5 ms·

Windows 7 is horribly insecure now. Please reconsider.

by eptcyka 5y ago

gruez 5y ago
Normally yes, but you can pirate the extended support updates, which last until 2023.
userbinator 5y ago
FUD. MS gathers more information about you than ever.
- eptcyka 5y ago
  Both of those statements can be true.
  - userbinator 5y ago
    It's downright fearmongering --- classic MS-style --- to say something is "horribly insecure" when it has has been around for over a decade and all the major bugs have already been found. Nevermind the fact that everyone is almost always behind a NAT and are basically unreachable for attackers to exploit remotely. If anything, the newer versions of Windows are "horribly inescure" because they contain so many "unknown unknowns". But that wouldn't fit the narrative MS wants to propagate...
    - kube-system 5y ago
      Plenty of new CVEs are in code that has been around for decades. For an example recently in the news: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527 https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...
    - gruez 5y ago
      > It's downright fearmongering --- classic MS-style --- to say something is "horribly insecure" when it has has been around for over a decade and all the major bugs have already been found. Have they? We just had printernightmare (CVE-2021-34527) a few months ago. In certain configurations you can even get RCE.
      - userbinator 5y ago
        We just had printernightmare (CVE-2021-34527) a few months ago. That's a remote authenticated code execution...
        userbinator 5y ago
        Downvoters, please GO READ THE PoC CODE THAT YOU CAN FIND EVERYWHERE.
        userbinator 5y ago
        I guess the FUD-spreading paranoia-shills are too busy downvoting to actually check the facts. ...which is how this fucking corporatoracy will try to maintain its power. You can point out the very clear and visible truth, but they'll just deny it. Fortunately, the number of people who realise they're being fleeced is slowly rising.
        orf 5y ago
        You’re missing the point of why you’re being downvoted. Go actually reply to people engaging you, rather than ranting to yourself.
        gruez 5y ago
        What are you trying to say here? "it's been 10 years so surely they ironed out the critical vulnerabilities (eg. eternal blue) by now. all the vulnerabilities left are probably the lame ones like printnightmare".
    - eptcyka 5y ago
      I wouldn't use an Android phone for anything safety critical if it was more than 6 months behind the latest security patches. Why would it be any different for Windows? Of course, we can play the asterisk game and expressly state that if the machine is not connected to the internet and not used to browse the web, then it's probably safe. Or if you like browse the web in a VM. I still have to wonder if the patches for these kinds of issues[1] get backported to Windows 7. As to the appeal for age, I think software ages like seafood in terms of security. Just because it's been deployed for years doesn't mean that there aren't vulnerabilities lurking in that code. Although I will concede that as Windows 7 loses users, the payoff for finding a vulnerability will decrease too. [1]: https://www.sentinelone.com/labs/cve-2021-3438-16-years-in-hiding-millions-of-printers-worldwide-vulnerable/ https://www.sentinelone.com/labs/cve-2021-3438-16-years-in-h...
      - Wowfunhappy 5y ago
        > Or if you like browse the web in a VM. What if you just browse the web in an up-to-date web browser? In both cases, the browser has a sandbox that should keep you safe. Multiple layers of defense are of course better—but in both cases, someone would need a zero day to escape the sandbox, right?
    - spywaregorilla 5y ago
      Have all the insecurities been patched? There's pretty much only downsides to unpatched, known vulnerabilities vs. unknown vulnerabilities with the slight exception that you'd be a little more justified assuming you're safe when you're not. The likelihood of suffering a loss is much higher.
