Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers exploited Word flaw for months while Microsoft investigated

reuters.com

Post reply on HN
Print view View original

51–60 of 105 posts

Re: Hackers exploited Word flaw for months while Microsoft investigated

#51

Post by to3m »

flukus wrote: post #23
voidz wrote: post #19

Earlier quoted context omitted.

Pure nonsense. Or did you try a distribution from 2002?

Ubuntu 17.04. Is that recent enough for you? I've tried antergos, red hat and a couple of others, all with similar issues. Many I didn't get far with because I simply couldn't read the login screen. Antergos doesn't even have user switching working out of the box but it was the only one that supported my graphics card until very recently. I used the gnome variant of each.

This has always been my experience too. I've installed Linux irregularly numerous times over the years and it's never worked 100% properly on any PC I've tried it on. It suffers I guess from having to run on the same wide range of hardware as Windows does, but with a testing and driver development budget of around 50p and some bits of fluff... still, when it doesn't work, it's my time that gets sucked up trying to fix it, and I'm unapologetic about being unhappy about it.

Things are improving compared to the past, though, because my latest install (Ubuntu 16.04 on my desktop PC) required minimal setup effort and only suffers from these problems:

1. volume control keeps popping up for no reason, and the sound stutters each time that happens

2. using 2 x NVidia GPUs disables XRandR, so some things don't work when I've got a 3-monitor setup

3. for reasons unknown, I can't get 2560x1440 on my 27" monitor (yes, I know, you can change the timings using XRandR...)

4. any time I click and drag in Firefox, Firefox crashes instantly

5. something crashes on startup on every boot (and, yes, I dutifully submit the autogenerated bug report)

However LAN+wifi+3D work, and audio has proven sufficient for basic testing. Things could have been a lot worse.

(Somebody on reddit told me "You have broken hardware or you're too incompetent and shouldn't be anywhere near any computer whatsoever". Well, everything runs fine in Windows... so, ouch.)

Re: Hackers exploited Word flaw for months while Microsoft investigated

#52

Post by kobeya »

aurelianito wrote: post #49
throwanem wrote: post #37

Earlier quoted context omitted.

So, turn a nontrivial set of vulns into successful DoS attacks?

Yes. That, in turn, will give the economic incentive to not have the vulnerabilities in the first place.

Or for software not to get written in the first place.

Re: Hackers exploited Word flaw for months while Microsoft investigated

#53

Post by shakna »

flukus wrote: post #43
shakna wrote: post #34

Earlier quoted context omitted.

> Can't change login screen resolution (haven't seen a way to do this on any distro I've tried). Really? You mention in another thread, you used Ubuntu. So you apparently didn't notice this [0] or this [1]? The issue with this and complexity, is that login screen resolution is often handled by GRUB, not Linux. Edit: In future you can drop into a commandline via Ctrl+Alt+F1 > Secondary drives require manual mounting (…

> Really? You mention in another thread, you used Ubuntu. So you apparently didn't notice this [0] or this [1]? Neither of those solutions are user friendly are they?. You think an average person knows what grub is? I did come across the second one actually, but I have no idea if the solution is still relevant or not. I haven't seen anything to indicate what login manager I'm even running, where is this information d…

> Neither of those solutions are user friendly are they?

Neither is Windows. [0]

Changing a login screen is a bit of a technical thing, for technical reasons. Maybe it could be better, but at the moment, everyone sucks equally.

> I haven't seen anything to indicate what login manager I'm even running, where is this information displayed?

Most distros use systemd nowadays, so this is something that is becoming easier:

    cat /etc/systemd/system/display-manager.service | grep '/usr/bin'
Otherwise, it can vary system to system. Because things are very customisable.

> But if I log in and start up steam all the games are missing. If I navigate to the drive through the file manager and then start steam then it will find them properly.

The sure-fire fix for this is fstab, but that is a bit technical, I'll admit. I don't mind it much, because Windows can't mount my Linux drive, and OS X can have mounting issues as well when confronted with partitions it doesn't know.

I'm guessing the partition type is NTFS, so try ntfs-config.

[0] https://social.technet.microsoft.com/Forums/windows/en-US/ff...

Re: Hackers exploited Word flaw for months while Microsoft investigated

#54

Post by dahauns »

interfixus wrote: post #16
jmcdiesel wrote: post #3

Earlier quoted context omitted.

Their users don't need to be allowed to freely evaluate the source, period. When you write software, you control its distribution. What the users are free to do, however, is use an operating system/stack that they CAN evaluate the source of. If linux or any other open source alternative was a better actual product, it would find its way to the top of the market. In fact, it already has, on the server... by far. But l…

"But linux wasn't made to be easy to use, to be quick and easy to install, to install other software onto, etc" For what it's worth (which may be not a great deal): I have installed a lot of Windows and Linux over the years, but my Windows experience has been lackin further and further behind these last few years. A short while ago, I had to a rare chance of setting up two identical machines side by side, one with Wi…

You needed twenty minues for

  choco install latexdistofchoice
?

(Yeah, I know, I'm being a bit facetious. I omitted three additional lines of PS to first install chocolatey...)

Re: Hackers exploited Word flaw for months while Microsoft investigated

#55

Post by grub5000 »

bitexploder wrote: post #47

This is why what McAfee did is ok. It was already being exploited. This got it patched and let Corp IT roll out a settings change to fix it immediately. Google's 90 day policy from its team is also sane. Letting bad bugs live on in the dark after submitting to a vendor is clearly more dangerous for everyone.

