Microsoft Has No Plans To Patch New Flaw 217
Trailrunner7 writes "Microsoft has acknowledged the vulnerability that the new malware Stuxnet uses to launch itself with .lnk files, but said it has no plans to patch the flaw right now. The company said the flaw affects most current versions of Windows, including Vista, Server 2008 and Windows 7 32- and 64-bit. Meanwhile, the digital certificate that belonging to Realtek Semiconductor that was used to sign a pair of drivers for the new Stuxnet rootkit has been revoked by VeriSign. The certificate was revoked Friday, several days after news broke about the existence of the new malware and the troubling existence of the signed drivers."
Possible mitigation? (Score:4, Insightful)
Couldn't they just start making driver signatures verify with the hardware they support instead of the OS? Screw the OS saying whether or not it's legit, does the actual hardware it's meant for say it's legit code?
Re:Possible mitigation? (Score:5, Funny)
Yes, that's working out really well for Motorola's publicity department with the Droid X just now.
Re: (Score:3, Interesting)
There is a small difference to note, however; One is addressing an entire hardware set (motorola) the other is using code from a piece of hardware (is it a sound card/network driver certificate that got jacked?)
Actually, bad example. let me see what my medicated brain can re-think.
It's more like this, Motorola is stopping you from using hardware you purchased in a manner you wish with a hardware security check, where on the other hand, someone usurped a certificate from Realtek and used that to bypass secur
Re:Possible mitigation? (Score:5, Informative)
Did you even read the summary? Realtek's signing keys were stolen. That's why Verisign revoked them. Putting the verification keys in hardware wouldn't fix this issue.
Re: (Score:3, Insightful)
Re: (Score:2)
Did you read my idea? Run verification key PLUS CODE through the hardware itself. If the key matches the hardware but the code produces BS results in the hardware (such as a nonsensical static when it should get several test tones,) then it gets denied.
Re: (Score:2)
So, you're saying you want to be stuck with the buggy driver that ships with the hardware, rather than the at least semi stable one that ships a year later?
Re: (Score:2)
Nothing short of fully sentient artificial intelligence can tell malicious code from non-malicious code. And even that can only make an educateted guess, and will be wrong every now and then.
Re: (Score:3, Informative)
Brilliant idea.
Re:Possible mitigation? (Score:4, Insightful)
And all of that just because microsoft refuses to make a secure operating system [...]
Can you outline what features and capabilities of a "secure operating system" are missing from Windows ?
Re: (Score:2, Troll)
lack of a *.lnk based root kit, the ability to audit the source, the lack of ability to run 99% of the viruses in the wild.[1]
Can you run any version of windows from something like a ramdisk, so there is no real way to write to the disk? how about the old, start the system up, shut it down, but leave iptables running router hack? A highly transparent bug/flaw reporting system, with a quick turn around?
If you hear of a mac mini pro, let me know. :)
[1]yes yes, all strawmen, but the issue for me is the last ve
Re: (Score:2)
How about fixing vulnerabilities when they're found, for starters? This is what the discussion is about -- MS's refusing to fix a known vulnerability in their newest operating systems. This is an EPIC security fail. Getting rid of the deeply flawed "securith through obscurity" where they know about a vuln but stupidly, arrogantly, and unethically thinking nobody will find it for another. Not getting rid of hActive-X. And that's just for starters, the list is almost endless. MS appears to not take security s
So no then (Score:2)
You cannot, in fact, point out what is missing, what you think needs to be done different. You are simply parroting "Windows = insecure" without any real understanding.
Because remember, if a single bug showing up means the design is insecure, then Linux is insecure. There have even been vulnerabilities in the kernel. Not many, but again if it is a case of "There was a flaw so this design is insecure," then Linux is insecure.
Re: (Score:2, Insightful)
Re:So no then (Score:4, Insightful)
And that's the essential difference. Linux had many flaws, and all were fixed in a timely manner, acknowledged and corrected. Correcting them might have been a pain in the ass but it was always possible. Which is not the case here. The flaw exists but it's rooted so deeply in the design that removing it without a major overhaul and breaking lots of compatibility is impossible. Insecure is not a system that has flaws, but one that has flaws that can't be fixed within current framework.
