Status Updates

CISA Warns of Hurricane-Related Scams

CISA Warns of Hurricane-Related Scams
09/25/2024 08:00 AM EDT

CISA encourages users to review the following resources to avoid falling victim to malicious cyber activity:

1) Federal Trade Commission’s Staying Alert to Disaster-related Scams and Before Giving to a Charity,

2) Consumer Financial Protection Bureau’s Frauds and scams, and

3) CISA’s Phishing Guidance, Stopping the Attack Cycle at Phase One to help organizations reduce likelihood and impact of successful phishing attacks.

MspPortal Partners provides a solution that works with the Fortune 500 firms (PhishingBox) the best in the business.
If you are a partner with MspPortal Partners we will set up a full admin panel so you can protect your clients.

Roy Miehe | MspPortal Partners Inc. | Ceo/President
Security Software Distributor: Bitdefender , Barracuda, Phishing Simulation & Cyber Security Training
“Where Service and Technical Skills Count”

Market share held by the leading computer (desktop/tablet/console) operating systems worldwide from January 2012 to February 2024

Long Short if the statics are correct 68.15 percent of the world uses Microsoft OS’s

Published by
Ahmed Sherif,
May 22, 2024

Microsoft’s Windows is the most widely used computer operating system in the world, accounting for 68.15 percent share of the desktop, tablet, and console OS market in February 2024. Apple’s macOS ranks as the next most widely used operating system, while its iOS mobile operating system, the standard installation on all iPad devices, ranks fourth. Linux OS versions serve as the primary option for users who prefer open-source software and intend to avoid the influence of major OS developers.
Operating Systems

Operating systems serve as the underlying platforms which connect computer hardware and software. They provide users with the graphical interface through which they issue commands and perform tasks on electronic devices. Billions of people make use of these devices and their operating systems on a regular basis, meaning that the companies that develop these widely used technologies have a great deal of influence on the daily lives of internet users around the world. Although Microsoft Windows is the clear leader in terms of desktop operating systems,

Article
(https://www.statista.com/statistics/268237/global-market-share-held-by-operating-systems-since-2009/)

Which we are and still are dealing with having even more security issue’s because the CrowdStrike debacle
Based upon what I do for a living I see more Large Mega Cap Firms down to SMB firms struggling more then ever before.

Personally some attorney with a class action filed should request a huge Liquidated damages (LDs): Which is a sum of money specified in some contracts that are to be paid by one party to another as compensation for intangible losses.

Hopefully this will put huge firms like Crowdstrike, Microsoft, Cloudflare all on notice,if you are going to take money from clients/enduser you are responsible for damages and please do not try to hide behind a EULA..I still have not heard back about how many techs Crowdstrike or Microsoft were sending over to Delta Airlines,considering each machine had to be touched and continue to be touched since you cannot write a Power Shell Script nor remote to a machine, that is Blue Screened (BOD). There has been a lot of LIP SERVICE

Roy Miehe | MspPortal Partners Inc. | Ceo/President
Security Software Distributor: Bitdefender , Barracuda, Phishing Simulation & Cyber Security Training
“Where Service and Technical Skills Count

Continued from July 19th 3 Cause’s of the Crowdstrike down in reality

Keep in mind this is my personal opinion..please prove me wrong if you can.

3 Cause’s of the CrowdStrike down
1) Bad Developer file uploaded/downloaded
2) Microsoft Software runs the operating systems sort of like a monopoly, we all know it in reality it is.
3) Distribution of software via Cloudflare

Keep in mind this is my personal opinion..please prove me wrong if you can.

I read something today that shocked me. CloudStrike was going pay techs globally $10.00 coffee vouchers to remove sys file issue. I work with four hundred plus tech firms through out the US I have never heard of a computer Tech working for a $10.00 coffee voucher.
Normal Tech rates run from entry level $50.00 to $500.00 a hour.

