Slashdot Mirror
Microsoft Refuses To Patch Rootkit-Compromised XP Machines
Barence writes "Microsoft has revealed that its latest round of patches won't install on XP machines if they're infected with a rootkit. In February, a security patch left some XP users complaining of endless reboots and Blue Screens of Death. An investigation followed and Microsoft discovered the problems occurred on machines infected with the Alureon rootkit, which interacted badly with patch KB977165 for the Windows kernel. Now Microsoft is blocking PCs with the rootkit from receiving its new patches. 'This security update includes package-detection logic that prevents the installation of the security update if certain abnormal conditions exist on 32-bit systems,' Microsoft cautions in the patch notes."
If the rootkit is still on your computer, maybe you should look into having it removed.
how shall thee pull out the mote that is in thine eye, when thou thyself beholdest not the beam that is in thine eye? Luke 6:42
Microsoft isn't really in the business of providing a virus scanner as one of their free updates. Oh wait...
*continues running Ubuntu*
It's better to vote for what you want and not get it than to vote for what you don't want and get it.
- E. Debs
You keep your original software. Time to wipe it and reinstall. Of perhaps boot Linux and get a faster computer.
Provided they[MS] provides doco on how to remove the rootkit, I don't take issue with this. This is similar to MS testing a 3rd-party developers product to make sure it works, when in the marketplace it's the job of the 3rd-party shop. Somehow I doubt the rootkit devs are going to get their kit validated by MS as a certified app......
Website Hosting
If Microsoft has a way of detecting the rootkit, they should make it available separately so that people can test their machines before they try to update them. Of course, this is Microsoft we're talking about, so you know they're not interested in what's right unless it's also profitable.
Good, inexpensive web hosting
Let's see what do I want?
A) A working machine that has a rootkit installed.
B) A machine that nolonger works.
Can you expect MSFT to test their patches against machines that have been modified via rootkits? Or should the patches themselves remove the rootkits. You are assuming that MSFT can remove the rootkit in the first place.
What ever happened to backwards compatibility? Why, I remember the day when any virus, worm, or piece of malware, would run no matter what!
#fuckbeta #iamslashdot #dicemustdie
I really don't have a problem with this. If the system is already rooted, the patch isn't going to actually help anything since their security is already compromised. And with all the bad press MS received last time over something that was not their fault at all, why should they risk it again? If your system has a serious issue like being rooted, then you have to take care of the issue before you can install the patch. Seems logical to me.
"Information wants to be expensive" - Stewart Brand, the same guy who said "Information wants to be free"
Rightfully so. Security patching a rootkit-ed OS is mildly amusing and also a bit redundant. The only way to secure such an OS starts with reformatting the system partition.
The title is totally misleading. It gives the sense that Microsoft refuses to deliver some patch that fixes the rootkit infection. While in fact Microsoft avoids to deliver the patch to keep the machines in a working (albeit infected) condition.
I bet that the poster is a fanboi that found his opportunity to bash Microsoft... :-P
I think microsoft acted responsibly in this situation. They merely mitigated any future issues these patches might have, they didn't want the same thing to happen again. In this case it was prevention not intervention. Unfortunately, there are many ways to get a rootkit installed on a computer; however, most of the time it's usually the user that infected themselves. This is why there are measures that a user can take to prevent or minimize the occurrence. Microsoft did make a note to remove the infection and then install the patch. If they don't know how to remove the infection or don't know they can download if not purchase one of many anti-virus solutions or pay someone to do it, then maybe the user's should rethink their web browsing behaviors.
Of all the things I've lost; I miss my mind the most. - Mark Twain
I recall slashdotters complaining that they didn't do CRC check or similar (they do, but the rootkit gave 'real' value and it was worthless).
Now they're doing the right thing and we get news how they refuse to patch the systems which .dll files have been damaged? Welcome to slashdot.
Their Malicious Software Removal Tool (sent out on Patch Tuesday) can remove the rootkit.
But I won't stop the Slashdotters here from complaining about it.
The price is always right if someone else is paying.
Code 0xB302392838271
This is why I come to Slashdot. So many computer-literate people...
As Microsoft has noted, while the solution prevents users from suffering the misery of Blue Screens of Death, it does leave them unprotected and the company has urged users to download its Malicious Software Removal Tool to clean up their machines and run the patch as soon as possible.
