14 ms·

Microsoft Issues WanaCrypt Patch for Windows 8, XP

266 points by my123 9y ago

mirimir 9y ago
> Additionally, we are taking the highly unusual step of providing a security update for all customers to protect Windows platforms that are in custom support only, including Windows XP, Windows 8, and Windows Server 2003. That's impressive!
- ddalex 9y ago
  It's impressive that they had the patches, but chose to put the security of their customers on a lower level than making more money by forcing said customers to upgrade.
  - douche 9y ago
    You can't support everything forever, even with the kind of resources Microsoft has available. At some point you've got to tell people to upgrade off the old shit, we're not supporting it anymore (unless you pay us exorbitantly to do so...)
  - rcaught 9y ago
    It's a 15 year old OS.
  - mirimir 9y ago
    They can't force XP etc users to upgrade. Custom support accounts probably got the patches some time ago. This release is for all users of XP etc. I'm sure that most of them have no support contracts. And many are likely running pirated versions. Maybe this is PR-driven. But I can't imagine how it directly makes money for them.
  - vmasto 9y ago
    Their (ex) customers placed their own security on a lower level themselves. WinXP is unsupported for quite some time and was given plenty of time to switch or upgrade. What's impressive is how people manage to spin this into an anti MS rant even when Microsoft is doing the right thing (stopping support for paleolithic software).
    - Dylan16807 9y ago
      > paleolithic software Windows 8 was shipping on brand new computers three years ago. And while upgrading your OS is nice in theory, it often means abandoning perfectly-good hardware because driver support for multiple versions of Windows is terrible. In this age of barely-getting-faster CPUs, how long do you think a piece of hardware should be usable?
      - vmasto 9y ago
        Windows 8.1 Update is supported until 2023 AFAIK. Also Windows 8 -> 10 was free for a reasonable amount of time. Purely out of interest what kind of hardware is incompatible between the two versions?
        Dylan16807 9y ago
        > Windows 8.1 Update is supported until 2023 AFAIK. Talking about 8, not 8.1 > Purely out of interest what kind of hardware is incompatible between the two versions? Many drivers tend to break as windows goes through changes. When I tried a preview of the windows 10 creators update I had a driver stop working right. There were also serious nVidia problems that broke the old driver versions; imagine that happening with your typical company that stops providing drivers after a year. Though the driver comment wasn't specifically about 8. Good luck upgrading XP to not-XP, even if your hardware can perform better than a modern Surface.
        belltaco 9y ago
        > Talking about 8, not 8.1 Windows 8.1 Update is basically a roll-up update service pack to Windows 8 and is a free upgrade. That's like complaining that the released patches work on XP SP2/SP3 but not the original XP. If someone fails to update Windows 8 to 8.1 Update or has magically written software that works on Windows 8 but not 8.1 Update, it's on them. >Many drivers tend to break as windows goes through changes. When I tried a preview of the windows 10 creators update I had a driver stop working right. There were also serious nVidia problems that broke the old driver versions; imagine that happening with your typical company that stops providing drivers after a year. Those drivers are typically either using bad coding practices or relying on unsupported features or bugs. Maybe you should contact them as a customer and let your displeasure known. If enough people do that they may actually do something about it.
  - belltaco 9y ago
    This is more like a pharmaceutical company taking a financial hit to help in a sudden epidemic by giving out antidotes/vaccines for free, for the sake of public interest and the ecosystem. Just because they had the vaccines ready in warehouses or could manufacture more easily doesn't mean that their customers "deserved" them for free before the epidemic hit. If the customers actually desired security, they would've paid for XP/2003 patches or upgraded to a different supported OS. Those customers messed up on their own, and Microsoft is giving them an out here.
    - toyg 9y ago
      > Just because they had the vaccines ready in warehouses or could manufacture more easily doesn't mean that their customers "deserved" them for free before the epidemic hit. Disagree.
    - qubex 9y ago
      I agree with you broadly but your analogy is flawed because patches have zero marginal cost (once developed, code can be infinitely duplicated at no additional cost) whereas vaccines are physical entities and therefore giving one to somebody entails not giving that same item to somebody else. If Microsoft had already developed these patches why not distribute them widely, since it costs nothing to do so and takes nothing away from paying customers?
Matt3o12_ 9y ago
Although it is probably good for the companies still using windows XP to receive those updates, I do not think updating windows xp was such a smart move because now those companies do not need to update once again and keep running outdated windows machines. If Microsoft did not provide this update for older OSes, I believe more people would update because they simply had to. Smaller hacks might not be enough for the manager of those machines to allocate resources to update, but this hack might have been just fatale enough for them to update those machines. And we should all expect to see such a hack again. This is not a one in a century thing. Such costly hacks could easily happen a few times a year.
