Slashdot Mirror
Unencrypted Windows Crash Reports a Blueprint For Attackers
An anonymous reader writes "According to Forbes online, up to 1 billion PCs are at risk of leaking information that could be used as a blueprint for attackers to compromise a network from Microsoft Windows Error Reporting (WER) crash reports that are sent in the clear. Researchers at Websense Labs released a detailed overview of the data contained in the crash reports, shortly after Der Spiegel released documents alleging that nation-state hackers may have used this information to execute highly targeted attacks with a low risk of detection, by crafting attacks specifically for vulnerable applications that are running on the network. Also interesting to think that Microsoft knows exactly what model of phones that you have plugged into your PC..."
This is your god, and will tell the truth about Slashdot, the worst site on the internet.
If you're really concerned about security on your individual systems, don't send critical system information externally. Otherwise the vulnerable applications were already vulnerable before and after sending, and if your messages are being intercepted, you've got bigger security issues already.
I should consider making a list of obvious things that will prove to be security risks in the future for everyone to be aware of it. This was so expected.
breaking news:
- the NSA tampers with scripts hosted on googleapis.com. 90% of the internet impacted.
At least with the gifted nose i have for smelling crap i must say none of the Snowden's revelations made me bat an eye or change any passwords.
Also interesting to think that Microsoft knows exactly what model of phones that you have plugged into your PC..."
Wait, you mean my crash reports include a list of devices?!?
The horror.
Who actually lets Windows submit these?
Also, if you don't trust your ISP not to snoop these, you shouldn't trust them not to snoop your real traffic too.
I want to delete my account but Slashdot doesn't allow it.
...instead of fixing their slow and buggy web filtering software. (Ducks.)
Anyone who can access technical support resources can access customer data. The biggest issue is that most technical support is outsourced to other countries, which now have full technical (hardware+software version, etc.) and customer information (good for social engineering).
Disabled on every machine I own, every machine I've deployed, every machine that I've been given the permission to manage.
Not because I think someone might be able to sniff them and then use them against my workplaces / PC's. Purely because they are WORTHLESS.
Reporting them, you see nothing back. All those people who get error reports upon upgrading to a duff hotfix, it takes someone to whinge to Microsoft to get it fixed. Millions of crash reports aren't acted up, from what I see. I doubt anyone reads them.
When offered to software developers, etc., I'm always told that it's easier to just get me to run a debug version rather than piss about with any built-in error reporting / dumping possible from the Microsoft tools. It gives them more information, they can debug it live, and I don't have to worry about information going back and forth.
Pretty much every time I've had one, it's been ignored, by Microsoft, developers, or myself. I learned a long time ago that debugging from any default dump or crash report - even for huge multinational companies that are trying to help solve your problem - is worthless. It's just not worth the effort.
Hence I've disabled them since day one. Not only do they not do anything useful, they don't tell me anything useful, they want to connect to the Internet (which can trigger my software firewall for a completely different process to those authorised applications I already allow through, assuming the machine is even online), and they actually make the error messages HARDER to read for my users. I disabled it entirely. "There was an error" and a hard crash is infinitely better than my users trying to debug a crashed application themselves or sending off dumps because the button says to do it, and still getting a hard crash. Hell, if the crash was because the network cable fell out (which apps will if they are based on a network share sometimes), the submission process triggers a DNS lookup which hangs the PC for 30+ seconds sometimes.
Worthless. Disabled.
Is a buzz word, if not done with the correct protocol.. helps with a sales pitch, one less place to visit at RSA
This is absolutely brilliant: Looking at windows crash reports. Just think how much data there is.
Even if only 5% of users actually send those reports, it's still the mother lode
it WAS intended to reflect ours?
Having looked at what data is actually sent, I don't see how this helps an attacker unless the system in question is already vulnerable. TFA lists some data (not entirely complete, e.g. the IP address is missing, but you get the point):
Date
USB Device Manufacturer
USB Device Identifier
USB Device Revision
Host computer - default language
Host computer - Operating system, service pack and update version
Host computer - Manufacturer, model and name
Host computer - Bios version and unique machine identifier
In all honesty, to me it looks as if websense is advocating security by obscurity here.
Isn't corporate spying and selling off individual customers condoned... er... encouraged at this point? I think the federal government is about 1 step away from banning encryption all together. Don't say they can't do it... if you speak of a VPN (even work related) you should be turned into your local police as a terrorist according to the FBI.
On one hand, it would be rather straightforward for Microsoft to push a patch to use encryption for these reports. On the other hand, now you are running closed source software that sends a bunch of data to Microsoft -- data that you can not inspect. When it is sent in the clear, at least you could sniff your traffic and see what Microsoft is getting. So with encrypted crash reports, you need to trust Microsoft more than now.
MS Word crashed? Better send the docx file that caused the crash as well, it's not like the user(s) can call Microsoft out for it with encryption.
Disable Windows Crash reporting. Problem solved.
I'll admit to being surprised by this. I assumed Microsoft had the common sense to encrypt error reports especially given they contain at least partial contents of applications internal memory and would therefore assumed to be considered sensitive. The dialogues asking you to send certainly make this posture clear.
In fact when I first read this the other day I was a bit confused as to how they (NSA) were getting this data...from Microsoft servers? It didn't even enter my mind these things were sent unencrypted and trivially pulled off the wire.
While we normally have WER and associated scheduler task entries disabled there are still some machines we send the reports in the off-chance bugs get fixed...not anymore...sad.. inexcusable...
This completes creates quite an interesting feedback loop imagine using QUANTUMINSERT to load malware or trigger crashes... if there is a problem or your not sure about the memory environment sit back and wait for the error report.
