November 2018 Update Summary

Yesterday Microsoft and Adobe published their routine monthly updates resolving 62 and 3 vulnerabilities (more formally known as CVEs (defined)) respectively. More information is available from Microsoft’s monthly summary page and Adobe’s blog post.

Microsoft’s updates also come with a list of Known Issues that will be resolved in future updates. They are listed below for your reference:




KB4467702 (file type association issue to be resolved later in November 2018)


As summarized above; Adobe issued 3 updates for the following products:

Adobe Acrobat and Reader: Priority 1: Resolves 1x Important CVE (see also this page for a Windows 10 additional mitigation)

Adobe Flash Player: Priority 2: Resolves 1x Important CVE

Adobe Photoshop CC: Priority 3: Resolves 1x Important CVE

As per standard practice if you use any of the above Adobe software, please update it as soon as possible especially in the case of Acrobat DC and Reader DC due to the public proof of concept code released.

You can monitor the availability of security updates for most your software from the following websites (among others) or use one of the utilities presented on this page:

US Computer Emergency Readiness Team (CERT) (please see the “Information on Security Updates” heading of the “Protecting Your PC” page):

A further useful source of update related information is the Calendar of Updates.

News/announcements of updates in the categories of General SoftwareSecurity Software and Utilities are available on their website. The news/announcements are very timely and (almost always) contain useful direct download links as well as the changes/improvements made by those updates (where possible).

If you like and use it, please also consider supporting that entirely volunteer run website by donating.

For this month’s Microsoft updates, I will prioritize the order of installation below:
Microsoft Edge and Internet Explorer (multiple versions of Edge and IE affected)

Windows Kernel (a zero day (defined) vulnerability in Windows Server 2008, Server 2008 R2 and Windows 7)

Microsoft Dynamics 365

Windows Deployment Services (if used within your organization)

Microsoft Office (11x CVEs + 3x further CVEs in Office SharePoint)

Windows VBScript

Microsoft Graphics Component

Microsoft Bitlocker

Please install the remaining updates at your earliest convenience.

As usual; I would recommend backing up the data on any device for which you are installing updates to prevent data loss in the rare event that any update causes unexpected issues. I have provided further details of updates available for other commonly used applications below.

Please find below summaries of other notable updates released this month.

Thank you.

Nvidia Graphics Drivers:
A low severity vulnerability (this is a local rather than a remotely exploitable vulnerability) with a CVSS V3 (defined) base score 2.2 had been found within Nvidia’s graphics card drivers (defined). At the time of writing no fix is yet available but will address it in a future driver release. Please monitor their security advisory for further updates.

PortSmash Vulnerability: What you need to know

Security researchers have released details of a new side channel attack known as “PortSmash” that can be used to steal information from processes running inside a computer systems CPU (defined)) when Intel Hyperthreading (HT)(defined here and here) is enabled. Their proof of concept allowed them to steal a private decryption from a thread running in the same core as their exploit. This thread belonged to an OpenSSL process.

How severe is this vulnerability?
It has been designated as CVE-2018-5407 and assigned a base score of 4.8 (medium severity) on the CVSS v3 scale (defined) with a high attack complexity and with only low privileges required. The attack cannot be exploited remotely. An attacker must have been able to compromise your system via another means most likely a phishing email (social engineering)(phishing: defined; social engineering: defined), accidentally clicking a malicious link or a drive by download (defined). The attacker will also still need to have their code running within the same core as the data/code they wish to obtain. Similar to Spectre; multi-tenant cloud environments are more at risk.

Red Hat’s security advisory states “In order to exploit this flaw, the attacker needs to run a malicious process on the same core of the processor as the victim process”. PortSmash is fundamentally different from Meltdown and Spectre vulnerabilities; it does not rely on speculative execution.

Collin Percival, a Computer Scientist summed up the attack as follows:

“I’ve been getting a few questions about the recent “PortSmash” vulnerability announcement. Short answer: This is not something you need to worry about. If your code is vulnerable to it, you were already vulnerable to other (easier) attacks.

He advises that users don’t need to worry about it and states: “the defence against microarchitectural side channel attacks from 2005: Make sure that the cryptographic key you’re using does not affect the sequence of instructions or memory accesses performed by your code”.

How does this vulnerability work?
When a thread (defined) is carrying out some work it has its own instructions (what to do) and data (the objects to work on) but it will share some of its hardware resources with another process operating on a collocated thread.

The attackers can obtain information about the decryption key by analysing how fast the (process) thread within the CPU is operating with particular assembly language (defined) instructions and uses that information to work backwards (reverse engineering) on what possible data was used as the input to achieve this data now being processed. In this case the data is a private decryption key (defined).

