SHA-1 Windows content to be retired August 3, 2020

[Brink]

To support evolving industry security standards, and continue to keep you protected and productive, Microsoft will retire content that is Windows-signed for Secure Hash Algorithm 1 (SHA-1) from the Microsoft Download Center on August 3, 2020. This is the next step in our continued efforts to adopt Secure Hash Algorithm 2 (SHA-2), which better meets modern security requirements and offers added protections from common attack vectors.

SHA-1 is a legacy cryptographic hash that many in the security community believe is no longer secure. Using the SHA-1 hashing algorithm in digital certificates could allow an attacker to spoof content, perform phishing attacks, or perform man-in-the-middle attacks.

Microsoft no longer uses SHA-1 to authenticate Windows operating system updates due to security concerns associated with the algorithm, and has provided the appropriate updates to move customers to SHA-2 as previously announced. Accordingly, beginning in August 2019, devices without SHA-2 support have not received Windows updates. If you are still reliant upon SHA-1, we recommend that you move to a currently supported version of Windows and to stronger alternatives, such as SHA-2.

Source: SHA-1 Windows content to be retired August 3, 2020 - Microsoft Tech Community - 1544373

 

[TechnoMage2016]

So, is there no way to update Win-7 to SHA-2?


That's my one dumb question for today.


TM

 

[SIW2]

Run Simplix.

 

[flavallee]

How far along (month and year) is the Windows 7 in your computer up to date?

There really is no "dumb question".
That's how we learn about computers.

 

[TechnoMage2016]

Ok, another day and another dumb question...
"What the heck is Simplix?"
I've been working with PC's for over 40 years, and I've never heard of it.

 

[TechnoMage2016]

I give up! I Googled "Simplix" and found it on the Major Geeks website.
So, I downloaded it and tried to install it, and after two attempts, I still get this:
See attachment.


I give up. Probably not something that I really need anyway.


Thanks for all the help.


TM

 

[Bree]

So, is there no way to update Win-7 to SHA-2?

KB4474419 SHA-2 code signing support update for Windows 7 - Sept. 10

 

[flavallee]

TechnoMage2016:

The Simplix Update Pack has become a "must have" for me.

As soon as I finish doing a clean install of Windows 7 Professional SP1 64-bit in a computer, I run Simplix Update Pack.

It runs uninterrupted with no intervention from me and automatically updates the operating system to July 2020 wiith its current version - 20.7.15

As soon as it's finished, I install the necessary drivers and perform the activation.

The amount of time it used to take me to complete the entire process has been cut by more than half.

 

[chuckhig]

Simplex....worked for me. Thanks all.

 

[LevelBest]

KB4474419 SHA-2 code signing support update for Windows 7 - Sept. 10

How can i tell if I have installed this update? I've just had to run a system image from January 2020 and there are no updates showing in my installed list anymore. Is there somewhere I can check on the system?

Many thanks
LB

 

[SIW2]

I've just had to run a system image from January 2020

Run simplix

 

[LevelBest]

Run simplix

I don't want to install or download stuff. I've just re-imaged the computer and it's running much better, so I don't want to do anything that may mess that up. I may already have this update installed, if it came through as part of a previous load of updates I don't see why I would not have installed it but I would like to be able to double check. So is there a way finding this information within the computer?

 

[SIW2]

Simplix scans your installed system, and then installs any missing updates. It is by far the best way to ensure your system is up to date.

If WU is not showing anything under Installed Updates, it should be able to repopulate the database if you try it a couple of times and reboot.

 

[LevelBest]

If WU is not showing anything under Installed Updates, it should be able to repopulate the database if you try it a couple of times and reboot.

That's really helpful, thank you, when I looked yesterday there was nothing there but they are all appearing now and I've searched and KB4474419 was installed in September 2019. So job done, thanks.

 

[RoWin7]

Source: SHA-1 Windows content to be retired August 3, 2020 - Microsoft Tech Community - 1544373

I know we're not supposed to be getting updates since January. So why is MSU telling me there are 96 optional updates, aside from the one for MSE? Would some of those be the ones with telemetry I chose not to install? but there are too many of them.

The link to Simplix is dead. There's one here, and I believe Major Geeks is still reliable:
Download Simplix UpdatePack 7 20.8.13

Will Simplix take care of the SHA stuff without my having to know what it means?

 

[SIW2]

Yes, just run simplix.

 

[RoWin7]

Done
And why are we still getting updates past January 14?

 

[SIW2]

Ask any questions on the developers site.

 

[Bree]

I don't want to install or download stuff. I've just re-imaged the computer and it's running much better, so I don't want to do anything that may mess that up. I may already have this update installed, if it came through as part of a previous load of updates I don't see why I would not have installed it but I would like to be able to double check. So is there a way finding this information within the computer?

Yes, there is. Open a Command Prompt and type the command SystemInfo which will give you a list of all installed updates by KB number under 'Hotfix(s):'. The updates will be listed in the order that they were installed, earliest first.

 

[Brds7t7]

One downside to this is the Microsoft Baseline Security Analyzer no longer seems to work. The past 2 months it has failed downloading the wsusscn2.cab file. I always found it a useful tool to use when scanning for the Security-only updates.

It hasn't been supported by MS for about 5 years though, so I'm not surprised really.

Aug 2020 wsusscn2.cab reported as damaged or not valid via MBSAcli.exe

I've switched to using the VBS script method instead, which seems to do the same thing, without the HTML output and links to the updates:

MBSA no longer supported - stop asking questions about it - here is an alternate solution