As you can see, within seconds of connecting the new USB device to the computer, a report is sent to watson.microsoft.com in HTTP (clear text). This report includes a considerable amount of information that is URL encoded into the request. This information includes:
Every time you plug in a device to USB port, a di-ding bell sounds. It is of utmost importance to Microsoft to know a bell has rung, so that it can promote an angel second class to angel first class with wings.
See? There is an innocent explanation for it after all.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
The Forget My Password feature many sites offer if intercepted is just as dangerous for the user. The issue isn't MS here, it's the nature of our current open infrastructure. Although I'm sure there is a solution I don't know what it is and how easy it is deployed to secure all transmissions, not just Microsoft's .
As you can see, within seconds of connecting the new USB device to the computer, a report is sent to watson.microsoft.com in HTTP (clear text). This report includes a considerable amount of information that is URL encoded into the request. This information includes:
Every time you plug in a device to USB port, a di-ding bell sounds. It is of utmost importance to Microsoft to know a bell has rung, so that it can promote an angel second class to angel first class with wings.
See? There is an innocent explanation for it after all.
When an angel gets his wings, a Venture Capital firm gets demoted...
You CAN security-harden Windows (just as well as anything else) via this guide I wrote up in 1997-2008 -> http://www.bing.com/search?q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&qs=n&form=QBLH&pq=%22how+to+secure+windows+2000%2Fxp%22&sc=1-30&sp=-1&sk=&cvid=60c59dc375834640bef6cf0ed9d8147a
I truly don't *think* that you "p.r. fanboys" for other alternate *NIX based OS understand something - when you post b.s. online, SOMEONE will spot it, and shred you for it... I mean, for YEARS here all you heard was (more or less) "*NIX = invulnerable & Windows = vulnerable"... well, new news: Look @ ANDROID (yes, it's a Linux) - it's being infested FAR FASTER than any Windows EVER WAS in the SAME timeframe. That tell you anything boys?
Well, then these results ought to (as a SINGLE example of many I've seen as a result, especially after CIS Tool usage which makes it cake to do & FUN in a nerdy kind of way):
---
"Its 2009 - still trouble free! I was told last week by a co worker who does active directory administration, and he said I was doing overkill. I told him yes, but I just eliminated the half life in windows that you usually get. He said good point. So from 2008 till 2009. No speed decreases, its been to a lan party, moved around in a move, and it still NEVER has had the OS reinstalled besides the fact I imaged the drive over in 2008.
Great stuff! My client STILL Hasn't called me back in regards to that one machine to get it locked down for the kid. I am glad it worked and I am sure her wallet is appreciated too now that it works. Speaking of which, I need to call her to see if I can get some leads. APK - I will say it again, the guide is FANTASTIC! Its made my PC experience much easier. Sandboxing was great. Getting my host file updated, setting services to system service, rather than system local. (except AVG updater, need system local)" from -> http://www.xtremepccentral.com/forums/showthread.php?s=19624f28d25cc6eec220229b503b7a4c&t=28430&page=3
---
It works, & is PROOF of my statements here.
APK
P.S.=> Additionally - IF you trust SeLinux? Better think again - look who created it (NSA)... apk
Anyone who uses closed source has forfeitted security. there is no but. none. anyone who claims that has no idea what theya re talking about.
Your effete b.s. = proof You can't dispute truth & proof of it http://tech.slashdot.org/comments.pl?sid=4622309&cid=45849209 & "the best you got" = bogus downmods to *try* to vainly "hide" it, lol! After all: You haven't disproven my points whatsoever... & you KNOW it.
* :)
(Hence your EFFETE "hit & run" downmod attempt with no justification that's technically valid behind it to disprove my words & the VERIFIABLE CONCRETE PROOF I USED BEHIND THEM...)
Yes... too bad you dolts ALSO don't get it that MOST FOLKS HERE BROWSE WELL BELOW THE DEFAULT MODERATION THRESHOLD - & thus?
Yes: Others, will see my post & points anyhow, + your rather reprehensible tactics (that only make you idiots look all the more idiotic - which, of course, only HARMS your cause in championing your OS "weapon-of-choice" vs. Windows too... DOUBLE bonus for me!) which of course, exposes you trolls for the weak weasels you are.
Two for the price of 1, in 1 shot, since your bogus deceits NEVER work...
Thanks for making ME look good, & yourselves? Well... lol, "not so good"!
APK
P.S.=> Seriously - how do you LIVE with yourselves? Face a fact (while you "channel your inner criminal" for understanding): THE MORE ANY OS IS USED, the more it will be attacked (& the GOOD side of that is weaknesses get exposed & eventually fixed - the ONLY good thing I have to say about malware in general & it's misguided creators), since just like another form of criminal, in pickpockets? Online crooks target crowds, just like pickpockets, for more potential victims from 1 codebase shot in malware used!
Additionally - Linux &/or MacOS X + iOS NEVER HAD THAT BEFORE like nowadays, but Android & MacOS X + iOS, once MORE users got on them, also do PROVE my/this point here now too - That, yes, they too, with added numbers of users, ARE now being attacked FAR MORE + exposed in weakness for the reasons above!
(Despite Apple's b.s. of "we don't get viruses" + the typical for years here /. NIX fan b.s. of "Linux = invulnerable, Windows = vulnerable" crap, etc.- et al - which, of course, makes YOUR "fanboy/Pro-*NIX? b.s. apparent as what it TRULY is, crap!)
You fools shoot yourselves in the foot!
Clue - you can't pull "mass media" crap-tactics on folks online nowadays - someone WILL expose it, everytime - just as I have YOU here now... apk
another cunting NIGGER ASSOCIATION
If you have any honor, either as an individual or a company, you will now encrypt the bloody things. Setting aside your a-hole buddies in the NSA, the other bad guys are exploiting these plain-text treasure troves as well, FFS.
If present Guess what I know.