6 ms·
A Windows Update bug is renaming everyone's printers to HP M101-M106
- kobpow 3y agoImagine hacking into a key supplier's driver software and sneaking in defective metadata to Windows Update. Wouldn't this result in mass installation on various systems? Sounds like a serious vulnerability in security.
- lionkor 3y agoNo worries - if word gets out, you can simply deny the windows update! Oh wait, you can't. This may be an attack vector, for sure
- Jerrrry 3y agochaining accessing a likely air-gapped rsa private key to sign the malformed update with an already unlikely attack vector of a metadata parsing exploit itself means this is pretty pie in the sky
- radicalbyte 3y agoI expect that many of the players have their private keys not only on accessible machines but also likely under version control. Probably on a cloud platform.
- fathyb 3y agoI always liked imagining big players like Apple, Sony, Microsoft, Nintendo, etc.. taking absurd measures to protect their private signing keys, something like that Coca-Cola recipe vault.
- bombcar 3y agoI've seen some documentaries implying that about some of the root keys for things like certificates, but you know that there are some laying around in easy to use format ...
- radicalbyte 3y agoThat was my assumption considering that is exactly what we did do for our covid certificates. Ran on the same infra as passports which is gold standard. Microsoft? YOLO with their crown jewels: https://techcrunch.com/2023/07/17/microsoft-lost-keys-government-hacked/?guccounter=1 https://techcrunch.com/2023/07/17/microsoft-lost-keys-govern...
- Jerrrry 3y agoYou can split any key into x/n pieces that require x outta n keys to approve a transaction. All senior dev's, physical locations, board members, hell, even all stock holders, could cryptographically vote via an agreed upon method for any actions.
- pxeboot 3y agoDidn't Sony get hacked and had a nearly completed film leaked? I hope the others you listed have far better security.
- mschuster91 3y ago> chaining accessing a likely air-gapped rsa private key Unfortunately, who knows if that's the case? Whoever was behind Stuxnet managed to steal the crown jewels of not just one but two different companies. There's a lot of companies with credentials to sign Windows kernel level code out there... which is also the reason why Apple is so insistent on getting rid of kext's - they want to get rid of the entire business model of allowing anyone but themselves to run kernel-level code on ordinary macOS machines. [1] https://en.wikipedia.org/wiki/Stuxnet https://en.wikipedia.org/wiki/Stuxnet
- jowea 3y agoEven for a state-level actor?
- realusername 3y agoIt seems that the QA on Windows is getting worse and worse, this kind of high visibility bug should be caught beforehand.
- Nextgrid 3y agoThere hasn't been any QA for years now. The old QA team that gave us masterpieces like Windows 7 has since been laid off.
- realusername 3y agoThat explains why it's going downhill then. It's sad to see what Windows has become even if I'm really not their biggest user.
- whalesalad 3y agoQA on Windows? Is that a thing?
- IcyWindows 3y agoUsed to be: https://www.youtube.com/watch?v=6_hm3NzLeO8 https://www.youtube.com/watch?v=6_hm3NzLeO8
- RobotToaster 3y agoQA? You mean the users?
- sydbarrett74 3y agoEliminating QA was one of Nadella's first substantive acts as CEO. There has been no such thing as QA at Microsoft for the better part of a decade.
- dabbz 3y agoQA elimination was a Terry Meyerson decision. There's a multitude of reasons he was asked to step down (allegedly).
- freedomben 3y agoThe more "oops" things like this get pushed in automatic updates, the more I begin to despise our modern culture of continual updates. This is by no means just a Microsoft/Windows problem either, this affects everything nowadays. My damn Pixel watch suddenly has a bug where if I turn around and walk back down the road I just came on, it rolls back my distance, like an old school odometer that is just tied to wheel rotations. I'm so sick of having working software one time, and the next time I open it it's broken or worse, has a completely overhauled UI and I don't have time to learn the new way to use it. As a dev I love CI/CD, but as a user I'm beginning to actively despise it for the UX that it's led to. I think too many people have decided that QA isn't needed anymore because "we'll get bug reports and can patch and deploy them quickly." That's a terrible philosophy and you are bad and you should feel bad if that's how you ship your software.