Re: (Score:2)
Also, the thing about "features and capabilities" is that they tend to be a check in the box. Yes, it has a particular feature (check in the box) but its so poorly implemented that you'll need a 3rd party to augment or outright replace it (still a check in the box).
For example ?
Re: (Score:2)
Re: (Score:2)
Defragging a Linux hard drive is only necessary under certain conditions. One is if you shrink a partition by a fair amount. Another is if you run your partitions at more than 80% full. The last one I know of is related to very odd file usage in which you regularly replace thousands of small files with very large files, something that doesn't happen very often in real life usage. That said, in 7 years of running Linux I've never found it necessary to defrag a hard drive.
Quite the opposite was true for NTF
Re: (Score:2)
De-fragmentation is a necessary evil but it should be done silently and automatically using the computer’s idle background resources.
Re: (Score:2)
That's how come online defrag is going into ext4.
Re: (Score:2, Informative)
drsmithy has always shown wilful ignorance of Microsoft's flaws.
As far as what's lacking from Microsoft's security model, managed software repositories and good updating systems are the most obvious lacks.
In addition, Microsoft's need to leverage it's existing software stack means anyone who actually uses Windows instead of just ticking off feature lists will inevitably have to bypass or disable most of the recent security features. With the virtualisation tech they've bought,
Re: (Score:3, Insightful)
Why is this modded Troll?
Because it's a troll. Much like the Slashdot headline and summary.
drsmithy has always shown wilful ignorance of Microsoft's flaws.
I frequently ask the question, yes. But (as has happened again) the responses rarely get any more advanced than "hurr, durr, viruses malware Micro$oft LOLz".
As far as what's lacking from Microsoft's security model, managed software repositories and good updating systems are the most obvious lacks.
Both are present in their security _model_. For
Re: (Score:2)
Indeed, I should patent it quickly, so that it may not come to pass without my blessing!
Re:Possible mitigation? (Score:4, Insightful)
And because the users refuse to switch to an operating system that works.
The number of PC users is about 1 to 1.2 billion, based on most estimates I've seen. That would put the number of Windows users at 900 million to 1 billion, at all skill levels.
I will take that as pretty strong evidence that the Windows OS works just fine for those who use it.
In that way, when companies refuse to develop free drivers for GNU/Linux, we won't be able to make our own because the hardware will reject them.
I suspect that signed drivers are inevitable, whatever your platform.
Re: (Score:2)
Join the dole, 3 million can't be wrong
Re: (Score:2)
Re: (Score:3, Insightful)
The number of PC users is about 1 to 1.2 billion, based on most estimates I've seen. That would put the number of Windows users at 900 million to 1 billion, at all skill levels. I will take that as pretty strong evidence that the Windows OS works just fine for those who use it.
I don't think I've ever met a non-nerd that even knows what an OS is. When I tell people there's a free replacement for Windows that doesn't get viruses, their jaws drop; they have no clue. Windows came with their computer and it's al
Re: (Score:2)
This is not insightful at all. Appeals to mob mentality and extending from "it has a lot of users" to "it must be good" is a major logical fallacy that is repeated far too often here.
If you haven't notices, most arguments here are one form of logical fallacy or another. The ad hominen fallacy is the most popular.
Re: (Score:2, Troll)
Would you stop that free market bullshit?
It's ***NOT*** "free market bullshit". It's ***YOU*** taking control of your purchaseing and buying products that work for you, rather than bitching, moaning, and complaining about Microsoft. If you ***LIKE*** to bitch, moan, and complain, I imagine that you are married or getting a divorce. But most people AVOID bitching, moaning, and complaining. So buy stuff that works for you and leave the rest behind. UNLESS you are like RMS, and just like to BITCH MOAN AND COMPLAIGN about Microsoft.
Re: (Score:2)
Companies should be regulated, and the implied warranties should be extended, to cover more things for certain products.
This message brought to you by the Trial Lawyers of America, LLC.
Re: (Score:3, Funny)
Did you bring enough to share with the whole class?
Re: (Score:2)
There's a reason no computer can detect that it's in an infinite loop. Study Turing someday.
Actually, you study turing harder – the halting problem doesn't say it's impossible to prove that you're in an infinite loop. It says that there exists some program(s) in which it's impossible to tell if you're looping infinitely given an input.
