Slashdot Mirror

← Back to Stories (view on slashdot.org)

Microsoft Fixes Critical Remotely Exploitable Windows Root-Level Design Bug

Posted by timothy on from the lurking-beneath-the-surface dept.

An anonymous reader writes "In this month's Patch Tuesday, Microsoft has released nine security bulletins to address 56 unique vulnerabilities in Microsoft Windows, Microsoft Office, Internet Explorer, and Microsoft Server software. Of the nine security bulletins, three are rated Critical in severity, and among these three is one that addresses a years-old design flaw that can be exploited remotely to grant attackers administrator-level privileges to the targeted machine or device. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights." Reader jones_supa writes, though, that the most recent patch rollout came with a bug of its own, since corrected: the company apparently botched a rollup update for Visual Studio 2010 Tools for Office Runtime: "There is an issue with KB3001652: many users are reporting that it is locking up their machines while trying to install it. It does not seem that this patch is doing any other damage though, such as bricking the operating system. These days Microsoft appears to be reacting quickly to this kind of news as it looks like the patch has already been pulled from Windows Update."

136 comments

  1. oh you motherf~}NO_CARRIER by ihtoit · · Score: 3, Interesting

    I read this just SIX MINUTES after I installed the bloody office runtime update.

    Which, lucky me, didn't lock the system up. It seems to have installed pretty painlessly.

    (wonder if that could be anything to do with the fact that I don't have Office installed?)

    --
    Political debates have me rolling my eyes so much I think I got optical whiplash. I should sue. - Foamy The Squirrel
    1. Re:oh you motherf~}NO_CARRIER by Bacon+Bits · · Score: 3, Informative

      It might be an extremely rare issue. Following the links in the article, the last update they pulled in August of 2014 was pulled because it was causing blue screen errors for 0.01% of users, but they pulled it anyways.

      --
      The road to tyranny has always been paved with claims of necessity.
    2. Re:oh you motherf~}NO_CARRIER by ihtoit · · Score: 4, Insightful

      whoa, 0.01% of 800 million (a very conservative estimate of the installed base) is still 80,000. That's a number far greater than 0 and most definitely of concern if you're one of those 80,000.

      --
      Political debates have me rolling my eyes so much I think I got optical whiplash. I should sue. - Foamy The Squirrel
    3. Re:oh you motherf~}NO_CARRIER by Anonymous Coward · · Score: 0

      Yeah, and that's why they pulled it, but that's still very rare.

    4. Re:oh you motherf~}NO_CARRIER by VGPowerlord · · Score: 3, Informative

      I read this just SIX MINUTES after I installed the bloody office runtime update.

      Microsoft already released a fixed version at least 12 hours before /. posted this story... and pulled the buggy version some hours (8?) before that.

      In other words, by the time this story was posted, it was no longer relevant.

      --
      GLaDOS for President 2016! "Well here we are again. It's always such a pleasure." -- GLaDOS, 2011
    5. Re:oh you motherf~}NO_CARRIER by WasteOfAmmo · · Score: 4, Informative

      After some investigation it looks like the update may not have been configured to do a silent install properly and actually hangs as it is waiting for user input on an invisible dialogue box.

      If you have a machine that does hang we have found the following:
      1. wait until there is virtually no disk activity (counting on you have a light that shows you) and then power the machine down, or
      2. use either PowerShell remoting or psexec to kill the two processes involved in the update: "Setup" and "vstor_redist".
      With PowerShell: Invoke-Command -ComputerName hostname -ScriptBlock {Stop-Process -Name Setup,vstor_redist -Force}
      With PSExec something like this will work:
      Psexec \\hostname cmd
      Taskkill /im Setup /f
      Taskkill /im vstor_redist /f
      Exit

      If the machine is doing a number of updates killing the two processes above will allow the machine to continue with the rest of the updates.

      Of course the standard disclaimers apply: No guarantees the above will help and not harm you computer, your mileage may vary, batteries not included, objects in code are buggier than they appear, yadda, yadda.

    6. Re:oh you motherf~}NO_CARRIER by Anonymous Coward · · Score: 0

      It's probably in the order of around 0-10% of that with a system that actually downloads and installs the patch before it is pulled (and I would guess a lot closer to 0 than to 10). That brings it down to a couple of thousand systems at most worldwide, which is probably less than the number of systems that go down each day due to catastrophic hardware failure. It really is next to nothing. Like the guy in the linked post said, 99.99% is pretty good in most jobs, it's a noble thought that he strives to do better, but I doubt it is realistically possible.

      In contrast, 50% of the global population of computer users cannot even get past the installation instructions of the average linux distro. It's easy to think that anyone can do a flawless upgrade if all your friends are computer savvy, it's a different thing when you're dealing with a global population of average consumers.

  2. The most insecure OS in the world by Anonymous Coward · · Score: 0, Insightful

    Windows - the most insecure OS in the world. There are probably more viruses, malware and ransonware than actual apps.

    1. Re:The most insecure OS in the world by monkeyzoo · · Score: 5, Funny

      Windows - the most insecure OS in the world.

      True, but only because Adobe never made an OS.

    2. Re:The most insecure OS in the world by Anonymous Coward · · Score: 0

      So what? By not installing spurious applications, a geek can these days keep his Windows installation malware-free very easily.

