Archive for Microsoft

Infographic: A Spectrum Of Microsoft’s Companies

Posted in Commentary with tags on February 18, 2021 by itnerd

Further information can be found here.

Microsoft Defender ATP is Detecting Yesterday’s Chrome Update As A Backdoor Trojan

Posted in Commentary with tags , on February 3, 2021 by itnerd

While there are some that say Google’s software is a backdoor to them gathering as much info on you as possible, this is the first time that I have ever heard of antivirus software actually flagging Google software as a backdoor trojan. Microsoft Defender Advanced Threat Protection (ATP), the commercial version of the ubiquitous Defender antivirus and Microsoft’s top enterprise security solution, is currently having a bad day and labeling yesterday’s Google Chrome browser update as a backdoor trojan:

The detections are for Google Chrome 88.0.4324.146, the latest version of the Chrome browser, which Google released last night. As per the screenshot [embedded in the linked story], but also based on reports shared on Twitter by other dismayed system administrators, Defender ATP is currently detecting multiple files part of the Chrome v88.0.4324.146 update package as containing a generic backdoor trojan named “PHP/Funvalget.A.” The alerts have caused quite a stir in enterprise environments in light of recent multiple software supply chain attacks that have hit companies across the world over the past few months. System administrators are currently awaiting a formal statement from Microsoft to confirm that the detection is a “false possitive” and not an actual threat.

The consumer version isn’t behaving the same way. Thus my assumption is that this is a mistake by Microsoft in terms of it’s detection engine and we should have official confirmation of that at some point. Until then, the safe thing to do is to wait until Microsoft comments publicly on this just in case it is a real threat.

SAP & Microsoft Expand Partnership

Posted in Commentary with tags , on January 22, 2021 by itnerd

 SAP SE (NYSE: SAP) and Microsoft Corp. announced plans to integrate Microsoft Teams with SAP’s intelligent suite of solutions. The companies also formalized an extensive expansion of an existing strategic partnership to accelerate the adoption of SAP S/4HANA® on Microsoft Azure. This builds on a joint commitment by the companies to simplify and streamline customers’ journeys to the cloud. 

Much has changed in the last year as work has become more virtual, increasing reliance on Microsoft Teams for meetings, communication and collaboration. To facilitate these business and societal changes, SAP and Microsoft are building new integrations between Microsoft Teams and SAP solutions, such as SAP S/4HANA, SAP® SuccessFactors® offerings, and SAP Customer Experience. This can enable innovation, increase employee productivity and engagement, deliver collaborative learning and support global growth. These integrations are planned for delivery in mid-2021.

The companies also are expanding their endorsed cloud partnership announced in 2019 to introduce new offerings in cloud automation and integration for SAP S/4HANA on Microsoft Azure. Together, Microsoft and SAP are expanding the ability to run a mission-critical intelligent enterprise on Azure while helping customers modernize their enterprise applications. SAP and Microsoft will provide customers with:

  • Simplification when moving on-premise editions of SAP ERP to SAP S/4HANA in the cloud. In addition to the industry-specific journey maps to the cloud and reference architectures, SAP and Microsoft will continue to co-innovate around SAP S/4HANA on Azure.
  • Expanded joint engagements with customers and partners. In addition to product integration work, SAP, Microsoft and system integrator partners will continue to provide digital enterprise road maps for customers. This includes immediate and actionable reference architectures and technical guidance to help customers on their journey to the cloud. 
  • Increased investments in platform and infrastructure. The companies will further develop automated migrations, improved operations, monitoring and security.

Customers broadly favor Azure when moving on-premise SAP S/4HANA to the cloud.

SAP’s endorsement of Azure for ERP cloud migration is reflected in positive customer feedback on the collaboration between the companies. SAP and Microsoft will continue to make migration simpler and increase customers’ confidence in running their digital enterprises in the cloud. At the same time, many customers express a desire to maintain multi-cloud environments. SAP continues with its long-standing policy of supporting choice for those customers who request alternatives based on business requirements.

SAP and Microsoft recently announced an update to enable customers to design and operate intelligent digital supply chain and Industry 4.0 solutions in the cloud and at the edge.

A Bug In Microsoft’s NTFS Filesystem Can Corrupt Your Hard Drive In Epic Fashion

Posted in Commentary with tags on January 15, 2021 by itnerd

Well, this isn’t good. An unpatched zero-day that was originally found in Microsoft Windows 10 allows attackers to corrupt an NTFS-formatted hard drive with a one-line command:

In August 2020, October 2020, and finally this week, infosec researcher Jonas L drew attention to an NTFS vulnerability impacting Windows 10 that has not been fixed. When exploited, this vulnerability can be triggered by a single-line command to instantly corrupt an NTFS-formatted hard drive, with Windows prompting the user to restart their computer to repair the corrupted disk records. The researcher told BleepingComputer that the flaw became exploitable starting around Windows 10 build 1803, the Windows 10 April 2018 Update, and continues to work in the latest version. What’s worse is, the vulnerability can be triggered by standard and low privileged user accounts on Windows 10 systems. […] It is unclear why accessing this attribute corrupts the drive, and Jonas told BleepingComputer that a Registry key that would help diagnose the issue doesn’t work. 

