Stay Alert

New Windows Server updates cause domain controller crashes, reboots

By Sergiu Gatlan March 20, 2024 04:40 PM 0

The March 2024 Windows Server updates are causing some domain controllers to crash and restart, according to widespread reports from Windows administrators.

Affected servers are freezing and rebooting because of a Local Security Authority Subsystem Service (LSASS) process memory leak introduced with the March 2024 cumulative updates for Windows Server 2016 and Windows Server 2022.

LSASS is a Windows service that enforces security policies and handles user logins, access token creation, and password changes.

As many admins have warned, after installing the KB5035855 and KB5035857 Windows Server updates released this Patch Tuesday, domain controllers with the latest updates would crash and reboot due to increasing LSASS memory usage.

“Since installation of the march updates (Exchange as well as regular Windows Server updates) most of our DCs show constantly increasing lsass memory usage (until they die),” one admin said.

“We’ve had issues with lsass.exe on domain controllers (2016 core, 2022 with DE and 2022 core domain controllers) leaking memory as well. To the point all domain controllers crashed over the weekend and caused an outage,” another one added.

“Our symptoms were ballooning memory usage on the lsass.exe process after installing KB5035855 (Server 2016) and KB5035857 (Server 2022) to the point that all physical and virtual memory was consumed and the machine hung,” one admin told BleepingComputer.

“The Support rep says they expect official comms to be announced from Microsoft soon.”
Temporary workaround available

Until Microsoft officially acknowledges this memory leak issue, admins are advised to uninstall the buggy Windows Server updates from their domain controllers.

“Microsoft Support has recommended that we uninstall the update for the time being,” the same admin told BleepingComputer.

To remove the troublesome updates, open an elevated command prompt by clicking the Start menu, typing ‘cmd,’ right-clicking the Command Prompt application, and then choosing ‘Run as Administrator.’

Next, run one of the following commands, depending on what update you have installed on your Windows domain controller:

wusa /uninstall /kb:5035855
wusa /uninstall /kb:5035857

Once uninstalled, you should also use the ‘Show or Hide Updates’ troubleshooter to hide the buggy update so it will no longer appear in the available updates list.

Microsoft addressed another LSASS memory leak affecting domain controllers in December 2022, when affected servers would freeze and restart after installing Windows Server updates released during the November 2022 Patch Tuesday.

In March 2022, Microsoft fixed one more LSASS crash, causing unexpected Windows Server domain controller reboots.

A Microsoft spokesperson could not immediately provide more details when contacted by BleepingComputer earlier today.

Article ( https://www.bleepingcomputer.com/news/microsoft/new-windows-server-updates-cause-domain-controller-crashes-reboots/)

Update Article 3-21-2024 (https://www.bleepingcomputer.com/news/microsoft/microsoft-confirms-windows-server-issue-behind-domain-controller-crashes/)

Roy Miehe | MspPortal Partners Inc. | Ceo/President
Security Software Distributor: Bitdefender , Barracuda, Phishline Training
“Where Service and Technical Skills Count”

2 different articles must read

Brought to you by Bleeping Computer

ScreenConnect flaws exploited to drop new ToddleShark malware

The North Korean APT hacking group Kimsuky is exploiting ScreenConnect flaws, particularly CVE-2024-1708 and CVE-2024-1709, to infect targets with a new malware variant dubbed ToddleShar

Article (https://www.bleepingcomputer.com/news/security/screenconnect-flaws-exploited-to-drop-new-toddleshark-malware/)

Hackers steal Windows NTLM authentication hashes in phishing attacks
Folks you need a phishing training!! We have it inexpensive for your clients

The hacking group known as TA577 has recently shifted tactics by using phishing emails to steal NT LAN Manager (NTLM) authentication hashes to perform account hijacks.

Article (https://www.bleepingcomputer.com/news/security/hackers-steal-windows-ntlm-authentication-hashes-in-phishing-attacks/)

Roy Miehe | MspPortal Partners Inc. | Ceo/President
Security Software Distributor: Bitdefender , Barracuda, Phishline Training
“Where Service and Technical Skills Count”

ConnectWise ScreenConnect Mass Exploitation Delivers Ransomware

Hundreds of initial access brokers and cybercrime gangs are jumping on the max-critical CVE-2024-1709 authentication bypass, threatening orgs and downstream customers.
BY Tara Seals, Managing Editor, News, Dark Reading February 23, 2024

Just days after initial exploitation reports started rolling in for a critical security vulnerability in the ConnectWise ScreenConnect remote desktop management service, researchers are warning that a supply chain attack of outsized proportions could be poised to erupt.