It isnt that they wont patch these systems, its that they wont automatically install the MSRT, which removes the rootkit, as part of the update.
..and to be perfectly honest, who wants the MSRT to be a mandatory component. Things like that are capable of unexpectedly altering the system, something typically frowned upon in enterprise.
"His name was James Damore."
First, you beat up Microsoft because their patch trashed machines that were *already* infected. Then you beat them up because they backed off on applying the patches to avoid trashing the machines. Get thee to SuperAntiSpyware and Anti-Malwarebytes and get your machine cleaned up before you complain.
This just proves that it's a great time for people who have been sticking with XP to take the plunge and upgrade to Windows 2000 Professional.
If they have the ability to detect these things, why in the world doesn't a little popup appear in the systray or security center saying "Your system appears to have a form of Malicious Software installed. Windows Updates are currently disabled. Please see your Network Administrator."
Seriously, the rogue spyware apps do this all the time, why can't Windows itself do it?
"Microsoft discovered the problems occurred on machines infected with the Alureon rootkit"
There are many reasons to hate Microsoft, and their QA failure when it comes to security is certainnly one of them. However, the spread of rootkits, viruses and other malware is primarily caused by user stupidity, something that is not Microsoft's fault. In the early days of personal computers I took the time to learn how things worked. If you're having the problem described in this article then you can wipe your hard drive and re-install Windows. If you don't know how to do this, then maybe it's time you learned. If you're not willing to learn, then do the rest of the world a favor and throw your computer out the nearest window.
I mean, they already have the malicious software removal tool, so they could blow the roots away if they wanted to. but what is really needed here is to block the rooting mechanism altogether.
or go back to the saner architecture of nt 3.0/3.1/3.5, where only the kernel and its designated MS helpers ran at level 0 to start with. the world started to go to hell when they allowed the video driver into level 0.
if this is supposed to be a new economy, how come they still want my old fashioned money?
microsoft doesn't refuse to patch rootkitted systems, microsoft is UNABLE to patch rootkitted system. NO ONE can patch a rootkitted system, of ANY OS. you need to wipe the system and reinstall
it is ok to be against microsoft, but you have to base your opinion on genuine problems. when you base your opinion on mindless propaganda, you are just another useless partisan in this world: loud, dumb, useless
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
Couldnt them had included...Had you been knowing English long?
I've abandoned my search for truth; now I'm just looking for some useful delusions.
See:
http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Virus:Win32/Alureon.A
I've have reasonably good experiences with MSE so far with my Windows users. Anybody else want to weigh in here?
Chances are, if it's a rootkit, it's already overwritten the "known good" versions of those files Windows keeps around.
Plus, they can't guarantee that other files won't be modified by different versions of the same rootkit.
Other than that, Microsoft already pushes a new version of the Malicious Software Removal Tool through Windows Update every month.
GLaDOS for President 2016! "Well here we are again. It's always such a pleasure." -- GLaDOS, 2011
and hence advertising revenue.
Hail Eris, full of mischief...
E pluribus sanguinem
Yes. Because when patching, you want the process to be as simple as possible for the END USER.
The more steps the end user has to follow, the more likely that the end user will make a mistake somewhere.
If it can be done in one step at the end user's level, then it should be done in one step at the end user's level. No delays.
A) A working machine that has a rootkit installed.
And is sending all key presses and bank account details to criminals.
Deleted
That was the sarcasm train, clearly passing you by.
If the kernel is fucked, nothing works any more. Any results from on-line determination of the damage status of the machine itself should be assumed fake because the malware is in control of all local resources. To accurately determine the status of the computer, it must be taken offline.
Never trust what rooted machines say about themselves...
Colorless green Cthulhu waits dreaming furiously.
I'm strangely ok with this. If they update the computer and the rootkit conflicts with the new patch and makes the computer unusable, they'll just get blasted for breaking people's computers. But if they don't update the computer, then the person is still able to use it. If they're warned that they can't update because they have a rootkit on their system and they do nothing about it, I feel no sympathy for them. At least Microsoft didn't make their system less operational. They should get rid of the rootkit and then update. If Microsoft let people update while knowing that it would make the computers unusable if they had this rootkit. People would still call foul on Microsoft. This way they're at least giving people a warning and chance to fix their problem, not making the problem worse.
