Ensuring your Windows 10 Clients are protected from CryptoAPI bug

Two weeks ago, Microsoft patched a vulnerability in its cryptographic library (CryptoAPI) that was reported by the NSA. At the time, there were no reports that this vulnerability had being exploited in the wild, however both Microsoft and the NSA where keen for organisations to install patches as quickly as possible. In its second-ever emergency directive, DHS' CISA recommended organisations perform the required endpoint patching by the 29th of January. I wrote about the first CISA emergency directive in my Advice on Mitigating DNS Infrastructure Tampering.

Proof-of-concept exploit code was quickly made available, but there are still no reported attacks. With the potential of attackers exploiting the vulnerability to sign malicious executables, that is, making malicious executables appear as if they are from a trusted, legitimate source; there are plenty of reasons to make installing this patch a priority.

As administrators, we already have the tools at our disposal to ensure that our Windows 10 clients are protected. Intune and Azure AD Conditional Access can once again be used to protect clients, as we did with Spectre and Meltdown.

How does it work? Read my post Using Intune and AAD to protect against Spectre and Meltdown, to understand the basics of how we can implement checks to validate the version of Windows 10 installed for Intune enrolled devices.

You will need to specify either of these two values for the Minimum OS version in your Windows 10 complaince policy:

• For Windows 10 version 1903 (May 2019 Update): 10.0.18362.592
• For Windows 10 version 1909 (November 2019 Update): 10.0.18363.592

I recommend the later, 10.0.18363.592, as it will allow you to ensure that all your clients are running the very latest Windows 10 features.

Need help with Windows 10 version numbering? Check out Wikipedia’s Windows 10 Version History) page. It is an exceptionally detailed guide on what versions you need to be aware of.

What’s Coming up with AzurePublicIPAddresses

Just a brief post to discuss the future of the AzurePublicIPAddresses PowerShell module.

I still believe there is a community need for this module, and as such, am going to continue to support it. The module fills some gapes in the Azure space, allowing for IT professionals to easily determine which addresses belong to each region. I have spoken to a few people who have used the module to help in managing their on-premises firewall rules, etc., they have spoke of how this module has helped them. I want to continue to support them. What is clear, is that I will need to invest some time in making some considerable updates to the module. These are to ensure that the module continues to function.

Microsoft has now flagged that the XML based Microsoft Azure Datacenter IP range files are now deprecated. They will stop updating these files on 2020-06-30. The new mechanism for getting updates is the Azure IP Ranges and Service Tags files. These are JSON formatted and include a break down of IP ranges by region and service. This opens more functionality to the users of the AzurePublicIPAddresses module, allowing the choice of IP ranges based on region and service. Another benefit is support for the US Government Cloud Regions.

I don’t expect it to take me a year to update the module, however with the file format changes, and some of the structural changes in the file, it might take a little effort to ensure that everything works as expected. The plan is to have a beta version available later in the year. My goal is to release version 2, with this and other updates, by the end of the year.

In the meantime, I will continue to support the current module, releasing updates when new regions are made available.

The Boring Security Talk at the Global Azure Bootcamp 2019

This weekend I spoke at the Global Azure Bootcamp 2019. This was another great day, this year hosted at Swinburne University.

I presented a longer version of my talk, The Boring Security Talk. The longer format lets me get into some extra details. The extra time also provides some time to talk about some of the latest security incidents that have occured in the last few months.

I have put together a list of links and reference materials:

• Hackers exploit Jenkins servers, make $3 million by mining Monero
• DHS: Multiple US gov domains hit in serious DNS hijacking wave
• Advice on Mitigating DNS Infrastructure Tampering
• A Deep Dive on the Recent Widespread DNS Hijacking Attacks
• DNS Squatting with Azure App Services
• Microsoft loses control over Windows Tiles subdomain
• DNSControl
• Managing DNS with DNSControl, CloudFlare, DNSimple, GitHub, VSTS, Key Vault and Docker
• MX Toolbox
• PostMark DMARC reporting
• Report URI DMARC monitoring
• Phishing Scorecard
• UK ICO, USCourts.gov... Thousands of websites hijacked by hidden crypto-mining code after popular plugin pwned
• Malicious Docker Containers Earn Cryptomining Criminals $90K
• Postmortem for Malicious Packages Published on July 12th, 2018
• Malicious remote code execution backdoor discovered in the popular bootstrap-sass Ruby gem
• Pipdig Update: Dishonest Denials, Erased Evidence and Ongoing Offences