Once the bugs are exploited, hackers will gain remote access into “upwards of ten thousand servers that control hundreds of thousands of endpoints,” Huntress CEO Kyle Hanslovan said in emailed commentary, opining that it’s time to prepare for “the biggest cybersecurity incident of 2024.”

ScreenConnect can be used by tech support and others to authenticate to a machine as though they were the user. As such, it could allow threat actors to infiltrate high-value endpoints and exploit their privileges.

Even worse, the application is widely used by managed service providers (MSP) to connect to customer environments, so it can also open the door to threat actors looking to use those MSPs for downstream access, similar to the tsunami of Kaseya attacks that businesses faced in 2021.
ConnectWise Bugs Get CVEs

ConnectWise disclosed the bugs on Monday with no CVEs, after which proof-of-concept (PoC) exploits quickly appeared. On Tuesday, ConnectWise warned that the bugs were under active cyberattack. By Wednesday, multiple researchers were reporting snowballing cyber activity.

The vulnerabilities now have tracking CVEs. One of them is a max-severity authentication bypass (CVE-2024-1709, CVSS 10), which allows an attacker with network access to the management interface to create a new, administrator-level account on affected devices. It can be paired with a second bug, a path-traversal issue (CVE-2024-1708, CVSS 8.4) that allows unauthorized file access.
Initial Access Brokers Ramp Up Activity

According to the Shadowserver Foundation, there are at least 8,200 vulnerable instances of the platform exposed to the Internet within its telemetry, with the majority of them located in the US.

“CVE-2024-1709 is widely exploited in the wild: 643 IPs seen attacking to date by our sensors,” it said in a LinkedIn post.

Huntress researchers said a source within the US intelligence community told them that initial access brokers (IABs) have started pouncing on the bugs to set up shop inside various endpoints, with the intent of selling that access to ransomware groups.

And indeed, on one instance, Huntress observed cyberattackers using the security vulnerabilities to deploy ransomware to a local government, including endpoints likely linked to 911 systems.

“The sheer prevalence of this software and the access afforded by this vulnerability signals we are on the cusp of a ransomware free-for-all,” Hanslovan said. “Hospitals, critical infrastructure, and state institutions are proven at risk.”

He added: “And once they start pushing their data encryptors, I’d be willing to bet 90% of preventative security software won’t catch it because it’s coming from a trusted source.”

Bitdefender researchers, meanwhile, corroborated the activity, noting that threat actors are using malicious extensions to deploy a downloader capable of installing additional malware on compromised machines.

“We’ve noticed several instances of potential attacks leveraging the extensions folder of ScreenConnect, [while security tooling] suggests the presence of a downloader based on the certutil.exe built-in tool,” according to a Bitdefender blog post on the ConnectWise cyber activity. “Threat actors commonly employ this tool … to initiate the download of additional malicious payloads onto the victim’s system.”

The US Cybersecurity and Infrastructure Security Agency (CISA) has added the bugs to its Known Exploited Vulnerabilities catalog.
Mitigation for CVE-2024-1709, CVE-2024-1708

On-premises versions up to and including 23.9.7 are vulnerable — so the best protection is identifying all systems where ConnectWise ScreenConnect is deployed and applying the patches, issued with ScreenConnect version 23.9.8.

Organizations should also keep a lookout for indicators of compromise (IoCs) listed by ConnectWise in its advisory. Bitdefender researchers advocate monitoring the “C:\Program Files (x86)\ScreenConnect\App_Extensions\” folder; Bitdefender flagged that any suspicious .ashx and .aspx files stored directly in the root of that folder may indicate unauthorized code execution.

Also, there could be good news on the horizon: “ConnectWise stated they revoked licenses for unpatched servers, and while it’s unclear on our end how this works, it appears this vulnerability is still a major concern for anyone running a vulnerable version or who did not patch swiftly,” Bitdefender researchers added. “This is not to say ConnectWise’s actions aren’t working, we’re unsure of how this played out at this time.”

