Slashdot Mirror

← Back to Stories (view on slashdot.org)

Microsoft Fixes Critical Remotely Exploitable Windows Root-Level Design Bug

Posted by timothy on from the lurking-beneath-the-surface dept.

An anonymous reader writes "In this month's Patch Tuesday, Microsoft has released nine security bulletins to address 56 unique vulnerabilities in Microsoft Windows, Microsoft Office, Internet Explorer, and Microsoft Server software. Of the nine security bulletins, three are rated Critical in severity, and among these three is one that addresses a years-old design flaw that can be exploited remotely to grant attackers administrator-level privileges to the targeted machine or device. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights." Reader jones_supa writes, though, that the most recent patch rollout came with a bug of its own, since corrected: the company apparently botched a rollup update for Visual Studio 2010 Tools for Office Runtime: "There is an issue with KB3001652: many users are reporting that it is locking up their machines while trying to install it. It does not seem that this patch is doing any other damage though, such as bricking the operating system. These days Microsoft appears to be reacting quickly to this kind of news as it looks like the patch has already been pulled from Windows Update."

85 of 136 comments (clear)

  1. oh you motherf~}NO_CARRIER by ihtoit · · Score: 3, Interesting

    I read this just SIX MINUTES after I installed the bloody office runtime update.

    Which, lucky me, didn't lock the system up. It seems to have installed pretty painlessly.

    (wonder if that could be anything to do with the fact that I don't have Office installed?)

    --
    Political debates have me rolling my eyes so much I think I got optical whiplash. I should sue. - Foamy The Squirrel
    1. Re:oh you motherf~}NO_CARRIER by Bacon+Bits · · Score: 3, Informative

      It might be an extremely rare issue. Following the links in the article, the last update they pulled in August of 2014 was pulled because it was causing blue screen errors for 0.01% of users, but they pulled it anyways.

      --
      The road to tyranny has always been paved with claims of necessity.
    2. Re:oh you motherf~}NO_CARRIER by ihtoit · · Score: 4, Insightful

      whoa, 0.01% of 800 million (a very conservative estimate of the installed base) is still 80,000. That's a number far greater than 0 and most definitely of concern if you're one of those 80,000.

      --
      Political debates have me rolling my eyes so much I think I got optical whiplash. I should sue. - Foamy The Squirrel
    3. Re:oh you motherf~}NO_CARRIER by VGPowerlord · · Score: 3, Informative

      I read this just SIX MINUTES after I installed the bloody office runtime update.

      Microsoft already released a fixed version at least 12 hours before /. posted this story... and pulled the buggy version some hours (8?) before that.

      In other words, by the time this story was posted, it was no longer relevant.

      --
      GLaDOS for President 2016! "Well here we are again. It's always such a pleasure." -- GLaDOS, 2011
    4. Re:oh you motherf~}NO_CARRIER by WasteOfAmmo · · Score: 4, Informative

      After some investigation it looks like the update may not have been configured to do a silent install properly and actually hangs as it is waiting for user input on an invisible dialogue box.

      If you have a machine that does hang we have found the following:
      1. wait until there is virtually no disk activity (counting on you have a light that shows you) and then power the machine down, or
      2. use either PowerShell remoting or psexec to kill the two processes involved in the update: "Setup" and "vstor_redist".
      With PowerShell: Invoke-Command -ComputerName hostname -ScriptBlock {Stop-Process -Name Setup,vstor_redist -Force}
      With PSExec something like this will work:
      Psexec \\hostname cmd
      Taskkill /im Setup /f
      Taskkill /im vstor_redist /f
      Exit

      If the machine is doing a number of updates killing the two processes above will allow the machine to continue with the rest of the updates.

      Of course the standard disclaimers apply: No guarantees the above will help and not harm you computer, your mileage may vary, batteries not included, objects in code are buggier than they appear, yadda, yadda.