Explained another way: This attack uses instruction timing (how long it takes to process) based on port contention. Each core of a CPU has physical regions known as ports which carry out the necessary calculations. If two or more threads are processing at the same they may have to wait on each other to use those regions of the CPU.

PortSmash seeks to monopolise a port which is being shared with a thread with information the attack wishes to obtain. They can measure the time taken between instructions of the attackers thread and the legitimate thread (thus determining how long the legitimate thread spend processing). This will help to obtain the data being processed over a long period of time

PortSmash is a side channel attack meaning that the attacker doesn’t immediately find out the protected/secret value immediately; instead the attack seeks out information from the other thread running within the CPU for information on the secret value being processed.

The proof of concept code targeted OpenSSL but is not limited to just that software. OpenSSL was targeted due to the researcher’s familiarity with the OpenSSL code.

What CPUs are affected by this vulnerability?
The researchers verified that this vulnerability is present on Intel Skylake CPUs (6th generation Core models e.g. i7 6700K). However any Intel CPU which implements HT is likely to have this vulnerability. Intel’s Nehalem architecture first introduced HT in 2008. The researchers believe AMD Ryzen CPUs may be affected but did not confirm this.

How can I protect myself from this vulnerability?
OpenSSL have added a fix to version 1.1.1 and older versions greater than version 1.1.0i (Source)

However the only true means of mitigating this vulnerability for all software is to disable Intel’s HT. The operating system distribution OpenBSD has done so since June this year. Similarly Intel within their new 9th generation Core CPUs disabled HT to enable hardware protections against the Meltdown, Spectre and L1 Terminal Fault vulnerabilities. They did so to their gaming focused CPUs since many games don’t leverage HT and thus don’t suffer a performance penalty from not using it. It doesn’t appear that HT was removed for security concerns since the Core i9 9900K still features it.

Since corporate organizations may have invested in software that uses HT; they should only consider turning it off if continuing to use it places them at a high risk of exploitation and would place them outside of what they consider an acceptable risk. They will then need to consider the performance/security trade-off of doing so.

If you use Intel HT I would recommend testing your own software with this feature turned off to tell if it has too much of a performance penalty for your particular use cases. From researching this it is not a straightforward answer of turning it off and definitely not experiencing any slowdown; it may or may not happen depending on how you use your system and the software you use.

I have provided links to definitions of HT above and some references below which may assist you in making a decision to disable or leave it enabled. That research also pointed out that if you wish to disable HT; please do so from the BIOS (defined) of your computing system since it will have a blanket disablement across all software and your operating system. A software disablement can work but disabling via the BIOS leaves less room for error. Please refer to your system manufacturer or motherboard user guide for the steps to enter the BIOS of the system and disable this feature.

As more details of this vulnerability emerge I will consider disabling this feature on my water cooled Intel Core i9 7980XE CPU. Windows detects it with 36 logical cores; with HT disabled it will “drop” to 18 physical cores. I’ll need to evaluate the performance impact (if any) for my particular use cases. Given the attacker will need to already have compromised my system and the attack is of high complexity; it’s less likely I will need to disable HT. My existing security controls are more than enough to mitigate this risk; but your system, configuration and risk appetite may be different.

Thank you.



Why You Disable Hyper-Threading or NOT, and How to Know the Difference

Nehalem – Everything You Need to Know about Intel’s New Architecture



Performance-impact of Hyper-Threading:


Is Hyper-Threading a Fundamental Security Risk?

Why does disabling hyperthreading supposedly give better gaming performance? (This is again a gaming focused discussion but would be relevant for software that does not use HT):


Why on earth would you disable Hyperthreading? (This is a more gaming focused discussion but would be relevant for software that does not use HT. Please ignore the advert spam posts for software named CPUCores, it’s confirmedsnake oil”):


Retpoline To Improve Windows 10 Performance Following Spectre Vulnerability

Alex Ionescu, a Windows Internals expert and Security Architect with CrowdStrike in mid-October provided new insight into performance improvements coming to the next update of Windows, namely 19H1 or Version 1903:

With performance decreases estimated to be up to 30% in the worst-case scenarios while mitigating the Spectre vulnerabilities earlier this year; the upcoming version of Windows will add Google’s Retpoline instructions to improve performance:

Such instructions are already present in Red Hat, SUSE and Oracle Linux 6 and 7. Ionescu revealed that performance was significantly improved while trusting the newer version of Windows 10. Moreover; Spectre variant 2 (CVE-2017-5715) will now be fully mitigated even if your hardware was not updated to support indirect branch restricted speculation (IBRS); making it more secure. In his words “On systems without IBRS, Windows won’t flush the BPB on kernel->user transitions. This opens up a potential security issue for CPUs without microcode that implements IBRS”.

