Windows 10: Microsoft is enhancing Windows 11's Enhanced Phishing Protection security feature

GHacks · Jul 25, 2023

Microsoft introduced the security feature Enhanced Phishing Protection in Windows 11 version 22H2 to better protect the Windows account password. The feature is now seeing improvements in the most recent Windows 11 Insider builds.

According to the changelog, Enhanced Phishing Protection functionality is now extended to copy and paste operations. Previously, it only kicked in if the user typed the password manually in unsafe contexts.

Enhanced Phishing Protection is a Microsoft Defender SmartScreen feature. Microsoft noted back then that the security feature works with different authentication systems, including Microsoft and local accounts, Active Directory and Azure Active Directory accounts. The protection is applied to any Chromium-based web browser and applications, according to Microsoft, and may also warn users about password reuse and unsafe password storage.

Password reuse refers to Windows 11 users trying to set their account password as the password for another service. Unsafe password storage refers to users storing the account password in plain text documents or Microsoft Office documents.

Windows 11 protects against using the password in malicious apps or on malicious sites only by default. Users and administrators may disable the functionality, or extend it to include password reuse and unsafe password storage warnings.

Up until now, Enhanced Phishing Protection displayed warnings only if the user typed the password. Copy and paste operations, which are also common operations when it comes to passwords, were not supported.

The most recent Windows 11 Insider build changes that. Microsoft writes: "We are trying out a change starting with this build where users who have enabled warning options for Windows Security under App & browser control > Reputation-based protection > Phishing protection will see a UI warning on unsafe password copy and paste, just as they currently see when they type in their password."

In other words: if Enhanced Phishing Protection is enabled on the Windows 11 device, it will now also inform users when they use copy and paste in unsafe contexts.

The dialog displays an option to change the password immediately and a "got it" button to close it.

Windows 11 users may configure the security feature in the following way:

Select Start > Settings.

Switch to Privacy & Security.

Select Windows Security.

Activate the "open Windows Security" button on the page.

In the Windows Security window, select App & browser control.

Switch to Reputation-based protection.

Scroll down to Phishing Protection to enable/disable the Enhanced Phishing Protection feature, and to configure the three available options separately.

Microsoft is testing the improvement currently. There is a chance that it will never land in a stable version of the Windows operating system, as it is still in testing.

Closing Words

Support for copy & paste operations improves Enhanced Phishing Protection, as it adds the common use case to the protective feature.

Thank you for being a Ghacks reader. The post Microsoft is enhancing Windows 11's Enhanced Phishing Protection security feature appeared first on gHacks Technology News.

read more...

user66001 · Jul 25, 2023

IE 11 Enhanced Protection Mode doesn't stay off

My work place has an external website (trusted) which requires Enhanced Protection Mode in IE 11 to be turned off to function correctly, however I can't seem to turn it off.

After going into Tools -> Internet Settings -> Advanced dialog, scrolling down to the Security sub-section, to uncheck Enhanced Protection Mode, and restarting the PC, it is rechecked upon getting back into Windows.

I have confirmed:

Unchecking and then reopening the dialog box prior to restarting shows it unchecked.

As we make use of GPO's: rsop.msc shows no subsection Advanced page under User Configuration (or Computer Configuration) -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel

Turning off both Protected mode in the internet zone, and Enhanced Protected Mode and rebooting PC makes no difference

Google'ng doesn't seem to result in any other circumstances this would happen

Why is Enhanced Protection Mode presumably being turned on again at startup?

Brink · Jul 25, 2023

Enhancements made to anti-phish capabilities for Office 365

We recently reported how we measure catch rates of malicious emails for Office 365 Exchange Online Protection (EOP) (available with any Office 365 subscription) and Advanced Threat Protection (ATP) (available as a standalone service or with Office 365 E5).

