Slashdot Mirror
As World Reacts To WanaDecrypt0r, Microsoft Issues Patch For Old Windows Systems (bleepingcomputer.com)
An anonymous reader quotes the AP:
Teams of technicians worked "round the clock" Saturday to restore hospital computer systems in Britain and check bank or transport services in other nations after a global cyberattack hit dozens of countries and crippled the U.K.'s health system. The worldwide attack was so unprecedented that Microsoft quickly changed its policy and announced that it will make security fixes available for free for older Windows systems, which are still used by millions of individuals and smaller businesses. [Windows XP, Windows 8, and Windows Server 2003]
An anonymous reader writes: The patches are available for download from here. Microsoft also advises companies and users to disable the Windows Server Message Block version 1 protocol, as it's an old and outdated protocol, already superseded by newer versions, such as SMBv2 and SMBv3... Microsoft had released a fix for that exploit a month before, in March, in security bulletin MS17-010 [which] included fixes for Windows Vista, Windows 7, Windows 8.1, Windows 10, Windows Server 2008, Windows Server 2012, and Windows Server 2016.
Below the fold are more stories about the WanaDecrypt0r ransomware.
An anonymous reader writes: The patches are available for download from here. Microsoft also advises companies and users to disable the Windows Server Message Block version 1 protocol, as it's an old and outdated protocol, already superseded by newer versions, such as SMBv2 and SMBv3... Microsoft had released a fix for that exploit a month before, in March, in security bulletin MS17-010 [which] included fixes for Windows Vista, Windows 7, Windows 8.1, Windows 10, Windows Server 2008, Windows Server 2012, and Windows Server 2016.
Below the fold are more stories about the WanaDecrypt0r ransomware.
- The Los Angeles Times says the attack "shows why Apple refused to hack terrorist's iPhone," and why Google, Apple, and Microsoft resist calls for backdoors. "Though the NSA hasn't confirmed it was hacked, the purported leak of its tools shows that even supposedly secret vulnerabilities can get into the wrong hands.... when flaws the agencies discover pose a threat to the nation's businesses and consumers, they should be forced to help secure systems."
- Science fiction writer Charlie Stross blogged a humorous take on the event, sharing a "Rejection Letter" from Reality Publishing Corporation that argues the plot of his newest thriller -- MS17-010 -- "does not hold up to scrutiny." (A government agency hoards known vulnerabilities about vital infrastructure, then suddenly loses control of them...)
- troublemaker_23 shares ITWire's call for a "public statement of contrition" from Microsoft, which reminds readers that "the ransomware and exploits are just the effects. The vulnerabilities in Windows are the cause."
- There's now a first-person account about the discovery of the kill switch, which insists that registering that domain "was not a whim. My job is to look for ways we can track and potentially stop botnets..."
- Slashdot reader Lauren Weinstein says some antivirus services (and firewalls incorporating their rules) are mistakenly blocking the kill switch's site as a 'bad domain', which allows the malware to continue spreading. "Your systems MUST be able to access the domain above if this malware blocking trigger is to be effective, according to the current reports that I'm receiving!"
I, for one, welcome our new Cylon overlords.
Corruption is convincing someone that the selfless ideal is the same as their selfish ideal.
At the moment, we are just lucky. The next version of this malware will have a 'format c:' switch.
They truly are a reborn company.
N....S.....A
N....S.....A
dun dun dun dunna
N....S.....A
Am I safe to assume that since I don't have the Server Service or Workstation Service running that I'm safe from this particular exploit?
At my job we finished phasing out the Windows XP and Windows Server 2003 systems from the network last year, the few Windows 8 tablets we have in test are Windows 8.1, and everything else is up-to-date with the latest patches. While the rest of the world burned, it was a quiet Friday as everyone took off for the weekend..
For an ancient unsupported version of their product. Make sure you put that into your narrative.
Lots of people on the net would support the product, if Microsoft allowed them to.
The fact that it's unsupported is a dodge - in reality, Microsoft comes out with new products and forces people into them in order to make more profit.
And in this instance, the "forced upgrade" policy is causing people to die. it's completely unreasonable for people with expensive equipment running Windows XP to have to repurchase their hardware just because Microsoft wants them to spend another $100 for a new OS.
If the OS is truly obsolete and unsupported, Microsoft should release it into the public domain.
That's why I disabled Windows Update on them, because that situation was untenable. I tried many proposed fixes I found on different fora, but nothing worked.
Granted, they are relatively safe, because these installations only exist to provide me a Windows when I need one (read: next to never) and the rest of the network is Linux and BSD. Being task-oriented with use-cases that don't involve email and random surfing, they are quite a bit safer than your run-of-the-mill Windows 7 that suffer from eternal Windows Update runs.
