4 ms·

> That's the crux of it isn't it. Ignorance. How can you type that with a straight face? By all means keep rolling around with an unpatched Windows machine, thi

> That's the crux of it isn't it. Ignorance. How can you type that with a straight face? By all means keep rolling around with an unpatched Windows machine, thinking this is 1999 where the biggest threat is internet worms spreading via open ports and hoping your cheap, exploit-infested router is going to help you. If you router is infested you've got even a bigger problem - your system then can be trivially exploited because the attacker may inject whatever HTML code he wishes and render your system totally powned. Also remind me when was the last time Windows had readily available exploits against its core open ports. I'm under the impression that you remember that circa 15 years ago there was an exploit for unpatched Windows 2000 which either infected your PC or rebooted it. Again, all I hear is bla bla bla and no valid argumentation. Also, I'm ready to install Windows 7 SP1 64 (that's now a six years old system) without any patches applied and I can give you its IP to break in. I can bet $1000 you won't break in in any amount of time even with all network ports open. So much for "windows updates must be installed in order to survive". Pathetic.

orf 10y ago
> Again, all I hear is bla bla bla and no valid argumentation. All I hear is "bla bla bla who needs security updates" with absolutely nothing of substance to back that point of view up up. Feel free to use the reply button to actually make this point using some actual facts, data or anything other than your apparent superpowers at deflecting exploits with your bare hands. In the meantime I hope you don't do any banking on that machine or even browse the internet. Edit: SP1 was released in 2010, here is a breakdown of Windows 7 CVEs: https://www.cvedetails.com/product/17153/Microsoft-Windows-7.html?vendor_id=26 https://www.cvedetails.com/product/17153/Microsoft-Windows-7... Since 2011 I count nearly 100 RCE exploits, 40 overflows, 20 memory corruptions and like 150 privilege escalations. I hope you've patched all those, or is blind faith the best protection? Another edit: https://www.cvedetails.com/vulnerability-list.php?vendor_id=26&product_id=17153&version_id=&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=0&month=0&cweid=0&order=3&trc=577&sha=47d29bad4e41fa72927e93dbd6b6e2cbeefa4e07 https://www.cvedetails.com/vulnerability-list.php?vendor_id=... 'Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT allow remote attackers to execute arbitrary code via a malformed asynchronous RPC request, aka "Remote Procedure Call Vulnerability." ' Hmm... what's that about open ports being absolutely fine because of... reasons? Do some damn research.
- mynameislegion 10y ago
  References, CVEs, etc. etc. etc. Can you break into my PC if I give your an external IP address or not? I guess you can't that's why you give me all those links which mean sh*t. Let unpatched Windows 7 SP1 have 1000 critical remote vulnerabilities - show me at least one that you yourself can exploit. I guess you don't understand how vulnerabilities are discovered and published. And what the purpose of CVE is.
  - orf 10y ago
    Ahh the old "hack me m8" defence. Nice one. Yet again I don't see any actual substance to your replies. If you could post something, just anything to back your frankly outlandish claims out that would be awesome. I work for an infosec company, and the answer is yes. Yes any number of us could dos, get an RCE or otherwise fuck with your unpatched windows 7 machine that is missing 5 years of critical updates. Just fire up nessus, point it at your machine, see what it comes back with and find an exploit for one of those issues from our extensive library, or on any number of public resources. Bread and butter. We'd be in the wrong industry if we couldn't, and it's not exactly hard. However it would be pretty unethical/illegal to do so and who the hell wants to waste time doing that to a crazy person on HN. It's clear you're clueless, and that's fine because its your choice to be uneducated. Just please don't spread this misinformation on your blog. Or better yet do: write a big blog post about how security patches are not needed along with a "hack me please" challenge at the end. You've not nothing to worry about, right?
    - mynameislegion 10y ago
      I don't see any substance in your replies other trying to be menacing because you want to look like an authority in security. You're none to me - I know nothing about you or the company you work for - you might as well be BS'ing everyone here. Also you quickly found the words to weasel yourself out of the posed problem - you're talking too much, yet you admit that you're unable to hack into a 6 yo unpatched system. Six freaking years old system which, according to you, must be hackable using readily available exploits which take a few seconds to be found on Google. So much for a security (more like BS) expert. Again, your post is rife with name calling and no sound arguments. Dude, I really doubt your work for any security company after repeatedly calling me "clueless", "uneducated", "crazy". I have nothing to worry about - I can expose a VM running Windows 7 no problems. You surely look like a lame self proclaimed security "expert" if you thought I'd expose a real physical PC. In short: far too many scary words, little to no substance. Peace, dude. Go troll someone else. I yawned several times while reading your scary reply.

