Slashdot Mirror
Security Firm Reveals Microsoft's "Silent" Patches
CWmike writes "Microsoft silently patched three vulnerabilities last month, two of them affecting enterprise mission-critical Exchange mail servers, without calling out the bugs in the accompanying advisories, a security expert said on Thursday. Two of the three unannounced vulnerabilities, and the most serious of the trio, were packaged with MS10-024, an update to Exchange and Windows SMTP Service that Microsoft issued April 13 and tagged as 'important,' its second-highest threat ranking. Ivan Arce, CTO of Core Security Technologies, said Microsoft patched the bugs, but failed to disclose that it had done so — which could pose a problem. 'They're more important than the [two vulnerabilities] that Microsoft did disclose,' said Arce. 'That means [system] administrators may end up making the wrong decisions about applying the update. They need that information to assess the risk.'"
"Secret patches are neither new or rare. 'This has been going on for many years and the action in and of itself is not a huge conspiracy," said Andrew Storms, director of security operations at nCircle Security. What is unusual is that Core took Microsoft's silent updates public. Saying that Microsoft 'misrepresented' and 'underestimated' the criticality of MS10-024 because it didn't reveal the two bugs, Core urged company administrators to 'consider re-assessing patch deployment priorities.' Microsoft confirmed this instance and defends the practice, noting that updates can "be destructive to customer environments." But Storms echoed Arce's concern about possible misuse of the practice, which could result in a false sense of security among users."
...but deadly.
This ain't rocket surgery.
Updates can be destructive to customer environments. Just ask anyone who uses McAfee.
"I'm not a quack, I'm a mad scientist! There's a difference." - Dr. Cockroach
they should tell us about everything they're doing. they can do/undo bugs and we'd never know it.
How so? If it is a patch, it needs to go through your testing process for deployment.
Phwew! Thank you Microsoft. Just yesterday I posted that I usually find a reason to hate Microsoft each day, but yesterday I loved the new Office 10. Thanks for bringing me back to my comfortable place.
http://slashdot.org/comments.pl?sid=1641038&cid=32102920&art_pos=1
- For the complete works of Shakespeare: cat
he said "asses"s
they've got to keep those great security stats they publish about themselves somehow, right?
Ivan Arce
I've an arse too, but I don't feel the need to point it out to everyone..
which is totally what she said
"Secret patches are neither new or rare. "This has been going on for many years and the action in and of itself is not a huge conspiracy," said Andrew Storms, director of security operations at nCircle Security."
What is unusual is that Core took Microsoft's silent updates public.
Not that this should go on anyway, but don't go thinking this is a rare instance and they are stealing your milk money, it happens enough to be of some sort a standard business practice.
~Mekkah
Use GNU/Linux.
All vulnerabilities and patch side effects should be described, so I'm not defending the practice,. But until a system administrator has the full source code of the system and is willing and capable of auditing it, they should apply all critical patches.
Regardless of the operating system.
According to the article some of these patches were only marked as important not critical.
note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register
... themselves!
Microsoft doesn't need additional bad press. The more bad press they can prevent, the better...for them anyway.
No surprise here. Sysadmins need to know exactly what bugs are being fixed in each patch so they can decide on appropriate priorities for deployment. However, vendors need to not disclose exactly what bugs are being fixed in each patch to minimize the damage to their reputations that comes from large numbers of major bugs or having to fix the same bug over and over and over. And since the vendors get to control the patch descriptions, guess who gets their way.
This is one reason I favor full disclosure of security bugs. Vendors can only hide the fact that they're fixing a bug if the world at large doesn't know the bug exists. If the bug's publicly disclosed, the vendor now takes the PR/image hit if they don't say when they've fixed it. This then encourages not only quicker fixes to high-risk vulnerabilities but full and complete disclosure of what's being fixed (so users don't keep asking "Why haven't you fixed this yet?").
Microsoft was not fixing a bug, it was removing a remote access feature. They didn't mention it because they didn't want people to complain that this valuable functionality was being removed.
