5 ms·

This links to a Microsoft support thread in which several users are reporting a suspicious update distributed through Windows Update. In lieu of a title and des

This links to a Microsoft support thread in which several users are reporting a suspicious update distributed through Windows Update. In lieu of a title and description, the update has 108-character and 24-character base52-encoded random numbers. In lieu of "more information" and "help and support" links, it has similarly random base52-encoded domains, which currently do not resolve, in .gov, .edu and .mil. Searching for the patch title turns up a bunch of people asking about the same suspicious patch on other sites, all within the past day. The update is attracting attention because it fails to install. http://security.stackexchange.com/questions/101520/weird-windows-update http://security.stackexchange.com/questions/101520/weird-win... https://www.reddit.com/r/techsupport/comments/3mykv1/weird_windows_update/ https://www.reddit.com/r/techsupport/comments/3mykv1/weird_w... This does strongly suggest a compromise of the Windows Update servers or of some bit of infrastructure that connects people to them, but also suggests that whoever the attackers are, they made a mistake - a successful compromise executed correctly would not leave so much evidence around. It's quite possible that they've been compromised for awhile, and this is a buggy update to the existing malware.

dpark 11y ago
"Base52-encoded random numbers" is a rather obtuse way to describe random letters.
- dragontamer 11y ago
  Base52 means capital letters and lower case letters. Base62 includes numbers (0 through 9). We programmers like being specific. Sometimes these sorts of details matter.
  - dpark 11y ago
    This detail doesn't matter and is needlessly confusing. "Random upper and lowercase letters" is exactly as specific and accurate as "base52-encoded random numbers", but the former is more understandable while the latter is trying way too hard to sound smart.
    - kbar13 11y ago
      look, this is hacker news. the author knows his audience. most people who read this will know what base52 is or will at least recognize what it might be and be able to look it up. i dont think it's meant to sound "smart", it's an accurate and concise description of the randomness
      - bitJericho 11y ago
        It wasn't smart since I literally thought he was saying there was encoded data.
    - RandomBK 11y ago
      These details can often shed light into what happened ( or was supposed to happen ), what tools were being used, etc. While they might be useless for the average reader, there are many on HN, myself included, who will be dissecting the update to learn more about how Windows update works
      - dpark 11y ago
        That's fine, but it's not useful to use obtuse terminology. Not once have I heard anyone use the term base-52 before today. I understood the term, but it's not common (because base-52 encoding is not common). It's so not common that it doesn't merit a page on Wikipedia, nor a reference from the page for the number 52, nor even a reference from the page for base-64. It's obtuse. It's also so specific as to be inaccurate. These strings could be interpreted as "base-52", but also as base-64 or any other base greater than 52. Calling them "encoded" also implies a belief about how these were derived that isn't justified. "Encoded" means that there is some original source that can be recreated by decoding. It's possible that these were actually created by generating random numbers and then encoding that data in base-52. I think that's pretty unlikely, though. So no, I don't think this sheds any light or additional detail. It's inaccurate and misleading and if we're so specific we're making up terminology, then we should also be specific enough to say things like "assumed pseudorandom" rather than "random" when we don't know. Otherwise we're just being obtuse.
  - Dylan16807 11y ago
    And saying "base52" is misleading. It implies that there is a source data that's been encoded, which is not likely here. You can be specific without implying that. A random string out of a specific character set is also subtly different from taking random bits and encoding them with that same character set, in that the first couple digits will have different distributions.
    - kaoD 11y ago
      > saying "base52" is misleading. It implies that there is a source data that's been encoded No, it doesn't. 0xFF is a number I just made up, no source data at all, I promise. Also, it's base 16 :) Anyhow, the source data was most definitely base 2 (as is your computer's memory, I assume) and later encoded into base52 to be represented as a string (unless someone at Microsoft wrote it in base52, which seems unlikely).