He also confirmed that Retpoline is enabled on systems with indirect branch prediction barrier (IBPB). This will protect such systems from kernel to user transitions where currently no protection exists. Finally he asked that Retpoline be back ported earlier (but currently supported) versions of Windows since systems without IBRS are “sitting ducks”:

These changes were also announced by a Microsoft engineer, Mehmet Iyigun working within the Windows and Azure kernel team.

In April 2019 we can look forward to a more secure and faster version of Windows. I’m particularly pleased to learn this since my water cooled Intel processor; an 18 core (36 thread) Core i9 7980XE has received full protection from Spectre in the form of IBRS and IBPB from the motherboard vendor. Performance impact has been minimal but any increase in performance is welcomed for my donations to Stanford’s Folding@Home project.

More info on IBRS and IBPB is available from this link. Thank you.

Windows Data Sharing Service Zero Day Disclosed

In late October, a new Windows zero day vulnerability (defined) was publicly disclosed (defined) by the security researcher SandboxEscaper (the same researcher who disclosed the Task Scheduler zero day in early September. This vulnerability affects a Windows service; Data Sharing Service (dssvc.dll) present in Windows 10 and its Server equivalents 2016 and 2019. Windows 8.1 and Windows 7 (and their Server equivalents (Windows Server 2008 R2, Windows Server 2012 R2) are not affected.

How severe is this vulnerability and what is its impact?
Similar to the Task Scheduler vulnerability; this vulnerability is not remotely exploitable by an attacker (more on this below). This vulnerability should be considered medium but not critical severity. When exploited it can allow an attacker to delete any files they choose since they will inherit the same level of permission (privilege escalation)(defined) as the Data Sharing Service namely LocalSystem privileges (the highest level of privilege)(defined) but they cannot initiate this automatically/remotely. They must socially engineer a potential victim into opening an attachment (most likely sent over email or via instant messaging etc.).

As with the Task Scheduler vulnerability; this vulnerability may be leveraged in the wild before it is patched by Microsoft; this is my reason for advising exercising caution with email and clicking unexpected links.

While security researchers such as Will Dorman (mentioned above) and Kevin Beaumont were successful in verifying the proof of concept code worked. They class the vulnerability difficult to exploit. This was verified by Acros Security CEO Mitja Kolsek noting he could not find a “generic way to exploit this for arbitrary code execution.” Indeed, SandboxEscaper described the vulnerability as a low quality bug (making it a “pain” to exploit). Tom Parson’s from Tenable (the vendor of the Nessus vulnerability scanner) summed it nicely stating “to put the threat into perspective, an attacker would already need access to the system or to combine it with a remote exploit to leverage the vulnerability”.

The vulnerability may allow the attacker to perform DLL hijacking (defined) by deleting key system DLLs (defined) and then replacing them with malicious versions (by writing those malicious files to a folder they have now have access to). Alternatively this functionality could be used to make a system unbootable by for example deleting the pci.sys driver. This has earned the vulnerability the name “Deletebug.”

How can I protect my organization/myself from this vulnerability?
As before with the Task Scheduler vulnerability; please continue to exercise standard vigilance in particular when using email; e.g. don’t click on suspicious links received within emails, social media, via chat applications etc. Don’t open attachments you weren’t expecting within an email (even if you know the person; since their email account or device they access their email from may have been compromised) and download updates for your software and devices from trusted sources e.g. the software/device vendors. This US-CERT advisory also provides advice for safely handling emails.

If you choose to; the firm 0patch has issued a micro-patch for this vulnerability. They developed the fix within 7 hours of the vulnerabilities disclosure. It blocks the exploit by adding impersonation to the DeleteFileW call. This was the same firm who micro-patched the recent Windows Task Scheduler vulnerability and JET vulnerabilities. Moreover; this vulnerability may be patched tomorrow when Microsoft releases their November 2018 updates.

As with the above mitigations; if you wish to deploy this micropatch please test how well it works in your environment thoroughly BEFORE deployment.

It can be obtained by installing and registering 0patch Agent from Such micropatches usually install and need no further action when Microsoft officially patches the vulnerability since the micropatch is only active when a vulnerable version of the affected file is used; once patched the micropatch has no further effect (it is then unnecessary).

Thank you.

