Microsoft Warns of 'Destructive Cyberattacks', Issues New Windows XP Patches (zdnet.com)
Ed Bott, reporting for ZDNet: Citing an "elevated risk for destructive cyberattacks," Microsoft today released an assortment of security updates designed to block attacks similar to those responsible for the devastating WannaCry/WannaCrypt ransomware outbreak last month. Today's critical security updates are in addition to the normal Patch Tuesday releases, Microsoft said. They'll be delivered automatically through Windows Update to devices running supported versions, including Windows 10, Windows 8.1, Windows 7, and post-2008 Windows Server releases. But in an unprecedented move, Microsoft announced that it was also making the patches available simultaneously for manual download and installation on unsupported versions, including Windows XP and Windows Server 2003. The new updates can be found in the Microsoft Download Center or, alternatively, in the Update Catalog.
[...] from the job-security-for-non-microsoft-it-workers dept
FTFY
There are no XP updates this month. What the hell is this guy talking about?
It would be nice if either TFA actually linked to the patches.
Seriously ... they literally set the precedent exactly a month ago.
This is great news for the people. Companies of all stripes are going to see that you can't walk away from your products and expect your brand to survive.
Microsoft knows they will suffer the brand damage if they don't release patches they never stopped producing. Now, they can shift the blame to people who don't patch.
and before that, the conficker manual patch for XP.
But I guess you could say it's "unprecedented" since the beginning of this month...
I read 'unprecedented' as 'unusual, since releasing security patches for a product that was long past EOL is unusual. Not many organizations willing to do that and MS should be commended.
Does it add any new telemetry tracking... ahm, "features" to those "obsolete" products?
ELOI, ELOI, LAMA SABACHTHANI!?
XP, the zombie OS that just keeps on going. It is well into its after life now, which according to most religious scriptures lasts forever.
TL;DR
http://www.catalog.update.micr...
Those who can do. Those who can't sue.
All Windows 7 updates have failed on my machine since August last year, and I've tried everything possible to fix the problem, including all Microsoft troubleshooting tools. Every update gets rolled back. It's ridiculous.
I read 'unprecedented' as 'unusual
Except unprecedented is much stronger, it very explicitly means that it's never, ever happened before. If you can point to even a single previous instance, then it's by definition wrong to use it. And since Microsoft recently did release a patch for an EOL product, using it now is plain wrong. Nice by Microsoft, but still wrong. It also makes me wonder how well a "ten more years of security patches" upgrade for Win7 would sell...
adjective
1. without previous instance; never before known or experienced; unexampled or unparalleled:
Live today, because you never know what tomorrow brings
http://i.imgur.com/umG2mN7.png
Yep. Reported right here, one month ago.
and it's not the desktops you should be worried about. It's the ATM's, cash registers, medical/hospital machines, metro/subway kiosks, traffic-light controllers, maybe even devices used by Army field personnel or on Navy ships and submarines (horrors...), uncounted masses of machines in use every day that you'd never guess are running Windows XP with no viable means of upgrading short of scrapping them entirely. XP lived long enough to become the go-to OS for way too much stuff.
Take it easy, Charlie, I've got an Angle...
I read 'unprecedented' as 'unusual
Except unprecedented is much stronger, it very explicitly means that it's never, ever happened before. If you can point to even a single previous instance, then it's by definition wrong to use it. And since Microsoft recently did release a patch for an EOL product, using it now is plain wrong. Nice by Microsoft, but still wrong. It also makes me wonder how well a "ten more years of security patches" upgrade for Win7 would sell...
adjective 1. without previous instance; never before known or experienced; unexampled or unparalleled:
Your point is both correct and pedantic.
How about some god damn links with specific KB numbers?
And not links posted a month ago.
What might be MS's liability if old time XP users sue owing to security issues that don't get patched?
these patches likely are backdoors.
use these to not get pwned they say, use these and defintiely get pwned, as these are from microNSAoft
If you search for "windows XP", the last patch was released in 2014:
https://www.catalog.update.mic...
If you search for "windows XP sp3", then you can find the last patches that were just released:
https://www.catalog.update.mic...
Pedantic, the best kind of correct?
Neutral European here, not a fan of either side.
Good, then either side can kill you with a clear conscience.
Protip: There's no such thing as "neutral" in the real world. Other people's actions will force you to make a choice. Best to make it now when you have options besides death or a concentration camp.
