5 ms·

Is this a "lock the doors, man the battle stations" kind of problem? It seems super, super bad.

dpark 11y ago
I doubt it. It looks to me a lot more like a test update that was pushed to production unintentionally rather than malware. A server compromise pushing malware as an update would presumably try to make the update look legitimate in order to maximize how long it went undetected. Disclosure: MSFT employee, no knowledge of this beyond what I've read in this thread, though.
- richmarr 11y ago
  > a test update that was pushed to production unintentionally rather than malware This position seems to be based on the assumption that malware is less likely to be subject to mistakes than MSFT. Want to check with the PR dept? ;)
  - pyre 11y ago
    You could rephrase that as: > A test update getting accidentally pushed out is more likely than a compromise of the Windows Update system.
  - dpark 11y ago
    It's based on the assumption that it's more likely that someone made a harmless but embarrassing mistake than that someone shipped a major security bug in a critical system, which was then exploited by someone simultaneously skilled enough to hijack the Windows Update servers to deliver malware and incompetent enough to completely screw it up. Random text but real TLDs also just smells like test data to me. Someone smarter than me could probably do the statistical analysis to determine if this is actually random or pseudo-random garbage typed by a person. Given the fairly long runs of all-caps and all-lowercase in the description, I'd guess a person typed this out (presumably as part of creating a test or test suite).
- astrodust 11y ago
  Exactly as predicted: http://arstechnica.com/security/2015/09/nerves-rattled-by-highly-suspicious-windows-update-delivered-worldwide/ http://arstechnica.com/security/2015/09/nerves-rattled-by-hi... Also, big whoops.
- A010 11y ago
  They've gone through the process to put the "test" update to production servers, so I'm pretty sure this is intentioned. Though they might thought this is ok wo/ harms.

dpark 11y ago

I doubt it. It looks to me a lot more like a test update that was pushed to production unintentionally rather than malware. A server compromise pushing malware as an update would presumably try to make the update look legitimate in order to maximize how long it went undetected. Disclosure: MSFT employee, no knowledge of this beyond what I've read in this thread, though.

richmarr 11y ago
> a test update that was pushed to production unintentionally rather than malware This position seems to be based on the assumption that malware is less likely to be subject to mistakes than MSFT. Want to check with the PR dept? ;)
- pyre 11y ago
  You could rephrase that as: > A test update getting accidentally pushed out is more likely than a compromise of the Windows Update system.
- dpark 11y ago
  It's based on the assumption that it's more likely that someone made a harmless but embarrassing mistake than that someone shipped a major security bug in a critical system, which was then exploited by someone simultaneously skilled enough to hijack the Windows Update servers to deliver malware and incompetent enough to completely screw it up. Random text but real TLDs also just smells like test data to me. Someone smarter than me could probably do the statistical analysis to determine if this is actually random or pseudo-random garbage typed by a person. Given the fairly long runs of all-caps and all-lowercase in the description, I'd guess a person typed this out (presumably as part of creating a test or test suite).
astrodust 11y ago
Exactly as predicted: http://arstechnica.com/security/2015/09/nerves-rattled-by-highly-suspicious-windows-update-delivered-worldwide/ http://arstechnica.com/security/2015/09/nerves-rattled-by-hi... Also, big whoops.
A010 11y ago
They've gone through the process to put the "test" update to production servers, so I'm pretty sure this is intentioned. Though they might thought this is ok wo/ harms.