6 ms·

Microsoft fixed critical vulnerabilities in uncredited update released in March

63 points by fujipadam 9y ago

TwoBit 9y ago
Why are my taxes being used to fund the NSA exploiting our software instead improving it?
- yeukhon 9y ago
  Because, cynical as this may sound to some people, that's what government does, in the name of national security. The argument that we keep zero-days exploits secret is basically security by obfuscation. That will only last until another smart person discovers it and sell that to the highest bidder. But the interest of national security in modern cyber warfare is about gathering intel. Otherwise, we wouldn't be looking at this news right now, we wouldn't have government websites hacked or classified documents stolen or government officials using their personal mail servers, if we are serious about the safety of our national computer infrastructure.
  - mistaken 9y ago
    I'm pretty sure that they buy a lot of these exploits as well. If you can trust the NSA, I don't think that keeping the exploits secret is such a big deal. There are other damaging vulnerabilities that even the state actors doesn't know about and are being exploited by organized crime. It's a cat and mouse game.
    - nthcolumn 9y ago
      ..and a very distasteful business, many of these developers live in SEAsia for dubious reasons and peddle their warez to support their sickening lifestyles, I would be ok with certain CIA/SIS proffered solutions in these cases. There is no current shortage of windows 0days that I know of.
- eksemplar 9y ago
  Probably because "your" enemies use "your" software as well. If it makes you feel any better it looks like the NSA shared the vulnerabilities with Microsoft a month before they were leaked.
  - cotillion 9y ago
    A month before they were leaked to the public. Not a month before they were leaked to another hostile actor.
  - mtgx 9y ago
    But the U.S. still has the most to suffer from them (as a country). But from NSA's point of view, even if the U.S. still has to suffer from those exploits, it's "worth it" because for every American that is getting harmed by those exploits, they can spy on 10 other foreigners. So it's not really a matter of "defending the country" but of "value of exploit". Kind of how in the WW2 they used to allow one or two or five of their own ships to be sunk by the enemy just so they don't reveal that they intercepted their communications (which I guess the argument was the intelligence would've been more useful against more of the enemies' ships). Also, this was a large batch of exploits, and the NSA knew eventually they would get released. So they might as well be the "heroes of the day" and get companies to fix them, especially if they can get the publicity for it. But for every one of these they fix there are probably dozens of others they don't want fixed, like for instance all the vulnerabilities in Chinese routers and smartphones and smart TVs and other electronics. It's not that hard to verify that this is their logic. Look how they want to push backdoors and how they fight encryption, just to catch a few people, even if that harms everyone else. From their point of view "more security" is a bad thing. And I'm not even sure you can expect much else from a spy agency. When you have a hammer, you want every problem to be a nail. It should be up to everyone else to push back on that logic.
  - cies 9y ago
    I think the NSA spying/surveillancing harder on "us" then on "them" (the enemies).
    - bigbugbag 9y ago
- bigbugbag 9y ago
  Because you have no say in how tax monies are spent, that's how taxes work. Then there is the rule for rulers[1], then because that's how USA rolls (have a look at the history of the country and you'll see that this is not an isolated event), also amusing ourselves to death[2], politics as usual, business as usual, capitalism, unsustainable economy based on growth and a bunch of other reasons, but mostly the great USA land of free yay! [1]: http://www.cgpgrey.com/blog/rules-for-rulers http://www.cgpgrey.com/blog/rules-for-rulers [2]: http://citizenactionmonitor.files.wordpress.com/2011/06/amusing-ourselves-to-death.png http://citizenactionmonitor.files.wordpress.com/2011/06/amus...
cies 9y ago
MS has a long history of broking in zero-days. Could not find an article with sources quoted, but a lot of cases have come to light: https://www.quora.com/Is-there-any-evidence-for-backdoors-in-Windows-or-other-client-software-for-the-NSA-CIA https://www.quora.com/Is-there-any-evidence-for-backdoors-in...
- repples 9y ago
  That Quora post is pretty bad. Actual evidence is requested, but the top answer is a list of wild conjecture. The responder prefaces most of their comment with "it is widely believed that" and "it is likely that", states without any explanation that the Malicious Software Removal Tool is somehow a backdoor, and that "everyone who knows about [the backdoors] is under NDA", with no evidence to support that statement either.
  - acdha 9y ago
    The second paragraph trying to class source code disclosure programs intended to find backdoors as proof of their existence was amazing, too. The fact that it got 1.5k upvotes is a great reminder that voting systems aren't a magic wand for solving quality issues. People just love conspiracy theories too much to think critically…
  - bitexploder 9y ago
    Undisclosed "1-day" is real and has gone on forever. A popular set of tools is binary diff tools such as the now defunct Zynamics acquired by Google. There is evidence. The amount of tooling around examining MS patches should convince most. http://www.blackhat.com/presentations/bh-usa-09/OH/BHUSA09-Oh-DiffingBinaries-SLIDES.pdf http://www.blackhat.com/presentations/bh-usa-09/OH/BHUSA09-O... http://www.phreedom.org/presentations/reverse-engineering-and-security/reverse-engineering-and-security.pdf http://www.phreedom.org/presentations/reverse-engineering-an... People built businesses around this. With so many eyeballs on release diffs, undisclosed vulnerable were often discovered (and still are). With the number of experts on file observing this it should not be controversial at all.
    - 9y ago
sqldba 9y ago
What I feel is awful is the lack of information stored against each update. It's all just "security" or "reliability" and possibly a link to a KB which says the same. Some large organisations still have stalwart IT managers who insist not to apply updates unless they know it affects a specific issue that they have. And now that this information is unpublished they apply nothing. It's lost on me how they keep their jobs. Oh well.
- yjftsjthsd-h 9y ago
  > And now that this information is unpublished they apply nothing. It's lost on me how they keep their jobs. IT managers keep their jobs by caring about stability and not applying changes without clear reason.
- symlinkk 9y ago
  Why is that necessary? Ive run Windows on the desktop for probably 10 years and I have never had an update break anything. Seems like people just trying to make themselves useful if you ask me.
  - rbanffy 9y ago
    It never broke anything you noticed. What if you are a bank, an airline or a hospital, with thousands of networked Windows machines, and one update breaks a specific networking feature (remember [1]) and that crashes your most vital piece of software? 1- https://support.microsoft.com/en-us/help/968920/windows-vista-and-windows-server-2008-dns-clients-do-not-honor-dns-round-robin-by-default https://support.microsoft.com/en-us/help/968920/windows-vist...
I_am_neo 9y ago
Microsoft is a broken shell company with awful PR