    3. Re:The most insecure OS in the world by sinij · · Score: 3, Insightful

      Please, the most insecure OS in the world is Linux (Damn Vulnerable Linux)

    4. Re: The most insecure OS in the world by AcerbusNoir · · Score: 1

      Can't argue with that.

      There was a time when Sun's (now Oracle) Solaris was considered the swiss cheese of operating systems.

    5. Re:The most insecure OS in the world by Anonymous Coward · · Score: 1

      And designed to be a security teaching tool.

      Not a production system.

    6. Re:The most insecure OS in the world by Archangel+Michael · · Score: 5, Insightful

      True. But Adobe already creates exploits for all the other OSes in the world, so they don't need to actually create an unsecured OS.

      --
      Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
    7. Re:The most insecure OS in the world by ihtoit · · Score: 1

      uh... DVLinux is a security training tool and sandbox for SELinux component testing, not a production desktop platform.

      --
      Political debates have me rolling my eyes so much I think I got optical whiplash. I should sue. - Foamy The Squirrel
    8. Re:The most insecure OS in the world by The-Ixian · · Score: 3, Interesting

      Yes, as much as I hate to admit it, I have had WAY more Linux servers exploited than Windows servers.
       
      I have set up hundreds of Windows Small Business servers and less than half as many production Linux servers. I only recall having 1 Windows server exploited, and that was because the customer set up an admin-level user with an extremely simple password and then opened RDP to the world.
       
      On the other hand, I have had several Linux servers exploited via ProFTPD, Horde, Sendmail and other vulnerable services.

      --
      My eyes reflect the stars and a smile lights up my face.
    9. Re:The most insecure OS in the world by Anonymous Coward · · Score: 1

      As much as I hate to say it, that is not a Windows exploit, but a PEBKAC issue...

    10. Re:The most insecure OS in the world by Anonymous Coward · · Score: 2, Insightful

      Its all about attack surface bro.

      Those windows SMB servers you likely firewalled away from the internet, zero exposed (inbound) services. They're only used to provide services to systems on the local network. Maybe you have SMTP exposed for inbound mail. (Today, though, running your own exchange server(s) for anything smaller than an enterprise is for suckers. Much cheaper to purchase hosted exchange service, and you don't have to deal with your IP blocks being blackholed)

      Those linux servers, on the other hand, were probably internet facing. Providing services anyone on the wild wild interwebs could hammer. If you put those windows servers in the same situation you'd see them pwnd too.

    11. Re:The most insecure OS in the world by sinij · · Score: 2

      Yes, but GPP did not specify "a production desktop platform". My point was that blanket "X OS is the most insecure" statements are largely pointless. With enough effort and expertise you could secure any OS, or you could exploit any OS, even when airgaped. With enough ignorance you could misconfigure even the most secure OS. The devil is in the details.

    12. Re:The most insecure OS in the world by Anonymous Coward · · Score: 0

      So, you're some sort of MSCE or similar. Screwed Linux up royally, eh?

      I have also set up a number of Linux servers, and none of them ever got pwned. Not even with Heartbleed; many apparently tried, according to the logs I've seen, but it's hard to get past the wrong version of OpenSSL. Similarly, many tried exploiting Shellshock - within a few hours - but it's hard to get past /bin/ash as the shell for web scripts.

    13. Re:The most insecure OS in the world by Archtech · · Score: 2

      "True, but only because Adobe never made an OS".

      A man's gotta know his limitations. And they do.

      --
      I am sure that there are many other solipsists out there.
    14. Re:The most insecure OS in the world by westlake · · Score: 2, Insightful

      Windows - the most insecure OS in the world. There are probably more viruses, malware and ransonware than actual apps.

      I doubt it.

      Download.com alone hosts over 51,000 Windows apps. Search Results for all Windows, Sourceforge, 16,000, 2,200 certified Fresh.

      Amazon.com 22,000 for retail sale. PC Software

      You could make a very strong case for Android being the most insecure, incompetently planned and managed OS in the wild.

      Google's position is complicated, because it has produced a platform that it has no power to update. There's no Windows Update for Android phones, and Google has no ability to push out updates to the operating system; it has to depend on a range of OEMs and network operators to adopt its source code changes and distribute them to users. Both Apple and Microsoft, in contrast, have a direct channel to update their mobile operating systems.

      Google won't fix bug affecting 60 percent of Android users

    15. Re:The most insecure OS in the world by VGPowerlord · · Score: 3, Informative

      True, but only because Adobe never made an OS

      A man's gotta know his limitations. And they do.

      Funny story... Oracle (née Sun) makes an Operating System.

      --
      GLaDOS for President 2016! "Well here we are again. It's always such a pleasure." -- GLaDOS, 2011
    16. Re:The most insecure OS in the world by Anonymous Coward · · Score: 0

      Those windows SMB servers you likely firewalled away from the internet, zero exposed (inbound) services. They're only used to provide services to systems on the local network.

      ...said everyone from the Iranian engineerss to the Chief Security Officer at Anthem/BlueCross/Wellpoint, just before they got pwn3d.

    17. Re:The most insecure OS in the world by Ravaldy · · Score: 1

      Also the most popular hence the attrition to it's security flaws.

    18. Re:The most insecure OS in the world by dfsmith · · Score: 1

      You don't count PostScript as an OS? It's so much more than a language....

