10 ms·
Microsoft Patches Six Zero-Day Security Holes
- paulpauper 5y agowhich probably means there are many more unreported and being used ,such as by FBI. you wonder how purportedly unhackable btc wallets get hacked? Now you know. these agencies have huge trove of exploits for all OS and browsers
- deleted 5y ago[deleted]
- maxrev17 5y agoAdding local weather to my task bar but unable to fix display scaling issues and leaving tonnes of zero days.... Lolz
- joeyrobert 5y agoYeah, let's get that weather app engineer working on NTFS privilege flaws.
- maxrev17 5y agoHaha yeah... I think it shows where their overall focus is placed.
- spand 5y agoWhat a silly straw man. Engineers may not be fungible but funding is.
- wvenable 5y agoSo they shouldn't fund adding local weather to task bar while there are potential security flaws anywhere in the OS? This seems like a sillier straw man.
- deleted 5y ago[deleted]
- celticninja 5y agoYou have to look at the customers. If you push for Linux throughout your organisation and you got hit with a linux zero day, it's your fault. If you use MS, then it's Microsoft s fault, you won't be blamed because almost everyone was exposed to it and you got hit. These companies also have older workforce who are used to windows and the switch would be difficult. Yes I know some older users would be fine but that is not the majority. It's similar to the "no one got fired for buying oracle" situation
- tux3 5y agoAnd why not :) People have different preferences for what they like to work on, but you seem to be implying the weather app engineers are incapable of doing that work. Like they're some kind of lower caste that must be kept away from working on security mitigations for filesystem drivers. I don't believe there's some category of human that's capable of shipping Windows 10 feature apps, and only that. People can move internally! People can leave and other people can be hired. It's all priorities and task allocation. The impression I get (and please correct me) is not really that there's an oversupply of news feed app builders on the market, but that the Windows team at Microsoft has been shifting to more user-facing features rather than internal deep kernel work.
- NicoJuicy 5y agoThere are more than 1500 developers working on visual studio alone ( not VS code). I'm pretty sure that a developer that wants to switch can and not many kernel developers would be impacted in total. Besides, paint and notepad getting a make-over doesn't make a dent of difference for a company at this size.
- coolspot 5y agoThere are many engineers who do super-boring stuff as main work, working on mind-bogglingly hard problems afterhours. Also that weather-widget engineer could do some basic tasks offloading more experienced engineer, who would offload even more experienced engineer until that chain of offloading makes enough time for NTFS-ninja to hunt down and fix that bug or write a fuzzer that finds new zero-days.
- deleted 5y ago[deleted]
- waynesonfire 5y agoabsolutely. and if there is a skill gap then train them so they can.
- KMnO4 5y agoTraining isn’t some magical way to transform an engineer with a skill set into one with a different skillset. I don’t think it’d be possible to train the React dev in kernel programming unless they had a serious interest in low level stuff to start with.
- waynesonfire 5y agohow's the view from that tower?
- bottled_poe 5y agoThat’s a ridiculous claim. Kernel programming isn’t some fantasy world where only the most passionate developers can do effective work. Most software engineers are web engineers because that’s where the market says they should focus. It says nothing about talent or ability to learn. smh.
- underscore_ku 5y agojust use use linux...
- scoofy 5y agouhh... there are zero-days in linux distros
- DistressedDrone 5y agoI use Linux exclusively. You don't need a zero-day when everyone forgets to patch or takes a month to do so. To say nothing of the documented vulnerabilities with no available patch.
- swiley 5y agoHow many are RCEs though? There was the bluetooth thing but patches for that were available instantly.
- deleted 5y ago[deleted]
- __turbobrew__ 5y agoJust use templeOS...
- alkonaut 5y agoI think the term you are looking for is “abacus”. Just use an abacus.
- cm2187 5y agoOr even better, just don’t write bugs.
- waynesonfire 5y agoare these the six zero days that were used to get those bit coins back?
- X6S1x6Okd1st 5y agoState actors don't need zero days to take control of a rented server.
