Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security Update for Microsoft Malware Protection Engine

technet.microsoft.com

Post reply on HN
Print view View original

71–80 of 85 posts

Re: Security Update for Microsoft Malware Protection Engine

#71

Post by mikhailt »

syshum wrote: post #50
mikhailt wrote: post #24

Earlier quoted context omitted.

There are many sides to this and you're generalizing it to people not understanding the full value of security disclosure is misleading. I can assure you a lot of those people fully understand the value of security disclosures and they are for it. What many people have the problem with, is with Tavis' tone and his approach to announcing his findings. No reasonable security researchers find a bug, announce it first to…

As a supporter of Full Disclosure I believe it is irresponsible to follow the so called "Responsible" disclosure model. I dont believe it is "responsible" to leave people exposed for 90+ days while the vendor attempts to whitewash and cover up their vulnerabilities as it so often the case. While some software vendors might respond the vulnerabilities properly, most do not often wanting to blame shit, or even file leg…

It depends on the situation but I agree with the better name for this, coordinated disclosure.

If the vendor refuses to do anything, then yes, the 90 days should be waived.

I'm not saying we shouldn't disclose at all, I'm saying the vendors have the right to have the info first and react before the said announcements start.

Re: Security Update for Microsoft Malware Protection Engine

#72

Post by mikeash »

mikhailt wrote: post #70
mikeash wrote: post #27

Earlier quoted context omitted.

What's wrong with an announcement like this? With literally no details, it's not helping bad guys (or, for that matter, good guys). I can see an argument that it's unprofessional to call out a company when you need them on your side. But is anyone making that argument? All the negative replies I saw to that tweet, for example, are along the lines of "omg you ruined my weekend why couldn't you wait until Monday?"

Not this tweet specifically, look at the tweets he did in the past where he did point out the names such as LastPass and 1Password. It caused some folks to contact these vendors for more information where they don't have any yet at the time of the tweets. Like this one: https://mobile.twitter.com/taviso/status/760231214812844032 Or https://mobile.twitter.com/taviso/status/845717082717114368

How is that different from pointing out a name like Microsoft? Either way, it might be uncouth, but I don't see the connection to responsible disclosure.

Re: Security Update for Microsoft Malware Protection Engine

#73

Post by mikhailt »

mikeash wrote: post #72
mikhailt wrote: post #70

Earlier quoted context omitted.

Not this tweet specifically, look at the tweets he did in the past where he did point out the names such as LastPass and 1Password. It caused some folks to contact these vendors for more information where they don't have any yet at the time of the tweets. Like this one: https://mobile.twitter.com/taviso/status/760231214812844032 Or https://mobile.twitter.com/taviso/status/845717082717114368

How is that different from pointing out a name like Microsoft? Either way, it might be uncouth, but I don't see the connection to responsible disclosure.

It's not me that is having a problem with this, I'm just pointing out why some people are having problems with Tavis in general.

You don't think it is reasonable to at least tell a vendor there is a security problem first before telling the rest of the world?

Maybe responsible disclosure is the wrong name for this, I like the coordinated disclosure idea better.

Maybe I am using the wrong terms but I cannot edit my post anymore.

Re: Security Update for Microsoft Malware Protection Engine

#74

Post by JonathonW »

user5994461 wrote: post #56
olig15 wrote: post #7

> Mr Cluley did add, however, that he thought the Project Zero protocol for announcing the vulnerability - which had included information that malicious hackers might have found useful - had been risky. > "That can help the bad guys," he said. This is just plain wrong, isn't it? I was under the impression that all of the details on PZ are hidden until either a fix is released, or 90 days have passed. I don't see how…

The disclosure is irresponsible. The post published today contains information on how to exploit the bug with a working code for POC, confirmed to work. The windows patch is published today. It's gonna take weeks to propagate to the windows computers around the world.

Windows Defender updates (malware definitions and engine updates) don't run on the same schedule as other Windows updates-- they're downloaded at least three times daily, and installed immediately once they're downloaded.

IIRC, they're also not disabled by the UI switch that disables other Windows updates. A user would have to go pretty far out of their way in mucking around with things that shouldn't be mucked around with in order for this update to take "weeks" to propagate to them.

Re: Security Update for Microsoft Malware Protection Engine

#75

Post by nailer »

dsp1234 wrote: post #66
nailer wrote: post #15

Earlier quoted context omitted.

