Latest Update Patches 57 Security Vulnerabilities, March 13 2025

[Condobloke]

Microsoft's Latest Update Patches 57 Security Vulnerabilities

Microsoft's latest Patch Tuesday update includes fixes for seven zero-day exploits.

au.lifehacker.com

Yes, I know.......Microsoft.

However, many members still run the windows OS...usually as a dual boot. In which case they are vulnerable

if you must use that OS, stay alert.

ClickFix: How to Infect Your PC in Three Easy Steps – Krebs on Security

HTH

 

[ron.alan]

Ah, the "bad" old days.

 

[Condobloke]

It would appear the "bad old days" are not so 'old'......they are still with users of that OS

I have no real idea of the number of dual booters on this forum, nor of the guests who visit us daily, but I would hazard an educated guess that the numbers are significant. Sufficiently significant to warrant an article of this nature.

 

[KGIII]

Lest Linux users get too cozy, there are 6+ pages (20 entries per page) of Linux updates in the past month. (I figure MSFT does this once per month, typically on Tuesdays known as Patch Tuesday.)

https://www.linux.org/forums/linux-security-announcements-automated.14/page-7

So, don't get complacent!

(Which is my point in this comment. We too have security issues that need to be patched and we too must update.)

And, to be more exacting, we have the liberty of seeing the code. We can see and verify security fixes. We have no clue about the code in Windows. We have no way of knowing anything more than they tell us.

Well, there is the 'Shared Source' program from MSFT. That has been around for decades at this point. You need justification but they'll share (some) source code with you if you ask nicely. You don't get to edit it and they only share what you requested. It's not open source by any reasonable definition.

You can read about that here:

Shared Source Initiative - Wikipedia

en.wikipedia.org

So, if you're a government agency or work for a large company, you can audit the code for security reasons and for reasons like integration. You don't get to edit the code. You'll sign an NDA first and you can't share the code outside of your organization. So, I'd never call it 'open' anything.

 

[bob466]

Ah, the "bad" old days.

The bad ol days never ended with m$.

 

[Condobloke]

They appear to exist in perpetuity.....

NOTE: I have added another link to my original post

 

[Condobloke]

ClickFix: How to Infect Your PC in Three Easy Steps – Krebs on Security

 

[ron.alan]

We too have security issues that need to be patched and we too must update.

Yes, but at least they are spread out, and not lumped all together on some arbitrary day of the week/month.

 

[CaffeineAddict]

Yes, but at least they are spread out, and not lumped all together on some arbitrary day of the week/month.

Indeed, it suggests MS would not release a patch even if they know is vulnerability only because the schedule is not due lol

 

[KGIII]

Yes, but at least they are spread out, and not lumped all together on some arbitrary day of the week/month.

My understanding is that they do it that way to make it easier for companies managing a lot of devices. They do release updates on other schedules if they're considered severe enough or if the exploit has been made public.

 

[Fanboi]

ClickFix: How to Infect Your PC in Three Easy Steps – Krebs on Security

Yeah, no offense to uninformed PC users, but that sort of "social engineering attack" requires a pretty special strain of stupid. I mean you'd have to be about as familiar with PCs as I am with pole dancing. Don't want to sound mean to people who might stumble on this in search results, but if you earned it you deserve it. You don't buy a car not knowing how to drive. If this were 50 -- heck even 20 -- years ago, I'd understand. But as it goes now, I never met the stereotypical "grandpa who can't use a PC". I've met idiots of all ages who can't because they're too lazy. That's it. Lazy. Everyone here (who doesn't come just to complain about Linux) has put in a reasonable to extreme amount of effort to learn what they know. To a point maybe the industry's at fault for encouraging users to not bother, IDK. But as I always say, the biggest threat is not malware, it's the person sitting in front of the PC.

 

[theLegionWithin]

But as it goes now, I never met the stereotypical "grandpa who can't use a PC". I've met idiots of all ages who can't because they're too lazy. That's it. Lazy.

agreed - especially since in the last 10+ years or so basically all jobs require a computer of some sort (other than at an amish community, maybe, assuming they're not outsourcing).

 

[KGIII]

By the way, I forgot to mention this in a previous reply, the third step is where this fails on Linux.

Well, that should be where it fails. You may have downloaded malware but it can't execute until you've set the executable bit and manually run the application.

(This assumes no other privileged escalation means. They'd have to daisy-chain a number of exploits and find a bug that let said exploit work.)

As I've often said, security is a process, not an application. The biggest security threat is the one sitting in the chair. These days, even Windows is reasonably secure - unless you do things that lessen that security (like falling for this attack).

I don't do that whole victim blaming thing. I will point out that you can learn how to increase/keep your security for free. There are many sites that will teach you how. There are likely free computer classes for adults at your nearest adult-ed facility. Barring that, you still have a ton of websites that you can learn from.

A part of me wonders if we should have made computes so easy to use. I realize that's gatekeeping but we sure do have a lot of people who give no care about how their computer works.

If people would learn to avoid this stuff, the bad people would eventually stop trying to do this stuff because they'd just be wasting their time and money. They do this stuff because it works. They send out spam because it works. They phish because it works. This stuff works because a subset of people don't care to learn even the basics.