Seeing the summary and many of the posts here, it's so sad to see how the internet gave every idiot a podium. It's always going to be catch-22 for Microsoft, even if they donated 40 billion dollars for every open source foundation/cancer research facility in the world. It's sad to see CS graduates, sysadmins and programmers with the mentalities of 4channers. Huh
So, does this detection result in a message like "Windows Update had an error. Code 0xB302392838271" or "YOU'VE BEEN HACKED!!! GET YOUR COMPUTER FIXED!!!!"?
Oh, like those lovely programs XP Antivirus and "Security Tool" do! Yes, I think that trying to scare and confuse the user into an irrational course of action is the way to go.
Microsoft let the crap get on the machine in the first place.
They're ultimately responsible any way you try to spin this situation.
I will say that again s-l-o-w-l-y: It's Microsoft's OS. They are responsible for it. You even paid money for it.
A Pirate and a Puritan look the same on a balance sheet.
Shouldn't it just determine if the DLL was damaged and replace it with the correct, working patched version if it is? Sorry, but automatically throwing their hands up and saying "you're fucked" is the Microsoft shortcut for not being able to fix their own security problems.
Isn't that what they did last time, and it caused bluescreens?
Do you want every single patch, no matter how small, to try to detect rootkits and, if a rootkit is detected, replace every DLL in the system with known clean copies? That's absurd.
The problem wasn't that the DLL the patch installed caused bluescreens, it's that DLLs the patch didn't touch - because it wasn't patching them - were now incompatible with the clean (patched) DLL (because they were part of the rootkit).
What do you propose Microsoft do about it? Patch the DLLs anyway, knowing it will cause bluescreens? Provide the entire slew of kernel DLLs for download via Windows Update, and install all of them every time there's a kernel patch?
I don't mind what MS is doing at all - they're doing their best to make sure that their users won't get bluescreens, even if they're rooted.
More like Obsoletes regularly. Wait a year to update and you can be SOL.
You don't know how computers work, do you?
The blue screen crashing that this rootkit caused after the previous update was not due to rootkit modifications to the files that were being patched.
The problems occured because code that was NOT being patched (the rootkit!) was making direct jumps into kernel memory, to offsets that were no longer relevant after the patch.
"His name was James Damore."
If MS won't support a 10 year old system anymore, I don't stand much of a chance getting my first gen root-kitted iPhone patched then.
Comment removed based on user account deletion
You don't know how software development and pointers work, do you?
To many users, a computer works by doing what they tell it to do, and that's plenty for them to know. "How computers work" is a very broad statement that could mean a number of things that you don't address in the statements following your first one.
It also makes you sound condescending.
'Never trust what rooted machines say about themselves..."
Funny, that's usually how I spot a rooted machine. There's a fine difference between "I just don't want to work because I'm a piece of shit" and "I don't want to work because I'm controlled by someone other than you."
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
Comment removed based on user account deletion
Comment removed based on user account deletion
If they patch system can detect the rootkit and not install, why doesn't it remove it and then install? At least give the user the option of doing it, instead of just leaving the user to deal with yet more work.
Uh, what are you trying to say?
Once the machine is rooted or has malware on it that has gained admin/root/kernel access, your best bet is to shut it down, take your documents and reinstall the system. You cannot know where it hides, no matter how knowledgeable you think you are. But you can still save your documents and not reveal banking data or passwords and similar.
So this is a vendor software issue? Those rootkit developers should have a better testing process. I'm not going to go to all of the trouble of rooting 100k servers just to have my botnet BSOD on the next update. I demand a refund
Truth: If it's not one thing, it's another
"I'm a people-person. What the hell is wrong with you people?"
*Still* negative function...
>> It never ceases to amaze me how the company that SHOULD produce some of the best code in the world (given revenue and longevity) instead seems to almost invariable produce code based on the "quickest and cheapest" principle.
Thats what happens when accountants get more say than engineers in the important decisions. The big problem is that missed sales can't be counted. The real problem is that most people will still buy Microsoft products no matter how bad they get, and Microsoft know it too.
A: Sell new 2010 automobile
B: Release new 2011 version of same automobile (with LED widgets!)
C: Inform everyone who purchased the 2010 model that parts for their model will no longer be available after 2012.
