Archived Release Notes

Features

Enhance Security with Anti-tamper Hardening OptionCopy&Go secondary media handling

When enabling the feature from WebMC, default Windows input compounds will be blocked and cannot be exploited to escape KIOSK mode.

• Notes: The shortcut to turn off KIOSK application is changed to ALT+S

Automatically unlock and process encrypted USBs with organization password

Organization-level alternative decryption security keys can be provided in management console and used as pre-configured password (max to 2 entries) to unlock encrypted USBs.

Simplified workflow

This new and minimal workflow is introduced to support plug-and-play media scanning with automatic decryption and result display (notes: when it is ON, the full workflows for Employee and Guest are disabled.)

Support files redaction, complete the workflows with Data Leak Prevention

Besides sanitizing infected files and detecting potential leak, KIOSK now is able to redact/substitute sensitive information and watermark files.

• Notes: The new term for sanitized and redacted is now Remediated

Support rescan retrieved files from Vault

• Previously KIOSK allows to rescan the retrieved files from a directory, now this feature is available for an integrated Vault.

Support HCI network volume

The new version of OMVA 2.0.8 comes with new KIOSK is compatible with Cluster Shared Volumes in HCI (Hyperconverged infrastructure)

Enhancements and fixes

For Hardened image

• KIOSK is compatible with Windows Defender

• KIOSK starts from service.

Improve the self-scan feature

It’s now possible to schedule self-scan on a certain weekday

Enhance the labeling of CD-ROM/DVD/BD-ROM in the scan result

Scan results and log now show the correct media type for CD/DVD and Blueray disc

Several defects have been addressed.

Known Issues and limitations.

Will be addressed in our next versions.

The power options in Start Menu sometimes disappear after closing KIOSK.

Sometimes, File Explorer will be triggered behind KIOSK Application.

KIOSK currently does not have the capability to retry entering the password for Kanguru Defender 3000.

Set Settings cannot apply Anti-tamper Hardening to all KIOSK instances.

Cannot trigger Self Scan by clicking SCAN NOW because Simplified workflow already starts a session.

Workaround solution: Admin can configure Schedule Self Scan and enable option Allow Self Scan to cancel any currently running scan to trigger Self Scan

Features

Copy&Go secondary media handling

Introduced new button to allow choosing to insert secondary media at the start or end of a Copy&Go session

A new config option now exists in File Handling of a workflow to only allow inserting secondary media at the end of a session

Exit Kiosk with administrator AD credentials

Extended the configuration to allow exiting the Kiosk with AD administrator credentials

NTFS ADS detection

Added ability to detect and warn that an Alternative data stream was found in a processed file. This information can be seen in session history and in the reports.

Disable Vault ID display

Vault server configuration allows to disable showing any Vault ID information on the UI

Support for additional encrypted devices

• DataLocker Sentry ONE

• Viasat Eclypt

• Viasat Freedom 600

My OPSWAT integration

Initial preparation for basic inventory & license reporting support in a future My OPSWAT release (end of September)

Features

Security note

The system administrators are required to make Kiosk machine more secured by following actions:

1. Set a BIOS password

2. Enable TPM and Secure Boot in the Windows system

3. Turn on BitLocker encryption

Fixes

System hardening

• Disable keystrokes to maintain uninterrupted Kiosk operation and reduce interference (CVE-2023-36657)

• Prevent unintended executables to be ran (CVE-2023-36658)

• Prevent overly long input (CVE-2023-36659)

Fixes

System hardening

Optimized Windows system settings to maintain uninterrupted Kiosk operation and reduce interference

Features

Preloading passwords for encrypted archives

Allows users to preload list of passwords for encrypted archives before the scanning

Enforce remote login

Administrators can disable remote login for local, AD, or SSO users

Screensaver

Kiosk can play a video after a predefined amount of idle time

SDMS MkIII AES Duoulock support

SDMS MkIII AES Duoulock can be unlocked and processed

Media types

The admin can configure Kiosk to accept encrypted USBs only

Fixes/Enhancements

SSL certificates

Certificates added in the management console are stored in the Microsoft Certificate Store

Copying to disc

Fixed issue that prevented copying from one disc to another in the same session

Password protected archive\document handling

Corrected issue where certain passwords would not unlock files and Kiosk would re-prompt for input.

Improved encrypted archive handling when scanning with Vault.

