9 ms·
Windows 7, not XP, was the reason WCry spread so widely
- NuDinNou 9y agoIt's the most used Windows OS, so no surprise there.
- nthcolumn 9y agoThe worm reused the meterpreter code which didn't target XP at all. For some reason some people are having are hard time dealing with this: https://news.ycombinator.com/item?id=14377799 https://news.ycombinator.com/item?id=14377799 and I am beginning to wonder why. Any insights?
- deleted 9y ago[deleted]
- avbor 9y agoI think because they're aware Microsoft released a patch for Windows after XP, they're thinking as though XP can be the only one affected by the ransomware. As we've learned, that logic doesn't work since people turn off updates.
- sigmar 9y ago>The worm reused the meterpreter code which didn't target XP at all Small nitpick- though the worm aspect of WCry does have a lot of issues with targeting WinXP, the meterpreter part of that sentence is a widespread myth that originated from poor wording in a slide. Source, w/ a reply that has a link to correction from the original author: https://twitter.com/riskybusiness/status/864293475981729793 https://twitter.com/riskybusiness/status/864293475981729793
- eriknstr 9y agoI think the reason that they were downvoted was not because people have a hard time accepting it but because they just stated that windows xp was not targeted without linking to any sources for that claim.
- AdmiralAsshat 9y agoWell for one thing, people seem to really enjoy victim blaming. It's much easier to say, 'The people who got infected have only themselves to blame, they were using an old an unsupported OS!' rather than to accept that maybe it's not necessarily anyone's direct fault if their computer got infected.
- cwyers 9y agoIt was patched for 7 months before WCry started to spread. So it's not "The people who got infected have only themselves to blame, they were using an old an unsupported OS!" it's "The people who got infected have only themselves to blame, they were using an old and extended support OS and turning off Windows Update!"
- userbinator 9y agoIn case it's not clear, "7" and "7 home" are the 32-bit versions. It took me rather longer than necessary to figure that out. Instead, it now appears, the leading contributor to the virally spreading infection were Windows 7 machines that hadn't installed a critical security patch Microsoft issued in March I'd guess a lot of those who don't install updates on 7 were greatly turned off by the aggressive Windows 10 upgrade promotions and other unwanted features Microsoft were trying to sneak by as security-related. Those still on XP didn't have to worry about that either. I remember a memorable analogy about the nature of Windows updates: "they aren't just like vaccinations --- there's also a large chance of making you grow an extra 3 ears, lose one eye, and turn your skin bright green." If only Microsoft had two "update channels", one for features and the other for security-only fixes...
- bitwize 9y agoFat chance of that happening; when Microsoft really wants you to avail yourself of their new spinning, dancing start button, they will flag it as a "critical" update, or attach it as a rider to a critical security fix. Apple does this too; that's why I haven't bought a Mac in many years.
- 21 9y agoCan you show just one example of that, an update marked "critical" but which sneaked in a new feature.
- boomboomsubban 9y ago"Update now to windows ten for free!"
- bitwize 9y agoThe C++-ABI-breaking libstdc++ from Mac OS 10.4 was backported to Mac OS 10.3 and pushed out in a hafta-havit security update -- but none of the compilers were. So any attempt to link C++ programs under Mac OS 10.3 suddenly broke.
- eps 9y ago> Based on a sample that had Kaspersky installed Something tells me that people that still run XP aren't exactly the Kaspersky clientelle, so the sample is severely biased. Unless Kaspersky pro-rated the infection rates to accommodate for that, but it doesn't sound like they did.
- crowbahr 9y agoI mean Win 10 and XP both have relatively similar install bases of around 10% of installed windows instances. So of course 7 spread it more... It's more commonly installed.
- JeffCyr 9y agoI had to update a Windows 7 laptop recently and the process was far from easy, the update process hang at 100% cpu for hours and I had to manually install the monthly update rollout, average people won't do that and just disable the updates.
- photon-torpedo 9y agoExactly. I've seen this problem on Windows 7 as far back as 2012. Any machine that is not constantly receiving updates will run into this issue sooner or later. On weaker machines, the update process will actually eat all the machine's memory and likely never finish. Also, the manual update which fixes this problem changes every few months. At this point I feel that Microsoft just wants to discourage people from using Windows 7.
- Pica_soO 9y agoYeah, that dead horse called "New OS-Software every five years" still has some miles to go, before acceptance sets in- that buisness customers prefer stability over shiny any day and Infrastructure now sells as a service.
- KindOne 9y agoWhat about using WSUS Offline? http://www.wsusoffline.net/ http://www.wsusoffline.net/
- ant6n 9y agoDoes that include all security updates for the windowses ... it's only 2MB (?!)
- rincebrain 9y agoIt pulls down a list of updates then fetches them.
- 9y ago
- rythie 9y agoMicrosoft has recommended turning off SMB1 support in the past: https://blogs.technet.microsoft.com/filecab/2016/09/16/stop-using-smb1/ https://blogs.technet.microsoft.com/filecab/2016/09/16/stop-... - though perhaps not prominently enough. However, you might be able turn off SMB1 support is if you still have machines with Windows XP or 2003. This is a similar situation to SSLv3 when POODLE was discovered, in that the difficulty of getting rid of old protocols, is that of getting rid of the last ones (Though I realise WCry exploits an implementation bug).
- chrisper 9y agoWhy is it enabled by default then? If you need such an old legacy thing, shouldn't it be the other way around? Like that you need to enable it if you need it rather than disable it if you don't.
- rincebrain 9y agoI would suspect because they initially shipped with it enabled in 7, and changing that default during the product's lifetime, even with the loudest notification they could muster, would break people.
- chrisper 9y agoYes, but it is also enabled on Windows 10 by default.
- arthurfm 9y ago> Why is it enabled by default then? SMB1 will be disabled by default in the Fall Creators Update [1] and removed completely in a future release of Windows 10 [2]. It should have probably happened a lot sooner, but the protocol is still used quite a bit [3] despite Windows itself not requiring SMB1 for the past 10 years [4]. [1] https://twitter.com/NerdPyle/status/863297941930246145 https://twitter.com/NerdPyle/status/863297941930246145 [2] https://twitter.com/NerdPyle/status/863519752429293568 https://twitter.com/NerdPyle/status/863519752429293568 [3] https://twitter.com/NerdPyle/status/863298534862340096 https://twitter.com/NerdPyle/status/863298534862340096 [4] https://twitter.com/NerdPyle/status/863520227576791040 https://twitter.com/NerdPyle/status/863520227576791040
- Pica_soO 9y agoThis is a nice example of blame shifting to either the consumers or the programmers.. Blame for the whole "deactivated" Updates affair should be upon the CEOs and marketing guys who tried to shanghai-shovel consumers and customercompanys Win10. Yes, they might have saved microsoft in the short turn burning consumer trust, but if that consumer trust is part of the world wide infrastructure- they should be called liable for burning this resource.
- kalleboo 9y ago> according to a blog post published by AV provider Malwarebytes, it spread through a mechanism that scanned the Internet for computers with open Server Message Block ports I'm still amazed so many PCs are directly online, and not trapped behind NAT or at least a firewall. Does this mean that the NHS, etc had DMZed machines on their LAN? edit: Shodan shows over 1 million machines with SMB open