D: Inform car dealers that they will not be allowed to sell used 2010 models.
E: Inform gas stations that they must use new nozzles at their pumps that only fit the 2011 models.
F: Sit back an wonder why people take cheap shots at your company and begin purchasing motorcycles.
G: File lawsuits against the motorcycle companies for restraint of trade and IP infringement.
I don't rag on Microsoft because they make a substandard product. I rag on Microsoft because they *force* their new products on their customers, and then treat those customers like thieves until proven otherwise. If I don't want to upgrade from Ubuntu 6, I can still download it and use it if I so choose, and I won't be accused of software piracy if I blow a system board and swap the drive into a new system.
Microsoft let the crap get on the machine in the first place.
They're ultimately responsible any way you try to spin this situation.
I will say that again s-l-o-w-l-y: It's Microsoft's OS. They are responsible for it. You even paid money for it.
I wasn't aware that Microsoft was to blame when a user went against safe operating practices, such as clicking on pop-ups and opening virus-filled emails. I suppose I was wrong.
I don't like Linux. This doesn't make me a troll.
Given that only the first hex digit was in the range a-f, the number was very obviously not completely random, and therefore has less than 52 bits of information. 12 digits in the range 0-9 have 39.9 bits of information. Assuming it was not by chance that the first digit was in the range A-F, then this digit also has an entropy of 2.6 bits. The sum of both is 42.5 bits. However, the digit string doesn't seem to be completely random either, so it's not impossible that the extra reduced randomness just removes that half bit, so the total information is actually 42 bits.
The Tao of math: The numbers you can count are not the real numbers.
What if it hides in the documents?
The Tao of math: The numbers you can count are not the real numbers.
http://technet.microsoft.com/en-us/library/cc512587.aspx
>You can't clean a compromised system by patching it.
>You can't clean a compromised system by removing the back doors.
>You can't clean a compromised system by using some "vulnerability remover."
>You can't clean a compromised system by using a virus scanner.
>You can't clean a compromised system by reinstalling the operating system over the existing installation.
>You can't trust any data copied from a compromised system.
>You can't trust the event logs on a compromised system.
>You may not be able to trust your latest backup.
>>>>>The only way to clean a compromised system is to flatten and rebuild.
Jesper M. Johansson, Ph.D. [YES, HE'S A DOCTOR], CISSP, MCSE, MCP+I
Security Program Manager
Microsoft Corporation
I agree, I thought the title of this submission was skewed - especially after reading the rest of the article. Microsoft does not appear to be "refusing to patch rootkit infected computers".
A more accurate title would be something along the lines of: Microsoft attempts to prevent inadvertently bricking XP systems with Windows Updates
Bear in mind I'm terrible at coming up with titles. Also bear in mind I'm not a big fan of Windows.
http://xkcd.com/123/
note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register
Well, by refusing to patch an already compromised system they open that system up to getting further malware infections...
If the system breaks at least it's now offline and will cease sending spam or whatever other malicious things its doing.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
theoretically impossible and practically impossible
you wipe the system: you are now guaranteed a clean system and you spent orders of magnitude less time and effort than the scenario you propose (which doesn't guarantee anything)
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
Do they notify the users that they're rootkitted?
If anything, a bluescreen is a good thing since the rootkitted machine is now offline and no longer sending spam or whatever other malicious things it might be doing.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
Meh. I'm just glad they're still patching Windows XP.
It is exactly for the reason that I am not an expert in it that I don't do plumbing nor farming. And, the world will be a safer place if plumbers don't do any heavy IT work either.
There's a clear distinction between (end) users and admins. Apple, for one, tries hard to blur it, but the distinction is there.
Since when cluelessness is not a excuse? The internets ain't your city park where all dogs wear muzzles and a purse accidentally dropped on the ground will be brought to you by the discreet police no later than in five minutes. If anyone in charge of a computer goes carefree to the point that his computer becomes a zombie, this becomes *my* problem, not just theirs.
Mod parent poster emphatically up.
I hate to say it, but it's more like this:
A: Release New OS
B: No One Adopts New OS
C: Release Another New OS
D: Support Expires for Old OS
E: "SOMEONE" Develops a rootkit\virus\malware that targets old OS.
