Slashdot Mirror

← Back to Stories (view on slashdot.org)

Microsoft's Windows 7 Meltdown Fixes From January and February Made PCs More Insecure (theregister.co.uk)

Posted by msmash on from the closer-look dept.

Microsoft's January and February security fixes for Intel's Meltdown processor vulnerability opened up an even worse security hole on Windows 7 PCs and Server 2008 R2 boxes. From a report: This is according to researcher Ulf Frisk, who previously found glaring shortcomings in Apple's FileVault disk encryption system. We're told Redmond's early Meltdown fixes for 64-bit Windows 7 and Server 2008 R2 left a crucial kernel memory table readable and writable for normal user processes. This, in turn, means any malware on those vulnerable machines, or any logged-in user, can manipulate the operating system's memory map, gain administrator-level privileges, and extract and modify any information in RAM. The Meltdown chip-level bug allows malicious software, or unscrupulous logged-in users, on a modern Intel-powered machine to read passwords, personal information, and other secrets from protected kernel memory. But the security fixes from Microsoft for the bug, on Windows 7 and Server 2008 R2, issued in January and February, ended up granting normal programs read and write access to all of physical memory.

48 of 84 comments (clear)

  1. I am still waiting to apply these patches... by ls671 · · Score: 4, Insightful

    I am still waiting to apply these patches. About 2 months ago, I wrote here that it looked like a 2-3 months waiting period could be a nice ballpark figure. Will I have to wait even longer?

    --
    Everything I write is lies, read between the lines.
    1. Re:I am still waiting to apply these patches... by techno-vampire · · Score: 2

      OK, you use Windows for a living; I don't. Tell me, do you find this report surprising, or is it what you expect from Microsoft?

      --
      Good, inexpensive web hosting
    2. Re:I am still waiting to apply these patches... by aliquis · · Score: 1

      They just revealed another side-channel attack.

      Best is likely to buy some future product which don't have these faults. Hard to do now though.

    3. Re:I am still waiting to apply these patches... by ls671 · · Score: 1

      "Using Windows for a living" is far fetched! I have a couple Windows VM running under qemu. I wait to apply these patches on all OS flavors that I manage, I will spare you the list.

      --
      Everything I write is lies, read between the lines.
    4. Re:I am still waiting to apply these patches... by Anonymous Coward · · Score: 1

      No worries, we are due for a worm to come along that attacks some "unfixable" part of the operating system affecting Windows 7, 8, and 8.1. Everyone does remember the worm attacking WindowsXP pre-service pack 1? In that instance, Microsoft had to kill off all the pirated and leaked copies of XP. This time it will be to push everyone to 10.

    5. Re:I am still waiting to apply these patches... by Anonymous Coward · · Score: 2

      I will never apply any of the so-called "fixes" for Spectre and Meltdown on my personal PCs. The "vulnerabilities" (actually FEATURES BY DESIGN for over two decades) just aren't serious and the media blew it way out of proportion. My computers are secure as ever, nothing has changed and no hackers are going to be gaining access to them or anything stored on them. I'm not going to suffer massive performance hits because some crackpipe smoking, tinfoil hat wearing idiot said that it was a "bad thing(tm)" and all of the lemmings followed him over the edge.

    6. Re:I am still waiting to apply these patches... by NicknameUnavailable · · Score: 3, Insightful

      Still use Windows, but don't find it surprising. They've been known to release patches which cripple vital OS functionality (e.g. the XP phase-out) in order to get people to upgrade, in very subversive ways they don't know actually happened most of the time (e.g. making network or local files disappear at random from the file explorer, but not to other programs.) They probably see Spectre/Meltdown as an opportunity to cripple Windows 7 with minor backlash. Windows 7 machines should not be upgraded beyond the first time they announced the end of life (definitely none of the ongoing support patches after they extended the end of life.) You need to keep such machines behind several firewalls and browse safely to use them (with all telemetry and update services shut off.) Do that and it's solid, don't do that and it will keep breaking. Sadly there are still a bunch of things you just can't do on Linux because of people not porting their apps over (especially when you get into high end computing which requires simulating specialty engineering stuff.)

