By Sergiu Gatlan February 9, 2024 12:57 PM

Microsoft warned Outlook for Microsoft 365 users that clients might have issues connecting to email servers via Exchange ActiveSync after a January update.
Exchange ActiveSync (EAS) is an Exchange synchronization protocol using HTTP and XML to let users access their email, calendar, contacts, and tasks.
EAS is enabled by default on new user mailboxes, and disabling it prevents users from synchronizing their mailboxes with mobile devices.
“After updating to Version 2401 Build 17231.20182 Outlook stops connecting when using the Exchange ActiveSync (EAS) protocol,” Microsoft said.
“We have to use Activesync in order to connect to our cloud-hosted email server. Other syncing may not be impacted,” one impacted user said.
While the Outlook Team has yet to provide an explanation for this syncing issue, it’s currently investigating and will provide a fix as soon as a solution is found.

Article (https://www.bleepingcomputer.com/news/microsoft/microsoft-outlook-clients-not-syncing-over-exchange-activesync/)

If you are stressed and concerned at MspPortal with Barrcuda we can backup your O365 environment and archive you mail very inexpensive considering the alternative

Also if you are not running our Phiseline Test product ..you are not training your clients to help themselves protect themselves from themselves

Roy Miehe | MspPortal Partners Inc. | Ceo/President
Security Software Distributor: Bitdefender , Barracuda, Phishline Training
“Where Service and Technical Skills Count”

By Sergiu Gatlan January 26, 2024 12:49 PM

Typically this leads to Security Breaches like 2023 just search for yourself (microsoft teams security issues 2023)

Microsoft is investigating an ongoing and widespread outage impacting the users of its Teams communication platform and causing connectivity issues, login problems, and message delays.

While Redmond is still working on addressing these ongoing problems, it revealed that a networking issue might be the root cause of this outage.

“We’ve identified a networking issue impacting a portion of the Teams service and we’re performing a failover to remediate impact. Additional information can be found under TM710344 in the admin center,” tweeted the official Microsoft account for updates on Microsoft 365 service incidents.

Affected customers have reported login and server connection issues, desktop and mobile Teams apps freezing on the loading screen, and message delivery problems.

Other reports mention chat history not being available and images no longer displaying in chat, as well as being left in the waiting room after joining Teams meetings.

On impacted systems, customers see “We’ve run into a server error. Some functions might not work right now but you can continue to use the app” errors.

According to the TM710344 incident report in the Microsoft 365 admin center, the outage was first acknowledged by Redmond at 10:37 AM EST and it impacts customers across North America, Europe, the Middle East, and Africa regions.

The outage affects users performing a cold boot, who may not be able to log into teams and will see an “oops” page. It also causes users attempting to log into their accounts and unlocking devices to see missing messages.

Other scenarios experienced by impacted customers can lead to:

Users may fail to load messages in channels and chats
Users are unable to view or download their media (images, videos, audio, call recordings, code snippets)
Some messages may experience delays being sent
Call Recordings might take longer to appear in user’s OneDrive for Business and SharePoint Online
Bots may be unable to download attachments
Sending and receiving read receipt notifications may be delayed

“Our review of service telemetry indicates a portion of database infrastructure that facilitates multiple APls is experiencing a networking issue, resulting in impact,” Microsoft said.

“We’re continuing our investigation to isolate the underlying cause of the networking issue and develop remediation actions.”

Update January 26, 12:55 EST: Added TM710344 incident report info.

Article (https://www.bleepingcomputer.com/news/microsoft/microsoft-teams-outage-causes-connection-issues-message-delays/)

Roy Miehe | MspPortal Partners Inc. | Ceo/President
Security Software Distributor: Bitdefender , Barracuda, Phishline Training
“Where Service and Technical Skills Count”

Windows 10 KB5034441 security update fails with 0x80070643 errors

By Lawrence Abrams January 10, 2024 11:56 AM

Windows 10 users worldwide report problems installing Microsoft’s January Patch Tuesday updates, getting 0x80070643 errors when attempting to install the KB5034441 security update for BitLocker.

Yesterday, as part of Microsoft’s January 2024 Patch Tuesday, a security update (KB5034441) was released for CVE-2024-20666, a BitLocker encryption bypass that allows users to access encrypted data.

However, when attempting to install this update, Windows 10 users are reporting getting 0x80070643 errors and the installation failing.

On reboot, users will be greeted with a Windows Update screen stating that an error occurred and to try again later.

