Microsoft Has No Plans To Patch New Flaw

Trailrunner7 writes "Microsoft has acknowledged the vulnerability that the new malware Stuxnet uses to launch itself with .lnk files, but said it has no plans to patch the flaw right now. The company said the flaw affects most current versions of Windows, including Vista, Server 2008 and Windows 7 32- and 64-bit. Meanwhile, the digital certificate that belonging to Realtek Semiconductor that was used to sign a pair of drivers for the new Stuxnet rootkit has been revoked by VeriSign. The certificate was revoked Friday, several days after news broke about the existence of the new malware and the troubling existence of the signed drivers."

Comments

Possible mitigation?

[Khyber]

Couldn't they just start making driver signatures verify with the hardware they support instead of the OS? Screw the OS saying whether or not it's legit, does the actual hardware it's meant for say it's legit code?

Re:Possible mitigation?

[drsmithy]

And all of that just because microsoft refuses to make a secure operating system [...]

Can you outline what features and capabilities of a "secure operating system" are missing from Windows ?

Re:Possible mitigation?

[AusIV]

If anything, it would make things worse because they'd be harder to revoke.

Re:Possible mitigation?

[westlake]

And because the users refuse to switch to an operating system that works.

The number of PC users is about 1 to 1.2 billion, based on most estimates I've seen. That would put the number of Windows users at 900 million to 1 billion, at all skill levels.

I will take that as pretty strong evidence that the Windows OS works just fine for those who use it.

In that way, when companies refuse to develop free drivers for GNU/Linux, we won't be able to make our own because the hardware will reject them.

I suspect that signed drivers are inevitable, whatever your platform.

Re:Possible mitigation?

[mcgrew]

The number of PC users is about 1 to 1.2 billion, based on most estimates I've seen. That would put the number of Windows users at 900 million to 1 billion, at all skill levels. I will take that as pretty strong evidence that the Windows OS works just fine for those who use it.

I don't think I've ever met a non-nerd that even knows what an OS is. When I tell people there's a free replacement for Windows that doesn't get viruses, their jaws drop; they have no clue. Windows came with their computer and it's all they know.

If you've never seen an automobile, you would say that your horse works just fine for transportation, too.

Re:Possible mitigation?

[drsmithy]

Why is this modded Troll?

Because it's a troll. Much like the Slashdot headline and summary.

drsmithy has always shown wilful ignorance of Microsoft's flaws.

I frequently ask the question, yes. But (as has happened again) the responses rarely get any more advanced than "hurr, durr, viruses malware Micro$oft LOLz".

As far as what's lacking from Microsoft's security model, managed software repositories and good updating systems are the most obvious lacks.

Both are present in their security _model_. For what are hopefully obvious reasons, Microsoft can't be the sole provider of software in unmanaged environments (ie: individual end-user systems). For the software they do provide, they have "software repositories" and "updating systems".

In addition, Microsoft's need to leverage it's existing software stack means anyone who actually uses Windows instead of just ticking off feature lists will inevitably have to bypass or disable most of the recent security features.

For example ?

With the virtualisation tech they've bought, they had the opportunity to build an effective sandbox, but chose not to.

Probably because they have vastly more interest in catering to their customer's demands for transparently functioning legacy support (despite common Slashdot mythos).

Interestingly, about the only mainstream example of a common application actually being sandboxed in a standard configuration is on Windows - Internet Explorer.

I'll ask again: what features and capabilities are missing from Windows that make it insecure. Ie: if they were implemented, all (or even most) of the "security problems" Windows has would disappear overnight (or at least within a short period of time). If you'd like to expand that to identify security problems that are _only_ present on Windows, with a technical overview as to why (ie: what security features and capabilities are lacking that make them possible), that would also be very interesting.

Source?

[Arainach]

I know Slashdot's editorial standards have dropped, especially when it comes to Anti-Microsoft articles, but there is no link here to any article that claims Microsoft has no plans to patch the flaw. Do we even have editors anymore?

Re:Was there a point to this?