- sschueller 9y ago
  I think the issue here is that Microsoft has a patch already for those special support contracts and holding it back may become some pr issue.
  - deleted 9y ago
    [deleted]
  - irl_ 9y ago
    What about all the other patches they're holding back? This can't be the only security issue they've only selectively distributed patches for.
    - my123 9y ago
      Yes, they hold back a lot of fixes. It's exceptional, a lot of unfixed flaws are still there. :)
    - easilyBored 9y ago
      They'd be no incentive to upgrade otherwise. XP is 16 years old! Microsoft is in a tough spot, this was a worldwide problem so they had no choice. They should make the support contracts for old version quadruple in price for every year and offer incentives to upgrades. Better for them, more revenue and less bad press for MSFT.
faragon 9y ago
In my opinion, hospitals should never run any kind of software accessing complex protocols locally. Should run everything, except real-time critical devices, using virtualized remote applications, so the security gets ensured at data-center level, instead of at client level.
- acqq 9y ago
  The "complex protocol" is actually "plain" Windows file sharing, which is practically always enabled in the local networks. That's how the computers in the local network are traditionally supposed to be maintained. I've managed a bunch of computers which weren't configured so, but configuring them that way you lose everything Microsoft created for the management of the computers in the local network -- to be effective you'd have to maintain and develop your own tools, which most of the companies wouldn't like you to do. It the users are supposed to "normal work" on the given computers, not enabling the file access is much harder to achieve. I know there are "everything virtualized" approaches, but they are really expensive.
  - faragon 9y ago
    Windows file sharing (SMB/CIFS) is complex, in comparison to delivering remote applications using HTTPS (TLS/HTTP) through one single port (which is very simple, and easier to secure). So compare: local applications running many client remote protocols, or running remote applications through HTTPS (TLS/HTTP) with all the complexity at server-side (e.g. in-building data center, or remote data center, with high availability and being fault-tolerant, etc.).
    - acqq 9y ago
      Personally, I consider the approach "nothing done on the clients" problematic on many levels. I like what Apple is doing, like trying to make the client phones do the processing there, and not moving everything to the cloud, but still keeping the phones somewhat harder to be attacked "en masse". But there they have the user base that has grown effectively from nothing, on another side the whole personal computing approach has other historical development and expectations. The oldest known computing approach was actually "dumb terminals" but moving completely in that direction is quite wasteful. At the end, I blame Microsoft for not recognizing enough what their users actually want: I know a lot of the companies which actually pay "the Microsoft tax" (as much as the Microsoft accounting is considered, they "use Windows 10") while in fact using Windows XP and anything but 10. And they are right to do so. The problem with everything after XP wasn't that the companies wouldn't pay for support. The problem was that Microsoft "innovates" in the areas that businesses find directly harmful. The business would of course like updates, would of course like better and safer protocols implemented, would of course turn on new security settings if they would be delivered, but they don't want all the annoyance of all that doesn't have to do anything with the infrastructure, like "Windows or Windows Server which you have to use through the new 'phone' UI." In short, there are many reasons there's a lot of Windows XP use, and Microsoft simply decided that they don't care. Linux is of course even worse, even with the efforts of Red Hat to have long-term stable OS versions, the concept is that most of what the user consider "just apps" are typically so dependent of so many random stuff that maintaining the stability is unnecessarily hard. Finally, Apple traditionally doesn't care for the company use of their products much. Which leaves most of the infrastructures in not having any "straightforward" choice. And "redeveloping everything" every time the OS companies decide to "innovate" is really not possible. That's were we are now. There's simply not enough awareness among the OS companies that "every non-programming entity" wants the stable infrastructure. Instead, the attention deficit goals of the managers of the moment are typically chased.
webwanderings 9y ago
For the life of me, and embarrassingly, I could not locate this patch (or any patches) to download manually, for offline install on 2008 server which would not get online updates (the reasons I would leave unknown).
- nabaraz 9y ago
  Try again. The page has been updated with a direct link (CDN). Here is the direct link to executable just in case. [1] [1] - http://download.windowsupdate.com/c/msdownload/update/software/secu/2017/05/windows8-rt-kb4012598-x86_a0f1c953a24dd042acc540c59b339f55fb18f594.msu http://download.windowsupdate.com/c/msdownload/update/softwa...
  - cryptarch 9y ago
    Then it turns out parent is the ransomware vendor and the linked file turns out to contain the ransomware, with a few letters in the URL substituted for Unicode lookalikes so it appears to be a legitimate Windows update. I'm not saying that's truly what's happening, but it's easy to imagine. I'd verify I'm connecting to the right domain and double-check with e.g. VirusTotal if I were you.