Today, we’re sharing the results from the enhancements we made to anti-phish capabilities for Office 365 to address impersonation, spoof, and phish content and internal phish emails sent from compromised accounts. Over the last year, Microsoft’s threat analysts discovered threat actors pivoting from malware to sophisticated, often targeted phishing campaigns. The scale of these attacks and how quickly users click through on malicious links is shown in Figure 1.

Figure 1. Phish email statistics from Office 365 from January 2018 to September 2018.

Understanding the phish landscape

To develop solutions mitigating these modern phishing campaigns, our engineers rigorously analyzed phish emails in Office 365, uncovering a general pattern of phish campaigns following the path shown in Figure 2.

Figure 2. Phish email campaign pathway from initial reconnaissance to data exfiltration.

Additionally, since Office 365 is one of the world’s largest email service providers, Microsoft gains visibility and experience across most—if not all—types of cyber threats. Every day, Microsoft analyzes 6.5 trillion signals, and each month we analyze 400 billionemails, while detonating 1 billion items in our sandbox. This telemetry helps us understand the full spectrum of phish attacks and the sophisticated and varied methods used by attackers, summarized in Figure 3. With this understanding of the phish landscape, our engineers not only designed new capabilities, but also enhanced existing capabilities to address the phishing emails being launched at customers.

Figure 3. Phish emails attack spectrum and variety of attack methods.

Understanding the situation

When we began our journey of enhancing our anti-phish capabilities, we admittedly were not best of breed at mitigating phish. As we alluded to previously, transparency with customers is a core priority at Microsoft. Figure 4 shows the number of phish emails that Microsoft (Office 365) missed in comparison to several other vendors also protecting email for customers within Office 365.

From November 2017 to January 2018, you see that Office 365 (orange bar in Figure 4) was not the best solution at phish catch. (We previously discussed how we measure phish catch.) The values are based on normalized email volume. As the inset plot shows, the scale of mail volume in Office 365 far exceeds the mail volume of third-party vendors. Fundamentally, this scale is one our differentiators and strengths as it offers us much greater depth and breadth into the threat landscape.

Figure 4. Normalized phish email miss from November 2017 to January 2018 in Office 365 email traffic. Inset shows actual mail flow volume.

Solving the problem with our technology, operations, and partnerships

Leveraging our signal from mail flow, the expertise of 3,500 in-house security professionals, and our annual $1 billion investment in cybersecurity, we strategically addressed the growing wave of phishing campaigns. Our engineers determined four categories of phish emails and designed capabilities addressing each type. Figure 5 summarizes the enhancements made to the anti-phish capabilities in Office 365.

Figure 5. Phish email categories and anti-phish enhancements made in Office 365 to address the categories.

Details on all the anti-phish updates for Office 365 are available in the following posts:

Schooling a Sea of Phish Part 1: How Office 365 Advanced Threat Protection Helps Stop Spear Phishing

Schooling a Sea of Phish Part 2: Enhanced anti-spoofing technology in Office 365

Schooling a Sea of Phish Part 3: Intra-Org Email Link Scanning and Detonation of Phish Lures

Securing the modern workplace with enhanced threat protection services in Office 365

While the enhancements are interesting, ultimately, catch rate is the parameter that counts, and it is important to remember that no solution can ever stop all threats. Sometimes misses occur, and the most effective solution will miss the least. To this end, we are very excited to share our phish miss rate from May 1, 2018 to September 16, 2018. As you can see in Figure 6, today, when compared to the same set of vendors that we compared ourselves to in November to January, we exhibit the lowest miss rate of phish emails in Office 365. Figure 6 is the culmination of the incredible focus, drive, and expertise of Microsoft researchers and engineers working together to push the boundaries of threat research, machine learning, and development of algorithms that together provide customers the most impressive and effective protection against phish emails available for Office 365 today.

Figure 6. Normalized Phish Email Miss Rate in Office 365 from May 1, 2018 to September 16, 2018. Inset is a blowup of the graph from August 1, 2018 to September 16, 2018.