Not really, according to the article the sequence of events went

* Microsoft warned in March of active attacks

* Microsoft schedules patch for April 11th

* McAfee sees attacks on April 6th

* McAfee publicly explains how to use the exploit on April 7th

* April 9th attack-kits are publicly for sale

* April 11th Microsoft releases public patch as scheduled

McAfee fucked up here.

Re: Hackers exploited Word flaw for months while Microsoft investigated

#56

Post by teh_klev »

yitchelle wrote: post #46

"A quick change in the settings on Word by customers would do the trick, but if Microsoft notified customers about the bug and the recommended changes, it would also be telling hackers about how to break in." In their monthly update, couldn't Microsoft have released a patch to have this setting to the correct configuration? Of course this would only be the short term solution, rather than waiting for 9 months for the…

I guess the reason is that by studying the patch, even a short term workaround such as this, you can deduce what the vulnerability is and quickly knock out a working exploit. I'm not suggesting that security-through-obscurity was the correct choice by MS, or the time taken to build a comprehensive fix was acceptable, but from the article it seems that this has been a bit of a gnarly issue to solve properly and even a cursory fix might reveal deeper seated issues.

I'm not defending MS here, but I imagine that Word's codebase is a helluva pile of cards to work on. Especially given that it can still open document formats such as WordPerfect 5 which date back to 1988. Add in all the legacy OLE automation stuff, a VBA environment and all those shims and backwards compatibility things that MS are known for (see Old New Thing blog) that translates as "One Does Not Simply Patch Word".

Re: Hackers exploited Word flaw for months while Microsoft investigated

#57

Post by [deleted] »

HappyTypist wrote: post #35

We need civil penalties for failing to patch any serious vulnerability (that can be defined as RCE, priv. escalation, etc) within 30 days of disclosure. If you can't patch it, you must issue a patch that announces the vuln and disables the minimal set of functionality that enables it. Even if that's the whole program.

[deleted]

Re: Hackers exploited Word flaw for months while Microsoft investigated

#58

Post by grub5000 »

scarybeast wrote: post #5

And _this_, ladies and gentlemen, is why we have disclosure deadlines for security vulnerabilities. For example, Project Zero expects vendors to fix security vulnerabilities within 90 days of notification. Looking at this story, it's possible that 90 days is almost too long and should be shortened. As time goes on, it's becoming more and more common for multiple parties to become aware of the same vulnerabilities. No…

It says it right in the article:

> "We performed an investigation to identify other potentially similar methods and ensure that our fix addresses [sic] more than just the issue reported," Microsoft said through a spokesman, who answered emailed

If MS had immediately patched CVE-2017-0199, only for someone to reverse the patch, discover an identical exploit somewhere else in the code and commence immediate abuse, people would crucify Microsoft.

From the article, it seems clear that Microsoft scheduled a public release of the patch as soon as it became clear it was being publicly exploited.

Re: Hackers exploited Word flaw for months while Microsoft investigated

#59

Post by jaredklewis »

HappyTypist wrote: post #35

We need civil penalties for failing to patch any serious vulnerability (that can be defined as RCE, priv. escalation, etc) within 30 days of disclosure. If you can't patch it, you must issue a patch that announces the vuln and disables the minimal set of functionality that enables it. Even if that's the whole program.

I don't the think we need this. It follows the strategy of "just create one rule and penalty for everything bad that can be done." The result is more regulations than can ever be learned, except by total specialists that devote their entire career to compliance in one particular area, huge enforcement costs, and typical government incompetence (we have clean water regulations, doesn't stop them from being broken constantly).

IMHO, a better solution is to create legislation that forces software to be sold and distributed under a set of public, common terms.

If the rest of the market worked the way software does, everytime you went into a restaurant, bought a book, or used a photocopier you first would sign a long contract freeing that business of any liability whatsoever.

If I go to a restaurant and the Food poisoning kills my family, I can sue them. If I buy a book at the store, the store cannot mandate that I not read the book on Sunday. If you buy the book on Amazon Kindle, they are free to stipulate pretty much anything.

If software and digital products were sold with universal, reasonable terms, companies and individuals that were damaged by grossly negligent behavior could sue and have those damages repaid to them. This incentivizes companies to behave better. It is also more general purpose. We don't have to add one new regulation for every way a company can possibly be grossly negligent.

Re: Hackers exploited Word flaw for months while Microsoft investigated

#60

Post by rando444 »

grub5000 wrote: post #55
bitexploder wrote: post #47

This is why what McAfee did is ok. It was already being exploited. This got it patched and let Corp IT roll out a settings change to fix it immediately. Google's 90 day policy from its team is also sane. Letting bad bugs live on in the dark after submitting to a vendor is clearly more dangerous for everyone.

Not really, according to the article the sequence of events went * Microsoft warned in March of active attacks * Microsoft schedules patch for April 11th * McAfee sees attacks on April 6th * McAfee publicly explains how to use the exploit on April 7th * April 9th attack-kits are publicly for sale * April 11th Microsoft releases public patch as scheduled McAfee fucked up here.

Microsoft was formally notified of the vulnerability in October 2016. Why leave this out of the timeline?

The researcher that found the vulnerability first noticed it in July 2016. Between July and October he had gathered even more information about the vulnerability, presumably in his interest to demonstrate how serious the matter is, as well as a likely attempt to procure as large a bug bounty as possible.

If Microsoft was presented with such a serious vulnerability and didn't address it properly for over half a year, I would say that they are the owners of the lion's share of the responsibility here.

Post reply on HN