  2. Tough decision by monkeyzoo · · Score: 1

    Would I rather my computer be bricked or p0wned?
    In one case I potentially lose my data, in the other, bad guys potentially get it all.

    1. Re:Tough decision by Anonymous Coward · · Score: 1

      Would I rather my computer be bricked or p0wned?

      Bricked. A bricked computer can't be p0wned. A p0wned computer can still be bricked, and by someone else.

    2. Re:Tough decision by mlts · · Score: 1

      I may be a bit pedantic, but how can a general purpose laptop or desktop computer get bricked, unless part of the exploit overwrote the firmware, causing the machine to not be able to be booted?

      The OS might need to be repaired or reinstalled, but generally the data should be recoverable.

      Of course, having backups is a wise idea.

    3. Re:Tough decision by Archtech · · Score: 1

      Definitely bricked. It's axiomatic that your data is more valuable than your hardware - since you have it all backed up, you just buy new hardware and you are set. (Although you might want to consider changing your OS).

      In fact, I have heard security professionals opine that a brick is the ideal secure IT system. It can't store any data, it can't do any computing, and it doesn't do you any good except as part of a wall (or something handy to throw at a politician). But it is VERY secure indeed.

      --
      I am sure that there are many other solipsists out there.
    4. Re:Tough decision by dimeglio · · Score: 1

      Ah yes; but a bricked computer can't be used, a p0wned computer can still be used - sometimes by many.

      --
      Views expressed do not necessarily reflect those of the author.
    5. Re:Tough decision by jhantin · · Score: 1

      Let me Google that for you.

      --
      ...when you're writing a game...tweak the difficulty of "Easy" to something [your mother] can cope with. -- onion2k
  3. VS2010 patch locks up OS? by jfbilodeau · · Score: 4, Insightful

    Why would a patch for an IDE lock up an OS?

    Is Microsoft able in any way to create products that are not intractably entrenched in their OS?

    --
    Goodbye Slashdot. You've changed.
    1. Re:VS2010 patch locks up OS? by Rich0 · · Score: 1

      In the case of VB it might have to do with the way it installs a debugger (assuming it still does that - has been ages since I've used it).

      It is still a stupid design. In Linux I can debug a process without elevated privileges whatsoever. Now, messing with kernel debugging tools could potentially crash your system and requires elevated privileges, but, well, you're messing with the kernel.

      Now, I could see a botched installer going nuts and killing other processes or whatever, requiring a user to log off and back on. You can't really prevent that sort of thing without going the SELinux route and restricting what a user's own processes can do within the context of their own account. If in linux as an unprivileged user I type "killall --user myself --signal SIGKILL" then I'm going to see a "crash" of sorts, but I'll just end up being dumped back at a getty or XDM screen or whatever.

    2. Re:VS2010 patch locks up OS? by jfbilodeau · · Score: 3, Funny

      "killall --user myself --signal SIGKILL"

      Sounds like the type of code a VB developer would write on Linux. :P

      --
      Goodbye Slashdot. You've changed.
    3. Re:VS2010 patch locks up OS? by Pope+Hagbard · · Score: 3, Informative

      It's not a patch for the IDE, it's for the runtime for programs built with that version of Visual Studio (there are such runtimes for all versions of VS). It sounds like the computer can freeze during patch installation.

    4. Re:VS2010 patch locks up OS? by gstoddart · · Score: 2

      Historically, they've used APIs the rest of us don't see, and since this is also a debugger and who knows what else ... it's probably embedded quite deeply into the OS.

      Part of the problem is Microsoft's own software has pretty much always been intractably entrenched in the OS, and they've never seen that as an issue.

      It doesn't sound like a modular architecture .. it sounds like they just view all of this as one monolithic thing.

      Which is probably why they have a terrible track record of supporting other platforms. Because support for something else is hard even for them.