Careful with that idea... (Score:3, Informative)
The ATI video card I have fails hard on XP64, so I got a driver some random guy that has nothing to do with ATI made instead, and it works great. If I were stuck using only drivers that were ATI-approved, I'd be majorly SoL.
I'm all for having the hardware verify that the driver actually is a valid driver for the hardware in question, just make sure that's ALL it does, or we'll lose the ability to use someone's hack to force a piece of hardware to work.
Re: (Score:3, Funny)
Welcome to the world of ATI-Fail. Enjoy your stay
Re: (Score:2)
Check out Omega Drivers [omegadrivers.net]
Re:Possible mitigation? (Score:4, Interesting)
Re: (Score:2)
yep, and it's what the "TIVO" clause in the GPL3 is for. I bought the hardware, I can do as i like with it, including blend it, make it into a rocket(not for sooting at something, but like a model rocket), use it to prop the window open, etc. The reason that TI doesn't like it, is they sell the same hardware with additional software features for a premium this way, and people buying a lowend calculator and flashing advanced firmware on it hurts their profit part.
Re: (Score:2)
It also assumes the hardware has enough processing power - on its own - to handle approving the driver. That's not easy when the driver very possibly supplies the firmware that the hardware executes.
Re:Possible mitigation? (Score:4, Interesting)
We should not care about security too much. Security is the opposite of freedom, and by concentrating our efforts on security we may end up with completely locked environment.
It's better to tolerate certain threshold of hijacked/owned computers than to require hardware verify the software.
Re: (Score:2)
We should not care about security too much. Security is the opposite of freedom, and by concentrating our efforts on security we may end up with completely locked environment.
Welcome to the physical world. If you do not like security and are afraid to be locked out of your own house, you are free to remove the lock on your front door.
Re: (Score:2)
No, it isn't. You do not have to sacrifice freedom to gain security. Yes, that's what the authorities have been telling you forever, but that's just because they want/like the power that comes from limiting freedom, and use people's fears to make them think that they will be more secure if their freedoms are reduced. But it's bollocks.
Freedom is not antithetical to security. You can have both. In fact, it has generally been shown that the less free a society is (think pol
Re: (Score:2)
I don't see how you can have both. You can have some trade-off between those, but not both. Law is one of such trade-offs - you aren't free to kill people, but you're safe from being killed yourself.
And as a former Soviet citizen I can testify that living in a police state IS safe, if you agree to follow the rules (e.g. if you limit your freedom...). Whether or not this means that the state itself is
Re: (Score:3, Funny)
So unsigned drivers cause rape?
That is the fattest straw man I've ever seen.
You just proved his point (Score:5, Insightful)
See to secure against that, to truly secure against it, he'd have to lose all freedom. Children are soft targets, the only way to keep them secure from kidnapping is to have them under guard 24/7. Keep your kids in a locked compound with armed, trusted, guards and they could be secure (though even that could be overcome). If you want them to live a normal life, well there are risks.
So your complete and total paranoia bullshit actually proves the GP's point: Getting too paranoid about security is stupid. In the real world, there's no such thing as perfect security. If you think there is you are lying only to yourself. As such you want to design your security for two things:
1) Good enough to stop the attacks you are likely to face. You don't want to get all crazy and speculate on shit you aren't likely to see. You aren't guarding nuclear secrets, secure your house accordingly. Have it good enough, not stupidly overboard.
2) Relaxed enough you don't screw over your life. Living in a continual state of locked down paranoia and denying yourself everything because of supposed risks is no way to live. You want your security so it doesn't harm your ability to enjoy a normal life.
Also if you are dealing with someone deranged enough to try and stalk you to this degree, they needn't get in your computer to do it. You think you are safe? Not hardly. I hire a competent private investigator, they'll track you down, no breaking in to your computer needed.
You either need to be way less dramatic, get a sense of perspective, or get professional help. Maybe all three.
Drivers aren't just for hardware (Score:2)
Couldn't they just start making driver signatures verify with the hardware they support instead of the OS?
That's a really, really bad idea.