    - jfrunyon 5y ago
      > and all the major bugs have already been found Excuse me while I die of laughter. People are still finding bugs which existed in XP. Which was supported for 12 years and was released 20 years ago. 7 was supported for 11 years and was released 12 years ago. > Nevermind the fact that everyone is almost always behind a NAT and are basically unreachable for attackers to exploit remotely. Sure, except that the vast majority of malware doesn't come from a remote attack.
      - userbinator 5y ago
        People are still finding bugs which existed in XP. Ones which existed only in XP and not later? I doubt it. On the other hand, as for the bugs which exist only in the later versions... Sure, except that the vast majority of malware doesn't come from a remote attack. ...then where does it come from? Don't say "users installing it", because that's nothing more than an authoritarian excuse to take away freedom --- and as the saying goes, "Those who give up freedom for security deserve neither."
        jfrunyon 5y ago
        > Ones which existed only in XP When did I say that? Finding a bug in Win10 which has existed since XP is just as dangerous as finding a bug only in XP, given that the patch Microsoft releases for Win10 will not be released for XP. > ...then where does it come from? Vulnerabilities in locally installed software? Supply-chain attacks, drive-by attacks, clickjacking attacks? Or, you know, users installing it? Believe it or not, users frequently install malware; otherwise, there wouldn't be such a proliferation of fake "driver" sites on the internet. I'm not sure how you reached the conclusion that facts are an authoritarian excuse to take away freedom, particularly since I have never and would never advocate for disallowing people to install whatever software they like.
jlokier 5y ago
From the article, I'm under the impression Windows 11 is horribly insecure now. Which security issues are worse? A built-in cloud command logger is quite bad if you don't know it's there, and is a security risk even if you know. Some people occasionally enter things like private URLs, tokens, UUIDs, pathnames and query value onto the command line. Which is fine if they're the sort of thing that's ok in your local, private command history. Not so much if it's sent upstream.
- chakalakasp 5y ago
  The Windows 7 issues are worse. Far worse. But you do you, man
  - NullPrefix 5y ago
    Care to elaborate? Without additional arguments it sounds like pure FUD to get more people on to the win11 spyware wagon
    - chakalakasp 5y ago
      I mean, there is an entire field of study in cybersecurity. You're asking me why using an EOL OS that is 7 years out of patch compliance is worse than using Windows 10 and being in patch compliance. That's something you can easily Google and get 15 second answer from an authoritative source. But like I said, you do you. You'll figure it out eventually, probably at great cost.
- yabones 5y ago
  It entirely depends on your threat model but if yours is similar to most people, holes that let anybody on your network hijack your system via `tcp.sys` RCE's might be a showstopper...
  - SteveNuts 5y ago
    What about HIPAA issues like 'notepad.exe john_doe_health_info.txt'
raxxorrax 5y ago
I think this form of telemetry is far worse than the unlikely event someone uses an unfixed exploit against my OS to be honest. Although I would expect this kind of telemetry already implemented in Windows 7.
- jsjsjsjsjsjs 5y ago
  All it takes is going to one random website, that embeds ads, that embed an exploit kit. Not a new thing, we had this happen even with popular news sites. So yeah, it is more likely than you think.
  - raxxorrax 5y ago
    I think in most cases the browser is far more relevant than the OS.
- m463 5y ago
  I didn't install the windows 7 telemetry updates (or the force upgrade to 8 updates, etc...)
m463 5y ago
to clarify: I use it offline for games and my primary systems run macos or linux.

