Slashdot Mirror

Chrome on Windows is almost as bad - "To use this Web site's full functionality, you must be running Microsoft Internet Explorer 6.0 or later."

Here's the direct download links: x86 x64

Chrome on Windows is almost as bad - "To use this Web site's full functionality, you must be running Microsoft Internet Explorer 6.0 or later."

Here's the direct download links: x86 x64

See subject: MS Update servers are hardcoded into the OS (unless someone can show me differently) as follows:

http://.update.microsoft.com/

https://.update.microsoft.com/

http://download.windowsupdate....

* Per the Windows HELP system itself, regarding "Windows Update error 80072efd"...

(Still - using WSUS or SMS possibly can 'override' that so you can 'mass deploy' updates to end point user desktop nodes for example, on an internal LAN).

APK

P.S.=> Oddly enough though? Another article MENTIONS hosts files interfering with it per "Windows Update error 80072ee7" so it *MAY* be possible to "override" those above with the WRONG IP Addresses - however, I am *FAIRLY CERTAIN* that's not the case (hence my initial reply regarding hosts affecting it adversely is not possible since MS bypasses hosts for Windows update, afaik)... apk

The Windows Vista machine across the street requests this: http://www.update.microsoft.com/v9/windowsupdate/selfupdate/wuident.cab

And my Windows 7 workstation requests these:
http://download.windowsupdate.com/v9/windowsupdate/redir/muv4wuredir.cab
http://download.windowsupdate.com/v9/windowsupdate/a/selfupdate/WSUS3/x86/Other/wsus3setup.cab

Those are technically web pages, as is this one requested nightly by a bunch of Linux machines at my house:
http://us.archive.ubuntu.com/ubuntu/dists/karmic-updates/multiverse/source/Sources.bz2

None of those are in HTML format, but they're served via http from a web server - just like the Google updates. Also like the Google updates, the "update service" can be set to install updates found on those "web accessible pieces of data" (aka "web pages") with no user interaction.

Google updater installs either the "google pack" (which is not a web page) or just Google software (also, not a web page). It can be configured: http://www.google.com/support/pack/bin/answer.py?hl=en&answer=46708 and works pretty much the same way as synaptic, windows update service, adobe updater, java updater, symantec live update, etc etc etc.

They all work pretty much the same way. There's an initial setup - in which you chose what you want automatically installed - and then something that runs automatically thenceforth (is that a word?) and requests updates from a web site. If that site's hijacked, your DNS is comprmised, etc; there's varying levels of bad things which can happen.

The Windows Vista machine across the street requests this: http://www.update.microsoft.com/v9/windowsupdate/selfupdate/wuident.cab

And my Windows 7 workstation requests these:
http://download.windowsupdate.com/v9/windowsupdate/redir/muv4wuredir.cab
http://download.windowsupdate.com/v9/windowsupdate/a/selfupdate/WSUS3/x86/Other/wsus3setup.cab

Those are technically web pages, as is this one requested nightly by a bunch of Linux machines at my house:
http://us.archive.ubuntu.com/ubuntu/dists/karmic-updates/multiverse/source/Sources.bz2

None of those are in HTML format, but they're served via http from a web server - just like the Google updates. Also like the Google updates, the "update service" can be set to install updates found on those "web accessible pieces of data" (aka "web pages") with no user interaction.

Google updater installs either the "google pack" (which is not a web page) or just Google software (also, not a web page). It can be configured: http://www.google.com/support/pack/bin/answer.py?hl=en&answer=46708 and works pretty much the same way as synaptic, windows update service, adobe updater, java updater, symantec live update, etc etc etc.

They all work pretty much the same way. There's an initial setup - in which you chose what you want automatically installed - and then something that runs automatically thenceforth (is that a word?) and requests updates from a web site. If that site's hijacked, your DNS is comprmised, etc; there's varying levels of bad things which can happen.

download here http://download.windowsupdate.com/msdownload/update/software/svpk/2008/04/windowsxp-kb936929-sp3-x86-enu_c81472f7eeea2eca421e116cd4c03e2300ebfde4.exe

I haven't seen a link posted yet, so: http://download.windowsupdate.com/msdownload/update/software/svpk/2008/04/windowsxp-kb936929-sp3-x86-enu_c81472f7eeea2eca421e116cd4c03e2300ebfde4.exe

http://download.windowsupdate.com/msdownload/update/software/svpk/2008/04/windowsxp-kb936929-sp3-x86-enu_c81472f7eeea2eca421e116cd4c03e2300ebfde4.exe (download.windowsupdate.com redirects to Microsoft.com, it's legit)

Good job, Microsoft.

