Slashdot Mirror
BadTunnel Bug Hijacks Network Traffic, Affects All Windows Versions (softpedia.com)
An anonymous reader writes: Microsoft has just patched a vulnerability that affects all Windows versions ever released. Called BadTunnel, the security flaw allows attackers to pass as a WAPD or ISATAP server and intercept all network traffic. Exploitation is trivial and firewalls are natively designed to open the port through which the attack is carried out. BadTunnel can be triggered whenever the user clicks URI or UNC links/paths in Office files, IE, Edge, or other applications that support the URI/VNC scheme (and most do). Additionally, an attacker can carry out his attack from the other side of the world, and does not need to have a foothold on the victim's network. While recent Windows OS versions received patches, exploitation points remain open for non-supported Windows operating systems such as XP, Windows Server 2003, and others. For these operating systems, and for those that can't be updated just yet, system administrators should disable NetBIOS.
Probably not....
16 bit software will save the day again.
The 1% of you can thank me later:
Wow! And to think, Windows 1.0, 2.0 and 3.0 didn't have any networking support! Yet they somehow have bugs that allows diverting network traffic that they don't and can't generate!
Windows 3.11 was the first to include networking, and I'm going to bet it wasn't affected, either.
Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant
For the life of me I can't figure out why all of these tunneling/transition protocols are enabled by default in Windows. Who uses automatic IPv6 transition schemes in 2016? They certainly are not now nor have they ever been sufficiently reliable for production use and TTL for IPv6 amateur hour has long since expired. Why is this worth the massive security headaches these things invite?
Have a script that I run on any new windows boxes. Part of it does the following.
netsh interface teredo set state disabled
netsh interface isatap set state disabled
netsh interface 6to4 set state disabled
I'm honestly perplexed and dumbfounded why Microsoft is (still) doing this.
People still use it?
I'm sorry but I'm done with Microsoft patches. If hackers want to watch me play CS:GO or post on slashdot they're welcome to do it, but I won't risk Microsoft's definite installation of spyware.
Seven puppies were harmed during the making of this post.
I suddenly was unable to access popular websites recently, replaced by "WARNING. The web page has been blocked. Please CONTRACT (contact +R) your administrator." for most pages like google, apple, big pages. Smaller pages, subpages loaded as if javascript were disabled, like it was being stripped out of my http session or something. I have screenshots that can document this. I thought "ok, you've been hacked for sure now, wtf did I download recently.." but I couldn't think of anything and I scanned backwards to front in safe mode, etc. Nothing. I rebooted my router with a new address and got a new IP from the ISP and suddenly everything's back to normal. Now I wonder.
XP out of the box (even with all patches) doesn't even have IPv6. Neither does windows 2003.
You have to go to the trouble of manually adding IPv6 as a protocol.
And it isn't WAPD, it's WPAD (Web Proxy Auto-Discovery).
I tend to use a philosophy of "less is more"
That's why you have a multi megabyte host file right?
Also. Bing? Really?
"Freedom in the USA is not the ability to do what you want. It is the ability to stop others from doing what THEY want"
Proof that he's a completely incompetent tool, if he's using Bing.
I'm assuming that's a typo in the summary, that "URI/VNC" should read "URI/UNC".
firewalls are natively designed to open the port
My firewalls don't open any ports without me saying so.
Some of that looks dated; I don't have time to read it all now, but skimming through, the gist looks good. I'll check out the rest tomorrow. Maybe this is what you should be promoting instead of a 3 million line hosts file, especially if you can bring it modern to include steps for Windows 7/8. No sense trying to write a guide for 10, as there's no securing 10 no matter what you do.
Looks like Whipslash is failing in stopping APK bullshit.
... from softpedia, about microsoft. Either/or, really. Getting a better news source would be a good start, editors.
See subject: & use Port Filtering (@ IP stack level + in routers combined) allowing ONLY ports you absolutely need (in my case, 80/8080/443/53) in security guides I put out online HOW TO SECURE WINDOWS 2000/XP http://www.bing.com/search?q=%...
1st in 1996-1997 & later more complete models in 2006 that go way, Way, WAY beyond "std. fare" security suggestions by far!
* "Closing doors" or "bolting them shut permanently as possible" works & it's less to have to watch as well...
(I.E. - Running services of ANY KIND you don't need = risk you take...)
APK
P.S.=> Security CAN be pretty 'simple' - I tend to use a philosophy of "less is more" & use what you already have natively vs. "Bolting on 'MoAr'" illogically (especially when it has massive holes in it for excess complexity that will lead to those holes eventually when a tech's NOT proven over time)... apk
"Firewalls won't stop the attack, because UDP is a connectionless protocol. We are using it to establish a tunnel. That is why it be named 'BadTunnel'," Yu explains.
My border firewall certainly stops this attack from outside the network since it does not allow IP protocol 41 which is used by ISATAP.
Submitter doesn't understand firewalls either:
firewalls are natively designed to open the port through which the attack is carried out
That's may be true of the built-in Windows firewall, but it is not generally true for other ("real") firewalls.
Agree! I am trying to decide whether to allow Windows Update on my precious Windows 7 laptop which I finally bought for work after having been subject to Windows 8 crap (I'm trying to avoid the freshly-crapped Windows 10 with which one co-worker was saddled). Never thought I'd ever actually type the sequence of characters "precious Windows" in my lifetime, but after a lot of looking, I found a laptop Dell was selling that still had Windows 7 (Dell Vostro); it comes with a "Recovery CD-ROM" that installs Windows 8, so if my Windows 7 installation ever craps out, I'll have to be dragged screaming and kicking back into the Windows 8+ world.