I don't care. I only have a couple of windows machines left and will be changing OS going forward. I won't install anything from MS. They have totally lost any small amount of trust they may have ever had. I've gone as far as removing the update executables so patches can't even be downloaded and installed manually. I don't have anything worth anything on them anyway. No banking/financial or anything else except some old, obsolete games. I'll leave them directly connected to the 'net by high-speed fiber. Let the DDoSing, phishing, and cyberattacks roll!
Pedantic, the best kind of correct?
Technically, yes.
There is no XUL, only WebExtensions...
What about an update-roll up for vista / xp / 7 / 08r2?
It does not need to be an full on SP but just something that is one exe. Vista is very painful to get on the update train after an clean install. 7 is better but an sp3 that is just an update roll up of sp2 is nice to have.
XP for the most part works with the 3rd party sp4 but that will needed a bit of windows update after installing.
Won't that undercut sales on Windows 10? If they don't punish people for the temerity of trying to use what they've already paid for, how will they ever get all the people who refused to "upgrade" to their latest re-release of the same warmed-over shit, over and over again?
Here's the MS article...
https://support.microsoft.com/en-us/help/4025687/microsoft-security-advisory-4025685-guidance-for-older-platforms
Article ID: 4025687 - Last Review: Jun 13, 2017 - Revision: 13
Applies to:
Windows Vista Service Pack 2, Windows Vista Home Basic, Windows Vista Home Premium, Windows Vista Business, Windows Vista Ultimate, Windows Vista Enterprise, Windows Vista Starter, Microsoft Windows XP, Microsoft Windows XP Professional, Microsoft Windows XP Home Edition, Microsoft Windows Server 2003, Datacenter Edition (32-bit x86), Microsoft Windows Server 2003, Enterprise Edition (32-bit x86), Microsoft Windows Server 2003, Standard Edition (32-bit x86), Microsoft Windows Server 2003, Web Edition, Microsoft Windows Server 2003 R2 Enterprise Edition (32-Bit x86), Microsoft Windows Server 2003 R2 Enterprise x64 Edition, Microsoft Windows Server 2003 R2 Standard x64 Edition
Does NOT apply to:
Windows 7
Does that seem kind of weird to anyone?
POSReady version of Windows XP is still supported by Microsoft. Of course they have patches. POSReady is no different from XP Professional internally. You can enable POSReady updates on your regular XP via a simple registry change.
[HKEY_LOCAL_MACHINE\SYSTEM\WPA\PosReady]
"Installed"=dword:00000001
Just booted my XP VM with this hack and sure enough it had the KB4024323 update.
Running XP (or any Windows) with SMB/NetBT/random-shit-microsoft-protocol listeners enabled is just dumb. All this can be disabled with simple registry hacks.
Can't wait for IT departments to not install these patches and then 1) Blame MS when they're hacked 2) Scream bloody murder at Microsoft's attempt to enable automatic updates.
They'll be delivered automatically through Windows Update to devices running supported versions.
And if you're in the select few, you'll end up in a bluescreen-reboot loop after the updates. So you'll get your "Destructive Cyberattack" courtesy of Microsoft rather than the malware authors. And if you're unlucky enough to be on Win10, there's almost no way to block it.
...unless they are the attackers?
Or, you know, the black edition Windows XP off Pirate Bay that's been modified with all the patches up to 2015 and access to the POS patches as well.
READY.
PRINT ""+-0
Did you know that the patches recently issued to fix WannaCry were finalized and digitally signed 6 months ago?
Everything suggests NSA/CIA were behind WannaCry, to sample and investigate what kind of damage could be achieved and how they could use attacks like these against all other countries in the world. When they had the information they needed, they allowed Microsoft to send out the ready-made patches ASAP to minimize the damage.
Of course there was no company-wide memo sent down to everyone including the janitor and the ladies in the cafeteria. With these things, a combined comply-and-gag court order from the NSA was given to just a handful of people required to get the work done.
Makes you wonder exactly what the U.S. is up to.
In a case of footgun, Microsoft failed to provide reasonable access to the patches directly from XP/2003 because the damn page for the unsupported OS patches won't load in the IE version they have (even with the TLS crypto upgrade hotfix installed).
Which means you have to know the individual KB numbers and search/download from the update catalog site. Manually, for each damn KB. Of all the SSL exceptions approved by the CA/B Forum, a specific download site for old stuff from Microsoft for old browsers should have been obvious...
Have a new processor running windows 7? Need a security update? Microsoft says: "We hate our customers!" by adding a nice popup saying you have "Unsupported Hardware" every 3 minutes and no more updates!
Because we're Microsoft, we'll spy on you and screw you however we can.
Would love to trust this update, but Microsoft has become untrustworthy.