While the graph in Figure 6 is illuminating, we also want to share statistics from Office 365 EOP/ATP related to phish mitigation. Figure 7 is a summary of the remarkable impact these powerful new anti-phish capabilities across EOP/ATP have had with helping secure Office 365 users, and further showcases our tremendous depth and scale into the threat landscape. For those unfamiliar with Office 365 ATP, “Safe Links” provides time of click protection from malicious links in email where the click triggers several different protection technologies, including URL reputation checks, machine learning capabilities, and link detonation as needed. Recently, Safe Links expanded its capabilities to intra-org emails, making Office 365 ATP the only service to offer this type of protection while ensuring the internal emails remain within the compliance boundary of Office 365. We hope you agree at that the anti-phish capabilities have evolved at a remarkable pace and with amazing results.

Figure 7. The impact to end users from the enhanced anti-phish capabilities in Office 365.

Learn more

We hope this post provides a good overview on how we are helping customers with modern phishing campaigns. Please be sure to check out the Ignite session, Secure enterprise productivity with Office 365 threat protection services including EOP, ATP, and Threat Intelligence, where we give more details. Your feedback enables us to continue improving and adding features that will continue to make ATP the premiere advanced security service for Office 365. If you have not tried Office 365 ATP for your organization yet, you should begin a free Office 365 E5 trial today and start securing your organization from the modern threat landscape.
Click to expand...

Source: How Office 365 learned to reel in phish - Microsoft Secure %

Brink · Jul 25, 2023

Enhancements made to anti-phish capabilities for Office 365

We recently reported how we measure catch rates of malicious emails for Office 365 Exchange Online Protection (EOP) (available with any Office 365 subscription) and Advanced Threat Protection (ATP) (available as a standalone service or with Office 365 E5).

Today, we’re sharing the results from the enhancements we made to anti-phish capabilities for Office 365 to address impersonation, spoof, and phish content and internal phish emails sent from compromised accounts. Over the last year, Microsoft’s threat analysts discovered threat actors pivoting from malware to sophisticated, often targeted phishing campaigns. The scale of these attacks and how quickly users click through on malicious links is shown in Figure 1.

Figure 1. Phish email statistics from Office 365 from January 2018 to September 2018.

Understanding the phish landscape

To develop solutions mitigating these modern phishing campaigns, our engineers rigorously analyzed phish emails in Office 365, uncovering a general pattern of phish campaigns following the path shown in Figure 2.

Figure 2. Phish email campaign pathway from initial reconnaissance to data exfiltration.

Additionally, since Office 365 is one of the world’s largest email service providers, Microsoft gains visibility and experience across most—if not all—types of cyber threats. Every day, Microsoft analyzes 6.5 trillion signals, and each month we analyze 400 billionemails, while detonating 1 billion items in our sandbox. This telemetry helps us understand the full spectrum of phish attacks and the sophisticated and varied methods used by attackers, summarized in Figure 3. With this understanding of the phish landscape, our engineers not only designed new capabilities, but also enhanced existing capabilities to address the phishing emails being launched at customers.

Figure 3. Phish emails attack spectrum and variety of attack methods.

Understanding the situation

When we began our journey of enhancing our anti-phish capabilities, we admittedly were not best of breed at mitigating phish. As we alluded to previously, transparency with customers is a core priority at Microsoft. Figure 4 shows the number of phish emails that Microsoft (Office 365) missed in comparison to several other vendors also protecting email for customers within Office 365.

From November 2017 to January 2018, you see that Office 365 (orange bar in Figure 4) was not the best solution at phish catch. (We previously discussed how we measure phish catch.) The values are based on normalized email volume. As the inset plot shows, the scale of mail volume in Office 365 far exceeds the mail volume of third-party vendors. Fundamentally, this scale is one our differentiators and strengths as it offers us much greater depth and breadth into the threat landscape.

Figure 4. Normalized phish email miss from November 2017 to January 2018 in Office 365 email traffic. Inset shows actual mail flow volume.

