Slashdot Mirror
Security Firm VUPEN Claims To Have Hacked Windows 8 and IE10
An anonymous reader writes "Windows 8 was released late last week, and already this week French security firm VUPEN says it has broken Microsoft's latest and greatest security features. The company claims it has developed a 0-day exploit for Windows 8 and IE10, by chaining multiple undisclosed flaws together."
have fun hacking a OS that few want to run
Yep, it's bad news for the those 10 people that use it...
Be seeing you...
I thought that little used operating systems were less vulnerable because fewer hackers would target them compared to popular, mass market operating systems such as Linux and MacOS.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
Its a pretty common quote, basically its about the unloved and unwanted Vista
http://www.microsoft.com/en-us/news/exec/steve/2008/10-12AdDay.aspx
"STEVE BALLMER: Vista is our best selling product ever. So, if that takes too much getting over -- we're not going to have products that are much more successful than Vista has been. We sold over 180 million copies in the first 18 months, quite successful."
I wonder if their hack could be used on Windows RT to gain low-level access to the system, allowing one to essentially jailbreak the thing and let one side-load apps on it. I'm not planning to buy a Windows RT - tablet and one of the reasons is exactly the fact that I am only allowed to install stuff from Windows Store; a fully-working jailbreak would atleast make the thing slightly more useful.
Does this affect one or both of the flavors of 8?
On the bright side, your typical hacker won’t be able to figure this one out either: Windows 8 raises the security bar even higher than before, and if it was easy, someone would have beaten VUPEN to it long ago.
And who thinks that other hackers won't figure this out?
captcha: untried
Open a command prompt as administrator and type
del /F /S c:\*.*
1. They bought Windows 8. 2. They Installed Windows 8. 3. They connected Windows 8 to the internet. 4. They surfed goatse with IE10.
Considering that W8 still has that new OS smell, this is hardly surprising. Like any piece of software, it will take a while before it is provably secure. Microsoft may not have the worst QA department in the world, but it the only way to really put it through its paces is to let the world bang on it like it is now.
The real question is, how many 0-days haven't been announced?
What's the value of information that you don't know?
Is what it must be like for malware authors when Microsoft releases a new OS.
"If any question why we died, Tell them because our fathers lied."
Security generally advances through evolution, not revolution.After making significant advances in security from 3.1 to XP, Microsoft is all out of evolution and so they're just throwing in random shiny (and they've even run out of the semi-good stock of that).
So new code just for the sake of it and is it any wonder bugs come along with it?
...Microsoft is able to warn both users in time.
it took *that* long to get exploited?
... NOT. All the fuss about zero day exploits and the only people who ever use them are the ones who find them and the engineers who plug the holes. No big take-down of masses of people, no crippled companies, no nothing.
Well, it's more than 01, less than 11, and still only a 2-bit binary integer.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
Well, it had one big selling point.
It had "up^Wdowngrade to XP" option when XP was no longer available to buy.
Let's see, IE can't even load pages properly over a slower connection.
IE7: Jumps to Page Cannot Be Displayed error page.
IE8: See IE7, they never fixed the bug.
IE9: Throws error 408 and error 409 errors in place of the generic Page Cannot Be Displayed. Two browser versions later, they still didn't fix the bug. Rolled back to IE7 since at least it has a progress bar during page loading. (Idiots at Microsoft did away with it in IE9, just watch the circle spinning for however short or long.)
IE10: I don't run Windows 7 nor Windows 8. Don't care to. Don't care about IE10. Microsoft lost me as a customer beyond Vista 64-bit SP2.
Anyway, it doesn't surprise me that IE10 might still be a bug ridden POS with a few security holes.
I guess plenty of Slashdot discussions still revolve around the "reputations" these two OS types established at the start of the millenium. It's nice for a joke or two, or for some clueless fanboy to rant about. But the latest Windows and Linux releases are roughly at the same level of in/security and difficulty/ease of use, bar things like misbehaving user pograms and unsupported hardware. The moral here maybe that if you're starting a new software product you have to put equal attention into these two things.
Up to, but not including, 10. Reads like an old Sun Microsystems license agreement, doesn't it? I remember their legalese included the phrase "up to, but not including, 2 processors" on a Solaris 9 agreement. :)
It's the Stay-Puft Marshmallow Man.
The sad thing is they think anyone actually cares.
Informative dick-click: your penisbird will get blue, if you put too much rubber on it. By formality of progress, you get distracted. However we can plainly state that just "doing something" would be a lot slower.
Doing something beyond the scope of BSD is fundamental to the project again. That is the definition of giving to other people.
Even though I lack any surprise in this announcement, and would actually have been surprised if no 0-day had arisen within the first week after release, please kindly allow me to express, and excuse if it may sound a little childish, my first reaction:
lol
IE8: See IE7, they never fixed the bug.