Time filter in custom log display

Removed the custom time setting in Dashboard, Application Log, Windows Event Log, & Visitor Log

Verbose log compression

The support package is compressed at the highest level

Time format of [time] for Vault server

hh:mm:ss is changed to hh-mm-ss

Scanning duration

Enhancement of performance when utilizing existing process results

Copy&Go

All preparation actions need to be done prior to the scanning and the session ends without additional user actions

Features

Statistic information for Central Management

Added a periodic system health check and provided detail of session statistics for Central Management, for tracking purposes.

Hide Vault access ID on UI

The Vault access ID is now hidden on the UI. Users can temporarily reveal the ID for 3 seconds.

Sessions finish automatically

Enhanced the ability to complete session automatically without waiting for user actions. The session waits on pages where user input is required or results are necessary to view.

Visitor Management configuration

Specific visitor questions can now be enabled/disabled.

Management or Contact persons can be configured to not receive session reports attached to visitor check-in emails.

If no further questions are configured in a workflow, visitors are navigated to media detection screen immediately.

Fixes/Enhancements

UI unresponsiveness

Scanning a large amount of data may cause the Kiosk UI to hang indefinitely. Kiosk can detect this hanging, terminate and revive the UI to the state where hanging occurred.

Scanning archive files

Fixed mounting issues with TIB/VMDK/VHD archive files.

File retrieval

Encrypted devices are now supported in file retrieval.

Features

SMTP configuration

Sender input is mandatory for email settings (e.g., From field). The configured user for SMTP access needs to have permission to send as a configured email sender.

Email improvements

Session reports can be emailed to multiple recipients.

Pre-defined variables can be inserted into the body of the email to show some select data from a session.

Password change required on first login

Newly created users are required to change their password on their first login to the Management Console

Active Directory configuration in Visitor Management

Administrators can configure both AD users and groups as Contacts for Guests

Auto-selection of workflow

Administrators can either let employees select a workflow or automatically move forward with the first matched workflow an employee can use

Fixes/Enhancements

Custom command script

The syntax now works the same as on a DOS terminal

Scanning Pause/Resume

Pausing a scan requires additional confirmation

User authentication

Corrected the display for custom authentication on changes of Display disclaimer screen.

Authentication performance was also improved.

Performance enhancement for AD queries

Sped up the performance when connecting/querying to AD server

Features

Non-authenticated workflows

Kiosk administrator can create multiple workflows for guests to select on demand.

Email template

Emails can now be customized with logos, text colors, and font sizes for workflows.

Fixes/Enhancements

Visitor configuration

Corrected issue where loading a large amount Active Directory users would take a long time for Visitor Contact configuration.

Retrieval page

Direct navigation to the Vault retrieval page occurs when only one retrieval option is enabled.

syslog data

Expanded session data in json format for syslog messages.

Features

Upgrade in-place

Upgrade of Kiosk no longer requires uninstallation of the previous version. This allows for history logs to be maintained in between version upgrades. The original upgrade method still operates the same.

Copy empty folder

Empty folders from scanning sources are copied to local/network destination after scanning

Fixes/Enhancements

Skipped file reporting

Files not able to send to Core for scanning are now considered as Skipped files. Customer can configure to show/hide skipped files in their workflow printing options.

Trust self-signed certificates

Administrators can add self-signed certificates to trust directly in the Management console

File integrity monitoring

Corrected issue where Kiosk would be disabled by file monitoring when the feature was disabled

Stale processing results

Any change to a Core workflow will require a file to be analyzed to ensure results reflect the latest policy configured

Self Scan

Inaccessible system files are skipped during a Self Scan to avoid indefinite retries to scan

Features

Country of Origin

The Country of Origin feature helps administrators add more restrictions on the scanning result by specifying which countries a publisher resides in as forbidden. Files published from forbidden countries are considered blocked.