Ahhh...the great dumpster continuum. Many a free computer will be found there. -- sowth (748135)
The scan to folder functions on some copiers haven't upgraded their SMB yet, so they cannot save scans to folders without SMBv1. Your choices are get a new copier (or copier with different vendor), enable SMBv1 on the server (bad idea), or use FTP (bad but not as bad idea). I've come across servers that had SMBv1 enabled just for this. One copier vendor wanted major cash to get the latest firmware. WTF? I've had good luck with Toshiba and Xerox. Sharp and Ricoh can kiss my ass. Forums are filled with "techs" advising to enable SMBv1 on the server. Yikes!
Switch around the names of the perpetrators and reread the plot.
As much as I like to complain about micro$oft, I'm hard-pressed to fault them for this event, and certainly can't fault their response to it.
I'd say most of the blame lies on the staff and, more so, the policies at the institutions where the event occurred. Government and healthcare orgs are notoriously slow to update mission-critical systems, and while some of this blame can be placed on their reliance on custom software built for old environments or a lack of funds for upgrades, at the end of the day all institutions had been given the same end-of-service deadline, and a majority of them cleared it.
Hospitals are far from the only organisation to rely on frequently-antiquated specialty software and embedded devices, but they are perhaps the most critical example.
Microsoft recommends to update to a supported version of their Windows. But it does not say that such update will be free of charge. If your data gets encrypted, pay to recover them. Otherwise... pay if you don't want them encrypted in the first place.
What is the difference?
It's really sad that even with this, companies (and hospitals, for goodness sake) will not move to more secure platforms...
Oh wait, they deliberately didn't do that .....
Setup cannot update your windows xp files because the language installed on your system is different from the update language. ...
They released the update for Win7 & Vista in March.
If you want to take shots at them, do it on XP/2003. XP was patched in March as well; they just give that update to special customers only. You don't think they qualified all of these updates in 24 hours, do you?
captcha: licensor
Microsoft removed a feature. It did not patch a bug. This was put into all versions of Windows, even those that were supposedly "rewritten from the ground up." It didn't get there by accident.
Remember the xscreensaver debacle?
Took out a few hospitals, and badly affected a few others.. But far from taking out the UK health service.. Most places were just fine.. Though part of that is down to rapid shutting down of the initial vector on an organisational level..
And if the update breaks expensive vertical applications, it won't be Microsoft that foots the bill...
Quidnam Latine loqui modo coepi?
Microsoft in there greed to force everyone to Windows 10 turned of patch's on peoples machines. Shit hits the fan.
MS seems to be sticking with the "this is just SMB1 and shame on you if you haven't shut it off" but others are saying otherwise:
https://securelist.com/blog/incidents/78351/wannacry-ransomware-used-in-widespread-attacks-all-over-the-world/ appears to identify the attack vector as SMBv2.
Anyway, it seems like not being brain dead is the best way to avoid getting burned by this. Make sure your patches are current, make sure you're not running an operating system that hasn't been supported for more than three years now (after being warned that the end was coming for literally twice that long) and of course try to not do retarded shit like open random email attachments from spammers. That ten year old network capable printer/scanner with firmware that can't be updated? Keep putting off its replacement at your peril.
For all of the businesses and hospitals who got smacked up by this, YOU DESERVED IT. There is absolutely no excuse for the level of incompetence required to be running unpatched and non backed up computers that contain critical data. This is criminal level negligence.
perhaps this crack was launched after the death of the writer.
Normally the most likely candidates for cracking are the intelligence services themselves, but unless they all colluded on this one, it is quite big.
Posthumous cracking is only set to get worse as the old IT lot are getting closer to kicking the bucket. And to be fair most people with the technical know how don't crack, not because of some moral or ethical reason, but because they know that tracing is not that hard to do.
Asking about one's skill with editing old code has nothing to do with the need for treating other people ethically by respecting users' software freedoms. Just because you aren't skilled enough to track what's going on in code from week to week doesn't justify denying users the freedom to run, inspect, share, and modify the code running on their computers. Non-technical users (which probably are in the majority) can either learn programming, hire out the job, get someone they trust to help them gratis, or a combination of these things. But the decision should be up to them to make, just as your learning curve is apparently steep enough for you to review week-old code and think it to be "shit".
Digital Citizen
And still no Windows 2000 patch!
From https://view.officeapps.live.c... : "As expected, Enterprise Services revenue declined 1 percent and was flat in constant currency, due to a lower volume of Windows Server 2003 custom support agreements."
I did not even know that Custom Support has to do with MS quarterly earnings until today! I wonder how much it actually costs for MS.