“There were some problems installing updates, but we’ll try again later. If you keep seeing this and want to search the web or contact support for information, this may help: (0x80070643),” reads the Windows Update error.

In a support bulletin also published yesterday, Microsoft warns that when installing the KB5034441, users are supposed to see the “Windows Recovery Environment servicing failed, (CBS_E_INSUFFICIENT_DISK_SPACE)” error when the Windows Recovery Partition is not large enough to support the update.

However, a coding error causes the Windows Update to mistakenly display the generic “0x80070643 – ERROR_INSTALL_FAILURE” error message instead.
WinRE partition too small

When installing the KB5034441 security update, Microsoft is installing a new version of the Windows Recovery Environment (WinRE) that fixes the BitLocker vulnerability.

Unfortunately, Windows 10 creates a recovery partition, usually around 500 MB, which is not large enough to support the new Windows RE image (winre.wim) file, causing the 0x80070643 error when attempting to install the update.

In a test by BleepingComputer this morning, a brand new install of Windows 10 using the latest ISO from Microsoft created a 522MB WinRE partition. However, even this new install has a partition that is too small, causing the KB5034441 security update not to install and display a 0x80070643 error.

The only solution Microsoft has offered at this point is to create a larger Windows Recovery Partition so there is enough room for the security update to install.

As the Windows Recovery Partition is created on the same disk as the C: partition, you must shrink the C: partition by 250 MBs and use that newly unallocated space to create a bigger Recovery Partition.

Microsoft had previously shared a support bulletin describing how to shrink the C: partition by 250 MB and create a new Recovery Partition using the reagentc.exe and dispart.exe command line utilities to accommodate WinRE security updates.

Reagentc.exe is a command line tool for managing the Windows Recovery Environment, and diskpart.exe is a command line tool to manage the device’s disk partition and volumes.

However, if you are not comfortable using command line programs, we strongly suggest you hold off on performing these steps as the vulnerability requires physical access to your device, minimizing its impact.

Instead, you should wait for a solution from Microsoft, which may offer an automated way to recreate a larger Windows Recovery partition.

Furthermore, there is always the risk of damaging partitions when shrinking and expanding them, so it is strongly advised that you back up your data before proceeding.

More Article (https://www.bleepingcomputer.com/news/microsoft/windows-10-kb5034441-security-update-fails-with-0x80070643-errors/)

Roy Miehe | MspPortal Partners Inc. | Ceo/President

Security Software Distributor: Bitdefender , Barracuda, Phishline Training

“Where Service and Technical Skills Count”

Always amazes me Microsoft stays in businesses..but that is my personal opinion..

Article by

Jai Vijayan, Contributing Writer December 19, 2023

Attackers can chain the vulnerabilities to gain full remote code execution.
Researchers this week disclosed details on two security vulnerabilities in Microsoft Outlook that, when chained together, give attackers a way to execute arbitrary code on affected systems without any user interaction. Unusually, both of them can be triggered using a sound file.

One of the flaws, tracked as CVE-2023-35384, is actually the second patch bypass that researchers at Akamai have uncovered for a critical privilege escalation vulnerability in Outlook that Microsoft first patched in March. The second flaw that Akamai disclosed this week (CVE-2023-36710) is a remote code execution (RCE) vulnerability in a feature of Windows Media Foundation, and it has to do with how Windows parses sound files.

“An attacker on the Internet can chain the vulnerabilities together to create a full, zero-click remote code execution (RCE) exploit against Outlook clients,” Akamai said in a two-part blog post this week.
Arbitrary Code Execution

Microsoft issued a patch for CVE-2023-35384 in August, after Akamai researchers contacted the company. The flaw stems from a security feature in Outlook not properly validating if a requested URL is in a local machine zone, intranet zone, or another trusted zone.

Attackers can trigger the vulnerability by sending an affected Outlook client an email reminder with a custom notification sound, according to Akamai. “An attacker can specify a UNC path that would cause the client to retrieve the sound file from any SMB server” on the Internet, instead of from a safe or trusted zone, the vendor added.

To trigger the second vulnerability, an attacker would use the first vulnerability to send a specially crafted email that downloads a malicious sound file from an attacker-controlled server.

“When the downloaded sound file is autoplayed … it can lead to code execution on the victim machine,” Akamai said.

