12 ms·

Updates for older platforms to protect against potential nation-state activity

110 points by my123 9y ago

norswap 9y ago
What the heck does "nation-state activity" means?
- jaclaz 9y ago
  >What the heck does "nation-state activity" means? That looks hard enough to understand, but additionally it is "potential".
- cityhall 9y ago
  Russia
  - Alupis 9y ago
    > Russia Is that a new way of saying "NSA"? All joking aside... this is likely the tail-end result of the Shadow Brokers leak coupled with the recently-used exploits in the failed crypto-locker variant "Wanna Cry".
- sp332 9y ago
  It means governments are exploiting the OS instead of random hackers.
- gruez 9y ago
  "Activity" = codename for hacking
- my123 9y ago
  > we have taken action to provide additional critical security updates to address vulnerabilities that are at heightened risk of exploitation due to past nation-state activity and disclosures. It's state sponsored hacking or hoarding of vulnerabilities.
- Ded7xSEoPKYNsDd 9y ago
  Presumably it's another case where an intelligence agency lost control of an exploit they developed, the same thing that happened with WannaCry.
- daveloyall 9y ago
  The page links here: https://support.microsoft.com/en-us/help/4025687/microsoft-security-advisory-4025685-guidance-for-older-platforms https://support.microsoft.com/en-us/help/4025687/microsoft-s... ...which mentions some MSyy-nnn numbers, some of which have been mentioned on HN before.
- 1001101 9y ago
  https://en.wikipedia.org/wiki/WannaCry_ransomware_attack#Attribution https://en.wikipedia.org/wiki/WannaCry_ransomware_attack#Att...
- kpil 9y ago
  Interesting question. "Nation" is really the people, not the country or the state, and the reason it's mixed up to the point of having reached the dictionaries, is the strong nation-states that have been founded in Europe the last few hundred years. "State" is the organisation that governs a country or region, and in extension all it's concerns. Activity means hacking. So... a government organisation from a country of ethnically and culturally distinct people are hacking shit.
DuskStar 9y ago
I can't help but feel that Microsoft providing these security updates long past XP's stated EOL date will only decrease security in the long run. After all, if any "big enough" vulnerability results in getting a patch anyways, why upgrade/firewall that old XP system running your equipment? And I'd bet that people will expect the same treatment for Windows 7, too. People never learn when disaster is narrowly averted. People learn when their decisions mean everything is on fire.
- jimmaswell 9y ago
  Anyone still using XP at this point is obviously not planning to upgrade to a new OS in the first place. I'm certain there are virtually no XP users who would have been swayed to finally upgrade by these specific security patches being withheld.
  - DuskStar 9y ago
    Maybe not from security patches being withheld, but I'd bet that Britain's NHS has done something to improve security following their encounter with WannaCry - and I know my university's hospital system did.
- ch4s3 9y ago
  Imagine if you will a hospital system say, the VA, which owns a number of MRI machines, x-ray equipment, or similar which runs Windows XP. Now imagine that these machines were built by a company that was acquired and dismantled and therefore can no longer provide updates. Now imagine that these machines are connected to the local network behind the firewall, but can not be air gapped... for reasons. These machines work just fine, other than having an old OS. Should they get scrapped?
  - codefined 9y ago
    I'd say yes, especially if they're not getting security updates and are connected to the rest of the network. Honestly, the cost of it getting broken into seems to be significantly higher than the cost of upgrading the systems.
news_to_me 9y ago
How the fuck are some government orgs still on Windows XP?? Seriously, we need government-wide standards in place so this sort of thing doesn't happen.
- eli 9y ago
  Strict standards and certifications that make it hard to make changes are one contributing factor to how we ended up here.
- deleted 9y ago
  [deleted]
- louithethrid 9y ago
  How dare the customer have opinions of there own and vote with there feet and money for it! This is outrageous! Dont they want to go Hipster-Hyper-Heaven?
  - deathanatos 9y ago
    I'm not saying the customer shouldn't be able to vote with their feet/wallet, but they should also be aware that code rots, and security vulnerabilities become more known as time goes on. I don't think criticizing an organization for sticking with ever older, ever more insecure software is necessarily wrong. What makes this harder is that people bought into a platform that doesn't given them access to the code they run. The business that originally created it isn't interested in supporting it further (well, they are, i.e., "Windows 10", but I presume that that's not acceptable to our hypothetical "vote with there [sic] feet" person), and I don't really see that the business should be forced to support it, either. (It's not like MS didn't support it for quite a while, and don't still offer a solution.) Software evolves. Ideally we're finding more secure and better ways of doing stuff, and shedding the old stuff, though I acknowledge the debatability of that. I acknowledge that it's also unfortunate that UI changes, and bloat, often seem tightly coupled with that. But if people also persist in choosing non-free, non-open source software…
    - 9y ago
0x0 9y ago
I keep a winxp vm around for some old games. Many of the download links at https://support.microsoft.com/en-us/help/4025687/microsoft-security-advisory-4025685-guidance-for-older-platforms https://support.microsoft.com/en-us/help/4025687/microsoft-s... , especially in table parts 2 and 3 for winxp go to 404 pages. Also, ie for winxp does not seem to be able to even open the windows update website any more. Any tips?
- chrisper 9y ago
  Just download it normally and move it to your VM through network share or whatever.
- sp332 9y ago
  Have you tried manually installing SP3 first? I remember an old PC I had to troubleshoot wouldn't install anything else until I had that.
  - mrighele 9y ago
    I tried to install Xp in a VM a few weeks ago to see if I could run a few old games. The iso I had was for XP Sp2, and I couldn't find a download link for the Sp3 installer on the whole Microsoft site. Links from search engines become "the file is no longer available" or something similar
  - 0x0 9y ago