- rkagerer 3y agoI've always despised it. I demand control over the timing of updates, and I allow only very few exceptions in any of what I consider my critical infrastructure. It means I pass on buying or using a lot of modern hardware / software. It also means my PC won't fail the night before a big delivery deadline for a multimillion dollar project for a client (and yes, I also keep duplicate spare hardware and backups to mitigate against regular failure).
- JohnFen 3y ago> I begin to despise our modern culture of continual updates. I started fully despising it a number of years ago. I think it's one of the worst fads that has swept through the industry. I hope that eventually it will die a horrible death.
- easton 3y ago> bug where if I turn around and walk back down the road I just came on, it rolls back my distance, like an old school odometer that is just tied to wheel rotations. Ah, they must be using the classic physics definition of work, where if you start and end in the same position you didn’t do any work. (…does nobody at Google actually look at the step number? Isn’t that half the use of these watches?)
- randerson 3y agoThis explains the confusing email I got from Microsoft Family Safety last week saying that my child (who uses a locked down Windows PC for gaming) had purchased the HP Smart application from the Microsoft store for $0.00.
- mrlonglong 3y ago[flagged]
- urbandw311er 3y agoGreat, I can’t wait for the promised utopia when things are all “joined up” and my PC automatically orders me ten litres of unwanted HP toner when this happens.
- sonicanatidae 3y agoEven better, it'll happen while you own a Brother printer. lol
- thedanbob 3y ago> After the printer metadata incorrectly identified everyone's printers as HP LaserJet printers, Windows installed all the software needed for an HP printer to work smoothly, including the HP Smart App. Tangential, but I absolutely hate printers that force you to install an app (or should I say spyware?) along with their drivers.
- rplnt 3y agoEven more tangential, you can extend that to most common peripheral hardware. And it's kinda outrageous an OS would be forcing this down on their users.
- bonton89 3y agoMy understanding is that by default Windows update has drive updates on and installs all manner of manufacturer crapware through it.
- JohnFen 3y agoAny printer that has to have special software (including proprietary drivers) is not fit for purpose, in my opinion.
- SushiHippie 3y agoEven worse HP scanners need an account for scanning! On linux there is at least the https://hplipopensource.com/ https://hplipopensource.com/ library which contains the `hpscan` command line utility, which can scan flawlessly without an account or any other weird stuff.
- ssss11 3y agoThe dev: “update works on my machine… now let me just print that document to my printer M101-M106”
- DougN7 3y agoThat is exactly what happened. And the QA person used the same printer. In that scenario I might not notice either.
- deleted 3y ago[deleted]
- rabbits_2002 3y agothe move to windows being a service has been a disaster. I swear task manager lists some new useless daemon taking 3% of cpu after every update
- shiroiuma 3y ago>the move to windows being a service has been a disaster. No, it hasn't, it's been quite the opposite. The company is more profitable than ever, so much that now instead of saying "FAANG", people are saying "MAANG" or "GAMMA" or some variation. >I swear task manager lists some new useless daemon taking 3% of cpu after every update What's wrong with that? Microsoft isn't paying your power bill, you are. It's not their problem. Are you going to stop using Windows because it's slow and hogging the CPU to show you ads in the home screen?
- bonton89 3y agoMicrosoft updates are also really bloated. Fortunately, Microsoft was able to solve this problem by implementing a feature so your PC uploads updates to other PCs for them. No need to improve update size, users can just share the cost of the update infrastructure. Microsoft updates were always large but then they found out some users weren't installing updates because they didn't have enough hard drive space since the update process is so bloated. Microsoft innovation solved this as well, they just force reserved 7GB of end users (Microsoft's) hard drive so there would always be room. Mark that one as resolved. These innovations are why Microsoft is such a profitable powerhouse. Maybe Microsoft can install a cryptominer to run on your PC when it is idle and send the money back to Microsoft. It would help pay for the cost of all the improvements Microsoft is always making to Windows. The possibilities are endless.
- rabbits_2002 3y ago>Maybe Microsoft can install a cryptominer to run on your PC when it is idle and send the money back to Microsoft. I think thats what “antimalware service executable” is