orf 10y ago

> Again, all I hear is bla bla bla and no valid argumentation. All I hear is "bla bla bla who needs security updates" with absolutely nothing of substance to back that point of view up up. Feel free to use the reply button to actually make this point using some actual facts, data or anything other than your apparent superpowers at deflecting exploits with your bare hands. In the meantime I hope you don't do any banking on that machine or even browse the internet. Edit: SP1 was released in 2010, here is a breakdown of Windows 7 CVEs: https://www.cvedetails.com/product/17153/Microsoft-Windows-7.html?vendor_id=26 https://www.cvedetails.com/product/17153/Microsoft-Windows-7... Since 2011 I count nearly 100 RCE exploits, 40 overflows, 20 memory corruptions and like 150 privilege escalations. I hope you've patched all those, or is blind faith the best protection? Another edit: https://www.cvedetails.com/vulnerability-list.php?vendor_id=26&product_id=17153&version_id=&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=0&month=0&cweid=0&order=3&trc=577&sha=47d29bad4e41fa72927e93dbd6b6e2cbeefa4e07 https://www.cvedetails.com/vulnerability-list.php?vendor_id=... 'Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT allow remote attackers to execute arbitrary code via a malformed asynchronous RPC request, aka "Remote Procedure Call Vulnerability." ' Hmm... what's that about open ports being absolutely fine because of... reasons? Do some damn research.

mynameislegion 10y ago
References, CVEs, etc. etc. etc. Can you break into my PC if I give your an external IP address or not? I guess you can't that's why you give me all those links which mean sh*t. Let unpatched Windows 7 SP1 have 1000 critical remote vulnerabilities - show me at least one that you yourself can exploit. I guess you don't understand how vulnerabilities are discovered and published. And what the purpose of CVE is.
- orf 10y ago
  Ahh the old "hack me m8" defence. Nice one. Yet again I don't see any actual substance to your replies. If you could post something, just anything to back your frankly outlandish claims out that would be awesome. I work for an infosec company, and the answer is yes. Yes any number of us could dos, get an RCE or otherwise fuck with your unpatched windows 7 machine that is missing 5 years of critical updates. Just fire up nessus, point it at your machine, see what it comes back with and find an exploit for one of those issues from our extensive library, or on any number of public resources. Bread and butter. We'd be in the wrong industry if we couldn't, and it's not exactly hard. However it would be pretty unethical/illegal to do so and who the hell wants to waste time doing that to a crazy person on HN. It's clear you're clueless, and that's fine because its your choice to be uneducated. Just please don't spread this misinformation on your blog. Or better yet do: write a big blog post about how security patches are not needed along with a "hack me please" challenge at the end. You've not nothing to worry about, right?
  - mynameislegion 10y ago
    I don't see any substance in your replies other trying to be menacing because you want to look like an authority in security. You're none to me - I know nothing about you or the company you work for - you might as well be BS'ing everyone here. Also you quickly found the words to weasel yourself out of the posed problem - you're talking too much, yet you admit that you're unable to hack into a 6 yo unpatched system. Six freaking years old system which, according to you, must be hackable using readily available exploits which take a few seconds to be found on Google. So much for a security (more like BS) expert. Again, your post is rife with name calling and no sound arguments. Dude, I really doubt your work for any security company after repeatedly calling me "clueless", "uneducated", "crazy". I have nothing to worry about - I can expose a VM running Windows 7 no problems. You surely look like a lame self proclaimed security "expert" if you thought I'd expose a real physical PC. In short: far too many scary words, little to no substance. Peace, dude. Go troll someone else. I yawned several times while reading your scary reply.