7 ms·
Windows 0-day was exploited by North Korea to install advanced rootkit
- graycat 2y agoBeen afraid of something like that: Mostly running Windows 7 Professional with latest patches from Microsoft. Had an HP Laptop with Windows 10 Home Edition where the hard disk failed. So, got another HP, with Windows 11 Home. I'm a traditional Windows user and am writing software in .NET, IIS, ASP.NET, SQL Server. My most important tools are Rexx for a scripting language and KEdit for my text editor. I don't want Windows to be more like a smartphone. Microsoft made a lot of changes from 10 to 11, and for my traditional usage made Windows too different to use. Bluntly I have to regard 11 as unacceptable for my traditional usage on 7 and 10 and am eager to replace 11 with 10. Sooooo, I'm ready to pull hair and scream trying to find a way to install a genuine, 100% authentic, dyed in the wool, DVD, SSD, SEO, whatever, I can use to install 10 on my new HP. HELP!!!!!
- lhamil64 2y agoI'm curious why you prefer Rexx as a scripting language on Windows over something like Python or even PowerShell. I use it quite a bit for work and find it pretty limiting. With a lack of built in libraries even some simple stuff like parsing JSON can be a huge pain.
- graycat 2y agoWhy Rexx? (A) Used it for decades. (B) The latest Object Oriented Rexx has some nice things, e.g., SysFileTree to get a nice file of all the names in a directory tree. (C) Yup, I agree that could use more tools and not have to roll my own. (D) Sure, looked at PowerShell: Looks like it has some nice powerful features but a, uh, goofy syntax -- intend to do more, maybe a lot more, with it. (E) Lots of people are taking Python seriously, and for more than just a scripting language, e.g., maybe all the software for a significant Web site. Intend to devote a weekend to Python. One little thing I did recently with Rexx was take an email message, all in just text, that had a Web page, as a MIME (multi-media Internet Mail Extensions or some such) Part, get the MIME part with the HTML, fix the email '=' characters used for splitting long lines, replaced some uses of special characters, and did get a Web page that Firefox would read. Worked? Yup. Elegant? Nope.
- PenguinCoder 2y agoDang, I'd like a copy of that script. Eml parsing, even with powershell and Exchange modules, is painful.
- wildzzz 2y agoHere's some good news: your license for Windows 11 is probably good for Windows 10 as well. Grab a Windows 10 install media from Microsoft and do a clean install on the drive. https://www.microsoft.com/en-us/software-download/windows10ISO https://www.microsoft.com/en-us/software-download/windows10I...
- jwrallie 2y agoStill there is only one year left of support if you do that.
- graycat 2y agoI still get "security updates" for Windows 7 Professional and am unsure what the lack of "support" might mean for my business.
- jborean93 2y agoExtended support ended in Jan 2020 and the paid ESU support ended in Jan 2023 [1]. Are you sure those updates aren't just defender/AV definition updates rather than actual OS updates? [1] - https://learn.microsoft.com/en-us/lifecycle/faq/extended-security-updates https://learn.microsoft.com/en-us/lifecycle/faq/extended-sec...
- graycat 2y agoPerhaps: "Defender" is what I've noticed.
- bravetraveler 2y agoAnti-virus definitions, not really exhaustive security maintenance. Defender is their AV. The firewall/kernel isn't included, for example How important that is, no idea! The firewall is probably passable but I generally don't know your risk profile. Applications and the rest of the system offer a lot of surface area
- giancarlostoro 2y agoI also do .NET but I went with Linux instead. Something Ubuntu based like POP OS or just plain any of the official Ubuntu flavors did the trick for me. Heck for fun I migrated a .NET 3.5 project thats been untouched for centuries all the way to the latest all on Linux, and it looks like it worked with barely any issues.