      - dpark 11y ago
        > 0xFF is a number I just made up, no source data at all, I promise. Also, it's base 16. It's not base 16 encoded, which was his point. Encoding demands a source. This is just a base-16 number unless you encoded something to arrive at this. You could interpret "Romeo and Juliet" as a very large base65 number (65 unique chars in the random copy I grabbed) if you want, but it's not meaningful or accurate to call it a base65 encoding. > Even if that were true, the source data was most definitely encoded from base 2 (which is what our computers work with). This is the kind of pedantry that people hate because it adds nothing to the conversation. It's a way to inject "I'm right" moments into the conversation so you can feel smart, while no one else really cares. It makes for unpleasant conversations. <pedantry> You're also not right. Your brain doesn't work in base-2, and you likely didn't enter this number into your computer in base2. You typed in the string "0xFF", and that string was encoded in base 2. The base2 that represents the string "0xFF" is very different from the base2 number that represents the logical (base16) number 0xFF. </pedantry>
        kaoD 11y ago
        > It's not base 16 encoded, which was his point. I didn't understand it that way. Also, your whole <pedantry> block and the paragraph above is based on misunderstanding my comment (probably because I'm not a native speaker and you caught me inbetween edits). I think you're the only one making an "unpleasant conversation".
  - jlebar 11y ago
    > We programmers like being specific. But above all, we like being pedantic. (Not you.) :)
  - SixSigma 11y ago
    [a-Z] and [a-Z0-9] would be a better representation, no?
- RIMR 11y ago
  No, it's a very specific way to describe a random string. Don't come to HN if you're expecting everything to be in layman's terms.
  - dang 11y ago
    > Don't come to HN if you're expecting everything to be in layman's terms That's not nice. Please don't do that. I doubt that dpark is "expecting everything to be in layman's terms", but even if dpark were, many HN users would be happy to explain. And that's the kind of site we want.
    - RIMR 11y ago
      Then why describe being pedantic (extremely specific) as being "obtuse" (annoyingly insensitive)?
      - dpark 11y ago
        Because the specificity here is inaccurate and misleading. I've left plenty of comments about what's wrong with the term "base52-encoded random numbers" here and so have a number of other commenters. I didn't ask for anyone to use lay terminology, but it's reasonable to ask for clear and correct terminology. One of the frustrating things about reading academic papers is that many authors insist on using less common and less clear phrasing when there are much simpler ways of saying the same things. It makes for unpleasant, heavy reading and it makes the author sound pompous. "Obtuse" also means dumb, and is often used to mean "difficult to understand". "Abstruse" might have been a better choice of word.
- peterwwillis 11y ago
  It's not random letters. It's random numbers encoded in base52. Because the number strings are encoded, they're probably not random at all.
  - dpark 11y ago
    You have no way of knowing that. All you see are some random-looking strings. These could be numbers (random or not) that were encoded as base52. These could also be numbers encoded as base64, or base88, or any other base52+. Or they could be randomly-generated strings and there is no meaningful number underlying them.
    - daveloyall 11y ago
