Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers exploited Word flaw for months while Microsoft investigated

reuters.com

Post reply on HN
Print view View original

91–100 of 105 posts

Re: Hackers exploited Word flaw for months while Microsoft investigated

#91

Post by repples »

HappyTypist wrote: post #36
HenryBemis wrote: post #20

I thought that it is the norm for M$ to hand out the zero-days to the 3-letter-agencies for "a while" and patches them ONLY when someone else gets hold and starts using the same vuln.. so it makes PERFECT sense that they would do something like that. Also who in their right mind allow Word/Excel/Powerpoint to access the internet? (oh yes it's called "365" and it makes software, that is completely unfit for the task,…

Not sure why you're being downvoted. This is literally the company that built in "_NSAKEY" into the kernel, which is still present (just called "_KEY2" now.

If "_key2" is an public key embedded within Windows, then presumably there exists one or more holders of the private key somewhere - what exactly are they able to do with this key?

I've seen a lot of concern about "_key2" and "_NSAKEY" being expressed over the years, but scant technical detail.

Re: Hackers exploited Word flaw for months while Microsoft investigated

#92

Post by bitexploder »

scarybeast wrote: post #85
bitexploder wrote: post #47

This is why what McAfee did is ok. It was already being exploited. This got it patched and let Corp IT roll out a settings change to fix it immediately. Google's 90 day policy from its team is also sane. Letting bad bugs live on in the dark after submitting to a vendor is clearly more dangerous for everyone.

FWIW, I'll note that Google has a 7 day policy for issues that are believed to be under active exploitation.

Thanks, I didn't know that. I really appreciate the work you and others do/did at project zero, btw. It is hard to understate the impact it has had on changing people's minds about disclosure (anecdotally of course).

Re: Hackers exploited Word flaw for months while Microsoft investigated

#93

Post by bitexploder »

flukus wrote: post #67
bitexploder wrote: post #48

Earlier quoted context omitted.

Ubuntu 16.04 or Fedora are likely to work better than 17.04. Regardless there is still hardware that does not have the best compatibility. Ubuntu does handle individual high DPI displays well though.

I've got the new line of radeon graphics card. 16.04 only supported some It was quite frustrating to read about ATI's new open source drivers, purchase that hardware explicitly because of that and still have it not work, but it's nice that it's improved so much too.

Ahh... yeah it is still easy to fall in the cracks. When you get a good system and everything works it is beautiful, when it doesn't, you will be spending quality time with kernel parameters and resources like the Arch Linux wiki. I had a miserable time troubleshooting i915 on my Dell XPS 13" (latest edition). Very frustrating to have an officially supported Dell laptop with Ubuntu that doesn't even work right out of the box.

Re: Hackers exploited Word flaw for months while Microsoft investigated

#94

Post by davidgerard »

jmcdiesel wrote: post #90
davidgerard wrote: post #62

Earlier quoted context omitted.

> But linux wasn't made to be easy to use, to be quick and easy to install, to install other software onto, etc... You can only say that in comparison to Windows if you haven't tried installing both any time in the past 15 years.

I have installed both multiple times recently... Linus is NOT as easy to install software into, its a different process for different distros... if what you want isnt in the repo of your choice you have to add repos (because politics matter in software apparently)... lets not even talk GPU driver issues... I work on linux and mac, and I play on windows. Im familiar with all 3 environments (including various distros f…

Windows : Not Ready For The Desktop

https://andrewhickey.info/2012/04/07/windows-not-ready-for-t...

Most Windows users never install Windows.

Re: Hackers exploited Word flaw for months while Microsoft investigated

#95

Post by dvtv75 »

interfixus wrote: post #16
jmcdiesel wrote: post #3

Earlier quoted context omitted.

Their users don't need to be allowed to freely evaluate the source, period. When you write software, you control its distribution. What the users are free to do, however, is use an operating system/stack that they CAN evaluate the source of. If linux or any other open source alternative was a better actual product, it would find its way to the top of the market. In fact, it already has, on the server... by far. But l…

"But linux wasn't made to be easy to use, to be quick and easy to install, to install other software onto, etc" For what it's worth (which may be not a great deal): I have installed a lot of Windows and Linux over the years, but my Windows experience has been lackin further and further behind these last few years. A short while ago, I had to a rare chance of setting up two identical machines side by side, one with Wi…

A couple of years back, I installed Windows Vista on a Lenovo something (no idea what). Took me three days to find most of the drivers and get it all running, and about an hour to do the actual install. I ran it for a few weeks, then the software I was using had a Linux release, so I threw on Kubuntu (15.04 I think it was). Took me no effort to get drivers, as everything (bar the ancient Geforce 3D drivers) just worked out of the box. The system prompted me to install the 3D drivers, and I was done in under an hour.