    19. Re:The most insecure OS in the world by Zaiff+Urgulbunger · · Score: 1

      Windows - the most insecure OS in the world.

      True, but only because Adobe never made an OS.

      True. But Adobe already creates exploits for all the other OSes in the world, so they don't need to actually create an unsecured OS.

      AFAIK no Adobe software even runs on Raspberry Pi, but never-the-less, flash can crash it. The mere "aura" of Adobe can break things! :D

    20. Re:The most insecure OS in the world by Anonymous Coward · · Score: 0

      I think they make another one too... don't they have versions of their database that run on bare metal?

    21. Re:The most insecure OS in the world by nuckfuts · · Score: 1

      The security of an operating system should be judged by its default configuration, not by how insecure it is after you've installed a bunch of 3rd party apps. Even a security-oriented OS like OpenBSD can't prevent other people from doing insecure things to it.

  3. You heard it here first. by Anonymous Coward · · Score: 0

    It's almost like they are trying to keep some vulnerabilities open for some client...

  4. Clench your buttcheeks by Anonymous Coward · · Score: 0

    Windows Updates are just the worst. You never know how it's going to fuck up your system, and if it'll happen instantly or weeks down the road, but it always will.

  5. Tough decision by monkeyzoo · · Score: 1

    Would I rather my computer be bricked or p0wned?
    In one case I potentially lose my data, in the other, bad guys potentially get it all.

    1. Re:Tough decision by Anonymous Coward · · Score: 1

      Would I rather my computer be bricked or p0wned?

      Bricked. A bricked computer can't be p0wned. A p0wned computer can still be bricked, and by someone else.

    2. Re:Tough decision by mlts · · Score: 1

      I may be a bit pedantic, but how can a general purpose laptop or desktop computer get bricked, unless part of the exploit overwrote the firmware, causing the machine to not be able to be booted?

      The OS might need to be repaired or reinstalled, but generally the data should be recoverable.

      Of course, having backups is a wise idea.

    3. Re:Tough decision by Archtech · · Score: 1

      Definitely bricked. It's axiomatic that your data is more valuable than your hardware - since you have it all backed up, you just buy new hardware and you are set. (Although you might want to consider changing your OS).

      In fact, I have heard security professionals opine that a brick is the ideal secure IT system. It can't store any data, it can't do any computing, and it doesn't do you any good except as part of a wall (or something handy to throw at a politician). But it is VERY secure indeed.

      --
      I am sure that there are many other solipsists out there.
    4. Re:Tough decision by Anonymous Coward · · Score: 0

      I may be a bit pedantic, but how can a general purpose laptop or desktop computer get bricked, unless part of the exploit overwrote the firmware, causing the machine to not be able to be booted?

      welcome to UEFI land

    5. Re:Tough decision by dimeglio · · Score: 1

      Ah yes; but a bricked computer can't be used, a p0wned computer can still be used - sometimes by many.

      --
      Views expressed do not necessarily reflect those of the author.
    6. Re:Tough decision by jhantin · · Score: 1

      Let me Google that for you.

      --
      ...when you're writing a game...tweak the difficulty of "Easy" to something [your mother] can cope with. -- onion2k
    7. Re:Tough decision by Anonymous Coward · · Score: 0

      I had to kill Vs2010ToolsSetup.exe*32 or something like that, but my machine isn't bricked.

  6. VS2010 patch locks up OS? by jfbilodeau · · Score: 4, Insightful

    Why would a patch for an IDE lock up an OS?

    Is Microsoft able in any way to create products that are not intractably entrenched in their OS?

    --
    Goodbye Slashdot. You've changed.
    1. Re:VS2010 patch locks up OS? by Rich0 · · Score: 1

      In the case of VB it might have to do with the way it installs a debugger (assuming it still does that - has been ages since I've used it).

      It is still a stupid design. In Linux I can debug a process without elevated privileges whatsoever. Now, messing with kernel debugging tools could potentially crash your system and requires elevated privileges, but, well, you're messing with the kernel.

      Now, I could see a botched installer going nuts and killing other processes or whatever, requiring a user to log off and back on. You can't really prevent that sort of thing without going the SELinux route and restricting what a user's own processes can do within the context of their own account. If in linux as an unprivileged user I type "killall --user myself --signal SIGKILL" then I'm going to see a "crash" of sorts, but I'll just end up being dumped back at a getty or XDM screen or whatever.

    2. Re:VS2010 patch locks up OS? by jfbilodeau · · Score: 3, Funny

      "killall --user myself --signal SIGKILL"

      Sounds like the type of code a VB developer would write on Linux. :P

      --
      Goodbye Slashdot. You've changed.
    3. Re:VS2010 patch locks up OS? by Pope+Hagbard · · Score: 3, Informative

      It's not a patch for the IDE, it's for the runtime for programs built with that version of Visual Studio (there are such runtimes for all versions of VS). It sounds like the computer can freeze during patch installation.

    4. Re:VS2010 patch locks up OS? by gstoddart · · Score: 2

      Historically, they've used APIs the rest of us don't see, and since this is also a debugger and who knows what else ... it's probably embedded quite deeply into the OS.

      Part of the problem is Microsoft's own software has pretty much always been intractably entrenched in the OS, and they've never seen that as an issue.

      It doesn't sound like a modular architecture .. it sounds like they just view all of this as one monolithic thing.