63 points by fujipadam 9y ago

TwoBit 9y ago

Why are my taxes being used to fund the NSA exploiting our software instead improving it?

yeukhon 9y ago
Because, cynical as this may sound to some people, that's what government does, in the name of national security. The argument that we keep zero-days exploits secret is basically security by obfuscation. That will only last until another smart person discovers it and sell that to the highest bidder. But the interest of national security in modern cyber warfare is about gathering intel. Otherwise, we wouldn't be looking at this news right now, we wouldn't have government websites hacked or classified documents stolen or government officials using their personal mail servers, if we are serious about the safety of our national computer infrastructure.
- mistaken 9y ago
  I'm pretty sure that they buy a lot of these exploits as well. If you can trust the NSA, I don't think that keeping the exploits secret is such a big deal. There are other damaging vulnerabilities that even the state actors doesn't know about and are being exploited by organized crime. It's a cat and mouse game.
  - nthcolumn 9y ago
    ..and a very distasteful business, many of these developers live in SEAsia for dubious reasons and peddle their warez to support their sickening lifestyles, I would be ok with certain CIA/SIS proffered solutions in these cases. There is no current shortage of windows 0days that I know of.
eksemplar 9y ago
Probably because "your" enemies use "your" software as well. If it makes you feel any better it looks like the NSA shared the vulnerabilities with Microsoft a month before they were leaked.
- cotillion 9y ago
  A month before they were leaked to the public. Not a month before they were leaked to another hostile actor.
- mtgx 9y ago
  But the U.S. still has the most to suffer from them (as a country). But from NSA's point of view, even if the U.S. still has to suffer from those exploits, it's "worth it" because for every American that is getting harmed by those exploits, they can spy on 10 other foreigners. So it's not really a matter of "defending the country" but of "value of exploit". Kind of how in the WW2 they used to allow one or two or five of their own ships to be sunk by the enemy just so they don't reveal that they intercepted their communications (which I guess the argument was the intelligence would've been more useful against more of the enemies' ships). Also, this was a large batch of exploits, and the NSA knew eventually they would get released. So they might as well be the "heroes of the day" and get companies to fix them, especially if they can get the publicity for it. But for every one of these they fix there are probably dozens of others they don't want fixed, like for instance all the vulnerabilities in Chinese routers and smartphones and smart TVs and other electronics. It's not that hard to verify that this is their logic. Look how they want to push backdoors and how they fight encryption, just to catch a few people, even if that harms everyone else. From their point of view "more security" is a bad thing. And I'm not even sure you can expect much else from a spy agency. When you have a hammer, you want every problem to be a nail. It should be up to everyone else to push back on that logic.
- cies 9y ago
  I think the NSA spying/surveillancing harder on "us" then on "them" (the enemies).
  - bigbugbag 9y ago
bigbugbag 9y ago
Because you have no say in how tax monies are spent, that's how taxes work. Then there is the rule for rulers[1], then because that's how USA rolls (have a look at the history of the country and you'll see that this is not an isolated event), also amusing ourselves to death[2], politics as usual, business as usual, capitalism, unsustainable economy based on growth and a bunch of other reasons, but mostly the great USA land of free yay! [1]: http://www.cgpgrey.com/blog/rules-for-rulers http://www.cgpgrey.com/blog/rules-for-rulers [2]: http://citizenactionmonitor.files.wordpress.com/2011/06/amusing-ourselves-to-death.png http://citizenactionmonitor.files.wordpress.com/2011/06/amus...

