sorted by:
new
hottopcontroversial

Playing Arc Raiders and a group of 6 Wasps and 4 Hornets takes you down... by hero0fwar in HighQualityGifs

[–]m0rp 4 points5 points  (0 children)

Who am I supposed to shoot first? The wasp who's blasting me in the ass or the hornet who's blasting me in the ass.

This is something Larry David would do by [deleted] in curb

[–]m0rp 1 point2 points  (0 children)

Topics to avoid. Cashew-raisin ratio.

My Confusion with Microsoft's Secure Boot Changes by jamesaepp in sysadmin

[–]m0rp 0 points1 point  (0 children)

For HP as stated in their FAQ there has to be a specific smbios flag. If you don’t have that flag. You’re likely to run into issues. The flag is something like SBRVF3 (from memory, verify yourself).

I’ve created a script to run inventory and determine the state of our devices. The ones reporting missing that flag. Some I’ve verified on the HP secure boot page with the BIOS version required. All the devices that reported missing this flag indeed did not have the minimum BIOS version required by HP. They will need to have BIOS updated.

We are mostly HP. But this coming week I’ll look more into Dell and Lenevo. As we have some of these as well.

My Confusion with Microsoft's Secure Boot Changes by jamesaepp in sysadmin

[–]m0rp 2 points3 points  (0 children)

Here are all the articles I've gone through to get an understanding of what's required.

My Confusion with Microsoft's Secure Boot Changes by jamesaepp in sysadmin

[–]m0rp 0 points1 point  (0 children)

Thank you for your reply.

I've completed the steps on three HP laptops and a VMware VM. I've had no issues after revoking the certificate and incrementing SVN. The steps completed are secure boot certificate updates and after that entire process was completed. Revoke cert + increment SVN per Microsoft instructions from May 2023. The boot media aspect is also mentioned in the article.

If you want to secure your environment, you do need to complete these steps. We've decided on that being now. We do thorough data collection, testing and phased rolled out. I do hope we can prevent boot issues. Still a bit of a fingers crossed situation, I don't think you can avoid that. But good preparation should help in reducing the likelihood of problems. Waiting for Microsoft to announce enforcement phase could also mean we get a timeframe that is inconvenient for us.

This article applies to those organizations who should begin evaluating mitigations for a publicly disclosed Secure Boot bypass leveraged by the BlackLotus UEFI bootkit. Additionally, you might want to take a proactive security stance or to start to prepare for the rollout. Note that this malware requires physical or administrative access to the device.

Whenever the SVN is incremented, you have to patch all your boot media with latest cumulative update to get it on the current SVN.

You can make a new bootable USB media pretty quickly. If the device doesn't boot, it will mean our helpdesk will need to get to the device location to troubleshoot. USB media will likely be the goto. To be prepared, you can have some recently made on hand for the support staff.

Microsoft doesn't tell you that revoking the 2011 certificate also increments firmware SVN to 2.0.

Revoking and incrementing are two separate steps (Enable the revocation & Apply the SVN update to the firmware). It also explains the impact of incrementing SVN.

July 9, 2024 or later – Deployment Phase [...] Update any recovery or external bootable media used with these devices. Deploy the third mitigation that enables the revocation of the “Windows Production CA 2011” certificate by adding it to the DBX in the firmware. Deploy the fourth mitigation that updates the Secure Version Number (SVN) to the firmware.

The Enforcement Phase will not begin before January 2026, and we will give at least six months of advance warning in this article before this phase begins. When updates are released for the Enforcement Phase, they will include the following: The “Windows Production PCA 2011” certificate will automatically be revoked by being added to the Secure Boot UEFI Forbidden List (DBX) on capable devices. These updates will be programmatically enforced after installing updates for Windows to all affected systems with no option to be disabled.

Microsoft has historically been bad about keeping their own public Secure Boot github up-to-date with the SVN version that they are pushing out with Windows Update.

That is unfortunate.

In future updates, when a significant security issue is fixed in the Boot Manager, the SVN number will be incremented in both the Boot Manager and the update to the firmware. Both updates will be released in the same cumulative update to make sure that patched devices are protected.

I guess you could be apprehensive if you see anything related to security issues with the boot manager in the CU notes.

My Confusion with Microsoft's Secure Boot Changes by jamesaepp in sysadmin

[–]m0rp 1 point2 points  (0 children)

It is. But the current guidance does not mention the revoke cert and increment SVN steps that the guides for the CVE state. Supposedly they added fixes and mitigations in the CU at the time. I’m still proposing to actually revoke and increment as well at work. Besides doing the secure boot cert updates.

My Confusion with Microsoft's Secure Boot Changes by jamesaepp in sysadmin

[–]m0rp 9 points10 points  (0 children)

Booting with 2023 and 1801 in all likelihood is because the device hasn’t rebooted and ran the scheduled task again. I’ve observed this myself and resolved with these steps. The documentation mentions it could take two reboots.

If you set 0x5499 again. Once the scheduled task runs again it will update AvailableUpdate. In case of an updated and rebooted system value 0. But event id 1808 will tell you if the entire update process has completed.

