Slashdot Mirror
Unencrypted Windows Crash Reports a Blueprint For Attackers
An anonymous reader writes "According to Forbes online, up to 1 billion PCs are at risk of leaking information that could be used as a blueprint for attackers to compromise a network from Microsoft Windows Error Reporting (WER) crash reports that are sent in the clear. Researchers at Websense Labs released a detailed overview of the data contained in the crash reports, shortly after Der Spiegel released documents alleging that nation-state hackers may have used this information to execute highly targeted attacks with a low risk of detection, by crafting attacks specifically for vulnerable applications that are running on the network. Also interesting to think that Microsoft knows exactly what model of phones that you have plugged into your PC..."
If you're really concerned about security on your individual systems, don't send critical system information externally. Otherwise the vulnerable applications were already vulnerable before and after sending, and if your messages are being intercepted, you've got bigger security issues already.
I should consider making a list of obvious things that will prove to be security risks in the future for everyone to be aware of it. This was so expected.
breaking news:
- the NSA tampers with scripts hosted on googleapis.com. 90% of the internet impacted.
At least with the gifted nose i have for smelling crap i must say none of the Snowden's revelations made me bat an eye or change any passwords.
Also interesting to think that Microsoft knows exactly what model of phones that you have plugged into your PC..."
Wait, you mean my crash reports include a list of devices?!?
The horror.
Who actually lets Windows submit these?
Also, if you don't trust your ISP not to snoop these, you shouldn't trust them not to snoop your real traffic too.
I want to delete my account but Slashdot doesn't allow it.
...instead of fixing their slow and buggy web filtering software. (Ducks.)
True, now if we could just bread that trait out of politicians we'd be set!
Anyone who can access technical support resources can access customer data. The biggest issue is that most technical support is outsourced to other countries, which now have full technical (hardware+software version, etc.) and customer information (good for social engineering).
Disabled on every machine I own, every machine I've deployed, every machine that I've been given the permission to manage.
Not because I think someone might be able to sniff them and then use them against my workplaces / PC's. Purely because they are WORTHLESS.
Reporting them, you see nothing back. All those people who get error reports upon upgrading to a duff hotfix, it takes someone to whinge to Microsoft to get it fixed. Millions of crash reports aren't acted up, from what I see. I doubt anyone reads them.
When offered to software developers, etc., I'm always told that it's easier to just get me to run a debug version rather than piss about with any built-in error reporting / dumping possible from the Microsoft tools. It gives them more information, they can debug it live, and I don't have to worry about information going back and forth.
Pretty much every time I've had one, it's been ignored, by Microsoft, developers, or myself. I learned a long time ago that debugging from any default dump or crash report - even for huge multinational companies that are trying to help solve your problem - is worthless. It's just not worth the effort.
Hence I've disabled them since day one. Not only do they not do anything useful, they don't tell me anything useful, they want to connect to the Internet (which can trigger my software firewall for a completely different process to those authorised applications I already allow through, assuming the machine is even online), and they actually make the error messages HARDER to read for my users. I disabled it entirely. "There was an error" and a hard crash is infinitely better than my users trying to debug a crashed application themselves or sending off dumps because the button says to do it, and still getting a hard crash. Hell, if the crash was because the network cable fell out (which apps will if they are based on a network share sometimes), the submission process triggers a DNS lookup which hangs the PC for 30+ seconds sometimes.
Worthless. Disabled.
Is a buzz word, if not done with the correct protocol.. helps with a sales pitch, one less place to visit at RSA
This is absolutely brilliant: Looking at windows crash reports. Just think how much data there is.
Even if only 5% of users actually send those reports, it's still the mother lode
it WAS intended to reflect ours?
Having looked at what data is actually sent, I don't see how this helps an attacker unless the system in question is already vulnerable. TFA lists some data (not entirely complete, e.g. the IP address is missing, but you get the point):
Date
USB Device Manufacturer
USB Device Identifier
USB Device Revision
Host computer - default language
Host computer - Operating system, service pack and update version
Host computer - Manufacturer, model and name
Host computer - Bios version and unique machine identifier
In all honesty, to me it looks as if websense is advocating security by obscurity here.