- graycat 2y agoVersions of Linux seem to have a lot of value and are real competition for all the versions of Windows. But I decided to concentrate on just one operating system and there picked Windows. Otherwise I want to concentrate on my needed software development, the inevitable system management, and, then most of all, the business itself. I'm guessing that, whatever frustrations, Windows will be able to support the computing for my business.
- giancarlostoro 2y agoI agree, I gave up on Windows since the deployment target for .NET services (web, etc) are now fully Linux, at least in my case. Linux is a known OS and there's thousands of experts. We can see under the covers and get a deep understanding. I highly recommend you install Linux on an older laptop and try it on your time off. As for package management, in terms of .NET its just nuget still, in terms of installing packages, there's UIs for them, but yeah you do need to sit down and read about it so you have some familiarity for when something goes wrong, which in the case of Ubuntu / Debian is only really the case if you're installing packages not maintained by them, Debian has insanely strict rules on what they consider stable, which means you get a slightly "dated" set of packages, but the confidence that your OS will not blow up out of the blue. What pushed me over the edge to Linux was Windows Defender sends files to Microsoft for analysis, but there's no audit trail for what those files are. It could be my PII for taxes, could be highly proprietary documents for my employer / company. I have no way to know what the heck their heuristics or whatever has seemingly found suspicious and uploaded.
- graycat 2y ago
- lewispollard 2y agoI used to work at the IBM lab where Rexx was created, funnily enough I've never heard of anyone using it in the wild!
- daghamm 2y agoWasn't the Amiga version pretty big back in the day?
- drsopp 2y agoYes, ARexx was big. A lot of popular software had an ARexx API so you could script across programs. Pretty awesome. I haven't seen anything like that since.
- graycat 2y ago"Wild"? I used to work at IBM!
- lewispollard 2y agoAha!
- graycat 2y agoAt Google, refreshed my memory: Mike Cowlishaw - Hursley
- jiggawatts 2y agoThe weird thing about rants like this is I tell customers that there are very few business-oriented new features in Windows 11 that justifies the upgrade, but there are quite a few developer-oriented features that are unique to it. Windows Terminal is a nice example, but proper support for Windows Containers is huge. It was “technically possible” to containerise workloads on Windows 10 but you had to maintain the exact same patch level as the server OS the containers would run on! Windows 11 removed this restriction. There’s also Dev Drive and a bunch of other small things like HTTP/3 and TLS 1.3 support and whatnot. At $dayjob I have to hold the hand of helpless devs mired in corporate miasma complete with out-of-date Windows 10 desktops. I regularly have the issue of trying to show them something and failing because I forgot I have Windows 11 and they don’t.
- isomorphic- 2y agoWindows Terminal is not unique to Windows 11. You can install it on Windows 10. As for containers, you can install Docker or Podman or some other container infrastructure. The Windows versions of them have hooks into the Windows OS too. TLS 1.3 can be enabled in Windows 10 by toggling a registry key.
- jareklupinski 2y ago> Sooooo, I'm ready to pull hair and scream trying to find a way to install a genuine, 100% authentic, dyed in the wool, DVD, SSD, SEO, whatever, I can use to install 10 on my new HP. there's a windows 10 build called "LTSC" that cuts out all the "Windows-as-a-Service" products you still have to run a few debloat/service uninstall powershell scripts after reinstalling, but it's honestly the only thing keeping me from going full linux
- shepherdjerred 2y agoThere’s a similar build for Windows 11
- MaxikCZ 2y agoIts funny how Microsoft basically hides it from the world, and if you happen to know about it, you still cant buy a single licence to run on your personal PC.
- petepete 2y agoIf they marketed it every enthusiast/pro/gamer would buy it and it'd make their default offering look like some kind of economy version.