      --
      Lost at C:>. Found at C.
    5. Re:VS2010 patch locks up OS? by Ravaldy · · Score: 2

      I've seen this issue twice (we have a few VS2010 enabled machines). If you apply the patch by going into the Windows Update screen it will simply attempt to install in an infinite loop and you can simply end the process using the task manager. If you shutdown the system while the patch is pending to be installed, Windows will attempt to perform the update before completing the shutdown procedure. This is what creates the appearance of a lock up. Because the patch never appears to end, it remains in shutdown mode for as long as you don't reboot manually. This is very different than an actual OS lock. Just though I'd clarify.

    6. Re:VS2010 patch locks up OS? by Rich0 · · Score: 1

      "killall --user myself --signal SIGKILL"

      Sounds like the type of code a VB developer would write on Linux. :P

      Just an illustration, but I have run stuff like this to clean up orphan processes. If you're running systemd there are also settings you can change which will cause it to clean up orphan processes as well (just don't do this if you like to leave stuff running under screen and so on).

  4. Seems I didn't get that patch by monkeyzoo · · Score: 1

    I updated immediately after release on 2/10, but I don't have the patch mentioned. I presume that is because I don't have Visual Studio installed?

    1. Re:Seems I didn't get that patch by eyenot · · Score: 1

      Probably so. I just checked the incoming updates and the problematic one was in the list, and I do have VS2010 installed. However, I did not install the particular subgroup of tools that the patch is mentioned to target. Good thing I crawled through the list looking for the specific KB#'s of incoming updates and unchecked it. If I were less cautious I would have been hitting "Install" feeling safe under the assumption that since I didn't have those tools installed in VS2010 that I would not be targeted for that update.

      --
      "Stratigraphically the origin of agriculture and thermonuclear destruction will appear essentially simultaneous" -- Lee
    2. Re:Seems I didn't get that patch by Anonymous Coward · · Score: 1

      Visual Studio Tools for Office (VSTO) is a runtime - you often don't know you have it installed as it would come as a dependency with another application. It is generally safe to say that if you don't have MS Office installed, you don't have VSTO installed either because the applications written with VSTO are generally ad-ins for Office. Things like WebEx scheduling ad-ins for MS Office Outlook, etc.

  5. Re:The most insecure OS in the world by monkeyzoo · · Score: 5, Funny

    Windows - the most insecure OS in the world.

    True, but only because Adobe never made an OS.

  6. TFA Says Patch is Fixed by Bacon+Bits · · Score: 4, Informative

    The article says the patch has already been updated and is safe to install.

    --
    The road to tyranny has always been paved with claims of necessity.
    1. Re:TFA Says Patch is Fixed by WasteOfAmmo · · Score: 2

      Yes, except... if your machine still has updates outstanding then from what we have seen it is best if you "check for updates" again before installing them. It looks like if the patch was already downloaded then it will install unless you refresh by checking for updates again before installing.

  7. Re:This is your computer on Windows... by BreakBad · · Score: 2

    FTA "this is a design problem not an implementation problem."

    So....Microsoft designed a godmode exploit.

  8. Serious IE 11 Vulnerability is left out by neo00 · · Score: 1

    Apparently the update left out a serious universal XSS vulnerability in IE11 unpatched. Source
    Vulnerability Full Disclosure - 31 Jan 2015

  9. Re:The most insecure OS in the world by sinij · · Score: 3, Insightful

    Please, the most insecure OS in the world is Linux (Damn Vulnerable Linux)

  10. Re: The most insecure OS in the world by AcerbusNoir · · Score: 1

    Can't argue with that.

    There was a time when Sun's (now Oracle) Solaris was considered the swiss cheese of operating systems.

  11. Sad Hacker by sir-gold · · Score: 4, Funny

    Somewhere in the world, there is a hacker crying into his keyboard right now, because MS finally found the hole he's been exploiting for the last 10 years.

    1. Re:Sad Hacker by H0p313ss · · Score: 1

      No hacker, no cry.

      I remember when we used to sit
      In the IRC channel in Trenchtown, yeah...

