Slashdot

An anonymous reader quotes ZDNet: As Microsoft promised in early April, Windows 10 is gaining a new option that gives users better control over when its twice-yearly major feature updates are installed. That option is called “Download and install now” and should help Windows 10 users avoid unintentionally accepting a feature update after using Windows Update to check for new patches. While clicking “Check for updates” could mean checking for monthly or security updates, historically it’s also triggered the installation of a feature update, which can be a major disruption… Choosing to download and install when offered a feature update is taken as confirmation that the user wants that update. From that point on, the feature update can then only be paused for up to 35 days. By not clicking on “Download and install now”, the new feature update can be avoided so long as the version of Windows 10 currently running is supported and not nearing end of support.

Microsoft has published a support document today warning Windows 10 users that the impending May 2019 Update may not install on their systems if they use external USB storage devices or SD cards. From a report: The OS maker cited problems with “inappropriate drive reassignment” as the main reason for blocking the May 2019 Update. “Inappropriate drive reassignment can occur on eligible computers that have an external USB device or SD memory card attached during the installation of the May 2019 update,” the company said. “For this reason, these computers are currently blocked from receiving the May 2019 Update.”

An anonymous reader shares a report: Last year, Microsoft announced when it would be killing app updates and distribution in the Windows Store for Windows Phone 8.x and Windows 8.x. At the time, the blog post stated that Windows Phone 8.x devices would stop receiving app updates after July 1, 2019, while Windows 8.x devices would get app updates through July 1, 2023. However, it seems as though plans have changed a little bit, as the blog post has quietly been updated earlier this month. Microsoft has changed the wording in the post to state that Windows 8 devices will stop getting updates for their apps at the same time as Windows Phone 8.x, that is, July 1 of this year. Windows 8.1 devices will continue to receive updates through the previously announced date in 2023.

Security researcher John Page has revealed a new zero-day exploit that allows remote attackers to exfiltrate Local files using Internet Explorer. “The craziest part: Windows users don’t ever even have to open the now-obsolete web browser for malicious actors to use the exploit,” reports Mashable. “It just needs to exist on their computer…”

Microsoft has announced that starting with the Windows 10 May 2019 Update, which will hit general availability late next month, users will no longer be forced to install new Windows 10 feature updates as they become available. From a report: This comes after feedback from users who have had countless issues with updates breaking programs, losing files, and installing at inconvenient times. Microsoft has been working hard to improve Windows Update, and while the system is better than it was at launch in 2015, it’s still not perfect. Now, users will have the option to not have to deal with feature updates when they are released. What Microsoft is doing here is splitting Windows Update in two. The normal “check for updates” button will now only function for security and monthly patches. Feature updates now get their own area in Windows Update where the user can initiate the download and install process for the latest feature update available. If the user doesn’t want to initiate that process, they don’t have to. The user will be alerted that a new feature update is available every now and then, but at no point will the user be forced to install that update, as long as the version of Windows 10 they’re currently running is still in support.

Members of the US Senate and House of Representatives introduced the Internet of Things Cybersecurity Improvement Act on Monday, hoping to bring legislative action to the emerging technology. From a report: Connected devices are expected to boom to 20.4 billion units by 2020, but they don’t all have the same levels of security. Hackers often target IoT devices that don’t have built-in security, leading to problems like default passwords and vulnerabilities that can’t be fixed. […] Lawmakers are looking to fix that with the bill, which would require a bare minimum of security standards for any IoT devices that the federal government uses. “While I’m excited about their life-changing potential, I’m also concerned that many IoT devices are being sold without appropriate safeguards and protections in place, with the device market prioritizing convenience and price over security,” Sen. Mark Warner, a Democrat from Virginia, said in a statement.

Mark Wilson writes: Anyone who is still using Windows 7 doesn’t have much longer until the operating system is no longer supported by Microsoft. Come January 14, 2020 only those enterprise customers who are willing to pay for Extended Security Updates will receive any kind of support. Microsoft has already done a lot to encourage Windows 7 diehards to make the move to Windows 10, and now it is stepping things up a gear. Throughout 2019, the company will show pop-up notifications in Windows 7 about making the switch to the latest version of Windows.

Microsoft is reportedly working on a new functionality that will automatically remove botched updates from Windows 10 to fix startup issues and other bugs preventing the PC from booting. “The support document was quietly published a couple of hours ago and for some reasons, Microsoft has also blocked the search engines from crawling or indexing the page,” reports Windows Latest. “In the document, Microsoft explains that Windows may automatically install updates in order to keep your device secure and smooth.” From the report: Due to various reasons, including software and driver compatibility issues, Windows Updates are vulnerable to mistakes and hardware errors. In some cases, Windows Update may fail to install. After installing a recent update, if your PC experience startup failures and automatic recovery attempts are unsuccessful, Windows may try to resolve the failure by uninstalling recently installed updates. In this case, users may receive a notification with the following message: “We removed some recently installed updates to recover your device from a startup failure.” Microsoft says that Windows will also automatically block the problematic updates from installing automatically for the next 30 days. During these 30 days, Microsoft and its partners will investigate the failure and attempt to fix the issues. When the issues are fixed, Windows will again try to install the updates. Users still have the freedom to reinstall the updates. If you believe that the update should not be removed, you can manually reinstall the driver or quality updates which were uninstalled earlier.

AmiMoJo quotes Computerworld: Microsoft plans to start selling its Windows 7 add-on support beginning April 1. Labeled “Extended Security Updates” (ESU), the post-retirement support will give enterprise customers more time to purge their environments of Windows 7. From Windows 7’s Jan. 14, 2020 end of support, ESU will provide security fixes for uncovered or reported vulnerabilities in the OS. Patches will be issued only for bugs rated “Critical” or “Important” by Microsoft, the top two rankings in a four-step scoring system. ESU will be dealt out in one-year increments for up to three years and support will be sold on a per-device basis, rather than the per-user approach Microsoft has pushed for Windows 10 licensing. Costs for ESU will start out low – $25 or $50 per year per device – but will double each year, ending at $100 or $200 per device for the third and final year.

itwbennett writes: Security researchers at Varonis have uncovered a new attack using a new version of the venerable Qbot malware that “creates scheduled tasks and adds entries to the system registry to achieve persistence,” writes Lucian Constantin, reporting on the attack for CSO. “The malware then starts recording all keystrokes typed by users, steals credentials and authentication cookies saved inside browsers, and injects malicious code into other processes to search for and steal financial-related text strings.” The researchers “found logs showing 2,726 unique victim IP addresses,” writes Constantin, but because “computers inside an organization typically access the internet through a shared IP address, the researchers believe the number of individually infected systems to be much larger.” The malware first appeared in 2009 and was found to be uploading 2GB of stolen confidential information to its FTP servers each week by April 2010 from private and public sector computers, including 1,100 on the NHS network in the UK. A modified version of the malware resurfaced in April 2016 that was believed to have infected more than 54,000 PCs in thousands of organizations around the world. As Varonis now reports, Qbot is making yet another comeback.