Windows Licensing had a funny issue, though - I typed the number in, it rejected it, so I typed it in again, verified every character, it rejected it, typed it in a third time, it accepted it. Installed, booted up, and then it told me that I didn't have a genuine Vista (although the sticker on the system was genuine). I used it for a bit, intending to fix it later, and then one day it popped up telling me I needed to activate the system with a genuine number, which it did without asking for a new one, told me happy things and enjoy my Windows experience.

It's enough to drive you to drink...

Re: Hackers exploited Word flaw for months while Microsoft investigated

#96

Post by qplex »

to3m wrote: post #51
flukus wrote: post #23

Earlier quoted context omitted.

Ubuntu 17.04. Is that recent enough for you? I've tried antergos, red hat and a couple of others, all with similar issues. Many I didn't get far with because I simply couldn't read the login screen. Antergos doesn't even have user switching working out of the box but it was the only one that supported my graphics card until very recently. I used the gnome variant of each.

This has always been my experience too. I've installed Linux irregularly numerous times over the years and it's never worked 100% properly on any PC I've tried it on. It suffers I guess from having to run on the same wide range of hardware as Windows does, but with a testing and driver development budget of around 50p and some bits of fluff... still, when it doesn't work, it's my time that gets sucked up trying to fi…

So if your machine/os/whatever does not run properly you might either fix it yourself or pay somebody else to fix it.

But really, no need to complain about the nice things that you got for free.

Re: Hackers exploited Word flaw for months while Microsoft investigated

#97

Post by jmcdiesel »

davidgerard wrote: post #94
jmcdiesel wrote: post #90

Earlier quoted context omitted.

I have installed both multiple times recently... Linus is NOT as easy to install software into, its a different process for different distros... if what you want isnt in the repo of your choice you have to add repos (because politics matter in software apparently)... lets not even talk GPU driver issues... I work on linux and mac, and I play on windows. Im familiar with all 3 environments (including various distros f…

Windows : Not Ready For The Desktop https://andrewhickey.info/2012/04/07/windows-not-ready-for-t... Most Windows users never install Windows.

No, they chose to buy a computer with windows on it...

And an article starts with complaining that its not free (money) and not open source - it makes it very clear the level of bias right off the bat.

Re: Hackers exploited Word flaw for months while Microsoft investigated

#98

Post by goodplay »

kobeya wrote: post #88
goodplay wrote: post #63

Earlier quoted context omitted.

>Or for [buggy] software not to get written in the first place. FTFY We place too much trust and rely too much on computer systems these days to have the luxury to write software like we used to.

No don't twist my words. I meant I'm sure as hell not inventing something new if it sets me up for civil liabilities. It would kill innovation.

> meant I'm sure as hell not inventing something new if it sets me up for civil liabilities.

And I'm arguing that not doing so might be a good thing. I shudder to think how we'd be off if other infrastructure disciplines took the same approach we take to develop software.

If you build something that people use in important infrastructure, prepare to be on the hook if it fails.

Re: Hackers exploited Word flaw for months while Microsoft investigated

#99

Post by kobeya »

goodplay wrote: post #98
kobeya wrote: post #88

Earlier quoted context omitted.

No don't twist my words. I meant I'm sure as hell not inventing something new if it sets me up for civil liabilities. It would kill innovation.

> meant I'm sure as hell not inventing something new if it sets me up for civil liabilities. And I'm arguing that not doing so might be a good thing. I shudder to think how we'd be off if other infrastructure disciplines took the same approach we take to develop software. If you build something that people use in important infrastructure, prepare to be on the hook if it fails.

So if you write some toy PID controller for your kids LEGO project and post it to stack overflow, should you be held liable for all the places it is used?

Re: Hackers exploited Word flaw for months while Microsoft investigated

#100

Post by jokoon »

Even though there is a lot of work in computer security, those stories really scare me and I wonder if I would dare working in this field. I wonder if hackers already lost their life due to their work in computer security, and I would not like to fall in the crosshair of russia right now.
Post reply on HN