Microsoft 'Stealth Update' Proving Problematic 257
DaMan writes "According to the site WindowsSecrets, the stealth Update that Microsoft released back in August isn't quite as harmless as the company claims. The site's research has shown that when users try to do a repair to XP subsequent to the update, bad things happen. 'After using the repair option from an XP CD-ROM, Windows Update now downloads and installs the new 7.0.600.381 executable files. Some WU executables aren't registered with the operating system, preventing Windows Update from working as intended. This, in turn, prevents Microsoft's 80 latest patches from installing -- even if the patches successfully downloaded to the PC.' ZDNet's Hardware 2.0 has independently confirmed that this update adversely affects repaired XP installations: 'This issue highlights why it is vitally important that Microsoft doesn't release undocumented updates on the sly. Even the best tested update can have unpleasant side-effects, but if patches are documented properly and released in such a way that users (especially IT professionals) know they exist, it offers a necessary starting point for troubleshooting.'"
Let me be the first to say... (Score:5, Funny)
Re:Let me be the first to say... (Score:5, Funny)
The real problem is ... (Score:5, Interesting)
Whereas documented updates are magically OK?
OK, OK, that's not really what you meant, and it's not your point
=====
If you ask me, the real problem is updates. Let's say that one update in 50 is significantly defective -- which is, IMHO, quite optimistic. Let us further guess that 50% of the defective updates introduce new unexpected problems rather than failing to (fully) fix the existing problem -- they do test these things. At least I hope they do. What is likely to get past testing is errors in areas that no one thought would be affected. Lets assume that there are 10 updates a week on average, and that the average time from first report to fix is four weeks.
If you just uncritically load updates, you'll download new grief every 10 weeks or so and take four weeks to get it fixed. that means that five times a year, you'll unwittingly install a significant new problem and that about 40% of the time you'll be living with one or more of these things.
IMO, the best strategy -- at least for larger operations -- is to evaluate each and every patch, and to load only those which seem absolutely necessary. Even that is not going to work all the time.
As for updates that you aren't asked about... A truly bad idea. Hopefully Microsoft and other operations that believe in automatic updates will learn their lesson from this relatively modest (we hope) fiasco and will never ever do THAT again. Memo to organizations that do that. If your QA -- who are overworked, underpaid, and probably need a vacation -- screws up at the wrong time and you put an important business sector offline for days or weeks, you are looking at a major league class action suit. Don't expect the shrinkwrap EULA to protect you.
Re: (Score:2)
Re:The real problem is ... (Score:5, Insightful)
I have no idea what is "protecting" these software vendors other than the halo that we are dealing with software and everyone expects things to go very bad once and a while in the field but the threat of lawsuits at this point is laughable.
Note: I am merely reporting on the actual state of things, this does not mean I agree with it.
enterprise ready operating system (Score:5, Insightful)
You have zeroed in on the heart of this problem with laser like precision. I couldn't agree more.
If you run a business on an OS you need to know the details of upgrades. You need to test all upgrades against your production machines before applying the upgrade.
I am not talking about a home desktop, or even a corporate desktop system here. Think about computers used to control water or fuel delivery. Maybe a system that reconciles ATM transactions at a bank, or adjusts inventory databases from sales at retail locations, or the automated system that routes calls to a city's 911 emergency center.
Businesses and Governments depend on many customized pieces of software day in and day out. All software changes must be tested and shown to have no ill effects before thay are applied to enterprise production systems.
Any OS that does not allow the user to control the application of patches and updates, and instead updates systems by stealth, is not ready for the enterprise.
Think about the problems that could result if people use an OS like Windows in misssion critical applications that involve lives [slashdot.org].
Even if lives are not involved businesses cannot tolerate amateur stunts like stealth patches from an OS vendor. They could lose billions of dollars trying to find out the cause of a problem.
This highlights how out of touch Microsoft is with the needs of enterprise level customers.