Some folks are better off in a walled garden. In that case, they have a level of protection despite their best efforts.

They'd probably do better in the Apple ecosystem. At least that's a UNIX under the shell (and even has some open source) and is very secure. Still, I don't do any victim blaming. I look for other options that might work better for them, but I find victim blaming to be distasteful.

 

[Condobloke]

If people would learn to avoid this stuff, the bad people would eventually stop trying to do this stuff because they'd just be wasting their time and money. They do this stuff because it works. They send out spam because it works. They phish because it works. This stuff works because a subset of people don't care to learn even the basics.

Amen to that !

 

[Trynna3]

Yeah, no offense to uninformed PC users, but that sort of "social engineering attack" requires a pretty special strain of stupid. I mean you'd have to be about as familiar with PCs as I am with pole dancing. Don't want to sound mean to people who might stumble on this in search results, but if you earned it you deserve it. You don't buy a car not knowing how to drive. If this were 50 -- heck even 20 -- years ago, I'd understand. But as it goes now, I never met the stereotypical "grandpa who can't use a PC". I've met idiots of all ages who can't because they're too lazy. That's it. Lazy. Everyone here (who doesn't come just to complain about Linux) has put in a reasonable to extreme amount of effort to learn what they know. To a point maybe the industry's at fault for encouraging users to not bother, IDK. But as I always say, the biggest threat is not malware, it's the person sitting in front of the PC.

Well, I would partially agree: people should make an effort to educate themselves about online security, but tbf, you don't know what you don't know.
I have been using Windows computers since my mid 20s, long time ago, a normie. Just last year, 2024 I had a massive boost in computing, that including backing up practice and trying Linux for the first time. We, who have a better understanding of computers and cyber security, we are privileged and no longer appreciate the blissful ignorance of average folks who didn't come this far. That reminds me our university teacher, telling us at the beginning, that over time we will gain knowledge way above knowledge of everyday folks, and we won't notice this difference, taking our knowledge for granted and having difficulties to comprehend why not everybody knows this. I often remind this to myself.
Industry comes into this to protects itself, making the users not to need caring about stuff, because the majority won't. And so even the MS is turning into a nanny, limiting average users in many ways, telling them what to do or doing it for them out of the box, limiting them in doing other things, like the S mode. Schools don't teach other practical things for life, like finances, practical skills to fix things, critical thinking is in a short supply, and so looks computer awareness of average folks. Apps on mobile devices are highly restrictive (turning users to mere consumers of content) and I refuse to go on a fakebook or youtube via an app. Always a browser where I have a better control over things.

 

[Fanboi]

Well, I would partially agree: people should make an effort to educate themselves about online security, but tbf, you don't know what you don't know.
I have been using Windows computers since my mid 20s, long time ago, a normie. Just last year, 2024 I had a massive boost in computing, that including backing up practice and trying Linux for the first time. We, who have a better understanding of computers and cyber security, we are privileged and no longer appreciate the blissful ignorance of average folks who didn't come this far. That reminds me our university teacher, telling us at the beginning, that over time we will gain knowledge way above knowledge of everyday folks, and we won't notice this difference, taking our knowledge for granted and having difficulties to comprehend why not everybody knows this. I often remind this to myself.
Industry comes into this to protects itself, making the users not to need caring about stuff, because the majority won't. And so even the MS is turning into a nanny, limiting average users in many ways, telling them what to do or doing it for them out of the box, limiting them in doing other things, like the S mode. Schools don't teach other practical things for life, like finances, practical skills to fix things, critical thinking is in a short supply, and so looks computer awareness of average folks. Apps on mobile devices are highly restrictive (turning users to mere consumers of content) and I refuse to go on a fakebook or youtube via an app. Always a browser where I have a better control over things.

I'll agree with you on the part about society, i.e. companies like MS putting people off bothering and schools not teaching critical thinking. But I think we all need to take personal responsibility. In a world where cyber threat awareness is all over the place -- we're bombarded with headlines about it, AV ads, you name it -- anyone should think, "How do I learn to protect myself?" followed by some web searching.

 

[Trynna3]

I'll agree with you on the part about society, i.e. companies like MS putting people off bothering and schools not teaching critical thinking. But I think we all need to take personal responsibility. In a world where cyber threat awareness is all over the place -- we're bombarded with headlines about it, AV ads, you name it -- anyone should think, "How do I learn to protect myself?" followed by some web searching.

