Stealthy Windows Update Raises Serious Concerns

UniversalVM writes "What is the single biggest issue that bothers open source advocates about proprietary software? It is probably the ability of the vendor to pull stunts like Microsoft's recent stealth software update and subsequent downplaying of any concerns. Their weak explanation seems to be a great exercise in circular logic: 'Had we failed to update the service automatically, users would not have been able to successfully check for updates and, in turn, users would not have had updates installed automatically or received expected notifications.' News.com is reporting that all of the updated files on both XP and Vista appears to be in windows update itself. This is information that was independently uncovered by users and still not released by Microsoft."

Comments

So Windows Update Has Problems

[dch24]

My biggest problem would be this list. One hundred and twenty three patches to reinstall Windows XP Service Pack 2 (with Office XP), which I plan to do for a long, long time. It really hurts someone like me when Microsoft decides to get rabies w.r.t. AutoPatcher.

Here's the complete list to prove it (sorry for the lame formatting, it's Slashdot's lameness filter):

• 001 WinGenuineCheck.exe
• 002 WGAPluginInstall.exe
• 003 WindowsInstaller-KB893803-v2-x86.exe
• 004 KB898461 package installer.exe
• 005 KB925902.exe 006 KB896423.exe 007 KB929338.exe 008 KB928255.exe 009 KB928843.exe
• 010 KB927802.exe 011 KB924667.exe 012 KB927779.exe 013 KB918118.exe 014 KB926436.exe
• 015 KB928090 cumulative ie update.exe
• 016 KB931836 dst.exe
• 017 KB929969.exe 018 KB923980.exe 019 KB926255.exe
• 020 KB923694 cumulative outlook express.exe
• 021 KB925398 windows media 6.exe
• 022 KB923689.EXE
• 022 KB923789 flash player 7.exe
• 023 KB920213.exe 024 KB924270.exe 025 KB923414.exe 026 KB924496.exe 027 KB923191.exe
• 028 KB924191.exe 029 KB922819.exe 030 KB922582.exe 031 KB916595.exe 032 KB919007.exe
• 033 KB920685.exe 034 KB920872.exe 035 KB917422.exe 036 KB920670.exe 037 KB920683.exe
• 038 KB914388.exe 039 KB911280.exe
• 040 KB917734 windows media 9.exe
• 041 KB914389.exe
• 042 KB917344 jscript ENU.exe
• 043 KB918439.exe 044 KB913580.exe 045 KB917953.exe 046 KB900485.exe 047 KB908531.exe 048 KB911562.exe 049 KB911927.exe
• 050 KB911564 windows media player plugin.exe
• 051 KB908519.exe 052 KB910437.exe 053 KB904706.exe 054 KB905749.exe 055 KB900725.exe 056 KB902400.exe 057 KB901017.exe 058 KB905414.exe 059 KB893756.exe 060 KB899591.exe 061 KB899587.exe 062 KB894391.exe 063 KB896358.exe 064 KB890859.exe 065 KB901214.exe 066 KB896428.exe 067 KB888302.exe 068 KB887472.exe 069 KB891781.exe 070 KB873339.exe 071 KB886185.exe 072 KB885836.exe
• 073 KB925876 rdp 6.0.exe
• 074 KB896344.exe
• 075 KB885884 office.exe
• 076 KB930178.exe 077 KB931261.exe 078 KB931784.exe 079 KB932168.exe 080 KB935448.exe
• 081 KB927978 msxml4.exe
• 082 KB923689.EXE
• 083 OfficeXpSp3-kb832671-fullfile-enu.exe
• 084 KB925673 msxml6.exe
• 085 KB927977 msxml6.exe
• 086 OGAPluginInstall.exe
• 087 officexp-kb833858-client-enu.exe 088 officexp-kb837253-client-enu.exe
• 089 officexp-KB925523-FullFile-ENU.exe 090 officexp-KB914796-FullFile-ENU.exe
• 091 officexp-KB920816-FullFile-ENU.exe 092 officexp-KB920821-FullFile-ENU.exe
• 093 officexp-KB929063-FullFile-ENU.exe 094 officexp-kb873379-fullfile-enu.exe
• 095 officexp-KB905649-FullFile-ENU.exe 096 officexp-KB921594-FullFile-ENU.exe
• 097 officexp-KB905758-FullFile-ENU.exe 098 officexp-KB923092-FullFile-ENU.exe
• 099 officexp-KB894541-FullFile-ENU.exe 100 officexp-KB911701-FullFile-ENU.exe
• 101 officexp-KB929061-FullFile-ENU.exe 102 officexp-KB904018-FullFile-ENU.exe
• 103 officexp-KB913471-FullFile-ENU.exe 104 officexp-KB934394-FullFile-ENU.exe
• 105 officexp-KB934453-FullFile-ENU.exe 106 officexp-KB934705-FullFile-ENU.exe
• 107 WindowsXP-KB930916-x86-ENU.exe 108 WindowsXP-KB931768-x86-ENU.exe
• 109 WindowsXP-KB927891-v3-x86-ENU.exe
• 110 KB933566 cumulative ie6 update.exe
• 111 KB929123 cumulative oe6 update.exe
• 112 KB935839 kernel api.exe
• 113 KB935840 schannel.exe
• 114 kb937143 ie6 sp2.exe
• 115 kb936181 msxml4.exe
• 116 kb933579 msxml6.exe
• 117 kb936782 wmplayer9.exe
• 118 kb921503.exe
• 119 kb936021 msxml3.exe
• 120 kb938127 ie6 vml.exe
• 121 kb938829 gdi.exe
• 122 kb933360 dst.exe
• 123 kb938828 explorer stop c0000005.exe