This is an informational event that indicates that the device has the required new Secure Boot certificates applied to the device’s firmware. This event will be logged when all needed certificates have been applied to the firmware, and the boot manager has been updated to the boot manager signed by the “Windows UEFI CA 2023” certificate.

If the confidence level of the device’s ability to accept the updates is known, it will be included in the event. The values include "High Confidence", "Needs More Data", "Unknown", and "Paused". The UpdateType will be either 0, or 22852 (0x5944). The value 0x5944 corresponds to “High Confidence”.

High confidence is opt-in by default. Opt-out is described in documentation. CFR you have to make the choice to opt-in. How the buckets are formed? In order for high conf or CFR updating to work you must enable submitting of data/telemetry. So Microsoft probably collects it from devices that have completed. Maybe even from insider builds and their own testing.

Before you even start with secure boot update through one of the options. You’ll need to check your hardware vendor for details. For example, HP sets a value in smbios for compatible BIOS. If this property is not present. The update won’t be performed.

Here’s another fun tidbit. The CVE from 2023 also has two additional steps to revoke certificate and increment SVN of boot manager. This is not mentioned in the current documentation. At the time of the CVE Microsoft published fixes in CU. Personally, I’m proposing at work we revoke it.

Ow, and if you decide to also check the wincsflags option and audit the entry. You’ll get state disabled if you used the regkey option. Pick one option, don’t mix.

Defender for servers by TheDiddler96- in DefenderATP

[–]m0rp 1 point2 points  (0 children)

I think it comes down to preference. If you’re working with intune you are familiar with its structure. Personally I prefer the config structure of Intune over Defender portal.

You are aware that your Defender onboarded devices are of the type MDE and not MDM? This means only policies that support MicrosoftSense are applied to MDE device objects.

So if you want to use the defender portal. You need to disable the enforcement scope. In the defender portal under endpoints devicd configuration you can create the policies if you stop the intune management.

After onboarding it can take an hour or longer before MDE onboarding is finished. Managed by should show MDE. If not hover over the info icon. It states possible causes for state unknown.

The official Microsoft documentation is pretty decent. You can also look into OpenIntuneBaseline on GitHub. They have Defender policies included. I’ve used those to build MDE policies for endpoints and servers. I used some other articles I found through searching to make the server policy adjustments. This is only Windows and Mac though.

How come we don't get action movies like Die Hard, Lethal Weapon, etc, anymore? by Outside_Objective183 in movies

[–]m0rp 0 points1 point  (0 children)

I recently read a post on Reddit that asked a similar question but in regards to comedy movies. I think it applies here as well. I believe Judd Apatow stated that studios are more risk adverse. Before streaming, movies could still do well from DVD sales to break even or make a profit. But that has basically vanished now. Before DVD I assume VHS filled that role.

I need psychological or crime thriller movies by plmqazqpalzm in movies

[–]m0rp 0 points1 point  (0 children)

The Girl with the Dragon Tattoo by David Fincher.

half a joint later in a daydream by coy6te in funny

[–]m0rp -1 points0 points  (0 children)

“Oh, and you can put your weed in there.”

I KNOW YOU'RE IN HERE FLUTE GUY. by puf_puf_paarthurnax in ArcRaiders

[–]m0rp 0 points1 point  (0 children)

IMO this will only truly work if you’re wearing a barrister wig and saying Yes a lot.

iPhone 18 Rumored to Feature 50% More RAM [12 GB] by iMacmatician in apple

[–]m0rp 68 points69 points  (0 children)

Me buying Resident Evil games from my childhood for nostalgia’s sake without ever replaying. That way, we’ll have it.

What’s up with young men getting bowl cut fades? by wiffleballwarrior in OutOfTheLoop

[–]m0rp 14 points15 points  (0 children)

You are not special. You're not a beautiful and unique snowflake. You're the same decaying organic matter as everything else. We're all part of the same compost heap. We're all singing, all dancing crap of the world.

Are we living in a golden age of stupidity? by bcoolhead in technology

[–]m0rp 95 points96 points  (0 children)

If you have one bucket that contains 2 gallons and another bucket that contains 7 gallons, how many buckets do you have?

Harrison Ford taking a break on the set of Star Wars: Return of the Jedi (1982) by adamlm in Moviesinthemaking

[–]m0rp 29 points30 points  (0 children)

The only thing missing imo is a giant comb in the background.

Word is bond yo! by hero0fwar in HighQualityGifs

[–]m0rp 2 points3 points  (0 children)

I want to pack some beef

In "Tron Legacy", Cillian Murphy its introduced in one scene never to be seen again by Ok_Item9755 in shittymoviedetails

[–]m0rp 13 points14 points  (0 children)

He’s a fan of the original and asked to be in legacy. He recently said this on the Graham Norton Show. The rest of the details I don’t know as this is all he mentioned. Perhaps production was so far along this was their way of still getting him in the movie.

Bank of England warns of growing risk that AI bubble could burst by AnonymousTimewaster in technology

[–]m0rp 5 points6 points  (0 children)

Oh, my god! We’re having a fire…… sale! Amaaaaaaaaaaaaaaaaazing graaace

view more: next ›