- None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
"Secret patches are neither new or rare..." So counting fixed vulnerabilities of closed software will not count the number of vulnerabilities in said software.
If such secret patches are neither new nor rare, why then are vuln patches used to ascertain whether CSS or FLOSS is better quality???
(on conference call)
Dr. Egon Spengler: There's something very important we forgot to tell you.
Ivan Arce: What?
ES: Advise your clients to install security update MS10-024.
IA: Why? What would happen if they didn't?
ES: It would be bad.
IA: I'm fuzzy on the whole good/bad thing. What do you mean, "bad"?
ES: Try to image all their Exchange servers locking up all at once and all their mail traffic being rerouted to parts unknown, effectively bringing about the end of your client's existence as a functioning company.
Dr. Ray Stantz: Total packet reversal!
IA: Right. That's bad. Okay. All right. Important safety tip. Thanks, Egon.
.
Prisencolinensinainciusol. Ol Rait!
unless the patch breaks something which you should test in a test lab you should apply most patches, and half of the releases that explain what it fixes explain how to take advantage of any computers that don't use this patch, if it's a serious threat then it might be better to let people protect themselves before you tell the hackers how to use that exploit.
a botnet?
Yours In Astrakhan,
Kilgore Trout
administrators may end up making the wrong decisions about applying the update.
Decision? Automatically apply updates and reboot? Check.
One year later: BREAK
Well, that's Microsoft, Boss. Whatada gonna do? Sure I'll come in for overtime; you buying pizza? I want Hawaiian.
...how much the numbers are actually mis-represented in side-by-side vulnerability comparisions between the various platforms (windows/linux, etc.), if there's a bunch of them that being swept under the carpet.
"You will NEVER be happy with anything Microsoft does."
I know. I figured it wasn't realy my thing, so I jumped onto a different OS bandwagon and absolutelt love it!
Here be signatures
"[...]they're more important than the [two vulnerabilities] that Microsoft did disclose,' said Arce. 'That means [system] administrators may end up making the wrong decisions about applying the update."
Right, there's been a fair few times where I've not applied security patches "right away" for simple reasons; like they did not affect the way my system was set up.
But in the end I am hoping "[...]end up making the wrong decisions about applying the update" is talking about a time aspect rather than if-at-all... (this should explain itself)
Then that they did not declare this in their patch info is a whole other issue; Microsoft are certainly not the only ones who have a history of not doing so...
Microsofts very creative way of handling security has been known for a long time. Instead of fixing the bugs they go for the statistics. By downplaying any security issue until openly proven wrong and rate vulnerabilities as low as possible the statistics look much better.
Another smart move was UAC that puts all the blame on the user but doesnt fix the underlying security issues.
Comparing only Windows to Linux + All applications is also very deceptive, especially with the practices above in mind.
The sad thing is, it works. People tend to think Microsoft has improved their security when infact Windows 7 in many cases are worse than than its predecessor. If you lie enough times with a straight face stupid cheep will think its true.
HTTP/1.1 400
if you have not yet figured out that the ruling class and the corporations that they own and control .. own and control this planet and your sorry ass .. you are just not paying attention ..
after all they control 98% of all the wealth on earth .. and it is because they are smarter and more deserving than the rest of humanity .. the divine rights of royalty and all that crap.
big brother knows what is best for us and them ..
and besides better if i can hide my shortcomings from scrutiny .. so no one is aware that in fact we are not really all that much brighter just more ambitious cunning and greedy .. as that might lead the masses to start questioning whether the ruling class is really deserving of controlling 98% of everything .. although with the effectiveness of 50% +1 demonocracy .. mass brainwashing through public education and the media .. i doubt it ..
and we would not want a second french revolution .. or one like the 60's were the awakening of consciousness among the youth(the peacemakers .. the biblical children of god) being asked to die for them in one of their for profit WARs and a relatively open and free press almost beat them .. which is why they have retaken control of the educational institutions .. mass media .. and effectively outsourced 95%+ of the government and the militarily to their corporations since 1984 and reagen's second term election .. while the working class grunts are under the threat of losing their livelihood or even death for not fallowing the orders they are given ..
that part is quit cunning .. really nothing new though .. and if it were not for lewis f. powell who went on to become a supreme court judge and his manifesto .. http://old.mediatransparency.org/story.php?storyID=21 .. WE THE PEOPLE might have fulfilled the true meaning of democracy and actually gained control over our own lives ..
what a perfect Catcha for the day .. indolent
You're a moron. I can tell by your use of words like "cheep."