Re:So Windows Update Has Problems

[Anonymous Coward]

Why don't you stop using Windows? I know that's not an option for everyone, but these days it's something you should consider. It's not like there aren't alternatives out there. There are! A Google search just turned up several blog posts that talk about Windows alternatives:

Langa Letter: Exploring Windows Alternatives
Avoid Windows Vista anti-piracy shenanigans by using BSD, OpenSolaris or Linux.
Mac OS X Leopard vs Microsoft Windows Vista
Dump Windows Update, use alternatives
Alternatives to Windows Software

I'm sure you could find a lot more information, too. So there's really no excuse for still using Windows, especially if there's really nothing keeping you from switching to one of the many alternatives.

Re:So Windows Update Has Problems

[NeverVotedBush]

A few things to consider if you really would like to explore Linux - you can dual boot. You don't have to give up your Windows system to start checking Linux out. Linux can make room on your hard drive (assuming you have enough free space) and you can switch back and forth between them with just a reboot. (there are other ways too with virtualization but you can Google more info if that might interest).

As for no guarantee your PC could even run Linux, just download and burn (or just buy) a "live CD". A live CD is a CD you just boot from and it boots your computer up in Linux. During boot it will check hardware and you can see for yourself if it finds everything natively. If it doesn't, keep in mind that you can search the web for whatever hardware and Linux and see if drivers might be available. You would be surprised how much hardware is well supported under Linux although there are holes. Another thing about a live CD - since it is running from the CD, don't be put off by the slowness. Running from the CD will be much slower than if it was installed. If you have a lot of RAM, it may not seem that slow but CDs are much slower than hard drives. All you are doing is seeing what it looks like and if/how it will run on your computer.

As for Wine, it supposedly works pretty good but it may not support what you want to run. If you are wanting to run Windows programs under Linux, check out Crossover Office from Codeweavers. I use it to run Microsoft Office under Linux and it works perfectly. (I spend much more time now in Open Office though) So do a number of other supposedly Windows-only programs. But if you dual boot, you can always just run whatever you want under Windows but do your long haul stuff under Linux. You will probably be a lot safer doing anything requiring good security under Linux than under Windows. I never order anything online or do any financial stuff in Windows. It's just too risky.

ANd about upgrading to run Linux - not necessary. If your computer was running OK with Windows, it will seem quite peppy under Linux. Windows is a memory and resource hog. Linux is not. Anyone with a computer that now can't run Vista ought to take a look at running Linux instead. They will get what feels like a new computer and get a very nice OS at the same time.

And don't let the supposed complexity of Linux fool you and keep you away. It isn't that complex. In Windows you just can't do a lot of stuff or they make the decisions for you. In Linux, you can do pretty much whatever you want. In Linux, everything is file based. You have config files and such that you just edit to make changes. Nothing is hidden from you. A lot of the internals are best accessed on the command line once you get more familiar but you can also admin the machine from the GUI if you want. As you get more experienced, you'll want to learn the command line though - much more efficient and really easier. Or you can stick to the GUI and pretend you are just running a really stable and fast version of Windows. You don't have to dig into the guts of Linux if you don't want to. It's just that you can if you would like.

But Linux is a lot easier to try out and use than a lot of people imagine. It's why it is growing so much in user base recently. Give a live CD a try and see for yourself. That's the best way to experience it.

Re:So Windows Update Has Problems

[cortana]

This is because Ubuntu's installer is crap. Use their 'alternate install CD' and you get the original Debian installer, which will let you resize partitions to your heart's content.