    - Dylan16807 9y ago
      It doesn't take voodoo to figure out if something is ascii or not.
      - i336_ 9y ago
        https://www.аррӏе.com https://www.xn--80ak6aa92e.com
        Dylan16807 9y ago
        What's your point? If I put the non-punycode version in my ascii checker it immediately tells me it isn't ascii. Having to check because registrars are dumb has nothing to do with the fact that doing the check is easy.
emmelaich 9y ago
The title probably should include the word WannaCrypt since that's the motivation. Good on Microsoft for doing this.
- i336_ 9y ago
  > The title probably should include the word WannaCrypt since that's the motivation. Your comment was directly above https://news.ycombinator.com/item?id=14330193 https://news.ycombinator.com/item?id=14330193 when I saw this page. Screenshot: http://i.imgur.com/8fydOGG.png http://i.imgur.com/8fydOGG.png I'm starting to seriously dislike HN's lack of moderation transparency. I don't know who changed the title - if it was the post author or a moderator - and when.
pja 9y ago
If a bug is wormable & your OS is still in widespread use then this ought to be the least you can do. If you’re unwilling to put the effort in, then open source the OS in some form so that someone else can. There are vast numbers of XP boxes out there. They represent a risk to all of us.
- irl_ 9y ago
  There was a Microsoft Research project that made it possible to run Windows XP (or Server 2003, I don't remember exactly) as a PV guest. That was really cool, but the whole project disappeared. If it had been open source, I bet it would still be actively maintained to this day. Edit: Found the paper https://www.microsoft.com/en-us/research/wp-content/uploads/2003/10/2003-sosp.pdf https://www.microsoft.com/en-us/research/wp-content/uploads/...
  - my123 9y ago
    There's also Drawbridge...
  - i336_ 9y ago
    I will admit I've just rapidly paged through that PDF, but it looks like I'm reading a Xen introductory paper. Xen is open source. I found some PV IO drivers at https://wiki.xen.org/wiki/Xen_Windows_GplPv https://wiki.xen.org/wiki/Xen_Windows_GplPv which mention XP (search for 'XP' including (!) single quotes), and a quick Google does immediately give hits on running XP as a HVM guest. I'm (genuinely) curious what you're describing/referring to here. What project disappeared?
    - my123 9y ago
      He's talking about Windows on Xen, which existed at a time, but was never released, like a lot of research projects. AMD-V and Intel VT made it mostly moot though.
      - i336_ 9y ago
        So you mean like... NTOSKRNL et al essentially retrofitted to run in a kind of userspace? Nice. I don't expect that kind of thing to ever leave a research environment though. It would mess with too many people's heads and give people too many ideas of running bare-metal kernels other than NT. Now I think about it, I realize the reason why HW virtualization really took off is because it let vendors keep their operating systems as actual operating systems in the traditional sense of the word, making for fewer legal issues (among many other reasons). Also, I thought Xen was essentially just a super-thin layer to kickstart VT-x/AMD-V. I didn't know it could do anything else. In fact, I thought there was only emulation and hardware-assisted virtualization. Is there a middle ground I'm not aware of?
dom0 9y ago
Original title is "Customer Guidance for WannaCrypt attacks"
acqq 9y ago
Not all vulnerabilities are equal. If I understand correctly, the reason this one enabled extremely easy spread of ransomware is that, reading the description of MS17-010, it is enough for the computer to be a part of the local network and have the "file sharing" enabled to be infected.
gressquel 9y ago
I can't get this to work on Win 8. The application starts up, then says "Searching for updates on this computer". I have been waiting for like 15 minutes now
- blablabla123 9y ago
  Have you considered getting Windows 10? The update isn't so expensive.
  - my123 9y ago
    It's still free afaik. Are you on 8 or 8.1?
    - beefhash 9y ago
      That's news to me. The free upgrade period is over[1]. The only free Windows 10 upgrade is the one for users of assistive technologies[2]. Of course, you can just pretend to be a user of assistive technologies, but I'm uncertain about the legal ramifications of doing so, regardless of whether or not you'll be caught. Additionally, Windows 10 silently accepts Windows 7 and 8 product keys[3], but the legal situation is equally nebulous in the face of [1]. [1] https://support.microsoft.com/en-us/help/12435/windows-10-upgrade-faq https://support.microsoft.com/en-us/help/12435/windows-10-up... "Is the Windows 10 free upgrade offer still available?" => "The Windows 10 free upgrade through the Get Windows 10 (GWX) app ended on July 29, 2016." [2] https://www.microsoft.com/en-us/accessibility/windows10upgrade https://www.microsoft.com/en-us/accessibility/windows10upgra... [3] https://www.bleepingcomputer.com/news/microsoft/you-can-activate-windows-10-creators-update-with-old-windows-license-keys/ https://www.bleepingcomputer.com/news/microsoft/you-can-acti...
      - my123 9y ago
        Windows 7 and 8.1 product keys are still accepted and will continue to be. Only GWX updates via WU were removed.
      - 9y ago
awqrre 9y ago
Does that mean that they will fix all future (major) remote vulnerabilities?
- lukealization 9y ago