      --
      XML is a known as a key material required to create SMD: Software of Mass Destruction
    2. Re:Sad Hacker by cyberchondriac · · Score: 1

      I think you meant, "Somewhere in the world, there is a **script-kiddie** crying into his keyboard right now, because MS finally found the hole he's been exploiting for the last 10 years."

      --

      Look back up at my post, now look back down, you're on the Internet. Now look back up. I'm a signature.
    3. Re:Sad Hacker by toddestan · · Score: 1

      The script kiddie would have no idea that the security hole they were exploiting was fixed until they suddenly find out that their l33t hax0r t00lz no longer work.

  12. Re:The most insecure OS in the world by Anonymous Coward · · Score: 1

    And designed to be a security teaching tool.

    Not a production system.

  13. The XP Killer? by bill_mcgonigle · · Score: 4, Insightful

    We've been waiting for that vulnerability that will finally create such havoc on XP that people will abandon it.

    The security bulletin is vague, as usual, but it does say:

    A remote code execution vulnerability exists in how Group Policy receives and applies policy data when a domain-joined system connects to a domain controller. To exploit this vulnerability, an attacker would have to convince a victim with a domain-configured system to connect to an attacker-controlled network.

    An attacker who successfully exploited this vulnerability could take complete control of an affected system and then install programs; view, change, or delete data; or create new accounts with full user rights. The security update addresses the vulnerability by improving how domain-configured systems connect to domain controllers prior to Group Policy accepting configuration data. ...

    Although Windows Server 2003 is an affected product, Microsoft is not issuing an update for it because the comprehensive architectural changes required would jeopardize system stability and cause application compatibility problems. Microsoft recommends that security-conscious customers upgrade to a later operating system in order to keep pace with the changing security threat landscape and benefit from the more robust protections that later operating systems provide.

    Which would seem to put the XP/2003 lineage one malware download away from connecting to a botnet that spoke just enough Domain protocol to exploit it and being pwned.

    NSA could have such an exploit ready next week, Russian mafia in a month. The Prize is controlling close to 19% of the installed base.

    --
    My God, it's Full of Source!
    OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
    1. Re:The XP Killer? by Dwedit · · Score: 4, Funny

      Everyone runs Admin on XP anyway, so privilege escalation is less of a problem than it could be.

    2. Re:The XP Killer? by tlhIngan · · Score: 4, Informative

      We've been waiting for that vulnerability that will finally create such havoc on XP that people will abandon it.

      It only affects domain-joined PCs. If you're running XP Home (can't join a domain to begin with), then it really doesn't affect you.

      It's a basic downgrade attack - similar to how those TLS bugs were done. You force the client and/or server to revert to an older less secure authentication protocol and then use that to get your way in.

      And most businesses have moved off XP.

    3. Re:The XP Killer? by skids · · Score: 1

      1) Are members of an 'active domain' (i.e. corporate machines). ...Microsoft's bread and butter...
      2) Are connecting to an exploited domain server. ...no, they just have to be in a place that a fake domain server can forge packets pretending to be from the real one.

      Given the state of ethernet security these days (some vendors even still sell brand spanking new switches without ARP/IP validation features) that is not a hard environment to find.

      --
      Someone had to do it.
    4. Re:The XP Killer? by antdude · · Score: 1

      Are there still that many business using old Windows XP Pro SP3 with domain connections?

      --
      Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
  14. Patching is NOT ENOUGH by jeffasselin · · Score: 5, Informative

    One very important part of this latest vulnerability is that patching your systems is NOT ENOUGH. The patch is not so much a fix as an entirely new security functionality which must be configured properly.

    It is required to configure a group policy to harden your systems. Any domain-joined system must have both the patch installed and a group policy setup to force the system to use secure authentication and validation mechanism on any sensitive share. Domain shares such as NETLOGON and SYSVOL are an obvious priority, but any share used for software deployment or script execution must be similarly listed.

    Make sure you read the KB article and take the proper steps to secure your systems:

    https://support.microsoft.com/...