TLS 1.0 and 1.1 Upcoming End of Support Announced

Early last week saw a coordinated effort from almost major browser vendor to follow the guidelines of the PCI-DSS standard and to end support for TLS 1.0 and 1.1

Why should this change be considered relevant?
Each of the browser vendors have worked together to create a definite timeline (starting in 2020 and complete by July 2020) for the end of support of these now obsolete security protocols. TLS 1.0 is almost 20 years old and is no longer PCI-DSS compliant.  Separately TLS 1.1 is more than 10 years old. They both contain known vulnerabilities e.g. BEAST (an attack), DROWN or FREAK (both downgrade attacks) etc. use insecure hash functions (e.g. MD5 and SHA-1) and receive very little use today:

0.4% from Apple Safari (<0.36% for all connections) (Source: WebKit)

0.5% for Google Chrome (Source: Google)

1.2% of Firefox Beta 62 during the time August-September 2018 (Source: Mozilla)

0.72% for Microsoft Edge (Source: Microsoft)

More modern standard e.g. TLS 1.2 offers improved performance when used with HTTP/2 and are PCI-DSS compliant. Moreover, it doesn’t suffer from all of the vulnerabilities affecting prior versions and includes stronger alternatives to older hash functions e.g. ECDHE_RSA_WITH_AES_128_GCM_SHA256 .

What does the future hold?
Following the recent deprecation of any standard of TLS older than 1.2 on the 30th of June this year due to the mandate set by the PCI Security Standard Council has steadily seen the increase of the recently ratified TLS 1.3 (in April 2018) but defined within (Request for Comments) RFC 8446 in August. This is in part due to a change by Mozilla to Firefox in April and the adoption of the newest standard by some popular websites e.g.:

Google’s Gmail (although the newer standard isn’t always enabled) (which also includes this blog you are reading!)

The OpenSSL Foundation added full TLS 1.3 support to their popular cryptographic library OpenSSL with the release of version 1.1.1 in September 2018. OpenSSL are further driving adoption of the newest standard by ending support for the current long term support (LTS) version 1.0.2 by the end of 2019 (with it only receiving security updates after the 31st December 2018).

The increase in traffic is best illustrated by Mozilla showing approaching 6% usage for Firefox Beta 62 during the time August-September 2018. Such an increase is really good news for the security of the Internet specifically any online service that requests personal information and e-commerce websites in particular.

For more information on which web browsers support TLS 1.3, please see this link with a table from Salesforce illustrating browser support for TLS 1.2 here.

Thank you.

WD Releases My Cloud NAS Firmware Updates

In the first half of 2017 I posted about vulnerabilities being publically (defined) within Western Digital (WD) My Cloud NAS devices. This vulnerability was designated as CVE-2018-17153 (defined).

Why should this vulnerability be considered important?
The vulnerability is relativity easy for an attacker to exploit without them needing to authenticate/login to the device. They need only to set the username=admin’ cookie to obtain admin/privileged access to the device due to a network CGI (defined) module containing a command that begins an administrative session tied to the IP address of the device but the attacker must first set bind the admin session to the IP address. They only then need to call the remote system and authenticate using the cookie with the value set (as detailed above).

Of even more concern than above; an attacker could leverage this vulnerability using a CSRF (CSRF, defined here and here)) attack within a malvertising (malicious adverts) (defined) campaign allowing them to compromise WD devices which are not connected to the internet. Separately; there was more than security researcher who discovered this vulnerability; I previously mentioned a researcher by the name of Zenofex; who not only contacted WD but the company refused to acknowledge r fix the issues raised. The group Zenofex is part of disclosed the vulnerability (along with other security concerns) during the Def Con security conference in 2017 and created a Metasploit module (defined). In mid-September it was estimated that there were more than 1,800 vulnerable WD devices visible online.

How can I protect myself from this vulnerability (and the other security concerns raised)?
If you own any of the devices listed below; please follow the links below to download and install updated firmware using the steps that WD provides:

Many thanks to for these convenient links.


The firmware updates resolve many than the vulnerability discussed above (the updated OpenSSL, OpenSSH, jQuery and libupnp will also have significant security improvements). For example, please find below the list for the “My Cloud FW 2.31.149”:

Security Fixes

  • Resolved multiple command injection vulnerabilities including CVE-2016-10108 and CVE 2016-10107.
  • Resolved multiple cross site request forgery (CSRF) vulnerabilities.
  • Resolved a Linux kernel Dirty Cow vulnerability (CVE-2016-5195).
  • Resolved multiple denial-of-service vulnerabilities.
  • Improved security by disabling SSH shadow information.
  • Resolved a buffer overflow issue that could lead to unauthenticated access.
  • Resolved a click-jacking vulnerability in the web interface.
  • Resolved multiple security issues in the Webfile viewer on-device app.
  • Improved the security of volume mount options.
  • Resolved leakage of debug messages in the web interface.
  • Improved credential handling for the remote MyCloud-to-MyCloud backup feature.
  • Improved credential handling for upload-logs-to-support option.