      hobbes@namagiri:~/scratch$ echo gYxseNjwafVPfgsoHnzLblmmAxZUiOnGcchqEAEwjyxwjUIfpXfJQcdLapTmFaqHGCFsdvpLarmPJLOZYMEILGNIPwNOgEazuBVJcyVjBRL|ent Entropy = 5.352821 bits per byte. Optimum compression would reduce the size of this 108 byte file by 33 percent. Chi square distribution for 108 samples is 650.52, and randomly would exceed this value less than 0.01 percent of the times. Arithmetic mean value of data bytes is 92.6019 (127.5 = random). Monte Carlo value for Pi is 4.000000000 (error 27.32 percent). Serial correlation coefficient is 0.142915 (totally uncorrelated = 0.0). ...Which is meaningless without context. Let's see if we can create some context... hobbes@namagiri:~/scratch$ echo "You have no way of knowing that. All you see are some random-looking strings. These could be numbers (random or not) that were encoded as base52. These could also be numbers encoded as base64, or base88, or any other base52+. Or they could be randomly-generated strings and there is no meaningful number underlying them." |base64 |sed -e :a -e '$!N; s/\n//; ta' WW91IGhhdmUgbm8gd2F5IG9mIGtub3dpbmcgdGhhdC4gQWxsIHlvdSBzZWUgYXJlIHNvbWUgcmFuZG9tLWxvb2tpbmcgc3RyaW5ncy4gVGhlc2UgY291bGQgYmUgbnVtYmVycyAocmFuZG9tIG9yIG5vdCkgdGhhdCB3ZXJlIGVuY29kZWQgYXMgYmFzZTUyLiBUaGVzZSBjb3VsZCBhbHNvIGJlIG51bWJlcnMgZW5jb2RlZCBhcyBiYXNlNjQsIG9yIGJhc2U4OCwgb3IgYW55IG90aGVyIGJhc2U1MisuIE9yIHRoZXkgY291bGQgYmUgcmFuZG9tbHktZ2VuZXJhdGVkIHN0cmluZ3MgYW5kIHRoZXJlIGlzIG5vIG1lYW5pbmdmdWwgbnVtYmVyIHVuZGVybHlpbmcgdGhlbS4K ok, that's base64. Let's turn that into base52... CL-USER> (to-base 52 (from-base 64 "WW91IGhhdmUgbm8gd2F5IG9mIGtub3dpbmcgdGhhdC4gQWxsIHlvdSBzZWUgYXJlIHNvbWUgcmFuZG9tLWxvb2tpbmcgc3RyaW5ncy4gVGhlc2UgY291bGQgYmUgbnVtYmVycyAocmFuZG9tIG9yIG5vdCkgdGhhdCB3ZXJlIGVuY29kZWQgYXMgYmFzZTUyLiBUaGVzZSBjb3VsZCBhbHNvIGJlIG51bWJlcnMgZW5jb2RlZCBhcyBiYXNlNjQsIG9yIGJhc2U4OCwgb3IgYW55IG90aGVyIGJhc2U1MisuIE9yIHRoZXkgY291bGQgYmUgcmFuZG9tbHktZ2VuZXJhdGVkIHN0cmluZ3MgYW5kIHRoZXJlIGlzIG5vIG1lYW5pbmdmdWwgbnVtYmVyIHVuZGVybHlpbmcgdGhlbS4K")) "6lH81qbtcGjfFOclhdtt7ieuljADG17Ou6swolu2A2qlnO52zmMkG8Nfk2APbEbso4idFF44wsLIGfrOg5atP0ucg5gubxAcD9ztMcboeC4sAui28skbwtEiuv64OuD8fbFnn1M01oeq3bH7n9bvu8p3P1MwirdDHxKDONktDvtNOLE1srOz2I4wNLsBpgOGIlLs1i11xt58JpOC1whJ54Krmln1ahmrvksODe7kqjtBazKzKamu5tygI6hGHq3h123Ighyw8s2MxE4dl9rBdBNG1o7tJM2HvzOh955NpLB33nuPr4OwfhjB618y1BP9y2euMquIMszOuH1rPAEkBccOu9qIJBqKgGf1qH42bBd7GOMsbKExosd8CErJlMIAcEyyytFzoKOfkJy1ExEnKc0iE7OGkpLJM3ybB2JNlnwtrC5F0cH8kB41IIv0BwNk9DO" Astute readers will note that this output contains numeric digits. There's more than one representation of "base-52". The one above goes from 0 through p. An alternative would go from A-z. But none of that matters to measure the entropy of base-52 encoded English text, ya dig? hobbes@namagiri:~/scratch$ echo "6lH81qbtcGjfFOclhdtt7ieuljADG17Ou6swolu2A2qlnO52zmMkG8Nfk2APbEbso4idFF44wsLIGfrOg5atP0ucg5gubxAcD9ztMcboeC4sAui28skbwtEiuv64OuD8fbFnn1M01oeq3bH7n9bvu8p3P1MwirdDHxKDONktDvtNOLE1srOz2I4wNLsBpgOGIlLs1i11xt58JpOC1whJ54Krmln1ahmrvksODe7kqjtBazKzKamu5tygI6hGHq3h123Ighyw8s2MxE4dl9rBdBNG1o7tJM2HvzOh955NpLB33nuPr4OwfhjB618y1BP9y2euMquIMszOuH1rPAEkBccOu9qIJBqKgGf1qH42bBd7GOMsbKExosd8CErJlMIAcEyyytFzoKOfkJy1ExEnKc0iE7OGkpLJM3ybB2JNlnwtrC5F0cH8kB41IIv0BwNk9DO" | ent Entropy = 5.610518 bits per byte. Optimum compression would reduce the size of this 452 byte file by 29 percent. Chi square distribution for 452 samples is 2093.27, and randomly would exceed this value less than 0.01 percent of the times. Arithmetic mean value of data bytes is 86.3496 (127.5 = random). Monte Carlo value for Pi is 4.000000000 (error 27.32 percent). Serial correlation coefficient is 0.018253 (totally uncorrelated = 0.0). Conclusion: I don't think the original text was pseudorandom. If you can convince me that the original isn't "base-52 encoded" at all (and I'd be easily convinced), I'm willing to reevaluate that conclusion. I'm also interested to see if anyone sees a flaw in my process.
jimrandomh 11y ago
For some reason, all the replies to this are focused on how I described the title and description strings. Which is... not at all the interesting part of this, and not something I gave much thought when I wrote this comment.