    Yeah, I'm sure it has SP3, and I think also all the regularly issued windows updates up until EOL. Anyways, it looks like more updates are coming online now. Perhaps they published the links before publishing the linked pages.
gaius 9y ago
Kudos to Microsoft for doing this. Who else in the world is patching 16-year-old code well past it's EOL, for free?
- askvictor 9y ago
  I'm sure you could find some oss projects
  - IshKebab 9y ago
    I'm sure you can't. You might find open source projects that are older than 16 years, e.g. Linux. But that's not the same. Nobody is maintaining Linux 2.4, which was released in 2001. Its support only lasted until in 2010 as far as I can tell.
    - zwerdlds 9y ago
      I think NetBSD qualifies for whatever criteria you're trying to express.
    - askvictor 9y ago
      In that case, let's compare apples with apples- the final release of XP was in 2008. So we're looking for software released on or before 2001, actively developed until 2008, then on life support since then. On the other hand, many oss projects have rolling releases, so trying to compare like this is futile, expect for the fact they have been maintained for a very long time. LaTeX 2e has been around since 1994 and is still the current, maintained version.
- AndrewOMartin 9y ago
  Certainly not the people whose code is much older than 16 years and not simply declared EOL for profit reasons.
- csydas 9y ago
  Blizzard? Diablo 2 got a patch just this year. I get what you're saying, it's nice that they're doing this, but it's not really so much a goodness of the heart thing as it is that there is a super critical bug to many versions of Windows and there happen to be enough XP machines around that they're a significant threat. The bugs are big enough and the threat great enough that there's probably less cost in patching than there is in dealing with any of the potential fallout.
toredash 9y ago
Sad part is that there will still be owners of WinXP who won't patch their systems.
- Angostura 9y ago
  Because the manufacturer of their embedded system went bust, for example.
  - toredash 9y ago
    Or they just don't patch their systems.
EdSharkey 9y ago
I imagine Microsoft gets a dump truck full of cash to open support up on XP like this. I wonder who paid?
- TAForObvReasons 9y ago
  US pours tens of billions of dollars into legacy technologies: http://www.gao.gov/products/GAO-16-696T http://www.gao.gov/products/GAO-16-696T -- no doubt a large portion of that made its way to Microsoft
- ocdtrekkie 9y ago
  Well, the US government's already paying them to maintain XP to begin with. So the patches already exist internally at Microsoft, and it costs them nothing if they just decide "Hey, this patch is such a big deal, we also want to let everyone else have it". Isn't really gonna change the fact that the US government's still paying them for the work. And computer security benefits from herd immunity tactics, so it's best to get virus updates in as many hands as possible. It's why Microsoft has never really prevented pirated copies of Windows from getting security updates. They benefit from not having old machines potentially causing problems for newer ones, and even just avoiding the bad PR from massive malware attacks.
  - daxfohl 9y ago
    For that matter the government may well be dictating the patch release schedule too. And certainly the skeptical among us can wonder what else may be in these patches.
weinzierl 9y ago
Could be related to the The Shadow Brokers threatening to release a new stash of exploits in June, this time targeting Windows 10. From their announcement on 2017-05-15 [1]: > In February Microsoft is missing patch Tuesday. TheShadowBrokers is knowing, Microsoft is missing to be making patches for Eternal exploits. [..] In March Microsoft is releasing patch for SMB vulnerabilities. TheShadowBrokers is knowing this is being for Eternal exploits. TheShadowBrokers is still waiting and not releasing. [..] In April, 90 days from theequationgroup show and tell, 30 days from Microsoft patch, theshadowbrokers dumps old Linux (auction file) and windows ops disks. [..] Eternal exploits is not being ZeroDays. [..] patch was being available for 30 days before theshadowbrokers is releasing dump to public. [..] TheShadowBrokers Monthly Data Dump could be being: web browser, router, handset exploits and tools select items from newer Ops Disks, including newer exploits for Windows 10 compromised network data from more SWIFT providers and Central banks compromised network data from Russian, Chinese, Iranian, or North Korean nukes and missile programs More details in June. Their latest message is from 2017-05-29 [2]: > Q: What is going to be in the next dump? > TheShadowBrokers is not deciding yet. Something of value to someone. See theshadowbrokers’ previous posts. The time for “I’ll show you mine if you show me yours first” is being over. Peoples is seeing what happenings when theshadowbrokers is showing theshadowbrokers’ first. This is being wrong question. Question to be asking “Can my organization afford not to be first to get access to theshadowbrokers dumps?” [1] https://steemit.com/shadowbrokers/@theshadowbrokers/oh-lordy-comey-wanna-cry-edition https://steemit.com/shadowbrokers/@theshadowbrokers/oh-lordy... [2] https://steemit.com/shadowbrokers/@theshadowbrokers/theshadowbrokers-monthly-dump-service-june-2017 https://steemit.com/shadowbrokers/@theshadowbrokers/theshado...
- throwanem 9y ago
  What the hell is with all those present progressive forms?
  - weinzierl 9y ago
    Has been discussed on HN at length in the respective threads. Some people believe it's to make language analysis harder.
Kenji 9y ago
Why is nobody punishing the responsible nation states? I think the nation states who have such irresponsible intelligence agencies should pay every last dime of Microsoft's patching efforts and the damages the hacks and leaks cause.
- empath75 9y ago
  Well it's a combination of the us and Russia in this case.
  - qb45 9y ago
    If we are talking malware being leaked or escaping to the wild, it's more like the US, Israel and maybe some not-yet-caught European states cooperating with them.
- dragonwriter 9y ago
  > Why is nobody punishing the responsible nation states? Because the nation-states involved are legally immune, because of sovereignty and sovereign immunity, and rather resistant to other forms of coercion because of substantial economic power, conventional military forces, and nuclear weapons.
- pessimizer 9y ago
  Nation-states are the law. Punishing a nation-state means going to war.

