Slashdot Mirror
A Vulnerability in Cortana, Now Patched, Allowed Attacker To Access a Locked Computer, Change Its Password (bleepingcomputer.com)
Catalin Cimpanu, reporting for BleepingComputer: Microsoft has patched a vulnerability in the Cortana smart assistant that could have allowed an attacker with access to a locked computer to use the smart assistant and access data on the device, execute malicious code, or even change the PC's password to access the device in its entirety. The issue was discovered by Cedric Cochin, Cyber Security Architect and Senior Principle Engineer at McAfee. Cochin privately reported the problems he discovered to Microsoft in April. The vulnerability is CVE-2018-8140, which Microsoft classified as an elevation of privilege, and patched yesterday during the company's monthly Patch Tuesday security updates. Further reading: Microsoft Explains How it Decides Whether a Vulnerability Will Be Patched Swiftly or Left For a Version Update.
No Cortana, no problem.
He better have gotten a huge bug bounty for that. Remove code and auth changes via Cortana? That's gotta be worth at least the $10k PornHub paid for their PHP remote code execution (which wasn't even a PornHub bug, but a PHP one; so that company collected the PHP bounty on top of it as well).
How long before this bug is re-introduced?
It's continually blows my mind people *voluntarily* use Win10...the track record of show-stopping problems with this OS is well known.
So rise up, all ye lost ones, as one, we'll claw the clouds.
Far too integrated into the operating system for it's own good.
I thought so from the start, but when they made it so you couldn't fully disable Cortana, then I knew it for sure.
Just like Office of the Clippy era, it's introducing vulnerabilities you can't fix unless you hack the system beyond Microsoft's specifications.
The preceding post was not a Slashvertisement.
A Microsoft story (OR MORE!) a day... well, you know!
Wherever you live... Head towards the nearest beach. When you get there, grab a hand full of sand and pack it up your Hellary.
https://imgs.xkcd.com/comics/s...
Nothing to do with O.P.
"Microsoft has patched a vulnerability in the Cortana smart assistant that ALLOWS an attacker with access to a locked computer to use the smart assistant and access data on the device, execute malicious code, or even change the PC's password to access the device in its entirety."
The patch was released 1 day ago. This vulnerability still exists for every Cortana-equipped computer that has not yet been updated.
And how many people refuse to update because updates have a history of breaking things?
Using Windows 7 again. After the disastrous 1803 update I decided to stop playing beta operating system tester.
Religion: The greatest weapon of mass destruction of all time
More like Clippy's smarter and nastier sister. Clippy at least had a funny face. Cortana can't even take a joke about Siri any more.
So, is this the patch that patched the patch after it was patched?
https://www.cvedetails.com/top...
open-sores? lols!
I simply don't allow the bitch to run.
Something that’s added yet another avenue for attack that makes Windows less secure. But jam it onto our PCs anyway right Microsoft?
Wine 3.0.x and 3.x dev releases are heads and shoulders above previous iterations, and even many esoteric programs will work now. The biggest issue I have found is there are still some order of operation issues in d3d/OpenGL (appears to be in higher level d3d libraries, because it affects both the libd3d and opengl renderer in Test Drive Unlimited, causing water edge effects to 'bleed through' other geometry.) Beyond that however, almost every application I throw at it has worked recently, up to Windows 7 era apps. While I can't promise it will be a trouble free experience without testing it for yourself, it certainly isn't any more frustrating than Windows 8-10 have been, and there is a desktop environment emulating pretty much whatever style you want (Whether Windows 9x-XP, Vista/7, or 8+) plus day to day updates don't require reboots, unless you are replacing the kernel for security or reliability related issues. I have systems with regularly months of uptime being used for browsing, gaming, etc without issues. AMD GPUs from HD2xxx-R7 era cards should work out of box, most of the later cards work with AMDGPU and either the open source or proprietary driver, and if you use the Nvidia proprietary drivers, all newer Nvidia cards work out of box including OGL and CUDA. Nouveau(open source nvidia drivers) on OGL 1.x/2.x cards is a mixed bag, Tesla to Kepler is pretty reliable as of Mesa 18, although not feature complete above OGL 3.3 yet and without usable OpenCL support.) Other than those caveats, desktops effectively work across the board, the majority of notebooks, especially low end ones work across the board, mid-high end laptops are on a case by case basis.
Your point is interesting but let me summarize my experience with Linux so far:
In Windows up to version 7, the order is "updates accommodating the old code". The new things works but your old aplications (and some of then can be indeed very old) keeps working;
In Linux the order is "updates breaking the old code". The new things works but only luck will make your old applications work;
And now, to my dismay, the order in Windows 10 is also "updates breaking the old code".
Religion: The greatest weapon of mass destruction of all time
Scotty doing this in Star Trek 4?
https://m.youtube.com/watch?v=hShY6xZWVGE