Slashdot Mirror
Microsoft's Windows 7 Meltdown Fixes From January and February Made PCs More Insecure (theregister.co.uk)
Microsoft's January and February security fixes for Intel's Meltdown processor vulnerability opened up an even worse security hole on Windows 7 PCs and Server 2008 R2 boxes. From a report: This is according to researcher Ulf Frisk, who previously found glaring shortcomings in Apple's FileVault disk encryption system. We're told Redmond's early Meltdown fixes for 64-bit Windows 7 and Server 2008 R2 left a crucial kernel memory table readable and writable for normal user processes. This, in turn, means any malware on those vulnerable machines, or any logged-in user, can manipulate the operating system's memory map, gain administrator-level privileges, and extract and modify any information in RAM. The Meltdown chip-level bug allows malicious software, or unscrupulous logged-in users, on a modern Intel-powered machine to read passwords, personal information, and other secrets from protected kernel memory. But the security fixes from Microsoft for the bug, on Windows 7 and Server 2008 R2, issued in January and February, ended up granting normal programs read and write access to all of physical memory.
I am still waiting to apply these patches. About 2 months ago, I wrote here that it looked like a 2-3 months waiting period could be a nice ballpark figure. Will I have to wait even longer?
Everything I write is lies, read between the lines.
"Fast, good, cheap, pick (no more than) two."
Sometimes you only get to pick one, or none.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Fixing one problem in haste sometimes creates other problems.
For example, as Jason Mendoza, from The Good Place, noted:
Jason: Any time I had a problem, I threw a Molotov Cocktail and, boom, I had a different problem.
It must have been something you assimilated. . . .
microsoft is intentionally crippling windows 7 security.. stay tuned for the press release touting windows 10 as the 'best' fix for these issues.
The more they dump on it, the bigger it gets.
Ask yourself, who would design chips so that they could be backdoored?
There you go.
Oh, and, yes, we're in your keyboards, mice, printers, and so many devices in your "smartphones".
-- Tigger warning: This post may contain tiggers! --
Before Windows 7 EOL. Microsoft simply isn’t making the effort now it is near.
When Meltdown and Spectre were first revealed, I know I posted on here: PLEASE MAKE FIXES OPTIONAL.
Mainly because these 'flaws,' and I do use that word loosely. I'm not entirely convinced it's an actual flaw. It's just how it works. Anyway, gimping the execution predicting to protect against these 'flaws' is really stupid on a desktop computer, where there's no VM's, very little if any usage outside of 1 user. They're hurting computing performance for a non-issue.
On server systems, data center, etc, yes, fix this bug, it's a real issue on shared computing resources. On a desktop where there's 1 maybe 2 users whom browse the web, play games, type documents and otherwise 'use' their computer normally, it should be left as is. It's not a flaw on desktops. The flaw is fixing this on desktop, because it gimps performance.
All that aside, Microsoft making it worse it just laughable. And pretty much non-surprising. I'd wager Microsoft is one of the few companies that could take a 'problem' with fairly straight forward fixes and fuck it up, making a bigger problem than originally existed. Par for the course, for Microsoft.
Ask yourself, who would design chips so that they could be backdoored?
People in too big a hurry or too cheap to do it right.
These flaws were almost certainly unforeseen side effects of otherwise-smart design decisions, not intentional.
Every one of the motherfuckers that sneered at me and downvoted me and talked shit to me when I dared to suggest that turning off automatic updates was a good idea can eat crow. Assholes. Enjoy your wide open computers, you "secure" cunts.
And now Windows 10 is more secure than Windows 7!
That was M$ plan all along.
Some of our server lost they network card after the last Windows update... it cannot be more secure !
What is the good KB##### patch for meltdown/spectre as today?
The jewish 'engineers' of Israel ensured the Intel successor to the awful Netbust x86 design would be the most perfect spy device mossad and the NSA could ever desire. And better, by ensuring every Intel x86 CPU from then onwards was broken by design, they'd also run FASTER than the AMD competition.
Imagine a thread is a person. Imagine a thread's data always sits in a closed chest. AMD's chests have a LOCK, and AMD's threads must have the correct key for a lock protecting a chest the thread is entitled to open.
Meanwhile Intel Israel removed the locks Netburst 'chests' also had. Now the thread on an Intel Israel CPU (all Intel CPUs for the last ten+ years) is TRUSTED to not open and look inside chests of the wrong privilege. But when that thread represents mossad or NSA user-code...
This is the essential basis of Meltdown and Spectre. Intel sold this sickening situation by having microsoft and linux devs focus on OS partition methods based on the memory paging system. But any user code on an Intel CPU can inspect any data on the same CPU, not matter what kind of other thread that data belongs to. As I said, no locks.
There is only ONE way to make an Intel CPU secure. Run one thread at a time on the CPU, and do a complete state flush of the CPU each time multi-tasking shedules a thread change. The latest Intel CPU (8700K) runs SIXTEEN threads at once, so you are already at a situation where the 8700K loses 15/16s of its max performance, before factoring in the insane time it takes to fully reset the chip state (data flush).
And NO, despite Intel spending millions of dollars to push FUD claiming otherwise, AMD does not have this issue. The only impact of this type of vulnerability on AMD's Ryzen is where a tiny number of edge cases (usually branch prediction) accidentally bypass the universal data locks AMD has but Intel does not have. But to use this form of exploit on AMD in an actual attack has not even been proven possible in theory.
PS Intel has recently lied, and stated its next batch of CPUs will have the issue fixed in hardware. What Intel actually meant is that they are fiddling with the memory paging system to advance OS thread partition methods- the very FAKE NEWS method of not fixing the problem that already exists in current versions of windows and linux.
It will take Intel at least four years to introduce a new x86 architecture with privilege data locks on every data transaction. And this architecture will be loads slower per clock than Intel's current 'core' architecture. And it will max clock to lower speeds than current as well.
opening a data lock (ie., checking the privilege level of every data transaction low level) takes time and energy- time and energy Intel's chips currently avoid. Like a doping athlete, Intel currently cheats its way to victory.
Darn- forgot how far Intel is behind AMD these days. Of course it is the best Ryzens that have 8 cores (16 threads). Intel's 8700K is just 6-cores/12 threads, tho my point remains.
You cannot make Windows more insecure.
Static IP address settings are lost after you apply this update.
In both instances the advisory states that "Microsoft is working on a resolution and will provide an update in an upcoming release."
Microsoft's Windows 7 Meltdown Fixes From January and February Made PCs More Insecure
There are extra words inserted by accident in the headline. Should read:
"Microsoft ... Made PCs More Insecure"
... Microsoft devises a "better" flaw.
It's a natural result of Murphy's laws. ;)
This whole problem was warned about in the 90s from memory; Google it.
Intel usually only had 10% increase over AMD which wonâ(TM)t exist after this update. So the whole intel premium should be refunded at least pro-rata from this point on. Arguable if it shouldnâ(TM)t go back in time too to compensate for the lack of security.
Microsoft etc are being generous in their resources to solve a mostly intel problem. Intel stock should tank.
Popcorn.
Should we un-install all Meltdown patches? WTF are we doing now?
I was first to submit this story to /. I could live with my submission being rejected in favor of submission of someone else. Although my submission had link straight to the Ulf Frisk's blog. But marking my submission as SPAM? Really? That hurts.