Patch Tuesday Brought Windows 10 Ad Generator

jones_supa writes: Microsoft has been very aggressive on getting Windows 7 and 8 users to upgrade to Windows 10. The company has introduced a "Get Windows 10" system tray icon, moved the upgrade to "recommended" category in Windows Update, and even initiated the OS download automatically. The latest trick is almost comical: KB3139929 is an actual security update for Internet Explorer, but it also deploys a trojan horse, KB3146449, which is an advertisement generator for Internet Explorer. On computers not joined to a domain, it adds a blue banner when a user opens a new tab, saying "Microsoft recommends upgrading to Windows 10".

Comments

GWX Control Panel blocks all the annoying prompts

[Archtech]

GWX Control Panel is your friend. http://ultimateoutsider.com/do...

(I have no interest in, or connection with this free utility).

Re:Calling it a Trojan Horse is a bit much

[war4peace]

Here's what's really sad:
It all started with this Infoworld.com article. There's no definitive proof that "On computers not joined to a domain, it adds a blue banner when a user opens a new tab, saying "Microsoft recommends upgrading to Windows 10"."
I checked my Windows 7, windows 8 and windows 8.1 VMs. All have the update. None exhibit the behavior presented above.
None of the other machines I managed to check (which I don't own) exhibit the behavior.
There is no screenshot I could find online that shows the blue banner.
This seems to have blown out of proportion based on ONE single article which might just as well be a load of bullshit, and Slashdot is making it even worse.
What the fuck has /. become, Faux News?

Re:If you are using IE, that's what you get

[Anonymous Coward]

Really. Care to explain how you're less secure on two operating systems that are still receiving support and patches vs their new adware delivery platform?

Specifics please.

Specific Win10 security improvements include:

- Improvements to address space layout randomization (ASLR), Data Execution Prevention (DEP), the heap architecture, and memory-management algorithms reduce the likelihood that vulnerabilities can enable successful exploits.
- Protected Processes isolates nontrusted processes from each other and from sensitive operating system components.
- VBS, built on top of Microsoft Hyper-V, protects sensitive Windows processes from the Windows operating system by isolating them from user mode processes and the Windows kernel.
- Configurable code integrity enforces administrative policies to select exactly which applications are allowed to run in user mode. No other applications are permitted to run.

RTFA

[Zalbik]

Or for those who RTFA, perhaps it DIDN'T include an ad spamming "trojan horse":

I spent most of the night trying to replicate this behavior -- a blue banner on new tabs in IE11 with "Microsoft recommends upgrading to Windows 10" -- and couldn't get it to trigger.

Re:If you are using IE, that's what you get

[Dunbal]

You can't - unless you pirate it. If I recall correctly, the "condition" of the free upgrade is they invalidate the key to your previous version. It's Windows 10 or nothing, suckers! There's no going back!

Re:Keep pushing...

[Anonymous Coward]

You're so tough. How about you stop talking and change to a damn free platform already? "But I need my gaming"-tards.

Re:Calling it a Trojan Horse is a bit much

[Anonymous Coward]

Really?

https://support.microsoft.com/de-de/kb/3139929#bookmark-nonsecurityfix

Scroll down to "non-security related fixes", last table entry: 3146449 Updated Internet Explorer 11 capabilities to upgrade Windows 8.1 and Windows 7
From there look up 3146449: https://support.microsoft.com/de-de/kb/3146449

"This update adds functionality to Internet Explorer 11 on some computers that lets users learn about Windows 10 or start an upgrade to Windows 10. Before you install this update, see the Prerequisites section. For more information about Windows 10, see Windows 10."

Security and privacy are not equivalent

[NoImNotNineVolt]

I generally help pile on the Microsoft hate along with the rest of slashdot, but I'd like to point out that security and privacy are two distinct concepts. You've listed privacy implications that have little bearing on security. Your third point is the only one that is a potential security hole, but even that's a bit of a stretch, as the ads displayed by Microsoft are likely vetted quite a bit more thoroughly than what you see with a typical ad network.

Re:If you are using IE, that's what you get

[Anonymous Coward]

Not quite true. You *can* go back with a clean or image reinstall, but will have to negotiate with the phone drones to reactivate.

Re:If you are using IE, that's what you get

[Anonymous Coward]

You can roll back up to 30 days after Win 10 install. I did it, no problems with activation.