Configurable printing per session type

Allows printing to be enabled/disabled separately for each action Scan/Retrieve/Wipe

Fixes/Enhancements

Scan result for encrypted archives in Copy&Go mode

Fixed issue that showed both Allowed and Blocked status on the same file

Slow processing time for a large dataset

Improved performance in processing large datasets

Features \ Enhancement

Skip Print button displayed for all session flows

Added Skip Print button when Print button is displayed

Editing workflow with many AD members assigned

Optimized performance with workflow loading to allow workflows with a large amount of members assigned to be edited

Support for updated encrypted device software versions and retrieving files

Added support for updated versions of some encrypted device software and corrected instances where retrieved files were download to incorrect volumes leading to failures

Fixed

Reports being stripped from emails

Modified content type in email reports to prevent specific email policies from blocking attachments

Retrieve files to disc

Fixed issue that prevented files to be retrieved and copied to a disc

Session history failing to load in certain cases

Corrected background sorting of session history that caused for sessions to not be displayed in the Management Console

Features

Nested group support for login

Active Directory with nested group supported for login in Kiosk UI

Archive file selection

Support multiple selection of password protected archives to scan

Visitor Management

Session report is sent to Manager, Contact, and Guest

Fixed

Phone detection

Fixed issue with phones not being detected

Central Mgmt config push affecting SSL settings

Prevented export/upgrade of certificate settings

Mismatch file result display in Session History

Corrected the display of mismatch result in session report

Configuration import

Fixed issue where certain settings were not maintained on a configuration import

Email session report

Correct cases where email was sent without a sender

Browse window

Refined UI browsing page

Features

OMVA Logging

Accessible logging in json format generated when plugging & validating media into a machine with OMVA installed

Printer Status

New icon on UI to show current printer status

Session history username filtering

Able to filter Session History in the Management Console by username

Fixed

Copy file to disc

Corrected detection of a blank disc as destination media to copy files to

"Set Settings" applied to all instances

Fixed issues causing Central Management failing to "set settings" to other Kiosks. Extending timeout settings in CM may be necessary

Workflow selection

Adjusted workflow selection for better usability

Session log saved to network share

Fixed case where the session log was not properly saved to a network shared folder

Management Console login

Modified Management Console behavior to only allow a user to be logged in from a single browser

USB whitelisting

Serial number to include vendor name and model

Features

User workflow selection

A user may now be assigned to multiple workflows either by direct assignment or group assignment.

When logging in to a Kiosk session, users will be presented with their assigned workflows to choose.

Spanish translation

Added support for default Spanish translation

Mail configuration test

When configuring SMTP settings, administrators may now test their settings within the mgmt console

Fixed

OMVA failing to validate media after a reboot

Fixed issue where media validation no longer worked after reboot in certain domain environments

Saving session logs to network shares

Corrected issue that prevented session logs from saving to networks shares due to permission issues

Allow sessions to end automatically

Modified session flow to adhere to UI timeout settings when the session is done

Active Directory load when editing workflows

Further enhancements to speed up the AD user & group loading when a workflow is edited

Local user password restrictions

Removed extra restrictions on passwords for local users and increased the minimum length to 12 characters

Features

Vault processing - File size limit

File sizes can now be limited to dictate what is uploaded to Vault for processing

Vault processing - File count limit

The amount of files can now be limited when processing files with Vault

Copy-to media device info in logging

When files are copied to secondary media, the device information of this media is now included in the session logging

Fixed

Processing VMDKs with Linux file systems

Fixed issue with failing to process contents in a VMDK with Linux file systems

Processing discs with CDFS file system

Corrected detection error the prevented processing discs with CDFS file system

Hebrew language display

Restored Hebrew display when browsing for files and selecting copy-to directories

Management Console login case insensitivity

Modified mgmt console login to not require case sensitive username input

Retrieve available files from Vault

Enhanced Vault file retrieval to not display files that are not approved by a supervisor

Email reports

Fixed issue where email reports were sent to incorrect recipients with similar names

Features

syslog support for TLS over TCP

syslog can now be configured to send messages using TLS

USB Copying Whitelist and Retrieving files

The whitelist to allow USBs to copy files to now also applies to retrieving files from Vault or directory

Battery percentage display

If MetaDefender Kiosk is deployed on a battery powered system (i.e. tablet\laptop) a battery power indicator will be displayed on the user interface in the bottom right corner

Disable hash calculation for non-processing session

For workflows where no processing is configured, the hash calculation of files can be disabled to allow for a faster session completion time

Fallback to OS logged in user when copying files to a directory

File handling to copy files to a directory now has the ability to enable copying files as the OS logged-in user if copying using the Kiosk user session credentials fails

Fixed

Media detection

Corrected further issues with media detection:

• encrypted devices being detected as CDROM

• media insertion not being detected after a wipe event

Wipe functionality

Corrected further issues with wiping media:

• encrypted device handling attempting to wipe the un-encrypted disc partition

• wiping hanging on completion

• device detection not operating after a wipe event

AD User & Group load in workflows

Improved the mechanism to load the list of AD users & groups to better handle large amounts

Retrieve files from Vault

Fixed a case where authenticating a user to Vault for retrieving files was failing

Send email only when blocked files are found

Restored the expected behavior of the workflow email setting to only send a session report email when a blocked file is found in a session

Features

Digital signing of session logs

Session logs can now be digitally signed with a configured certificate to ensure logs have not been tampered with

Supported browsers for the Management Console

The Management Console supports Chrome, Firefox, and Edge browsers. Internet Explorer and others are not officially supported

Fixed

Media detection

Enhanced media detection logic to reduce inconsistent issues with misdetection or improper identification of media

Copy & Go and copying to user media destination

Copying files to a secondary media is now supported when Copy & Go processing is enabled

SSO Management console login from a remote system

Fixed a redirection issue that caused users to not be navigated into the mgmt console after a successful SSO login

Guest workflow file retrieval

Corrected issue where Guests were not allowed to retrieve files if certain user authentication settings were set

Features

Estimated time remaining display during processing

Processing progress indicator now shows current time elapsed and estimated time remaining

Retrieve files from Vault as a Guest

Guests can retrieve files from Vault using a Guest ID

Multiple copy-to directory support

Multiple copy-to directories can be configured in file handling. Users can select which directory to copy to when the user copy selection is enabled.

Browse file selection totals

Options for browsing files can now be set to display the number of files selected and the total size of the selection

Fixed

File\Session history export

Corrected issues with the export taking too long to generate and timing out connections

Retrieve files from Vault as an AD user

Fixed problems with retrieving files from Vault for certain AD user configurations

OMVA multiple media manifest support

Adjusted OMVA support for handling multiple media manifests on a device

Features

SSO authentication for the Management Console

Management Console login settings have been expanded to allow connecting an Identity Provider via SAML 2.0

Fixed

Custom workflow editor load time for a large AD

Reduced the amount of time it takes to load the AD user\group list when editing a custom workflow

Periodic Core test

Fixed eicar test string generation that was affecting the detection rate

OMVA non-ascii path support

Corrected OMVA support for handling file paths with non-ascii characters which would result in blocking media

Features

Allow AD users to log in to the Management Console

Management Console login settings have been expanded to allow connecting Active Directories to allow users/groups to login

Fixed

Session log directory in Central Management

Fixed validation error that prevented setting the session log directory from Central Mgmt

Automatic export

Corrected non-ascii errors with automatic export and added Scanning System information to the csv

Features

Configurable result for un-processed large files

Management Console administrators can now specify if a file should be allowed or blocked if it exceeds the file size limit for sending a file to MetaDefender Core.

Fixed

Floppy drives consistently spinning

Fixed issue where certain floppy drive models would spin up consistently while Kiosk was running

Workflow login selection

Corrected instances where mapping a logged in user to a workflow did not follow the configured order

File size process limit

Adjusted file size calculation to prevent errors with setting file size limit for processing files

Core URL validation

Repaired error detection that would prevent connecting a Core via hostname

Features

Configure HTTPS from the Management Console

Management Console administrators can now configure listening port and HTTPS settings from within the Management Console

Configurable boot sector processing

Boot sector files can now be disabled from appearing in browsing for files to process and not included when processing all contents of media

Fixed

UNC file path support for retrieving files

Fixed issues where retrieving files from a UNC path would fail

User question display in session export

Session export data now displays the user question and answer to the question in order

Copying files to disc

Corrected instances where long file paths were failing to be copied to discs

Features

Configure order of workflow profiles

Custom workflow profiles can now be manually adjusted to indicate the order in which users are identified to belong to

Periodic Core test

Kiosk can be configured to periodically send an EICAR file to ensure Core's detection is functioning

Fixed

Email session report

Corrected issues with connecting to SMTP, sending emails to the logged in user and guest users

Authentication failure when Remote AD SSL is enabled

Fixed active directory communication to not attempt the default LDAP port when SSL is enabled

Automatic export of session\file history logs

Export log path configuration was failing to save and the file history export was lacking information, this has all been corrected

UNC path support for session logs

Fixed issue that prevented configuring a UNC path for specifying where session logs were written out to

Features

Copy & Go processing

New Core processing option that allows copying files to the system and removing media before file processing begins

