Slashdot Mirror
Microsoft Says No More Windows Security Updates Unless AVs Set a Registry Key (bleepingcomputer.com)
Catalin Cimpanu, reporting for BleepingComputer: Microsoft has added a new and very important detail on the support page describing incompatibilities between antivirus (AV) products and the recent Windows Meltdown and Spectre patches. According to an update added this week, Microsoft says that Windows users will not receive the January 2018 Patch Tuesday security updates, or any subsequent Patch Tuesday security updates, unless the antivirus program they are using becomes compatible with the Windows Meltdown and Spectre patches. The way antivirus programs become compatible is by updating their product and then adding a special registry key to the Windows Registry. The presence of this registry key tells the Windows OS the AV product is compatible and will trigger the Windows Update that installs the Meltdown and Spectre patches that address critical flaws in the design of modern CPUs.
Microsoft finally comes up with a way for the user to potentially have some level of control over their patches. All you have to do is mess around with a registry key and forgo all patches altogether. People have been demanding to have some level of control and this is what Microsoft comes up with...
Remember,
For Windows Server, you will need to also set the following three registry keys to enable post patch install. With Windows Home/pro, it's already enabled after installation.
For Windows Server.
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverride /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverrideMask /t REG_DWORD /d 3 /f
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Virtualization" /v MinVmVersionForCpuBasedMitigations /t REG_SZ /d "1.0" /f
To Validate status, you can run the PowerShell command Get-SpeculationControlSettings.
If Windows 10 or Server 2016, you can skip the first step.
1. Set-ExecutionPolicy Bypass
2. Install-Module SpeculationControl
3. Get-SpeculationControlSettings
You will now see results.
4. Set-ExecutionPolicy Restricted (to protect the system via securing powershell again)
Good luck. Be sure to apply BIOS updates when and if applicable to stave off Spectre
Life is not for the lazy.
Who runs AV's anyway?
It pains me to side with Microsoft but their decision here is a good and legitimate one.
The key to it's legitimacy is this quote:
There is a problem where some anti-virus vendors are using techniques to bypass Kernel Patch Protection by injecting a hypervisor which they use to intercept syscalls and make assumptions about memory locations — memory locations which are now changing with the Meltdown fixes.
Anons need not reply. Questions end with a question mark.
I came to say exactly this. I have no idea how they are going to protect it from a program that acquires root (Admin) privileges somehow. A Malware program that installs itself, has these kind of rights.
Ahhh...the great dumpster continuum. Many a free computer will be found there. -- sowth (748135)
Apparently This is a temporary solution according to Microsoft.
https://support.microsoft.com/...
Q3: How long will Microsoft require setting a registry key to receive the January 3, 2018, security updates?
A3: Microsoft added this requirement to ensure customers can successfully install the January 2018 security updates. Microsoft will continue to enforce this requirement until there is high confidence that the majority of customers will not encounter device crashes after installing the security updates.
In Soviet Russia, Trojan exploits YOU!
1. Since when was Slashdot ever timely?
2. I've skimmed a bunch of Spectre and Meltdown articles, haven't seen the registry key mentioned before now.
So the better solution is to let the AV trash the OS so the user gets a BSOD on reboot? The reason they are requiring this is because if the AV isn't patched it trashes the update and leaves the OS unbootable. I'm sure once the majority of AVs push out a patch (which lets be honest an AV that doesn't push out some updates to deal with Meltdown is a truly shit AV) they will simply remove this requirement from the patch.
ACs don't waste your time replying, your posts are never seen by me.
You have bigger problems than a registry key if the malware has root.
All my liberal friends think I'm a conservative, all my conservative friends think I'm a liberal.
So what happens if I don't install any AV-product and also don't use the Microsoft AV-Solution?
It is highly unreasonable to expect MS to be able to patch your Linux box. :P
sudo yes > /dev/hda
Nope, first of all /dev/hda won't exist, we moved on to sda and mmcblk a good decade ago. But more importantly the sudo applies to the yes command, not to the redirect, so all you are doing is running 'yes' as root and then trying to write to the dev as an ordinary user.
If the malware is already installed, then its in their interest to ensure your system gets updates so it's less likely to get infected by any competing malware...
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
Once a machine has a root kit installed , the game is lost. You can't remove rooted malware from the same machine. You might be able to clean the disk from a different machine, maybe, if it's low-rent malware. Of course, the Snowden leaks included NSA malware that lives in the BIOS of the drive, so it might just root the second system. Thanks NSA.
Socialism: a lie told by totalitarians and believed by fools.
If malware can set this reg key - your machine is already done (its only writable by system/admin).
Comment removed based on user account deletion
You can actually make a case that a lot of security/antivirus products rather than protecting from malware, are actually malware.
They
1) Cause other programs to stop working or even the OS not to start
2) Run with very high privilege levels
3) Are unnecessarily hard to remove
4) Disable Windows Defender
5) Often mess with Windows Update.
It's like this sad tale of becoming what you most fear and are trying to stop.
.
echo -e 'global _start\n _start:\n mov eax, 2\n int 80h\n jmp _start' > a.asm; nasm a.asm -f elf; ld a.o -o a;
... Going forward the end user (or whatever malware on their machine) can permanently disable windows updates by setting registry security to prevent such a key from getting created in the first place?