110 points by my123 9y ago

norswap 9y ago

What the heck does "nation-state activity" means?

jaclaz 9y ago
>What the heck does "nation-state activity" means? That looks hard enough to understand, but additionally it is "potential".
cityhall 9y ago
Russia
- Alupis 9y ago
  > Russia Is that a new way of saying "NSA"? All joking aside... this is likely the tail-end result of the Shadow Brokers leak coupled with the recently-used exploits in the failed crypto-locker variant "Wanna Cry".
sp332 9y ago
It means governments are exploiting the OS instead of random hackers.
gruez 9y ago
"Activity" = codename for hacking
my123 9y ago
> we have taken action to provide additional critical security updates to address vulnerabilities that are at heightened risk of exploitation due to past nation-state activity and disclosures. It's state sponsored hacking or hoarding of vulnerabilities.
Ded7xSEoPKYNsDd 9y ago
Presumably it's another case where an intelligence agency lost control of an exploit they developed, the same thing that happened with WannaCry.
daveloyall 9y ago
The page links here: https://support.microsoft.com/en-us/help/4025687/microsoft-security-advisory-4025685-guidance-for-older-platforms https://support.microsoft.com/en-us/help/4025687/microsoft-s... ...which mentions some MSyy-nnn numbers, some of which have been mentioned on HN before.
1001101 9y ago
https://en.wikipedia.org/wiki/WannaCry_ransomware_attack#Attribution https://en.wikipedia.org/wiki/WannaCry_ransomware_attack#Att...
kpil 9y ago
Interesting question. "Nation" is really the people, not the country or the state, and the reason it's mixed up to the point of having reached the dictionaries, is the strong nation-states that have been founded in Europe the last few hundred years. "State" is the organisation that governs a country or region, and in extension all it's concerns. Activity means hacking. So... a government organisation from a country of ethnically and culturally distinct people are hacking shit.

