New Windows XP Zero-Day Under Attack
wiredmikey writes "A new Windows kernel zero-day vulnerability is being exploited in targeted attacks against Windows XP users. Microsoft confirmed the issue and published a security advisory to acknowledge the flaw after anti-malware vendor FireEye warned that the Windows bug is being used in conjunction with an Adobe Reader exploit to infect Windows machines with malware. Microsoft described the issue as an elevation of privilege vulnerability that allows an attacker to run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full administrative rights."
Adobe Reader - problem solved
Hmm, a bug that gets admin rights.... If I were sufficiently evil I would have saved this until April when there's no chance of it being patched ever.
Windows 8.x best Marketing tools, XP EOL and new exploits.
Of course it has the side effect of delivering some to Apple, Google, Linux and BSD as well. Not to mention the largest effect being to increases in technical jobs related to the switchovers for all that software and hardware.
Too bad Windows XP won't be supported much longer. Once that happens, it would be a...shame if something were to happen to that PC. If you upgrade to Windows 8, Microsoft will surely protect you.
Never have an adobe product installed in the first place - solved.
So other than Flash or Edge Animate, what's a good program for creating vector animations?
You have a hilariously mistaken idea of how copyrights work.
Oh, I see, a ramping-up of press releases about 'exploits' against XP prior to the cut-off date.
Didn't see that coming.
All your ghosts are just false positives.
Per TFA, this exploit is dumb and unconcerning. It just lets a standard user perform admin operations, no remote exploit of any kind. There have always been many ways for a standard user to get admin on any OS, the most trivial being physical access.
A lot of companies own multi-thousand-dollar PC peripherals with no NT 6 (Windows Vista/7/8) driver, and the peripheral's manufacturer has either gone out of business or deliberately chosen not to make new drivers for old but still working hardware. When companies have to re-buy expensive peripherals, the manufacturer makes more money.
so all you need to due is use this to install that remote exploit app.
How many bugs are in Windows XP? You don't know, no one knows. Someone needs to do work to figure that out. Some geek needs to spend time to figure out the attack surface and see what breaks. How do you fix it? A harder question, how do you fix it without causing more problems? I've got nearly 15 years of code and machines that support XP. If you don't test, and this breaks, i'm going to be angry at Microsoft. Oh, and this is a Zero day. So I need to be FAST and RIGHT. That doesn't come cheap.
Are you going to pay for that? Are you going to pay for the geeks to fix the holes? If they don't get money, they can get money by selling these exploits to others. Are you going to pay for the matrix of testing? Think of the millions of different PCs there are. Any code change costs hundreds of thousands of dollars to test. You don't get that for free.
A bug by definition is a problem. If you admit there are bugs, you are, in effect, admitting that the OS does not work fine. You just have expectations that they will be fixed before they bite you. Either that, or maybe there's some acceptable level of infestation you're good with on your computer. That may be fine, but don't expect all other users to have the same level of comfort with it.
I don't get that last comment. If you have an old car, and the engine wears out after 10 years, you don't get the money back from GM. You either pay for the repair, or you ride the bus.
wipe windows and install Linux on the machine.
by TheSpoom (715771) Uncaring Linux user here. I have nothing to add to this but please continue. *munches popcorn*
Man, I guess they were testing or something, but for a while, "slashdot.org" was redirecting to "beta.slashdot.org". All I could really make out was this "New Windows XP Zero-Day Under Attack" Headline and thought that something was wrong with either my PC or the site.
But maan that new layout sucks balls. I hope they don't go through with it.
Politics; n. : A religion whereby man is god.
Export
Export from what, if not Flash?
to video
I tried that. The encoded video was 10 times bigger than the SWF, which counts against the viewer's monthly download cap, and had no means for interactivity.
Truly remote exploits are getting rarer and rarer. These days it usually takes two (or more) exploits, an exploit to become a local user, and a permission escalation exploit to become admin.
"First they came for the slanderers and i said nothing."
Has anyone else considered that M$, in their desire to get all the XP users to buy a new version of Windows, may continue the illegal and immoral tactics they started with oh so many years ago? I remember when they encrypted the part of Windows that caused false message to disparage competing software. It wouldn't surprise me in the slightest if they expose (or even plant) some exploits and then release them to the wild after they drop support, and follow it up by more relentless FUD. They are, in my opinion, an evil company.
I don't know if you're joking, I suspect you are, but for the benefit of the following readers I'll explain.
Here's how it works. User is tricked into accessing an infected pdf which contains code to elevate the user's privileges. the infected document's code downloads further exploits to root-kit the box. Right now the exploit is in a pdf, but infected websites are sure to follow.
If it's out there, and it has a picture of a puppy (or, in the USA, the word "free"), some user will click on it.
If you read the TFA, then you know it also is a Server 2003 bug as well.
Privilege elevation exploits are a nightmare for Terminal Server and Citrix boxes because it is a conduit for installing tools (using the admin rights) to grab other users' credentials and to continue from there to own the entire environment.
Did the submitter RTFA, or just submit as soon as (s)he saw the words "XP exploit" somewhere?
It's not mentioned, in the Slashdot article, but it's also a Server 2003 bug.
https://technet.microsoft.com/en-us/security/advisory/2914486
This means Server 2003 Terminal Servers and Citrix boxes.
So games are your argument. For one thing, an Eee PC has the Intel "Graphics My Ass" integrated GPU that isn't really intended for heavyweight 3D gaming, and Wine runs a lot of the 2D games. For another, Wine isn't needed for any game that is ported to Linux, and once the Steambox One ships next year, video game publishers that want money will commission Linux ports.