dpark 11y ago

"Base52-encoded random numbers" is a rather obtuse way to describe random letters.

dragontamer 11y ago
Base52 means capital letters and lower case letters. Base62 includes numbers (0 through 9). We programmers like being specific. Sometimes these sorts of details matter.
- dpark 11y ago
  This detail doesn't matter and is needlessly confusing. "Random upper and lowercase letters" is exactly as specific and accurate as "base52-encoded random numbers", but the former is more understandable while the latter is trying way too hard to sound smart.
  - kbar13 11y ago
    look, this is hacker news. the author knows his audience. most people who read this will know what base52 is or will at least recognize what it might be and be able to look it up. i dont think it's meant to sound "smart", it's an accurate and concise description of the randomness
    - bitJericho 11y ago
      It wasn't smart since I literally thought he was saying there was encoded data.
  - RandomBK 11y ago
    These details can often shed light into what happened ( or was supposed to happen ), what tools were being used, etc. While they might be useless for the average reader, there are many on HN, myself included, who will be dissecting the update to learn more about how Windows update works
    - dpark 11y ago
      That's fine, but it's not useful to use obtuse terminology. Not once have I heard anyone use the term base-52 before today. I understood the term, but it's not common (because base-52 encoding is not common). It's so not common that it doesn't merit a page on Wikipedia, nor a reference from the page for the number 52, nor even a reference from the page for base-64. It's obtuse. It's also so specific as to be inaccurate. These strings could be interpreted as "base-52", but also as base-64 or any other base greater than 52. Calling them "encoded" also implies a belief about how these were derived that isn't justified. "Encoded" means that there is some original source that can be recreated by decoding. It's possible that these were actually created by generating random numbers and then encoding that data in base-52. I think that's pretty unlikely, though. So no, I don't think this sheds any light or additional detail. It's inaccurate and misleading and if we're so specific we're making up terminology, then we should also be specific enough to say things like "assumed pseudorandom" rather than "random" when we don't know. Otherwise we're just being obtuse.
- Dylan16807 11y ago
  And saying "base52" is misleading. It implies that there is a source data that's been encoded, which is not likely here. You can be specific without implying that. A random string out of a specific character set is also subtly different from taking random bits and encoding them with that same character set, in that the first couple digits will have different distributions.
  - kaoD 11y ago
    > saying "base52" is misleading. It implies that there is a source data that's been encoded No, it doesn't. 0xFF is a number I just made up, no source data at all, I promise. Also, it's base 16 :) Anyhow, the source data was most definitely base 2 (as is your computer's memory, I assume) and later encoded into base52 to be represented as a string (unless someone at Microsoft wrote it in base52, which seems unlikely).
    - dpark 11y ago
      > 0xFF is a number I just made up, no source data at all, I promise. Also, it's base 16. It's not base 16 encoded, which was his point. Encoding demands a source. This is just a base-16 number unless you encoded something to arrive at this. You could interpret "Romeo and Juliet" as a very large base65 number (65 unique chars in the random copy I grabbed) if you want, but it's not meaningful or accurate to call it a base65 encoding. > Even if that were true, the source data was most definitely encoded from base 2 (which is what our computers work with). This is the kind of pedantry that people hate because it adds nothing to the conversation. It's a way to inject "I'm right" moments into the conversation so you can feel smart, while no one else really cares. It makes for unpleasant conversations. <pedantry> You're also not right. Your brain doesn't work in base-2, and you likely didn't enter this number into your computer in base2. You typed in the string "0xFF", and that string was encoded in base 2. The base2 that represents the string "0xFF" is very different from the base2 number that represents the logical (base16) number 0xFF. </pedantry>
      - kaoD 11y ago
        > It's not base 16 encoded, which was his point. I didn't understand it that way. Also, your whole <pedantry> block and the paragraph above is based on misunderstanding my comment (probably because I'm not a native speaker and you caught me inbetween edits). I think you're the only one making an "unpleasant conversation".