What bug, specifically, is this? Or have you just screwed up your IE and you're intent on blaming it on Microsoft?
systemd is Roko's Basilisk.
How do you screw up a browser unless you're changing it's code?
You're a temporary arrangement of matter sliding towards oblivion in a cold, uncaring universe
I am a Linux user because of this exchange:
Me to tech department: "Hi, I need to setup a FTP server with anonymous access only for people to download our companies installer who have problems getting it through http"
BSD user: FTP is insecure because password are plain text.
LInux user: You can run proftp for a simple open ftp with just one directory in a chroot jail so it is perfectly safe and accessible.
Basic openbsd is plain useless and out of date, start updating and adding stuff you need, and they stop counting security holes. If openbsd was a car, it would be the safest car in the world. It would also never ever have moved out of the garage.
In the real world you need to trade security for functionality. Let BSD guy loose on your systems and nobody can hack into them, and neither can anyone use them. You get the perfectly secure system and all your developers and users leave you because the system is unusable. The BSD admin will not only insist on 20 character passwords that are a mix of characters, numbers, symbols and arcane spells but insist usernames follow a similar pattern. And for mobile access as well. 4 digit unlock on company phone? NOOOO! INSECURE!!!! 12 char password atleast and mix of caps, characters, reading symbols and dna sample!
And then they wonder why everyone spends all their time working around the system. Was so bad in one company that all work was getting done on laptops over mobile connections because getting things done through channels just took to fucking long.
Next BSD release will be called concrete, you poor concrete over your computer and it will be very secure!
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
It took me nearly a day to get a "Active Directory Users and Computers" icon on my Windows 8 Pro VM.
- First I have to download RSAT.
- It errors with random hex-code when run.
- Much googling (and no help in the MS KB) later, I find out it doesn't like being on a mapped shared drive (which is what VMWare uses for it's shared drive with the host).
- Copy to C:\, run it.
- It installs without error, but nothing happens after (nothing in Windows Features related to remote admin tools, no new icons).
- Much googling (and no help in the MS KB) later, it turns out I don't have the en_US language installed and it won't work without it (despite the computer being en_GB!) but will just die silently.
- Go to install language, get empty language lists.
- Think they must be on the CD, so point it at the original CD image. Nope. Nothing useful.
- Much googling (and no help in the MS KB) later, it turns out that because I'd disabled Windows Search, it totally stops the list of languages populating.
- Enabled Windows Search.
- Installed language.
- Still no joy.
- Much googling (and no help in the MS KB) later, it turns out that because I have disabled Automatic Updates, it won't actually download the language pack (or error, or tell you that, or anything).
- Re-enabled, got the language pack (150Mb!)
- Reinstalled the MSU
- Finally get "Users and Computers".
It doesn't shock me that in that mess of code there might be a security feature or two that's lax. I mean, seriously? Half the things had no error code or even message to say they weren't going to work or why and those that did provided zero useful information.
- You can't install an MSU from a network-mapped drive (even if it appears as a mapped drive Z:!)
- You can't install RSAT with only en_GB enabled.
- You can't even see the languages available without Windows Search enabled (WTF?)
- You can't install a language without Automatic Updates enabled (Again, WTF?)
- You have to know all this to get Users & Computers working (which, if I remember rightly, is installed by default on most "Pro" versions of Windows or at worst was an Add/Remove Windows Feature kind of deal from the initial install disk).
I'm not surprised, with that amount of cross-interaction between COMPLETELY unrelated components, complete lack of user feedback, and random interactions, that there's a few security problems cropping up.
And that's not even the worst experience I've had with a clean Windows 8 VM image from an official Windows 8 ISO with a proper Windows 8 Pro Product Key. I actually managed to BSOD the VM within hours of install, not by even doing anything remotely interesting.
by installing stupid toolbars and other things like BHOs
Security holes! In Windows!
It's just like every other release from Microsoft then, bug ridden and insecure.
..then we condition you to use the Linux kernel. It will be the "Windows Window Manager".
Screwing around with the registry. The wrong registry entry in the right place will cause any program to go "boom".
Free Martian Whores!
A Burger-Jerk ? There are lots of American and other nation's companies who do the same. Remember the HB Gary sleazebags ? They had one competent guy on payroll and he had Windows and VMWare zero-days "on sale". They tried to peddle it to USG. Figure how they got four Windows ZDs for Stuxnet...
Windows will never, ever be "provable secure". The only OS I know of that could be said of somehow "proven secure" is L4. Everybody else is "hope and pray".
..so fuck security. Welcome to be World Of Business !
..and they had VMWare exploits in case you wanted to pull a condom around Windows to feel more secure. It contracted with USG and was run by a former US Navy officer. Porks stinks everywhere.