Drivers are for hardware, yes, but they're also for software too. As soon as you switch to that type of signature verification model, you lose the ability to load drivers for virtual hardware, like ImDisk. [ltr-data.se] Microsoft's iSCSI initiator is also a virtual mass storage driver, and that wouldn't work either.
There's probably a gazillion other examples, but generally speaking, driver and software signing as it's currently implemented is working well enough for most things. It's
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
"the driver will have to tell the OS whether or not the hardware says the driver is legit. "
Just give it something similar to a POST. Make it OS agnostic. If the signed code comes from a video card, run the code to see if it's capable of handling what would be required to run a video card.
This doesn't break a goddamned thing, to those that think it does. If you write your video driver PROPERLY, it will check with the video card fine. a tiny rootkit with hardly any functionality will most likely not, and thu
Was there a point to this? (Score:2)
Re: (Score:2, Interesting)
it's hardly an OS problem if some wanker has written a nasty driver then signed it with a legit cert
dam i consider most of my linux wifi driver malicious
Re: (Score:3, Insightful)
it's hardly an OS problem if some wanker has written a nasty driver then signed it with a legit cert
I somewhat disagree: it clearly shows the flaws in an either/or trust model of that kind. Either it's signed and it's trusted to do anything at all to your system or it's not trusted to do anything at all... you only need one rogue signing key to break that model.
Re: (Score:3, Insightful)
Re:Was there a point to this? (Score:5, Informative)
Do you propose a better model?
Yes, don't trust anything unless you absolutely have to. In user land, for example, we have SELinux and Apparmor to prevent applications from accessing things they shouldn't; protecting the kernel is obviously harder.
How about the Linux model, where if the user decides to load it then it can do absolutely anything with the system?
Generally speaking, Linux drivers are only installed if signed by the distro repository, and you have to trust that key: if it's compromised you're toast. Windows has three bazillion drivers signed by three bazillion keys and only one needs to be compromised.
Nor will Linux drivers be loaded automatically from a random USB key just because you browsed there.
Re:Was there a point to this? (Score:5, Interesting)
Generally speaking, Linux drivers are only installed if signed by the distro repository
Actually, for most distros, "drivers" (code executed as root, which is the main barrier in a Linux-system) are installed if they're signed by _any_ key in the keyring, including 3:d-party repositories.
Many people add 3:d party repositories to access newer versions of various packages, or packages not included in the distro, significantly increasing the attack vector. If you manage to get a hold of a key for any of those repository-signers, you pretty much have root-access to thousands-millions of users.
One of the things Linux distributions must really rethink is the concept of 3d-party software, and how it can be integrated and allowed more safely than it is today.
One concept could be special repository-system for 3:d-party packages, chrooted to separate container, and not allowed to execute any scripts during installation (or allowed, but at non-root privileges). Another idea could be per-user installs of 3d-party apps that installs to $HOME/.local or similar, and never root.
Re: (Score:2)
This is still far fewer keys than a Windows install has, and you still need to get the package into the repos as well (so you need to steal a key an crack a repo server).
In addition, no key will let you attack more than a fraction of Linux installs. It would be nasty if someone got hold of an Ubuntu key (as its the most popular distro) and they managed to place a package on the Ubuntu repo server, but most Linux installs would not even be exposed to the risk, and only those Ubuntu users who install the malw
Re: (Score:2)
I have exactly three keys on my keyring: Adobe, Fedora stable, Fedora testing. I seem to remember that, with the addition of RPM Fusion, this is all that Fedora users ever install, statistically.
My roommate has an HP printer, Wacom tablet, nVidia graphics card, Logitech trackball, Intel motherboard, and Creative soundcard. Not counting plug'n'play drivers, he's already going to have more keys to track if he ever upgrades from XP.
Just an anecdote.
Re: (Score:2)
A point of open source is that everything is third party. Now we should have open source emulate the Steve jobs theory of software? All your codes belong to me?
Free or fool-proof: pick one.
Re: (Score:2)
Nor will Linux drivers be loaded automatically from a random USB key just because you browsed there.
That's the big point. It doesn't matter if drivers are signed or not nor does it matter if someone steals a random signing key IFF the OS doesn't go installing drivers from random USB keys that get plugged in.
USB devices are well defined so that as long as the vendor doesn't do something incredibly stupid like hiding all of the functionality behind a vendor specific extension, you don't usually need a bunch of special drivers.