(Bloomberg) — Microsoft Corp. said Delta Air Lines Inc. turned down repeated offers for assistance following last month’s catastrophic system outage, echoing claims by CrowdStrike Holdings Inc. in an increasingly contentious conflict between the carrier and its technology partners.
Now I am not a strong proponent of Ed Bastien (to full of himself) nor do I fly Delta.

If read/sift through all the garbage it really was all 3 firms that caused the outage.
No matter what OS Delta was running, Windows, Apple, Linux, The Falcon Platform runs on all 3. So in my opinion Delta does deserve the money for the down time.

Even thou in my opinion Mark S Cheffo when :“Even though Microsoft’s software had not caused the CrowdStrike incident, Microsoft immediately jumped in and offered to assist Delta at no charge,” I did not hear they were going to fly Techs to fix all Delta’s machines, for that matter globally let alone Delta

When does a end user or SMB company ever able to talk to Microsoft Support and receive a response within a reasonable amount of time?

So right now I see 2 parties at fault (Microsoft & CroudStrike)
But there is a 3rd party involved, CloudFlare, have you ever asked yourself what they do:Protecting it from online threats and optimizing performance there web Site.

Cloudflare is a company that provides services like content delivery network (CDN), cloud cybersecurity, DDoS mitigation, Domain Name Service (DNS), and domain registration. They help improve website speed, security, and reliability by acting as a mediator between a website’s server and its visitors, protecting it from online threats and optimizing performance.

Cloudflare
American internet infrastructure and website security company
cloudflare.com

Cloudflare, Inc. is an American company that provides content delivery network services, cloud cybersecurity, DDoS mitigation, Domain Name Service, and ICANN-accredited domain registration services. Cloudflare’s headquarters are in San Francisco, California. According to The Hill, Cloudflare is used by more than 20% of the Internet for its web security services, as of 2022. Wikipedia

Now all this is my opinion but should help create and finish a Class Action Law Suit, all 3 need to named as defendants.

Last Pay Your developers and Tech Support folks more money, Take it out of the C-Levels paychecks/bonuses. It appears that most firms have forgotten with out staff the company would be nothing.

Microsoft 365 suite status changed to WARN

warn status (MspPortalPartners Status Page)

Microsoft 365 suite is now WARN
Previous status was UP
Users’ file related operations may fail within various Microsoft 356 services
Title: Users’ file related operations may fail within various Microsoft 356 services User impact: Users’ file related operations may fail within various Microsoft 356 services. More info: The impacted scenarios may include but not are limited to the following: -Android and iOS users may be unable to preview Microsoft Word and Microsoft PowerPoint files within the Microsoft Teams mobile app -Users may be unable to open .zip downloads in Microsoft Teams. -Users may be unable to view PDF and image files shared with download disabled in Microsoft Teams desktop client and Microsoft Teams on the web. OneDrive for Business and SharePoint Online: -Users may be unable to view image files and HTML files in OneDrive for Business app and OneDrive for Business on the web. – Users may be unable to download folders from SharePoint Online. – Additionally users may experience issues with image viewing, video streaming, and multi-file download in SharePoint Online. – Users may be unable to play videos in Microsoft Stream Current status: We’re observing improvements in the affected functionalities after we reverted the impacting update, and we’re continuing to monitor for a period to ensure these problems are comprehensively resolved for all users. Scope of impact: Users who are attempting to perform file-related operations within various Microsoft 365 services may be impacted. Start time: Thursday, June 13, 2024, at 12:30 AM UTC Root cause: A deployment for one of our file operation services is causing impact. Next update by: Thursday, June 13, 2024, at 10:00 AM UTC

Bitdefender Changes access to Power user

Bitdefender recently made major changes to the Power User capability, and the main driver for this change is security. The 3rd party technology we use for PowerUser could pose some security risks in the future, and we had to act quickly to mitigate those risks. Also, the latest version of the technology is not compatible with any operating system before Windows 10, which does not fall in line with our target to offer backward compatibility.

