Feeds

back to article MS preps emergency patch for Windows shortcut peril

Warning of an uptick in attacks, Microsoft plans to issue an emergency update to patch a critical Windows vulnerability that hackers are exploiting to seize control of PCs. The patch, which fixes the way Windows parses shortcut icons, will be released on Monday at around 10 a.m. California time. It comes two weeks after reports …

COMMENTS

This topic is closed for new posts.
Stop

I'm confused

We were told that Vista was a completely new version of Windows - re-written from the ground up and that it was "secure by design". If that is the case how can this security hole affect every version of Windows.

Or were Microsoft simply lying to us..... again?

13
2
Anonymous Coward

I'm confused too...

are you too dense to recognise that marketing does not equal reality? I mean, do you REALLY think that those sugary breakfast cereals are part of a better balanced diet? Do you REALLY think that bottled water is totally pure as the driven snow? Do you REALLY think that a subcompact Chevy is actually as safe in a crash as they swear to you it is?

Hmmm. Or are we just somehow expecting IT marketing to actually, for some miracle reason, actually be LITERALLY true in every detail, whereas every other thing in our lives gets a pass?

I'm not saying it's not a bad thing that this wasn't fixed, but honestly, all the anti-vendor marketing speak sometimes feels like listening to 14 year olds....

4
14
Gold badge
Flame

No passes

"Or are we just somehow expecting IT marketing to actually, for some miracle reason, actually be LITERALLY true in every detail, whereas every other thing in our lives gets a pass?"

I can't speak for the OP, but I grant no passes. All marketing lies are offensive. The sub-text in every case is "We think you are stupid enough to fall for this and have no moral qualms about exploiting other people's stupidity for our own personal gain.".

8
0
Stop

Not an outright lie however..

The problem is, in this case as in so many OTHER cases of marketing speak, that it isn't a total lie.

Anyone who knows much about Vista will understand that substantial areas of the kernel and the device driver models WERE totally re-written from XP, to avoid many types of attacks. They broke a whole lot (i..e., ALL) of 3d party device drivers to do it, too. So we can see that that happened - in fact it happened to such a degree that Vista got a terrible reputation for how many devices didn't have drivers for it after it launched....

But an OS is more than just the kernel and the device driver models - it has all sorts of ancillary helper programs and services, some of which were re-written, some of which were not (as it seems with this one).

So how SHOULD MS go about publicizing the rather large amount of work they did on their kernel, et al? Should they say - "well, we totally re-wrote 25,000 function points of our operating system, but we didn't get around to 55,000 function points of the helper apps?" YEAH, I think not, not at least to Joe Sixpack buying his home computer at Best Buy or Tescos. Function points? I mean who besides Computer Science grads even know what they are?

So what metric should they use? Lines of code? Umm, high level or assembler? Megabytes of executables? I mean, what makes sense?

The answer is that NONE of it makes sense to the vast majority of people that buy Operating Systems. SO - MS, knowing that they really, really did re-write the major sections, simply says "we re-wrote it from the ground up." Because there is no good way to quantify how much they actually did do - and it kind of makes sense.

Same thing with the Chevy subcompact. Now, Chevy subcompacts actually have pretty marginal crash scores in many cases, compared to other cars on the road. But a point CAN be made that all of them are much, much safer than subcompacts of 10 or 20 years ago - MUCH safer. So are they lying when they say they are safe? Yes...and no. Not a clear answer.

Somehow, it seems that CAVEAT EMPTOR has been forgotten...and people keep looking for anything that is not perfect as evidence of ill-intent and deception, rather than admitting that ANYTHING that is created by man is imperfect...

4
2
Stop

RE: Not an outright lie however..

Considering that they ripped big chunks of NT from BSD, I would expect Windows to be as secure as BSD.

Unless or course, Microsoft are a big bunch of idiots.

Oh, wait...

1
2
Gates Horns

I'm not confused

Microsoft lie.

They always have.

MS-DOS was not developed by Microsoft.

NT was NOT paradigm shifting - it had large chunks copied from (I think) BSD. Not the best bits though!

95 was almost as good as some of the operating systems on the Unix machines at my uni...

Vista was not good.

At that point I stopped listening to them and stopped buying any more of their crap.

3
2
Bronze badge
Boffin

Not BSD...

The architect of NT was Dave Cutler, ex-Digital Equipment Corp, so I have always understood that NT had little to do with BSD, but a whole lot to do with VAX OS. I believe some research will show such beliefs to be common to those of us that were around the industry about that time (I've done a little bit of work on VAX OSes, including the real-time variant).