For the exceptions or where the USB driver is just enough to let a userspace progr
Re: (Score:2)
Still, on most Linux distros you're talking about maybe a dozen keys that the user themselves specifically trusted, and the chances of any 2 Linux users trusting the same 3rd party will be remarkably small. Under the Windows model, any Verisign trusted certificate will get you access, there's got to be millions of those (unless they restrict drivers to a different root certificate than app or website signing, but even then it'll be in the thousands), and if any one is compromised then every Windows user w
Re: (Score:2)
Which is why I say that simply being signed is not a good enough reason to just let some driver on a random device be installed.
Re: (Score:2)
Yes, don't trust anything unless you absolutely have to. In user land, for example, we have SELinux and Apparmor to prevent applications from accessing things they shouldn't; protecting the kernel is obviously harder.
You can set Windows to trust even less. In general a user can't install drivers at all on Windows, it takes an administrator to do it. If the administrator decides to install something without checking it well first, you're boned no matter what other steps you took.
Nor will Linux drivers be loaded automatically from a random USB key just because you browsed there
This is not a problem with the model, it is a bug in the implementation. Are you saying linux doesn't have any coding errors in it?
With this bug, the code only runs as the current user. So if the current user isn't an administrator, there's no ri
Re: (Score:2)
>>>It's like saying a politician told a lie.
Yes but some people still think politicians/government are completely honest so they need a reminder from time to time that they aren't. Likewise some people think Windows is safe. Just this morning a Slashdotter posted that Windows is no more insecure than Linux. This story proves them wrong. (If this was Linux it would be fixed within a week, but some resourceful OSS programmer.)
Re: (Score:2)
Re: (Score:2)
Yeah, Microsoft already has our money. Why would they bother trying to fix the problems? This is the problem with near-monopolies.
Every single patch and update Microsoft has ever released refutes your broken argument.
Source? (Score:5, Insightful)
Re: (Score:2, Troll)
Microsoft statement via Technet blog:
http://blogs.technet.com/b/mmpc/archive/2010/07/16/the-stuxnet-sting.aspx [technet.com]
Re:Source? (Score:5, Informative)
Re:Source? (Score:5, Funny)
Here's a picture of a pony:
http://babybird.files.wordpress.com/2009/08/pony.jpg [wordpress.com]
What are you trying to do here? There still is no outright refusal to fix this.
Instead it says:
Re: (Score:3, Funny)
Here's a picture of a pony: http://babybird.files.wordpress.com/2009/08/pony.jpg [wordpress.com] [wordpress.com]
Gah, whyfor are things (badly) photoshopped out of the left and right sides of that image?
Stalin, is that you?
Re: (Score:2)
We recommend that customers follow the guidance provided in the Security Advisory, making note of mitigations and tested workarounds. We will continue to investigate the vulnerability and, upon completion of that investigation, we will take appropriate action to protect our customers.
So they'll fix or it not fix it once they've complete their investigation of the problem.... sounds about right.
MS isn't Apple (Score:2)
With their market share, any small looking issue could become a global disaster. Add the fact that, new fashion "free antivirus" stuff rarely has decent heuristics to catch such a complex behavior, you get the picture.
Apple, with their current desktop marketshare are free to ignore such issues for couple of months but when we speak about Microsoft Windows, small issues really becomes very critical.
They acknowledge the issue doesn't matter a thing. Especially if the issue is so simple so any script kiddie ca
Re:Source? (Score:5, Informative)
there is no link here to any article that claims Microsoft has no plans to patch the flaw.
To be fair the summary states
it has no plans to patch the flaw right now
Which is in the 2nd link actually.
Microsoft said it is investigating the flaw and looking at possible solutions, however there was no clear indication that the company intends to patch the flaw in the near future.
Well, from that quote to the summary, there is quite a stretch, but what did you expect ?
Well since we're going with semantics... (Score:2)
Re: (Score:2)
I know Slashdot's editorial standards have dropped, especially when it comes to Anti-Microsoft articles, [...]
That's not really correct. Slashdot has excellent editorial standards when it comes to Anti-Microsoft articles, and have been serving up some of the best ones on the Internet for going on a decade now.