    --
    If he explores all forms and substances Straight homeward to their symbol-essences; He shall not die.
    1. Re:Patching is NOT ENOUGH by skids · · Score: 1

      Well, considering this is an MITM attack that targets a service that is typically only used on private internal networks (That likely use switches), or computers connected to one over VPN this is a bit less serious.

      You vastly overestimate the competency of corporate LAN departments. When the LAN is not properly hardened, and it very often isn't, all you need is one owned box/printer inside the broadcast domain to own all the AD Windows clients in that broadcast domain.

      --
      Someone had to do it.
    2. Re:Patching is NOT ENOUGH by jeffasselin · · Score: 1

      The problem in this case is that there are workarounds allowing you to impersonate a DC. For example, someone could sniff your DNS requests and use ARP poisoning to redirect your requests for GPO files or login scripts to its own servers, and Windows would automatically downgrade its SMB security to connect to this fake DC. This could easily be done to a computer connecting in a remote network, even if its corporate trafic is in a VPN. Read up on this article from the guys who found the vulnerabiltiy:

      https://www.jasadvisors.com/ab...

      One issue which Microsoft also did not mention is how AD-joined Windows systems by default leak a lot of info, and will send out DNS requests for domain resources from ANYWHERE. It doesn't matter that the servers aren't available from the Starbucks WiFi, Windows will still do DNS requests for "domain.local" and try to run "\\domain.local\NETLOGON\logon.bat".

      --
      If he explores all forms and substances Straight homeward to their symbol-essences; He shall not die.
  15. Re:This is your computer on Windows... by gstoddart · · Score: 2

    I bet they didn't so much design an exploit, as design another feature, implement it as designed ... and the discovered they'd made a gaping hole.

    I suspect at this point the code is so complex they don't even know what it does any more.

    --
    Lost at C:>. Found at C.
  16. Re:This is your computer on Windows... by courteaudotbiz · · Score: 2
    Bricking an OS? It's just like the guy don't actually know what a brick is. Bricking something is to break an actual object to the point where its only use is to be a doorstopper. Thie is the Urban Dictionnary quote:

    brick
    As verb: to brick something. This is the action of rendering any small-medium size electronic device useless. This can happen whilst changing the firmware, soldering or any other process involving either hardware of software.

    I bricked my mobile phone when I tried to install Linux on it.

    Haha! "When I tried to install Linux on it". Sounds funny reading that thread...

  17. Fancy Vulnerability Name by organgtool · · Score: 2, Funny

    Why is it that this bug doesn't have a fancy name like Heartbleed and Shellshock? Given that this bug will allow an attacker to completely dominate the target machine, I recommend the name "Skullfuck".

    1. Re:Fancy Vulnerability Name by jones_supa · · Score: 2

      Actually the vulnerability has been nicknamed "JASBUG". JAS Global Advisors founder Jeff Schmidt cooperated with Microsoft to fix the bug behind the scenes during 2014, while he was working an engagement with ICANN.

    2. Re:Fancy Vulnerability Name by ihtoit · · Score: 1

      Seconded. I'm surprised nothing called "Skullfuck" has hit the security newswires to date...

      --
      Political debates have me rolling my eyes so much I think I got optical whiplash. I should sue. - Foamy The Squirrel
    3. Re:Fancy Vulnerability Name by BronsCon · · Score: 1

      Damn, sad to hear that... WindowPain would have been a better fit. That or Glasscutter since, you know, it lets pretty much anyone cut a huge hole in Windows.

      --
      APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
    4. Re:Fancy Vulnerability Name by freeze128 · · Score: 1

      Maybe they should have called the patch "ICANN FIXIT".

  18. Re:This is your computer on Windows... by ihtoit · · Score: 2

    you mean like the desktop gadgets gadget? Yeah, I discovered yesterday while trying to install a lunar cycle widget that MS had deprecated the entire project, saying basically "Oh, we'd discovered that what we'd actually done was enable any old Joe Scumbag to completely own your computer via a widget you might actually find useful like live weather or news tickers".