F: Anti-Virus keeps the old OS limping along
G: Anti-Virus vendors keep releasing updates to prevent new viruses\rootkits\etc.
H: Over time thousands, if not millions of Old OS systems get infected by root kits that the large population isn't aware of.
I: Create a new patch that specifically, when coupled with the largely ignored\unnoticed rootkit\virus\malware, makes Old OS unuseable.
J: Choice: switch to Linux or upgrade to New OS.
K: Laugh histerically as at least 50% upgrade to New OS and you bath in $20 bills soaked in Champaign.
L: Profit.
GLaDOS for President 2016! "Well here we are again. It's always such a pleasure." -- GLaDOS, 2011
Because as a PC repairman I can tell you that trick won't work? These bugs ain't the nasties of old, where a simple boot into safe mode and a cleaning fixes you right up. No sir, these babies are naaaasty. Multiple hidden processes, auto replacing of files with its own, hidden reg entries, rootkits, all kinds of really nasty shit.
MSFT is doing the right thing in this case. There simply isn't any way to really clean these badly infected machines by remote, and trying to patch them while infected will just leave you with a BSOD'd box. Better to pop up a screen that says "We're sorry, but it seems like your computer may be infected. Please take it to your nearest service center to have it checked" than to try to fix this crap by remote and totally hose the machine.
Not to mention if MSFT disables programs by remote, spyware or not, they'll probably get hit by a wave of lawsuits from spyware vendors claiming their apps are legit. Better to let the user take it to someone who knows what they are doing and let them decide what needs to go.
ACs don't waste your time replying, your posts are never seen by me.
That's good for the world in general but bad for the owner of the machine. You're suggesting MS make the decision to fuck over some individual for the good of many? They don't have that mandate.
Well, by refusing to patch an already compromised system they open that system up to getting further malware infections...
They're not 'opening up' the system -- they're just leaving it open. It was already like that when they found it.
If the system breaks at least it's now offline and will cease sending spam or whatever other malicious things its doing.
Good for us. Bad for the owner. MS cannot fuck the owner on our behalf.
They need something for systems that have been screwed up by their own users. Perhaps a patch that prevents administrator users from connecting to websites that use bad javascript?
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
Because patching it kills the system and results in endless blue-screens and reboots. So yeah, it's not an optimal solution, but breaking the system to the point where it's unusable isn't a good idea either.
I'm fine with msft bricking them. Might finally get some action. Gb
So now they're actively leaving rootkits online and fucking over the rest of the world for the good of the guy who can't maintain his machine properly? You could argue that they don't have that mandate either.
5. 353,000 tons traveling at 650 miles per second creates enormous air resistance - this will heat the reindeer up in the same fashion as spacecrafts re-entering the earth's atmosphere.
Which is why Rudolph has a red nose!
www.Buy-Proxy.com - A "buyer-driven" global marketplace.
Once a machine gets owned it's gone. Total wipe, reinstall from good backup. No matter what OS or even WIndows it is.
Joe Sixpack doesn't have a backup.
Also, Joe Sixpack probably don't have XP CDs, so he has to install from the 'recovery partition'; I wonder whether any rootkits are installing themselves into the recovery partition so they'll automatically be reinstalled if someone tries to wipe their system and reinstall from scratch?
To do nothing? They need a mandate to not touch a system they don't own?
Hmmm.... MS would be screwing over the machine owner by actually letting them know that their machine has been compromised by having it blue screen? How is that?
It's somehow NOT screwing over the user to let them go on in ignorance doing their banking, tax prep, online investing, online purchasing, etc... from a compromised machine? How do you figure that? You would rather let an attacker know all your personal information, and have your machine used to compromise other systems, than have your machine blue screen? If you would, I say you have some seriously screwed up priorities.
"while democracy seeks equality in liberty, socialism seeks equality in restraint and servitude." de Tocqueville
Yes they do - it gives a specific error code where if looked up it says "this machine in unable to run Windows Update because it is infected with malware" or something like that.
Rooted machines need more than a quick patch or av scan - do that so you can secure your data, back it up and then blow it away and start over. Its the only way to be sure.
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
You can scan them, and inspect them relatively easily for corruption. What you can't necessarily scan for with a dumb rootkit remover is modified configuration settings, modified firewall rules, added ipsec tunnels, etc - that weren't done by the rootkit, but by someone with control of it. Sure you could do that manually by going through each and every configuration item on your box, but its a lot quicker and easier to blow it away and start over.
