Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows 10 Urgent Update

cnn.com

Post reply on HN
Print view View original

11–20 of 29 posts

Re: Windows 10 Urgent Update

#11

Post by Lendal »

Someone1234 wrote: post #6

Only if you have Remote Desktop Connection (RDS) enabled and exposed to the open internet. Which you shouldn't. To quote the CVE: > Disable Remote Desktop Services if they are not required. # > Block TCP port 3389 at the enterprise perimeter firewall If you're using a VPN or RD Gateway which have been best practice for tens of years, you're already insulated. I'd still patch but outside of business hours.

Almost every Windows computer in the fortune 500 company I work for has RDP enabled and if it wasn't production would grind to a halt.

To make matters worse I can't even run Windows updates on my laptop because the IT department has blocked it. I can only run updates at home.

Re: Windows 10 Urgent Update

#12

Post by _qbjt »

cptskippy wrote: post #7
Someone1234 wrote: post #6

Only if you have Remote Desktop Connection (RDS) enabled and exposed to the open internet. Which you shouldn't. To quote the CVE: > Disable Remote Desktop Services if they are not required. # > Block TCP port 3389 at the enterprise perimeter firewall If you're using a VPN or RD Gateway which have been best practice for tens of years, you're already insulated. I'd still patch but outside of business hours.

I know people do that, what with cloud based VMs and all, but still... I don't get it.

It’s usually to run some old, proprietary software that only has a Windows version.

Re: Windows 10 Urgent Update

#13

Post by SanchoPanda »

parliament32 wrote: post #2

Let me guess, they've discovered too many users turned Telemetry off so they're pushing an urgent update to re-enable it.

They have lost my confidence as well after breaking* a Windows 7 machine I was using as an ad hoc server with updates that ammounted to little more than telemetry without announcing themselves as such.

* Set off a crash loop in connection with my setup that had been pretty conservatively setup. It was fixable, but a nonsense problem to deal with.

Re: Windows 10 Urgent Update

#14

Post by AnIdiotOnTheNet »

_qbjt wrote: post #12
cptskippy wrote: post #7

Earlier quoted context omitted.

I know people do that, what with cloud based VMs and all, but still... I don't get it.

It’s usually to run some old, proprietary software that only has a Windows version.

"Old, proprietary software" describes something like 80% of all the software keeping the modern world going.

Re: Windows 10 Urgent Update

#15

Post by Riverheart »

Someone1234 wrote: post #6

Only if you have Remote Desktop Connection (RDS) enabled and exposed to the open internet. Which you shouldn't. To quote the CVE: > Disable Remote Desktop Services if they are not required. # > Block TCP port 3389 at the enterprise perimeter firewall If you're using a VPN or RD Gateway which have been best practice for tens of years, you're already insulated. I'd still patch but outside of business hours.

While internet facing servers may be the most common attack vector you assume the vulnerability couldn't come from inside the network.

Re: Windows 10 Urgent Update

#16

Post by Someone1234 »

Riverheart wrote: post #15
Someone1234 wrote: post #6

Only if you have Remote Desktop Connection (RDS) enabled and exposed to the open internet. Which you shouldn't. To quote the CVE: > Disable Remote Desktop Services if they are not required. # > Block TCP port 3389 at the enterprise perimeter firewall If you're using a VPN or RD Gateway which have been best practice for tens of years, you're already insulated. I'd still patch but outside of business hours.

While internet facing servers may be the most common attack vector you assume the vulnerability couldn't come from inside the network.

If they're attacking you from an internal vector they likely already have code execution within that internal context, making this bug largely redundant. The more common case is gaining entry to a poorly secured edge or cloud server, rather than a bad actor sitting on your LAN.

But sure, I suppose, that niche edge case (local context without local code execution) could hypothetically exist somewhere, but patching this won't make you secure.

Re: Windows 10 Urgent Update

#17

Post by Riverheart »

Someone1234 wrote: post #16
Riverheart wrote: post #15

Earlier quoted context omitted.

While internet facing servers may be the most common attack vector you assume the vulnerability couldn't come from inside the network.