The Boring Security Talk - Azure Global Bootcamp Melbourne 2019 from kieranjacobsen

[Updated Module] AzurePublicIPAddresses v1.0.14 has been released

A new version of the AzurePublicIPAddresses module has been released. This includes support for 8 new regions: UAE, South African, Chile, and Brazil. For more information see the Change Log.

Getting the Module

If you have never used the module before, the easiest way to get AzurePublicIPAddresses is through the PowerShell Gallery:

PS> Install-Module -Name AzurePublicIPAddresses

If you already have the module installed, you can update the module from the PowerShell Gallery with:

PS> Update-Module -Name AzurePublicIPAddresses

You can also download the release from the module’s GitHub Releases page.

Found an issue? Then raise any bugs or feature requests via GitHub Issues.

Azure Automation State Configuration – Installing Common DSC Modules

Azure Automation State Configuration

Azure Automation State Configuration (previously Azure Automation DSC), is a service provided by Azure that allows you to write, manage and compile PowerShell Desired State Configuration (DSC) configurations and assign these configurations to target virtual machines (or any server or workstation to be honest). On its own, State Configuration provides some basic configuration examples, but its true power comes form the ability for you to define your own configurations.

User created configurations need to be imported and compiled before the configuration is applied to a virtual machine. It is common when creating DSC configurations to rely on a variety of DSC Resources. The modules containing these resources need to be imported into Azure Automation for it to be able to compile any configuration. So how do we import and update these modules?

The first mechanism to manage the PowerShell modules is through the Azure Portal, by going to your Automation Account > Shared Resources > Modules. Here you can add modules from a zip file, update the built in Azure modules, or add modules from the PowerShell Gallery. This provides a simple mechanism particularly if you are starting; unfortunately, most production configurations will need multiple modules, making the Azure Portal difficult to use.

We can also manage modules via ARM templates. Define the template is relatively straight forward but requires a couple of tricks to get started. I will put together a separate blog post on how you can define your own ARM template.

Accelerating Adoption

I wanted to help those starting out with State configuration. My goal was to help accelerate new State Configuration deployments, by creating a “starter” ARM template that would install the most common PowerShell DSC modules that are in the PowerShell Gallery and the most common in my production DSC configurations. This ARM template could also be used to ensure that the modules are also updated on a regular basis.

So what modules are included? I selected 32 modules in the end. These cover the configuration of core Windows, Windows Server roles and features, security hardening, package management and Chocolatey. Most of the modules are maintained by Microsoft, however four modules, cChoco, cSpeculationControlFixes, UpdateServicesDSC and xSystemSecurity that are maintain by members of the community.