cies 9y ago

MS has a long history of broking in zero-days. Could not find an article with sources quoted, but a lot of cases have come to light: https://www.quora.com/Is-there-any-evidence-for-backdoors-in-Windows-or-other-client-software-for-the-NSA-CIA https://www.quora.com/Is-there-any-evidence-for-backdoors-in...

repples 9y ago
That Quora post is pretty bad. Actual evidence is requested, but the top answer is a list of wild conjecture. The responder prefaces most of their comment with "it is widely believed that" and "it is likely that", states without any explanation that the Malicious Software Removal Tool is somehow a backdoor, and that "everyone who knows about [the backdoors] is under NDA", with no evidence to support that statement either.
- acdha 9y ago
  The second paragraph trying to class source code disclosure programs intended to find backdoors as proof of their existence was amazing, too. The fact that it got 1.5k upvotes is a great reminder that voting systems aren't a magic wand for solving quality issues. People just love conspiracy theories too much to think critically…
- bitexploder 9y ago
  Undisclosed "1-day" is real and has gone on forever. A popular set of tools is binary diff tools such as the now defunct Zynamics acquired by Google. There is evidence. The amount of tooling around examining MS patches should convince most. http://www.blackhat.com/presentations/bh-usa-09/OH/BHUSA09-Oh-DiffingBinaries-SLIDES.pdf http://www.blackhat.com/presentations/bh-usa-09/OH/BHUSA09-O... http://www.phreedom.org/presentations/reverse-engineering-and-security/reverse-engineering-and-security.pdf http://www.phreedom.org/presentations/reverse-engineering-an... People built businesses around this. With so many eyeballs on release diffs, undisclosed vulnerable were often discovered (and still are). With the number of experts on file observing this it should not be controversial at all.
  - 9y ago

sqldba 9y ago

What I feel is awful is the lack of information stored against each update. It's all just "security" or "reliability" and possibly a link to a KB which says the same. Some large organisations still have stalwart IT managers who insist not to apply updates unless they know it affects a specific issue that they have. And now that this information is unpublished they apply nothing. It's lost on me how they keep their jobs. Oh well.

yjftsjthsd-h 9y ago
> And now that this information is unpublished they apply nothing. It's lost on me how they keep their jobs. IT managers keep their jobs by caring about stability and not applying changes without clear reason.
symlinkk 9y ago
Why is that necessary? Ive run Windows on the desktop for probably 10 years and I have never had an update break anything. Seems like people just trying to make themselves useful if you ask me.
- rbanffy 9y ago
  It never broke anything you noticed. What if you are a bank, an airline or a hospital, with thousands of networked Windows machines, and one update breaks a specific networking feature (remember [1]) and that crashes your most vital piece of software? 1- https://support.microsoft.com/en-us/help/968920/windows-vista-and-windows-server-2008-dns-clients-do-not-honor-dns-round-robin-by-default https://support.microsoft.com/en-us/help/968920/windows-vist...

I_am_neo 9y ago

Microsoft is a broken shell company with awful PR