12 ms·
Security Update for Microsoft Malware Protection Engine
- octo_t 9y agoOther thread is up at: https://news.ycombinator.com/item?id=14296959 https://news.ycombinator.com/item?id=14296959 (although doesn't mention that MSFT have released a fix already).
- abalos 9y agoSerious props to Microsoft for getting the fix out the door so quickly. I'm glad that they took this seriously because this is a major vulnerability.
- vesinisa 9y agoWhat is less impressive is that this exploit was even possible. Executing all incoming JavaScript as root user, what the heck? Even if they patched this one bug in the interpreter, how many more are there that are not yet discovered / only known by dark market exploit vendors?
- abalos 9y agoVery true. I wouldn't be surprised if see more patches after this one. Based on their initial response time they seem to be taking this as seriously as it warrants. Hopefully they move away from this model eventually - it won't be easy to lock this down properly.
- booleandilemma 9y agoDetails from Microsoft: https://technet.microsoft.com/en-us/library/security/4022344 https://technet.microsoft.com/en-us/library/security/4022344
- nailer 9y agoHrm. Microsoft article says: > For more information on how to verify the version number for the Microsoft Malware Protection Engine that your software is currently using, see the section, "Verifying Update Installation", in Microsoft Knowledge Base Article 2510781. But the link points to https://technet.microsoft.com/en-us/library/security/4022344 https://technet.microsoft.com/en-us/library/security/4022344 which doesn't include Windows 10. Edit: guessed and found it: Start -> Windows Defender Security Centre -> (cog icon in bottom left) -> About -> Engine Version
- johnhattan 9y agoAnd if your engine version is equal to or less than 1.1.13701.0, then you still have the vulnerability and need to update ASAP.
- 0xfeba 9y agoAnd for Microsoft Security Essentials, Click the down arrow next to the Help link, and select about.
- dsp1234 9y agoFrom powershell (on Windows 10/Server 2016, possibly others): (Get-MpComputerStatus).AmEngineVersion Also, from powershell: Update-MpSignature to just go ahead and run the update process
- nailer 9y agoThanks! I wish Microsoft would throw the powershell one liner in their document, most poeple interested in this stuff would just rather do: Get-MpComputerStatus | select 'AmEngineVersion' Than read a longwinded set of commands. PS. Cool technique with the parens.
- olig15 9y ago> Mr Cluley did add, however, that he thought the Project Zero protocol for announcing the vulnerability - which had included information that malicious hackers might have found useful - had been risky. > "That can help the bad guys," he said. This is just plain wrong, isn't it? I was under the impression that all of the details on PZ are hidden until either a fix is released, or 90 days have passed. I don't see how this could have 'helped the bad guys'.
- zitterbewegung 9y agoThey are commenting on the disclosure of the exploix and how to exploit it. Obviously everyone will have the patch installed.
- snowwolf 9y agoYeah, I don't get this. The announcement on twitter contained zero information apart from "there's a remote code exec vulnerability on windows". Which I think you could confidently say at ANY point in time (about ANY system). But Graham and others (https://twitter.com/taviso/status/861575086632968192 https://twitter.com/taviso/status/861575086632968192) continue to attack Tavis for announcing the fact that there is a known vulnerability. As if this somehow makes users more insecure. Surely it is better to alert people (and especially organisations) that a major security issue has been found so that they can be prepared to patch their systems as soon as a fix is released?
- richmarr 9y agoI know comparatively little about this stuff, so please excuse the question if it's dumb... If being alerted allows organisations to prepare to patch, surely it also allows malicious actors to prepare to exploit? My lay gut feeling is this seems more a trade-off in publicity between the announcing party and the software provider, both wanting to be seen with the initiative so that they look good.
- snowwolf 9y agoMalicious actors are far more proactive already about watching for security patches and reverse engineering them to work out how to exploit unpatched systems. Once a patch is released the cat is out the bag, and the only solution is to patch as quickly as possible.
- reallydontask 9y agoshame that the instructions for verifying the update don't apply to Windows 10
- Noseshine 9y agoThey do? Just check the version: Open Defender, go to Help => About, check "Engine Version". Should be 1.1.13704.0 or higher.
- sbuttgereit 9y agoI also find the version under Settings -> Updates & Security -> Windows Defender. Thant screen gives you the version numbers in the place you're most likely to want to update.
- mannykannot 9y agoIf you assume the instructions for Windows 8 apply to windows 10, then that is what you find. Also, the security advisory itself links to this page with the statement "For more information on how to verify the engine version number that your software is currently using, see the section, "Verifying Update Installation", in Microsoft Knowledge Base Article 2510781.", but the actual section title is "Verification of the update installation", so when I searched for the stated section name, I did not find it. These are small mistakes, but it is sloppy work. A person might be left wondering if there is some Windows-10 -specific information somewhere in the rabbit-warren of links leading from the security advisory.
- nickthegreek 9y agoon my win10 machine, I had to open Windows Defender Security Center, click the cog in the lower left, and then click 'About' in the upper right.
- dghughes 9y agoMy Windows 10 system showed 1.1.13701.0 but Windows Update indicated everything was up to date. I clicked on the usual Windows Update button Check for Updates anyway and now Defender shows 1.1.13704.0
- davidhyde 9y ago"An attacker who successfully exploited this vulnerability could execute arbitrary code in the security context of the LocalSystem account and take control of the system." Why would software that is written to scan potentially dangerous files be configured to run under the LocalSystem account? Shouldn't it run under a least privilege account?
- redcalx 9y agoAny suggestions for a good quality virus scanner in which I can have some confidence in regarding a reasonable choice in how it operates. If I'm understanding correctly Defender runs with high privilege and has a very large security footprint; as such I don't think it's something I want to run.
- sxldier 9y agoI'd recommend Avira.
- acdha 9y agoEverything on the market has had something like this bug. I'd stick with Defender simply because Microsoft will put the resources into dragging their coding practices out of the 90s and they're better about general QA testing.
- user5994461 9y ago>>> Any suggestions for a good quality virus scanner in which I can have some confidence in regarding a reasonable choice in how it operates. All antivirus operate like rootkits. It's basically a rootkit trying to block other rootkits to install. Microsoft has the advantage to have access to all windows API and they put a ton of efforts in testing/compatibility. It is the least worst of all evil.
- spyder 9y agoDid they only fix the type confusion or did they do something about the unsandboxed JavaScript interpreter running as SYSTEM ?
- CGamesPlay 9y agoThey got this out incredibly quickly so it's likely that either they just fixed the type confusion or that they already had a sandboxing modification ready which they were saving for a major update but had to rush out. I don't know the age of the defender code, but my money is on the former.