According to Ben Barnea, security researcher at Akamai, an attacker can exploit both vulnerabilities individually or in a chained fashion. “While each one of them is a somewhat ‘weak’ vulnerability, by chaining them together against Outlook we achieved a powerful zero-click RCE vulnerability,” he says.
Patch, Then Patch Again

As noted, this is the second time that Akamai researchers have found a way around a March patch that Microsoft issued for the Outlook privilege-escalation flaw tracked as CVE-2023-23397. That original bug gives attackers a way to use a sound file to steal a user’s password hash and authenticate to services to which the user has access. As recently as Dec. 4, Microsoft warned of Russia’s Fancy Bear group (aka Forest Blizzard) actively exploiting the flaw to gain unauthorized access to email accounts in Exchange server.

Microsoft’s original patch sought to ensure that before Outlook handles emails containing custom notification reminders, it first verifies the safety of the URL for the sound file. The patch was designed to ensure that if the URL for the custom notification sound was brought in from an untrusted/unverified domain, Outlook’s default notification sound is used instead.

But then, Akamai researchers probing the patch discovered they could bypass it by adding a single character to a function in the Microsoft update. The discovery prompted Microsoft to assign the issue a separate CVE (CVE-2023-29324) and issue a patch for it in May.

The new bypass that Akamai is detailing this week also arises from an issue in the original patch — and it might not be the last problem found in the patch, either.

“The patch for the original vulnerability used a function called ‘MapUrlToZone’ to mitigate the abuse of the custom reminder sound feature,” explains Barnea, noting that the function is a complex one and increases the attack surface available to the attacker.

“As a result, the patch added more code that also had vulnerabilities in it,” he says. “We suggested to remove the abused feature instead of using patches, since the feature does more harm than good.”

Article (https://www.darkreading.com/vulnerabilities-threats/researchers-release-details-on-two-patched-outlook-zero-click-flaws?_mc=NL_DR_EDT_DR_weekly_20231221&cid=NL_DR_EDT_DR_weekly_20231221&sp_aid=120055&elq_cid=34964379&sp_eh=949bacdba1e2c4851acc11df0ff47140b1c6468716621bc723fe5fe498198bd9&sp_eh=949bacdba1e2c4851acc11df0ff47140b1c6468716621bc723fe5fe498198bd9&sp_cid=51098)

Roy Miehe | MspPortal Partners Inc. | Ceo/President

Security Software Distributor: Bitdefender , Barracuda, Axcient

“Where Service and Technical Skills Count”

By Sergiu Gatlan November 28, 2023 02:01 PM

Opinion:Proably does not surprise you

Today, Microsoft shared a temporary fix for a known issue causing Outlook Desktop to crash when sending emails from Outlook.com accounts.

This confirms customer reports regarding crashing issues when using Outlook.com accounts shared on Microsoft’s community website and other social networks since last Monday, November 20.

According to online reports, restarting, repairing Outlook, reinstalling the application, and creating a fresh Outlook profile for the impacted email account fails to address the issue.

“I’ve tried everything (safe mode, new profile, repair pst, even up to and including a system restore to attempt to roll back a previous installation) to no avail,” one of the affected users said.

These problems only affect Outlook for Microsoft 365 users and those in the Current Channel (Preview) channel using Outlook build 17029.20028.

“The issue is fixed in future builds 17029.20052+. However, this build has not been released yet,” Microsoft said.

While a limited number of customers did report they had successfully worked around this known issue by reinstalling Office, Microsoft suggests reverting to an earlier version.

To do that, type Command Prompt in the Windows search box, right-click Command Prompt and click Run as administrator.

Next, paste the following commands into the Command Prompt window and hit Enter after each:

cd %programfiles%\Common Files\Microsoft Shared\ClickToRun

officec2rclient.exe /update user updatetoversion=16.0.16924.20124

Redmond also started rolling out fixes last week for some of the customers affected by another known Microsoft 365 issue behind ‘Something Went Wrong [1001]’ sign-in errors, rendering desktop Office apps unusable for many affected users.

These ongoing login issues impact customers using Excel, Word, Outlook, and PowerPoint for Microsoft 365, Microsoft 365 Apps for business, and Office apps for iOS and Android, as the company confirmed over a month ago.

Previously, it fixed another bug causing significant delays for Microsoft 365 customers when saving attachments in Outlook Desktop to a network share.

Earlier this year, Microsoft tackled various other Outlook issues, including ones blocking Microsoft 365 customers from accessing emails and calendars and causing slow starts and freezes during cache re-priming.