Hrm. Microsoft article says: > For more information on how to verify the version number for the Microsoft Malware Protection Engine that your software is currently using, see the section, "Verifying Update Installation", in Microsoft Knowledge Base Article 2510781. But the link points to https://technet.microsoft.com/en-us/library/security/4022344 which doesn't include Windows 10. Edit: guessed and found it: Start ->…

From powershell (on Windows 10/Server 2016, possibly others): (Get-MpComputerStatus).AmEngineVersion Also, from powershell: Update-MpSignature to just go ahead and run the update process

Thanks! I wish Microsoft would throw the powershell one liner in their document, most poeple interested in this stuff would just rather do:

    Get-MpComputerStatus | select 'AmEngineVersion'
Than read a longwinded set of commands. PS. Cool technique with the parens.

Re: Security Update for Microsoft Malware Protection Engine

#76

Post by user5994461 »

dsp1234 wrote: post #60
user5994461 wrote: post #51

Earlier quoted context omitted.

Tell that to the millions of people who won't have the patch before next week.

Why would they not have it until next week. Per the advisory, the engine update is part of the normal windows defender updates, which happen up to 3 times daily. I just checked this morning, and I have the updated version already, and took no action. Those millions would have had to have disabled windows defender updates in order to not get this update before next week.

It turns out the update is part of the Defender update, not windows update.

That's a much more frequent schedule.

Re: Security Update for Microsoft Malware Protection Engine

#77

Post by throwaway890723 »

snowwolf wrote: post #38
captainmuon wrote: post #30

Earlier quoted context omitted.

He basically announced that he knows a secret worth millions. Criminals and state actors might do everything they can to get this secret, starting with trying to hack him, over bribing him, blackmailing him, serving him secret court orders, or even physically assaulting him with the famous wrench. Even if you are a seasoned security researcher, saying "I know how to get into any Windows PC by sending someone to a web…

I'd maybe disagree that there is "no security gain from tweeting about this". I think there is a security gain from warning people that an urgent security patch is on the way so they should prepare themselves/their organisation to deploy the patch as soon as it lands. Now you could argue that a personal twitter account is not the best medium for this warning (maybe it should come directly from Google Project Zero or…

At he end of the day you have to ask yourself if it's worth it. Security is a touchy topics and that's probably how you want it. Yes, you can argue that you're right, even objectively so, but there's going to be people who disagree. There only so much karma you can burn through before people, and often the people who are the most serious about it, leaves for some other route. And then you sit there ten years later and wonder why "people don't care".

You want to announce upcoming vulnerabilities, fine, do that. Be up front about it and make an argument for it so people see your motivations. Don't leave people guessing what's going to happen based on the mood of the day.

Re: Security Update for Microsoft Malware Protection Engine

#78

Post by user5994461 »

redcalx wrote: post #54

Any suggestions for a good quality virus scanner in which I can have some confidence in regarding a reasonable choice in how it operates. If I'm understanding correctly Defender runs with high privilege and has a very large security footprint; as such I don't think it's something I want to run.

>>> Any suggestions for a good quality virus scanner in which I can have some confidence in regarding a reasonable choice in how it operates.

All antivirus operate like rootkits. It's basically a rootkit trying to block other rootkits to install.

Microsoft has the advantage to have access to all windows API and they put a ton of efforts in testing/compatibility. It is the least worst of all evil.

Re: Security Update for Microsoft Malware Protection Engine

#79

Post by scopecreep »

criley2 wrote: post #62
user5994461 wrote: post #51

Earlier quoted context omitted.

Tell that to the millions of people who won't have the patch before next week.

Not sure about millions but many do have update for Windows turned off, due to Microsoft's security-trust-destroying habit of deploying invasive and undesired non-security updates automatically. Windows 10 especially has a nasty streak with updates, and while security updates are smart, forcing new content updates, advertisements, and spyware into the Tuesday fast track teaches users that the only way to be safe from…

File this one under "play stupid games - win stupid prizes".

Idiots like this are why Windows updates are completely forced in the first place. A couple generations of "experts" knew better and refused to let Windows update. Then billions of dollars were lost cleaning up worms that had already been patched, but people kept canceling the update dialog. See SqlSlammer, CodeRed, etc.

You had your chance to handle your own updates and proved that you cannot be trusted to do so. This is the next logical step.

Re: Security Update for Microsoft Malware Protection Engine

#80

Post by snakeanus »

SA500 wrote: post #19
CiPHPerCoder wrote: post #14

Earlier quoted context omitted.

A lot of people in IT (a surprisingly high portion of programmers, even) don't understand the value of full disclosure in security research. For some reason, they decided to export their usual arguments to decry Tavis's tweet: https://twitter.com/taviso/status/860679110728622080 The responses to his tweet calling him irresponsible are consistent with the tone of this remark. "This can help the bad guys". Nevermind th…

Graham's a longtime critic of Tavis. Think he used to work for an AV provider. Here's the history anyway https://www.google.co.uk/search?q=Graham+Cluley&oq=Graham+Cl...

It seems that he is the Sophos guy.
Post reply on HN