- jlebar 11y ago
  > We programmers like being specific. But above all, we like being pedantic. (Not you.) :)
- SixSigma 11y ago
  [a-Z] and [a-Z0-9] would be a better representation, no?
RIMR 11y ago
No, it's a very specific way to describe a random string. Don't come to HN if you're expecting everything to be in layman's terms.
- dang 11y ago
  > Don't come to HN if you're expecting everything to be in layman's terms That's not nice. Please don't do that. I doubt that dpark is "expecting everything to be in layman's terms", but even if dpark were, many HN users would be happy to explain. And that's the kind of site we want.
  - RIMR 11y ago
    Then why describe being pedantic (extremely specific) as being "obtuse" (annoyingly insensitive)?
    - dpark 11y ago
      Because the specificity here is inaccurate and misleading. I've left plenty of comments about what's wrong with the term "base52-encoded random numbers" here and so have a number of other commenters. I didn't ask for anyone to use lay terminology, but it's reasonable to ask for clear and correct terminology. One of the frustrating things about reading academic papers is that many authors insist on using less common and less clear phrasing when there are much simpler ways of saying the same things. It makes for unpleasant, heavy reading and it makes the author sound pompous. "Obtuse" also means dumb, and is often used to mean "difficult to understand". "Abstruse" might have been a better choice of word.
peterwwillis 11y ago
It's not random letters. It's random numbers encoded in base52. Because the number strings are encoded, they're probably not random at all.
- dpark 11y ago
  You have no way of knowing that. All you see are some random-looking strings. These could be numbers (random or not) that were encoded as base52. These could also be numbers encoded as base64, or base88, or any other base52+. Or they could be randomly-generated strings and there is no meaningful number underlying them.
  - daveloyall 11y ago
    hobbes@namagiri:~/scratch$ echo gYxseNjwafVPfgsoHnzLblmmAxZUiOnGcchqEAEwjyxwjUIfpXfJQcdLapTmFaqHGCFsdvpLarmPJLOZYMEILGNIPwNOgEazuBVJcyVjBRL|ent Entropy = 5.352821 bits per byte. Optimum compression would reduce the size of this 108 byte file by 33 percent. Chi square distribution for 108 samples is 650.52, and randomly would exceed this value less than 0.01 percent of the times. Arithmetic mean value of data bytes is 92.6019 (127.5 = random). Monte Carlo value for Pi is 4.000000000 (error 27.32 percent). Serial correlation coefficient is 0.142915 (totally uncorrelated = 0.0). ...Which is meaningless without context. Let's see if we can create some context... hobbes@namagiri:~/scratch$ echo "You have no way of knowing that. All you see are some random-looking strings. These could be numbers (random or not) that were encoded as base52. These could also be numbers encoded as base64, or base88, or any other base52+. Or they could be randomly-generated strings and there is no meaningful number underlying them." |base64 |sed -e :a -e '$!N; s/\n//; ta' WW91IGhhdmUgbm8gd2F5IG9mIGtub3dpbmcgdGhhdC4gQWxsIHlvdSBzZWUgYXJlIHNvbWUgcmFuZG9tLWxvb2tpbmcgc3RyaW5ncy4gVGhlc2UgY291bGQgYmUgbnVtYmVycyAocmFuZG9tIG9yIG5vdCkgdGhhdCB3ZXJlIGVuY29kZWQgYXMgYmFzZTUyLiBUaGVzZSBjb3VsZCBhbHNvIGJlIG51bWJlcnMgZW5jb2RlZCBhcyBiYXNlNjQsIG9yIGJhc2U4OCwgb3IgYW55IG90aGVyIGJhc2U1MisuIE9yIHRoZXkgY291bGQgYmUgcmFuZG9tbHktZ2VuZXJhdGVkIHN0cmluZ3MgYW5kIHRoZXJlIGlzIG5vIG1lYW5pbmdmdWwgbnVtYmVyIHVuZGVybHlpbmcgdGhlbS4K ok, that's base64. Let's turn that into base52... CL-USER> (to-base 52 (from-base 64 "WW91IGhhdmUgbm8gd2F5IG9mIGtub3dpbmcgdGhhdC4gQWxsIHlvdSBzZWUgYXJlIHNvbWUgcmFuZG9tLWxvb2tpbmcgc3RyaW5ncy4gVGhlc2UgY291bGQgYmUgbnVtYmVycyAocmFuZG9tIG9yIG5vdCkgdGhhdCB3ZXJlIGVuY29kZWQgYXMgYmFzZTUyLiBUaGVzZSBjb3VsZCBhbHNvIGJlIG51bWJlcnMgZW5jb2RlZCBhcyBiYXNlNjQsIG9yIGJhc2U4OCwgb3IgYW55IG90aGVyIGJhc2U1MisuIE9yIHRoZXkgY291bGQgYmUgcmFuZG9tbHktZ2VuZXJhdGVkIHN0cmluZ3MgYW5kIHRoZXJlIGlzIG5vIG1lYW5pbmdmdWwgbnVtYmVyIHVuZGVybHlpbmcgdGhlbS4K")) "6lH81qbtcGjfFOclhdtt7ieuljADG17Ou6swolu2A2qlnO52zmMkG8Nfk2APbEbso4idFF44wsLIGfrOg5atP0ucg5gubxAcD9ztMcboeC4sAui28skbwtEiuv64OuD8fbFnn1M01oeq3bH7n9bvu8p3P1MwirdDHxKDONktDvtNOLE1srOz2I4wNLsBpgOGIlLs1i11xt58JpOC1whJ54Krmln1ahmrvksODe7kqjtBazKzKamu5tygI6hGHq3h123Ighyw8s2MxE4dl9rBdBNG1o7tJM2HvzOh955NpLB33nuPr4OwfhjB618y1BP9y2euMquIMszOuH1rPAEkBccOu9qIJBqKgGf1qH42bBd7GOMsbKExosd8CErJlMIAcEyyytFzoKOfkJy1ExEnKc0iE7OGkpLJM3ybB2JNlnwtrC5F0cH8kB41IIv0BwNk9DO" Astute readers will note that this output contains numeric digits. There's more than one representation of "base-52". The one above goes from 0 through p. An alternative would go from A-z. But none of that matters to measure the entropy of base-52 encoded English text, ya dig? hobbes@namagiri:~/scratch$ echo "6lH81qbtcGjfFOclhdtt7ieuljADG17Ou6swolu2A2qlnO52zmMkG8Nfk2APbEbso4idFF44wsLIGfrOg5atP0ucg5gubxAcD9ztMcboeC4sAui28skbwtEiuv64OuD8fbFnn1M01oeq3bH7n9bvu8p3P1MwirdDHxKDONktDvtNOLE1srOz2I4wNLsBpgOGIlLs1i11xt58JpOC1whJ54Krmln1ahmrvksODe7kqjtBazKzKamu5tygI6hGHq3h123Ighyw8s2MxE4dl9rBdBNG1o7tJM2HvzOh955NpLB33nuPr4OwfhjB618y1BP9y2euMquIMszOuH1rPAEkBccOu9qIJBqKgGf1qH42bBd7GOMsbKExosd8CErJlMIAcEyyytFzoKOfkJy1ExEnKc0iE7OGkpLJM3ybB2JNlnwtrC5F0cH8kB41IIv0BwNk9DO" | ent Entropy = 5.610518 bits per byte. Optimum compression would reduce the size of this 452 byte file by 29 percent. Chi square distribution for 452 samples is 2093.27, and randomly would exceed this value less than 0.01 percent of the times. Arithmetic mean value of data bytes is 86.3496 (127.5 = random). Monte Carlo value for Pi is 4.000000000 (error 27.32 percent). Serial correlation coefficient is 0.018253 (totally uncorrelated = 0.0). Conclusion: I don't think the original text was pseudorandom. If you can convince me that the original isn't "base-52 encoded" at all (and I'd be easily convinced), I'm willing to reevaluate that conclusion. I'm also interested to see if anyone sees a flaw in my process.

jimrandomh 11y ago

For some reason, all the replies to this are focused on how I described the title and description strings. Which is... not at all the interesting part of this, and not something I gave much thought when I wrote this comment.