One striking finding shared by Jonas with us was that a crafted Windows shortcut file (.url) that had its icon location set to C:\:$i30:$bitmap would trigger the vulnerability even if the user never opened the file! As observed by BleepingComputer, as soon as this shortcut file is downloaded on a Windows 10 PC, and the user views the folder it is present in, Windows Explorer will attempt to display the file’s icon. To do this, Windows Explorer would attempt to access the crafted icon path inside the file in the background, thereby corrupting the NTFS hard drive in the process. Next, “restart to repair hard drive” notifications start popping up on the Windows PC — all this without the user even having opened or double-clicked on the shortcut file.

This has been tested onWindows XP and the issue has been found there as well. Thus it appears to be an NTFS based issue as opposed to a Windows 10 issue. Microsoft is investigating this, but they need to have a rapid fix for this as a threat actor is going to be able to exploit this to cause chaos.

BREAKING: Microsoft Pwned By Russian Hackers…. Source Code Allegedly Viewed

Posted in Commentary with tags , on December 31, 2020 by itnerd

This isn’t a good way to end the year. The news is breaking that Microsoft has admitted that they were hacked as part of the huge Solarwinds hack. And the results are not good:

While the hackers, suspected to be working for Russia’s S.V.R. intelligence agency, did not appear to use Microsoft’s systems to attack other victims, they were able to view some Microsoft source code by hacking into an employee account, the company said.

Microsoft had previously said it was not breached in the attack, which compromised dozens of federal agencies, as well as corporations. Microsoft said its subsequent investigation revealed that the hackers were not able to access emails or its products and services, and that they were not able to modify the source code they viewed.

This is far from good. If the hackers saw source code, they could exploit it to attack anyone with a Microsoft OS or product installed. That’s pretty scary. I suspect that we’re going to find out more details about this in the coming days. And those details will send chills down the spines of security experts everywhere.

Microsoft Class Action Settlement Is Available In Canada….. This Is Not A Joke

Posted in Commentary with tags , on December 15, 2020 by itnerd

An unexpected new National Class Action Settlement has been announced. From a consumer standpoint, it is the single largest class action in the history of Canada. Naturally, many are questioning if this is indeed a legitimate campaign. The answer is a resounding yes after doing some research on this.

Here’s the deal.

As part of a nation-wide legal settlement, Microsoft has agreed to reimburse Canadians for their old PC software. If you bought PC versions of eligible Microsoft software, like Windows, Office, Word, Excel, or MS-DOS between 1998 and 2010, you should be eligible for compensation. You could receive up to $250 in cash for individual licences or up to $650 in vouchers for Volume Licences, without proof of purchase. All you need to do is fill out the online claim form and attest it to be true.

Microsoft denies any wrong-doing and has not admitted liability.

Canadians are invited to visit to see if they meet the criteria for eligibility. If they do, a claim must be submitted by September 23, 2021.

UPDATE: Some people asked for some more detail. So here it is. The class-action lawsuit alleged that Microsoft and Microsoft Canada were involved in a conspiracy to illegally increase prices for the company’s products. Microsoft agreed to the settlement but denies any wrongdoing and has not admitted liability.

Microsoft Will Start Force Upgrading Windows 10 For Some Users…. WTF?

Posted in Commentary with tags on December 11, 2020 by itnerd

Microsoft really won’t let forcing its users to run the versions of Windows it wants them to use go. Now they are apparently going to force feed Windows updates down their throats:

Starting this month, Microsoft will begin forcing some users to upgrade to Windows 10 version 1909 or version 2004 if they don’t update their PC manually. This is coming after Microsoft announced that it’s ending support for Windows 10 version 1903, including Windows 10 Home and Windows 10 Pro. If you’re on Windows 10 version 1903, you’ll be force upgraded to version 1909 later this month. If you’re on Windows 10 version 1909, you’ll be forcefully upgraded to Windows 10 version 2004 (May 2020 Update) by the spring of next year. If you’re still using last year’s Windows 10 versions, it’s better to attempt the upgrade manually.

While I will admit that that some people don’t keep up to date in terms of the latest version of Windows they should be running, some people make a choice to run a specific version of Windows because of the hardware or software that they run. Microsoft is effectively taking that choice away from users which I think is wrong. This is the sort of thing that sends people to Apple Stores to buy Macs in droves. Microsoft may want to keep that in mind and reconsider this move.

Microsoft Adds A “Feature” To Track Users In Corporate Environments…. And The Reaction Is Pretty Much What You’d Expect

Posted in Commentary with tags on December 2, 2020 by itnerd

Microsoft in their infinite wisdom decided to a feature in some of their Office 365 apps that logged app usage data at a user level. They claimed enterprise customers could use the data to measure both the productivity and influence of their employees. The Guardian summed this feature up this way:

Microsoft has been criticised for enabling “workplace surveillance” after privacy campaigners warned that the company’s “productivity score” feature allows managers to use Microsoft 365 to track their employees’ activity at an individual level.