Windows 7 is horribly insecure now. Please reconsider.

gruez 5y ago

Normally yes, but you can pirate the extended support updates, which last until 2023.

userbinator 5y ago

FUD. MS gathers more information about you than ever.

eptcyka 5y ago
Both of those statements can be true.
- userbinator 5y ago
  It's downright fearmongering --- classic MS-style --- to say something is "horribly insecure" when it has has been around for over a decade and all the major bugs have already been found. Nevermind the fact that everyone is almost always behind a NAT and are basically unreachable for attackers to exploit remotely. If anything, the newer versions of Windows are "horribly inescure" because they contain so many "unknown unknowns". But that wouldn't fit the narrative MS wants to propagate...
  - kube-system 5y ago
    Plenty of new CVEs are in code that has been around for decades. For an example recently in the news: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527 https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...
  - gruez 5y ago
    > It's downright fearmongering --- classic MS-style --- to say something is "horribly insecure" when it has has been around for over a decade and all the major bugs have already been found. Have they? We just had printernightmare (CVE-2021-34527) a few months ago. In certain configurations you can even get RCE.
    - userbinator 5y ago
      We just had printernightmare (CVE-2021-34527) a few months ago. That's a remote authenticated code execution...
      - userbinator 5y ago
        Downvoters, please GO READ THE PoC CODE THAT YOU CAN FIND EVERYWHERE.
        userbinator 5y ago
        I guess the FUD-spreading paranoia-shills are too busy downvoting to actually check the facts. ...which is how this fucking corporatoracy will try to maintain its power. You can point out the very clear and visible truth, but they'll just deny it. Fortunately, the number of people who realise they're being fleeced is slowly rising.
        orf 5y ago
        You’re missing the point of why you’re being downvoted. Go actually reply to people engaging you, rather than ranting to yourself.
      - gruez 5y ago
        What are you trying to say here? "it's been 10 years so surely they ironed out the critical vulnerabilities (eg. eternal blue) by now. all the vulnerabilities left are probably the lame ones like printnightmare".
  - eptcyka 5y ago
    I wouldn't use an Android phone for anything safety critical if it was more than 6 months behind the latest security patches. Why would it be any different for Windows? Of course, we can play the asterisk game and expressly state that if the machine is not connected to the internet and not used to browse the web, then it's probably safe. Or if you like browse the web in a VM. I still have to wonder if the patches for these kinds of issues[1] get backported to Windows 7. As to the appeal for age, I think software ages like seafood in terms of security. Just because it's been deployed for years doesn't mean that there aren't vulnerabilities lurking in that code. Although I will concede that as Windows 7 loses users, the payoff for finding a vulnerability will decrease too. [1]: https://www.sentinelone.com/labs/cve-2021-3438-16-years-in-hiding-millions-of-printers-worldwide-vulnerable/ https://www.sentinelone.com/labs/cve-2021-3438-16-years-in-h...
    - Wowfunhappy 5y ago
      > Or if you like browse the web in a VM. What if you just browse the web in an up-to-date web browser? In both cases, the browser has a sandbox that should keep you safe. Multiple layers of defense are of course better—but in both cases, someone would need a zero day to escape the sandbox, right?
  - spywaregorilla 5y ago
    Have all the insecurities been patched? There's pretty much only downsides to unpatched, known vulnerabilities vs. unknown vulnerabilities with the slight exception that you'd be a little more justified assuming you're safe when you're not. The likelihood of suffering a loss is much higher.
  - jfrunyon 5y ago
    > and all the major bugs have already been found Excuse me while I die of laughter. People are still finding bugs which existed in XP. Which was supported for 12 years and was released 20 years ago. 7 was supported for 11 years and was released 12 years ago. > Nevermind the fact that everyone is almost always behind a NAT and are basically unreachable for attackers to exploit remotely. Sure, except that the vast majority of malware doesn't come from a remote attack.
    - userbinator 5y ago
      People are still finding bugs which existed in XP. Ones which existed only in XP and not later? I doubt it. On the other hand, as for the bugs which exist only in the later versions... Sure, except that the vast majority of malware doesn't come from a remote attack. ...then where does it come from? Don't say "users installing it", because that's nothing more than an authoritarian excuse to take away freedom --- and as the saying goes, "Those who give up freedom for security deserve neither."
      - jfrunyon 5y ago
        > Ones which existed only in XP When did I say that? Finding a bug in Win10 which has existed since XP is just as dangerous as finding a bug only in XP, given that the patch Microsoft releases for Win10 will not be released for XP. > ...then where does it come from? Vulnerabilities in locally installed software? Supply-chain attacks, drive-by attacks, clickjacking attacks? Or, you know, users installing it? Believe it or not, users frequently install malware; otherwise, there wouldn't be such a proliferation of fake "driver" sites on the internet. I'm not sure how you reached the conclusion that facts are an authoritarian excuse to take away freedom, particularly since I have never and would never advocate for disallowing people to install whatever software they like.

jlokier 5y ago

From the article, I'm under the impression Windows 11 is horribly insecure now. Which security issues are worse? A built-in cloud command logger is quite bad if you don't know it's there, and is a security risk even if you know. Some people occasionally enter things like private URLs, tokens, UUIDs, pathnames and query value onto the command line. Which is fine if they're the sort of thing that's ok in your local, private command history. Not so much if it's sent upstream.

chakalakasp 5y ago
The Windows 7 issues are worse. Far worse. But you do you, man
- NullPrefix 5y ago
  Care to elaborate? Without additional arguments it sounds like pure FUD to get more people on to the win11 spyware wagon
  - chakalakasp 5y ago
    I mean, there is an entire field of study in cybersecurity. You're asking me why using an EOL OS that is 7 years out of patch compliance is worse than using Windows 10 and being in patch compliance. That's something you can easily Google and get 15 second answer from an authoritative source. But like I said, you do you. You'll figure it out eventually, probably at great cost.
yabones 5y ago
It entirely depends on your threat model but if yours is similar to most people, holes that let anybody on your network hijack your system via `tcp.sys` RCE's might be a showstopper...
- SteveNuts 5y ago
  What about HIPAA issues like 'notepad.exe john_doe_health_info.txt'

raxxorrax 5y ago

I think this form of telemetry is far worse than the unlikely event someone uses an unfixed exploit against my OS to be honest. Although I would expect this kind of telemetry already implemented in Windows 7.

jsjsjsjsjsjs 5y ago
All it takes is going to one random website, that embeds ads, that embed an exploit kit. Not a new thing, we had this happen even with popular news sites. So yeah, it is more likely than you think.
- raxxorrax 5y ago
  I think in most cases the browser is far more relevant than the OS.
m463 5y ago
I didn't install the windows 7 telemetry updates (or the force upgrade to 8 updates, etc...)

m463 5y ago

to clarify: I use it offline for games and my primary systems run macos or linux.