Therefore, we’ve decided to provide a change which will let us continue PowerUser for all the supported operating systems. The new CLI will help us provide a lighter agent footprint, and much more precise control of all modules going forward.

We are currently working on adding new commands in PowerUser ComandLine to support additional actions and we plan to expend its coverage as we move forward.
Considering the feedback we recently received from some of our customers and partners, we also plan to release example scripts in our documentation, and allow the use of our existing Power User capability. It will be accessible only by running the process EPPowerConsole.exe directly, and it will be limited to Windows 10 and above operating systems.

An important project we have ongoing right now is the development of a new BEST GUI, which will offer some of the Power User capabilities in the endpoint GUI.
We aim to introduce as many settings as possible going forward on this new UI and CLI. Your feedback is most welcome, as it will determine what options will be available in the upcoming BEST GUI.”

I spoke to a nice gentleman in Romaina (BD Head Quarters, and he stated it had changed to only getting to it: By following these steps Windows/program Files/Bitdefender/endpoint security/ run as admin EPPowerConsole.exe-> then put the password in to bring up the UI. A little painful but secure

New Windows driver blocks software from changing default web browser

Must read article (https://www.bleepingcomputer.com/news/microsoft/new-windows-driver-blocks-software-from-changing-default-web-browser/)

By Lawrence Abrams April 7, 2024 10:17 AM
Microsoft is now using a Windows driver to prevent users from changing the configured Windows 10 and Windows 11 default browser through software or by manually modifying the Registry.

Windows users can still change their default browser through the Windows settings. However, those who utilized software to make the changes are now blocked by a driver quietly introduced to users worldwide as part of the February updates for Windows 10 (KB5034763) and Windows 11 (KB5034765).

IT consultant Christoph Kolbicz was the first to notice the change when his programs, SetUserFTA and SetDefaultBrowser, suddenly stopped working.

SetUserFTA is a command line program that lets Windows admins change file associations through login scripts and other methods. SetDefaultBrowser works similarly but is only for changing the default browser in Windows.

Starting with Windows 8, Microsoft introduced a new system for associating file extensions and URL protocols with default programs to prevent them from being tampered with by malware and malicious scripts.

This new system associates a file extension or URL protocol to a specially crafted hash stored under the UserChoice Registry keys.

If the correct hash is not used, Windows will ignore the Registry values and use the default program for this URL protocol, which is Microsoft Edge.

Kolbicz reverse engineered this hashing algorithm to create the SetUserFTA and SetDefaultBrowser programs to change default programs.

However, with the Windows 10 and Windows 11 February updates installed, Kolbicz noted that these Registry keys have now been locked down, giving errors when modified outside the Windows Settings.

For example, using the Windows Registry Editor to modify these settings gives an error stating, “Cannot edit Hash: Error writing the value’s new contents.”

BleepingComputer contacted Microsoft about the lockdown of these Registry keys in March, but they said they had nothing to share at this time.

Roy Miehe | MspPortal Partners Inc. | Ceo/President
Security Software Distributor: Bitdefender , Barracuda, Phishline Training
“Where Service and Technical Skills Count”

New Windows Server updates cause domain controller crashes, reboots

By Sergiu Gatlan March 20, 2024 04:40 PM 0

The March 2024 Windows Server updates are causing some domain controllers to crash and restart, according to widespread reports from Windows administrators.

Affected servers are freezing and rebooting because of a Local Security Authority Subsystem Service (LSASS) process memory leak introduced with the March 2024 cumulative updates for Windows Server 2016 and Windows Server 2022.

LSASS is a Windows service that enforces security policies and handles user logins, access token creation, and password changes.

As many admins have warned, after installing the KB5035855 and KB5035857 Windows Server updates released this Patch Tuesday, domain controllers with the latest updates would crash and reboot due to increasing LSASS memory usage.

“Since installation of the march updates (Exchange as well as regular Windows Server updates) most of our DCs show constantly increasing lsass memory usage (until they die),” one admin said.