Isn't corporate spying and selling off individual customers condoned... er... encouraged at this point? I think the federal government is about 1 step away from banning encryption all together. Don't say they can't do it... if you speak of a VPN (even work related) you should be turned into your local police as a terrorist according to the FBI.
On one hand, it would be rather straightforward for Microsoft to push a patch to use encryption for these reports. On the other hand, now you are running closed source software that sends a bunch of data to Microsoft -- data that you can not inspect. When it is sent in the clear, at least you could sniff your traffic and see what Microsoft is getting. So with encrypted crash reports, you need to trust Microsoft more than now.
MS Word crashed? Better send the docx file that caused the crash as well, it's not like the user(s) can call Microsoft out for it with encryption.
Disable Windows Crash reporting. Problem solved.
We also need to 'breed' out the trait of illiteracy and stupidity which seems rampant in the idiots with 7 digit user IDs around here.
I'll admit to being surprised by this. I assumed Microsoft had the common sense to encrypt error reports especially given they contain at least partial contents of applications internal memory and would therefore assumed to be considered sensitive. The dialogues asking you to send certainly make this posture clear.
In fact when I first read this the other day I was a bit confused as to how they (NSA) were getting this data...from Microsoft servers? It didn't even enter my mind these things were sent unencrypted and trivially pulled off the wire.
While we normally have WER and associated scheduler task entries disabled there are still some machines we send the reports in the off-chance bugs get fixed...not anymore...sad.. inexcusable...
This completes creates quite an interesting feedback loop imagine using QUANTUMINSERT to load malware or trigger crashes... if there is a problem or your not sure about the memory environment sit back and wait for the error report.
What? You don't sit on the steps of the Capital feeding the congress critters bits of stale bread in the afternoon?
As you can see, within seconds of connecting the new USB device to the computer, a report is sent to watson.microsoft.com in HTTP (clear text). This report includes a considerable amount of information that is URL encoded into the request. This information includes:
Every time you plug in a device to USB port, a di-ding bell sounds. It is of utmost importance to Microsoft to know a bell has rung, so that it can promote an angel second class to angel first class with wings.
See? There is an innocent explanation for it after all.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
The Forget My Password feature many sites offer if intercepted is just as dangerous for the user. The issue isn't MS here, it's the nature of our current open infrastructure. Although I'm sure there is a solution I don't know what it is and how easy it is deployed to secure all transmissions, not just Microsoft's .
As you can see, within seconds of connecting the new USB device to the computer, a report is sent to watson.microsoft.com in HTTP (clear text). This report includes a considerable amount of information that is URL encoded into the request. This information includes:
Every time you plug in a device to USB port, a di-ding bell sounds. It is of utmost importance to Microsoft to know a bell has rung, so that it can promote an angel second class to angel first class with wings.
See? There is an innocent explanation for it after all.
When an angel gets his wings, a Venture Capital firm gets demoted...
What? You don't sit on the steps of the Capital feeding the congress critters bits of stale bread in the afternoon?
Bread them, dip them in egg yolk, fry until crispy.
A lovely alternative to tar and feathers.
Just FYI, there are two ways to avoid leaking information via the Crash Reports.
The first is to click "cancel" when it asks if you want to send it. (yes, difficult task for some)
The other is to go into your computer management and simply shut off the crash reporting service entirely.
Are you suggesting Catherine the Great was a Windows user?
Anyone who uses closed source has forfeitted security. there is no but. none. anyone who claims that has no idea what theya re talking about.
Really?
First thing to realize: on the software level, there is NO SUCH THING as closed source. If your computer can read it, so can you. It's just rather obfuscated, and not in the form that the original author wrote it in.
But as complexity increases, having access to the source doesn't guarantee that the software operator is any more secure; it's trivially easy to insert the right insecurities into a complex system such that each one, by itself (see = vs ==) looks like a trivial bug, but together, they make a nice remote exploit.
And then, of course, you have to drill down. Do you know how all your hardware works (really know, not just understand theoretically how your specific chip types work)? Do you know exactly what information it leaks via networking, radiation and vibration? If you don't, you can't really vouch for the security of your system as a whole.
If you have any honor, either as an individual or a company, you will now encrypt the bloody things. Setting aside your a-hole buddies in the NSA, the other bad guys are exploiting these plain-text treasure troves as well, FFS.
If present Guess what I know.
Another downmod of your post proves your point.