Now, it is true that BSD was ported to run on the VAX architecture, and many VAX machines did end up running BSD, but BSD had little if anything to do with the VAX OS as originally developed by DEC and later copied by MicroSoft's team of ex-DEC developers (Cutler brought several of his DEC team to Redmond). VAX OS was in many ways a more technically accomplished OS than BSD, including heavy-weight clustering and multi-processor support when such things were almost unheard of...

4
0
Boffin

The clue's in the name

As I remember is WNT is to VMS as IBM is to HAL ....

0
0
FAIL

RE: The clue's in the name

The HAL from IBM is an urban myth so it's probably true that the other is too... unless of course you can come up with a reliable citation.

0
0

Fantastic

Had it not been for the pressure applied by the security researcher, buy disclosing this flaw MS would still be sitting around with their thumbs up their asses.

I am all for public disclosure.

Having read the "hurry up and wait" part of their disclosure document, I find it's complete bunk.

Sooner you publish a hole, sooner it gets fixed.

4
1

confused

Dear Confused,

it's simple.

You are right.

They lied.

3
0
Happy

"rarely" ?? Really??!?

>Microsoft rarely issues patches outside of its monthly schedule ...

>By our count, this is the third time this year Microsoft has issued

>a so-called out-of-band update.

Today is still July, month number seven.

How the heck is three out-of-band in seven months "rare" ??

If this is rare then I hate to think how charred "well-done" would be.

5
1
Gold badge
Happy

Re: rarely

It's rare compared to the number of patches issued in-band.

2
0
Silver badge

I'm suspicious

Why did they decide to fix this particular critical Windows vulnerability? They must be up to something.

2
3
Bronze badge
FAIL

**facepalm**

Did you not read the article? In there is the reason why they're fixing it, and fixing it early.

2
2
Silver badge

**facepalm** indeed

"Did you not read the article? In there is the reason why they're fixing it, and fixing it early."

You must be new around here. We _all_ know "why they're fixing it and, fixing it early". Did you not read the comments, or is humour not your strong point?

1
1
Bronze badge
FAIL

Well if you all know...

... then silly trolling comments don't need to be published.

You must be someone who likes trolls.

0
1
Anonymous Coward

"achieved the appropriate quality bar for broad distribution to customers"

i.e. "it compiled"

10
0
WTF?

Typical

I wait well over ten years before thinking a Win32 OS might be safe enough to trust, finally upgrade the other half's PC from W98 to XP (not many of these vulns affect W98 or Acrobat 5 or ...), and instantly there's yet another string of holes wide enough to drive a tank through.

If only there was an alternative...

;)

0
0
Linux

Title

Your right!

An alternative to Windows is needed. Maybe we could get some sort of programing community based effort to create something that would work on the same hardware as Windows, hell maybe others could create applications the would be compatible with MS apps like Office.

If only ...

7
1
Thumb Up

Fix Available Now

A temporary fix is available. See the article Free Toolset Fixes Windows Shortcut Flaw date July 29, 2010 at http://www.infopackets.com/

0
1
Coat

Solution.

"Warning of an uptick in attacks, Microsoft plans to issue an emergency update to patch a critical Windows vulnerability that hackers are exploiting to seize control of PCs."

Does their emergency patch consist of supplying you with a non-MS operating system and a windows emulator?

3
0
Pint

"emergency update"

I have my tin foil hat on will this protect me?

Beer Icon. Because its the only thing that seems never to be effected by a Zero Day exploit....

0
0
Silver badge

But the breweries have SCADA systems...

If they mess with our beer, they will have a war on their hands.

0
0
Alert

The amount of times...

I see XP with only SP2 or Vista with only SP1 is silly!

I say force people to upgrade :)

1
0
Headmaster

@Robert Hill re "VAX OS"

Robert's memory seems to be failing a bit, so here's a bit more background, especially for the young uns.

The relevant mainstream VAX OS was called VMS (or later OpenVMS), which in its day was the industry standard 32bit OS. Despite Compaq's and HP's efforts, VMS is still around, and still has class-leading heavyweight clustering and SMP support and and and (though it's still awaiting its own implementation of IPsec, isn't it Richard).

Basically VMS is what NT wanted to be when it grew up, except NT had dropped some of the VMS stuff that Cutler presumably considered "unnecessary baggage" on VMS (stuff like fine-grained security, and resource-specific quotas to prevent resource exchaustion Denial of Service issues). Gates wouldn't have wanted these anyway as although they improved system integrity they caused a performance hit and NT was already slower than W98 on the same tin.