Article (https://www.bleepingcomputer.com/news/microsoft/microsoft-shares-temp-fix-for-outlook-crashes-when-sending-emails/)

Roy Miehe | MspPortal Partners Inc. | Ceo/President
Security Software Distributor: Bitdefender , Barracuda, Axcient
“Where Service and Technical Skills Count”

By Bill Toulas November 27, 2023 09:52 AM

My comment: Between Google and Microsoft I have no idea if you are in the frying pan or the fire. Persoanlly I would ask for a full refund if not fixed with 72 hours. I am sure some lawyer will create a class action

Google Drive users are reporting that recent files stored in the cloud have suddenly disappeared, with the cloud service reverting to a storage snapshot as it was around April-May 2023.

Google Drive is a cloud-based storage service that allows people to store and access files from any internet-connected device via their Google account. It is a widely used service by individuals and businesses (as part of Google Workspace).

A trending issue reported on Google’s support forums starting last week describes a situation where people say they lost recent data and folder structure changes.

“There is a serious issue here that needs to escalate urgently. We have a support ticket open, this has not been helpful to date,” said a Google Drive user on the support thread.

“I pay extra each month to store folders in the cloud so that it is safe, so it is devastating that all my work appears to have been lost,” another Google Drive user posted.

The activity logs on impacted accounts do not show any recent changes, confirming that the users themselves didn’t accidentally delete them.

Overall, there are no indications of a user error but rather a problem with the service’s system that prevented the synchronization of data between the local devices and Google Cloud at some point.

Some users have offline caches that might contain the missing data, but no known method exists to restore access to the data within them.

Google’s volunteer support agents have posted an alleged response from Google’s support engineers that confirms they are already investigating the issue. However, an estimate for a fix hasn’t been provided yet.

“Please accept my sincere apologies if I’m unable to join the Google Meet session. I am continously tracking this case and to be transparent with you we totally agree now that you are not the only customer affected by this behavior.

Aside from the thread link you provided there are other admins now that have reported the same behavior we encounter where after the update there are files that went missing. This is now being investigated by our Product Engineers and we are also waiting for a root cause analysis as well on how we can fix it. Due to the ongoing investigation we are unable to provide an ETA yet.

We don’t recommend as well to make changes on the root/data folder while we wait for instructions from our Engieers. I will continue to monitor the behavior of reported issue from other admins and schedule a callback tommorow same time hoping there are progress within the day that I can deliver before our Google Meet session.” – Google Support Team.

The recommendation for those affected is to avoid making changes to the root/data folder until the situation clears up and the root cause of the problem is determined.

Understandably, many users are frustrated by the loss of critical data they entrusted to the cloud-based service and, in many cases, paid for the hosting of their files.

A notable aspect of the situation is that Google’s support forums are backed by volunteers with limited insight or understanding of the cloud service, so the lack of effective assistance in critical problems like this makes it all the worse.

BleepingComputer has contacted Google for an update on the status of the internal investigation and whether the lost files are recoverable or irreversibly lost, but we have not received a response by publication time.

In this situation, Google Drive users should refrain from changing their cloud storage as it might complicate the recovery process. Instead, your best bet would be to contact Google Support, open a new case, and monitor for official updates.

Until the problem is resolved, it would be more prudent to backup important files locally or use a different cloud service.
Article (https://www.bleepingcomputer.com/news/google/google-drive-users-angry-over-losing-months-of-stored-data/)

Roy Miehe | MspPortal Partners Inc. | Ceo/President
Security Software Distributor: Bitdefender , Barracuda, Axcient
“Where Service and Technical Skills Count”

This could affect the economy

By Bill Toulas November 13, 2023 02:06 PM

A cyberattack on international logistics firm DP World Australia has severely disrupted the regular freight movement in multiple large Australian ports.

DP World has an annual revenue of over $10 billion and specializes in cargo logistics, port terminal operations, maritime services, and free trade zones.

It is responsible for operating 82 marine and inland terminals in 40 countries. It handles about 70 million containers carried annually by 70,000 vessels, corresponding to roughly 10% of the global container traffic.

DP World has a significant presence in Australia, handling 40% of the nation’s container trade. It operates logistics terminals in the ports of Bing Bong, Fremantle, Brisbane, Sydney, and Melbourne.

According to a statement the firm shared with BleepingComputer, a cyberattack on Friday, November 10 disrupted landside freight operations at its ports.

In response, the company activated its emergency plans and engaged with cybersecurity experts to overcome problems caused by the incident. It is currently testing key systems required to resume normal business operations.

Since Friday, roughly 30,000 shipping containers of varying importance and value remained unmoved and crowded to the brim the available storage spaces. At the moment, operations are being restored gradually.