    So why the fuck is it still in my desktop context menu!?

    --
    Political debates have me rolling my eyes so much I think I got optical whiplash. I should sue. - Foamy The Squirrel
  19. Re:This is your computer on Windows... by ihtoit · · Score: 1

    I think most phones that don't actually come with Linux (read: Android) installed will actually brick when you try to install Linux on them, because the kernel simply isn't designed for the architecture.

    --
    Political debates have me rolling my eyes so much I think I got optical whiplash. I should sue. - Foamy The Squirrel
  20. Re:The most insecure OS in the world by Archangel+Michael · · Score: 5, Insightful

    True. But Adobe already creates exploits for all the other OSes in the world, so they don't need to actually create an unsecured OS.

    --
    Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
  21. Re:The most insecure OS in the world by ihtoit · · Score: 1

    uh... DVLinux is a security training tool and sandbox for SELinux component testing, not a production desktop platform.

    --
    Political debates have me rolling my eyes so much I think I got optical whiplash. I should sue. - Foamy The Squirrel
  22. Re:The most insecure OS in the world by The-Ixian · · Score: 3, Interesting

    Yes, as much as I hate to admit it, I have had WAY more Linux servers exploited than Windows servers.
     
    I have set up hundreds of Windows Small Business servers and less than half as many production Linux servers. I only recall having 1 Windows server exploited, and that was because the customer set up an admin-level user with an extremely simple password and then opened RDP to the world.
     
    On the other hand, I have had several Linux servers exploited via ProFTPD, Horde, Sendmail and other vulnerable services.

    --
    My eyes reflect the stars and a smile lights up my face.
  23. Re:The most insecure OS in the world by Anonymous Coward · · Score: 1

    As much as I hate to say it, that is not a Windows exploit, but a PEBKAC issue...

  24. Re:Russian Mafia Re:The XP Killer? by Anonymous Coward · · Score: 3, Interesting

    Let me suggest another scenario:
    NSA have had the exploit for years since they asked for it to be put there.
    It was only removed just now since the Russian Mafia found and started to use the exploit.

  25. Re:Just you wait... by BronsCon · · Score: 1

    Well, of course! All the hackers use Linux and other Open Source software because they don't want to be vulnerable to the same exploits they're using! Damn Linux! :P

    --
    APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
  26. Re:The most insecure OS in the world by Anonymous Coward · · Score: 2, Insightful

    Its all about attack surface bro.

    Those windows SMB servers you likely firewalled away from the internet, zero exposed (inbound) services. They're only used to provide services to systems on the local network. Maybe you have SMTP exposed for inbound mail. (Today, though, running your own exchange server(s) for anything smaller than an enterprise is for suckers. Much cheaper to purchase hosted exchange service, and you don't have to deal with your IP blocks being blackholed)

    Those linux servers, on the other hand, were probably internet facing. Providing services anyone on the wild wild interwebs could hammer. If you put those windows servers in the same situation you'd see them pwnd too.

  27. Re:The most insecure OS in the world by sinij · · Score: 2

    Yes, but GPP did not specify "a production desktop platform". My point was that blanket "X OS is the most insecure" statements are largely pointless. With enough effort and expertise you could secure any OS, or you could exploit any OS, even when airgaped. With enough ignorance you could misconfigure even the most secure OS. The devil is in the details.

  28. Re:It could've been worse ... oh wait.... by Anonymous Coward · · Score: 1

    Yeah, fucking capitalist assholes! Forcing people to upgrade to one of the last few versions of their operating system!

    I mean EVEN Debian still makes security packages for Potato and Woody! ... right?

  29. Re:The most insecure OS in the world by Archtech · · Score: 2

    "True, but only because Adobe never made an OS".

    A man's gotta know his limitations. And they do.