Retrieving files from a directory

Ability to retrieve files from a local or network share and run the files through Core before copying to the inserted media

OMVA configurable uninstall password

The uninstall password can now be modified for deployments to endpoints

Whitelist for secondary media

Whitelist can now be specified for copy-to media

Fixed

Language import

Corrected issue where languages were not allowed to be edited after importing configuration of a previous release

IP support for SMTP host configuration

Fixed issue where connecting to an SMTP host configured by IP would fail

Hostname for syslog

syslog server can now be configured by either IP address or hostname

Users and Groups synced in workflows on Central Mgmt

The users and groups re-assigned to other workflows on Central Mgmt now updates as expected and syncs to the Kiosk instance's settings

Fixed

Remote Active Directory connection and assigning users and groups to a workflow

Fixed domain identification issues that would block adding an AD server. Corrected problems where displaying the users and groups of a server would fail.

Usability of selecting groups to assign to a workflow

Added the ability to search the groups list to find specific entries

Features

Multiple Active Directory support

Multiple active directories can now be added to expand the coverage of users allowed to use Kiosk

Automated log retention

Application logs and session history can now be set to automatically clean up records older than a configured time span

Fixed

Issues with user authentication and foreign language passwords

Fixed issues where users could not authenticate when their passwords contained foreign characters

Username & user response variables for the copy-to directory

Copy-to directory validation has been fixed to allow the user name and user response variables

UI exit password setting

Fixed an issue where the exit password was changed when user authentication settings were modified

Offline systems could not locally access the mgmt console

Updated internal management console settings to allow offline systems to access the console locally

Selecting groups to add to a workflow

Only allowed groups are displayed to assign to a workflow

Central Management v7 configuration sync

Corrected many issues where settings disappeared from the Central Management view or were applied incorrectly

Features

NGINX serving the Management Console

IIS Express has been replaced with NGINX to power the Management Console

Guests can email session reports

Guests are now prompted to enter an email to session reports, when emailing reports is enabled

Send passwords with encrypted archives when processing with Vault

When an encrypted archive is identified, a password can be input to submit the file to Vault for processing

Support for Kanguru Defender Elite 200

Added support for processing Kanguru Defender Elite 200 USB

Fixed

Setting custom export date range

Fixed the date selection to allow setting a custom date range to export session or file history

OMVA install via automated deployments

Modified OMVA installation to work successfully in remote deployments

Hash verification copy failure with extension-less files

Corrected an issue with hash verification failing on files without an extension

Copying files to a network share as Guest

Copying to a network share now utilizes the credentials of the user logged in to the system to copy files in the Guest workflow

Features

Specify Vault copy-to directory structure

Administrators can now indicate the directory structure of how files are uploaded to Vault when configuring a Vault server

Allow users to confirm to delete all blocked files

When blocked file handling is set to delete files, an Administrator can now allow users to confirm whether the blocked files should be deleted or not

Fixed

Copy-to media blocked with OMVA

Copying all allowed files to a secondary media that was wiped would still cause OMVA to block the media. This workflow has been modified to allow OMVA to unblock the media as expected.

Configure syslog settings from Central Management

A managed instance's syslog settings can now be configured via Central Management v7

Single password use to unlock multiple encrypted archives

Fixed an issue where the checkbox to supply a single password to multiple encrypted archives was not being respected

AD groups are only allowed to be added to a workflow profile

Only AD group objects will be allowed to be added to a workflow profile to reduce confusion with authentication issues

Sanitized file handling with the custom command line script

Corrected an issue where sanitized files were not handled in a configured script

Fixed

Detection of multiple Linux partitions

A device with multiple non-Windows partitions can now be browsed through and processed

Vault entry changes applied automatically to selections

Any changes made to an entry in the Vault server list are automatically applied across all configured selections of that specific server

Windows XP+ support for OPSWAT Media Validation Agent

OMVA now supports Windows XP and above

Report files quarantined by Core

Files quarantined by Core are now reported on the session summary without having to configure to have the files removed

Language menu button on the on-screen keyboard

Corrected button behavior where the keyboard language button would remain open despite clicking away from it

Features

Specify Vault user to upload files to

New configuration option allows for specifying a Vault user to upload files to in addition to the previous settings of uploading to the user logged into Kiosk or a guest account

