3 ms·

For the life of me, and embarrassingly, I could not locate this patch (or any patches) to download manually, for offline install on 2008 server which would not

For the life of me, and embarrassingly, I could not locate this patch (or any patches) to download manually, for offline install on 2008 server which would not get online updates (the reasons I would leave unknown).

nabaraz 9y ago
Try again. The page has been updated with a direct link (CDN). Here is the direct link to executable just in case. [1] [1] - http://download.windowsupdate.com/c/msdownload/update/software/secu/2017/05/windows8-rt-kb4012598-x86_a0f1c953a24dd042acc540c59b339f55fb18f594.msu http://download.windowsupdate.com/c/msdownload/update/softwa...
- cryptarch 9y ago
  Then it turns out parent is the ransomware vendor and the linked file turns out to contain the ransomware, with a few letters in the URL substituted for Unicode lookalikes so it appears to be a legitimate Windows update. I'm not saying that's truly what's happening, but it's easy to imagine. I'd verify I'm connecting to the right domain and double-check with e.g. VirusTotal if I were you.
  - Dylan16807 9y ago
    It doesn't take voodoo to figure out if something is ascii or not.
    - i336_ 9y ago
      https://www.аррӏе.com https://www.xn--80ak6aa92e.com
      - Dylan16807 9y ago
        What's your point? If I put the non-punycode version in my ascii checker it immediately tells me it isn't ascii. Having to check because registrars are dumb has nothing to do with the fact that doing the check is easy.
        i336_ 9y ago
        That's very true. Such attacks are predicated on an ignorant and/or lazy target demographic, I guess. Incidentally, when I copied the link out of Chrome (57) it pasted the punycode link even though it showed "apple.com" in the omnibox. So then I carefully copy-pasted just the domain and TLD to work around Chrome's link-copying magic, submitted, and... discovered that Arc punycode-ifies Unicode domains. So that was interesting, but it kind of killed the impact of the point I was making.
    - cryptarch 9y ago
      It doesn't, but you do have to do a manual check and remember to do that.
- aruggirello 9y ago
  Wait - a critical security update distributed via plain HTTP instead of HTTPS...? I checked all the links provided for my computers, too - they're all http:// http://
  - sschueller 9y ago
    Probably because some windows xp boxes can't connect to https servers running TLS 1.2 so the patches are available under http as well.
  - aw3c2 9y ago
    No issue as long as the updates are properly signed. Distributing updates via HTTP/FTP is normal in Linux land.
derpadelt 9y ago
Direct links for english have been provided (as stated in a sibling comment). Yet the catalog server (to download localized versions) seems to be under heavy load or otherwise hard to reach...
hsivonen 9y ago
I couldn't either from Firefox on Linux or IE11 on Windows 7, but the download started automatically in IE8 on XP.
thirdsun 9y ago
Furthermore at least one download points to the wrong file: I need the patch for Windows XP SP3 x86 in German but will always receive the patch for the embedded version, which obviously doesn't work.

nabaraz 9y ago

Try again. The page has been updated with a direct link (CDN). Here is the direct link to executable just in case. [1] [1] - http://download.windowsupdate.com/c/msdownload/update/software/secu/2017/05/windows8-rt-kb4012598-x86_a0f1c953a24dd042acc540c59b339f55fb18f594.msu http://download.windowsupdate.com/c/msdownload/update/softwa...

cryptarch 9y ago
Then it turns out parent is the ransomware vendor and the linked file turns out to contain the ransomware, with a few letters in the URL substituted for Unicode lookalikes so it appears to be a legitimate Windows update. I'm not saying that's truly what's happening, but it's easy to imagine. I'd verify I'm connecting to the right domain and double-check with e.g. VirusTotal if I were you.
- Dylan16807 9y ago
  It doesn't take voodoo to figure out if something is ascii or not.
  - i336_ 9y ago
    https://www.аррӏе.com https://www.xn--80ak6aa92e.com
    - Dylan16807 9y ago
      What's your point? If I put the non-punycode version in my ascii checker it immediately tells me it isn't ascii. Having to check because registrars are dumb has nothing to do with the fact that doing the check is easy.
      - i336_ 9y ago
        That's very true. Such attacks are predicated on an ignorant and/or lazy target demographic, I guess. Incidentally, when I copied the link out of Chrome (57) it pasted the punycode link even though it showed "apple.com" in the omnibox. So then I carefully copy-pasted just the domain and TLD to work around Chrome's link-copying magic, submitted, and... discovered that Arc punycode-ifies Unicode domains. So that was interesting, but it kind of killed the impact of the point I was making.
  - cryptarch 9y ago
    It doesn't, but you do have to do a manual check and remember to do that.
aruggirello 9y ago
Wait - a critical security update distributed via plain HTTP instead of HTTPS...? I checked all the links provided for my computers, too - they're all http:// http://
- sschueller 9y ago
  Probably because some windows xp boxes can't connect to https servers running TLS 1.2 so the patches are available under http as well.
- aw3c2 9y ago
  No issue as long as the updates are properly signed. Distributing updates via HTTP/FTP is normal in Linux land.

derpadelt 9y ago

Direct links for english have been provided (as stated in a sibling comment). Yet the catalog server (to download localized versions) seems to be under heavy load or otherwise hard to reach...

hsivonen 9y ago

I couldn't either from Firefox on Linux or IE11 on Windows 7, but the download started automatically in IE8 on XP.

thirdsun 9y ago

Furthermore at least one download points to the wrong file: I need the patch for Windows XP SP3 x86 in German but will always receive the patch for the embedded version, which obviously doesn't work.