    --
    I am sure that there are many other solipsists out there.
  30. Re:The most insecure OS in the world by westlake · · Score: 2, Insightful

    Windows - the most insecure OS in the world. There are probably more viruses, malware and ransonware than actual apps.

    I doubt it.

    Download.com alone hosts over 51,000 Windows apps. Search Results for all Windows, Sourceforge, 16,000, 2,200 certified Fresh.

    Amazon.com 22,000 for retail sale. PC Software

    You could make a very strong case for Android being the most insecure, incompetently planned and managed OS in the wild.

    Google's position is complicated, because it has produced a platform that it has no power to update. There's no Windows Update for Android phones, and Google has no ability to push out updates to the operating system; it has to depend on a range of OEMs and network operators to adopt its source code changes and distribute them to users. Both Apple and Microsoft, in contrast, have a direct channel to update their mobile operating systems.

    Google won't fix bug affecting 60 percent of Android users

  31. KB3013455 by Old+Aylesburian · · Score: 1

    After successfully forcing the machine to reboot into safe mode last night (to stop a perpetual cyclic restart) I found that the screen fonts were being incorrectly rendered to the point of being unreadable. Hours later it turned out to be KB3013455, now uninstalled. Today several sites say that this affects Vista and several flavours of Windows Server.

    1. Re:KB3013455 by Old+Aylesburian · · Score: 1

      To be fair the problem may have been caused by a local configuration e.g. I have many fonts and work in three scripts, one of which is right-to-left. The testers might simply have overlooked that particular case. OTOH...

  32. Just so I understand by WaffleMonster · · Score: 1

    Everywhere I look people still blissfully using completely insecure authentication methods for VPN access effectively broadcasting plaintext passwords to anyone snooping the wire... but hey at least if someone tricks you into connecting to their evil network Microsoft has your back.

    Would love an education how this bug is worthy of mention while other much more egregious issues such as true type vulnerabilities affecting anyone who browses to an attacker controlled website were also patched.

    1. Re:Just so I understand by Gunstick · · Score: 1

      on patch day, not only the trutype thingie got fixed, but 35 other remote code executions in MSIE.
      thirtyfive!
      Shows code quality.

      --
      Atari rules... ermm... ruled.
  33. Re:The most insecure OS in the world by VGPowerlord · · Score: 3, Informative

    True, but only because Adobe never made an OS

    A man's gotta know his limitations. And they do.

    Funny story... Oracle (née Sun) makes an Operating System.

    --
    GLaDOS for President 2016! "Well here we are again. It's always such a pleasure." -- GLaDOS, 2011
  34. Looks like the bug was in credential sharing by 140Mandak262Jamuna · · Score: 1
    The fine article is quite skimpy on the details about who is vulnerable. Throw in a little "If attacked" at the beginning of the sentence and then tack on all sorts of scary things. Sort of like, "If zombies were real." then write a whole host of scary things.

    From what I could make out, the bug is in credential sharing across a network. If some computer configured to be part of remotely administered network "joins" the network controlled by the attacker, then the attacker can get admin privilege. Most home computers and small business computers are locally managed not remotely managed. So medium to large company computers which are typically administered by dedicated IT departments are at risk. To be at risk this computer must be persuaded to "join" another network controlled by the attacker. It involved editing the workgroup/network setting of the computer. So it would involve some social engineering to get the user to run a malware trojan, a script or an executable to change the settings. But, at that point, once they run a trojan, you can't help them.

    Looks like the bug is in networked machines sharing credentials.

    --
    sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
    1. Re:Looks like the bug was in credential sharing by skids · · Score: 1

      So it would involve some social engineering to get the user to run a malware trojan

      Not even wrong. Any machine joined to a domain can be tricked into believing another machine is the server in that domain, and then that other machine installs a new group policy disabling all the protections set up by the legitimate domain admin. No social engineering required, just a way to successfully deliver forged packets or poison DNS.