Since you mentioned AV ads - many think that having an AV will protect them fully, still on Win7 (some with the trial expired long ago), like my family member just recently left Win7 for Win11 and that only because the laptop broke physically and it was a nuisance to use it. Then Google kept paying to other browsers and Apple billions to be the default search engine, people not knowing they have a choice, and google is notoriously becoming more about sales and malware right at the top searches... there was even a fake google authenticator app, with signature, in the app store. How are people supposed to know this? Or when they google a phone number of a bank, the top result might be the scammers paying for the ad... people are too distracted these days that they won't notice.
Or take the massively advertised deleteme or incogni on youtube. They present it, and the websites themselves, that by paying a monthly fee they will totally erase our data from internet, which isn't true. But people seeing the ads will pay and trust the service (giving them their data on top) that they are safe and that they did enough to be protected from scammers cold callers. And that even more from supposedly computer experts on youtube who got sponsored by this sham business, while advising people how to protect themselves by other means. I haven't seen anyone criticising these services on large and I only came to realisation I don't want to finance them after I realised that dark web is outside of their scope - finding the weakest link. And then there are plentiful legit databases that must hold our data for years, getting hacked and data bypassing the data brokers, right onto the dark web. The most they can do for you is to give you an alert that your data was found there. In time there will be data of most of us, so why paying to somebody every month to tell me what I already know?
These are the fine print details you often won't find after a brief searching on the web, only somebody who takes it as a hobby to learn the holes in the system will become aware, after hours and hours of watching and reading, and completing a mosaic of little facts what is happening around. I have got a sense that even web searching is there to sell you an illusion of internet safety in most cases.

 

[Fanboi]

They'd probably do better in the Apple ecosystem. At least that's a UNIX under the shell (and even has some open source) and is very secure. Still, I don't do any victim blaming. I look for other options that might work better for them, but I find victim blaming to be distasteful.

Fair points. I usually wouldn't blame a victim of cyber crime like how I don't those on who are scammed, but I think there's this part of me that can't reconcile that actual attack specifically. I have doubts as to that working on anyone today, but I'm not a security researcher. As opposed to "Your Computer Is Infected!!! Download your antivirus now." which I can understand takes advantage of human psychology which is panic first, ask questions later. And yeah, I agree about Mac, too. Windows and the move away from UNIX-alike systems, is probably the worst thing that happened in computing history, and had MS not played the best marketing game ever (albeit, IMO, also the most unethical), we'd never have ended up in this mess. But such is life, I suppose.

 

[Fanboi]

Since you mentioned AV ads - many think that having an AV will protect them fully, still on Win7 (some with the trial expired long ago), like my family member just recently left Win7 for Win11 and that only because the laptop broke physically and it was a nuisance to use it.

You should have used the opportunity to introduce them to Linux

Then Google kept paying to other browsers and Apple billions to be the default search engine, people not knowing they have a choice, and google is notoriously becoming more about sales and malware right at the top searches... there was even a fake google authenticator app, with signature, in the app store. How are people supposed to know this? Or when they google a phone number of a bank, the top result might be the scammers paying for the ad... people are too distracted these days that they won't notice.

I'll be honest, I've never heard of Google facilitating scams, but then I don't use Google products. My gmail account, which I use just for my phone, is where the buck stops. I use a Xiaomi (Chinese brand) phone, so I wouldn't know about Samsung et al. but my phone scans anything you install from the Playstore. I'm just going out on a limb, but I imagine these incidents aren't an every day thing.
Still, I'd never criticise anyone for installing from a trusted source and getting infected, that would be 100% blame on who operates the repository.

Or take the massively advertised deleteme or incogni on youtube. They present it, and the websites themselves, that by paying a monthly fee they will totally erase our data from internet, which isn't true. But people seeing the ads will pay and trust the service (giving them their data on top) that they are safe and that they did enough to be protected from scammers cold callers. And that even more from supposedly computer experts on youtube who got sponsored by this sham business, while advising people how to protect themselves by other means. I haven't seen anyone criticising these services on large and I only came to realisation I don't want to finance them after I realised that dark web is outside of their scope - finding the weakest link. And then there are plentiful legit databases that must hold our data for years, getting hacked and data bypassing the data brokers, right onto the dark web. The most they can do for you is to give you an alert that your data was found there. In time there will be data of most of us, so why paying to somebody every month to tell me what I already know?
These are the fine print details you often won't find after a brief searching on the web, only somebody who takes it as a hobby to learn the holes in the system will become aware, after hours and hours of watching and reading, and completing a mosaic of little facts what is happening around. I have got a sense that even web searching is there to sell you an illusion of internet safety in most cases.

That's a little conspiratorial. I mean you're right that these services don't scrub you from the internet, but they're geared towards social media mainly (and most people don't know what they're looking for on wayback machine to get those pages that were crawled where someone said something cringey) and for automating data removal requests. It's a complete sham and a total false sense of security, but so are all the skin creams that will make you look younger and the pills that claim you can lose weight while lying on the couch eating pizza all day.
Most of these evils aren't strictly and online thing. I mean there are two contexts of "data brokers": people who sell stolen secrets online, and people/companies that sell your contact info. In the case of the latter, this has been going on long before everyone was online. You sign up for a rewards card and within a month you get five calls per day to sell you insurance. You sell them your data in exchange for the deals that come with the rewards card. It sucks, but it's not going anywhere any time soon. Not unless people either wise or make enough of a protest about legal transparency. I'd go with the latter. That would clean things up across the board, not just with your personal data, but hidden clauses that stop insurance paying out, and the "*" next to "Uncapped", too.

 

[theLegionWithin]

yeah - I cant do anything to help the majority of the populace but i've convinced my family members to ask me when they have computer/security concerns. let me tell you, it took quite a bit of doing to get them to remember to ask me first.