- koheripbal 5y agoNo
- joenathanone 5y agoDo the Microsoft links not work for anyone else too? I get a "Something went wrong" error on all the links. Would like to read more about specific vulns.
- 1vuio0pswjnm7 5y agoMicrosoft is asking the user to enable Javascript. There is no technical reason in this case why Javascript is necessary. https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2021-33742 https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/... https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2021-31955 https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/... https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2021-31956 https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/... https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2021-33739 https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/... https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2021-31201 https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/... https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2021-31199 https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/... https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2021-31959 https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/... https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2021-31963 https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/... To add insult to injury, Microsoft's server refuses to honour the Accept-Encoding header, e.g., setting the value to "identity" has no effect. It returns compressed content no matter what, even when the content size is very small. To create a simple HTML page with all the info you need, no Javascript required sed '/^e/!s/^/url=/'<<eof|curl -K-|gzip -dc|sed 's/",/\"<br>/g;s/\\n//g' > 1.htm https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2021-33742 https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2021-31955 https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2021-31956 https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2021-33739 https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2021-31201 https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2021-31199 https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2021-31959 https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2021-31963 eof firefox ./1.htm
- afrcnc 5y agoWow... patch tuesday analysis from a reporter who doesn't know how virus total works https://twitter.com/silascutler/status/1383085248381128715 https://twitter.com/silascutler/status/1383085248381128715
- zelon88 5y agoI view Krebs as a tabloid. It is a stopgap for layman's with slightly above average opsec knowledge. It is rather dangerous because he is wrong or misrepresents reality rather often. And there's something sensationalist about every article. They always have this rushed, panic driven, sophomoric writing style. To quote a comment I read on HN once, "Krebs is a security entertainer, not a security researcher."
- deleted 5y ago[deleted]
- boston_clone 5y agoCould you provide some examples to bolster your claim about this person's journalistic integrity? There are some technical details that may be abstracted or analogized in less-than-accurate fashion, but I don't recall reading an article or post and thinking "gosh, that's just _wrong_"
- atatatat 5y agoHe's generally a "good guy", but if you haven't figured out he's a cowboy, just read more of his shit. Any of it, really.
- afrcnc 5y agohttps://twitter.com/VessOnSecurity/status/1394311907666972672 https://twitter.com/VessOnSecurity/status/139431190766697267... https://twitter.com/juanandres_gs/status/1394725629640298502 https://twitter.com/juanandres_gs/status/1394725629640298502 https://twitter.com/fwosar/status/1394465986087161856 https://twitter.com/fwosar/status/1394465986087161856 https://twitter.com/vinopaljiri/status/1394326993500524545 https://twitter.com/vinopaljiri/status/1394326993500524545
- chaimanmeow 5y agogiving open sores a run for the money!
- nodesocket 5y agoAre these on the same level as Stuxnet? For an amazing technical deep dive into each 0-day Stuxnet vulnerability watch this talk with Bruce Dang from Microsoft[1]. I really enjoy his natural speaking style (it's like talking about Stuxnet over beers with him). [1] https://youtu.be/rOwMW6agpTI?t=409 https://youtu.be/rOwMW6agpTI?t=409
- userbinator 5y ago–CVE-2021-33742, a remote code execution bug in a Windows HTML component. The only one that stands out as being a real concern, but who's willing to bet it requires JS to exploit (or even if not, the attackers prefer to obfuscate it using JS)? Turning off JS by default in IE is probably the single most effective way of preventing these attacks. Even if you don't use IE, it'll greatly reduce the attack surface. I've browsed the shadier parts of the Internet for literally decades this way.
- CleanCoder 5y agoIf it required JS it would not be a bug in Windows HTML component.
- chmod775 5y agoIt's a bug in Trident/MSHTML, which includes a 'JScript' engine. Anecdotally code execution exploits in pure HTML (that don't require JS) are exceedingly rare, so it is unlikely it doesn't use JS.
- Black101 5y ago> Microsoft also patched five critical bugs — flaws that can be remotely exploited to seize control over the targeted Windows computer without any help from users. seems pretty bad...
