back to article Microsoft says it won't fix kernel flaw: It's not a security issue. Suuuure

A design flaw within the Windows kernel that could stop antivirus software from recognizing malware isn't going to be fixed, Microsoft has said. The issue, spotted this week by enSilo security researcher Omri Misgav, lies within the system call PsSetLoadImageNotifyRoutine, which has been part of Microsoft's operating system …

Facepalm! Windows 10 1607 Aniversary Update "Defer Updates" setting is back to front.

Here's another major flaw too.

Could it be someone at Microsoft got their wording/digital states: 1 and 0 (true and false) mixed up? Seems so.

For those people running Windows 10 1607 AU wondering why they haven't been offered Windows 10 1703 Creators Update, it turns out:

Windows Settings->Update and security->Advanced Options->Defer Feature updates

This toggle switch appears to be operating back to front. (This might sound odd that no one has noticed this before, but it does appear to be the case)

(Check first that on your system the toggle is off (i.e. no tick in the box), the system is set "not to defer updates")

Select 'Defer Feature updates' (i.e place a tick in the box) then go back and check for updates, it then finds the update. (The switch operation seems to be the wrong way round).

If you break the 1703 update process (to test) i.e. don't complete the update at this point (you'll get a failed update in your update history though), then toggle the switch off again (i.e. remove the tick in the box to 'Defer Feature updates'), when you check for updates again the 1703 update option disappears.

Which seems to prove the switch is working opposite way to the way it should. Well done Microsoft.

(Seems crazy to think a Company the size of Microsoft could make such a simple fundamental mistake, which has such massive consequences to the roll out of new versions of the Windows 10 OS, but these things happen).

If this is the reason, there are so many not getting this update, that is highly embarrassing for MS, an 'egg on face' moment, especially given they've been quite coy regards the latest figures for number of active installs of Windows 10.

MS are not going to get many 1703 upgrades in the interim before 1709, if they have all been 'deferred'. But maybe MS saw it as a way of dealing with complaints of 'upgrade overload', to give users/consumers a break.

37
3
Anonymous Coward

Re: Facepalm! Windows 10 1607 Aniversary Update "Defer Updates" setting is back to front.

A last minute "hack" by MS to Delay feature updates? (Make "Defer Updates" the norm).

Maybe done to appease AV vendors like Kaspersky?

0
2

Re: Facepalm! Windows 10 1607 Aniversary Update "Defer Updates" setting is back to front.

Have been wondering why my Surface Pro 4 has not got the Creators Update even if my aging HP laptop has. Will try this, see what happens and come back if it works (or doesn't).

9
0

Re: Facepalm! Windows 10 1607 Aniversary Update "Defer Updates" setting is back to front.

Can't believe this. Followed your instructions and Feature update to Windows 10, version 1703 has, finally, shown up! Will the install complete? Don't know yet. I'll be back!

20
0
Silver badge

Re: Facepalm! Windows 10 1607 Aniversary Update "Defer Updates" setting is back to front.

Damnit - that's why it wouldn't stop bugging me. I want to defer feature updates for a few months to let other people find all the problems for me.

11
0

Re: Facepalm! Windows 10 1607 Aniversary Update "Defer Updates" setting is back to front.

Hey thanks Adam - by deferring the feature update, I've finally managed to get my Surface Pro 4 running the 1703 update.

Seems you may well be right. Microsoft does indeed appear to have messed up.

Would love to know how many others are still stuck in the Win 10 1607 black (or maybe blue) hole because of this. Well, now there's a way for them to get Win 10 1703.

PS ElReg, this could be a story for you.

24
0

Re: Facepalm! Windows 10 1607 Aniversary Update "Defer Updates" setting is back to front.

I couldn't believe they'd get something so fundamental wrong, but yes I deferred feature updates to get the feature update, and my machine upgraded.

I have also found Office 365 much buggier than Office 2016.

This must be a new strategy - alpha is now beta, and what was beta is now gold.

13
0

I have also found Office 365 much buggier than Office 2016.

No Shit Sherlock.

What part of Office 365 having a lower version number than Office 2016 did you miss?

15
7
Anonymous Coward

Re: Facepalm! Windows 10 1607 Aniversary Update "Defer Updates" setting is back to front.

Next Question...

How many of those Privacy/Telemetry settings in Windows 10 1607 work back to front too?

24
1
Boffin

Re: Facepalm! Windows 10 1607 Aniversary Update "Defer Updates" setting is back to front.

BOOLEAN EnableExtendedTelemetryGathering(BOOLEAN enable);

Parameters

enable - set to TRUE to enable extended telemetry gathering. Set to FALSE to not disable extended telemetry gathering.