Fixed

Retrieve files from Vault

Fixed issues with downloading files from Vault among multiple users

File sizes displayed in browse

Corrected the file size display when browsing for files

Features

Image Media

New process flow allows for an image to be created of the inserted media and uploaded to a specified location (e.g. Vault or directory)

Fixed

IIS Express 10 support

Kiosk REST service now runs uninterrupted if the underlying IIS Express is upgraded to version 10

Updated German language strings

German language strings are now up-to-date

Blocked sound playback

Fixed an issue where the sound byte to alert for blocked files would not play at times

Features

Visitor Management

Visitor management allows the ability for guest users to check-in to an organization via the Kiosk. During the check-in process the guest user accepts any agreements specified by the organization, a badge for the visitor can be printed and contact\admin personnel are automatically notified when a guest has arrived.

Fixed

Korean keyboard character composition

Onscreen Korean keyboard has been fixed to correctly combine Hangul characters

Device whitelisting applies to destination media

Device whitelisting is now applied to destination media, in addition to the source media used for processing

Copy files to IronKey USB

Corrected behavior where files were copied to the wrong volume for specific IronKey USBs

Features

Management Console settings locked when instance is managed

The Management Console now has the ability to show details when it is managed. If managed, changes to settings are disabled. Currently supported for Central Management v5, v7 in the future.

Configure the length of time a Vault guest account is valid

Administrators can now specify how long a created Vault guest account can remain valid

Fixed

Processing system files

Enhancements made in attempting to process system files that may be potentially locked

File integrity monitor event

Upgraded the visibility of a file integrity monitor event to be included in the syslog application events

Features

Delete after retrieving files

Retrieving files from Vault can now be configured to delete the files from the server after download

Fixed

Copy to disc folder structure

Copying to disc no longer creates a Session ID directory when the no subfolders option is enabled

Settings display on Central Mgmt v7

Fixed issues with some fields being improperly displayed in Central Mgmt

LDAP groups workflow profile assignment

Corrected an error where a users logging in to Kiosk were not identified under a user group assigned to a workflow profile

Features

Ability for Kiosk to use multiple backup servers during a session

Multiple backup servers can now be configured in the global configuration.

Within a workflow profile, it can be designated for Kiosk to attempt processing a file among any available MetaDefender server during a session.

Support for Layer 7 Load Balancer with MetaDefender

A Load Balancer can now be selected as the primary server for processing files

Regular expression support for media whitelisting

Media whitelisting can accept regular expression rules for more flexibility in configuring allowed devices

Option to disable SSL verification

Certain offline environments cannot successfully verify SSL certificates due to the network structure.

Kiosks in these special instances can be configured to workaround these limitations.

Fixed

Issue with MetaDefender verification only working through TLS 1.0

MetaDefender connection testing in the Management Console has been fixed to utilize the latest security protocols when available (e.g. TLS 1.2)

Virtual keyboard input

Corrected ability to insert/delete characters within an input text box rather than only at the ends of the input

Unlock for IronKey D300 Managed devices

Updated ability to handle different versions of IronKey D300 Managed devices

Interface timeout not triggered while waiting for media to be inserted

Fixed the interface timeout to apply while waiting for media to be inserted

Updated Custom Authentication Module template

Custom Authentication Module template & tester have been updated to 64bit

Features

Kiosk self scan

Allows the user to periodically or on demand utilize the MetaDefender Kiosk to scan its file system for possible infection

File handling option to copy allowed files to the original media

New copy-to route will wipe the original media and copy all allowed files back to it

Select to not submit special archive files, mounted by Kiosk, to Core

Only applicable to Acronis backups, virtual hard disks and/or VMware virtual machines. Can now choose to withhold these files from Core if its contents have already been processed.

Prompt users for the password to password protected documents

When password protected documents are encountered (Word, PDF, Excel), they will now be prompted for passwords for processing their contents.

Generate a log message and warn the user when disk capacity reaches 80%

To help our customers ensure that the Kiosk has sufficient space to operate, it will generate a log message when disk capacity has reached 80% or higher.

Updated Custom Authentication Module sample code to include 64-bit

To better facilitate CAM users in upgrading from V3 to V4, the CAM sample code has been cleaned up and generated in 64-bit

Fixed

Kiosk failing to quarantine read-only files

Read-only files are now supported for quarantining

Fixed VHD mounting that was broken by recent Windows 10 updates

Windows 10 updates changed the case of the name of the drive being attached. Fixed parsing to handle variable case string.

