8 ms·
I've been deploying Microsoft based computer networks for 18 years... this would nearly top my nightmare list! I can't imagine what the alert level is at MS of
by imperialdrive 11y ago
I've been deploying Microsoft based computer networks for 18 years... this would nearly top my nightmare list! I can't imagine what the alert level is at MS offices right now, but I bet they are expending every effort to get to the bottom of this ASAP :/
- astrodust 11y agoIs this a "lock the doors, man the battle stations" kind of problem? It seems super, super bad.
- dpark 11y agoI doubt it. It looks to me a lot more like a test update that was pushed to production unintentionally rather than malware. A server compromise pushing malware as an update would presumably try to make the update look legitimate in order to maximize how long it went undetected. Disclosure: MSFT employee, no knowledge of this beyond what I've read in this thread, though.
- richmarr 11y ago> a test update that was pushed to production unintentionally rather than malware This position seems to be based on the assumption that malware is less likely to be subject to mistakes than MSFT. Want to check with the PR dept? ;)
- pyre 11y agoYou could rephrase that as: > A test update getting accidentally pushed out is more likely than a compromise of the Windows Update system.
- dpark 11y agoIt's based on the assumption that it's more likely that someone made a harmless but embarrassing mistake than that someone shipped a major security bug in a critical system, which was then exploited by someone simultaneously skilled enough to hijack the Windows Update servers to deliver malware and incompetent enough to completely screw it up. Random text but real TLDs also just smells like test data to me. Someone smarter than me could probably do the statistical analysis to determine if this is actually random or pseudo-random garbage typed by a person. Given the fairly long runs of all-caps and all-lowercase in the description, I'd guess a person typed this out (presumably as part of creating a test or test suite).
- astrodust 11y agoExactly as predicted: http://arstechnica.com/security/2015/09/nerves-rattled-by-highly-suspicious-windows-update-delivered-worldwide/ http://arstechnica.com/security/2015/09/nerves-rattled-by-hi... Also, big whoops.
- A010 11y agoThey've gone through the process to put the "test" update to production servers, so I'm pretty sure this is intentioned. Though they might thought this is ok wo/ harms.
- buffoon 11y agoAppeared on WSUS as well... NEVER turn on auto updates on windows. Read all the KBs, then choose to install, ALWAYS. If you have a corp network, use WSUS and stop all updates and check them. If the KB is content-free like the new ones, no install. I avoided the whole CEIP bag of shit and Windows 10 upgrade notification hell thanks to that.
- imperialdrive 11y agoVery good advice... I agree. Took me a long time to figure that system out, but it sure works well!
- moron4hire 11y agoAlways turn on auto-updates. The likelihood of you missing or delaying an update and getting hit by an a known exploit is a lot more likely than an exploit getting through the update system or enabling a new exploit.
- buffoon 11y agoNo no no no no. I've watched entire networks of machines downed with auto-updates. Always read, always test.
- moron4hire 11y agoIt might make sense to pay a guy to make this his job for hundreds of computers on a corporate network, but there is no way in hell I'm keeping that close of track of updates on my home computer. And when was this, over a decade ago? Also, what evidence did you have it was the auto-update system that caused the outage? Past performance is not a predictor of future performance. Seriously folks, turn on auto-updates.
- buffoon 11y agoThis was Oct 2014. KB2949927.