Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lessons from last week’s cyberattack

blogs.microsoft.com

Post reply on HN
Print view View original

251–260 of 304 posts

Re: Lessons from last week’s cyberattack

#251

Post by belorn »

pawadu wrote: post #222
EvanAnderson wrote: post #209

Earlier quoted context omitted.

Anyone can seek help on the open market to support Ubuntu 10.04 forever if they like. You can't go to another company if you don't like the price Microsoft sets for support for Windows XP.

This comment makes my blood boil. Please ask yourself: 1. why would anybody want to keep 10.04 alive? 2. do you think the type of people who stubbornly continue to use 10.04 would know/care enough about security to seek an alternative source for security patches? edit: should maybe add why this pisses me off: just logged into a production server running 12.04, default install apache and updates _turned off_. the owne…

Whatever hardware that is running that 12.04 system can be upgraded, free of charge, for likely the next 20 years if the past 20 years of linux is anything to go by.

Even if you pay money for the windows 10, it is unlikely to even start on the hardware that XP ran on. Not only will the people have to go through the budget to pay for the software, but now you need a full upgrade plan.

To put this in a concrete example. If a hospital had a check-in system running 12.04 they could just take someone internal from IT and go and fix it. If it was Windows XP then they need to go through finance, then get a offers from competing companies, fitting the upgrading into the budget, and last have people installing it in each of the hospitals entrances. The first case has a project length of days and the other of months and in worst case years.

Re: Lessons from last week’s cyberattack

#252

Post by pmlnr »

carlosrg wrote: post #221
dominhhai wrote: post #66

Why not use Linux or MacOS?

You have to be pretty delusional if you think macOS or Linux don't have security problems.

Of course they do, yet we still haven't seen an outage like this, even though most of the web world is running on some kind of linux.

Most probably it's due to the high variety in kernels, versions and the subtle differences in linux distributions.

Re: Lessons from last week’s cyberattack

#253

Post by alkonaut »

kaoD wrote: post #247
alkonaut wrote: post #189

One scary thing about these security holes is that it's almost impossible to check if your system is affected. There are at least 50 different releases of Windows 10 alone, and it's hard enough to find which is actually used. The "System" dialog Shows "Windows 10 2015 LTSB". "Winver" on the command line shows "Windows 10 2015 LTSB build 10240" - but there are several releases of that and only the latest ones, e.g. fr…

Go to your Windows Update History and check if you have KB4013429 installed. https://support.microsoft.com/en-us/help/4013429/windows-10-... EDIT: Or KB4012606 / KB4013198 for older Windows builds.

How do I know that's the one? I'm was curious about the process of knowing how to find out if my system is patched against vulnerability X.

Re: Lessons from last week’s cyberattack

#254

Post by cableshaft »

MisterPC wrote: post #217
amenghra wrote: post #159

Earlier quoted context omitted.

I think the car analogy isn't that bad. New classes of security issues get discovered over time. Development processes which are considered "state of the art" at one point can become unacceptable 10 years down the road. A decade in software engineering is a significant amount of time!

For the car analogy, what will happen when self-driving cars become the norm and the contained software becomes so important? I'm going to be annoyed if my car becomes useless after 10 years because they dont have to patch it after that period. On the other hand though, can we realistically enforce lifetime guarantees? What is a car company goes out of business?

Pretty sure the endgame for self-driving cars is pretty much nobody owning cars anymore. It will become too convenient and cheap to rent one instead (possibly not in rural areas, not sure about that). Kind of like how very few people in big cities bother with owning cars.

Re: Lessons from last week’s cyberattack

#255

Post by coldpie »

4684499 wrote: post #63
cm2187 wrote: post #9

Another lesson learned: don't bundle your security updates with your cool new features nobody wants, Microsoft. This will aggravate the problem as more people/companies will defer updates.