Features

Added the OPSWAT Media Validation Agent

The OPSWAT Media Validation Agent can be downloaded from the Management Console Resources section. This agent can be used to ensure media is processed by a Kiosk before it can be mounted on an endpoint.

Support for Avira-Iron-Drive

Files can now be processed within or copied to an Avira-Iron-Drive.

Fixed

Changes made to the disclaimer not being updated

Corrected issue where making changes to the disclaimer content were not reflected in the UI

Sentry 3 FIPS unlock enhancement

Enhanced the unlock mechanism for Sentry 3 FIPS to correctly unlock versions with different behavior

Disabling boot hardening may hang

Fixed disabling the boot hardening to not cause a hang and fail to update the correct status on the mgmt console for some cases

Central Mgmt synchronization error

Added more protection to avoid issues with Central Mgmt configuration pushes failing

Fixed

Login to the Management Console

Corrected issue where login to the Management Console would fail on certain systems

Features

User login for the Management Console

User login is now required to access the Management Console *In keeping parity with MetaDefender, custom integrations to the REST API with passwords will no longer function. You must set up an API key per user. When installing, you must use the creation wizard to create your first admin user. Admin credentials are no longer created automatically.

Support for Non-Windows file systems

Processing media content in Ext2/3/4, HFS Plus, HFSX, and APFS file systems is supported

Discs allowed to retrieve files from Vault

Retrieving files from Vault can now be downloaded to a disc

Fixed

Enabling boot hardening

Security enhancements made to allow boot hardening for all systems

File handling count display

A count of the current file progress is now displayed when files are copied/moved to a destination

Product activation through a proxy

Online activation can now complete successfully via a proxy server

Fixed

Improvements for Central Management

Under the hood enhancements to allow the management of Kiosk instances to be smoother

Features

Mount and scan VMware virtual machines

Added support for processing within VMDK files

French translation

French language can now be selected as one of the default languages

Upload files to Vault

Vault upload in the file handling of a workflow can now be specified to upload files singularly (with the addition of file scan results) or all packaged within a zip

Password prompt for nested encrypted archives

Password prompt will be displayed for encrypted archives found within encrypted archives

Integral Courier encrypted USB support

Integral Courier can be unlocked and processed

Kingston IronKey D300 Managed support

Kingston IronKey D300M can be unlocked and processed

Fixed

CEF Extension field format

The Extension field in the CEF messages have been fixed to conform to correct CEF standard

German language

German language strings have been expanded upon

Features

Mount and scan VHD & VHDX

Added support for processing within virtual hard disk files

Fixed

Copying sanitized files would fail for certain users logged into a Kiosk session

All users are now able to copy sanitized files to the desired destination

LDAPS connection

Connecting to a directory server via LDAPS has been improved

Features

System boot hardening

With boot hardening enabled the taskbar on the desktop will be not be loaded, thereby disallowing any PC functionality to a user until the Kiosk starts.

Folder navigation when retrieving files from Vault

When browsing for files to download from Vault, folders can be accessed and downloaded to the desired media.

Copy the original file along with the sanitized version

New configuration option added for Copy-To actions that will allow an administrator to specify copying the original file along with the sanitized version.

Fixed

Emails not being sent to the user logged into the Kiosk session

Kiosk can now identify the email address of the logged in user from a remote AD server.

LDAPS authentication failure

Users can authenticate using LDAPS functionality with improved routing.

Handling sanitized file naming convention

Now an incremental number is only appended to the file name during copy to avoid file collisions.

Features

Wipe multiple devices in one session

Multiple devices can be inserted at the wipe option selection screen for the wipe to be performed on all devices

Warning message is displayed if a file is not processed by MetaDefender

A warning message is displayed before the session results screen if any file is not processed by MetaDefender

Fixed

Backup server selection when the primary MetaDefender instance is unable to process files

The decision to use a backup MetaDefender server has been enhanced to ensure a primary MetaDefender instance is not used when it is unable to process files. Any MetaDefender instance that reports problematic issues will be noted on the Mgmt Console and the issue logged in the application log.

syslog message format for TCP

Some syslog messages were missing line breaks which caused parsing issues for some syslog management systems when receiving data over TCP

Enhanced retry mechanism for files that are unable to be opened

Certain files have some permissions that block Kiosk from accessing them to upload the file to MetaDefender for processing. The ability to retry on these files and allow for successful upload has been enhanced. This does not apply to locked system files.