Ah yes, my mistake, that was an old beta.

Here is the real RTM version. MD5 should be BB25707C919DD835A9D9706B5725AF58.

http://www.download.windowsupdate.com/msdownload/update/software/svpk/2008/02/windowsxp-kb936929-sp3-x86-enu_9afedbd6b2941bf568c27046d6688e6ccb5ce018.exe

MD5: BB25707C919DD835A9D9706B5725AF58
SHA1: C81472F7EEEA2ECA421E116CD4C03E2300EBFDE4

I'm absolutely not an Apple fanboi but this is bollocks. Apple (who are indeed significantly slowerthan other distributors in releasing patches) ship an awful lot of Free software - application software that is - with OS X, whilst Microsoft generally only patch the core OS (and Office, if you go to https://microsoftupdate.com/ rather than https://windowsupdate.com/ .) Hmmm, one day I must get round to doing that chart tracking who, of the main distros shipping common code such as (say) Zlib, releases what patches, when. Some of the Linux distys are particularly lax on this front.

You can actually grab it directly from Microsoft here too:

http://download.windowsupdate.com/msdownload/update/v3-19990518/cabpool/windowsxp-kb936929-sp3-x86-enu_a2ca583dedcd86837796111a632efa29a23f4cc0.exe

Install 927891 and the latest WU client, and the issues should be resolved:

http://download.windowsupdate.com/v7/windowsupdate /redist/standalone/WindowsUpdateAgent30-x86.exe
http://download.windowsupdate.com/v7/windowsupdate /redist/standalone/WindowsUpdateAgent30-x64.exe
http://download.windowsupdate.com/v7/windowsupdate /redist/standalone/WindowsUpdateAgent30-ia64.exe

Install 927891 and the latest WU client, and the issues should be resolved:

http://download.windowsupdate.com/v7/windowsupdate /redist/standalone/WindowsUpdateAgent30-x86.exe
http://download.windowsupdate.com/v7/windowsupdate /redist/standalone/WindowsUpdateAgent30-x64.exe
http://download.windowsupdate.com/v7/windowsupdate /redist/standalone/WindowsUpdateAgent30-ia64.exe

Install 927891 and the latest WU client, and the issues should be resolved:

http://download.windowsupdate.com/v7/windowsupdate /redist/standalone/WindowsUpdateAgent30-x86.exe
http://download.windowsupdate.com/v7/windowsupdate /redist/standalone/WindowsUpdateAgent30-x64.exe
http://download.windowsupdate.com/v7/windowsupdate /redist/standalone/WindowsUpdateAgent30-ia64.exe

The problems you cited are problems in Windows, not in Firefox. In fact, Firefox has a built-in auto-update feature. On Linux systems, it is included in in the distribution's auto-updates.

The problem is that MS Windows does nothing to provide a centralized auto-update feature.

If anything, your argument is to mean that Windows has no place in the corporate world yet.. which, is true, but not in practice.

Most linux distros (Red Hat/Fedora, Suse, Debian, Gentoo, etc.. off the top of my head) provide a central repository that will update everything on your system for you. This appears to be a much more optimal method of applying updates. If nothing else, these results show that not just core functionality, but also supporting functionalities must be kept up to date and are just as much of a security problem, if not more so. Linux distributions support such update methodolgies natively, Windows does not.

So what would you call this exactly?

I can't elaborate on that, but WindowsUpdate will help avoid the security hole. The patch is out, and has been out at least all of today.

A huge unidentified virus is approaching the Computer. It was made in the far past by another life than the human race, and occupied and inhabited by a vicious exploit in the long period. In order to save the Computer, the strongest Windows patches go into action.

that is a GREAT idea! I'd like to see a similar service for Google Images, sorted by PageRank.

Unfortunately, his Unsafe Search doesn't seem to work very well:


Unsafe Search Results

A Google query for microsoft returned 53,300,000 normal results and 0 SafeSearch results,
making it 0.0 percent safe.

Of the top 30 normal query results, the following 3 results were "unsafe":

1. MSN UK
Portal and ISP offering subscription-free and monthly pre-paid packages from Microsoft.
http://www.msn.co.uk/ -

2. MSN Search
Miscroft provides search of the web, news, images and its own encyclopedia, Encarta.
Also offers desktop search via a toolbar.
http://search.msn.com/ - 4k

3. http://www.windowsupdate.com/

Just thought of this.