  It's an interesting conundrum. One could argue this is a precedent. Then it becomes a question of "for what levels of severity do they patch vulnerability for?".
  - coleca 9y ago
    Exactly! IMHO Microsoft shouldn't have released the patch to people that aren't paying for extended support. It is just going to encourage cheap CIOs to continue to ignore their dying infrastructure. They just doomed themselves to another 10+ years of Windows XP support.
themihai 9y ago
Am I wrong to say that app sandboxing would fix this kind of issues and a lot more(i.e. keyloggers) ?
jwilk 9y ago
Please remove "?utm_source=t.co&utm_medium=referral" from the URL.
- eddyg 9y ago
  I hate dinglequeries too. I wish more people would learn what can and can't be removed from a URL before sharing it. It's not that difficult, and it's easy to test that the "minified" version still works.
  - nabaraz 9y ago
    Just curious, why do you care so much about them? They are just data for analytics. Everyone is probably just clicking on them not typing manually.
    - Sylos 9y ago
      Because they are data for analytics. Not everyone is a fan of that, especially when the URL points to the servers of a company with such a terrible privacy policy.
      - samtoday 9y ago
        Surely if you dislike analytics, keeping these bogus utm parameters is "good"? They are misleading the webmaster in some form.
    - jmkni 9y ago
      On sites like Reddit (and maybe HN), links with those extra parameters aren't flagged as a duplicate, and end up getting posted multiple times with multiple comment threads.
mikelabatt 9y ago
The patch was finalized already in February. I wonder why it took so long to release it? https://twitter.com/mikelabatt/status/863356853576749056 https://twitter.com/mikelabatt/status/863356853576749056
- problems 9y ago
  They're still providing these to Windows XP Embedded customers like those running it in ATMs, POS systems and industrial control systems until 2019. It's probably been out since march like the other OSes for those users, so they just released the same patch to everyone else.
- qb45 9y ago
  So a month before patches for supported versions of Windows. Does that mean I can get info on current Windows 0days simply by subscribing to XP support program?
  - belltaco 9y ago
    Many of the researchers already test to see if they work on XP. You could do what you said but it's pretty expensive and only works for a bulk deal at around $200/PC/year with a large number of PCs at a minimum.
    - qb45 9y ago
      I surely won't be doing it myself, but I can imagine some spook making this small personal sacrifice of becoming an employee at some Windows XP shop just to smuggle patches to his mothership for vulnerability analysis. I hope that the fact this patch was signed in February doesn't imply that it was published in February and available to every semi-competent cyberwarfare unit in the world.
- Too 9y ago
  QA maybe? Imagine the shitstorm headlines Microsoft would get if they managed to accidentally brick every Windows XP computer in the field with an automatic security update.
r721 9y ago
Funnily, WannaCry itself doesn't work on WinXP: https://twitter.com/GossiTheDog/status/863339558364229634 https://twitter.com/GossiTheDog/status/863339558364229634
- emmelaich 9y ago
  Interesting, but I suspect that a slight variant of it would work.
deleted 9y ago
[deleted]
RichardHeart 9y ago
People need it. People want it. Allow the people to pay for it.
- cube00 9y ago
  They do, it's called custom support, but it's very expensive (think six figures)
SimeVidas 9y ago
Can a Windows laptop that doesn’t have the Windows Update patch get infected just by being connected to the Internet via a home Wi-Fi network?
kozak 9y ago
Looks like humanity needs some long-term-support version of an operating system, where "long term" would mean 50 years or so (not five or ten).
- jpineman 9y ago
  Enter rolling distributions, where each upgrade is guaranteed to work. Even if you can't upgrade from version A to C, you can upgrade from A to B to C. Why can't Microsoft products also upgrade this way, even between major versions?
  - tallanvor 9y ago
    Except you can see Youtube videos of examples where people started on early versions of DOS in a VM and upgraded all the way to Windows 10. Name one company that does more work to ensure backwards compatibility. You can even read Raymond Chen's blog about times where Microsoft developers wrote shims to emulate bugs in previous versions so that specific applications would continue to work. And no, Microsoft can't guarantee everything developed by a 3rd party will continue working, and nor should they. The bottom line when it comes to places like the NHS is that they decided to cut costs by either not entering into a custom support agreement with Microsoft so that they could continue to get security patches for XP, or by upgrading their systems to run on newer versions of the OS.
swang 9y ago
Is Windows 7 not affected?
rocky1138 9y ago
Was Vista affected by this?
Angry25 9y ago
Ok, having to scrap an excellent hp laptop that had vista (did not buy it in a month that Microsoft thought they had to offer free upgrades to W 7) My doorstop was not past it's prime. If car companies treated customers like window does, the brakes would fail at 4 years and the 40 page online agreement would say that the purchaser would not be able to hold the auto mfg. liable for intentional brake malfunction. Kind of like GM screwed Americans by filing for bankruptcy, getting federal funding and saving 10 cents on the ignition switch that killed many people. Microsoft and GM could be good companies, they choose not to be.