Return value

The current extended telemetry gathering enabled setting. Always TRUE (enabled).

Remarks

Versions of Windows may elect to not honour the enable flag. To check whether extended telemetry information is being gathered from your machine and uploaded to Microsoft, we advise to check whether your machine is made by Apple and whether it is connected to the internet. If the results of this check is 'no' and 'yes', then all your data is belong to us.

25
4
Silver badge
Trollface

Re: Facepalm! Windows 10 1607 Aniversary Update "Defer Updates" setting is back to front.

How many of those Privacy/Telemetry settings in Windows 10 1607 work back to front too?

FTFY

9
1
Silver badge

Re: Facepalm! Windows 10 1607 Aniversary Update "Defer Updates" setting is back to front.

So I need to set "Defer" to "Off" to make Windows stop nagging me to install a pointless update that I really don't want?

2
0
Silver badge
Pint

Re: Facepalm! Windows 10 1607 Aniversary Update "Defer Updates" setting is back to front.

------------------------------------------------------------------------------------->

With thanks!

(EDIT: I just had the bizarre thought that may that flip is how they're limiting the rollout of Creators, folk think that they're set to auto-update, but a hidden setting somewhere is reversing the logic)

3
0
Silver badge

Design flaw?

This sound more like a feature that No Such Agency might have requested.

43
1
Silver badge

Re: Design flaw?

It's Obi-Wan Feature

"This is not the executable you are looking for"

20
0

To anybody that actually writes AV scanner code for a living, this isn't news and really isn't a problem and even if it was fixed wouldn't actually save anybody any work since released bugs/features still have to be worked around on back-rev platforms since folks aren't terribly bought into 'windows as a service' quite yet.

7
9
Bronze badge

Next release

They really seriously promise to fix it in MSWin 11... Oh, wait...

16
1
Anonymous Coward

So since Microsoft are not concerned about the security of windows,

does this mean that they will compensate anyone who has/will loose money because of this issue.

Headline should read MS know about the issue but just don't care

16
2
Anonymous Coward

Re: So since Microsoft are not concerned about the security of windows,

compensation?

Are you smoking something very illegal?

The very, very, very small print of the EULA clearly (sic) tells you that you can't sue MS for anything, anywhere or anytime.

Don't you get it?

MS thinks they are a GOD (other dieties exist). They are above the law (Billy C film excepting).

26
3
Bronze badge

Re: So since Microsoft are not concerned about the security of windows,

But the bigger print says "Your statutory rights are not affected". The EULA cannot take away any rights given to you by the Law of the Land; it can only give you permission above and beyond those rights. There's a good case to be made that this sort of security hole makes an operating system unfit for purpose, especially as it was "bought blind" without a full description (the Source Code).

23
0
Silver badge

Re: So since Microsoft are not concerned about the security of windows,

They already covered the "unfit for purpose" in the warranty.

There is no warranty that it is "fit for any purpose"....

From the EULA:

"The manufacturer or installer, and Microsoft, exclude all implied warranties and conditions, including those of merchantability, fitness for a particular purpose., and non-infringement. If your local law does not allow the exclusion of implied warranties, then any implied warranties, guarantees, or conditions last only during the term of the limited warranty and are limited as much as your local law allows. If your local law requires a longer limited warranty term, despite this agreement, then that longer term will apply, but you can recover only the remedies this agreement allows."

So you get nothing more than what you paid for it...

7
1
Silver badge
Devil

Re: So since Microsoft are not concerned about the security of windows,

There is no warranty that it is "fit for any purpose"....

From the EULA:

The key phrase is "limited as much as your local law allows". If that flaw is used in malware, someone's banking is compromised because of said malware, and money is stolen, then where would the responsibility be?

Or let's try another example, shall we? What if said malware is used by Russian or Chinese hackers against the American security services? Do we think Microsoft might suddenly care about the flaw then?

7
0
Anonymous Coward

Re: So since Microsoft are not concerned about the security of windows,

Which under UK law would be illegal. It must be 'fit for purpose' and trying to disclaim that may well be a criminal offence under the Fair Trade Act.

16
1
Silver badge

Re: So since Microsoft are not concerned about the security of windows,

The EULA cannot take away any rights given to you by the Law of the Land; it can only give you permission above and beyond those rights.

Ahhh, ok ... from the EULA:

If your local law allows you to recover damages from the manufacturer or installer, or Microsoft, even though this agreement does not, you cannot recover more than you paid for the software (or up to $50 USD if you acquired the software for no charge).

0
0
Silver badge

Re: So since Microsoft are not concerned about the security of windows,

So you get nothing more than what you paid for it...