Article ( https://www.darkreading.com/remote-workforce/connectwise-screenconnect-mass-exploitation-delivers-ransomware?_mc=NL_DR_EDT_DR_weekly_20240229&cid=NL_DR_EDT_DR_weekly_20240229&sp_aid=121742&elq_cid=34964379&sp_eh=949bacdba1e2c4851acc11df0ff47140b1c6468716621bc723fe5fe498198bd9&sp_eh=949bacdba1e2c4851acc11df0ff47140b1c6468716621bc723fe5fe498198bd9&sp_cid=52262)

Roy Miehe | MspPortal Partners Inc. | Ceo/President
Security Software Distributor: Bitdefender , Barracuda, Phishline Training
“Where Service and Technical Skills Count”

Microsoft 365 suite is now WARN

I feel so sorry for folks that use O365..most of you are glutton for punishment. They provide no really true US support considering they take you money either monthly or yearly..Unfortunately most Major Firms use O365. think about looking around..careful with O365 for Malware and phishing attacks

Anyway

Some users may be unable to sign into the Microsoft To Do service
Title: Some users may be unable to sign into the Microsoft To Do service User impact: Users may be unable to sign into the Microsoft To Do service. Current status: We’re reviewing network traces to isolate the source of this issue and identify our troubleshooting actions. Scope of impact: Impact may occur for all users when attempting to sign into the Microsoft

Roy Miehe | MspPortal Partners Inc. | Ceo/President
Security Software Distributor: Bitdefender , Barracuda, Phishline Training
“Where Service and Technical Skills Count”

Microsoft: Outlook clients not syncing over Exchange ActiveSync

By Sergiu Gatlan February 9, 2024 12:57 PM

Microsoft warned Outlook for Microsoft 365 users that clients might have issues connecting to email servers via Exchange ActiveSync after a January update.
Exchange ActiveSync (EAS) is an Exchange synchronization protocol using HTTP and XML to let users access their email, calendar, contacts, and tasks.
EAS is enabled by default on new user mailboxes, and disabling it prevents users from synchronizing their mailboxes with mobile devices.
“After updating to Version 2401 Build 17231.20182 Outlook stops connecting when using the Exchange ActiveSync (EAS) protocol,” Microsoft said.
“We have to use Activesync in order to connect to our cloud-hosted email server. Other syncing may not be impacted,” one impacted user said.
While the Outlook Team has yet to provide an explanation for this syncing issue, it’s currently investigating and will provide a fix as soon as a solution is found.

Article (https://www.bleepingcomputer.com/news/microsoft/microsoft-outlook-clients-not-syncing-over-exchange-activesync/)

If you are stressed and concerned at MspPortal with Barrcuda we can backup your O365 environment and archive you mail very inexpensive considering the alternative

Also if you are not running our Phiseline Test product ..you are not training your clients to help themselves protect themselves from themselves

Roy Miehe | MspPortal Partners Inc. | Ceo/President
Security Software Distributor: Bitdefender , Barracuda, Phishline Training
“Where Service and Technical Skills Count”

Microsoft Teams outage causes connection issues, message delays

By Sergiu Gatlan January 26, 2024 12:49 PM

Typically this leads to Security Breaches like 2023 just search for yourself (microsoft teams security issues 2023)

Microsoft is investigating an ongoing and widespread outage impacting the users of its Teams communication platform and causing connectivity issues, login problems, and message delays.

While Redmond is still working on addressing these ongoing problems, it revealed that a networking issue might be the root cause of this outage.

“We’ve identified a networking issue impacting a portion of the Teams service and we’re performing a failover to remediate impact. Additional information can be found under TM710344 in the admin center,” tweeted the official Microsoft account for updates on Microsoft 365 service incidents.

Affected customers have reported login and server connection issues, desktop and mobile Teams apps freezing on the loading screen, and message delivery problems.

Other reports mention chat history not being available and images no longer displaying in chat, as well as being left in the waiting room after joining Teams meetings.

On impacted systems, customers see “We’ve run into a server error. Some functions might not work right now but you can continue to use the app” errors.

According to the TM710344 incident report in the Microsoft 365 admin center, the outage was first acknowledged by Redmond at 10:37 AM EST and it impacts customers across North America, Europe, the Middle East, and Africa regions.

The outage affects users performing a cold boot, who may not be able to log into teams and will see an “oops” page. It also causes users attempting to log into their accounts and unlocking devices to see missing messages.