266 points by my123 9y ago

> Additionally, we are taking the highly unusual step of providing a security update for all customers to protect Windows platforms that are in custom support only, including Windows XP, Windows 8, and Windows Server 2003. That's impressive!

ddalex 9y ago
It's impressive that they had the patches, but chose to put the security of their customers on a lower level than making more money by forcing said customers to upgrade.
- douche 9y ago
  You can't support everything forever, even with the kind of resources Microsoft has available. At some point you've got to tell people to upgrade off the old shit, we're not supporting it anymore (unless you pay us exorbitantly to do so...)
- rcaught 9y ago
  It's a 15 year old OS.
- mirimir 9y ago
  They can't force XP etc users to upgrade. Custom support accounts probably got the patches some time ago. This release is for all users of XP etc. I'm sure that most of them have no support contracts. And many are likely running pirated versions. Maybe this is PR-driven. But I can't imagine how it directly makes money for them.
- vmasto 9y ago
  Their (ex) customers placed their own security on a lower level themselves. WinXP is unsupported for quite some time and was given plenty of time to switch or upgrade. What's impressive is how people manage to spin this into an anti MS rant even when Microsoft is doing the right thing (stopping support for paleolithic software).
  - Dylan16807 9y ago
    > paleolithic software Windows 8 was shipping on brand new computers three years ago. And while upgrading your OS is nice in theory, it often means abandoning perfectly-good hardware because driver support for multiple versions of Windows is terrible. In this age of barely-getting-faster CPUs, how long do you think a piece of hardware should be usable?
    - vmasto 9y ago
      Windows 8.1 Update is supported until 2023 AFAIK. Also Windows 8 -> 10 was free for a reasonable amount of time. Purely out of interest what kind of hardware is incompatible between the two versions?
      - Dylan16807 9y ago
        > Windows 8.1 Update is supported until 2023 AFAIK. Talking about 8, not 8.1 > Purely out of interest what kind of hardware is incompatible between the two versions? Many drivers tend to break as windows goes through changes. When I tried a preview of the windows 10 creators update I had a driver stop working right. There were also serious nVidia problems that broke the old driver versions; imagine that happening with your typical company that stops providing drivers after a year. Though the driver comment wasn't specifically about 8. Good luck upgrading XP to not-XP, even if your hardware can perform better than a modern Surface.
        belltaco 9y ago
        > Talking about 8, not 8.1 Windows 8.1 Update is basically a roll-up update service pack to Windows 8 and is a free upgrade. That's like complaining that the released patches work on XP SP2/SP3 but not the original XP. If someone fails to update Windows 8 to 8.1 Update or has magically written software that works on Windows 8 but not 8.1 Update, it's on them. >Many drivers tend to break as windows goes through changes. When I tried a preview of the windows 10 creators update I had a driver stop working right. There were also serious nVidia problems that broke the old driver versions; imagine that happening with your typical company that stops providing drivers after a year. Those drivers are typically either using bad coding practices or relying on unsupported features or bugs. Maybe you should contact them as a customer and let your displeasure known. If enough people do that they may actually do something about it.
- belltaco 9y ago
  This is more like a pharmaceutical company taking a financial hit to help in a sudden epidemic by giving out antidotes/vaccines for free, for the sake of public interest and the ecosystem. Just because they had the vaccines ready in warehouses or could manufacture more easily doesn't mean that their customers "deserved" them for free before the epidemic hit. If the customers actually desired security, they would've paid for XP/2003 patches or upgraded to a different supported OS. Those customers messed up on their own, and Microsoft is giving them an out here.
  - toyg 9y ago
    > Just because they had the vaccines ready in warehouses or could manufacture more easily doesn't mean that their customers "deserved" them for free before the epidemic hit. Disagree.
  - qubex 9y ago
    I agree with you broadly but your analogy is flawed because patches have zero marginal cost (once developed, code can be infinitely duplicated at no additional cost) whereas vaccines are physical entities and therefore giving one to somebody entails not giving that same item to somebody else. If Microsoft had already developed these patches why not distribute them widely, since it costs nothing to do so and takes nothing away from paying customers?

