Microsoft Kills Windows Gadgets Via Security Update

← Back to Stories (view on slashdot.org)

Microsoft Kills Windows Gadgets Via Security Update

Posted by timothy on Thursday July 12, 2012 @05:00AM from the cutting-losses dept.

benfrog writes "Microsoft has taken the unusual step of killing the Windows Gadgets feature completely via a security update. According to an advisory issued Tuesday, an attacker could take over a user's system if they are logged in as admin and they install a vulnerable gadget. Microsoft has pulled the plug on its official Gadgets Gallery and is offering a Fix-it that completely disables the Windows Sidebar and Gadgets. Researchers Mickey Shkatov and Toby Kohlenberg are scheduled to give a presentation on the vulnerability at the upcoming Black Hat conference called We Have You By the Gadgets."

15 of 161 comments (clear)

Min score:

Reason:

Sort:

Misinformed Title by Mike+Wag · 2012-07-12 05:00 · Score: 5, Informative

Slashdot's title gives the idea that Microsoft is using Windows Update to disable gadgets while in fact they are not. The article, however, is correct so this is just Slashdot trying to be sensationalist.

What Microsoft is giving is 'Fix It' executable on their website. These are entirely optional and are proactively downloaded and enabled by users. They also contain the full info of what they do.

As for the "vulnerability", well, duh. You download executable code, you might get pwnd. Even Chrome warns you that addons can pwn your system.
1. Re:Misinformed Title by Sc4Freak · 2012-07-12 05:21 · Score: 5, Informative
  
  This is a fix-it update, which doesn't appear through windows update and isn't pushed out through WSUS...
2. Re:Misinformed Title by Dog-Cow · 2012-07-12 05:59 · Score: 5, Insightful
  
  And even if it was, it wouldn't matter. IT departments that push patches indiscriminately deserve any negative feedback they get.
3. Re:Misinformed Title by rodrigoandrade · 2012-07-12 06:55 · Score: 4, Funny
  
  I won't send the to Hell
  
  Please do; I'm afraid I'll not be able to kill Diablo on my own this time.
4. Re:Misinformed Title by racermd · 2012-07-12 07:07 · Score: 4, Insightful
  
  As a former enterprise-grade desktop support staffer (i.e.: one level up from the front-line call-takers), I know there have always been ways to disable the Windows Gadget platform. If not through GPO, at least through most other alternative rights-management schemes. Ultimately, it's as simple as removing the sidebar.exe file from the Program Files folder(s). Alternatively, an anti-malware utility (that's centrally managed, right?) can prevent the executable from starting.
  This should not be news to any company large enough to have a (competent) IT staff. Anything that runs applets or other code locally is potentially vulnerable. Disabling the platform entirely is one of the most effective ways of preventing this sort of vulnerability from being any sort of problem on a large-ish network. As such, assuming they're competent, they've already disabled or restricted this functionality long before a formal vulnerability existed.
  And, like you said, what IS sorta newsworthy is the subtext - that Microsoft is choosing to eliminate the Gadget platform altogether rather than patch it appropriately. Heading into Windows 8, I'm betting they didn't want to expend the resources necessary to do a proper repair job and, instead, focus developer time on Windows 8, Windows Server 2012, and optimizations on their new tablet platform.
  
  --
  My sources are unreliable, but their information is fascinating. -- Ashleigh Brilliant
5. Re:Misinformed Title by hairyfeet · 2012-07-12 07:33 · Score: 5, Insightful
  