Solving the problem with our technology, operations, and partnerships

Leveraging our signal from mail flow, the expertise of 3,500 in-house security professionals, and our annual $1 billion investment in cybersecurity, we strategically addressed the growing wave of phishing campaigns. Our engineers determined four categories of phish emails and designed capabilities addressing each type. Figure 5 summarizes the enhancements made to the anti-phish capabilities in Office 365.

Figure 5. Phish email categories and anti-phish enhancements made in Office 365 to address the categories.

Details on all the anti-phish updates for Office 365 are available in the following posts:

Schooling a Sea of Phish Part 1: How Office 365 Advanced Threat Protection Helps Stop Spear Phishing

Schooling a Sea of Phish Part 2: Enhanced anti-spoofing technology in Office 365

Schooling a Sea of Phish Part 3: Intra-Org Email Link Scanning and Detonation of Phish Lures

Securing the modern workplace with enhanced threat protection services in Office 365

While the enhancements are interesting, ultimately, catch rate is the parameter that counts, and it is important to remember that no solution can ever stop all threats. Sometimes misses occur, and the most effective solution will miss the least. To this end, we are very excited to share our phish miss rate from May 1, 2018 to September 16, 2018. As you can see in Figure 6, today, when compared to the same set of vendors that we compared ourselves to in November to January, we exhibit the lowest miss rate of phish emails in Office 365. Figure 6 is the culmination of the incredible focus, drive, and expertise of Microsoft researchers and engineers working together to push the boundaries of threat research, machine learning, and development of algorithms that together provide customers the most impressive and effective protection against phish emails available for Office 365 today.

Figure 6. Normalized Phish Email Miss Rate in Office 365 from May 1, 2018 to September 16, 2018. Inset is a blowup of the graph from August 1, 2018 to September 16, 2018.

While the graph in Figure 6 is illuminating, we also want to share statistics from Office 365 EOP/ATP related to phish mitigation. Figure 7 is a summary of the remarkable impact these powerful new anti-phish capabilities across EOP/ATP have had with helping secure Office 365 users, and further showcases our tremendous depth and scale into the threat landscape. For those unfamiliar with Office 365 ATP, “Safe Links” provides time of click protection from malicious links in email where the click triggers several different protection technologies, including URL reputation checks, machine learning capabilities, and link detonation as needed. Recently, Safe Links expanded its capabilities to intra-org emails, making Office 365 ATP the only service to offer this type of protection while ensuring the internal emails remain within the compliance boundary of Office 365. We hope you agree at that the anti-phish capabilities have evolved at a remarkable pace and with amazing results.

Figure 7. The impact to end users from the enhanced anti-phish capabilities in Office 365.

Learn more

We hope this post provides a good overview on how we are helping customers with modern phishing campaigns. Please be sure to check out the Ignite session, Secure enterprise productivity with Office 365 threat protection services including EOP, ATP, and Threat Intelligence, where we give more details. Your feedback enables us to continue improving and adding features that will continue to make ATP the premiere advanced security service for Office 365. If you have not tried Office 365 ATP for your organization yet, you should begin a free Office 365 E5 trial today and start securing your organization from the modern threat landscape.
Click to expand...

Source: How Office 365 learned to reel in phish - Microsoft Secure %

Windows 10: Microsoft is enhancing Windows 11's Enhanced Phishing Protection security feature

Microsoft is enhancing Windows 11's Enhanced Phishing Protection security feature

Microsoft is enhancing Windows 11's Enhanced Phishing Protection security feature

Microsoft is enhancing Windows 11's Enhanced Phishing Protection security feature

Microsoft is enhancing Windows 11's Enhanced Phishing Protection security feature - Similar Threads - Microsoft enhancing 11's

Enhance device security

Enhance device security

How to use Enhance audio feature on Windows 11

Enhance Feature of the Photo App

Photo ENHANCE feature

enhancement

Enhancements made to anti-phish capabilities for Office 365

Enhanced Virtual Desktops (Feature(s) Request(s))

Enhance..still not enhancing..