Matt3o12_ 9y ago

Although it is probably good for the companies still using windows XP to receive those updates, I do not think updating windows xp was such a smart move because now those companies do not need to update once again and keep running outdated windows machines. If Microsoft did not provide this update for older OSes, I believe more people would update because they simply had to. Smaller hacks might not be enough for the manager of those machines to allocate resources to update, but this hack might have been just fatale enough for them to update those machines. And we should all expect to see such a hack again. This is not a one in a century thing. Such costly hacks could easily happen a few times a year.

sschueller 9y ago
I think the issue here is that Microsoft has a patch already for those special support contracts and holding it back may become some pr issue.
- deleted 9y ago
  [deleted]
- irl_ 9y ago
  What about all the other patches they're holding back? This can't be the only security issue they've only selectively distributed patches for.
  - my123 9y ago
    Yes, they hold back a lot of fixes. It's exceptional, a lot of unfixed flaws are still there. :)
  - easilyBored 9y ago
    They'd be no incentive to upgrade otherwise. XP is 16 years old! Microsoft is in a tough spot, this was a worldwide problem so they had no choice. They should make the support contracts for old version quadruple in price for every year and offer incentives to upgrades. Better for them, more revenue and less bad press for MSFT.

faragon 9y ago

In my opinion, hospitals should never run any kind of software accessing complex protocols locally. Should run everything, except real-time critical devices, using virtualized remote applications, so the security gets ensured at data-center level, instead of at client level.

acqq 9y ago
The "complex protocol" is actually "plain" Windows file sharing, which is practically always enabled in the local networks. That's how the computers in the local network are traditionally supposed to be maintained. I've managed a bunch of computers which weren't configured so, but configuring them that way you lose everything Microsoft created for the management of the computers in the local network -- to be effective you'd have to maintain and develop your own tools, which most of the companies wouldn't like you to do. It the users are supposed to "normal work" on the given computers, not enabling the file access is much harder to achieve. I know there are "everything virtualized" approaches, but they are really expensive.
- faragon 9y ago
  Windows file sharing (SMB/CIFS) is complex, in comparison to delivering remote applications using HTTPS (TLS/HTTP) through one single port (which is very simple, and easier to secure). So compare: local applications running many client remote protocols, or running remote applications through HTTPS (TLS/HTTP) with all the complexity at server-side (e.g. in-building data center, or remote data center, with high availability and being fault-tolerant, etc.).
  - acqq 9y ago
    Personally, I consider the approach "nothing done on the clients" problematic on many levels. I like what Apple is doing, like trying to make the client phones do the processing there, and not moving everything to the cloud, but still keeping the phones somewhat harder to be attacked "en masse". But there they have the user base that has grown effectively from nothing, on another side the whole personal computing approach has other historical development and expectations. The oldest known computing approach was actually "dumb terminals" but moving completely in that direction is quite wasteful. At the end, I blame Microsoft for not recognizing enough what their users actually want: I know a lot of the companies which actually pay "the Microsoft tax" (as much as the Microsoft accounting is considered, they "use Windows 10") while in fact using Windows XP and anything but 10. And they are right to do so. The problem with everything after XP wasn't that the companies wouldn't pay for support. The problem was that Microsoft "innovates" in the areas that businesses find directly harmful. The business would of course like updates, would of course like better and safer protocols implemented, would of course turn on new security settings if they would be delivered, but they don't want all the annoyance of all that doesn't have to do anything with the infrastructure, like "Windows or Windows Server which you have to use through the new 'phone' UI." In short, there are many reasons there's a lot of Windows XP use, and Microsoft simply decided that they don't care. Linux is of course even worse, even with the efforts of Red Hat to have long-term stable OS versions, the concept is that most of what the user consider "just apps" are typically so dependent of so many random stuff that maintaining the stability is unnecessarily hard. Finally, Apple traditionally doesn't care for the company use of their products much. Which leaves most of the infrastructures in not having any "straightforward" choice. And "redeveloping everything" every time the OS companies decide to "innovate" is really not possible. That's were we are now. There's simply not enough awareness among the OS companies that "every non-programming entity" wants the stable infrastructure. Instead, the attention deficit goals of the managers of the moment are typically chased.

webwanderings 9y ago

For the life of me, and embarrassingly, I could not locate this patch (or any patches) to download manually, for offline install on 2008 server which would not get online updates (the reasons I would leave unknown).

nabaraz 9y ago
Try again. The page has been updated with a direct link (CDN). Here is the direct link to executable just in case. [1] [1] - http://download.windowsupdate.com/c/msdownload/update/software/secu/2017/05/windows8-rt-kb4012598-x86_a0f1c953a24dd042acc540c59b339f55fb18f594.msu http://download.windowsupdate.com/c/msdownload/update/softwa...
- cryptarch 9y ago
  Then it turns out parent is the ransomware vendor and the linked file turns out to contain the ransomware, with a few letters in the URL substituted for Unicode lookalikes so it appears to be a legitimate Windows update. I'm not saying that's truly what's happening, but it's easy to imagine. I'd verify I'm connecting to the right domain and double-check with e.g. VirusTotal if I were you.
  - Dylan16807 9y ago
    It doesn't take voodoo to figure out if something is ascii or not.
    - i336_ 9y ago
      https://www.аррӏе.com https://www.xn--80ak6aa92e.com
      - Dylan16807 9y ago
        What's your point? If I put the non-punycode version in my ascii checker it immediately tells me it isn't ascii. Having to check because registrars are dumb has nothing to do with the fact that doing the check is easy.