Components Updated

  • Apache – v2.4.34
  • PHP – v5.4.45
  • OpenSSH – v7.5p1
  • OpenSSL – v1.0.1u
  • libupnp – v1.6.25 (CVE-2012-5958)
  • jQuery – v3.3.1 (CVE-2010-5312)


If firmware is not yet present for your WD My Cloud NAS device, please follow the recommended steps from my previous post on WD My Cloud devices. Protecting these devices is especially important since NAS devices are often used for backups and to store precious/valuable data. Please also contact WD Customer Service to enquire about an update becoming available for your device.

Thank you.

APT28 Group Distributes First in the Wild UEFI Rootkit

In late September; researchers from the security/anti-malware firm Eset discovered the first UEFI (defined) rootkit (defined) being used in the wild (namely being present on computing devices used by the general public in their professional and personal lives).

The APT group known as APT28 (who we discussed before on this blog) has been named as being responsible for this advanced threat being distributed to victim systems located in the Central Europe, Eastern Europe and the Balkans.

Why should this threat be considered important?
While this threat is so far limited to targeting systems in Central Europe, Eastern Europe and the Balkans; it has the potential to set a precedent to dramatically increase the persistence of malware on selected systems. This is due to the fact that to save time malware removal usually involves re-installing the operating system. More advanced users may choose to re-create the MBR/GPT, replace the boot sector and rebuild the BCD. Even more informed users may replace the hard disk to remove the malware. This new threat is significant since all of these steps would not remove it.

Eset researchers discovered that the LoJack anti-theft software which was installed compromised systems was being leveraged to start the attacker’s malware instead by using the Windows registry (defined) to load files with very similar names to that of the legitimate LoJack software. They also located a kernel (defined) driver (defined) being used to write the systems firmware when required. Since this tool was a legitimate tool; it has a valid digital signature. This is significant; otherwise the attacker’s tool would not have worked on a 64 bit Windows system. Should attempts to write to the firmware fail, the malware uses a 4 year old vulnerability CVE-2014-8273 (a race condition (defined)) to bypass the write lock.

Once the firmware has been updated it replaces the original LoJack software files with hijacked versions designed to enable further persistence on the compromised systems, namely a backdoor (defined).

How can I protect myself against this threat?
While it is less likely a threat of this sophistication will become widespread; the steps below will help to defend you against this and similar threats in the future. How this threat establishes an initial foothold on a system was inconclusive by Eset. However exercising caution on the links you click in emails, IMs and social networking should provide some form of prevention. Keeping your system up to date should also prevent a drive by download (defined). However I will detail more specific defensive steps below:

Eset determined that this threat can be prevented from affecting a system by enabling the Secure Boot hardware security feature (if your system has this feature available; most systems manufactured from 2012 onwards do). Any system with a certified Windows 8 or Windows 10 badge on the outside will have Secure Boot enabled with no action required from you. Secure Boot works even better when paired with Intel BootGuard (corporate users are more likely to use/enable this feature).

If the rootkit had affected the system described above it would have then refused to boot due to Secure Boot being enabled. It’s important to clarify that Secure Boot won’t prevent the infection/tampering but it will prevent that tampering from starting the system for use as normal.

Secure Boot was added to Windows 8.0 in 2012 to prevent unsigned components (e.g. rootkits) from affecting a system so early in the boot process that anti-malware software would be unable to detect or prevent that component from obtaining a privileged level of access over the system.


Keeping the UEFI firmware of your system up to date will assist with resolving known vulnerabilities within the firmware. Patching known firmware vulnerabilities makes your system less vulnerable to low level attacks such as this. Please only install UEFI firmware updates from your system vendor. Check the vendor’s website or contact them to determine if you need a UEFI firmware update and how to install it. If possible/available verify the checksum (defined) of the file you download matches the vendors provided checksum. I use the word available above since not all vendors provide checksums of the firmware updates they distribute which would allow you to verify them.

More recent Intel motherboards (defined) are not vulnerable to the race condition by Eset in their paper (more details available here). These modern chipsets feature a Platform Controller Hub (present in Intel’s Series 5 chipsets and later (available circa 2010 onwards).

If you know of a system affected with such a low level threat you may be able to update the UEFI firmware with a known safe version from the vendor but this is not guaranteed to work. Replacing the hardware will be a more reliable alternative.

Thank you.