- deleted 2y ago[deleted]
- aaron695 2y ago[dead]
- katbyte 2y agoMsdn should still have isos. I still have my installer archive from 98 till 10 thou as my windows machine is a vm it just exists. I have a backup from just after a fresh install I can restore a new machine from if I need be
- isomorphic- 2y agoRunning an end-of-service OS such as Windows 7 means it's very likely that there are plenty of unpatchable zero-days for it. Being forced to upgrade probably made you safer and reduced your attack surface. I completely agree with you about Windows 11's unusability. However, Windows 10 will be end-of-service in a year and that really sucks. I have been clinging to Windows 10 and I do not look forward to being forced to upgrade. But it's better than having a system that no longer has security updates and has tons of nation states looking for/already hoarding zero-days.
- hulitu 2y ago> Running an end-of-service OS such as Windows 7 means it's very likely that there are plenty of unpatchable zero-days for it. Being forced to upgrade probably made you safer and reduced your attack surface. What makes you think that ? People usually target the latest Windows version.
- blackoil 2y agoRejoice in fact, No one will be wasting 0 day on you.
- giantg2 2y agoBut it doesn't have to be a zero day if it's never getting patched at this point. It could be a 400 day that acts like a zero day - even more dangerous due to the potential for more threat actors to know about it and using the exploit doesn't burn it.
- pathartl 2y agoI'd honestly give 11 a valid shot, probably with 11 Pro. It's by far my favorite version of the OS over the years, and I've been a user since 3.11 days. These days, Windows 10 feels old to me. It does take a bit of customization on first start (I like to align left, disable search, tasks button, copilot, etc), but it's been by far the most stable and consistent Windows I've used since probably 7.
- southernplaces7 2y agomassgrave.dev
- hulitu 2y ago> Windows 0-day was exploited by North Korea to install advanced rootkit Only by North Korea ? /s
- ec109685 2y agoSomebody is going to make billions on an AI that can transpile vulnerable code into Rust. Unacceptable to have so much non provably safe code exploitable like this.
- xeonmc 2y agotranspile to rust with the original vulnerabilities intact?
- ec109685 2y agoObviously not. With enough resources, engineers could do it, and it’s a constrained enough problem that AI likely could do so as well eventually.
- quohort 2y agothe purpose of having engineers write software is that they can transparently prove that it works reliably, and they can be professionally held accountable and learn if it fails. You're suggesting that reliability should be improved by being obfuscating the code through transpilation or by merit of being generated by a black box (LLM). I really suspect that simply transpiling code to rust or ada or some other "safe" language largely wouldn't improve its security. The whole point of these "safe" languages is that they encourage safer practices by design, and that in porting the code to rust you have to restructure the program to conform to the new practices (as opposed to just directly re-implementing it). I haven't seen a LLM that is reliably capable of logic/reasoning or can even reliably answer technical questions, much less synthesize source code that isn't some trivial modification of something it has been trained on. And it's not clear that future models will necessarily be capable of doing that.
- Ygg2 2y agoIt will depend on use case. Remember that adage. Make it work, make it right, make it fast (in that order). So first pass yes. Then you make refactor and see if tests are green. Rinse and repeat.
- 2y ago
- feverzsj 2y agoIt's more like China is behind this.
- tsujamin 2y agoBased on capability, it getting caught, or just abstract vibes and speculation?
- iJohnDoe 2y agoNK and China work very closely together on their hacking efforts. North Korean’s go to China for training.
- MaxikCZ 2y agoOkay, and apart from "two advesary countries collaborating on what the rest of the world is doing", is your claim (or support of) of China being involved in this specific case based on capability, it getting caught, or just abstract vibes and speculation?
- iJohnDoe 2y agoFTA > There are also no indicators of compromise. I find it fascinating they are able to detect these things and report them to Microsoft. The security companies obviously have to be on the endpoints to see any of this. However, it doesn’t seem like this depth of detection extends to protecting customers.
- magicalhippo 2y agoIf you control the network, you could observe a machine behaving in a compromised manner, without being able to find anything while accessing the compromised machine itself.