      Which is probably why they have a terrible track record of supporting other platforms. Because support for something else is hard even for them.

      --
      Lost at C:>. Found at C.
    5. Re:VS2010 patch locks up OS? by Anonymous Coward · · Score: 0

      It is also called "logout". :)

    6. Re:VS2010 patch locks up OS? by Ravaldy · · Score: 2

      I've seen this issue twice (we have a few VS2010 enabled machines). If you apply the patch by going into the Windows Update screen it will simply attempt to install in an infinite loop and you can simply end the process using the task manager. If you shutdown the system while the patch is pending to be installed, Windows will attempt to perform the update before completing the shutdown procedure. This is what creates the appearance of a lock up. Because the patch never appears to end, it remains in shutdown mode for as long as you don't reboot manually. This is very different than an actual OS lock. Just though I'd clarify.

    7. Re:VS2010 patch locks up OS? by Rich0 · · Score: 1

      "killall --user myself --signal SIGKILL"

      Sounds like the type of code a VB developer would write on Linux. :P

      Just an illustration, but I have run stuff like this to clean up orphan processes. If you're running systemd there are also settings you can change which will cause it to clean up orphan processes as well (just don't do this if you like to leave stuff running under screen and so on).

    8. Re:VS2010 patch locks up OS? by Anonymous Coward · · Score: 0

      The answer is yes. They do publish some quality app for Android and iOS.

      But to the point: In your statement Microsoft can be replaced by any company.

      > Is Apple able in any way to create products that are not intractably entrenched in their OS?

      > Is Google able in any way to create products that are not intractably entrenched in their Services/OS?

      > Is Taco Bell able in any way to create products that are not intractably entrenched in their Menu?

      > Is HP able in any way to create ink cartridges that are not intractably entrenched in their printer?

  7. Seems I didn't get that patch by monkeyzoo · · Score: 1

    I updated immediately after release on 2/10, but I don't have the patch mentioned. I presume that is because I don't have Visual Studio installed?

    1. Re:Seems I didn't get that patch by eyenot · · Score: 1

      Probably so. I just checked the incoming updates and the problematic one was in the list, and I do have VS2010 installed. However, I did not install the particular subgroup of tools that the patch is mentioned to target. Good thing I crawled through the list looking for the specific KB#'s of incoming updates and unchecked it. If I were less cautious I would have been hitting "Install" feeling safe under the assumption that since I didn't have those tools installed in VS2010 that I would not be targeted for that update.

      --
      "Stratigraphically the origin of agriculture and thermonuclear destruction will appear essentially simultaneous" -- Lee
    2. Re:Seems I didn't get that patch by Anonymous Coward · · Score: 1

      Visual Studio Tools for Office (VSTO) is a runtime - you often don't know you have it installed as it would come as a dependency with another application. It is generally safe to say that if you don't have MS Office installed, you don't have VSTO installed either because the applications written with VSTO are generally ad-ins for Office. Things like WebEx scheduling ad-ins for MS Office Outlook, etc.

  8. It could've been worse ... oh wait.... by davidwr · · Score: 0

    "Microsoft Does Not Fix Critical Remotely Exploitable Windows Root-Level Design Bug"

    To all Windows Server 2003 users still out there: Oh wait...

    Or even worse:

    For the last several years there's been a critical no-workaround vulnerability that even the vendor didn't know about. Oh wait...

    --
    Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
    1. Re:It could've been worse ... oh wait.... by Anonymous Coward · · Score: 0

      Not to defend Microsoft here, but Server 2003 is out of support in a couple of months anyway so if you've not moved off it by now you're just going to have to get used to not getting patches for it any more.

    2. Re:It could've been worse ... oh wait.... by Anonymous Coward · · Score: 1

      Yeah, fucking capitalist assholes! Forcing people to upgrade to one of the last few versions of their operating system!

      I mean EVEN Debian still makes security packages for Potato and Woody! ... right?

    3. Re:It could've been worse ... oh wait.... by peppepz · · Score: 0
      The interesting part is not so much that they're no longer fixing bugs in Windows Server 2003, but rather the reason why they aren't:

      Although Windows Server 2003 is an affected product, Microsoft is not issuing an update for it because the comprehensive architectural changes required would jeopardize system stability and cause application compatibility problems.

      In practice they're admitting that Windows 2003 is so broken by design that not even them can fix it without causing problems. I'd like to hear now the opinion of those who were lamenting over the quality of open source software after the heartbleed bug.

    4. Re:It could've been worse ... oh wait.... by davidwr · · Score: 1

      I mean EVEN Debian still makes security packages for Potato and Woody! ... right?

      I don't know if Debian does or not (I'm going to assume not based on your tone), but at least Debian's customers have everything they need (except maybe skill and time) to fix it themselves.

      Microsoft customers? Not so much.

      --
      Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
    5. Re:It could've been worse ... oh wait.... by Anonymous Coward · · Score: 1

      And realistically, how many people are going to do that instead of just upgrading to a distro from the last decade?

  9. TFA Says Patch is Fixed by Bacon+Bits · · Score: 4, Informative

    The article says the patch has already been updated and is safe to install.

    --
    The road to tyranny has always been paved with claims of necessity.
    1. Re:TFA Says Patch is Fixed by WasteOfAmmo · · Score: 2

      Yes, except... if your machine still has updates outstanding then from what we have seen it is best if you "check for updates" again before installing them. It looks like if the patch was already downloaded then it will install unless you refresh by checking for updates again before installing.