Module Name	Author	Description
ActiveDirectoryCSDsc	Microsoft Corporation	This DSC Resource module can be used to install or uninstall Certificate Services components in Windows Server.
AuditPolicyDsc	Microsoft Corporation	The AuditPolicyDsc module allows you to configure and manage the advanced audit policy on all currently supported versions of Windows.
cChoco	Chocolatey Software Lawrence Gripper Javy de Koning	Chocolatey DSC Resources for use with internal packages and the community package repository. Learn more at http://chocolatey.org/
CertificateDsc	Microsoft Corporation	This module includes DSC resources that simplify administration of certificates on a Windows Server
ComputerManagementDsc	Microsoft Corporation	The ComputerManagementDsc module is originally part of the Windows PowerShell Desired State Configuration (DSC) Resource Kit. This version has been modified for use in Azure. This module contains the xComputer and xDisk resources. These DSC Resources allow you to perform computer management tasks, like joining a domain or initializing disks.
cSpeculationControlFixes	Kieran Jacobsen	PowerShell DSC for enabling Speculation Control fixes on Windows Server
DFSDsc	Microsoft Corporation	DSC resources for configuring Distributed File System Replication and Namespaces.
GPRegistryPolicy	Microsoft Corporation	Module with cmdlets to work with GP Registry Policy .pol files
GPRegistryPolicyParser	Microsoft Corporation	Module with parser cmdlets to work with GP Registry Policy .pol files
NetworkingDsc	Microsoft Corporation	Module with DSC Resources for Networking area
PackageManagementProviderResource	Microsoft Corporation	Module with DSC resources for the package management.
PSDscResources	Microsoft Corporation	This module contains the standard DSC resources. Because PSDscResources overwrites in-box resources, it is only available for WMF 5.1. Many of the resource updates provided here are also included in the xPSDesiredStateConfiguration module which is still compatible with WMF 4 and WMF 5 (though that module is not supported and may be removed in the future).
SecurityPolicyDsc	Microsoft Corporation	This module is a wrapper around secedit.exe which provides the ability to configure user rights assignments
SqlServerDsc	Microsoft Corporation	Module with DSC Resources for deployment and configuration of Microsoft SQL Server.
StorageDsc	Microsoft Corporation	This module contains all resources related to the PowerShell Storage module, or pertaining to disk management.
UpdateServicesDsc	Michael Greene	Module with DSC Resources for deployment and configuration of Windows Server Update Services.
WindowsDefender	Microsoft Corporation	Windows Defender module allows you to configure Windows Defender settings.
xActiveDirectory	Microsoft Corporation	The xActiveDirectory module is originally part of the Windows PowerShell Desired State Configuration (DSC) Resource Kit. This version has been modified for use in Azure. This module contains the xADDomain, xADDomainController, xADUser, and xWaitForDomain resources. These DSC Resources allow you to configure and manage Active Directory.
xDhcpServer	Microsoft Corporation	Module with DSC Resources for DHCP Server area
xDismFeature	Microsoft Corporation	Module with DSC Resources for Deployment Image Servicing and Management features.
xDnsServer	Microsoft Corporation	Module with DSC Resources for DNS Server area
xFailOverCluster	Microsoft Corporation	Module containing DSC resources used to configure FailOver Clusters.
xInternetExplorerHomePage	Microsoft Corporation	This DSC Resources can easily set an URL for the home page of Internet Explorer
xPendingReboot	Microsoft Corporation	This module identifies pending reboots in Windows Server and acts on them.
xPSDesiredStateConfiguration	Microsoft Corporation	The xPSDesiredStateConfiguration module is a part of the Windows PowerShell Desired State Configuration (DSC) Resource Kit, which is a collection of DSC Resources produced by the PowerShell Team. This module contains the xDscWebService, xWindowsProcess, xService, xPackage, xArchive, xRemoteFile, xPSEndpoint and xWindowsOptionalFeature resources.
xRemoteDesktopAdmin	Microsoft Corporation	Module with DSC Resources for enabling administrative Remote Desktop Connections
xSmbShare	Microsoft Corporation	Module with DSC Resources for SmbShare area
xSystemSecurity	Arun Chandrasekhar	Handles Windows related security settings like UAC and IE ESC. xUAC enables or disables the User Account Control prompt, while xIEEsc enables or disables IE Enhanced Security Configuration.
xTimeZone	Microsoft Corporation	This DSC Resources can easily set the System Time Zone.
xWebAdministration	Microsoft Corporation	Module with DSC Resources for Web Administration
xWindowsEventForwarding	Microsoft Corporation	This module can be used to manage configuration of a Windows Event Forwarding server in a Collector role.
xWindowsUpdate	Microsoft Corporation	Module with DSC Resources for Windows Update
xWinEventLog	Microsoft Corporation	Configure Windows Event Logs

Want to get started and use the template?

You will need an Azure Automation account to start.

You can then use the Deploy to Azure button on the Git Repository or download the latest release and deploy using Azure CLI or PowerShell.

What to contribute?