    7. Re:I am still waiting to apply these patches... by rtb61 · · Score: 2

      You, 'HOPE'. No matter what you do, they want to hack you, they will. Security is a balance, being more secure than you are worth hacking. That worth hacking can take on all sorts of metrics, from being a target of three letter agencies, to manipulating your psychology, to identity fraud against credit card acceptors. In this case of M$ wanting to push Windows anal probe 10, you can bet patches will far and few and likely shite, to kick you off what they already sold you, to force you to buy what amounts to spyware, full up, no holds barred, spyware.

      --
      Chaos - everything, everywhere, everywhen
    8. Re:I am still waiting to apply these patches... by Bert64 · · Score: 1

      Just add pti=off to your kernel command line and its off, but you can still benefit from any other updates going forward.

      --
      http://spamdecoy.net - free throwaway anonymous email - avoid spam!
    9. Re:I am still waiting to apply these patches... by jwhyche · · Score: 2

      I would keep waiting. For the past two months I have heard horror stories about the patches. Yet, I have not heard of any exploits that use the problems. Seems to me this is a case of the cure being worse than the illness.

      --
      I read at +2. If your post doesn't reach that level I will not see or respond to it.
    10. Re: I am still waiting to apply these patches... by Brockmire · · Score: 1

      What the fuck is your point? We all know what code Intel submitted to the kernel and got ripped by Linus for being stupid and shitty. Any developer or QA tester that claims they don't make mistakes is fucking stupid. This is an issue of a rushed fix that wasn't properly tested. How many fixes did it take to fix bash issues that were there for years? At least 3?

    11. Re:I am still waiting to apply these patches... by toddestan · · Score: 1

      I thought about it, and realized that really the only credible threat to my machines would be something in the browser written in Javascript. All the major browsers have modified their Javascript implementations to basically make that vector impossible, to which I said "good enough".

      And that's just the desktops. As the servers go, I couldn't think of any way, assuming everything nothing is broken, that someone could run their own code on the server as to exploit Spectre or Meltdown. Sure, maybe they could use some other exploit to load and run arbitrary code on my servers, but if they could do that then I'd have already lost.

  2. Security in a complex system is hard by davidwr · · Score: 2

    "Fast, good, cheap, pick (no more than) two."

    Sometimes you only get to pick one, or none.

    --
    Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
    1. Re:Security in a complex system is hard by rrohbeck · · Score: 2

      Open source often manages to give you all three.

      --
      thegodmovie.com - watch it
    2. Re:Security in a complex system is hard by Bigfishbowl · · Score: 1
      Yeah I think we both know that is not true. I love open source, but know that is not some magical force field against hardware-level bugs, so stop claiming there is. The most common examples of these exploits are done IN LINUX.

      These are brilliantly done exploites, and the Linux-x64 house is made of just as much glass as Windows.

      Difference being, Microsoft and Intel actually have to report to shareholders, so there is some accountability.

      I'm a little off the reservation on what the proper path is since all is currently properly fucked.

    3. Re:Security in a complex system is hard by davidwr · · Score: 1

      Open source often manages to give you all three [fast, cheap, and good].

      Measure the cost in man-hours instead of "how much the end user paid for it" and "cheap" tends to disappear.

      I will grant you one major difference between a large-team distributed project - most large FOSS projects are distributed - and a large-team project run by a single entity: Project management is usually very different, and as a result, the cost of project management may be very different.

      --
      Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
  3. The Meltdown meltdown. by fahrbot-bot · · Score: 1

    Fixing one problem in haste sometimes creates other problems.

    For example, as Jason Mendoza, from The Good Place, noted:

    Jason: Any time I had a problem, I threw a Molotov Cocktail and, boom, I had a different problem.

    --
    It must have been something you assimilated. . . .
  4. translation by Anonymous Coward · · Score: 3, Interesting

    microsoft is intentionally crippling windows 7 security.. stay tuned for the press release touting windows 10 as the 'best' fix for these issues.

    1. Re:translation by webmistressrachel · · Score: 5, Interesting

      This is exactly what I was thinking.

      Microsoft released a decent operating system and then killed it on purpose when they couldn't persuade people to upgrade to Windows 8, 8.1, or 10 - there was no need to upgrade while everything worked so well under 7!!