DuskStar 9y ago

I can't help but feel that Microsoft providing these security updates long past XP's stated EOL date will only decrease security in the long run. After all, if any "big enough" vulnerability results in getting a patch anyways, why upgrade/firewall that old XP system running your equipment? And I'd bet that people will expect the same treatment for Windows 7, too. People never learn when disaster is narrowly averted. People learn when their decisions mean everything is on fire.

jimmaswell 9y ago
Anyone still using XP at this point is obviously not planning to upgrade to a new OS in the first place. I'm certain there are virtually no XP users who would have been swayed to finally upgrade by these specific security patches being withheld.
- DuskStar 9y ago
  Maybe not from security patches being withheld, but I'd bet that Britain's NHS has done something to improve security following their encounter with WannaCry - and I know my university's hospital system did.
ch4s3 9y ago
Imagine if you will a hospital system say, the VA, which owns a number of MRI machines, x-ray equipment, or similar which runs Windows XP. Now imagine that these machines were built by a company that was acquired and dismantled and therefore can no longer provide updates. Now imagine that these machines are connected to the local network behind the firewall, but can not be air gapped... for reasons. These machines work just fine, other than having an old OS. Should they get scrapped?
- codefined 9y ago
  I'd say yes, especially if they're not getting security updates and are connected to the rest of the network. Honestly, the cost of it getting broken into seems to be significantly higher than the cost of upgrading the systems.

news_to_me 9y ago

How the fuck are some government orgs still on Windows XP?? Seriously, we need government-wide standards in place so this sort of thing doesn't happen.

eli 9y ago
Strict standards and certifications that make it hard to make changes are one contributing factor to how we ended up here.
deleted 9y ago
[deleted]
louithethrid 9y ago
How dare the customer have opinions of there own and vote with there feet and money for it! This is outrageous! Dont they want to go Hipster-Hyper-Heaven?
- deathanatos 9y ago
  I'm not saying the customer shouldn't be able to vote with their feet/wallet, but they should also be aware that code rots, and security vulnerabilities become more known as time goes on. I don't think criticizing an organization for sticking with ever older, ever more insecure software is necessarily wrong. What makes this harder is that people bought into a platform that doesn't given them access to the code they run. The business that originally created it isn't interested in supporting it further (well, they are, i.e., "Windows 10", but I presume that that's not acceptable to our hypothetical "vote with there [sic] feet" person), and I don't really see that the business should be forced to support it, either. (It's not like MS didn't support it for quite a while, and don't still offer a solution.) Software evolves. Ideally we're finding more secure and better ways of doing stuff, and shedding the old stuff, though I acknowledge the debatability of that. I acknowledge that it's also unfortunate that UI changes, and bloat, often seem tightly coupled with that. But if people also persist in choosing non-free, non-open source software…
  - 9y ago

0x0 9y ago

I keep a winxp vm around for some old games. Many of the download links at https://support.microsoft.com/en-us/help/4025687/microsoft-security-advisory-4025685-guidance-for-older-platforms https://support.microsoft.com/en-us/help/4025687/microsoft-s... , especially in table parts 2 and 3 for winxp go to 404 pages. Also, ie for winxp does not seem to be able to even open the windows update website any more. Any tips?

chrisper 9y ago
Just download it normally and move it to your VM through network share or whatever.
sp332 9y ago
Have you tried manually installing SP3 first? I remember an old PC I had to troubleshoot wouldn't install anything else until I had that.
- mrighele 9y ago
  I tried to install Xp in a VM a few weeks ago to see if I could run a few old games. The iso I had was for XP Sp2, and I couldn't find a download link for the Sp3 installer on the whole Microsoft site. Links from search engines become "the file is no longer available" or something similar
- 0x0 9y ago
  Yeah, I'm sure it has SP3, and I think also all the regularly issued windows updates up until EOL. Anyways, it looks like more updates are coming online now. Perhaps they published the links before publishing the linked pages.

gaius 9y ago

Kudos to Microsoft for doing this. Who else in the world is patching 16-year-old code well past it's EOL, for free?

askvictor 9y ago
I'm sure you could find some oss projects
- IshKebab 9y ago
  I'm sure you can't. You might find open source projects that are older than 16 years, e.g. Linux. But that's not the same. Nobody is maintaining Linux 2.4, which was released in 2001. Its support only lasted until in 2010 as far as I can tell.
  - zwerdlds 9y ago
    I think NetBSD qualifies for whatever criteria you're trying to express.
  - askvictor 9y ago
    In that case, let's compare apples with apples- the final release of XP was in 2008. So we're looking for software released on or before 2001, actively developed until 2008, then on life support since then. On the other hand, many oss projects have rolling releases, so trying to compare like this is futile, expect for the fact they have been maintained for a very long time. LaTeX 2e has been around since 1994 and is still the current, maintained version.
AndrewOMartin 9y ago
Certainly not the people whose code is much older than 16 years and not simply declared EOL for profit reasons.
csydas 9y ago
Blizzard? Diablo 2 got a patch just this year. I get what you're saying, it's nice that they're doing this, but it's not really so much a goodness of the heart thing as it is that there is a super critical bug to many versions of Windows and there happen to be enough XP machines around that they're a significant threat. The bugs are big enough and the threat great enough that there's probably less cost in patching than there is in dealing with any of the potential fallout.

toredash 9y ago

Sad part is that there will still be owners of WinXP who won't patch their systems.