Re:enterprise ready operating system (Score:5, Funny)
Just let us patch the systems (Score:5, Insightful)
Re: (Score:3, Insightful)
to me it seems that a large majority of issues with windows can be solved in 3 ways
1. dont use the OS "Add ons" (ie outlook msn messager etc)
2. use a properly configured firewall
3. dont be an idiot.
i have no problem following these 3
Following your train of thought (Score:4, Interesting)
Re: (Score:2)
Re:Following your train of thought (Score:5, Funny)
Are you saying they aren't?
Re: (Score:3, Insightful)
Re: (Score:2)
Microflaccid strikes again (Score:5, Funny)
Subconscious or stealth push to Vista? (Score:3, Interesting)
Re:Subconscious or stealth push to Vista? (Score:5, Funny)
Re:Subconscious or stealth push to Vista? (Score:5, Insightful)
Re:Subconscious or stealth push to Vista? (Score:4, Funny)
Re: (Score:2)
There, fixed that for you.
Re: (Score:2)
95 to 98 compared to XP to Vista (Score:5, Insightful)
The problem with MicroSoft (Score:5, Interesting)
Microsoft doesn't allow me this, and continues to fail to predict the negative consequences resulting from these choices. Apple at least gives me the option of installing an update, even though they have a bad record on the full disclosure thing too.
Re: (Score:2, Insightful)
You know whats installed, eh? So you go through and check the source of all code that is being installed on your Linux box? I understand the idea that because it is open source, there must be no problems with what you are installing, but don't make the false assumption of this, because as Linux becomes more and more popular the chance of something getting on your system that you were unaware of will most likely grow. Everything might not always be so hunkydory.
Re:The problem with MicroSoft (Score:5, Insightful)
Re: (Score:2)
which is why Microsoft
predictably and consequentially continues to fail
WTF (Score:5, Insightful)
Re: Broken Process (Score:5, Funny)
The lather-repeat caused a buffer overflow.
Why did no antivirus s/w pick this up? (Score:5, Interesting)
How do these antivirus programs know for sure that these updates were 'harmless' and 'normal behaviour'.
In light of this revelation, I think corporates must now take action against these antivirus firms for not preventing this breach. Let's see what Microsoft has to say to this 'harmless' update that allows users to 'know and be informed of further updates'. A Media Defender style expose' of internal communications on this issue would be very interesting indeed.
Re: (Score:2, Insightful)
A dozen system files have been updated as part of this undocumented stealth update... and yet not a single antivirus software reported this. Why?
How do these antivirus programs know for sure that these updates were 'harmless' and 'normal behaviour'.
In light of this revelation, I think corporates must now take action against these antivirus firms for not preventing this breach. Let's see what Microsoft has to say to this 'harmless' update that allows users to 'know and be informed of further updates'. A Media Defender style expose' of internal communications on this issue would be very interesting indeed.
Updates are run under the system user process. If you had ever been a Windows admin, you'd know that there are all sorts of ways to hide updates and the like from users...which means that there's something in the process that MS can enable to hide it from their users. The reason no AV caught it is because it was using an update service already approved by the AV program and was running it under the already accepted system user.
I'm not saying that I approve of their actions, I don't. But just becau
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re:Why did no antivirus s/w pick this up? (Score:4, Interesting)
So, does an antivirus program run as a normal user process or system user process? If it is the latter, then how is it that the stealth update managed to escape attention??
And if antivirus s/w firms do not know systems programming, why do they exist at all? Looks like most anti-virus programs have been configured / patched NOT TO REPORT this particular stealth update... I cannot see any other logical explanation for this lapse.
Re:Why did no antivirus s/w pick this up? (Score:5, Informative)
And if antivirus s/w firms do not know systems programming, why do they exist at all? Looks like most anti-virus programs have been configured / patched NOT TO REPORT this particular stealth update... I cannot see any other logical explanation for this lapse
Like I mentioned, it seems that you have not ever been a Windows admin, nor have ever dealt with a large roll-out of a system patch.