Re:So Windows Update Has Problems

[Zonk (troll)]

OK, tax software. I'm Australian, and the tax office allow you to lodge online using their own application. I have found instructions to run the Java app under Ubuntu, but I had no success at all. You likely have GIJ set as the Java runtime, which is what Ubuntu (and Fedora, IIRC) does by default. This doesn't support Swing or much else, and has horrible performance. This can be fixed easily, though:


sudo apt-get install sun-java6-jre sun-java6-plugin sun-java6-fonts
sudo update-alternatives --config java
(select the number that says "/usr/lib/jvm/java-6-sun/jre/bin/java")
sudo gedit /etc/jvm
(add /usr/lib/jvm/java-6-sun as the first entry)


Now all Java should work properly.

Cue VMWare player. Free, included in the packages for Ubuntu. I figured I'd use this until the ATO software can be installed in Linux (which I'm sure it can be). There's a way to create basic VMWare images using a QEMU which can then be saved as VMWare images. So a licensed version of windows 2000 went on for the sole purpose of doing my tax. This is my current project to make this thing run under Linux, an ongoing quest. Install VMWare Server. Ubuntu provides packages for it and to get it to work all you have to do is go to vmware.com and request a (free) license key for it. You can then create virtual machines easily. It rocks.

You can also give VirtualBox a try. It works well and offers a "seamless" mode (Windows apps appear on the Linux desktop). The only downside to VirtualBox is licensing. The binary that's available is under their "Personal Use and Evaluation License", but they do provide an Ubuntu repository for it. There is a GPL version available that does the same things, but you have to compile it from source.

At the moment I'm using both VMWare Server and VirtualBox OSE (the GPL version) equally.

Paint shop pro, well, it wouldn't install using WINE, Buy CrossOver Office instead (there's a 30 day demo available). It's based on WINE, but actually works.

Haven't figured out how to save alpha transparencies to PNG's yet. But it's doing it. Just save it as a PNG. Unless you index it first it will save the alpha transparencies by default.

Not a big deal

[ejdmoo]

Just a bunch of people bitching for no reason, trying to generate traffic to their blogs. Let's see...

The update only updated the Windows Update software itself, nothing in Windows.

It did not update if you have automatic updates turned off.

It did update if you had "Notify me" turned on. This is a point of contention, but MS says they needed to do the update to continue to notify users of actual updates.

Finally, this doesn't apply to any networks running a WSUS (or whatever it's called now) server.

Re:Not a big deal

[This_Is_My_Happening]

It actually updated no matter if you had the auto-updates on or off. Incorrect. Automatic Updates has several settings:

- Automatic (downloads and installs updates automatically)
- Download but not install (downloads automatically, but you choose when to install)
- Notify but not download (notifies you of updates, but doesnt download)
- Turn off Automatic Updates

If the 4th setting above is selected, there are no updates at all, stealth or otherwise. The service is off, and no communication is done with the WU servers.

This stealth update was a surprise for the people who had the 2nd or 3rd setting above selected. Under these settings you expect the update to be downloaded (or you expect to be notified of it) but you do not expect it to be installed without your input. Under these settings your computer still communicates with the Update servers on a regular basis to check whether new updates are available.

MS claims that the stealth update to the Windows Update system itself was required so that it could still check for new updates. Im not sure if I buy that myself, but as long as the limit this behaviour to Windows Update updates only, I can live with it. If they try it for any other updates (like WGA or the like) you can bet I'll be disabling the service entirely right quick.

Oh man, this one again?

[Anonymous Brave Guy]

We already did this one just two days ago.

The anti-Microsoft FUD was thoroughly debunked by numerous Slashdot posters. It was also thoroughly debunked by numerous comments in reply to the various external sources cited in the older Slashdot article.

They updated Windows Update, when people explicitly visited the Windows Update site. That is all. They are not pushing out updates to critical system files without any user intervention.

Last time, several posters asked whether Slashdot would at least have the decency to correct the blatantly Microsoft-bashing headline/article. They didn't, they posted it again. <sigh> Go Zonk!

Big Deal...

[nutrock69]

It did not update if you have automatic updates turned off.

Really? Last I read, the claim that it does update when the feature is turned off was supported by several reputable computer trades, each of which (supposedly) verified this independently on PC's they own and test with. Has anybody besides Microsoft claimed otherwise? Remember, having a computer that didn't update on its own is not proof that it won't, only that it might not have been in the list to receive the patch. The lack of evidence does not prove a contrary opinion in this case.

The biggest problem I have with this update, is that it proves beyond any doubt that Microsoft deliberately placed a "hole" in the security of their OS for their own purposes. It is nothing less than something on the internet contacting the OS, opening a hole, then running software with root/admin permissions to change something in the OS itself. Something many people have suspected because of the so-called security patches that move holes around instead of actually closing them, has now been proven to be true.

This must be a holy grail for a Windows hacker. This hole was put in the OS specifically to take over a computer, and Microsoft's reaction to its discovery shows they obviously have no intention of closing it - just continuing to use it when desired. You can bet that finding this hole and ways to exploit it are now the top priority of hackers around the world.