Unfortunately Gates took NT down a different road and now it never can be VMS++. "Trusted computing" in the NT sense doesn't mean the users or admins or whatever can trust it to protect the integrity or confidentiality of their data, it means the "content providers" can trust it not to provide easy ways of copying their highly valuable "content".

In discussions of the history of NT it is commonly noted that Cutler was one of the architects of VMS, and that WNT = VMS++. What is less often noted is that Cutler was also one of the architects of a superb but little-known realtime OS+toolset for VAXes, which was called VAXELN.

There are a few bits in common between the NT kernel and the VMS kernel, but there are a lot more bits common between the NT kernel and VAXeln. You will find this confirmed in Helen Custer's book, "Inside Windows NT" (though I am speaking from personal experience of VMS and VAXELN internals, and from having read about NT internals).

There's been lots of discussion of whether the IP stack inside NT was or wasn't based on the BSD stack at some point. I don't know the answer to that one.

7
0
Anonymous Coward

VAX VMS was poorly copied in Win NT, contaminated by C and Unix

Dave Cutler and a very small team from Digital Equipment Corporation (DEC) were a very visible part of the Win NT development, receiving much of the credit for its development, some deservedly. Unfortunately, the positive impact they had in some areas were more than offset by the negative impact in some others and by the pernicious influence of the C language, Unix, and the undisciplined design and development espoused by many academics at that time and which now dominates our industry.

While Windows NT has many similarities with the VMS and later OpenVMS operating systems, it and the other MS systems were then and remain today fatally flawed, in many cases sharing these flaws with the various Unix variants and with many other C-based environments. These very same types of flaws are directly responsible for this latest breach. At their core are simple concepts, like fully validating the arguments to system calls and using string descriptors and counted strings rather than NULL-terminated ones or using typed pointers rather than unrestrained ones a la "C". If only we had not ...

It is a great tragedy for our industry and for the entire world that Unix and C gained prominence within the academic and research establishments, supplanting all those alternatives of which any one would have better reflected the "best practices" we had painfully discerned. If only we had taken all that we had learned with systems like Multics and later applied in newer systems like VMS/OpenVMS, we might have avoided many of today's perils.

Cutler and his guys knew better, they had just done the PL/I compiler for the VAX using technology derived from the Multics PL/I compiler. Gates should have known better since he had learned on the TOPS-10 system on the DEC PDP-10. Many of the newly-minted CS professors probably did not know better, most never having worked on a real system of any type much less one used in "production". Their students were truly clueless about security, data representation, robust and reliable systems, or much else. The overwhelming majority still are.

Dave, Don, et al do not get a free ride. They made their share of stupid decisions with NT that are still hanging around today. Dave was always known as a quick and dirty programmer -- really good at delivering something as a first version to customers, but moving on while others spent then years honing his "proof of concept" implementation into a sustainable, supportable product roughly two versions and three years later. (Ask anyone who worked with his early RSX-11 operating systems or with early versions of RSX-11M.)

NT is only one example of how many places we collectively failed our industry, making "engineering tradeoffs" where no tradeoff should have been allowed. While many of us knew better, we were swamped by recurring themes in the industry: newer is perceived as better; weaknesses are marketed as strengths; low initial price always wins whether functional or not.

BTW I never worked for DEC nor MS, but have been a customer, partner, and sometimes supplier to them and to other clients in many industries including SCADA. I have personally known and worked with the people I mention.

VMS/OpenVMS on whatever hardware is still the system I would most trust when my life depended on it. It is insane that MS Windows is being used in applications like SCADA rather than a reliable, robust, and far more secure system like OpenVMS.

6
2
Silver badge

NT and VMS

According to the story I read a number of years ago, it wasn't just the team that went from DEC to Microsoft. At some point it was discovered that parts of the VMS source code, _including the original comments_, were present in early versions of the NT code base. The resulting legal action was dropped when Microsoft agreed to develop NT to run on DEC's Alpha processor - hence the hardware-abstracted architecture of NT, subsequently extended to the PowerPC.

I wonder how much truth there is in this. Most of VMS seems to have been built using a very DEC-specific language called BLISS. I don't suppose that would have been much use to Microsoft.

Who downvoted AC's post? Dave Cutler? Bill Gates? A C-language enthusiast?

0
0
Happy

the real solution

I have the solution, go back to msdos who don´t need icons only command prompt

0
0
Joke

MacOS X

No Apple fanboi here defending the Almighty Steve Jobs, the Great One that gave us the Amazing MacOS X?

We need to defend our Operating System!

0
0
This topic is closed for new posts.