      --
      Someone had to do it.
  35. Patch breaks Cisco Anyconnect VPN client too by Kernel+Kurtz · · Score: 2

    Cisco opened a priority 1 case with Microsoft yesterday as soon as we found out about this issue. We are continuing to escalate this issue with Microsoft for a resolution timeframe. We recommend that all customers open their own cases with Microsoft since the ultimate fix will need to come from them. You can feel free to reference Cisco's case # which is 115021112390273 in order to expedite having your ticket properly triaged by their support team.

    https://supportforums.cisco.co...

  36. Re:It could've been worse ... oh wait.... by davidwr · · Score: 1

    I mean EVEN Debian still makes security packages for Potato and Woody! ... right?

    I don't know if Debian does or not (I'm going to assume not based on your tone), but at least Debian's customers have everything they need (except maybe skill and time) to fix it themselves.

    Microsoft customers? Not so much.

    --
    Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
  37. Re:The most insecure OS in the world by Ravaldy · · Score: 1

    Also the most popular hence the attrition to it's security flaws.

  38. Comment removed by account_deleted · · Score: 1

    Comment removed based on user account deletion

  39. Comment removed by account_deleted · · Score: 1

    Comment removed based on user account deletion

  40. Comment removed by account_deleted · · Score: 2

    Comment removed based on user account deletion

  41. Re:It could've been worse ... oh wait.... by Anonymous Coward · · Score: 1

    And realistically, how many people are going to do that instead of just upgrading to a distro from the last decade?

  42. Re:The most insecure OS in the world by dfsmith · · Score: 1

    You don't count PostScript as an OS? It's so much more than a language....

  43. Re:This is your computer on Windows... by msobkow · · Score: 1

    I found this article particularly amusing seeing as I'm not done re-installing my Windows 7 box from the latest attack to take it out from a couple of days ago. I don't even use the box for surfing or email; just for running database servers, builds, and playing internet media.

    So it's got about the smallest attack surface you could imagine -- and it still has never survived more than 2 years without being nuked. None of my Windows boxes ever has.

    --
    I do not fail; I succeed at finding out what does not work.
  44. Windows XP? by fluor2 · · Score: 1

    Is Windows XP affected?

    1. Re:Windows XP? by Gunstick · · Score: 2

      yes. and not patched.
      like windows 2003, which is stull in support, but so badly designed that a patch is not possible.

      --
      Atari rules... ermm... ruled.
  45. Re:The most insecure OS in the world by Zaiff+Urgulbunger · · Score: 1

    Windows - the most insecure OS in the world.

    True, but only because Adobe never made an OS.

    True. But Adobe already creates exploits for all the other OSes in the world, so they don't need to actually create an unsecured OS.

    AFAIK no Adobe software even runs on Raspberry Pi, but never-the-less, flash can crash it. The mere "aura" of Adobe can break things! :D

  46. Re:The most insecure OS in the world by nuckfuts · · Score: 1

    The security of an operating system should be judged by its default configuration, not by how insecure it is after you've installed a bunch of 3rd party apps. Even a security-oriented OS like OpenBSD can't prevent other people from doing insecure things to it.

  47. Re:No patch for XP by CaTfiSh · · Score: 1

    That's mighty cavalier of you, but the fact remains that exploited machines affect the rest of us as well.

  48. Re:It's funny... by toddestan · · Score: 1

    Did you manage to sleep through the big new stories the past year about 'Heartbleed' (OpenSSL) and 'Shellshock' (bash)?

  49. Re:It's funny... by Gunstick · · Score: 1

    and glibc "ghost"
    oh wait...
    that one was mostly a publicity stunt from the security company.

    --
    Atari rules... ermm... ruled.
  50. Re:This is your computer on Windows... by tjbutt58 · · Score: 1

    Probably a developer's backdoor. There was allegedly a /etc/passwd backdoor propagated through gcc for many years - a truly legendary hack. Developers like to leave these so they can back in if something goes wrong (putting a benign spin on it). I've brok a pam config before and wished I had a backdoor...