I always had auto updates turned on until Windows' malicious behaviors in recent years: https://thenextweb.com/microsoft/2015/09/11/microsoft-is-aut... This one consumes me several gigabytes on my C drive without my permission. https://www.tenforums.com/windows-updates-activation/55185-w... This one acts like malware. And this one: http://www.pcworld.com/article/3039827/windows/7-ways-window... I don't know why I'd c…

> I don't know why I'd choose a operating system does that.

Me either. Stop using Windows.

Re: Lessons from last week’s cyberattack

#256

Post by kaoD »

alkonaut wrote: post #253
kaoD wrote: post #247

Earlier quoted context omitted.

Go to your Windows Update History and check if you have KB4013429 installed. https://support.microsoft.com/en-us/help/4013429/windows-10-... EDIT: Or KB4012606 / KB4013198 for older Windows builds.

How do I know that's the one? I'm was curious about the process of knowing how to find out if my system is patched against vulnerability X.

Here's the complete process I followed:

1. Search for "windows smb server vuln" in Google.

2. "Microsoft Security Bulletin MS17-010 - Critical"[0] is the link I'm looking for.

3. Search for your version in the list. Mine is "Windows 10 Version 1607", listed in the table with 4013429 (right next to the Windows version, not in "Updates replaced"). That's my update number.

[0] https://technet.microsoft.com/en-us/library/security/ms17-01...

Re: Lessons from last week’s cyberattack

#257

Post by ralphie02 »

nthcolumn wrote: post #243
3chelon wrote: post #225

Earlier quoted context omitted.

I agree completely. People can blame MS for their insecure OS, or users who don't know any better for running outdated systems (or even for running Windows at all), but the stark reality is that all OSes have vulnerabilities because they are huge and complex and it is impossible to make them 100% secure. But the NSA are - by definition - supposed to be security experts, so what are they doing letting themselves get h…

A bit rich from Microsoft to talk about hoarding when the patches they released over the weekend were all signed back in February... i.e. they are hoarding fixes to their own shit for their $$$ extended support agreements.

"The chaos surprised many security watchers because Microsoft issued an update in March that patched the underlying vulnerability in Windows 7 and most other supported versions of Windows. (Windows 10 was never vulnerable.)"

source: https://arstechnica.co.uk/security/2017/05/wcry-microsoft-is...

So I don't really know what you mean by 'hoarding the fix'. The patch was not initially released to some OS versions because they are NO LONGER supported.

Re: Lessons from last week’s cyberattack

#258

Post by [deleted] »

muricula wrote: post #97
codedokode wrote: post #38

One of the reasons why such attack was possible is poor security in Windows. Port 445 that was used in an attack is opened by a kernel driver (at least that is what netstat says on WinXP) that runs in ring 0. This driver is enabled by default even if the user doesn't need SMB server and it cannot be easily disabled. Most of services in Windows are run under two privileged user accounts (LocalService or NetworkService…

The thing is there really isn't a production ready alternative. Rust in ring 0 isn't production ready -- a lot of language features needed to run in ring 0 are nightly only. There are no widely used microkernels. Ironically, of the widely used operating systems in the world, Windows does the best job of running drivers in userland.

[deleted]

Re: Lessons from last week’s cyberattack

#259

Post by JimDabell »

alkonaut wrote: post #230
JimDabell wrote: post #228

Earlier quoted context omitted.

Does this include OpenBSD?

Is it a program written by humans and have parts that accept user input or network input? then yes.

By that definition, pretty much all software has "poor security" regardless of language. I don't think your definition of "poor security" is proportionate or useful.

Re: Lessons from last week’s cyberattack

#260

Post by yig »

loteck wrote: post #11

The quote bombshell here, and what hasnt yet gotten much attention since sysadmins the world over are busy dealing with fallout, is that the NSA and therefore the US government is directly responsible for the current global cyber-carnage. We developed the capability, we chose to keep it unpatched, we tried to keep it secret, we lost control of it. This has similarities in type, if not in horror, to the development an…

We would be in the exact same situation if the NSA had immediately disclosed the vulnerability to Microsoft. Old software wouldn't have been updated and someone would have exploited it.
Post reply on HN