Re: (Score:2)
I swear we get this article every couple of months. The google researcher patch was released this patch cycle after slashdot gave us a dozen breathless articles about how MS won't fix it. Its our two minute's hate. Yet, people still buy it. I guess if you're so anti-corporate you'll believe anything that is compatible with your bias. Its like guys who are into 9/11 conspiracy theories who later talk to you about UFO abductions and the hushed-up car that gets 100 mpg or somesuch. They want to believe bullshi
Can someone explain how it works? (Score:2, Interesting)
I didn't put it through exhaustive tests, but I actually tried to make some link files and put them on a usb drive and have them install something when I accessed the shortcuts in Windows explorer. No luck whatsoever. I looked for some working examples but I couldn't find any, either.
And funny, I did some work for a large oil/gas company that stored the config files for some flowmeters on usb thumb drives and left them in the battery boxes. It was really fun when the first wave of thumb drive viruses hit! T
Re: (Score:2)
Well, it's clearly some kind of bug in the icon handler for shotcuts, as Microsoft's workaround is to disable that with Regedit, which results in every shortcut having the generic file icon (a rather plain looking Start menu results). I'd guess it some sort of buffer overrun related to custom icons in the shortcut or something like that. Quite nasty really, you look at a directory with Explorer and Windows will execute code because Microsoft seemingly can't load an icon without it causing a major problem.
Ju
Re: (Score:2)
The MS Security Advisory (2286198) [microsoft.com] states,
The vulnerability exists because Windows incorrectly parses shortcuts in such a way that malicious code may be executed when the user clicks the displayed icon of a specially crafted shortcut.
Sounds like a vulnerability in the way the Details panel in Explorer is updated when the user highlights a maliciously malformed icon. However the MS page did indicate that the user has to actually click on the icon, so it appears that simply autoplaying the drive would not be enough to infect you (unlike some of the PDF/JPEG - or was it PNG - exploits that I seem to remember which infected your computer by an exploit of the code that generated the Explorer thumbnai
Re: (Score:2)
Well, looks like I might have misunderstood the advisory. Further down in the details:
When attempting to load the icon of a shortcut, the Windows Shell does not correctly validate specific parameters of the shortcut. ... An attacker could present a removable drive to the user with a malicious shortcut file, and an associated malicious binary. When the user opens this drive in Windows Explorer, or any other application that parses the icon of the shortcut, the malicious binary will execute code of the attacker’s choice on the victim system.
From this, it appears that the part about clicking was rather misleading in that you do not have to click the icon for the exploit to execute.
However, it also requires a secondary malicious binary in addition to the malicious shortcut, and it seems to me that AV software could easily be updated to detect and clean this sort of malformed file. In the meantime, I would suggest disabling Autoplay and using particular caution
Who fault is it? (Score:5, Interesting)
I think Microsoft is right on this issue. This problem is truly not theirs, except for the amount it negatively affects them. (Which they can do little except attempt spin control on the issue.)
They designed their driver verification process intelligently: By implementing the requirement of the drivers being signed by an appropriate third-party certificate registrar (VeriSign in this case), thus leaving the issue of managing the business of encryption keys to the established so-called "experts".
Part of the process of obtaining a trusted VeriSign cert such as the device driver key involves the company desiring a high-trust certificate of this nature involves signing and complying with a detailed set of procedures describing the physical/organizational processes how to handle and store the signed keys in a very secure and documented "chain of trust".
In the case where the security chain was broken by a (previously) trusted third party, in this case we'll probably find that RealTek is the cause of the issue by not properly following the chain of trust requirements, or how else would a rogue employee be able to sign his malicious driver?
<CoolStoryBro
A decade ago, I was a systems engineer for the internet banking division of a large bank that owned a bunch of other regional banks, and I was a "primary key custodian" (A defined role in the chain of trust requirements), so I was the one who would handle the technical details as far as getting the cert created and installing it on the web banking servers. (Just SSL certs rather than driver signing certs, but at the core they're the exact same thing.)