Other scenarios experienced by impacted customers can lead to:

Users may fail to load messages in channels and chats
Users are unable to view or download their media (images, videos, audio, call recordings, code snippets)
Some messages may experience delays being sent
Call Recordings might take longer to appear in user’s OneDrive for Business and SharePoint Online
Bots may be unable to download attachments
Sending and receiving read receipt notifications may be delayed

“Our review of service telemetry indicates a portion of database infrastructure that facilitates multiple APls is experiencing a networking issue, resulting in impact,” Microsoft said.

“We’re continuing our investigation to isolate the underlying cause of the networking issue and develop remediation actions.”

Update January 26, 12:55 EST: Added TM710344 incident report info.

Article (https://www.bleepingcomputer.com/news/microsoft/microsoft-teams-outage-causes-connection-issues-message-delays/)

Roy Miehe | MspPortal Partners Inc. | Ceo/President
Security Software Distributor: Bitdefender , Barracuda, Phishline Training
“Where Service and Technical Skills Count”

TeamViewer abused to breach networks in new ransomware attacks

BEWARE a lot of RMM solutions use TV chnage you security logins

By Bill Toulas January 18, 2024 04:07 PM 3

Ransomware actors are again using TeamViewer to gain initial access to organization endpoints and attempt to deploy encryptors based on the leaked LockBit ransomware builder.

TeamViewer is a legitimate remote access tool used extensively in the enterprise world, valued for its simplicity and capabilities.

Unfortunately, the tool is also cherished by scammers and even ransomware actors, who use it to gain access to remote desktops, dropping and executing malicious files unhindered.

A similar case was first reported in March 2016, when numerous victims confirmed in the BleepingComputer forums that their devices were breached using TeamViewer to encrypt files with the Surprise ransomware.

At the time, TeamViewer’s explanation for the unauthorized access was credential stuffing, meaning the attackers did not exploit a zero-day vulnerability in the software but instead used users’ leaked credentials.

“As TeamViewer is a widely spread software, many online criminals attempt to log on with the data of compromised accounts, in order to find out whether there is a corresponding TeamViewer account with the same credentials,” explained the software vendor at the time.

“If this is the case, chances are they can access all assigned devices, in order to install malware or ransomware.”

Article (https://www.bleepingcomputer.com/news/security/teamviewer-abused-to-breach-networks-in-new-ransomware-attacks/)

Roy Miehe | MspPortal Partners Inc. | Ceo/President
Security Software Distributor: Bitdefender , Barracuda, Phishline Training
“Where Service and Technical Skills Count”
Cloud Services Status page (https://cloudstatus.mspportalpartners.net/)

Windows 10 KB5034441 security update fails with 0x80070643 errors (Bitlocker)

Windows 10 KB5034441 security update fails with 0x80070643 errors

By Lawrence Abrams January 10, 2024 11:56 AM

Windows 10 users worldwide report problems installing Microsoft’s January Patch Tuesday updates, getting 0x80070643 errors when attempting to install the KB5034441 security update for BitLocker.

Yesterday, as part of Microsoft’s January 2024 Patch Tuesday, a security update (KB5034441) was released for CVE-2024-20666, a BitLocker encryption bypass that allows users to access encrypted data.

However, when attempting to install this update, Windows 10 users are reporting getting 0x80070643 errors and the installation failing.

On reboot, users will be greeted with a Windows Update screen stating that an error occurred and to try again later.

“There were some problems installing updates, but we’ll try again later. If you keep seeing this and want to search the web or contact support for information, this may help: (0x80070643),” reads the Windows Update error.

In a support bulletin also published yesterday, Microsoft warns that when installing the KB5034441, users are supposed to see the “Windows Recovery Environment servicing failed, (CBS_E_INSUFFICIENT_DISK_SPACE)” error when the Windows Recovery Partition is not large enough to support the update.

However, a coding error causes the Windows Update to mistakenly display the generic “0x80070643 – ERROR_INSTALL_FAILURE” error message instead.
WinRE partition too small

When installing the KB5034441 security update, Microsoft is installing a new version of the Windows Recovery Environment (WinRE) that fixes the BitLocker vulnerability.

Unfortunately, Windows 10 creates a recovery partition, usually around 500 MB, which is not large enough to support the new Windows RE image (winre.wim) file, causing the 0x80070643 error when attempting to install the update.