  10. Re:This is your computer on Windows... by BreakBad · · Score: 2

    FTA "this is a design problem not an implementation problem."

    So....Microsoft designed a godmode exploit.

  11. Design "Bug" by MagickalMyst · · Score: 0

    Hahahahahhahahaha... breathe.. hahahahaha

    --
    Political correctness is really just herd psychology pushed by insecure people who desperately seek social conformity.
  12. Serious IE 11 Vulnerability is left out by neo00 · · Score: 1

    Apparently the update left out a serious universal XSS vulnerability in IE11 unpatched. Source
    Vulnerability Full Disclosure - 31 Jan 2015

  13. PowerShell module by Anonymous Coward · · Score: 0

    For those who want to try it out, this stuff can now be managed also from CLI using the Windows Update PowerShell module. :)

  14. No patch for XP by ugen · · Score: 0, Flamebait

    How convenient that 15% of all Windows computers are (and will remain) vulnerable to this problem (yes, I mean Windows XP). Good one.

    1. Re:No patch for XP by Anonymous Coward · · Score: 0

      Don't join the system to the domain. That avoids the really critical one.

    2. Re:No patch for XP by Anonymous Coward · · Score: 0

      Yeah if you can't afford to use something other than XP you get what you deserve.

    3. Re:No patch for XP by Anonymous Coward · · Score: 0

      It's amazing that XP is so bug-ridden that there are still critical vulnerabilities left after 12 years of patching. Even more amazing is that people are lining up to buy Windows 10 from the same company.

    4. Re:No patch for XP by Anonymous Coward · · Score: 0

      Err Mah Gerd, There's no patch for Windows 95 either!! Microsoft sucks, Microsoft is evil!

    5. Re:No patch for XP by bobbied · · Score: 0

      It's amazing that XP is so bug-ridden that there are still critical vulnerabilities left after 12 years of patching. Even more amazing is that people are lining up to buy Windows 10 from the same company.

      But, but, it's going to be BETER... They changed the name and upped the version number to 10!

      --
      "File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
    6. Re:No patch for XP by Anonymous Coward · · Score: 0

      Unless they didn't. See the difference?

    7. Re:No patch for XP by Anonymous Coward · · Score: 0

      Would they really? How many security/new technology updates for 2001-era Linux distros do you see?

    8. Re:No patch for XP by CaTfiSh · · Score: 1

      That's mighty cavalier of you, but the fact remains that exploited machines affect the rest of us as well.

  15. Sad Hacker by sir-gold · · Score: 4, Funny

    Somewhere in the world, there is a hacker crying into his keyboard right now, because MS finally found the hole he's been exploiting for the last 10 years.

    1. Re:Sad Hacker by Anonymous Coward · · Score: 0

      No hacker, no cry.

    2. Re:Sad Hacker by H0p313ss · · Score: 1

      No hacker, no cry.

      I remember when we used to sit
      In the IRC channel in Trenchtown, yeah...

      --
      XML is a known as a key material required to create SMD: Software of Mass Destruction
    3. Re:Sad Hacker by cyberchondriac · · Score: 1

      I think you meant, "Somewhere in the world, there is a **script-kiddie** crying into his keyboard right now, because MS finally found the hole he's been exploiting for the last 10 years."

      --

      Look back up at my post, now look back down, you're on the Internet. Now look back up. I'm a signature.
    4. Re:Sad Hacker by toddestan · · Score: 1

      The script kiddie would have no idea that the security hole they were exploiting was fixed until they suddenly find out that their l33t hax0r t00lz no longer work.

  16. Important details by Hiroto.+S · · Score: 0

    SpaceX would use portable “port-o-potties” during landing operations.

  17. The XP Killer? by bill_mcgonigle · · Score: 4, Insightful

    We've been waiting for that vulnerability that will finally create such havoc on XP that people will abandon it.

    The security bulletin is vague, as usual, but it does say:

    A remote code execution vulnerability exists in how Group Policy receives and applies policy data when a domain-joined system connects to a domain controller. To exploit this vulnerability, an attacker would have to convince a victim with a domain-configured system to connect to an attacker-controlled network.

    An attacker who successfully exploited this vulnerability could take complete control of an affected system and then install programs; view, change, or delete data; or create new accounts with full user rights. The security update addresses the vulnerability by improving how domain-configured systems connect to domain controllers prior to Group Policy accepting configuration data. ...

    Although Windows Server 2003 is an affected product, Microsoft is not issuing an update for it because the comprehensive architectural changes required would jeopardize system stability and cause application compatibility problems. Microsoft recommends that security-conscious customers upgrade to a later operating system in order to keep pace with the changing security threat landscape and benefit from the more robust protections that later operating systems provide.

    Which would seem to put the XP/2003 lineage one malware download away from connecting to a botnet that spoke just enough Domain protocol to exploit it and being pwned.

    NSA could have such an exploit ready next week, Russian mafia in a month. The Prize is controlling close to 19% of the installed base.

    --
    My God, it's Full of Source!
    OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
    1. Re:The XP Killer? by Dwedit · · Score: 4, Funny

      Everyone runs Admin on XP anyway, so privilege escalation is less of a problem than it could be.