The amount of procedural rigamorole for handling the certs was complex, and well thought-out. I would create our private key in front of a few handpicked suits from corporate and data security who would observe me as I created our unsigned private key, then I would look away while one of the security people entered a complex password that I was not allowed to know, then I would get the cert signed by VeriSign which would require the security guy to re-enter the password that I did not know, then we would get the certs back, print out several copies, seal them in an envelope, all of us would sign it and take it to a safety deposit box. The security guys were not allowed to have a copy of the unsigned private key, and I was not allowed to know the password to the VeriSign-signed (VeriSigned?) key.
[And it's been 10 years since I worked there, and the certs were only one-year certs (renewed each year going through the same type of process), so don't come try to hold me hostage for any info about the bank, my info expired 9 years ago! :) ]
</CoolStoryBro
So it looks like RealTek may have dropped the ball on their cert handling procedures. Maybe VeriSign was lacking in their process auditing as well. Who knows? (I don't)
But to blame this one of Microsoft is assinine, how were they supposed to do anything different?
I suppose Microsoft could release a Windows update that revokes trust for any cert signed by VeriSign, but would be devastating to online commerce as VeriSign has a near monopoly on the certificate registry market, so encryption would suddenly stop working on nearly all online businesses overnight. // But the bright side: All those sites would still work in the morning on Linux, giving it a huge boost! :) /// But on the dark side: All those sites would still work in the morning on Macs as well, giving the idiocracy movement a huge boost as well. :(
Re: (Score:2, Informative)
The flaw that isn't going to be fixed "in the near future" is the "if a shortcut's icon is shown in Windows Explorer, then automatic execution of malicious code may occur" (perhap's this is some sort of buffer overflow in the icon parameter reader?). The best workaround? Disable the display of icons for shortcuts. Attack vectors? WebDAV, USB sticks, and LAN shares mostly. To that end, I'd imagine Microsoft is directly at risk given they likely have multiple rather huge LAN and it's already been demonst
Re: (Score:2)
The flaw that isn't going to be fixed "in the near future" is the "if a shortcut's icon is shown in Windows Explorer, then automatic execution of malicious code may occur"
I’m still not sure where that idea comes from. Microsoft admitted a flaw in the icon display code for shortcuts (“When attempting to load the icon of a shortcut, the Windows Shell does not correctly validate specific parameters of the shortcut.”), so presumably they will be patching it shortly.
Re:Who fault is it? (Score:5, Informative)
Do you have any familiarity whatsoever with this situation?
.lnk files (shortcuts). That flaw is being exploited to install this malicious driver. The problem has been greatly compounded by the fact that the driver is signed by a previously-trusted private key, but this is not the original flaw. Normally the act of merely plugging in a USB thumbdrive does not immediately install system software such as device drivers. It is that acknowledged .lnk flaw that makes this possible.
Windows has an acknowledged flaw/vunlerability related to its handling of
If you can install a hardware driver with an exploit, you can also install a worm, rootkit, etc. This attack happens to install a device driver. If Realtek's private key had never been compromised, then instead of installing a malicious device driver, you'd have Windows users plugging in infected USB thumbdrives and immediately becoming members of botnets. The flaw is in the Windows system and its handling of shortcut files.
It is that flaw and only that flaw for which Microsoft is being blamed.
Why would they do that when Verisign can revoke only this specific Realtek cert? In fact that's exactly what they have done.
Seriously. Did you even bother to read the summary? At all? I'll quote it for you. This is the summary, verbatim:
Emphasis is mine. Now go clean the egg off your face.
Re: (Score:2)
Working as intended? (Score:4, Insightful)
I'm not Windows expert, but isn't this exactly the way the certificate system is supposed to operate? This sounds like a security success story, not a failure.
Driver needs certificate to work with OS. Driver is found to contain security flaw. Certificate is revoked, OS refuses to recognize driver, security hole is closed. Now driver manufacturer has to clean up their act before their drivers are allowed back in the house.
The headline reads "Microsoft has no plans to patch new flaw", but isn't the certificate revocation at least as good as a patch? More so, because it seals off any *other* undiscovered bugs in the driver? Or am I missing something?
Re:Working as intended? (Score:4, Informative)
I'm not Windows expert, but isn't this exactly the way the certificate system is supposed to operate? This sounds like a security success story, not a failure.
Driver needs certificate to work with OS. Driver is found to contain security flaw. Certificate is revoked, OS refuses to recognize driver, security hole is closed. Now driver manufacturer has to clean up their act before their drivers are allowed back in the house.
