4 ms·

Selectively pulling updates doesn't seem feasible. Consider that: * Microsoft does not disclose what (most) updates do and it's not feasible to reverse enginee

Selectively pulling updates doesn't seem feasible. Consider that: * Microsoft does not disclose what (most) updates do and it's not feasible to reverse engineer all of them to check. * Multiple updates, including critical security patches, are published as a single monthly rollup and cannot be (easily) separated from one another. * The Windows 10 Update client doesn't officially support cherrypicking some updates and delaying others indefinitely; if you let it connect to the (real) Microsoft update server it will try to install all available updates. * You're not downloading individual per-update executables and checking their hashes; you're running a program (the Windows Update client) that, once it trusts the server it connects to, uncritically runs any code the server sends to it. Now consider all of that when the adversary controls not just individual update contents but the whole update server or delivery channel...

lend000 9y ago
You can also use a separate computer to manually install Windows updates: http://www.windowscentral.com/how-download-and-install-windows-10-cumulative-updates-manually http://www.windowscentral.com/how-download-and-install-windo... Granted, the DNS blackhole is more about blocking the spyware than isolating single updates.
- danarmak 9y ago
  I wasn't aware of the MS Update Catalog. It's nice to know that it's an option. This does allow installing single updates without using the Microsoft Update client It's not a long-term solution, though: 1. You need to know the KB article ID of the update you're looking for. And again, the individual update descriptions or KB articles frequently just say "something was fixed" but not what. 2. Some updates will probably fail to install because previous updates to the same component weren't installed. Conversely, updates that just give you the latest version of a file or application might auto-install the older updates you wanted to skip. In any event, even if you successfully skip most updates, the main outcome will be that your system will be that much less secure and easier to take over using published vulns even without a backdoor...

lend000 9y ago

You can also use a separate computer to manually install Windows updates: http://www.windowscentral.com/how-download-and-install-windows-10-cumulative-updates-manually http://www.windowscentral.com/how-download-and-install-windo... Granted, the DNS blackhole is more about blocking the spyware than isolating single updates.

danarmak 9y ago
I wasn't aware of the MS Update Catalog. It's nice to know that it's an option. This does allow installing single updates without using the Microsoft Update client It's not a long-term solution, though: 1. You need to know the KB article ID of the update you're looking for. And again, the individual update descriptions or KB articles frequently just say "something was fixed" but not what. 2. Some updates will probably fail to install because previous updates to the same component weren't installed. Conversely, updates that just give you the latest version of a file or application might auto-install the older updates you wanted to skip. In any event, even if you successfully skip most updates, the main outcome will be that your system will be that much less secure and easier to take over using published vulns even without a backdoor...