So, explain how UAC differs significantly from OS X's requesting you input username and password each time it wants to update, or do other tasks, or in *nix, when it asks for temporary root access to install things? Or are those also just ways to put it on the user and not fix security issues?
Canada: The US's more awesome sibling.
A claim researchers have sometimes made is that Windows has fewer critical security issues.
That this has come to light raises even more doubt about the validity of such studies.
This is a demonstration that Microsoft sometimes hides critical security bugs, and doesn't release advisories, even when they have been reported.
This is Prima Facie evidence that Microsoft closed-source software probably has many critical security vulnerabilities that were never publicized such, and were instead kept secret, and if patched, the patch was a hitch-hiker on top of a lesser prioritized patch.
Why hide security vulnerabilities, or make them seem less critical? To give a false impression that the software is more secure, and deceive researchers that try to estimate security through blind counting of vulnerabilities.
A key difference is Mac OS input for Administrative credentials and *nix sudo (which are the same thing), MacOS prompt for an Admin login is essentially a graphical sudo ------
Is that in those OSes, the elevation is a true security boundary respected by the underlying kernel, and actual user credentials are required to defeat it.
Whereas with UAC, the 'security boundary' is a soft, artficial one that is easily defeated through various techniques.
Also, the UAC prompts are required for many routine operations, such that users will get used to clicking OK/Continue.
In MacOS/*ix such prompts are extremely rare, rare enough to give the user pause.
Typing in the password also requires considerably more effort and thought than simply clicking Ok.
Most likely the user will at least see what is prompted for and part of the warning message, rather than blindly clicking OK.
In Windows 7, many of those operations no longer require UAC approval - regardless of the fact that they impact the system (i.e. changing the loaded driver for hardware without installing new hardware to do it) - just like Mac OS X.
UAC can also be configured to require the user's credentials to elevate, even when logged in as an admin.
Also, UAC is indeed a boundary at the lowest level, hence the requirement to bloody reboot when you change it (can you tell I hate rebooting).
But hey, don't let facts get in the way of your anti-Microsoft rant.
For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
Anything that fixes security issues or appears under "high priority" in Windows Update is considered critical by me.
Also, UAC is indeed a boundary at the lowest level, hence the requirement to bloody reboot when you change it (can you tell I hate rebooting).
Nonsense. If the user is an administrator, UAC is not a security boundary. See here:
So basically if you can't trust MS with be truthful and upfront about security updates, what can you trust them with?
Microdosft? Are they still kicking around ?
That's great. Now if you could work on not being such a fag, then the rest of us would be happy to.
I get chuckles sometimes from /. ramblings, but this, this is truly funny. Excellent!
Social Credit would solve everything...
You must be mistaking me for a Mac user, coward.
Here be signatures
I would be quite happy if Microsoft were to die a horrible death involving fire.
For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
You can actually configure UAC so you don't have the token, you know. Require password every time you try to elevate.
Anyway, if you say that UAC is not a boundary (you'll note I didn't specify which user type you elevate from) then neither is sudo or Mac OS X elevation.
For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
I'm talking about default configurations here, it's not worth it to dicuss imaginary high-security configurations that real users never apply to their systems in real life.
Repeat after me: If it is not secure by default, then it is not secure.
When Microsoft makes the default that the user does not possess the second token, and a password is required, then we can refer to UAC as a security boundary.
That explosion would be kinda deadly... You know... flying chairs and all...
Here be signatures
Hmm... so Seattle is sitting on a ticking fuel-chair bomb eh?
For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...