Whether or not the AV program runs under a user process (highly unlikely) or a system process, it doesn't matter. You're ignoring what AV programs are looking for anyway. If a trusted process and service (windows update) run by a trusted user (SYSTEM), the chances that the AV program is even going to log such activity is doubtful. As far as the AV program is concerned, the service (Windows Update) is doing it's job...which in a way, it is. Windows Update has the control to change system files. No big secret there.
You seem to think that every time a system file gets updated by whatever process, that should be flagged and prevented. It's not some rogue program that is being run to update the files, it's the WU service that's on every single XP (and other MS OS's) machine out there.
Like I said, I'm not defending MS on this...no one I bitch about more. But to say that the AV companies have culpability on this, that's off the mark. A trusted Windows service did what it was built to do. Nothing to see here. Move along.
Re: (Score:2)
I think you have it backwards. The job of Windows Update is (supposedly) to patch the system in order to keep it in a secure, useful state. Which is precisely the definition of an antivirus software too. If Windows Update can reliably patch the OS and keep it secure, there would be no market for any antivirus software.
Theref
Re: (Score:3, Insightful)
Re: (Score:2)
Unfortunately, following your advice is impossible. The official WU program that is shipped with a Genuine Copy of Windows XP and Vista has been proved to be a Rogue Program by this episode. The only reliable protection appears to be, to disable Windows Update completely, and depend on the antivirus program to do a better job of protecting and securing the system.
Just try to go with me on this and pretend your a system admin of abo
Re: (Score:2)
The reason AV software doesn't pick this crap up is that the current crop of AV software uses a BLACKLIST based model and not WHITELIST based model. Since AV software is blacklist based, there IS NO "trusted" anything. Once they move to a whitelist model, THEN we can start talking about what is "trusted" and what is not.
Re: (Score:2, Interesting)
However, turning that around, Windows Update isn't on the blacklist. Why should it be logged as changing the files? Even AV programs that do heuristic scanning aren't really going to notice WU doing it's job.
Reasonable expectation (Score:2)
Actually yes, coming from a UNIX standpoint this is exactly what programs like Tripwire do.
If I have AV software I would love to have it notify me system files had been altered, whatever the cause - perhaps not prevent but at least issue a warning at some point.
Since viruses can potentially modify trusted executables there's no reason to trust any program running as any user more than anythi
Re: (Score:2)
Besides that, no AV can detect a process started by the undocumented MSOnlyStar
Re: (Score:2)
Re:Why did no antivirus s/w pick this up? (Score:4, Informative)
2) For the few behavioral antivirus software, my guess is that they're monitoring activity under some user accounts, and that they're not able to monitor activity of the "System" accounts and other special accounts.
Re: (Score:2)
Every antivirus software I have seen, has this feature that prompts you when any 'write' or 'update' happens in the system folders. Try copying a dll file and the antivirus s/w throws up a window, asking for confirmation... in many cases, it is rejected outright. The logic is that any update to the system files can only
Re:Why did no antivirus s/w pick this up? (Score:5, Insightful)
If a virus or trojan has that access already, you're screwed anyway. Might as well wipe the box and start over. However, to get that access, they usually need an exploit or to run an executable to grant them that access.
I don't think you have a very good understanding of what a virus program is expected to do. If a system account isn't allowed the power to update system files, then why have it in the first place?
Re: (Score:2)
If a virus or trojan has that access already, you're screwed anyway. Might as well wipe the box and start over.
True, but if the write is not detected and reported to the user, the user can't know that it's time to wipe & reinstall. In my opinion, anti-malware software should be expected to do that detection and reporting -- although I agree that "anti-virus" software is too narrow a genre for the sake of this discussion.
Still, I think the orginal question still stands. In the UNIX world, for
AVG usually does (Score:2)
Re: (Score:2)
Have to get away from the "patch" concept (Score:5, Interesting)
Everything depends on everything else. After a few years of updates and software installation, whether on Windows or Mac OS X (no, I can't speak to Linux so if Linux solves all these problems I plead ignorance), almost every system is in a slightly broken state, and you just hope it isn't intolerably broken. Talk to any average mom 'n dad and they'll say "Things that used to work fine on our computer aren't working any more, I guess it's just time to buy a new computer."
