The IT Nerd

Microsoft is getting ready to send reminders to Windows 8.1 users that support will end on January 10th 2023. Which is the same strategy that they used with Windows 7. What does that mean for you? Microsoft has a webpage here that has a FAQ which spells out what the end of support will means.

My advice is that if you’re still on Windows 8.1, or Windows 7 for that matter, you should be looking towards upgrading to a Windows 11 (or Windows 10) PC as that will provide you with a safer and more secure platform to do whatever it is that you need your computer to do. Because holding on to any computer that runs an earlier Microsoft OS really isn’t a good idea.

Are you having trouble with Microsoft Office365 this morning? If so, you’re not alone as it appears to be having issues. Users have been reporting the following:

• Being asked to relogin to their accounts
• Emails stuck in queues and not getting delivered
• Not being able to access their Exchange Online mailboxes via any connection method they tried. 

Microsoft has seemed to admit that there’s a problem.

I’ve done some testing with a couple of Office365 accounts and I only have issues with one of them. So this is a thing quite clearly. I’ll be keeping an eye on this as this is possibly going to impact a large number of people.

I’ve been delaying writing about this until I could get some more information about this zero day exploit, and mitigation strategies for it. Let’s start with the exploit.

Researchers warned last weekend that a flaw in Microsoft’s Support Diagnostic Tool could be exploited using malicious Word documents to remotely take control of target devices. Here’s some details:

On May 27, a researcher who uses the online moniker “nao_sec” reported on Twitter that they had found an interesting malicious document on the VirusTotal malware scanning service. The malicious Word file, uploaded from Belarus, is designed to execute arbitrary PowerShell code when opened.

The malware was later analyzed by several others, including researcher Kevin Beaumont, who published a blog post detailing his findings on Sunday.

“The document uses the Word remote template feature to retrieve a HTML file from a remote webserver, which in turn uses the ms-msdt MSProtocol URI scheme to load some code and execute some PowerShell,” Beaumont explained, adding, “That should not be possible.”

The researcher noted that the code is executed even if macros are disabled — malicious Word documents are typically used for code execution via macros. Microsoft Defender currently does not appear to be capable of preventing execution.

“Protected View does kick in, although if you change the document to RTF form, it runs without even opening the document (via the preview tab in Explorer) let alone Protected View,” Beaumont said.

The researcher decided to name the zero day vulnerability “Follina” because the malicious file references 0438, which is the area code of Follina, a village in Italy.

This is now being tracked as CVE-2022-30190. Currently there is no fix for it that Microsoft has issued. But they offer guidance for mitigation. That all sounds good, but here’s the bad news. This appears to be actively being exploited by threat actors and Microsoft may have been asleep at the switch:

The Microsoft Support Diagnostic Tool vulnerability was reported to Microsoft on April 12 as a zero-day that was already being exploited in the wild, researchers from Shadow Chaser Group said on Twitter. A response dated April 21, however, informed the researchers that the Microsoft Security Response Center team didn’t consider the reported behavior a security vulnerability because, supposedly, the MSDT diagnostic tool required a password before it would execute payloads.

On Monday, Microsoft reversed course, identifying the behavior with the vulnerability tracker CVE-2022-30190 and warning for the first time that the reported behavior constituted a critical vulnerability after all.

That’s bad on Microsoft’s part. Really bad.

My advice is that you should follow Microsoft’s guidance for this to mitigate the issue until a fix appears. Because if there is no fix, and it’s actively being exploited by threat actors, it’s only a matter of time before there is widespread pwnage.

The Microsoft 365 Defender Research Team has come across a new type of Linux trojan combining denial-of-service functionality with XOR-based encryption for communication. And there’s a massive increase on how often it’s been seen:

In the last six months, we observed a 254% increase in activity from a Linux trojan called XorDdos. First discovered in 2014 by the research group MalwareMustDie, XorDdos was named after its denial-of-service-related activities on Linux endpoints and servers as well as its usage of XOR-based encryption for its communications.

Here’s how it works:

XorDdos’ modular nature provides attackers with a versatile trojan capable of infecting a variety of Linux system architectures. Its SSH brute force attacks are a relatively simple yet effective technique for gaining root access over a number of potential targets.

Adept at stealing sensitive data, installing a rootkit device, using various evasion and persistence mechanisms, and performing DDoS attacks, XorDdos enables adversaries to create potentially significant disruptions on target systems. Moreover, XorDdos may be used to bring in other dangerous threats or to provide a vector for follow-on activities.

Microsoft sums it up how to defend yourself this way:

Defenders can apply the following mitigations to reduce the impact of this threat:

• Encourage the use of Microsoft Edge—available on Linux and various platforms—or other web browsers that support Microsoft Defender SmartScreen, which identifies and blocks malicious websites, including phishing sites, scam sites, and sites that contain exploits and host malware.
• Use device discovery to find unmanaged Linux devices on your network and onboard them to Microsoft Defender for Endpoint. 
• Turn on cloud-delivered protection in Microsoft Defender Antivirus or the equivalent for your antivirus product to use cloud-based machine learning protections that can block a huge majority of new and unknown variants. 
• Run EDR in block mode so that Microsoft Defender for Endpoint can block malicious artifacts, even when your non-Microsoft antivirus doesn’t detect the threat or when Microsoft Defender Antivirus is running in passive mode.
• Enable network protection to prevent applications or users from accessing malicious domains and other malicious content on the internet. 
• Enable investigation and remediation in full automated mode to allow Microsoft Defender for Endpoint to take immediate action on alerts to resolve breaches, significantly reducing alert volume. 

Clearly cross platform threats are real. Which means that you have to have a cross platform security. And the days of Linux being secure because nobody targets that platform are over.

Microsoft has announced that later this year, users will be required to connect to the internet and sign-in with a Microsoft Account during the out of box setup experience on Windows 11 Pro. The news comes via a change log in the latest Windows 11 preview build:

Similar to Windows 11 Home edition, Windows 11 Pro edition now requires internet connectivity during the initial device setup (OOBE) only. If you choose to setup device for personal use, MSA will be required for setup as well. You can expect Microsoft Account to be required in subsequent WIP flights.

Now if you’ve got Windows 11, you needed to do this. Which is one reason why I haven’t moved my production computer to Windows 11 yet. But this is going to tick off users for the following reasons:

• If you don’t want to use a Microsoft account to use Windows 11, and there are many who don’t, this will tick you off.
• If you want to use Windows 11 in a completely “air-gapped” environment. Meaning that you want to set it up and use it completely off the Internet for security reasons, that’s a non-starter.

Now why don’t I want to use a Microsoft account? With my personal computers running Windows 10, I skip setting up a Microsoft Account and setup a local account instead using this workaround as this isn’t the first time Microsoft has tried something like this, and I prefer local accounts over ones that talk to Microsoft. Call me paranoid. Then I leave it like that. On the shipping build of Windows 11, it was relatively easy to bypass the internet requirement on Windows 11 Home. But in this build of Windows 11, this workaround no longer works. And seeing as this is in a development build, it means that this will make it into shipping versions of Windows sometime this year. Infuriating users in the process.

Microsoft should get ready for the blowback. Because it’s coming.