“We’ve had issues with lsass.exe on domain controllers (2016 core, 2022 with DE and 2022 core domain controllers) leaking memory as well. To the point all domain controllers crashed over the weekend and caused an outage,” another one added.

“Our symptoms were ballooning memory usage on the lsass.exe process after installing KB5035855 (Server 2016) and KB5035857 (Server 2022) to the point that all physical and virtual memory was consumed and the machine hung,” one admin told BleepingComputer.

“The Support rep says they expect official comms to be announced from Microsoft soon.”
Temporary workaround available

Until Microsoft officially acknowledges this memory leak issue, admins are advised to uninstall the buggy Windows Server updates from their domain controllers.

“Microsoft Support has recommended that we uninstall the update for the time being,” the same admin told BleepingComputer.

To remove the troublesome updates, open an elevated command prompt by clicking the Start menu, typing ‘cmd,’ right-clicking the Command Prompt application, and then choosing ‘Run as Administrator.’

Next, run one of the following commands, depending on what update you have installed on your Windows domain controller:

wusa /uninstall /kb:5035855
wusa /uninstall /kb:5035857

Once uninstalled, you should also use the ‘Show or Hide Updates’ troubleshooter to hide the buggy update so it will no longer appear in the available updates list.

Microsoft addressed another LSASS memory leak affecting domain controllers in December 2022, when affected servers would freeze and restart after installing Windows Server updates released during the November 2022 Patch Tuesday.

In March 2022, Microsoft fixed one more LSASS crash, causing unexpected Windows Server domain controller reboots.

A Microsoft spokesperson could not immediately provide more details when contacted by BleepingComputer earlier today.

Article ( https://www.bleepingcomputer.com/news/microsoft/new-windows-server-updates-cause-domain-controller-crashes-reboots/)

Update Article 3-21-2024 (https://www.bleepingcomputer.com/news/microsoft/microsoft-confirms-windows-server-issue-behind-domain-controller-crashes/)

Roy Miehe | MspPortal Partners Inc. | Ceo/President
Security Software Distributor: Bitdefender , Barracuda, Phishline Training
“Where Service and Technical Skills Count”

TeamViewer abused to breach networks in new ransomware attacks

BEWARE a lot of RMM solutions use TV chnage you security logins

By Bill Toulas January 18, 2024 04:07 PM 3

Ransomware actors are again using TeamViewer to gain initial access to organization endpoints and attempt to deploy encryptors based on the leaked LockBit ransomware builder.

TeamViewer is a legitimate remote access tool used extensively in the enterprise world, valued for its simplicity and capabilities.

Unfortunately, the tool is also cherished by scammers and even ransomware actors, who use it to gain access to remote desktops, dropping and executing malicious files unhindered.

A similar case was first reported in March 2016, when numerous victims confirmed in the BleepingComputer forums that their devices were breached using TeamViewer to encrypt files with the Surprise ransomware.

At the time, TeamViewer’s explanation for the unauthorized access was credential stuffing, meaning the attackers did not exploit a zero-day vulnerability in the software but instead used users’ leaked credentials.

“As TeamViewer is a widely spread software, many online criminals attempt to log on with the data of compromised accounts, in order to find out whether there is a corresponding TeamViewer account with the same credentials,” explained the software vendor at the time.

“If this is the case, chances are they can access all assigned devices, in order to install malware or ransomware.”

Article (https://www.bleepingcomputer.com/news/security/teamviewer-abused-to-breach-networks-in-new-ransomware-attacks/)

Roy Miehe | MspPortal Partners Inc. | Ceo/President
Security Software Distributor: Bitdefender , Barracuda, Phishline Training
“Where Service and Technical Skills Count”
Cloud Services Status page (https://cloudstatus.mspportalpartners.net/)

MspPortal Partners New Product line for MspPortal Partners

Our New Phishing Line Product is like no other, combined with our Spam Filter Product you will have a 99% chance of protecting your network and your clients networks

1) An advanced email threat protection add-in for Microsoft 365 and Gmail.