      I only upgraded from Windows 2003 "workstation" after I had observed feedback from 7 users for about a year. I will not upgrade to 10, even if they try to force me to with "exclusive" releases - I will play my games on 7 until that market ends, and I will continue to use Linux for my work as I always have, all of which simply means that eventually my hobby will die with Windows 7. Thanks M$.

      I strongly suspect that I'm not the only person thinking like this. M$ created a whole industry, now they want to destroy it.

      --
      This tagline was transcoded to result in at least one smirk. If you experience failure to smirk, please consult your Gen
    2. Re:translation by blackpaw · · Score: 1

      Funny, I "upgraded" a toasted kubuntu install yesterday to Min 18.3 (Cinnamon). Looked nice and slick at first. But the taskbar is a PITA in vertical mode, no pinned apps on taskbar, fullscreen rdp on one monitor killed the desktop on the other monitor. Apps open at random location and I just don't have the time to yet again tweak the crap out of it.

      All on bog std hardware. The neighbouring Win 10 pro machine with the same hardware has no issues at all.

      Linux has always been crap with multiple monitors and usable desktops. Ironically we use the desktops to remote onto VM's running on a Linux cluster.

    3. Re:translation by Anonymous Coward · · Score: 1

      This is also why Microsoft never truly fixed Windows Update (the routines that checks updates is horribly slow) on pre-Windows 10 PCs.

      On Windows 10, they never really fixed it either, instead opting for 'upgrades' (vs 'update') every six months to reset the baseline; and, of course, taking away user control over the entire update/upgrade process and forcing whatever they want to install onto PCs.

    4. Re:translation by Tyger-ZA · · Score: 2

      Funny, I "upgraded" a toasted kubuntu (I fucked it up) install yesterday to Min 18.3 (Cinnamon). Looked nice and slick at first. But I fucked with it again and now it's broken so I'll blame the OS

      All on bog std hardware. The neighbouring Win 10 pro machine with the same hardware (That I didn't fuck up, apparently) has no issues at all.

      Linux has always been crap with multiple monitors and usable desktops. Ironically we use the desktops to remote onto VM's running on a Linux cluster.

      FTFY

      Now my turn for anecdotal evidence:

      I've been running Mint for years on my work machine (js, Python, C, C++ dev); with Windows (C# dev) banished to a Virtual Machine before it can cause any trouble.

      The host OS gives me no trouble, the guest OS typically wastes my time by being unusable while it updates, because the retarded shit gibbons at MS have written an overly complicated update system that takes 100% of a CPU core to download & copy files + edit registry

      The only reason I would want to run Windows as a host OS is for gaming, and even that use case can be solved with a Linux host and GPU passthrough

    5. Re:translation by blackpaw · · Score: 1

      Ah the classic Linux fanboy. Finding bugs in the software by your desktop to work the way you need it = breaking it.

    6. Re:translation by Tyger-ZA · · Score: 1

      Ah the classic Linux fanboy. Finding bugs in the software by your desktop to work the way you need it = breaking it.

      No, to give you a counter example:

      The upgrade process in Mint works, without eating crazy amounts of CPU, and there's actually a repo on Mint. If this were as frustrating as it is on Windows, I would be complaining to the devs and looking into whether I can fix it myself. Now if I fucked up my OS for example by interfering with parts I don't understand, that would be my fault if it broke. Example, interfering with fstab and then complaining when I can't find hard drives is akin to you touching things you apparently don't understand and toasting Kubuntu

      For a Windows example, me installing Windowblinds because the flat Windows UI looks like shit and fucking up the OS because of it, would be my fault. If I moved the taskbar to the left and something breaks, that would be their fault, nobody else had a hand in making that feature. It's their update system and their fault that the update system is shit. I can't fix it even if I knew how.

    7. Re: translation by Brockmire · · Score: 1

      Mint installation can fuck off. If install fails due to an NTP server going unreachable, they fucked up. Mint has also failed to install on a couple of laptops (without any useful error message), which blew my mind. Never had install issues with Xubuntu with many more Xubuntu installs. Everyone has their own unique experience with the millions of fucking distros. Some just work, some just fucking suck.