The project is up on GitHub and I welcome everyone to make suggestions and recommendations. If you need a had with your first PR, check out this guide from egghead.io. I have connected this project to Azure DevOps build pipelines so all PRs will be validated for any issues.

Presentation: Secure Azure Deployment Patterns

It was a wonderful experience to present at the Azure Global Bootcamp in Melbourne this year. This year I spoke about possible methods or patterns for securing Azure resources. This is an extremely board topic, though I focused on App Services, Virtual Network Endpoints and ARM templates.

You can find the PowerPoint slides to download here or view them via SlideShare.

Secure Azure Deployment Patterns from kieranjacobsen

AzurePublicIPAddresses v1.0 has been released

I'm pleased to announce Version 1.0 of AzurePublicIPAddresses. This version includes support 6 new Azure regions:

• Australia Central
• Australia Central 2
• UK North
• UK South 2
• North Europe 2 (name TBC)
• East Europe (name TBC)

This release also represents a major milestone since the modules creation back in March 2016. The module has proven to be very stable, and hence I'm now giving it the stable 1.0 moniker. I'm confident that the existing design should support any new regions or source XML files that Microsoft may release without the need for breaking changes.

What's the future for this module? With the launch of Azure Service Tags, in some respects this module has become less useful, but, I'll maintain the module for the immediate future.

I'm also thinking how this module and the JSON based file for Azure Service Tags should fit together. My current through it to create a separate module that consumes that file and allows you to select addresses by region and service.

Getting the Module

If you have never used the module before, the easiest way to get AzurePublicIPAddresses is through the PowerShell Gallery:

PS> Install-Module -Name AzurePublicIPAddresses

If you already have the module installed, you can update the module from the PowerShell Gallery with:

PS> Update-Module -Name AzurePublicIPAddresses

You can also find the module on GitHub.

Found an issue? Then raise any bugs or feature requests via GitHub Issues.

AzurePublicIPAddresses module now supports the France and Germany Azure Regions

Map of Azure Regions as of February 2018

I'm pleased to announce that my PowerShell for working with Azure’s public IP address listings now supports the new Azure Regions in France and Germany. This release, 0.9, introduces some minor breaking changes, needed to support the Germany regions.

Each month of so, I check the Microsoft Azure Datacenter IP Ranges file for new regions. This month, I noticed that the France Central and France South are included.

The Azure Germany regions, Germany Northeast and Germany Central, are managed under a trustee model by T-Systems. This is like that of Azure in China. I hadn’t seen the German regions IP ranges before, but last week I found the file: Windows Azure Datacenter IP Ranges in Germany. My goal always was to support every available Azure Region, as such, I've now included these regions.

I must admit, I didn’t fully design this module to be future proof, I assumed all regions would be included in a single file. I first included Azure in China in version 0.8, with the -ChinaRegion parameter. While functional, this wasn’t future proof. To offer support for Azure Germany, version 0.8 includes some breaking changes in the Get-MicrosoftAzureDatacenterIPRangeFile CMDLet.

With version 0.9, I've removed the -ChinaRegion parameter and replaced it with -Region. This new parameter takes one of 3 values: Standard, China or Germany. This parameter now has this behaviour:

• Standard: the default value, downloads the Microsoft Azure Datacenter IP Ranges file.
• China: downloads the Windows Azure Datacenter IP Ranges in China file
• Germany: downloads the Windows Azure Datacenter IP Ranges in Germany file

If you were separately downloading the China region file, you'll need to ensure that you update your scripts logic.

I've also tweaked Get-MicrosoftazureDatacenterIPRange. The first change was to add support for the extra file to download, and the parameter change. I've also modified the logic around how the CMDLet stores the region information. I don’t expect these changes to cause any issues.

Getting the Module

If you have never used the module before, the easiest way to get AzurePublicIPAddresses is through the PowerShell Gallery:

PS> Install-Module -Name AzurePublicIPAddresses

If you already have the module installed, you can update the module from the PowerShell Gallery with:

PS> Update-Module -Name AzurePublicIPAddresses

You can also find the module on GitHub.

Found an issue? Then raise any bugs or feature requests via GitHub Issues.