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
Well, the proper solution for a rootkitted box IS to replace every DLL and configuration item on the system once the rootkit is removed. Its called an OS wipe and reinstall.
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
Why is not patching the system acceptable?
Because it is.
What exactly do you expect patching an already rooted system to accomplish? Those patches won't make it any more secure than it was before the patch. Those patches won't fix any of the security problems they fix on a rooted system.
What would the point be?
Best possible case is nothing at all happens and you are just as rooted and insecure as before applying the patches.
Worse possible case is your system now refuses to boot, or reboots in loops, etc.
It's somehow NOT screwing over the user to let them go on in ignorance doing their banking, tax prep, online investing, online purchasing, etc... from a compromised machine? How do you figure that?
Don't over-complicate the issue. It's just not MS's call to make.
You would rather let an attacker know all your personal information, and have your machine used to compromise other systems, than have your machine blue screen? If you would, I say you have some seriously screwed up priorities.
???
This is not *my* situation. It's the situation of people who know so little about computers that they don't even know what their situation is. Even for them, MS cannot confer upon itself the power to bluescreen their machines to protect them from themselves. As much as you might wish it, you too do not have the power to give them that mandate. Such is life sometimes. Live with it.
Good for us. Bad for the owner. MS cannot fuck the owner on our behalf.
Strange. I thought fuck the consumer" was their business model.
See WGA
This is an ex-parrot!
Stands for one of two things:
Malicious Software Removal Tool
Microsoft Removal Tool
Wonder which works better?
--
Toro
(There's a reason Microsoft named the file MRT.exe)
Can you imagine if the auto industry adopted the same strategies used by Microsoft:
A: Sell new 2010 automobile
B: Release new 2011 version of same automobile (with LED widgets!)
C: Inform everyone who purchased the 2010 model that parts for their model will no longer be available after 2012.
D: Inform car dealers that they will not be allowed to sell used 2010 models.
E: Inform gas stations that they must use new nozzles at their pumps that only fit the 2011 models.
F: Sit back an wonder why people take cheap shots at your company and begin purchasing motorcycles.
G: File lawsuits against the motorcycle companies for restraint of trade and IP infringement.
I don't rag on Microsoft because they make a substandard product. I rag on Microsoft because they *force* their new products on their customers, and then treat those customers like thieves until proven otherwise. If I don't want to upgrade from Ubuntu 6, I can still download it and use it if I so choose, and I won't be accused of software piracy if I blow a system board and swap the drive into a new system.
Wow, just wow. I'm not sure where to begin with whats wrong with this post. Lets see, model 2010, 1 year later releases a newer model? Considering WIndows XP was released in August of 2001 and they are only officially stopping support for it on July 13, 2010 completely invalidate that comparison since 2001-2010 isn't 1 year. Vista wasn't even released until 2006, 5 years later... For C. you wrore that the 2010 model that they won't be able to use parts after 2012 again files in the face of everything since Office 2007 (the newest one) runs on Windows XP and was released 6 years later. This doesn't even consider that the new Office 2010 is also going to run on Windows XP... 'Inform dealers not to sell 2010 models'. You were able to buy Windows XP for years after Vista, and for quite some time without paying extra license... ' Inform gas stations they must use new nozzles, ect, again is wrong since Vista and Windows 7 allows backwards compatibilities and newly made software is still made to run on Windows XP (note the Office 2010 again)... If your going to try to make a comparison at least put a pinch of effort into it.
Attention... all grammer nazi"s! Is they're anything; wrong with: my post,
Joe sixpack is a cock who needs his machine to BSOD and become unrecoverable before he learns.
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
Say someone pisses in your pool...
... and then we get upset when these computers are used for botnets and spam propagation... WTF?!
How do you get the piss out of the pool?
You don't. It's fucked. You drain the pool and start again.
Any server administrator worth their salt knows if someone gets in to root / administrator who is not supposed to be there there is only one course of action: Unplug and rebuild.
You do not try to fix a server that has been compromised in this way, regardless of Operating System. For some reason we get compassionate about home-users who can't afford to fix their computer
I think it's utterly RESPONSIBLE of Microsoft to withdraw support for someone silly enough to want to keep running an operating system that's been rootkitted.