Some new way of building operating systems is needed that reduces the interdependence of its components.
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Interesting)
The down side is that many packages aren't created properly, which results in rpm he
Re:Have to get away from the "patch" concept (Score:4, Interesting)
Re: (Score:3, Interesting)
because of the installation and "maintenance" hassles they create.
One big savings of shared libraries is that if a vulnerability is fixed in libpng, you don't have to update 25 apps. And the authors of those apps don't have to repackage their app. And old projects that aren't in active development can still take advantage of the security fixes. Same with performance i
Re: (Score:2)
I can see why you would think that, but I'm not sure that it is true. It is true that the user interface level in graphical software is an intricate structure whose interactions are complex and difficult to follow. It might be just barely possible to untangle Windows 95 and see how the parts fit together. I spent a couple of years trying and I think I was making progress. Windows 98, NT, and (from what I can see Apple software) are simply beyond my comprehen
Only repaired? (Score:2)
Would the same issue not happen if you just installed from the CD from scratch? What prevents it from installing out of order when you do it that way?
Seems pretty serious either way, and it has me wishing I'd turned off the automatic update service on my only Windows PC. It's too late now, but you can bet it won't get internet access until after that's disabled when I format that mach
I've run into this and the fix isn't hard. (Score:4, Informative)
At the command prompt, type the following commands, press ENTER after each command, and then click OK every time that you receive a verification message: regsvr32 wuapi.dll
regsvr32 wuaueng1.dll
regsvr32 wuaueng.dll
regsvr32 wucltui.dll
regsvr32 wups2.dll
regsvr32 wups.dll
regsvr32 wuweb.dll
Once that is done, you'll be able to use Microsoft Update again.
Re: (Score:3, Funny)
Re: (Score:2)
Yeah, I could do that. That would ruin the joke though (as lame as it was). I would have better success if I integrated it into a new cursor or toolbar.
Re:I've run into this and the fix isn't hard. (Score:5, Funny)
- oft-heard criticism of Linux
Re:I've run into this and the fix isn't hard. (Score:5, Funny)
from here: http://bash.org/?464385 [bash.org]
Re: (Score:2)
Yeah, but this isn't a "little problem" so your criticism doesn't apply. HAH! See? One point for Microsoft! oh, wait...
Re:I've run into this and the fix isn't hard. (Score:4, Interesting)
Yeah... At least with Linux you know you're probably going to be messing around at the command prompt. I don't know how many times I've had a Windows machine do something odd, gone looking through the GUI for the magic checkbox that will fix things, only to eventually discover (through technical support or a KB article) that there's a command-line fix that isn't documented anywhere.
Frankly... These days I'm using the command prompt on my Windows machine just as often as I do on my Linux machine.
Re: (Score:3, Funny)
Re: (Score:3, Informative)
Go to http://windizupdate.com/ [windizupdate.com] with a supported (non-IE) browser.
Once that is done, you'll never have to use Microsoft Update again.
That's something you can tell your grandmother over the phone.
I got bitten by this (Score:5, Interesting)
Now I find out it's because of a broken secret mandatory update to the DRM that breaks windows update altogether. Nice one Microsoft!
I had another bug after that windows update, http://support.microsoft.com/kb/883821 [microsoft.com]
That took a lot longer to fix, as none of those listed fixed it. Perhaps that was also related? Lovely.
Microsoft XP updates....same old story. (Score:4, Interesting)
But earlier this year I had to allow a client's machine to use an XP service patch or be have to tell the user that the machine would be out of warranty both from the OEM and Microsoft.
The patch (SP2) froze the computer completely after an aborted install that the screen recorded as having been successfully uninstalled. It took nearly 20 hours of non-stop attempts plus two service calls to avoid having to wipe the disk -- which was not an option -- and afterwards the "Genuine Advantage" program still wants more updates.
Not surprisingly, I won't be recommending Microsoft on their next desktops. Ubuntu will be fine.