As soon as I got wind of Microsoft's "We'll upgrade you to Win10 for free! Whether or not you like!" scam, I disabled Windows updates. Now I have to figure out whether I want to get Win7 updated to protect me from this vulnerability, and risk having the entire system turned into a Win10 system. :sigh:
404555974007725459910684486621289147856453481154 in hex is "You sank my Battleship?"
[GPG key in journal]
. it comes with a "Recovery CD-ROM" that installs Windows 8, so if my Windows 7 installation ever craps out, I'll have to be dragged screaming and kicking back into the Windows 8+ world.
Tip: A disk-image is your friend here. Make one of your (as) clean (as possible) system and you're golden. Or put Linux on it, but I get the impression that is not possible for your work. Making a disk image with a (Live) CD should not be that hard.
See subject: CIS Tool for 7 (they took 3 of my suggestions to improve it) = fine (see ps below) & I don't CONSIDER 8/8.1/10 "windows" but an advertising-spying platform w/ a dumbed-down 'crippled' interface.
Hosts program's been my 'focus' 2013 on - others can "take the ball" on security guides!
It's NO "3 million line" hosts file - my PERSONAL one crosses almost 4++ million but I don't hand it out to everyone!
Mine tests how BIG I can grow it before perf hits (has stale entries but program allows purge by reverse DNS w/ a downside (servers can set ICMP replies off deceiving it). Hardcodes @ top avoid it as I spend a GOOD 95++% of my time @ them vs. meandering - what MOST do like w/ TV channels)
Others can build their own via my program (w/ current data - MOST important type) - MOST you get initially ~ 250k lines
APK
P.S.: Dated iirc = AdBlock & MS removed PortFilters @ IP stack (how you did 'em in 2000/XP) + services 8-10 past 7 turned off vs. auto
Is there a source for this besides softpedia, because everyone reporting on it refers to that article.
Given how many "stealth Win10 install" patches are lined up in all our "windows updates" notifications, and that plenty of people on /. and elsewhere have stated clearly they've just plain shut down all updates rather than try to weed out the crapware ones, it's pretty clear this vulnerability will remain on plenty of machines for a long time.
https://app.box.com/WitthoftResume Code: https://github.com/cellocgw
This. Standard IT practice: if you're going to nuke the system for some reason (installing a new OS *is* nuking the system) make a full set of backups including an image before starting. I had to use the image to revert to Win7 after Win10 messed up on one computer out of the 4 in the house (the laptops are running 10 fine).
As for the updates: in Windows 7 updates are still a la carte, and you can review them before downloading. And it's not all (automatic) or nothing (off). Instead of turning them off entirely, set them to notify you before downloading; that still works to keep Win10 off your system as long as you don't allow the updates that are related to it (I think about 10 of them now). Install GWX Control Panel and lock down against Win10 (Never10 does it too), enable GWX's "monitor" mode to catch anything you miss, then look at the updates. Most "Important" updates that are labeled "security" updates, and this is one of them, are OK, but check each anyway for evidence of relation to Win10 or "enhancing the upgrade experience" or "checking compatibility" or terms like that. Be aware that one of the recent IE cumulative updates (which ARE needed) includes a nag to get Win10 though it doesn't actually download it - but who uses IE any more anyway? Yes, it's a little more work, and if you're a business with a bunch of computers you may need other options.
NetBIOS was always a bit of a hack anyway. We shouldn't be using it anymore, period. An internal DNS is enough and easy to setup.
"Imagination is more important than knowledge" - Einstein
I tend to use a philosophy of "less is more"
Actually, less is more than more.
Just ask any csh jock.
https://app.box.com/WitthoftResume Code: https://github.com/cellocgw
Just grab the .msu file for this fix & for your specific OS (e.g. Win7x32 or Win7x64 or whatever) and apply it manually.
That's what I do with my systems. I save the important ones in case I have to reinstall from scratch.
Go be cancerous somewhere else.
There's a reason YOU have to post anonymously all the time.
"... said the truly anonymous coward hypocrite pot calling a kettle black..." while not using your FAKE NAME online (the testament to your "ne'er-do-well" life itself) hahaha!
See subject: That's a good question & I asked it myself - answer is "so it all 'just works'" right outta the box + whether you use it, or not - which also probably makes for LESS support calls like "why isn't (insert X here) working?"...
* Which is the "why" of WHY I popped this guide together https://news.slashdot.org/comm...
(...& the philosophy's MUCH like what you expound (less is more)).
APK
P.S.=> Leaving 'doors' open = dumb, & I agree w/ where you're coming from... only diff. between us really? Is that I put that out there for others (especially 'less saavy' others in 'things networking/security') but I had the SAME thoughts on the matter you do... I truly DO suspect the reason MS does it. is what I wrote above... apk
See subject: That's why there's no stopping it (or me) - & what I post on (as of late, hosts & my program for them) HELP ALL OF YOU/US in many ways + for considerably less minus security issues galore other "so-called 'solutions'" added on vs. using hosts/what you natively have that's proven, DO have (bad ones & many of them).
APK
P.S.=> I invite my naysayers to do something better OR to validly technically prove me wrong on my points on hosts - neither has EVER happened to date (since 2012 when I put it out for public consumption/use, gratis)... apk