Hell, if it were my network I'd be using the rootkit to permanently disable all network connectivity to avoid any further damage. User be damned.
XP (and IE 6) won't EOL any earlier than 2014. They are just trying to prevent users that complain that their system bricked when they installed an update.
Support for XP SP2 only ends July 13, 2010
Extended support for XP (mode it's in now, essentially just security fixes) for SP3 ends April 8 2014.
Windows 2000 Extended support ends July 13 2010. Christ Almighty they still patch IE 5.01 for Windows2000
Joe sixpack also didn't pay attention when his system that shipped without discs begged and pleaded with him for the past 5 years to burn off recovery DVDs.
I hate OEM preinstalled bloatware, I hate that they don't ship discs, but no, you're not screwed if you only have a recovery partiton. You're only screwed if you didn't make the discs it asked you to.
Microsoft isn't responsible for what a rootkit decides to do.
If I were microsoft, I'd update away, and consider malware infections the same way I would unauthorized tampering with system files by the user. Just update the kernel, and be damned with anything that was played with. For much the same reason that opening a device is usually grounds for voiding the warranty, since the manufacturer can't reasonably be required to support end user tinkering.
The notion that vendors should go out of the way to actually SUPPORT malware is absurd, let alone the notion that black hats should be dictating terms to OS creators.
But it's not intentional.
It's more like you take a device into the factory for an upgrade, but unknown to you, someone swiped it, and installed a spy chip inside. When the factory technician opens it up and tries to install the new parts, the spy chip short circuits the whole thing and the device blows up in his face.
Am I right in my assessment, that they first leave your door wide open. And once a burglar entered and set off the burglar-detection, they refuse to install a lock in your door?
Strange. I thought rational discourse was more important than dogma.
Say someone pisses in your pool...
How do you get the piss out of the pool?
Maxwell's demon
Most human behaviour can be explained in terms of identity.
Microsoft isn't responsible for what a rootkit decides to do.
What kind of crazy logic is this? Their code is downloading the patch and applying it. At this point the ball is in their (MS's) court about how to proceed. It's not the rootkit 'deciding' stuff at this point.
If I were microsoft, I'd update away, and consider malware infections the same way I would unauthorized tampering with system files by the user.
They don't get to make that call. If you were actually in MS's position, you would actually make the same call as them. On a random forum on the internet it's easy to make bold claims about what you would do.
Just update the kernel, and be damned with anything that was played with.
Again - this is a completely cavalier attitude -- and if you were actually in the position to make the call, not only would you not have the stones, you would also pause to think about it for a second and also realize that you don't have the right to do that.
For much the same reason that opening a device is usually grounds for voiding the warranty, since the manufacturer can't reasonably be required to support end user tinkering.
So you're saying the manufacturer gets the right to knowingly brick your system because you've voided your warranty?
The notion that vendors should go out of the way to actually SUPPORT malware is absurd, let alone the notion that black hats should be dictating terms to OS creators.
You managed to twist "we won't knowingly BSOD user's systems" into "we support malware"?? Only on slashdot. God knows what you mean by "black hats dictating terms to OS creators" -- nothing in your post made much sense anyway.
Yeah, okay, the analogy sucked. I was half asleep at my desk when I wrote it. I still stand by the basic argument that Microsoft's tactics of forcing customers to upgrade, combined with their draconian verification protocols, would not be tolerated in other industries.
I'm just saying it seems rather silly to put MS in the position of walking on egg shells around rootkits to prevent a BSOD that they're not even responsible for causing.
So, MS has no duty whatsoever to notify people that they know have compromised machines? Sorry, but that's pure horseshit and symptomatic of everything that's wrong with our society.
The principle behind it is no different than a neighbor watching someone back a truck up to your back door and load up all your furniture, appliances, safes, etc..., drive away with everything you own, and never say a word to you about it or call the cops. Does your neighbor have a moral duty to call both you and the cops? Yes. We all have a moral duty to protect each other.
MS has the same moral duty to those who buy their products when MS discovers their machines are compromised. MS shouldn't be snooping, but if they discover this type of problem during normal operations, like installing updates, then they most certainly have a moral obligation to help those people.