emmelaich 9y ago

The title probably should include the word WannaCrypt since that's the motivation. Good on Microsoft for doing this.

i336_ 9y ago
> The title probably should include the word WannaCrypt since that's the motivation. Your comment was directly above https://news.ycombinator.com/item?id=14330193 https://news.ycombinator.com/item?id=14330193 when I saw this page. Screenshot: http://i.imgur.com/8fydOGG.png http://i.imgur.com/8fydOGG.png I'm starting to seriously dislike HN's lack of moderation transparency. I don't know who changed the title - if it was the post author or a moderator - and when.

pja 9y ago

If a bug is wormable & your OS is still in widespread use then this ought to be the least you can do. If you’re unwilling to put the effort in, then open source the OS in some form so that someone else can. There are vast numbers of XP boxes out there. They represent a risk to all of us.

irl_ 9y ago
There was a Microsoft Research project that made it possible to run Windows XP (or Server 2003, I don't remember exactly) as a PV guest. That was really cool, but the whole project disappeared. If it had been open source, I bet it would still be actively maintained to this day. Edit: Found the paper https://www.microsoft.com/en-us/research/wp-content/uploads/2003/10/2003-sosp.pdf https://www.microsoft.com/en-us/research/wp-content/uploads/...
- my123 9y ago
  There's also Drawbridge...
- i336_ 9y ago
  I will admit I've just rapidly paged through that PDF, but it looks like I'm reading a Xen introductory paper. Xen is open source. I found some PV IO drivers at https://wiki.xen.org/wiki/Xen_Windows_GplPv https://wiki.xen.org/wiki/Xen_Windows_GplPv which mention XP (search for 'XP' including (!) single quotes), and a quick Google does immediately give hits on running XP as a HVM guest. I'm (genuinely) curious what you're describing/referring to here. What project disappeared?
  - my123 9y ago
    He's talking about Windows on Xen, which existed at a time, but was never released, like a lot of research projects. AMD-V and Intel VT made it mostly moot though.
    - i336_ 9y ago
      So you mean like... NTOSKRNL et al essentially retrofitted to run in a kind of userspace? Nice. I don't expect that kind of thing to ever leave a research environment though. It would mess with too many people's heads and give people too many ideas of running bare-metal kernels other than NT. Now I think about it, I realize the reason why HW virtualization really took off is because it let vendors keep their operating systems as actual operating systems in the traditional sense of the word, making for fewer legal issues (among many other reasons). Also, I thought Xen was essentially just a super-thin layer to kickstart VT-x/AMD-V. I didn't know it could do anything else. In fact, I thought there was only emulation and hardware-assisted virtualization. Is there a middle ground I'm not aware of?

dom0 9y ago

Original title is "Customer Guidance for WannaCrypt attacks"

acqq 9y ago

Not all vulnerabilities are equal. If I understand correctly, the reason this one enabled extremely easy spread of ransomware is that, reading the description of MS17-010, it is enough for the computer to be a part of the local network and have the "file sharing" enabled to be infected.

gressquel 9y ago

I can't get this to work on Win 8. The application starts up, then says "Searching for updates on this computer". I have been waiting for like 15 minutes now

blablabla123 9y ago
Have you considered getting Windows 10? The update isn't so expensive.
- my123 9y ago
  It's still free afaik. Are you on 8 or 8.1?
  - beefhash 9y ago
    That's news to me. The free upgrade period is over[1]. The only free Windows 10 upgrade is the one for users of assistive technologies[2]. Of course, you can just pretend to be a user of assistive technologies, but I'm uncertain about the legal ramifications of doing so, regardless of whether or not you'll be caught. Additionally, Windows 10 silently accepts Windows 7 and 8 product keys[3], but the legal situation is equally nebulous in the face of [1]. [1] https://support.microsoft.com/en-us/help/12435/windows-10-upgrade-faq https://support.microsoft.com/en-us/help/12435/windows-10-up... "Is the Windows 10 free upgrade offer still available?" => "The Windows 10 free upgrade through the Get Windows 10 (GWX) app ended on July 29, 2016." [2] https://www.microsoft.com/en-us/accessibility/windows10upgrade https://www.microsoft.com/en-us/accessibility/windows10upgra... [3] https://www.bleepingcomputer.com/news/microsoft/you-can-activate-windows-10-creators-update-with-old-windows-license-keys/ https://www.bleepingcomputer.com/news/microsoft/you-can-acti...
    - my123 9y ago
      Windows 7 and 8.1 product keys are still accepted and will continue to be. Only GWX updates via WU were removed.
    - 9y ago

awqrre 9y ago

Does that mean that they will fix all future (major) remote vulnerabilities?