The headline reads "Microsoft has no plans to patch new flaw", but isn't the certificate revocation at least as good as a patch? More so, because it seals off any *other* undiscovered bugs in the driver? Or am I missing something?
Please see this post [slashdot.org] where I correct a similar false notion. Then, please berate your teachers for failing to transmit basic reading comprehension skills to you. Hint: the signed malicious device driver is incidental and is not the flaw that Microsoft may or may not patch.
Sorry for the tone but I just don't see what part of this is difficult to understand.
Where did 'no plans to patch' come from? (Score:4, Insightful)
The article doesn't say it, and at no time was Microsoft reported as saying there were no plans to patch this bug.
Just because you are unaware of them reporting they will release a patch does not mean they have no plan to patch it.
They have offered workarounds and appear to be treating this seriously.
Just because it's the weekend and they haven't told you there will be a patch available monday DOES NOT mean they are ignoring or refusing to work on patching this.
Do Windows use CRL/OCSP by default? (Score:2)
On OS X; you have to run "Keychain Utility" and its preferences to enable OCSP functionality to check certificate revocation. Does Windows mechanism to check certificate revocation run by default?
So, revoking certificate won't mean a thing until some windows update (aka updated root certificates) comes. That would -of course- change if Microsoft takes it serious enough to ship a 5 KB (yes, kilobyte) Windows out of band update which won't require reboot or impossible to cause issues.
Don't they have slightest
Just wondering... (Score:2)
...If the reason for the Delay in fixing the bug is with purely commercial...
Think about it.
MS probably own a fair whack of shares in most of the big AV vendors. MS tips off the vendors of the exploit and they find a way to mitigate the effects (not fix the problem).
The Vendors then use the month or so between MS scheduled updates to panic the masses that they need to renew their AV subscription to help with this new virus attack.
Once they have milked the masses for a month or so of re-subscriptions, MS the
Re:goodie the certificate is revoked!! (Score:4, Insightful)
In this case, I think the question is whether Windows checks the certificate revocation lists. It is a code signature, nothing to do with the browser per se.
OS X is same deal (Score:2)
On OS X, you gotta enable OCSP/CRL functionality via keychain utility preferences which means, 99% of people didn't enable at all.
Of course, with OS X logic of working, almost entire OS becomes OCSP aware and with 5 years of usage, I haven't seen a single issue resulting from that setting. I have no clue why Apple doesn't enable it either. Of course, OS X doesn't have "signed drivers" (in logic of Windows) but it would really matter if some big idiot website lost their certificate.
Re: (Score:3, Insightful)
Re:Certificate revoked (Score:5, Informative)
No. Windows' security model only checks the certificate during install.
And even so, it doesn't update the revocation list automatically on install, nor does it check with OCSP; you won't get the revocation certificate unless you specifically install "Root certificate updates" through Microsoft Update, which is usually is found on the "optional" installs. So chances are that a lot of people will be able to install this malware in the future too.
Re:Certificate revoked (Score:5, Informative)
Windows' security model only checks the certificate during install.
64-bit versions of Vista and Windows 7 require a valid Class 3 code signing certificate to load the driver, not just on installation. Revoking that certificate will stop the devices from working, as the parent poster suspected. Though it may not be the same certificate for all Realtek uses.
Re: (Score:2)
No, they require a Microsoft Windows Hardware Compatibility signing certificate for loading on 64-bit systems, which the Realtek certificate isn't.
The 3rd party root signing certificates are just checked when installing.
Re: (Score:2)
Re: (Score:2)
So it can be installed without the user being told that it doesn't have a valid certificate. Not so it can run drivers on 64-bit Windows.
To recap, no, the OP does not have to reinstall his RealTek drivers.
If he runs 32-bit Windows, there is no driver signing check except on installation, and his drivers is already installed.
If he runs 64-bit Windows, the drivers are signed by Microsoft, not Realtek, and invalidating the Realtek signing cert won't affect it.
If (a) Microsoft publishes a revocation for the ce
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
This can be worked around, but the steps are quite arcane. It's pretty annoying if you want to things like run unofficial drivers, making it arguably the biggest flaw in 64-bit Windows.