- Smaug123 2y agoDoesn't have an entry on https://xeiaso.net/shitposts/no-way-to-prevent-this/ https://xeiaso.net/shitposts/no-way-to-prevent-this/ yet, but give @xena time…
- francispauli 2y agoDid i miss anything skimming the article. How would a target get infected
- vorticalbox 2y agoWell the cve noted in the article requires local access so either stacking exploits, having access to the machine or dropping usbs and hoping someone plugs it in.
- Macha 2y agoNote there's also a exploit to gain local access via malformed incoming ipv6 packets fixed in the same patch set
- notinmykernel 2y agoI'm assuming the executives will be receiving a pay decrease and reduced stock options due to their poor performance[1]. [1]https://arstechnica.com/information-technology/2024/05/microsoft-ties-executive-pay-to-security-following-multiple-failures-and-breaches/ https://arstechnica.com/information-technology/2024/05/micro...
- deleted 2y ago[deleted]
- aussieguy1234 2y agoAlot of people think the North Koreans dont have internet, or have very slow internet. Not true. A privileged few have very fast internet access via fibre cable from China. And they have cyber offensive teams that do attacks like this.
- BSDobelix 2y agoAnd South Korea has cyber offensive ISP-teams toward it's customers ;)
- alephnerd 2y agoIt's not that hard to train people in offensive and defensive security ops - it just takes effort and commitment. When I was working for a Vendor, we'd often train Jarheads, Squids, etc in IOW MOSes technolgies and techniques for offensive and defensive capabilities. Most other regional powers have built out a similar talent pipeline - it's very doable now that computing has diffused globally. Heck, LE in plenty of countries now has capabilities comparable to the Five Eyes circa 10-15 years ago.
- cj 2y agoVendor = Lockheed Martin or similar (?) Jarheads = Marines Squids = Navy IOW = Information Operations Warfare MOS = Military Occupational Specialties LE = Law Enforcement "Five Eyes circa 10-15 years ago" = PRISM, XKeyscore, Tempora, MUSCULAR, STATEROOM
- giantg2 2y agoExcept most branches are having an extremely difficult time filling those roles. They're even considering things as drastic as bringing civilians into those roles at an O5 grade. Pretty desperate.
- alephnerd 2y ago> Except most branches are having an extremely difficult time filling those roles Most of the issues with recruitment tend to be less skilled MOSes like Infantry. IOW, Intel, and Cyber MOSes are given a fast track to NCO and very good post-military careers, along with a decent entry pipeline via ROTC or Training Schools for enlistees like JCAC. Most vendors and large tech companies (eg. GCP, MS Azure and Security, PANW, Cisco, AWS, etc) will often hire ex-Intel and Cyber trainees in lieu of a bachelors degree, so it's often a very affordable path to high paying tech jobs (Sales Engineering, Systems Engineering, Support Engineering, etc). > bringing civilians into those roles at an O5 grade Pardon my French, but that's bullshit. Only the newly created Cyber Warfare Officer in the Marines is at O-5 (largely due to budget and staffing issues w/ the Marines because it's competing for the same pot of money as the Navy), and they have to go through Officer Training School in VA. Most entry level cyber roles are WO level (primarily W-1) or E1-3 if you are going to JCAC at NIOC Pensacola, and most Cybersecurity work was historically done by the Navy because Sigint was historically under the Navy, as all the IT and Cyber MOSes would get trained at NIOC Pensacola (none of this is classified btw) IOW and Cyber are desk jobs - doing the whole shebang of military training is unnecessary, and competitors like China, Russia, etc exempt their equivalents in these MOSes from bootcamp, and they tend to require a degree or a civilian career for those same roles as well. Also, these roles tend to require at minimum an Associates degree in Computers/Networking/IT, so plenty of grunts do upskill and get that via online programs like the AFIT, AMU, etc and then upskill after a couple years via Grants or get hired as Sales or Field Engineers at vendors.
- ThinkBeat 2y agoThe article is 90% standard template for such events in the media. Which has lot of filler. The attribution to North Korea, which was after all the headline does not appear substantiated in the information given.