If you can't understand, or disagree with, the above concepts, I certainly wouldn't want you for a neighbor or acquaintance, or be part of the same workplace with you, and most certainly would never call you friend, as you are not trustworthy.
As to you, personally, not having a root kitted computer, well, your comments just show you have no empathy as you can't identify with someone else's problem nor visualize what you would want someone to do for you if you were in the victim's shoes. That pretty much explains your lack of understanding with regard to moral obligations.
"while democracy seeks equality in liberty, socialism seeks equality in restraint and servitude." de Tocqueville
I couldn't find an answer to this in the article posted but does this patch notify the end user as to why the patch was not installed? After reading it it looked like the patches just simply wouldn't install and it was left to the end user to manually go back and verify that the patches wouldn't install. Rather than an informative message prompting on the screen.
While I understand your reasoning, please understand the concepts of morality apply only to humans. Microsoft corporation has no moral duty to do anything. Corporations are amoral, they are neither moral nor immoral, and as such they are only obligated to adhere to the rule of law in their pursuit of profit.
Did you ever wake up in the morning, with a Zombie Woof behind your eyes? -- FZ
...having someone on the highway who doesn't know about cars and is mechanically incompetent. And as a result of said incompetence the car is utterly unmaintained, so it belches whitish-blue smoke (because both oil and coolant are being burned) and holds-up traffic because it can barely maintain speed. It's going to break-down often because critical problems simply aren't addressed until various failures render the vehicle inoperable, and then it's only patched-up enough to get it limping-along again.
So why aren't all cars which are owned by people who have no mechanical aptitude clunkers of the sort I described above? It's because you don't have to be a master mechanic or have any mechanical aptitude to take your car TO a mechanic for an inspection if you think something might be wrong or to change the oil. You pay the professional to have knowledge and skill in an area you lack those things in. Said mechanic can also answer questions and offer helpful advice to help you get the most life out of your car and keep it running well.
Cars are machines, computers are machines. Is it really too much to ask that people who don't know much about computers take them in for a tech to look at if they start behaving strangely or running slowly? Or that they run and update anti-malware preventative-maintenance products? So, someone gets BSODed by an update. Such failures doesn't make people idiots because they don't know how to avoid or correct malware problems themselves. They are idiots because they not only couldn't do it themselves, but they also didn't bother to hire a professional to help them out.
So nope, no sympathy from me either. BSOD them and get 'em off the 'net, just like a ruined clunker alongside the road. At least with computers, there's no real physical damage, the "clunker" can almost certainly be restored to as-good-as-new functionality with an OS install disc and a couple hours of time.
I'm just saying it seems rather silly to put MS in the position of walking on egg shells around rootkits to prevent a BSOD that they're not even responsible for causing.
Nobody is putting them in any position. They're not walking on egg shells. They just know what they can and cannot do, and intensionally BSODing a user's system is fairly high on the list of things they cannot do. However it's spun, they're doing the only thing they can/should do.
While I understand your reasoning, please understand the concepts of morality apply only to humans.
Laws exist to project our sense of morality onto corporations. Please lose the condescending tone next time you post.
Microsoft corporation has no moral duty to do anything.
They don't have the authority to make a decision on the user's behalf about how to proceed (in the event of failing a system integrity check). Who said anything about morals?
Corporations are amoral, they are neither moral nor immoral, and as such they are only obligated to adhere to the rule of law in their pursuit of profit.
That rule of law as I said, is us (humans) projecting our morals onto corporations. If MS were to intentionally BSOD a users system, the user could go to court, and the user would win. MS has no other option here. Where did morals come into this??
But it's not intentional. It's more like you take a device into the factory for an upgrade, but unknown to you, someone swiped it, and installed a spy chip inside. When the factory technician opens it up and tries to install the new parts, the spy chip short circuits the whole thing and the device blows up in his face.
It is intentional. It was not intentional the last time they pused out updates and got burned by Alureon rootkits. The second time around, if they encounter the same number of BSODs it would be intentional at worst, and negligent at best.
I'm a dumbass. I just realized you were replying to the other poster -- not to me. In the correct context, I understand what you were saying.
Those users are rootkitted, they have by definition already been fucked over.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
Which doesn't preclude them from getting fucked over some more.
Well the updates applied successfully, so I guess I'm rootkit free.
You see? You see? Your stupid minds! Stupid! Stupid!