Angostura 9y ago
Because the manufacturer of their embedded system went bust, for example.
- toredash 9y ago
  Or they just don't patch their systems.

EdSharkey 9y ago

I imagine Microsoft gets a dump truck full of cash to open support up on XP like this. I wonder who paid?

TAForObvReasons 9y ago
US pours tens of billions of dollars into legacy technologies: http://www.gao.gov/products/GAO-16-696T http://www.gao.gov/products/GAO-16-696T -- no doubt a large portion of that made its way to Microsoft
ocdtrekkie 9y ago
Well, the US government's already paying them to maintain XP to begin with. So the patches already exist internally at Microsoft, and it costs them nothing if they just decide "Hey, this patch is such a big deal, we also want to let everyone else have it". Isn't really gonna change the fact that the US government's still paying them for the work. And computer security benefits from herd immunity tactics, so it's best to get virus updates in as many hands as possible. It's why Microsoft has never really prevented pirated copies of Windows from getting security updates. They benefit from not having old machines potentially causing problems for newer ones, and even just avoiding the bad PR from massive malware attacks.
- daxfohl 9y ago
  For that matter the government may well be dictating the patch release schedule too. And certainly the skeptical among us can wonder what else may be in these patches.

weinzierl 9y ago

Could be related to the The Shadow Brokers threatening to release a new stash of exploits in June, this time targeting Windows 10. From their announcement on 2017-05-15 [1]: > In February Microsoft is missing patch Tuesday. TheShadowBrokers is knowing, Microsoft is missing to be making patches for Eternal exploits. [..] In March Microsoft is releasing patch for SMB vulnerabilities. TheShadowBrokers is knowing this is being for Eternal exploits. TheShadowBrokers is still waiting and not releasing. [..] In April, 90 days from theequationgroup show and tell, 30 days from Microsoft patch, theshadowbrokers dumps old Linux (auction file) and windows ops disks. [..] Eternal exploits is not being ZeroDays. [..] patch was being available for 30 days before theshadowbrokers is releasing dump to public. [..] TheShadowBrokers Monthly Data Dump could be being: web browser, router, handset exploits and tools select items from newer Ops Disks, including newer exploits for Windows 10 compromised network data from more SWIFT providers and Central banks compromised network data from Russian, Chinese, Iranian, or North Korean nukes and missile programs More details in June. Their latest message is from 2017-05-29 [2]: > Q: What is going to be in the next dump? > TheShadowBrokers is not deciding yet. Something of value to someone. See theshadowbrokers’ previous posts. The time for “I’ll show you mine if you show me yours first” is being over. Peoples is seeing what happenings when theshadowbrokers is showing theshadowbrokers’ first. This is being wrong question. Question to be asking “Can my organization afford not to be first to get access to theshadowbrokers dumps?” [1] https://steemit.com/shadowbrokers/@theshadowbrokers/oh-lordy-comey-wanna-cry-edition https://steemit.com/shadowbrokers/@theshadowbrokers/oh-lordy... [2] https://steemit.com/shadowbrokers/@theshadowbrokers/theshadowbrokers-monthly-dump-service-june-2017 https://steemit.com/shadowbrokers/@theshadowbrokers/theshado...

throwanem 9y ago
What the hell is with all those present progressive forms?
- weinzierl 9y ago
  Has been discussed on HN at length in the respective threads. Some people believe it's to make language analysis harder.

Kenji 9y ago

Why is nobody punishing the responsible nation states? I think the nation states who have such irresponsible intelligence agencies should pay every last dime of Microsoft's patching efforts and the damages the hacks and leaks cause.

empath75 9y ago
Well it's a combination of the us and Russia in this case.
- qb45 9y ago
  If we are talking malware being leaked or escaping to the wild, it's more like the US, Israel and maybe some not-yet-caught European states cooperating with them.
dragonwriter 9y ago
> Why is nobody punishing the responsible nation states? Because the nation-states involved are legally immune, because of sovereignty and sovereign immunity, and rather resistant to other forms of coercion because of substantial economic power, conventional military forces, and nuclear weapons.
pessimizer 9y ago
Nation-states are the law. Punishing a nation-state means going to war.