In a test by BleepingComputer this morning, a brand new install of Windows 10 using the latest ISO from Microsoft created a 522MB WinRE partition. However, even this new install has a partition that is too small, causing the KB5034441 security update not to install and display a 0x80070643 error.

The only solution Microsoft has offered at this point is to create a larger Windows Recovery Partition so there is enough room for the security update to install.

As the Windows Recovery Partition is created on the same disk as the C: partition, you must shrink the C: partition by 250 MBs and use that newly unallocated space to create a bigger Recovery Partition.

Microsoft had previously shared a support bulletin describing how to shrink the C: partition by 250 MB and create a new Recovery Partition using the reagentc.exe and dispart.exe command line utilities to accommodate WinRE security updates.

Reagentc.exe is a command line tool for managing the Windows Recovery Environment, and diskpart.exe is a command line tool to manage the device’s disk partition and volumes.

However, if you are not comfortable using command line programs, we strongly suggest you hold off on performing these steps as the vulnerability requires physical access to your device, minimizing its impact.

Instead, you should wait for a solution from Microsoft, which may offer an automated way to recreate a larger Windows Recovery partition.

Furthermore, there is always the risk of damaging partitions when shrinking and expanding them, so it is strongly advised that you back up your data before proceeding.

More Article (https://www.bleepingcomputer.com/news/microsoft/windows-10-kb5034441-security-update-fails-with-0x80070643-errors/)

Roy Miehe | MspPortal Partners Inc. | Ceo/President

Security Software Distributor: Bitdefender , Barracuda, Phishline Training

“Where Service and Technical Skills Count”

Bitdefender Changes Scanning Techniques

This can be good or Bad..depends on how you look at it

I mange thousand of endpoints of Bitdefender

So i have been running the new changes for about a week ( I am satisfied so far)

Bitdefender is a policy based platform

In this point, there are several things to do:
1. Remove the scan archive from the Quick scans because these are designed to scan some resources fast.
2. Add the scan archives in the Full scan profile if not already done so it can be inherited and the report be populated as desired.
3) With all this, a malware located in an archive doesn’t pose a threat because when resources from the archive are accessed or unpacked they will be scanned and detected by the on access real time protection.

Read this link (https://www.bitdefender.com/business/support/en/71263-85158-contact.html) updates coming and some answers also

LAST IF YOU ARE NOT USING 2FA PLEASE TAKE THE TIME TO SETUP IT IS NOT HARD. personally  I use a high end 2FA program for all sites and I use it from one computer only. I do not use  cell phones to log in, the program that I use allows it.. security is a utmost concern to me in protecting myself and my partners

If you have questions and you are a MspPortal Partner feel free to contact me

Roy Miehe | MspPortal Partners Inc. | Ceo/President

Security Software Distributor: Bitdefender , Barracuda, Phish Line Training

“Where Service and Technical Skills Count”

 

MspPortal Partners New Product line for MspPortal Partners

Our New Phishing Line Product is like no other, combined with our Spam Filter Product you will have a 99% chance of protecting your network and your clients networks

1) An advanced email threat protection add-in for Microsoft 365 and Gmail.

It enables reporting phishing and other type of threats. Each inbox’s risk profile is unique and this plugin exposes tell tale signs of threats to your security

2) Helps users learn what to look

for using each email as a learning opportunity combined with security awareness training.

3) Addresses, Domains, Email Addresses, words, and other known threat types from different sources.

4) Pushes your endpoint protection even further and helps users better determine a real threat versus legitimate emails.

5) Phishing simulation:

Phishing simulation provides realistic emails to users to see if they react properly. When a user reports a simulated phishing email, it improves the organizations net reporter score Upon failure of a simulated phishing email, the organization can automatically enroll the user in remedial training.

1) MspPortal Partners Complete Email Protection

Backup and recovery for Exchange Online O365, GSuite

SharePoint, OneDrive, and Teams, Unlimited Storage, along with email archiving

2) Protect your business data with enterprise-grade automated Microsoft Office 365 or Gsuite backup for Mail, Calendar, Contacts, Tasks, Groups, Teams, OneDrive, and SharePoint, along with email archiving

 

Roy Miehe | MspPortal Partners Inc. | Ceo/President

Security Software Distributor: Bitdefender , Barracuda, Axcient

“Where Service and Technical Skills Count”