    8. Re: translation by Brockmire · · Score: 1

      Address the issue that Windows 7 development was stopped years ago, that had a schedule years in advance of ending support? This is only a surprise to morons. When you're clueless and make no fucking sense, you don't deserve a response. Anyone working in software development understands you put your efforts into newer, better code than spinning wheels putting in new features that were never planned or supported.

  5. It's the chips by WillAffleckUW · · Score: 2, Interesting

    Ask yourself, who would design chips so that they could be backdoored?

    There you go.

    Oh, and, yes, we're in your keyboards, mice, printers, and so many devices in your "smartphones".

    --
    -- Tigger warning: This post may contain tiggers! --
  6. Should have been optional from the start! by duke_cheetah2003 · · Score: 5, Informative

    When Meltdown and Spectre were first revealed, I know I posted on here: PLEASE MAKE FIXES OPTIONAL.

    Mainly because these 'flaws,' and I do use that word loosely. I'm not entirely convinced it's an actual flaw. It's just how it works. Anyway, gimping the execution predicting to protect against these 'flaws' is really stupid on a desktop computer, where there's no VM's, very little if any usage outside of 1 user. They're hurting computing performance for a non-issue.

    On server systems, data center, etc, yes, fix this bug, it's a real issue on shared computing resources. On a desktop where there's 1 maybe 2 users whom browse the web, play games, type documents and otherwise 'use' their computer normally, it should be left as is. It's not a flaw on desktops. The flaw is fixing this on desktop, because it gimps performance.

    All that aside, Microsoft making it worse it just laughable. And pretty much non-surprising. I'd wager Microsoft is one of the few companies that could take a 'problem' with fairly straight forward fixes and fuck it up, making a bigger problem than originally existed. Par for the course, for Microsoft.

    1. Re: Should have been optional from the start! by Anonymous Coward · · Score: 1

      didn't the proof of concept include a chrome based javascript file that could dump all your user credentials/logins on your windows machine? Not exactly 'only servers' if site adverts can steal your bank details.

    2. Re: Should have been optional from the start! by Luckyo · · Score: 1

      This was nuked almost instantly by all major browser vendors. Javascript engine in browsers no longer has access to timings tight enough to utilize this bug.

    3. Re:Should have been optional from the start! by Howitzer86 · · Score: 2

      If you're worried about performance, don't install the new firmware. The Windows patch can't mitigate Spectre/Meltdown without it, and you'll have to do it yourself. If you're worried about security... I guess you're boned no matter what.

      Just do what you probably always do: keep regular backups, keep an updated antivirus, use adblock, and avoid shady websites.

    4. Re: Should have been optional from the start! by Luckyo · · Score: 1

      Evidence is in the fact that in spite of massive attention this exploit got, and its supposed pervasiveness, no one utilized it to attack browsers in any meaningful capacity to this date.

    5. Re:Should have been optional from the start! by drinkypoo · · Score: 1

      It's not a flaw on desktops. The flaw is fixing this on desktop, because it gimps performance.

      Hurt me again, daddy! That's a lot of nonsense, because people execute code from untrusted sources all the time. On any computer where you might wind up running untrusted code, it's a problem. And that describes the average user desktop. You sound like an Intel apologist to me. Are you getting paid, or do you just have a lot of Intel kit and you don't want to feel stupid?

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    6. Re:Should have been optional from the start! by Waccoon · · Score: 1

      PLEASE MAKE FIXES OPTIONAL.

      Indeed. I nearly had a heart attack when I discovered my Gigabyte motherboard doesn't allow you to revert your BIOS after an update. So, does that mean if I installed the Meltdown patch and it screwed up, I couldn't fix it myself by downgrading? I didn't even take the chance!

      I expect that crap from companies that build fully pre-built systems, but now even the aftermarket parts market is making choice difficult. Isn't choice the whole point of building your own PC? How long before firmware updates are mandatory, too?

    7. Re:Should have been optional from the start! by thegarbz · · Score: 1

      They WERE optional from the start. All the added features of the patch can be disabled via a registry entry.