    2. Re:The XP Killer? by Anonymous Coward · · Score: 0

      Did you even read the description?

      This exploit only works on machines that:
      1) Are members of an 'active domain' (i.e. corporate machines).
      2) Are connecting to an exploited domain server.

      I would figure that the majority of XP installs are on home computers _or_ on corporate machines that aren't connecting to a hacked AD server..

    3. Re:The XP Killer? by tlhIngan · · Score: 4, Informative

      We've been waiting for that vulnerability that will finally create such havoc on XP that people will abandon it.

      It only affects domain-joined PCs. If you're running XP Home (can't join a domain to begin with), then it really doesn't affect you.

      It's a basic downgrade attack - similar to how those TLS bugs were done. You force the client and/or server to revert to an older less secure authentication protocol and then use that to get your way in.

      And most businesses have moved off XP.

    4. Re:The XP Killer? by skids · · Score: 1

      1) Are members of an 'active domain' (i.e. corporate machines). ...Microsoft's bread and butter...
      2) Are connecting to an exploited domain server. ...no, they just have to be in a place that a fake domain server can forge packets pretending to be from the real one.

      Given the state of ethernet security these days (some vendors even still sell brand spanking new switches without ARP/IP validation features) that is not a hard environment to find.

      --
      Someone had to do it.
    5. Re:The XP Killer? by Anonymous Coward · · Score: 0

      ARP/IP validation features?
      Do you even understand what you are talking about?

    6. Re:The XP Killer? by antdude · · Score: 1

      Are there still that many business using old Windows XP Pro SP3 with domain connections?

      --
      Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
  18. Just you wait... by Anonymous Coward · · Score: 0

    I'm sure all the fans will blame this on Linux and open source too somehow.

    1. Re:Just you wait... by BronsCon · · Score: 1

      Well, of course! All the hackers use Linux and other Open Source software because they don't want to be vulnerable to the same exploits they're using! Damn Linux! :P

      --
      APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
  19. Patching is NOT ENOUGH by jeffasselin · · Score: 5, Informative

    One very important part of this latest vulnerability is that patching your systems is NOT ENOUGH. The patch is not so much a fix as an entirely new security functionality which must be configured properly.

    It is required to configure a group policy to harden your systems. Any domain-joined system must have both the patch installed and a group policy setup to force the system to use secure authentication and validation mechanism on any sensitive share. Domain shares such as NETLOGON and SYSVOL are an obvious priority, but any share used for software deployment or script execution must be similarly listed.

    Make sure you read the KB article and take the proper steps to secure your systems:

    https://support.microsoft.com/...

    --
    If he explores all forms and substances Straight homeward to their symbol-essences; He shall not die.
    1. Re:Patching is NOT ENOUGH by Anonymous Coward · · Score: 0

      Well, considering this is an MITM attack that targets a service that is typically only used on private internal networks (That likely use switches), or computers connected to one over VPN this is a bit less serious.

      Patch and configure for sure, but you'd have to impersonate a DC to attack a vulnerable system. Thats typically not something you can do remotely. Though if you had a foothold on an internal system (a trojaned box or somesuch) you could conceivably try to impersonate one of the DCs to start attacking other machines.

    2. Re:Patching is NOT ENOUGH by skids · · Score: 1

      Well, considering this is an MITM attack that targets a service that is typically only used on private internal networks (That likely use switches), or computers connected to one over VPN this is a bit less serious.

      You vastly overestimate the competency of corporate LAN departments. When the LAN is not properly hardened, and it very often isn't, all you need is one owned box/printer inside the broadcast domain to own all the AD Windows clients in that broadcast domain.

      --
      Someone had to do it.
    3. Re:Patching is NOT ENOUGH by jeffasselin · · Score: 1

      The problem in this case is that there are workarounds allowing you to impersonate a DC. For example, someone could sniff your DNS requests and use ARP poisoning to redirect your requests for GPO files or login scripts to its own servers, and Windows would automatically downgrade its SMB security to connect to this fake DC. This could easily be done to a computer connecting in a remote network, even if its corporate trafic is in a VPN. Read up on this article from the guys who found the vulnerabiltiy:

      https://www.jasadvisors.com/ab...

      One issue which Microsoft also did not mention is how AD-joined Windows systems by default leak a lot of info, and will send out DNS requests for domain resources from ANYWHERE. It doesn't matter that the servers aren't available from the Starbucks WiFi, Windows will still do DNS requests for "domain.local" and try to run "\\domain.local\NETLOGON\logon.bat".

      --
      If he explores all forms and substances Straight homeward to their symbol-essences; He shall not die.
    4. Re:Patching is NOT ENOUGH by Anonymous Coward · · Score: 0

      He's right, we're pretty much all total dumbasses and fuckups. Our admin passwords are all 12345 because I actually can't count any higher.

      In other words, go fuck yourself.

  20. Russian Mafia Re:The XP Killer? by Anonymous Coward · · Score: 0

    NSA could have such an exploit ready next week, Russian mafia in a month. The Prize is controlling close to 19% of the installed base.

    Don't underestimate the Russian Mafia.

    Don't underestimate the NSA either - they've probably had an exploit in their arsenal for awhile now.