If you already have the ability to access a user account on a target machine, it has always been trivial to get root if that is the goal. ALWAYS. Even moreso with Windows. You glossed over "the infected document's code downloads further exploits", but that would actually be the exploit that matters. This is not that. Also if you've got regular users in your physical environment that are determined to hack permissions then you're screwed anyway.
What are you talking about? This exploit doesn't force any code to run, it *allows* a user, of their own intention, to get root. If you've got a user who's willing to install anything you want then the system is already screwed.
No, it is not trivial to go from a non-root user to a root user, at least in a properly secured system. That requires local root exploits such as these. This is the whole basis for running daemons as non-privileged users. Even if Apache has an exploit, if it's running as a dedicated, non-privileged user, you can't get root on the system.
Local root exploits are serious, though obviously not as serious as a remote remote exploit. It's also true that they are usually easy to come by on unpatched systems. But your claim that it's trivial to go from a non-privileged user to a privileged one is incorrect.
Your ideas about security are wrong, and you are missing the first rule of holes: when you find yourself in one, stop digging.
It's not like bugs are unheard of and are impossible to fix in software.
The OS still works fine.
The reason Vista was such a huge rewrite is because Windows XP's codebase is such a pile of spaghetti and outdated kludges/workarounds/and digital duct tape. Want to install it from a USB stick? Not without a third party app. Want to install raid drivers during initial setup? Hope you still have a floppy drive or nLite.
Microsoft needs to decide whether they are going to let XP go public domain, as per contract on copyright, or to continue to support it.
Unless you've been living under a rock for the past year or more, they HAVE decided what they're doing with it. On April 8, 2014, the update and activation servers are going dark. That's it. Game over. The End. They're NOT releasing a patch to disable activation and they're NOT releasing another service pack or update pack. You won't be able to do a fresh install without cracking the activation and you won't be able to get the 150 or so updates since SP3 without using a third party update pack. Do not pass GO, do not collect $200.
I doubt we'll go through the same thing with people hanging on to Vista for dear life on April 11, 2017 but I can already hear the same whining for Win 7 on January 14, 2020.
Unless you've been living under a rock for the past year or more, they HAVE decided what they're doing with it. On April 8, 2014, the update and activation servers are going dark. That's it. Game over. The End. They're NOT releasing a patch to disable activation and they're NOT releasing another service pack or update pack. You won't be able to do a fresh install without cracking the activation and you won't be able to get the 150 or so updates since SP3 without using a third party update pack. Do not pass GO, do not collect $200.
I doubt we'll go through the same thing with people hanging on to Vista for dear life on April 11, 2017 but I can already hear the same whining for Win 7 on January 14, 2020.
I have heard nothing indicating that they are planning on shutting down activation servers. This (recent) article agrees http://www.windowsobserver.com/2013/09/17/will-microsoft-turn-off-the-windows-xp-activations-servers-after-official-support-ends-in-april-2014/
After XP End Of Support, Windows XP will remain on MSDN and TechNet for customers who still need to activate and re-activate XP (there aren’t new retail copies). We don’t have a date to share around when activation will be shut off, but it will be on for the foreseeable future.
As a precedent, Microsoft released a "sunset" version of Money Plus when they shut down activation servers for it. Adobe did similar for CS2.
http://www.microsoft.com/en-ca/download/details.aspx?id=20738
When usage rates drop below 1-5% they'd probably consider sunsetting activation. Right now XP has between 10-25%.
You will be able to get all updates to date, but they won't release new ones. As a precedent, last time I tried you could update Windows 98 to July 2006 state (when support for Windows 98 was stopped).
Can't fix the backdoors the NSA is still using.
You know what you never see on your Nexus 7? Flash. Well....unless you don't upgrade to Kitkat, track down the apk and install it manually.
What changed in 4.4, other than Android Browser dropping plug-in support? Nexus 7 never had Android Browser anyway, and I was under the impression that Dolphin and Firefox still supported Flash Player as long as the apk was installed. I don't have my Nexus 7 with me right now to test though.
In spirit? Phones and mobile, produced using multi-platform game engines.
So how should hobbyist game development continue in the era of requiring a particular desktop platform $99 per platform per year store fees (source: Apple and Microsoft web sites)? You need a Mac, an iPod touch, and a $99 per year subscription to develop for iOS; you need a Windows PC, a Windows Phone device, and a 24-month service contract (there's no Windows Pod touch) to develop for Windows Phone.
Linux Mint. 3 problems...maybe more... solved.
Ever notice how all this malware tries to run in kernel mode? Seems to me that if installing software were password protected it would fix this; Not the type that pops up a window that most people tend to ignore and just click it to get off the screen as fast as possible. People won't like being forced to put in their password to install that latest game, though.
Just update Reader to the latest build & keep using XP, problem solved, according to the article.
I see this as MS scare tactics to get people to update from XP, XP is bad, XP must not be used.
Last month I started getting hit by none Genuine Win7 alerts, then I lost my Internet, yet everything was fine.
I'd load Mint and had Internet access. Install another Win7 and the same thing, My IP is marked.
Not sure what gave me away, a new ASUS modem, Google being my DNS or Comodo which downloaded a ton of stuff
before I noticed and put a halt to it; or any number of MS collaborators.
This is just a BS item, proper hex and your ok. Hirens boot cd with MiniXP is now public domain MS has given up on XP.