Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows 10 Urgent Update

cnn.com

Post reply on HN
Print view View original

1–10 of 29 posts

Re: Windows 10 Urgent Update

#3

Post by enzanki_ars »

CVE-2019-1182: https://portal.msrc.microsoft.com/en-US/security-guidance/ad...

Slightly more technical information from Wired: https://www.wired.com/story/dejablue-windows-bugs-worm-rdp/

TL;DR: Remote Code Execution via RDP on all windows versions, including 7 and 10.

Wired Quote:

> "Microsoft today warned Windows users of seven new vulnerabilities in Windows that, like BlueKeep, can be exploited via RDP, a tool that lets administrators connect to other computers in a network. Of those seven bugs, Microsoft's advisory emphasized that two are particularly serious; like BlueKeep, they could be used to code an automated worm that jumps from machine to machine, potentially infecting millions of computers."

> "Unlike BlueKeep, however, the new bugs—half-jokingly named DejaBlue by security researchers tracking it—don't merely affect Windows 7 and earlier, as the earlier RDP vulnerability did. Instead, it affects Windows 7 and beyond, including all recent versions of the operating system."

Re: Windows 10 Urgent Update

#5

Post by olyjohn »

parliament32 wrote: post #2

Let me guess, they've discovered too many users turned Telemetry off so they're pushing an urgent update to re-enable it.

I would guess the amount of people who care enough, and are able to successfully disable all Telemetry, and prevent it from being re-enabled is so small that Microsoft doesn't care.

I would also be willing to bet that the majority of people who have it "disabled" are still sending back plenty of Telemetry. If you really care, your best option is to just not use Windows.

Re: Windows 10 Urgent Update

#6

Post by Someone1234 »

Only if you have Remote Desktop Connection (RDS) enabled and exposed to the open internet. Which you shouldn't.

To quote the CVE:

> Disable Remote Desktop Services if they are not required.

#

> Block TCP port 3389 at the enterprise perimeter firewall

If you're using a VPN or RD Gateway which have been best practice for tens of years, you're already insulated. I'd still patch but outside of business hours.

Re: Windows 10 Urgent Update

#7

Post by cptskippy »

Someone1234 wrote: post #6

Only if you have Remote Desktop Connection (RDS) enabled and exposed to the open internet. Which you shouldn't. To quote the CVE: > Disable Remote Desktop Services if they are not required. # > Block TCP port 3389 at the enterprise perimeter firewall If you're using a VPN or RD Gateway which have been best practice for tens of years, you're already insulated. I'd still patch but outside of business hours.

I know people do that, what with cloud based VMs and all, but still... I don't get it.

Re: Windows 10 Urgent Update

#8

Post by Someone1234 »

cptskippy wrote: post #7
Someone1234 wrote: post #6

Only if you have Remote Desktop Connection (RDS) enabled and exposed to the open internet. Which you shouldn't. To quote the CVE: > Disable Remote Desktop Services if they are not required. # > Block TCP port 3389 at the enterprise perimeter firewall If you're using a VPN or RD Gateway which have been best practice for tens of years, you're already insulated. I'd still patch but outside of business hours.

I know people do that, what with cloud based VMs and all, but still... I don't get it.

It should be noted that AWS and other Cloud providers let you set up Security Groups containing specific IP addresses or ranges (i.e. just whitelist your static IP for SSH/RDS access).

It isn't as secure as a VPN (and not as convenient), but definitely a stop-gap if you don't want to pay for Client VPN.

Re: Windows 10 Urgent Update

#9

Post by groovybits »

enzanki_ars wrote: post #3

CVE-2019-1182: https://portal.msrc.microsoft.com/en-US/security-guidance/ad... Slightly more technical information from Wired: https://www.wired.com/story/dejablue-windows-bugs-worm-rdp/ TL;DR: Remote Code Execution via RDP on all windows versions, including 7 and 10. Wired Quote: > "Microsoft today warned Windows users of seven new vulnerabilities in Windows that, like BlueKeep, can be exploited via RDP, a tool that…

Thinking of this in context to Win7 EOL approaching:

I imagine the type of people who have RDP publicly exposed are the same type of people who will not be upgrading from Win7 anytime soon.

I suspect we will see many exploits of this to come.

Post reply on HN