    1. Re:Russian Mafia Re:The XP Killer? by Anonymous Coward · · Score: 3, Interesting

      Let me suggest another scenario:
      NSA have had the exploit for years since they asked for it to be put there.
      It was only removed just now since the Russian Mafia found and started to use the exploit.

  21. Re:This is your computer on Windows... by gstoddart · · Score: 2

    I bet they didn't so much design an exploit, as design another feature, implement it as designed ... and the discovered they'd made a gaping hole.

    I suspect at this point the code is so complex they don't even know what it does any more.

    --
    Lost at C:>. Found at C.
  22. Re:This is your computer on Windows... by courteaudotbiz · · Score: 2
    Bricking an OS? It's just like the guy don't actually know what a brick is. Bricking something is to break an actual object to the point where its only use is to be a doorstopper. Thie is the Urban Dictionnary quote:

    brick
    As verb: to brick something. This is the action of rendering any small-medium size electronic device useless. This can happen whilst changing the firmware, soldering or any other process involving either hardware of software.

    I bricked my mobile phone when I tried to install Linux on it.

    Haha! "When I tried to install Linux on it". Sounds funny reading that thread...

  23. Fancy Vulnerability Name by organgtool · · Score: 2, Funny

    Why is it that this bug doesn't have a fancy name like Heartbleed and Shellshock? Given that this bug will allow an attacker to completely dominate the target machine, I recommend the name "Skullfuck".

    1. Re:Fancy Vulnerability Name by jones_supa · · Score: 2

      Actually the vulnerability has been nicknamed "JASBUG". JAS Global Advisors founder Jeff Schmidt cooperated with Microsoft to fix the bug behind the scenes during 2014, while he was working an engagement with ICANN.

    2. Re:Fancy Vulnerability Name by ihtoit · · Score: 1

      Seconded. I'm surprised nothing called "Skullfuck" has hit the security newswires to date...

      --
      Political debates have me rolling my eyes so much I think I got optical whiplash. I should sue. - Foamy The Squirrel
    3. Re:Fancy Vulnerability Name by BronsCon · · Score: 1

      Damn, sad to hear that... WindowPain would have been a better fit. That or Glasscutter since, you know, it lets pretty much anyone cut a huge hole in Windows.

      --
      APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
    4. Re:Fancy Vulnerability Name by freeze128 · · Score: 1

      Maybe they should have called the patch "ICANN FIXIT".

  24. Re:This is your computer on Windows... by ihtoit · · Score: 2

    you mean like the desktop gadgets gadget? Yeah, I discovered yesterday while trying to install a lunar cycle widget that MS had deprecated the entire project, saying basically "Oh, we'd discovered that what we'd actually done was enable any old Joe Scumbag to completely own your computer via a widget you might actually find useful like live weather or news tickers".

    So why the fuck is it still in my desktop context menu!?

    --
    Political debates have me rolling my eyes so much I think I got optical whiplash. I should sue. - Foamy The Squirrel
  25. Re:This is your computer on Windows... by ihtoit · · Score: 1

    I think most phones that don't actually come with Linux (read: Android) installed will actually brick when you try to install Linux on them, because the kernel simply isn't designed for the architecture.

    --
    Political debates have me rolling my eyes so much I think I got optical whiplash. I should sue. - Foamy The Squirrel
  26. It's funny... by Anonymous Coward · · Score: 0

    Fixes like this happens all the time in software. Why is it critical news when it's Microsoft and not Linux or Unix? Considering the vast majority of Internet-connected servers are not Microsoft?

    I know I know, I'm a shill or something. I'll move on.

    1. Re:It's funny... by Anonymous Coward · · Score: 0

      Maybe because 80% of home computers are running Windows?

      I know that you don't think of things before spouting off bullshit questions, but could you at least refrain from making them so fucking dumb?

      TIA, the world.

    2. Re:It's funny... by Anonymous Coward · · Score: 0

      And how many of those home machines are using Active Directory Group Policy, genius? Or did you not even bother reading the article?

      Maybe you should think before spouting bullshit.

    3. Re:It's funny... by toddestan · · Score: 1

      Did you manage to sleep through the big new stories the past year about 'Heartbleed' (OpenSSL) and 'Shellshock' (bash)?

    4. Re:It's funny... by Gunstick · · Score: 1

      and glibc "ghost"
      oh wait...
      that one was mostly a publicity stunt from the security company.

      --
      Atari rules... ermm... ruled.
  27. KB3013455 by Old+Aylesburian · · Score: 1

    After successfully forcing the machine to reboot into safe mode last night (to stop a perpetual cyclic restart) I found that the screen fonts were being incorrectly rendered to the point of being unreadable. Hours later it turned out to be KB3013455, now uninstalled. Today several sites say that this affects Vista and several flavours of Windows Server.

    1. Re:KB3013455 by Anonymous Coward · · Score: 0

      Same thing happened to me.

    2. Re:KB3013455 by Anonymous Coward · · Score: 0

      That's why I would rather risk getting my computer pwned than to risk getting it bricked or rendered unusable.

      And that's also why I disable auto updates.

      Microsoft's patch quality standards have dropped significantly since Nadella took helm. Maybe he outsourced the patch testing division, who knows?

      Let the early guinea pigs patch first. If nothing happens, after a few weeks or months then MAYBE I'll consider doing Windows Update.

      Meanwhile, have fun interacting with the nincompoops on the Microsoft feedback forums and looking up the KB number of the faulty patch.

