7 ms·
The Microsoft Update mechanism has been used to spread malware
- leephillips 14y agoSo it's working as designed.
- fidotron 14y agoIt really was an unbelievable oversight to use the same certs in the Terminal Services activation system. Quite a demonstration that even if you go to great pains to secure the code if you aren't careful with your credentials then it's for nothing.
- rbanffy 14y agoA very similar thing happened with France during WW2. I always remind myself I'm not as smart as I think I am.
- sillysaurus 14y agoWhat happened with France?
- gojomo 14y agoI suspect it's a reference to 'the Maginot Line': http://en.wikipedia.org/wiki/Maginot_Line http://en.wikipedia.org/wiki/Maginot_Line
- AlexFromBelgium 14y agoOh yeah, sure, blame it on the Belgians!
- pygy_ 14y agoFellow Belgian here, our ancestors had been naive... Our main line of defense, the fort d'Ében-Émael, had been built by German workers. The German army had their plans, and knew the weak point of the fort: its vast, undefended roof (it was used as a football field by the soldiers). During a dark night, they landed with gliders on the roof, and manually set up shaped charges[1] to destroy the turrets, which were resistant to conventional bombs. Game over. [1] http://en.wikipedia.org/wiki/Shaped_charge http://en.wikipedia.org/wiki/Shaped_charge , damages seen from the outside: http://upload.wikimedia.org/wikipedia/commons/thumb/f/f6/Eben-Emael03.JPG/250px-Eben-Emael03.JPG http://upload.wikimedia.org/wikipedia/commons/thumb/f/f6/Ebe... -- Edited to reconcile my foggy memory with the historic truth...
- scoot 14y agoThey surrendered.
- Wicher 14y agoI was thinking of http://en.wikipedia.org/wiki/Funkspiel http://en.wikipedia.org/wiki/Funkspiel .
- debacle 14y agoThis is like finding out the zombies have made it into the compound. I wonder how big this hole is to fix. I also wonder, as many have, if this was written by an Intelligence agency and, if so, if they had access to Windows' source code.
- tobias3 14y agoMy Windows already fixed it. http://support.microsoft.com/kb/2718704 http://support.microsoft.com/kb/2718704
- Animus7 14y agoThe awesome part is how they force you to download an additional signed WGA validator exe before the site coughs up the patch, which itself is signed. If I was the attacker, I'd definitely be MITM'ing this page. Zombies in the compound indeed.
- exDM69 14y agoHow can you tell whether the fix was genuine? What if you were already infected by the Flame virus or similar that intercepts your Windows update traffic? I hope Microsoft can deliver the revoked certificates in a trustworthy manner.
- Achshar 14y agoThe idea of Microsoft willingly giving windows source code access to government does not make alot of sense. What could have however happened is that the said "Intelligence agency" first created a malware to infect MSFT engineers' computers and get access info of the code repository and then spoofing themselves as MSFT employees to download the source code. This is alot more plausible considering what stuxnet and flame can already do. (Assuming they were made by same "Intelligence agency") MSFT should really check the systems of their employees first.
- gaius 14y agoNah, anyone can get hold of Windows sources http://www.microsoft.com/en-us/sharedsource/default.aspx http://www.microsoft.com/en-us/sharedsource/default.aspx Microsoft licenses product source code to qualified customers, enterprises, governments, and partners for debugging and reference purposes Drop 'em an email if you're curious.
- MiguelHudnandez 14y agoHere we have an example of complexity arising from copy protection/licensing. It so happens that this complexity caused a security vulnerability which, when exploited on any one computer, affects close to a billion computers. Is anyone else infuriated that a vulnerability like this exists in what is analogous to copy protection code? In other words, if Microsoft had been spending more of their resources on making software work, instead of making software work only when you've proven you've paid for it, this particular issue would not exist.
- y0ghur7_xxx 14y agoThe same would happen on ubuntu if someone steals the repository keys. This has nothing to do with copy protection.
- dmboyd 14y agoWell... No, it'd be like if ubuntu required you to sign up to corporate licensing in order to use Ubuntu. Then handing out misconfigured keys to corporate customers which could also be used to sign repos as an unfortunate side effect.
