4 ms·

Probably because the risk low, and it would require a good deal of work to maintain such a database. You'd have to keep it updated after every patch, a system m

Probably because the risk low, and it would require a good deal of work to maintain such a database. You'd have to keep it updated after every patch, a system may get a different version of the patch based on what is installed on the OS etc.

acqq 13y ago
Not much more work than any decent administrator has to do if he controls the updates to his own network. Note that even if you don't have in the database "all files ever" every entry lessens your chances of false positives. Actually I can't imagine that they can do their business while not having such databases.
Scaevolus 13y ago
Having a version for every patch would be difficult, but the base level of {XP,Vista,7,8}{32-bit,64-bit}{RTM,SP1,SP2,...} should safeguard the majority of your users.
- acqq 13y ago
  And it's almost trivial to add new entries after each update. I can't imagine they don't have it, but I can imagine that they didn't use it this time ("check takes too much time, let's just ship it").
- greenyoda 13y ago
  I'd guess that the majority of users have automatic Windows Update turned on, since that's the default setting and what Microsoft recommends. The only people who have the base level of Microsoft operating systems (or don't apply patches between service packs) are the ones who are so clueless about security that they're not likely to have gone out of their way to install a third-party anti-virus tool. If they assume that most users apply all "critical" Windows updates in the order that they're pushed, the anti-virus vendor could snapshot their reference PCs before each update and record the hashes of all Windows files. It's possible to determine which updates have already been installed on a machine (there's an option for this in the control panel, and the information is probably stored in the registry).
acdha 13y ago
This has happened multiple times to multiple vendors – so it's not clear that the risk is actually low and the resulting database is also useful for catching malware which attempts to replace system files. As for different versions, it doesn't seem like this should be a significant challenge to an organization which already has to maintain a test OS farm. The process of updating after a release is mostly automatic and if this acted solely as a guard against false positives, the consequences of missing a patch permutation are the current status quo.

acqq 13y ago

Not much more work than any decent administrator has to do if he controls the updates to his own network. Note that even if you don't have in the database "all files ever" every entry lessens your chances of false positives. Actually I can't imagine that they can do their business while not having such databases.

Scaevolus 13y ago

Having a version for every patch would be difficult, but the base level of {XP,Vista,7,8}{32-bit,64-bit}{RTM,SP1,SP2,...} should safeguard the majority of your users.

acqq 13y ago
And it's almost trivial to add new entries after each update. I can't imagine they don't have it, but I can imagine that they didn't use it this time ("check takes too much time, let's just ship it").
greenyoda 13y ago
I'd guess that the majority of users have automatic Windows Update turned on, since that's the default setting and what Microsoft recommends. The only people who have the base level of Microsoft operating systems (or don't apply patches between service packs) are the ones who are so clueless about security that they're not likely to have gone out of their way to install a third-party anti-virus tool. If they assume that most users apply all "critical" Windows updates in the order that they're pushed, the anti-virus vendor could snapshot their reference PCs before each update and record the hashes of all Windows files. It's possible to determine which updates have already been installed on a machine (there's an option for this in the control panel, and the information is probably stored in the registry).

acdha 13y ago

This has happened multiple times to multiple vendors – so it's not clear that the risk is actually low and the resulting database is also useful for catching malware which attempts to replace system files. As for different versions, it doesn't seem like this should be a significant challenge to an organization which already has to maintain a test OS farm. The process of updating after a release is mostly automatic and if this acted solely as a guard against false positives, the consequences of missing a patch permutation are the current status quo.