    3. Re:KB3013455 by Old+Aylesburian · · Score: 1

      To be fair the problem may have been caused by a local configuration e.g. I have many fonts and work in three scripts, one of which is right-to-left. The testers might simply have overlooked that particular case. OTOH...

  28. Just so I understand by WaffleMonster · · Score: 1

    Everywhere I look people still blissfully using completely insecure authentication methods for VPN access effectively broadcasting plaintext passwords to anyone snooping the wire... but hey at least if someone tricks you into connecting to their evil network Microsoft has your back.

    Would love an education how this bug is worthy of mention while other much more egregious issues such as true type vulnerabilities affecting anyone who browses to an attacker controlled website were also patched.

    1. Re:Just so I understand by Gunstick · · Score: 1

      on patch day, not only the trutype thingie got fixed, but 35 other remote code executions in MSIE.
      thirtyfive!
      Shows code quality.

      --
      Atari rules... ermm... ruled.
  29. Looks like the bug was in credential sharing by 140Mandak262Jamuna · · Score: 1
    The fine article is quite skimpy on the details about who is vulnerable. Throw in a little "If attacked" at the beginning of the sentence and then tack on all sorts of scary things. Sort of like, "If zombies were real." then write a whole host of scary things.

    From what I could make out, the bug is in credential sharing across a network. If some computer configured to be part of remotely administered network "joins" the network controlled by the attacker, then the attacker can get admin privilege. Most home computers and small business computers are locally managed not remotely managed. So medium to large company computers which are typically administered by dedicated IT departments are at risk. To be at risk this computer must be persuaded to "join" another network controlled by the attacker. It involved editing the workgroup/network setting of the computer. So it would involve some social engineering to get the user to run a malware trojan, a script or an executable to change the settings. But, at that point, once they run a trojan, you can't help them.

    Looks like the bug is in networked machines sharing credentials.

    --
    sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
    1. Re:Looks like the bug was in credential sharing by skids · · Score: 1

      So it would involve some social engineering to get the user to run a malware trojan

      Not even wrong. Any machine joined to a domain can be tricked into believing another machine is the server in that domain, and then that other machine installs a new group policy disabling all the protections set up by the legitimate domain admin. No social engineering required, just a way to successfully deliver forged packets or poison DNS.

      --
      Someone had to do it.
  30. Patch breaks Cisco Anyconnect VPN client too by Kernel+Kurtz · · Score: 2

    Cisco opened a priority 1 case with Microsoft yesterday as soon as we found out about this issue. We are continuing to escalate this issue with Microsoft for a resolution timeframe. We recommend that all customers open their own cases with Microsoft since the ultimate fix will need to come from them. You can feel free to reference Cisco's case # which is 115021112390273 in order to expedite having your ticket properly triaged by their support team.

    https://supportforums.cisco.co...

  31. Comment removed by account_deleted · · Score: 1

    Comment removed based on user account deletion

  32. Comment removed by account_deleted · · Score: 1

    Comment removed based on user account deletion

  33. "i wan to shot something" by Anonymous Coward · · Score: 0

    how many FPS (frames-per-second) will this "update" kill in FPS (first-person-shooter)?

  34. Let's just wait for Windows 10 by Anonymous Coward · · Score: 0

    Let Microsoft sort out its sorry mess first.

  35. Comment removed by account_deleted · · Score: 2

    Comment removed based on user account deletion

  36. Re:For Microsoft, vulnerabilities are profitable. by Anonymous Coward · · Score: 0

    Microsoft makes even more money by withholding critical patches from older software, make up some bullshit about software end of life, just to coerce users to upgrade to the latest and greatest offerings.

    Planned obsolescence - keeping shareholders, MBAs and corporate America happy.

  37. Windows 7 with nothing else by Anonymous Coward · · Score: 0

    I run windows 7 with no IDE, am I still vulnerable?

  38. lmao by Anonymous Coward · · Score: 0

    you think the NSA are better coders than the russians?

    keep dreaming imperialist scum!

  39. Re:This is your computer on Windows... by msobkow · · Score: 1

    I found this article particularly amusing seeing as I'm not done re-installing my Windows 7 box from the latest attack to take it out from a couple of days ago. I don't even use the box for surfing or email; just for running database servers, builds, and playing internet media.

    So it's got about the smallest attack surface you could imagine -- and it still has never survived more than 2 years without being nuked. None of my Windows boxes ever has.

    --
    I do not fail; I succeed at finding out what does not work.
  40. Windows XP? by fluor2 · · Score: 1

    Is Windows XP affected?

    1. Re:Windows XP? by Gunstick · · Score: 2

      yes. and not patched.
      like windows 2003, which is stull in support, but so badly designed that a patch is not possible.

      --
      Atari rules... ermm... ruled.
  41. Re:This is your computer on Windows... by Anonymous Coward · · Score: 0

    well then pebkac.

  42. Re: This is your computer on Windows... by Anonymous Coward · · Score: 0

    I've been wondering that for years. :/

  43. Re:This is your computer on Windows... by tjbutt58 · · Score: 1

    Probably a developer's backdoor. There was allegedly a /etc/passwd backdoor propagated through gcc for many years - a truly legendary hack. Developers like to leave these so they can back in if something goes wrong (putting a benign spin on it). I've brok a pam config before and wished I had a backdoor...