  This is something I have been wanting to ask for awhile, seriously, WTF does ANYBODY CARE about these so called "shills" anyway? I mean seriously the real shills are so damned easy to spot they may as well be the PHB on Dilbert, they use the same "buzzword bingo" that the corps just looooove to see in print, like "synergy" and "vertical integration" and "user experience' that nobody IRL uses, and if their point is bullshit? Well its not hard to spot actual bullshit and it gets modded down quick enough.
  In the meanwhile all this "ZOMFG It a shill ZOMFG!" creates total paranoia and has the unstable seeing shill EVERYWHERE, I mean anybody that has read my history knows I'm just a little shop owner in the middle of bum fuck nowhere but so far I've been told I'm not actually in a little college town in the middle of AR, nope I'm hidden in a sekret bunker under Redmond, which I actually thought would be a hell of a lot more cool and interesting than my boring shop, oh and I'm also sub contracted to Comodo, AMD, Apple (Still haven't figured THAT one out, I don't even own an iPod), Asus, Gigabyte, and Asrock. I just wish someone would tell me where the sekret Swiss bank account is with all that money from subcontracting as I'd like a new truck, thanks.
  As for TFA I smell bullshit. Are you seriously telling me that MSFT can't even keep their own fucking website safe? Seriously? they got all those people working there, they can't even scan the fucking executables put on their own damned website? What are they running it on, a badly done FB page?
  Considering the fact I've NEVER seen anyone ever get a gadget at ANY site other than MSFT's, and that when you clicked on "get more gadgets online" it took you straight to their page i have to conclude that they simply want gadgets gone because it offers the same tweeting twitting FB shitting social crap that MSFT is pushing for Win 8. I've said it before and I'll say it again...watch out! I have NO doubt that between now and the release of Win 8 that MSFT will push more "security updates" that will be designed to cripple Win 7, because they are scared to death Win 8 is gonna be WinME the second coming.
  So triple check every damned update that comes out between now and then, and be sure to have disc images handy, because Ballmer and Sinofsky isn't gonna do anything that would allow Win 8 to flop and the simple fact is unless you have a touchscreen Win 7 will do anything you want. But if a security update were to...ohh I don't know....say kill 30%+ of performance, or take the decent features away, for 'security reasons" of course, why folks might be more likely to buy Windows 8! The fact that MSFT is offering Win 8 pro upgrades on their website for $40 tells me they are running scared, hell they have NEVER offered pro for anywhere near that cheap, so frankly every single thing they say or do between now and then i would look at as suspect. MSFT is on the ropes, stuck in a niche that is flatline and will never be #1 again, and when backed into a corner as we have seen in the past MSFT can be pretty nasty. Just something to think about.
  
  --
  ACs don't waste your time replying, your posts are never seen by me.
6. Re:Misinformed Title by fatphil · 2012-07-12 10:09 · Score: 4, Insightful
  
  The problem is that there's a flip-side. IT departments who don't push vital patches in time will get negative feedback for delaying.
  
  --
  Also FatPhil on SoylentNews, id 863
7. Re:Misinformed Title by mister_playboy · 2012-07-12 15:02 · Score: 4, Informative
  
  You like to complain about others making hyperbolic posts, yet every single post you make is an exaggerated bluster-filled rant.
  Your endless faux outrage is fucking boring. Get a new gimmick and maybe I'll consider reading your comments again.
  
  --
  Do what thou wilt shall be the whole of the Law ::: Love is the law, love under will
Wrong summary by Jennifer+Wag · 2012-07-12 05:01 · Score: 5, Informative

Microsoft Windows Update does not remove Windows Gadgets. To remove Windows Gadgets, you need to proceed to Microsoft website and download a Fix-It that can be then used to disable Windows Gadgets on your computer.
What? by trifish · 2012-07-12 05:03 · Score: 5, Insightful

An attacker could take over a user's system if they are logged in as admin and they install a vulnerable gadget.
I always thought that if an attacker is logged in as admin, he owns the system already.
Why do they talk about a specific attack? There are zillions of them if you have admin rights.
Re:Uh by Dynamoo · 2012-07-12 05:06 · Score: 4, Informative

The same goes for installing ANY application. This is a stupid knee-jerk reaction.

--
Never email donotemail@WeAreSpammers.com
Dr. Claw's response by Megane · 2012-07-12 05:09 · Score: 5, Funny

"I got you this time, Gadgets!"

--
#naabhaprzrag, #sverubfr-000, #agi-fcbafberq, negvpyr[pynff*=' negvpyr-ary-'] { qvfcynl: abar !vzcbegnag; }
Re:Uh by CowTipperGore · 2012-07-12 05:31 · Score: 4, Funny

Oh that's a rich. A Microsoft troll account accusing Google of smearing Microsoft. Good stuff!
Re:Sigh by the+eric+conspiracy · 2012-07-12 05:43 · Score: 5, Funny

> But then thats MS in 2012. Remove and restrict features, charge you for what was free before, and generally be a fucking bunch of dicks.
As Steve Ballmer said, we are not going to let Apple have any market unchallenged.
Re:Uh by Marc+Madness · 2012-07-12 05:43 · Score: 4, Informative

The featured article explains with a much less confusing use of pronouns:

"An attacker who successfully exploited a Gadget vulnerability could run arbitrary code in the context of the current user," company officials said in an advisory issued Tuesday. "If the current user is logged on with administrative user rights, an attacker could take complete control of the affected system."