    8. Re: Should have been optional from the start! by Luckyo · · Score: 1

      Exploits that have been stated as "unpatchable" and drummed about in every single piece of media the way meltdown and spectre were?

      Weeks at most. In most cases, probably days. Malware industry is a for-profit one, and you could make nine-ten digits easily if you actually had an exploit to vaccuum people's passwords en masse with just a javascript.

      Greed is a very powerful motivator.

    9. Re:Should have been optional from the start! by duke_cheetah2003 · · Score: 1

      You sound like an Intel apologist to me. Are you getting paid, or do you just have a lot of Intel kit and you don't want to feel stupid?

      Why is this the assumption when someone disagrees with you? I wish I were getting paid for speaking my mind, but I'm not. Must be a painful unpleasant reality you exist in where everyone who disagrees with you is a shill. So much paranoia.

    10. Re:Should have been optional from the start! by duke_cheetah2003 · · Score: 1

      ....And that describes the average user desktop.

      And frankly, if the average user downloads malware and installs it, or browses a malicious website. They deserve whatever they get. Stay away from untrusted programs and websites, plain and simple. I have no sympathy for people who browse untrusted sites and download garbage they don't need.

      I actually like these people. They pay my bills, since I have to remove their stupid from their machines and teach them how to not be stupid.

      No amount of anti-virus, flaw correction, security patches or arm twisting will fix the levels of stupid of the average user, so stop gimping ALL OF OUR PC's because some people can't take 5 seconds out of their busy lives to learn how to use a computer properly.

    11. Re:Should have been optional from the start! by ElizabethGreene · · Score: 1

      >> When Meltdown and Spectre were first revealed, I know I posted on here: PLEASE MAKE FIXES OPTIONAL.

      They did.
      The fixes for Spectre and Meltdown can be disabled with two registry keys,

      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management

      FeatureSettingsOverride =3
      FeatureSettingsOverrideMask =3

      They are disabled by default on server operating systems.

      Ref: KB4073119

    12. Re:Should have been optional from the start! by ElizabethGreene · · Score: 1

      ... fairly straight forward fixes

      Are you familiar with the Dunning-Kruger effect? It seems like this might be relevant to your understanding of the effort and complexity required here.

    13. Re:Should have been optional from the start! by drinkypoo · · Score: 1

      Why is this the assumption when someone disagrees with you?

      You're disagreeing with reality. Please consider how the world really works, in this case what users really do, and then consider your comment in that light.

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    14. Re: Should have been optional from the start! by Brockmire · · Score: 1

      Fuck off, you dumb cunt. You probably missed all the stories of legit ad networks being fooled into serving malware on big name sites? Perhaps you've heard of zero days? Do you work in an office with dumb, gullible people? Plenty of really smart, really careful people get infected all the time.

  7. True patch? by ELCouz · · Score: 1

    What is the good KB##### patch for meltdown/spectre as today?

  8. That's a load of nonsense by OneHundredAndTen · · Score: 4, Funny

    You cannot make Windows more insecure.

  9. Break this patch out of the cumulative update? by slincolne · · Score: 3
    The March rollup comes with several issues that make it a bit of a risk in itself to deploy (https://support.microsoft.com/en-au/help/4088875/windows-7-update-kb4088875). Of note:
    • A new Ethernet virtual Network Interface Card (vNIC) that has default settings may replace the previously existing vNIC, causing network issues after you apply this update. Any custom settings on the previous vNIC persist in the registry but are unused.

      Static IP address settings are lost after you apply this update.

      In both instances the advisory states that "Microsoft is working on a resolution and will provide an update in an upcoming release."

  10. submission by rastos1 · · Score: 3, Insightful

    I was first to submit this story to /. I could live with my submission being rejected in favor of submission of someone else. Although my submission had link straight to the Ulf Frisk's blog. But marking my submission as SPAM? Really? That hurts.

    1. Re:submission by Anonymous Coward · · Score: 1

      Don't bother. msmash and beauhd only repost stories from a fixed list of web sites.

      They don't care about the submission queue one bit.

  11. Re: I am owed an apology by Anonymous Coward · · Score: 1

    You sound very happy and well-adjusted. Im sure your coworkers love seeing you every day.