- Waterluvian 5y agoTurning off JS is not the single most effective way. Turning off the internet. Or your PC entirely is. Just not visiting most of the Internet is a solid move too, JS or not.
- mr_toad 5y ago> Turning off JS by default in IE But the only reason to use IE is for enterprise apps that probably require JavaScript to function. And the ability to toggle JavaScript is probably locked down by Mordac the Preventer, aka group policy.
- dlsa 5y agoSo these vulns weren't needed any more by some 3 letter agency? Or were they being used by someone a 3 letter agency didn't like? Or were about to be? Security warfare is fascinating to watch from the mud huts.
- Waterluvian 5y agoInteresting. Are you conspiracy theorizing or is there a reputable basis for this?
- taylorfinley 5y agoA reputable basis for three letter agencies failing to report zero days? Yeah, it's called Zerodium.
- xvector 5y ago> is there a reputable basis for this? Yes. The NSA has disclosed hoarded zero-days to Microsoft when they have fallen into the hands of people they did not like. See the Shadow Brokers incident [1]: > the critical vulnerabilities for four exploits previously believed to be zero-days were patched in March, exactly one month before a group called Shadow Brokers published Friday's latest installment of weapons-grade attacks Obviously, the problem with this is that the NSA were unaware their zero-days had fallen into enemy hands until the Shadow Brokers very publicly advertised the fact that they had them. [1]: https://arstechnica.com/information-technology/2017/04/purported-shadow-brokers-0days-were-in-fact-killed-by-mysterious-patch/ https://arstechnica.com/information-technology/2017/04/purpo...
- waste_monk 5y agoTake the EternalBlue exploit [1] as an example, NSA had been aware of the vulnerability for years, but only informed Microsoft once it slipped out of their control: "The NSA did not alert Microsoft about the vulnerabilities, and held on to it for more than five years before the breach forced its hand. The agency then warned Microsoft after learning about EternalBlue's possible theft, allowing the company to prepare a software patch issued in March 2017,[19] after delaying its regular release of security patches in February 2017.[20] On Tuesday, March 14, 2017, Microsoft issued security bulletin MS17-010,[21] which detailed the flaw and announced that patches had been released for all Windows versions that were currently supported at that time ... Many Windows users had not installed the patches when, two months later on May 12, 2017, the WannaCry ransomware attack used the EternalBlue vulnerability to spread itself" [1] https://en.wikipedia.org/wiki/EternalBlue#Details https://en.wikipedia.org/wiki/EternalBlue#Details
- ck2 5y agoSo wait, Microsoft is still making patches for Windows7, they just aren't supplied via the windows-update ? https://www.catalog.update.microsoft.com/Search.aspx?q=KB5003667 https://www.catalog.update.microsoft.com/Search.aspx?q=KB500... Is there a third party program that finds/installs the windows 7 updates?
- developer2 5y agoExtended Support ended January 14, 2020, however Microsoft is offering Extended Security Updates (ESU) until January, 2023. It's a paid program to extend security patches, having to be paid once a year for each of the 3 years; so only truly desperate companies are paying for this privilege. [1] https://docs.microsoft.com/en-us/lifecycle/faq/extended-security-updates https://docs.microsoft.com/en-us/lifecycle/faq/extended-secu... [2] https://techcommunity.microsoft.com/t5/windows-it-pro-blog/year-two-extended-security-updates-for-windows-7-and-windows/ba-p/1872910 https://techcommunity.microsoft.com/t5/windows-it-pro-blog/y...
- Silhouette 5y agoBut the Update Catalog shows updates that you can apparently download as usual for Windows 7 in this case. There is a specific rationale given on at least one of the reports[1] for why a patch is still being issued even though Windows 7 is out of support. So I'm not sure this time it has anything to do with ESU. [1] https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-31959 https://msrc.microsoft.com/update-guide/en-US/vulnerability/...
- tgragnato 5y agoLast week I saw a friend using dot net software that scrapes the Catalog, automatically downloads all patches and applies them to the system. It's apparently common in enterprises without an ESU subscription... I was quite surprised and amused
- developer2 5y ago