The estimated damages are in the millions of dollars, as many of the stranded containers hold time-sensitive goods such as blood plasma, wagyu beef, and lobsters
Article (https://www.bleepingcomputer.com/news/security/dp-world-cyberattack-blocks-thousands-of-containers-in-ports/)

Related Articles:

Pizza Hut Australia warns 193,000 customers of a data breach
Article (https://www.bleepingcomputer.com/news/security/pizza-hut-australia-warns-193-000-customers-of-a-data-breach/)

Pharmacy provider Truepill data breach hits 2.3 million customers
Article (https://www.bleepingcomputer.com/news/security/pharmacy-provider-truepill-data-breach-hits-23-million-customers/

Maine govt notifies 1.3 million people of MOVEit data breach
Article (https://www.bleepingcomputer.com/news/security/maine-govt-notifies-13-million-people-of-moveit-data-breach/)

McLaren Health Care says data breach impacted 2.2 million people
Article (https://www.bleepingcomputer.com/news/security/mclaren-health-care-says-data-breach-impacted-22-million-people/)

Kyocera AVX says ransomware attack impacted 39,000 individuals
Article (https://www.bleepingcomputer.com/news/security/kyocera-avx-says-ransomware-attack-impacted-39-000-individuals/)

Microsoft fixes critical Azure CLI flaw that leaked credentials in logs What a leak
Article (https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-critical-azure-cli-flaw-that-leaked-credentials-in-logs/)

Roy Miehe | MspPortal Partners Inc. | Ceo/President
Security Software Distributor: Bitdefender , Barracuda, Axcient
“Where Service and Technical Skills Count”

1) SEC Charges Against SolarWinds CISO Send Shockwaves Through Security Ranks
The legal actions may have a chilling effect on hiring CISOs, who are already in short supply, but may also expose just how budget-constrained most security executives are.
Article (https://www.darkreading.com/attacks-breaches/sec-charges-against-solarwinds-ciso-send-shockwaves-through-security-ranks?_mc=NL_DR_EDT_DR_weekly_20231102&cid=NL_DR_EDT_DR_weekly_20231102&sp_aid=119087&elq_cid=34964379&sp_eh=949bacdba1e2c4851acc11df0ff47140b1c6468716621bc723fe5fe498198bd9&sp_eh=949bacdba1e2c4851acc11df0ff47140b1c6468716621bc723fe5fe498198bd9&sp_cid=50368)

2) Boeing Confirms Cyberattack, System Compromise
The aerospace giant said it’s alerting customers that its parts and distribution systems have been impacted by cyberattack.
Article (https://www.darkreading.com/endpoint/boeing-confirms-system-compromise-alerting-customers?_mc=NL_DR_EDT_DR_weekly_20231102&cid=NL_DR_EDT_DR_weekly_20231102&sp_aid=119087&elq_cid=34964379&sp_eh=949bacdba1e2c4851acc11df0ff47140b1c6468716621bc723fe5fe498198bd9&sp_eh=949bacdba1e2c4851acc11df0ff47140b1c6468716621bc723fe5fe498198bd9&sp_cid=50368)

3) Boeing Breached by Ransomware, LockBit Gang Claims
LockBit gives Boeing a Nov. 2 deadline to pay the ransom or have its sensitive documents leaked to the public, but it hasn’t given evidence of the compromise.
Article (https://www.darkreading.com/endpoint/boeing-breached-ransomware-lockbit-gang-claims?_mc=NL_DR_EDT_DR_weekly_20231102&cid=NL_DR_EDT_DR_weekly_20231102&sp_aid=119087&elq_cid=34964379&sp_eh=949bacdba1e2c4851acc11df0ff47140b1c6468716621bc723fe5fe498198bd9&sp_eh=949bacdba1e2c4851acc11df0ff47140b1c6468716621bc723fe5fe498198bd9&sp_cid=50368)

4) OpenAI confirms DDoS attacks behind ongoing ChatGPT outages
During the last 24 hours, OpenAI has been addressing what it describes as “periodic outages” linked to DDoS attacks affecting its API and ChatGPT services.
By Sergiu Gatlan November 09, 2023 03:18 AM
Article (https://www.bleepingcomputer.com/news/security/openai-confirms-ddos-attacks-behind-ongoing-chatgpt-outages/)

Roy Miehe | MspPortal Partners Inc. | Ceo/President
Security Software Distributor: Bitdefender , Barracuda, Axcient
“Where Service and Technical Skills Count”