What about writing a worm (apparently this isn't so hard...) that runs a VB Script when the message is viewed. When the script runs, it adds an entry to the hosts file:

ip.of.some.evil.server www.windowsupdate.com

The message?

From: $Your IT Administrator

(Determine this variable by looking in the address book for those with domain admin privs, pick one at random)

Looks like there was a pretty important security update that came out last night. Please go to the Windows Update site and run it. Thanks!

http://www.windowsupdate.com/

Make it look believable. Heh.

Sites have become better. Several airlines and banking sites used to require IE. They don't anymore. In fact, the only time I regularly use IE is to access Windows Update.

What, like www.windowsupdate.com points to v4.windowsupdate.microsoft.com?

Firefox isn't perfect but please, bitch about one of it's few real problems and some bullshit ones. Someone please show Mr. Torr a clue-by-four please?

if you have a pirated version (or more specifically, a key that is flagged as pirated) you get a message saying your key is not valid and you should contact your administrator.

Let me get this straight - you find Windows Updates complex? Well, let's see now... Go to www.windowsupdate.com. Wow, that was hard, wasn't it?

Best piece of advice in this thread. Even with a firewall, the browser is a weakness, regardless of which browser you use. Until you get fully patched, only go to Windows Update. Do not visit any other site, even legitimate ones you trust. You don't trust their advertisers do you?

"windowsupdate.com" is a real Microsoft site? The HTML looks like something some dumb spammer would write. There's a NOFRAMES tag, but the page doesn't have frames. There's no BODY tag (which is why the page won't display in Mozilla). There's no CSS. There are no Microsoft Front Page indicators. The domain is in REGISTRAR-LOCK. Yes, the registrant info shows Microsoft's address, but you can put anything in there.

(fires up Demon.net's net tools page)

windowsupdate.com - WHOIS shows Microsoft being in control. No lock. DNS record looks like last updated on July 6th 2004.
windowsupdate.net - WHOIS also shows Microsoft in control. No lock. DNS looks like last update March 2004.
windowsupdate.org - WHOIS does show someone other then Microsoft. Registered Feb 2002, expires Feb 2005 by Jacco Tunnissen in Rotterdam, NL.

Looking at the page body of www.windowsupdate.com, it's simply a text-only HTML page, but with a missing set of BODY tags. Probably due to the massive DDoS that one of the past worms inflicted. So they removed all graphics and tried to make the page as light as possible. (I am surprised it's not simply a META REFRESH pointing at windowsupdate.microsoft.com.)

WARNING - do NOT click on the link above if you are running Microsoft Internet Explorer with Active-X controls enabled.

Windows Update is owned by microsoft - in fact, it is one of the URL's that the blaster worm DOS'ed.

According to this register article that someone posted, the website that the spammer registered was windowsupdateNOW.com

This is a pretty poor Ask Slashdot article, IMHO. Here is how I do it within an hour and have nothing to worry about:

1. Unplug network cable
2. Install Windows XP
3. Upon first boot turn on the Windows Firewall and reconnect network cable
4. http://www.windowsupdate.com
5. Wait for patches to download, then remove network cable and reboot after patches have installed
6. Return to http://www.windowsupdate.com and download the remaining patches
7. Reboot (no need to unplug network cable this time) and install a Virus Scanner/Firewall Suite.

This takes an hour and isn't rocket science.

-dk

This is a pretty poor Ask Slashdot article, IMHO. Here is how I do it within an hour and have nothing to worry about:

1. Unplug network cable
2. Install Windows XP
3. Upon first boot turn on the Windows Firewall and reconnect network cable
4. http://www.windowsupdate.com
5. Wait for patches to download, then remove network cable and reboot after patches have installed
6. Return to http://www.windowsupdate.com and download the remaining patches
7. Reboot (no need to unplug network cable this time) and install a Virus Scanner/Firewall Suite.

This takes an hour and isn't rocket science.

-dk

Bonus points for anyone who can link to the Internet Explorer changelog...

You do relaize that you are reading apple.slashdot.org, right?

You can find *BSD info here, the linux stuff is pretty much everywhere and Windows has moved to a monthly cycle, so you need to wait a couple more weeks and check here ;)

http://www.windowsupdate.com

To some extent, you did, at least in the way of some minor updates, etc (few for 98 compared to XP, but there were some)

You can also expect new hardware to support 98 even less than it already does. Guess what that means you get to use?