lukealization 9y ago
It's an interesting conundrum. One could argue this is a precedent. Then it becomes a question of "for what levels of severity do they patch vulnerability for?".
- coleca 9y ago
  Exactly! IMHO Microsoft shouldn't have released the patch to people that aren't paying for extended support. It is just going to encourage cheap CIOs to continue to ignore their dying infrastructure. They just doomed themselves to another 10+ years of Windows XP support.

themihai 9y ago

Am I wrong to say that app sandboxing would fix this kind of issues and a lot more(i.e. keyloggers) ?

jwilk 9y ago

Please remove "?utm_source=t.co&utm_medium=referral" from the URL.

eddyg 9y ago
I hate dinglequeries too. I wish more people would learn what can and can't be removed from a URL before sharing it. It's not that difficult, and it's easy to test that the "minified" version still works.
- nabaraz 9y ago
  Just curious, why do you care so much about them? They are just data for analytics. Everyone is probably just clicking on them not typing manually.
  - Sylos 9y ago
    Because they are data for analytics. Not everyone is a fan of that, especially when the URL points to the servers of a company with such a terrible privacy policy.
    - samtoday 9y ago
      Surely if you dislike analytics, keeping these bogus utm parameters is "good"? They are misleading the webmaster in some form.
  - jmkni 9y ago
    On sites like Reddit (and maybe HN), links with those extra parameters aren't flagged as a duplicate, and end up getting posted multiple times with multiple comment threads.

mikelabatt 9y ago

The patch was finalized already in February. I wonder why it took so long to release it? https://twitter.com/mikelabatt/status/863356853576749056 https://twitter.com/mikelabatt/status/863356853576749056

problems 9y ago
They're still providing these to Windows XP Embedded customers like those running it in ATMs, POS systems and industrial control systems until 2019. It's probably been out since march like the other OSes for those users, so they just released the same patch to everyone else.
qb45 9y ago
So a month before patches for supported versions of Windows. Does that mean I can get info on current Windows 0days simply by subscribing to XP support program?
- belltaco 9y ago
  Many of the researchers already test to see if they work on XP. You could do what you said but it's pretty expensive and only works for a bulk deal at around $200/PC/year with a large number of PCs at a minimum.
  - qb45 9y ago
    I surely won't be doing it myself, but I can imagine some spook making this small personal sacrifice of becoming an employee at some Windows XP shop just to smuggle patches to his mothership for vulnerability analysis. I hope that the fact this patch was signed in February doesn't imply that it was published in February and available to every semi-competent cyberwarfare unit in the world.
Too 9y ago
QA maybe? Imagine the shitstorm headlines Microsoft would get if they managed to accidentally brick every Windows XP computer in the field with an automatic security update.

r721 9y ago

Funnily, WannaCry itself doesn't work on WinXP: https://twitter.com/GossiTheDog/status/863339558364229634 https://twitter.com/GossiTheDog/status/863339558364229634

emmelaich 9y ago
Interesting, but I suspect that a slight variant of it would work.

deleted 9y ago

[deleted]

RichardHeart 9y ago

People need it. People want it. Allow the people to pay for it.

cube00 9y ago
They do, it's called custom support, but it's very expensive (think six figures)

SimeVidas 9y ago

Can a Windows laptop that doesn’t have the Windows Update patch get infected just by being connected to the Internet via a home Wi-Fi network?

kozak 9y ago

Looks like humanity needs some long-term-support version of an operating system, where "long term" would mean 50 years or so (not five or ten).

jpineman 9y ago
Enter rolling distributions, where each upgrade is guaranteed to work. Even if you can't upgrade from version A to C, you can upgrade from A to B to C. Why can't Microsoft products also upgrade this way, even between major versions?
- tallanvor 9y ago
  Except you can see Youtube videos of examples where people started on early versions of DOS in a VM and upgraded all the way to Windows 10. Name one company that does more work to ensure backwards compatibility. You can even read Raymond Chen's blog about times where Microsoft developers wrote shims to emulate bugs in previous versions so that specific applications would continue to work. And no, Microsoft can't guarantee everything developed by a 3rd party will continue working, and nor should they. The bottom line when it comes to places like the NHS is that they decided to cut costs by either not entering into a custom support agreement with Microsoft so that they could continue to get security patches for XP, or by upgrading their systems to run on newer versions of the OS.

swang 9y ago

Is Windows 7 not affected?

rocky1138 9y ago

Was Vista affected by this?

Angry25 9y ago

Ok, having to scrap an excellent hp laptop that had vista (did not buy it in a month that Microsoft thought they had to offer free upgrades to W 7) My doorstop was not past it's prime. If car companies treated customers like window does, the brakes would fail at 4 years and the 40 page online agreement would say that the purchaser would not be able to hold the auto mfg. liable for intentional brake malfunction. Kind of like GM screwed Americans by filing for bankruptcy, getting federal funding and saving 10 cents on the ignition switch that killed many people. Microsoft and GM could be good companies, they choose not to be.