Re: (Score:2)
You need to go a little further back than that. MS had planned to pull the plug for years - Windows ME was never meant to happen, and Windows '98 lasted rather longer than originally planned.
Re: (Score:2)
Not to mention the reduced cost of supporting only one code base.
I have to agree with you. Too bad that the "better" security in NT turned out to be a fantasy.
The only major bad update I can recall in Windows 98 Windows Update was an Intel originated patch that broke IDE disk access on many machines. Fortunately, automatic update wasn't all that wi
My experience (Score:4, Interesting)
I thought this was because of Skype, Windows Media Player, VLC Player or Real Player. I installed new versions of all of these apps but this did not help. I struggled with this problem and found little help, even from Microsoft itself. The good thing is that Windows XP has a [neat] feature that rolls the system back to its previous configuration. This is what I used and had this problem solved.
But I then wondered whether we in the Linux world have anything comparable to the feature that helped me roll back my settings in Windows XP Professional. I haven't found one! Have I looked hard enough of am I looking in the wrong places?
Re: (Score:3, Informative)
I can't speak to the internal reasons behind windows decision to include that feature (though I have a couple good guesses), but based on the number of people I know who think a backup is when the white lights come on at the back of the car, its a much needed feature. This is what backups are for people. No matter what OS. a proper backup scenario would allow recovery from any problem like this. In the linux world, due to plaintext config files and the modular nature of the syste
Are They Serious? (Score:4, Insightful)
In other words, if Microsoft had not updated Windows Update automatically, and a user had chosen to be notified of future updates, these notifications would not work. The only way to ensure that the user's settings were properly respected was to update Windows Update.
So now this article says that the silent update wasn't harmless because Windows Update was broken after they did a restore. Do they realize that without this update, Windows Update *definitely* wouldn't work, and that the fact that this update may have a bug in it regarding restoration is completely besides the point?
Should Microsoft have made it more clear that they were doing an update? Yes. Is this update proof of Microsoft's desire to ignore user preferences and do whatever the hell they want? Obviously not.
Re: (Score:3, Interesting)
Re: (Score:2)
Re:Are They Serious? Nope. (Score:3, Insightful)
What a long winded way to say the Windows update is such a horrible mess it isn't funny.
Me, I like rolled up file based updates. Download it and save it off. When the beta testers say it is OK, I apply. I have earned with over 20 OSes behind me that you patch to point in time from proven groups of patches. This idea of "auto" update is so fundamentally flawed...
Leave Microsoft alone. (Score:5, Funny)
Its stock price has stagnated. Google made Steve Ballmer mad. He threw two fucking chairs.
Ray Ozzie turned out to be a blogger, and now he's posting a bunch of comments. All you people care about is readers and making money off of them.
It's a corporation! What you don't realize is that Microsoft is making you all this money and all you do is write a bunch of crap about it.
It hasn't made a good OS in years. Its spreadsheet is called "excel" for a reason because all you people want is EXCELLENCE! EXCELLENCE! EXCELLENCE!
LEAVE IT ALONE! You are lucky it even makes products for you bastards! LEAVE MICROSOFT ALONE!
Please!
CmdrTaco talked about professionalism and said if Steve Ballmer was a professional he would've monkey danced no matter what.
Speaking of professionalism, when is it professional to publicly bash a company who is going through a hard time?
Leave Microsoft alone, please.
LEAVE MICROSOFT ALONE RIGHT NOW. I MEAN IT.
Anyone that has a problem with it you deal with me, because it is not well right now.
LEAVE IT ALONE!
Re: (Score:2)
No one saw this coming... (Score:2, Interesting)
Re: (Score:3, Insightful)
I'm not saying peopl
That explains the trouble I had! (Score:2, Informative)
"This, in turn, prevents Microsoft's 80 latest patches from installing -- even if the patches successfully downloaded to the PC."