But does this new worm try and download the update from www.windowsupdate.com?

P.S. If you didn't know, Microsoft took down windowsupdate.com, the correct site name is windowsupdate.microsoft.com

A link on Slashdot...;-)

It's always something. Either your XRENDER is slow or you're stuck with a two bit disk drive.

... or stuck with a two-bit software vendor.

I don't really look at Windows security updates, but why the HELL don't they put these patches on Windows Update? The reason that these worms spread is because NORMAL people (and idiot sysadmins) don't go and read these security updates.

I have WinXP SP1 installed, with all the updates and critical security fixes installed. I just go look here and I see that there are 21 extra updates I should install. All of them are remote exploits as well.

I will say that I am surprised, I thought I had been staying up-to-date. I don't do Windows server administration, so I didn't know about these. I Windows for my desktop, naturally. But I really don't understand why they don't go ahead and put this crap on Windows Update? Are they afraid of the bad press? Everyone and their goldfish knows that MS is insecure anyway, they may as well put it there.

Bleh. Why didn't /. cover the other 20 of these things?

Click Here To Save Lives

First of all, the example data sent is available free, as one poster above already listed. There's no software described there other than Windows itself.

Second, the System Info Schema, as posted by another above, is pretty explicit about what registry keys are available to be sent, and it's pretty tame.

Frankly, I have no problem letting them know exactly what hardware I've got running. How can they harm me there? Perhaps a malicious hacker could grab this data and find ways to abuse my network card? Pretty slim.

Call me too open, if you will, but I'd be happy if it would let me know about other MS updates, such as Office, without having to also visit MS' office site. Update those automatically? Never. But it's much less convenient than the Windows Update site.

I greatly doubted that it would be sending large quantities of personal data, because it just doesn't take that long. The ones to worry about are the virus scanners, that take the time to examine every freakin' file.

In summary:

• They're not sending your entire hard drive
• They're not sending your entire registry
• They're not sending a full software inventory
• They're probably gathering a little more than they need
• They're probably not doing anything with it (yet)

Client Info Schema and System Info Schema.

They appear to get a copy of your registry, as well as information like processor architecture, manufacturer, printer(s?) etc

Client Info Schema and System Info Schema.

They appear to get a copy of your registry, as well as information like processor architecture, manufacturer, printer(s?) etc

the about:<p>hello</p> doesnt work in IE6 SP1 , you just get "page cannot be displayed"

comments like yours show that you havent upgraded your browser and are open to lots more yummy exploits

windowsupdate

and people wonder why they catch 6 month old slammer worms when they cant even be bothered to update their browser

Mistake "Microsoft Windows" -> Winclows
"Microsoft Winc" "lows "

Mistake "Microsoft Windows" -> Winclows
"Microsoft Winc" "lows "

• uses the Iframe and MIME type vulnerabilities in IE.
• attempts to disable your anti-virus program, if you have one.
• starts a keylogger.
• steals your passwords, if you're running Windows 9x/ME.
• opens port 36794 allowing someone to mess with your system

More information and a removal tool:

Symantec Security Response

According to Norton 2002
The celebphoto site actually has a javascript virus called
the "JS. Exception" which tries to exploit an unpatched Internet Explorer vunerability, before clicking , if you are using an old IE (or you are using an unpatched IE) things will get messy for you, and if you have permission get updated NOW

If you retreive the patch via windowsupdate(only works with IE), the EULA doesn't say ANYTHING about DRM or crippling your ability to access secure content!

What the hell? I thought the BSD article was a troll, but to be sure I checked out his links and sure enough, THAT version of the patch contains the paragraph about DRM etc...

Well now we have two versions of the same EULA with conflicting conditions, both of which are posted in VERY public places! Now I'm no expert on contract law, but with two publicly posted conflicting versions, as far as I'm concerned, we can safely ignore both! Way to go Bill!

Sorry, but the Windows Media Player patch does not uninstall.

check out this XP update page for example:

http://www.download.windowsupdate.com/msdownload/u pdate/v3/static/RTF/en/5360.htm

This update resolves the "Playback and Copy-Protection Issues When You Try to Play the Snow White and the Seven Dwarfs DVD Movie" issue in Windows XP and is discussed in Microsoft Knowledge Base (KB) Article Q310510. Download now to be able to play Disney's "Snow White and the Seven Dwarfs" Platinum Collection DVD.