Windows 10: Microsoft is phasing out VBScript in Windows to improve security

Microsoft announced plans to deprecate Visual Basic Script (VBScript) support in its Windows operating system. The company introduced VBScript, which is modeled on Visual Basic, in 1996. Web developers were the initial target of the scripting language, but it soon gained popularity with Windows administrators. Administrators used VBScript to automate tasks on Windows. Malware developers started to use the scripting language as well in their attacks, for instance to infect systems with the infamous I Love You worm.

Microsoft included VBScript in Internet Explorer, its first major web browser. Internet Explorer is no longer supported in most versions of Windows and Microsoft disabled VBScript in IE some time ago as well.. VBScript itself has been pushed aside by Microsoft's .NET framework and it has been supported with bug fixes and security fixes only for a long time.

The deprecation message on Microsoft's website provides the following information: "VBScript is being deprecated. In future releases of Windows, VBScript will be available as a feature on demand before its removal from the operating system."

Microsoft doesn't provide a timeline at this point. VBScript is turned into an optional feature for Windows in "future releases" and it will continue to be enabled by default in the beginning. Eventually, Microsoft will flip a switch to make VBScript an optional component that is no longer enabled by default before removing the functionality entirely from Windows.



Windows administrators may list optional features in the Settings app. An easy way to get there is to open Start, type optional features and select the manage optional features item that is returned. Windows lists all optional feature that are installed on the page. The "add a feature" button displays all available features that are not installed at the time.

Disabling VBScript removes the attack vector


Microsoft offers no reason for disabling VBScript. Clearly, deprecation VBScript will improve security as attackers can't use .vbs scripts anymore in their attacks. While there are plenty of alternatives available, plugging one attack vector is better than nothing.

Bleeping Computer, which discovered the information, also believe that Microsoft is doing this primarily to improve security. VBScript is still used in malware attacks up to this day.

Once VBSCript is added to the optional features, Windows users may disable the feature in the Settings app. An option to disable the Windows Scripting Host to block .vbs malware is also available already.

Thank you for being a Ghacks reader. The post Microsoft is phasing out VBScript in Windows to improve security appeared first on gHacks Technology News.

read more...

 

Microsoft Security Bulletin for September 2007

Microsoft released yesterday the September Security Bulletin for Windows operating system, as part of its monthly security cycle. This bulletin summary lists one critical and three important updates. For more information, see Microsoft Security Bulletin Summary for September 2007.

Source: Microsoft

 

Microsoft Botches Up UEFI Support for Windows 7 on ASUS Motherboards



Microsoft suggests updating to Windows 10 to patch Windows 7

• 
  
  
• Chris Merriman
• 
  @ChrisTheDJ
• 05 May 2016

• Tweet
• Facebook
• Google plus
• Send to

9 Comments

MICROSOFT HAS confirmed a potentially lappy-borking problem that it won't be fixing, because Windows 7.

Woody Leonhard, the respected Windows columnist, points to a problem involving Asus motherboards, which also appear rebadged in a variety of other manufacturers' machines, and the activation of UEFI Secure Boot for Windows 7 in a patch KB3133977.

Short version: install update, welcome to Borksville, population you.

Both Asus and Microsoft acknowledged the problem. Microsoft entitled the article "BitLocker can't encrypt drives because of service crashes in svchost.exe process in Windows 7 or Windows Server 2008 R2", but we prefer to just call it "Trevor for brevity."

The firm's advice was that it's an optional update, leave well alone, you'll be fine, or alternatively turn secure boot off.

Then Microsoft did a silly, silly thing.

It moved the update from 'optional' to 'recommended' and anyone who reads this site regularly will know what happens when Microsoft does this. That's right boys and girls - it makes it automatically install, unless you've specifically told your machine not to.

So now, if you have one of the affected motherboard and you keep your security updates automatic like wot Microsoft recommends, then your machine will stop working properly.

We should add it's not permanently bricked, but it will take some mucking about in the BIOS to fix and that's a pain even for an experienced computer user.

Microsoft has, by offering a workaround, suggested heavily that it won't be fixing the problem, though we have asked the question, so expect a response in about a fortnight.

But the real kicker is this piece of advice: "Note The Secure Boot feature is supported in Windows 10. To learn more about the security advantages of this feature and about the upgrade path from Windows 7 to Windows 10, go to the following Windows website"

Holy toledo, this company really knows how to rub people up the wrong way.

After all - if the advice is to manually avoid the update or move to a version of the operating system where there's virtually no control over updates, then Microsoft is dealing in massive contradictions.

A more cynical site would suggest that it's yet another example of Microsoft running Windows 7 into the ground and adding built in obsolescence to encourage quicker updates. But we're not that sort of site.

Its the patching to force secure boot that is the problem win 7 does not support secure boot
hence it borks systems and well microsofts answer is Cactus >your Asshole > insert

from the inquirer

 

Microsoft Edge TLS Security

After trying everything (not a lot of steps) listed in the Microsoft Edge support site, I did a wider search and found this very simple youtube video that fixed it immediately:

For those who prefer not to click links the steps are simple:

1. Click in the Cortana search bar next to the Win 10 Start button

2. Type internet options

3. Select internet options (control panel) from the list

4. Click on the advanced tab

5. Scroll down to the security section

6. Make sure the following are all clicked:
Use SSL 3.0
Use TLS 1.0
Use TLS 1.1
Use TLS 1.2

7. Click apply

8. Refresh the page that was giving the error and it should now connect.

Hope this helps, it was a 30 second fix after hours of pounding my head against the error with the Support site suggestions.