[0123456]

it's hardly an OS problem if some wanker has written a nasty driver then signed it with a legit cert

I somewhat disagree: it clearly shows the flaws in an either/or trust model of that kind. Either it's signed and it's trusted to do anything at all to your system or it's not trusted to do anything at all... you only need one rogue signing key to break that model.

Re:Was there a point to this?

[TheRaven64]

Do you propose a better model? How about the Linux model, where if the user decides to load it then it can do absolutely anything with the system? Of course, it would be great to be able to run drivers in unprivileged mode, but until we have an IOMMU in every system that won't actually buy any security (a malicious driver can just tell the device to DMA random data from anywhere in physical memory to the device and then back to the driver's address space, or data from the driver's address space into another process's).

Re:goodie the certificate is revoked!!

[butlerm]

In this case, I think the question is whether Windows checks the certificate revocation lists. It is a code signature, nothing to do with the browser per se.

Working as intended?

[goodmanj]

I'm not Windows expert, but isn't this exactly the way the certificate system is supposed to operate? This sounds like a security success story, not a failure.

Driver needs certificate to work with OS. Driver is found to contain security flaw. Certificate is revoked, OS refuses to recognize driver, security hole is closed. Now driver manufacturer has to clean up their act before their drivers are allowed back in the house.

The headline reads "Microsoft has no plans to patch new flaw", but isn't the certificate revocation at least as good as a patch? More so, because it seals off any *other* undiscovered bugs in the driver? Or am I missing something?

Re:Colatteral Damage?

[xous]

Are you serious? How the fuck did this get modded insightful. Why the hell would this affect products based off a Linux kernel that does not verify any drivers. Secondly who would build a serious firewall on Realtek hardware? They are notoriously problematic and unreliable.

Where did 'no plans to patch' come from?

[mysidia]

The article doesn't say it, and at no time was Microsoft reported as saying there were no plans to patch this bug.

Just because you are unaware of them reporting they will release a patch does not mean they have no plan to patch it.

They have offered workarounds and appear to be treating this seriously.

Just because it's the weekend and they haven't told you there will be a patch available monday DOES NOT mean they are ignoring or refusing to work on patching this.

You just proved his point

[Sycraft-fu]

See to secure against that, to truly secure against it, he'd have to lose all freedom. Children are soft targets, the only way to keep them secure from kidnapping is to have them under guard 24/7. Keep your kids in a locked compound with armed, trusted, guards and they could be secure (though even that could be overcome). If you want them to live a normal life, well there are risks.

So your complete and total paranoia bullshit actually proves the GP's point: Getting too paranoid about security is stupid. In the real world, there's no such thing as perfect security. If you think there is you are lying only to yourself. As such you want to design your security for two things:

1) Good enough to stop the attacks you are likely to face. You don't want to get all crazy and speculate on shit you aren't likely to see. You aren't guarding nuclear secrets, secure your house accordingly. Have it good enough, not stupidly overboard.

2) Relaxed enough you don't screw over your life. Living in a continual state of locked down paranoia and denying yourself everything because of supposed risks is no way to live. You want your security so it doesn't harm your ability to enjoy a normal life.

Also if you are dealing with someone deranged enough to try and stalk you to this degree, they needn't get in your computer to do it. You think you are safe? Not hardly. I hire a competent private investigator, they'll track you down, no breaking in to your computer needed.

You either need to be way less dramatic, get a sense of perspective, or get professional help. Maybe all three.

Re:So no then

[euphemistic]

How about this for what is missing: an attempt to fix a (now very publically known) flaw in a somewhat timely manner.

Re:So no then

[SharpFang]

And that's the essential difference. Linux had many flaws, and all were fixed in a timely manner, acknowledged and corrected. Correcting them might have been a pain in the ass but it was always possible. Which is not the case here. The flaw exists but it's rooted so deeply in the design that removing it without a major overhaul and breaking lots of compatibility is impossible. Insecure is not a system that has flaws, but one that has flaws that can't be fixed within current framework.