It enables reporting phishing and other type of threats. Each inbox’s risk profile is unique and this plugin exposes tell tale signs of threats to your security

2) Helps users learn what to look

for using each email as a learning opportunity combined with security awareness training.

3) Addresses, Domains, Email Addresses, words, and other known threat types from different sources.

4) Pushes your endpoint protection even further and helps users better determine a real threat versus legitimate emails.

5) Phishing simulation:

Phishing simulation provides realistic emails to users to see if they react properly. When a user reports a simulated phishing email, it improves the organizations net reporter score Upon failure of a simulated phishing email, the organization can automatically enroll the user in remedial training.

1) MspPortal Partners Complete Email Protection

Backup and recovery for Exchange Online O365, GSuite

SharePoint, OneDrive, and Teams, Unlimited Storage, along with email archiving

2) Protect your business data with enterprise-grade automated Microsoft Office 365 or Gsuite backup for Mail, Calendar, Contacts, Tasks, Groups, Teams, OneDrive, and SharePoint, along with email archiving

Roy Miehe | MspPortal Partners Inc. | Ceo/President

Security Software Distributor: Bitdefender , Barracuda, Axcient

“Where Service and Technical Skills Count”

October Windows Server updates cause Hyper-V VM boot issues

By Sergiu Gatlan October 17, 2023 08:31 AM

Read this article for some update patches

According to customer reports, this month’s Patch Tuesday updates are breaking virtual machines on Hyper-V hosts, causing them to no longer boot and display “failed to start” errors.

According to complaints from Windows admins, the issue is triggered after installing KB5031361 and KB5031364 on Windows Server 2019 and Windows Server 2022 systems.

A Microsoft spokesperson told BleepingComputer that the company is aware of the issue and is investigating.

The following errors will be logged to the event viewer when trying to start a VM on an affected Hyper-V system:

Failed to start virtual machine TOOLS. Error: ‘TOOLS’ failed to start.
Failed to Power on with Error ‘Incorrect function.’
Failed to open attachment ‘vhdx_path’. Error: ‘Incorrect function.’

Administrators with impacted devices have noted that uninstalling the problematic updates resolves the issue, allowing all virtual machines (VMs) to start up without any problems.

This can be accomplished using the Windows Update Standalone Installer (WUSA) tool, which helps install and remove update packages through the Windows Update Agent API.

To fix the Hyper-V boot issues, open an elevated command prompt by clicking the Start menu, typing cmd, right-clicking the Command Prompt application, and choosing ‘Run as Administrator.’
Microsoft has yet to add this as a known issue to the Windows Health Dashboard, but, nonetheless, when it released the buggy cumulative updates, the company revised the support document for KB5031364, including and removing a known issue related to VMware ESXi.

“After installing this update on guest virtual machines (VMs) running Windows Server 2022 on some versions of VMware ESXi, Windows Server 2022 might not start up,” the now-removed known issue said.

“Only Windows Server 2022 VMs with Secure Boot enabled are affected by this issue. Affected versions of VMware ESXi are versions vSphere ESXi 7.0.x and below.”

Redmond also released emergency out-of-band Windows Server updates in January and December 2022 to fix known issues that caused Hyper-V VMs to no longer start and problems creating new VMs on some Hyper-V hosts.

Microsoft acknowledged a similar issue earlier this year affecting VMware ESXi VMs with Secure Boot after installing February 2023 cumulative updates. VMware issued emergency vSphere ESXi updates that fixed a bug causing boot issues after failing to locate a bootable operating system.

Article (https://www.bleepingcomputer.com/news/microsoft/october-windows-server-updates-cause-hyper-v-vm-boot-issues/)

Roy Miehe | MspPortal Partners Inc. | Ceo/President
Security Software Distributor: Bitdefender , Barracuda, Axcient
“Where Service and Technical Skills Count”

Cloud Services Status (https://mspportalpartners.net/cloud-service-status/)