The tools, first released in 2019, are designed to “provide you visibility into how your organisation works”, according to a Microsoft blogpost, and aggregate information about everything from email use to network connectivity into a headline percentage for office productivity.

But by default, reports also let managers drill down into data on individual employees, to find those who participate less in group chat conversations, send fewer emails, or fail to collaborate in shared documents.

Researcher Wolfie Christl says this is problematic:

Needless to say, the blowback to this was epic as this is a significant privacy issue. And to nobody’s surprise, Microsoft has now yanked user level data according this blog post:

We appreciate the feedback we’ve heard over the last few days and are moving quickly to respond by removing user names entirely from the product. This change will ensure that Productivity Score can’t be used to monitor individual employees. At Microsoft, we’re committed to both data-driven insights and user privacy. We always strive to get the balance right, but if and when we miss, we will listen carefully and make appropriate adjustments.

We’re making the following changes to Productivity Score:

First, we’re removing user names from the product. During preview, we added a feature that showed end-user names and associated actions over a 28-day period. In response to feedback over the last week, we’re removing that feature entirely. Going forward, the communications, meetings, content collaboration, teamwork, and mobility measures in Productivity Score will only aggregate data at the organization level—providing a clear measure of organization-level adoption of key features. No one in the organization will be able to use Productivity Score to access data about how an individual user is using apps and services in Microsoft 365.

Second, we’re modifying the user interface to make it clearer that Productivity Score is a measure of organizational adoption of technology—and not individual user behavior […]

The remaining three measures in the product— Microsoft 365 App health, network connectivity, and endpoint analytics—don’t include user names. 

I am not sure if this is enough. I can see scenarios where some data could still be tied back to specific individuals seeing as it includes device identifiers. So I fully expect this to continue to be an issue that Microsoft will have to deal with.

rag & bone & Microsoft Create A Virtual World That Challenges The Status Quo

Posted in Commentary with tags on September 29, 2020 by itnerd

rag & bone unveils a preview of its Spring/Summer 2021 collection with a dynamic teaser film, Metamorphosis, created in partnership with Microsoft. Metamorphosis explores new ways of bringing collections to life through the integration of innovative technology.

Metamorphosis is a special stand-alone collaboration that spans the creative worlds of design, technology, and filmmaking to bridge the authentic craft of rag & bone with technology to reveal elements from the collection. Creating the unexpected between rag & bone and Microsoft began with the Spring/Summer 2020 show, which featured real time point cloud data capture technology. The partnership will continue into 2021 with concepts aimed at simplifying how consumers digitally engage with rag & bone collections.

Set in a fantastical vision of New York, Metamorphosis represents a virtual transformation of movement, fabric detail and the versatility of rag & bone signatures. Through the use of Azure Virtual Machines for Cloud Rendering, classic outerwear, feminine meets masculine silhouettes, relaxed tailoring, and easy to wear essentials are mixed and matched to redefine an everyday wardrobe.

Created remotely on the Cloud and supported by Azure Virtual Machines, an avatar figure was generated to capture key looks in the collection. Through a variety of camera movements and atmospheric plays on light and dimension, the avatar explores a New York City that shifts perspectives of space and dimension. Each small and highly defined detail in the looks are created on the cloud using Microsoft Azure Solutions. Additionally, Microsoft Azure allows for powerful remote GPUs and other services that optimize the output of a virtual rag & bone collection. 3D software was utilized to run virtually in the cloud to facilitate direct renders of each piece featured in the teaser to cloud GPUs. A musical arrangement by DJ Kris Bones was created to round out the film’s surreal and imagined landscapes.

Available to view from today, Metamorphosis launches across rag & bone and Microsoft’s channels worldwide. A new set of look book imagery featuring expanded looks from Metamorphosis will accompany the film’s debutThrough a virtual articulation of how Cloud Computing has shaped the ways in which fashion can be interpreted, the partnership with Microsoft highlights rag & bone’s ongoing commitment to creating digital first experiences that are uniquely their own.

Microsoft Gaming Exec Files Court Document Supporting Epic Games

Posted in Commentary with tags , on August 24, 2020 by itnerd

One of the things that is at the center of the Epic Games vs. Apple battle is that the Unreal Engine that is used by many third party developers use. Apple has threatened to cut off access to their development tools, and this if acted upon will end up having these third party developers being collateral damage in this fight as it would leave developers who have nothing to do with this fight unable to use the Unreal Engine as it would not be updated. Now I’ve said that this is an unforced error by Apple, and it seems that Microsoft agrees. Microsoft gaming executive Kevin Gammill wrote this [Warning: PDF]:

“Apple’s discontinuation of Epic’s ability to develop and support Unreal Engine for iOS or macOS will harm game creators and gamers.”

And Microsoft has a stake in this. Microsoft’s own racing game Forza Street for iPhone and iPad use the Unreal Engine. And by not having access to it will put game makers who use the Unreal Engine at a disadvantage according to Gammill. And the fact that he would file a court document like this to put this on record says something. That will get the attention of both those in the legal community, and those in the political space. Something that will ultimately come back to haunt Apple. If I were them, I would be rethinking this strategy. Because if they don’t, it won’t end well for them.