Processing an iPhone with iTunes installed

After installing iTunes and then selecting files from an iPhone to process, the selected files would not be processed. Functionality has been restored.

Features

Blocked results directly reported from MetaDefender

Beforehand, Kiosk would group specific blocked reasons under special categories (e.g. Encrypted Archive & Password Protected Document → Password Protected). This would result in confusion when reading session summary reports and verifying specific file counts against the MetaDefender processing history. Blocked results are no longer grouped under special categories, they are grouped according to the result returned from MetaDefender.

Fixed

Blocked results directly reported from MetaDefender

Beforehand, Kiosk would group specific blocked reasons under special categories (e.g. Encrypted Archive & Password Protected Document → Password Protected). This would result in confusion when reading session summary reports and verifying specific file counts against the MetaDefender processing history. Blocked results are no longer grouped under special categories, they are grouped according to the result returned from MetaDefender.

Custom command line script not running

There was an issue with the component that runs custom command line script - failing to start and complete the configured actions. This has been fixed.

syslog CEF format

syslog messages sent in CEF were not formatted according to specifications which caused parsing issues in SIEM servers. The main body of the message is now sent in the Extension section and the log type is sent in the Name section. The severity level has also been corrected to meet the CEF specification.

Processing mobile phones with Vault

Fixed upload failures when attempting to process a mobile phone with MetaDefender Vault.

Features

Configuration to only send an email report when a blocked file is detected

The email report can now be specified to be sent only when a blocked file in a session is found, rather than sending an email after every session.

Allow users to select the folder structure of copied files

Users can now be allowed to select whether to create a high level directory for files to be copied to or maintain the same folder structure as the original processed media.

Fixed

Enhanced progress display for processing TIB files

Modified TIB processing experience to follow the archive processing flow. Files within a TIB are displayed during progress, the TIB itself is counted as one file & an indicator in the right hand corner will notify the user that an archive is being processed.

UI will remain responsive when processing large datasets

Processing large datasets would cause the UI to stop showing updated progress from being displayed near the completion of a session, giving the impression that the UI was hanging. Progress reporting has been modified to allow the UI to be responsive under large datasets for the duration of a session.

Finding users in groups assigned to workflow profiles

With a group assigned to a workflow profile, when a user would log in to Kiosk, there were instances where a user that is a member of the group was not correctly associated not provided the expected workflow profile. This has been fixed.

SD card detection failure

Certain SD card readers present information of the media differently, which caused the Kiosk to not detect it. Media detection has been updated to handle this case.

Hash verification when copying to a network share

Hash verification has been fixed to work with verifying files were copied correctly to a network share.

Translated strings not updating on the UI

A few translatable strings were not being updated for display in the UI. These have been identified and fixed. The default Japanese language strings have also been updated.

Fixed

Tab selection in Central Management

Scrolling through configuration sections has been removed in the latest Central Management 5.2.3. Overflow sections are now selectable from a dropdown menu.

Vault server configuration import from Central Management

Due to the change in how Vault server settings are saved in Kiosk, only partial Vault settings were being imported over. This has been rectified.

Features

Media Manifest Validation

Previously, Kiosk only saved signed manifests to the media that had been processed. Kiosk can now be configured to validate and utilize results from a manifest found on the media to process.

Logo and Intro Text on Receipt Printout

A logo and introduction text can be configured to print onto a session receipt.

Fixed

Process failure logging is now more transparent

If Kiosk fails to send a file to the MetaDefender server, the reason will be displayed in the UI and session result log & printout. Any network connection errors contributing to failures or MetaDefender failures reported to Kiosk will be logged in the Application Log in the Kiosk Management Console. Messages will contain HTTP codes, description and network error messages to enable admins to take proactive action.

Updated bundled 7z component to version 18.05

Due to vulnerability issues with older versions, the bundled 7z binaries were updated to the latest version.

Retry logic improved when retrieving results from MetaDefender

In previous versions, if an error from MetaDefender prevented Kiosk from obtaining results, it would fail quickly and show that the file failed to process. Kiosk will now try harder to receive correct results from MetaDefender if a file has been successfully sent for processing.

Removed curl error logging when a session is canceled

Canceling a session can result in canceling active connections between the MetaDefender server & Kiosk. This would result in an unnecessary large amount of curl error logs that are now removed under this specific condition.