- MiguelHudnandez 14y agoBut my point is that more teams needed access to signing keys because some of those teams were dedicated only to licensing issues. If they didn't need signing keys, those keys wouldn't have been compromised. I suppose I can break it down another way. Complexity introduces vulnerabilities. Some complexity is necessary for the software to accomplish what the customer wants. Some complexity is arguably necessary to protect the interests of the vendor. This is arguable because it varies between open source and proprietary software. To me, it is upsetting when the code to protect the vendor's interests is where a critical security vulnerability exists. I don't think this is a controversial statement.
- exDM69 14y ago> But my point is that more teams needed access to signing keys because some of those teams were dedicated only to licensing issues. If they didn't need signing keys, those keys wouldn't have been compromised. Cryptographically signed binaries are not used to manage licensing issues, they are used to make sure that no-one intercepts your download and replaces it with a malicious binary. It is absolutely essential that computer programs are signed or delivered through a secure connection. Losing your signing keys will make the entire system jeopardized and new keys must be generated and securely transmitted (this is hard). > To me, it is upsetting when the code to protect the vendor's interests is where a critical security vulnerability exists. Yes, that would be upsetting if it were true. But it isn't. The whole system is in place to protect you, the customer.
- Arare 14y agoOh look, another scaremongering and purposely misleading article from F-Secure. This is starting to become a regular thing isn't it; I guess the recession must have hit them particularly hard.
- bastardsage 14y agoI'm curious, could you please quote some of the points you thought were purposefully misleading in the article?
- Arare 14y agoAnd here come the shills, one or perhaps two at a time to defend the article from any critique. I'm afraid I've grown bored of this dance, entertaining as it may have been I've become listless.
- petitmiam 14y agoI guess I'll just remain scared and mislead then.
- bastardsage 14y agoI have no connection to the antivirus industry. It was meant to be a legitimate question. Please reconsider answering it.
- brazzy 14y agoyeah, shills. sure. no way you're getting downvoted for spreading FUD and then exolicitly refusing to back it up. Nope. Must be shills.
- sad_panda 14y agoThe dude's comment history is hilariously shilly.
- deleted 14y ago[deleted]
- DigitalSea 14y agoCue the sound of a thousand palms hitting faces at Microsoft HQ.
- meatsock 14y agolet this be a lesson to you: run windows update frequently for maximum security.
- ktizo 14y agoNow available with new and faster bugs.
- dholowiski 14y agoYou realize, you already have to be infected with the flame virus to work, right?
- caf 14y agoNo, you just have to be sharing a network with a host already infected with Flame.
- smackfu 14y agoApparently the other tricky bit is that Windows can be set to auto-configure network proxies (presumably for enterprise support), so the infected host pretends to be the source of auto-config info in order to direct the other systems to connect through it to get to Windows Update. At which point the infected system can infect the package, which has been signed so it will auto-install.
- semenko 14y agoThe SecureList summary was much more detailed: http://www.securelist.com/en/blog/208193558/Gadget_in_the_middle_Flame_malware_spreading_vector_identified http://www.securelist.com/en/blog/208193558/Gadget_in_the_mi... Flame took advantage of WPAD, a little-known magical hostname (http://en.wikipedia.org/wiki/Web_Proxy_Autodiscovery_Protocol http://en.wikipedia.org/wiki/Web_Proxy_Autodiscovery_Protoco...) to do MITM attacks on the Windows Update servers. Flame then installed 'WuSetupV.exe' with the description "Desktop Gadget Platform" "Allows you to display gadgets on your desktop". What's amazing is that Windows Update doesn't require explicit validation of an update-only certificate chain. It seems like any certificate from the Microsoft root can certify updates (!).
- sev 14y ago> I guess the good news is that this wasn't done by cyber criminals interested in financial benefit. They could have infected millions of computers. Instead, this technique has been used in targeted attacks, most likely launched by a Western intelligence agency. You mean the bad news.
- Achshar 14y agoThey apparently were only thinking of monetary losses, but a government malware on my computer is alot worse than credit card malware. At least we know what credit card malware can do at best (or worst).
- joewee 14y ago"Western Intelligence" agencies really seem to be good at mucking stuff up.
- billpg 14y agoI saw the headline and thought "Oh (expletive) I let update run last night!", but it turned out to be the revoked cert update.
- rsynnott 14y agoBut does it refuse to install the malware if it arbitrarily decides that your Windows is not genuine?