If they're attacking you from an internal vector they likely already have code execution within that internal context, making this bug largely redundant. The more common case is gaining entry to a poorly secured edge or cloud server, rather than a bad actor sitting on your LAN. But sure, I suppose, that niche edge case (local context without local code execution) could hypothetically exist somewhere, but patching thi…

It's not a niche edge case, there is an entire industry that revolves around securing BYOD devices. If I bring a compromised device on your network and it uses some rdp flaw to access another machine it's gotten a foothold in the network where it could spread further. I don't need code execution from an existing internal resource.

And yes, security is a layered approach. That's why we recognize that the internet isn't the only threat vector out there.

Edit: Why wouldn't you patch internal servers for this anyway? Let's say there is an existing threat with code execution like you say. Now he can trivially access all machines on the network because they share a common vulnerability. At least make him work for it.

Re: Windows 10 Urgent Update

#18

Post by Someone1234 »

Riverheart wrote: post #17
Someone1234 wrote: post #16

Earlier quoted context omitted.

If they're attacking you from an internal vector they likely already have code execution within that internal context, making this bug largely redundant. The more common case is gaining entry to a poorly secured edge or cloud server, rather than a bad actor sitting on your LAN. But sure, I suppose, that niche edge case (local context without local code execution) could hypothetically exist somewhere, but patching thi…

It's not a niche edge case, there is an entire industry that revolves around securing BYOD devices. If I bring a compromised device on your network and it uses some rdp flaw to access another machine it's gotten a foothold in the network where it could spread further. I don't need code execution from an existing internal resource. And yes, security is a layered approach. That's why we recognize that the internet isn'…

> If I bring a compromised device on your network

Then I'm in real trouble with or without this. A compromised device can sniff the network, masquerade, inject network traffic (inc. DNS), and can attack every other device on that same segment.

> I don't need code execution from an existing internal resource.

If you cannot execute code in an internal context then you cannot exploit this bug, you'd effectively be an external attacker. Your own example had you running code on a locally connected "BYOD" device. Therefore you're already executing code in that context.

> Why wouldn't you patch internal servers for this anyway?

Nobody suggested that. In fact quite to the contrary.

By the way while we're discussing niche edge cases, what's your strategy to protect against Van Eck phreaking? Seems about as concrete as the attack vector you're proposing (local network access with no way to execute code).

Re: Windows 10 Urgent Update

#19

Post by RyanAF7 »

olyjohn wrote: post #5
parliament32 wrote: post #2

Let me guess, they've discovered too many users turned Telemetry off so they're pushing an urgent update to re-enable it.

I would guess the amount of people who care enough, and are able to successfully disable all Telemetry, and prevent it from being re-enabled is so small that Microsoft doesn't care. I would also be willing to bet that the majority of people who have it "disabled" are still sending back plenty of Telemetry. If you really care, your best option is to just not use Windows.

Most sensible answer.

Re: Windows 10 Urgent Update

#20

Post by Riverheart »

Someone1234 wrote: post #18
Riverheart wrote: post #17

Earlier quoted context omitted.

It's not a niche edge case, there is an entire industry that revolves around securing BYOD devices. If I bring a compromised device on your network and it uses some rdp flaw to access another machine it's gotten a foothold in the network where it could spread further. I don't need code execution from an existing internal resource. And yes, security is a layered approach. That's why we recognize that the internet isn'…

> If I bring a compromised device on your network Then I'm in real trouble with or without this. A compromised device can sniff the network, masquerade, inject network traffic (inc. DNS), and can attack every other device on that same segment. > I don't need code execution from an existing internal resource. If you cannot execute code in an internal context then you cannot exploit this bug, you'd effectively be an ex…

Okay I think I've either poorly communicated or you've misconstrued what I meant. All I was trying to imply was that threats can surface within the network. I'm not saying some magic will take advantage of the exploit with no connection to the target's network. You said

"If they're attacking you from an internal vector they likely already have code execution within that internal context, making this bug largely redundant."

I was disagreeing that this is redundant. This vulnerability is a remote code exploit that could give an attacker control over the target just by sending a specially crafted packet. It is not some Apache misconfiguration affecting a couple servers, it's baked into all versions of Windows.

Post reply on HN