Slashdot Mirror
Windows 7 Reintroduces Remote BSoD
David Gerard writes "Remember the good old days of the 1990s, when you could teardrop attack any Windows user who'd annoyed you and bluescreen them? Microsoft reintroduces this popular feature in Windows 7, courtesy the rewritten TCP/IP and SMB2 stacks. Well done, guys! Another one for the Windows 7 Drinking Game."
Agreed -- it IS rather bad, but generally speaking you're not expecting attacks from inside your LAN. As Windows vulnerabilities go, this isn't horrible in a practical sense.
Not expecting such a problem until you go to college; half of the students on my campus don't even have a password put on their computers, making it extremely easy to access them remotely as is. If everyone had Win 7 installed, well...it'd make for some interesting work.
"Commodore Amiga is better!"
"No Atari ST is better!"
"No Amiga!"
"No Atari!"
"Amiga!"
"Atari!"
Oh that's not the debate you were looking for? Sorry. Let me update that ancient debate for the modern world:
"Apple Macintosh is better!"
"No Microsoft PC is better!"
"No Apple!"
"No Microsoft!"
"Apple!"
"Microsoft!"
(and ancient debate... just as juvenile today as it was 20 years ago)
"I disapprove of what you say, but I will defend to the death your right to say it." - historian Evelyn Beatrice Hall
Rewritten software is a double-edged sword. On the one hand you are able to finally discard the truly broken sections of your previous implementation; allowing you to make massive leaps forward. On the other you're getting rid of a large list of known bugs and replacing it with an even larger list of unknown ones.
One of the most useful features of old technolgy is that it breaks in predictable ways.
So it's not too surprising that something like this happened. Doesn't worry me either, I have firewalls and a NAT on all my machines, no reason not to. However since it's something that happened before, it's irritating that Microsoft didn't think to check for something like this.
How do you kill that which has no life?
Just because IPv6 reduces the need for NAT doesn't mean you shouldn't use a firewall. I assume that's what you were talking about anyway.
really - unless the person sets the "Let Microsoft decide when and where I do updates" most of the updates WILL NOT be done. The average person uses the computer like a tv - turn it on to see the web and turn it off when done. Leave my computer on ALL NIGHT just so i can backup/run antivirus/run defrag/run etc. etc. ???
Oh yeah these people do exist and they have 'FRIENDS' that 'KNOW' computers and 'HELP' them out by turning off that annoying UAC or giving them a 'FREE' version of office. The looks on their faces when I explain that the software they got off Limewire is infected with virus' - they can't believe microsoft would do that!!! THAT is the mentality, and that is why these attacks have always worked, and will always work.
A computer once beat me at chess, but it was no match for me at kick boxing. Emo Philips
Hi. I'm an adult. I work as a software engineer.
I cannot join in with the Linux community because of you people. You're just *too awful*. Instead of accepting that this stuff happens and it's bad, you childishly nerdsnort and start writing Microsoft with a dollar sign instead of an S, acting as if this stuff is some amazing manifestation of idiocy rather than a likely consequence of using a mainstream OS developed with time and budgetary constraints. It's going to have stupid bugs. Get the fuck over it.
I would like to join in with the Linux community, but all I ever hear is this pathetic nyerr-nyerr-nyerr garbage.
If you want to attract intelligent, grown-up people to Linux you need to stop doing certain things.
1) Don't act as if users of other operating systems are less intelligent than you. It turns out that Linux-advocacy isn't the entire world, and that leaders in different fields (or even this one!) might be using Windows. They're not "lusers", they just have priorities different from your own.
2) Don't act as if Linux hasn't had equally stupid stuff happen to it. Yes, it's a different process altogether, and I would dare say that bugs are less likely due to its open source nature, but they still happen. One that I can remember off the top of my head is Debian's guessable SSL keys.
3) Try—for ten minutes—to give the impression that half of your time isn't devoted to bashing an OS you believe is irrelevant.
4) For good measure try cutting out the xkcd worship and meme-spouting. We might be able to relate to you people if you acted as if you weren't cut from the same distasteful mold.
...generally speaking you're not expecting attacks from inside your LAN...
Even if you have total control over all physical access points to your LAN, and total trust in your user base, there is still a chance that internal people can try to do nasty things - and in some ways they may have more motivation to do so.
I think the concept of "internal/trusted network" is going to shrink - nowadays I tend to this of the "internal network" as ending at the edge of centralised server resources, and clients on what would have been called the "internal LAN" are actually outside of what I would now call the "trusted zone". Even then, SMB traffic is more likely to be open so this vulnerability is still a problem, and many organisations still concentrate on border protection without taking any defense-in-depth measures internally so they're probably wide-open to this.
I could be paranoid, but I don't want to be less strict with internal controls and then find out the hard way that I was right all along.
Patents. Microsoft has patents that may cover your implementations of the technologies described in the Open Specifications. Neither this notice nor Microsoft's delivery of the documentation grants any licenses under those or any other Microsoft patents. However, a given Open Specification may be covered by Microsoft's Open Specification Promise (available here: http://www.microsoft.com/interop/osp ) or the Community Promise (available here: http://www.microsoft.com/interop/cp/default.mspx ). If you would prefer a written license, or if the technologies described in the Open Specifications are not covered by the Open Specifications Promise or Community Promise, as applicable, patent licenses are available by contacting iplg@microsoft.com..
I checked both the Open Specification Promise and the Community Promise and SMB2 is not covered by either. Just because Microsoft published the spec doesn't mean they won't sue you for patent infringment.
So you mean the problem is _less serious_ by the fact that it's been on _more_ Windows versions than stated? Maybe you mean that MS has said 'it's not a problem because this and that?'
"I think it would be a good idea!"
Gandhi, about Internet Security
You make it sound like a gaping security hole is alright just because it's been in the product long enough that people might have forgotten about it.
If anything, this makes it sound like Windows 7 is the same old crap and that once again we have empty promises from Microsoft claiming that they will do things right this time.
Windows users are like domestic abuse victims.
A Pirate and a Puritan look the same on a balance sheet.
Funny, I could say the almost same thing about your thoughtless copy-pasta.
This brain dead Microsoft bash is just an update to previous MS bashes, being sold to you by people who have no actual technical knowledge of the product itself, and don't know it is an entirely new operating system.
WTF does "one, giant active directory domain" or "ping accross continents baby" have to do with IP Subnets?
Do you have any understanding of networks at all, or do you just spew back the crap you've heard?
And the worms ate into his brain.
I think the point is that Vista has been around for a couple of years now, and it's obviously not the "OMGWTFBBQ" issue some anti-Microsoft folks think it is. If it were, there would have been a big stink about all the remote BSODs in Vista.
Right, because Vista has been so broadly deployed in enterprise environments!
The article makes it seem like it hasn't been in Windows since Windows NT and that Windows 7 is the first time it's reappeared. Seriously, Vista has it.
Is this a case of "It's after midnight, must post another slam on Microsoft, even if we have twist and stretch like taffy to make the case"?
I'm here, reading your wonderful post, and laughing my ass off! Do you really think, reminding us that this horrible flaw is already present in Windows Vista, will somehow "soften the blow"?
Man, you're precious!
"The agriculture ministry is not in charge of Gundam" - Japanese ministry official.