Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows 10 Urgent Update

cnn.com

Post reply on HN
Print view View original

21–29 of 29 posts

Re: Windows 10 Urgent Update

#21

Post by AstralStorm »

AnIdiotOnTheNet wrote: post #14
_qbjt wrote: post #12

Earlier quoted context omitted.

It’s usually to run some old, proprietary software that only has a Windows version.

"Old, proprietary software" describes something like 80% of all the software keeping the modern world going.

Some of it is new software. South Korean love of ActiveX for example, a technology dead for at least 10 years. Still getting new stuff written.

On the contrary, most critical software is plenty new - things like MS Office. Still bound to Windows.

The remaining systems rely on truly custom software and should be either airgapped (so no RDP) or rewritten. I'm thinking industrial - they should've planned for this many years beforehand. There were instances back when Windows XP was the main driver.

Re: Windows 10 Urgent Update

#22

Post by AstralStorm »

Someone1234 wrote: post #16
Riverheart wrote: post #15

Earlier quoted context omitted.

While internet facing servers may be the most common attack vector you assume the vulnerability couldn't come from inside the network.

If they're attacking you from an internal vector they likely already have code execution within that internal context, making this bug largely redundant. The more common case is gaining entry to a poorly secured edge or cloud server, rather than a bad actor sitting on your LAN. But sure, I suppose, that niche edge case (local context without local code execution) could hypothetically exist somewhere, but patching thi…

The internal remote hole can be thought of as a force multiplier. An attacker that bypasses the edge in any way gets every machine in your network. It takes any other remote bug or anyone getting to any badness on the Internet. And then if your domain controller is owned, it's everything...

A simple virus could even do it. It takes only one instance for this bug to completely take over your network if you're Windows based. Remember Windows XP time? That's how it is.

Unless you completely cut off internal network everywhere. Good luck with that policy.

You wouldn't even know you have been owned completely and expect only a router issue if the breach is from there. Or not even spot anything out of ordinary.

About the only real way is to presume internal network is compromised and keep diversity and backups to reduce impact. Compartmentalize, do not centralize, no matter how much money you'd save that way. If a man has to go to fix an issue instead of remote login, so be it.

Re: Windows 10 Urgent Update

#24

Post by londons_explore »

groovybits wrote: post #9
enzanki_ars wrote: post #3

CVE-2019-1182: https://portal.msrc.microsoft.com/en-US/security-guidance/ad... Slightly more technical information from Wired: https://www.wired.com/story/dejablue-windows-bugs-worm-rdp/ TL;DR: Remote Code Execution via RDP on all windows versions, including 7 and 10. Wired Quote: > "Microsoft today warned Windows users of seven new vulnerabilities in Windows that, like BlueKeep, can be exploited via RDP, a tool that…

Thinking of this in context to Win7 EOL approaching: I imagine the type of people who have RDP publicly exposed are the same type of people who will not be upgrading from Win7 anytime soon. I suspect we will see many exploits of this to come.

Microsoft really ought to develop their own worm, and use it to patch the flaw.

They can release it on the same day as the regular updates, and scan the whole IPv4 address space every hour.

That way, the pool of unpatched machines will be so tiny it isn't worth evil people trying to exploit it.

Re: Windows 10 Urgent Update

#25

Post by londons_explore »

Someone1234 wrote: post #6

Only if you have Remote Desktop Connection (RDS) enabled and exposed to the open internet. Which you shouldn't. To quote the CVE: > Disable Remote Desktop Services if they are not required. # > Block TCP port 3389 at the enterprise perimeter firewall If you're using a VPN or RD Gateway which have been best practice for tens of years, you're already insulated. I'd still patch but outside of business hours.

Why has RDP been so vulnerable to exploits for so long? It seems Microsoft should require credentials sent before processing any complex graphics rendering stuff, yet even to this day, it is possible to view a remote logon screen, get remote audio, etc. all unauthenticated!

Re: Windows 10 Urgent Update

#26

Post by kgwxd »

Lendal wrote: post #11
Someone1234 wrote: post #6

Only if you have Remote Desktop Connection (RDS) enabled and exposed to the open internet. Which you shouldn't. To quote the CVE: > Disable Remote Desktop Services if they are not required. # > Block TCP port 3389 at the enterprise perimeter firewall If you're using a VPN or RD Gateway which have been best practice for tens of years, you're already insulated. I'd still patch but outside of business hours.

Almost every Windows computer in the fortune 500 company I work for has RDP enabled and if it wasn't production would grind to a halt. To make matters worse I can't even run Windows updates on my laptop because the IT department has blocked it. I can only run updates at home.

Are they exposed to the internet or do you have to connect to a VPN first?

Re: Windows 10 Urgent Update

#27

Post by kgwxd »

londons_explore wrote: post #24
groovybits wrote: post #9

Earlier quoted context omitted.

Thinking of this in context to Win7 EOL approaching: I imagine the type of people who have RDP publicly exposed are the same type of people who will not be upgrading from Win7 anytime soon. I suspect we will see many exploits of this to come.

Microsoft really ought to develop their own worm, and use it to patch the flaw. They can release it on the same day as the regular updates, and scan the whole IPv4 address space every hour. That way, the pool of unpatched machines will be so tiny it isn't worth evil people trying to exploit it.

Wouldn't that be illegal? I hope so.

Re: Windows 10 Urgent Update

#28

Post by groovybits »

londons_explore wrote: post #24
groovybits wrote: post #9

Earlier quoted context omitted.

Thinking of this in context to Win7 EOL approaching: I imagine the type of people who have RDP publicly exposed are the same type of people who will not be upgrading from Win7 anytime soon. I suspect we will see many exploits of this to come.

Microsoft really ought to develop their own worm, and use it to patch the flaw. They can release it on the same day as the regular updates, and scan the whole IPv4 address space every hour. That way, the pool of unpatched machines will be so tiny it isn't worth evil people trying to exploit it.

Its the same threat vector as BlueKeep, so I would imagine the prime exploitation window for Win7 (which was/is vulnerable to both) has already passed.

A quick Shodan query already does what you're thinking.

Re: Windows 10 Urgent Update

#29

Post by Lendal »

kgwxd wrote: post #26
Lendal wrote: post #11

Earlier quoted context omitted.

Almost every Windows computer in the fortune 500 company I work for has RDP enabled and if it wasn't production would grind to a halt. To make matters worse I can't even run Windows updates on my laptop because the IT department has blocked it. I can only run updates at home.

Are they exposed to the internet or do you have to connect to a VPN first?

Oh yeah there are all kinds of firewalls, but you know there is always a hole somewhere. (Officially they've contracted with Amazon Workspaces to provide remote access which actually works pretty good, albeit slow.)
Post reply on HN