That the trouble I had recently! A few weeks ago, a friend asked me to clean up three of her family computers that were crawling with spyware/adware, and trojans, as well as upgrade them from WinXP Home to WinXP Pro. I got them cleaned up fine, and did the upgrade. After booting to the desktop the first time, I ran Windows Update to grab the latest patches. On all three m
They already have a solution to this. (Score:4, Insightful)
Who says this is an -unintended- side effect?
complex systems==problems (Score:2)
And that (IMHO) is MS-Mindows main problem. It's too complex, and this is why there are so many issues with it.
End of story.
Re: (Score:2)
I mean sure, Linux systems are more built around the concept of "let each task do one small job and do it well", but without a fair bit of knowledge and experience, it's quite possible to screw a system so hard that you can't easily repair it. Particularly once you start getting into the minefield of "install this proprietary app which doesn't come with source, install that binary driver which comes as a kernel module, install the other program from an RPM intended fo
This will spur the Vista sales (Score:3, Insightful)
two words (Score:2)
Yeah, I think this opens the door to a class action lawsuit, because someone could argue that they accessed their computer, without their permission, thus violating the computer abuse and fraud act.
Damn Microsoft. (Score:2)
Re: (Score:2)
"Windows installation wants to install the following file: NTOSKRNL. Cancel or allow?"
"Windows installation wants to install the following file: rundll32.exe. Cancel or allow?"
"Windows installation wants to install the following file: cmd.exe. Cancel or allow?"
"Windows installation wants to install the following file: notepad.exe. Cancel or allow?"
"Windows installation wants to install the following file: mspaint.exe. Can
I am even happier now (Score:2)
Not that I really had any doubts to begin with.
Euthanasia (Score:2)
It is a drag on our society, on our culture, on our economy, not to mention the rest of the world's.
I wish something could be done about them, but we just have to wait for them to blow all their own limbs off and bleed to death I guess.
What about WSUS? (Score:2)
http://technet.microsoft.com/en-us/wsus/default.aspx [microsoft.com]
Did the stealth updates install on PCs that don't have WGA installed, and don't update from the Windows web site? If not, what effect will that have?
Re: (Score:2)
This is way we need xp sp3 or a update roll up.... (Score:2)
80+ updates for a new xp sp2 install is a lot.
Re: (Score:2)
Re: windows and linux problems (Score:3, Informative)
I've set it to default to Windows, because windows boots over and over, sometimes for hours, before it finally relents and comes to life. I've suspected a BIOS setting it doesn't like, or that Windows wants its own FAT instead of LILO, but could it be that Windows is trying to phone home, even though my internet access has been shut off for a couple of months? Even though it's a fresh install and the PC hasn't been connected to the internet since before the install?
Sounds like a hardware problem, to be honest. Like a bad bit or two in low memory, for example... do you have memory testing turned on in your BIOS? If it's set to "fast boot" it will skip nearly all useful testing, fast boot is just a way to generate money for PC repair shops. :)
And do thay have any idea what a pain in the ass it is to "register" that God damned OS without internet access?
Don't remember if I've tried it with Windows, but for most windows programs that nag for registration you just tell it you'll register by snail mail, when it asks for a printer tell it to print the registration page to a file,
Re: (Score:2)
they do update their product without asking or telling you => microsoft == evil.
Re: (Score:2)
You're right to some extent. This being Slashdot, Microsoft would be blamed for something even if they brokered a lasting peace between Isreal and the Palestinians, cured cancer, or brought global worming to a screeching halt.
But in this specific case, what they did was quietly load updates onto computers
Re: (Score:2)
slashdot'ers need an "Evil empire" in the same way as US needed the Soviet "Evil empire" to keep population in control thru fear (same thing they are doing now with terrorism)
Re: (Score:2)
Groupthink is quite amusing when you think about it. I just love seeing the vehement rants against a software company. So much wasted passion for a mostly inept, overly corporate software company. You'd think they were out killing babies or clubbing baby seals. Twitter is the most extreme example of this, and one of those people who I don't believe really exists.
Re: (Score:2)
Notify about update - allow user to approve or deny -> not evil
If MS would have pushed this update out in the normal way, this whole issue wouldn't have come up.