And how much did you pay for Windows 10 ?

0
0
Silver badge

Re: So since Microsoft are not concerned about the security of windows,

" Ahhh, ok ... from the EULA:

If your local law allows you to recover damages from the manufacturer or installer, or Microsoft, even though this agreement does not, you cannot recover more than you paid for the software (or up to $50 USD if you acquired the software for no charge). "

Which is equally meaningless, because if local law allows you to recover damages, it allows you to recover damages, and it's extremely rare that the damages caused will be limited to the price of the original product bought....

5
0
Bronze badge

Re: So since Microsoft are not concerned about the security of windows,

If the Law of the Land says a software vendor cannot limit claims for consequential damages, then they can print whatever they like in the EULA and it won't make a blind bit of difference.

Well, no difference unless they get criminal charges brought against them for misrepresentation, anyway.

2
0
Silver badge

Re: So since Microsoft are not concerned about the security of windows,

"

Which under UK law would be illegal. It must be 'fit for purpose' and trying to disclaim that may well be a criminal offence under the Fair Trade Act.

"

Sure, but does having a vulnerability for a very small subset of malware mean that it is "unfit for purpose"? And if so, is it the OS or the antivirus software that is "unfit"?

Does the fact that your car is vulnerable to a determined saboteur (who could e.g. crawl underneath and cut your brake lines) make your car "unfit for purpose"?

1
0
Silver badge
Holmes

Re: So since Microsoft are not concerned about the security of windows,

So you get nothing more than what you paid for it...

And how much did you pay for Windows 10 ?

Depnds. Fgor those who've lost productivity or data, it can be hundreds or thousands of dollars.

For those unfortunates who've lost family photos and other stuff, the loss is priceless.

0
0
Silver badge
Trollface

Re: So since Microsoft are not concerned about the security of windows,

Does the fact that your car is vulnerable to a determined saboteur (who could e.g. crawl underneath and cut your brake lines) make your car "unfit for purpose"?

I think in this case it's not so much "crawl underneath" as "the brake lines are fully exposed, already in the jaws of the cutters, with a big 'please push' sign on the handle".

0
0
Silver badge
Trollface

You are spoiling us Mr El Reg

Another 2 minute hate on MSFT. What a time to be alive!

4
40
Silver badge
Trollface

Re: You are spoiling us Mr El Reg

I've been hating m$ for alot longer than 2 mins

And for many good reasons

50
4
Coat

Re: You are spoiling us Mr El Reg

Come on bud , catch up with the times

MS hate is a long forgotten thing in the distant past , Totally out of fashion !

Now .. it's Oracle :)

Speaking of which , time for my Oracle Anonymous meeting ..

" i have admitted that Oracle is a problem , that i lost control of my database " LOL

6
0
Anonymous Coward

Re: You are spoiling us Mr El Reg

Another 2 minute hate on MSFT. What a time to be alive!

And yet here you are again, with the best seat in the audience.

9
1
Silver badge

Re: You are spoiling us Mr El Reg

"Another 2 minute hate"

"Hate" is a verb. Try again.

2
3
Paris Hilton

So the thing is already on my system, and...

"Essentially, malware can use the above API to trick the OS into giving malware scanners other files"

Uhm, so at this point the malware code has already been loaded and has ...essentially... started executing?

I.e. the train has already left the station? The chicken left the coup? Horse is out of the stable? Paris is already on top?

I think I will have to side with MS on this one. This bug does not help or hinder me when it comes to protecting my system. The whole point must be to keep malware from getting this far into any system.

5
12
Anonymous Coward

Re: So the thing is already on my system, and...

"i.e. the train has already left the station? The chicken left the coup? Horse is out of the stable? Paris is already on top?"...

Except Microsoft is ignoring zero day exploits / Security Service exploits that aren't in the public domain, where there is no stable door, gets set to work and pull up the drawbridge, with part of the "invisible cloaking" code batting away the malware scanners that attempt to probe.

Iain Thompson is right/correct.

20
1
Anonymous Coward

Re: The chicken left the coup

Sapristi!

Traitor to the chicken revolution.

Rise up chickens, you have nothing to lose but your coop

1
0
Gold badge
WTF?

" this does not pose a security threat"

Translations

"The developer who wrote it is now the person who reviews code to decide if they need a re-write as a security threat. He says it isn't and he wrote it."

"We are unable to locate the source code at this time for review, but we're pretty sure it's all good."

"We did a ground-up re write of Windows after all our devs had secure coding training. It is therefor logically impossible that this code have a fault."

"Since no exploit code was included with the information they provided we conclude it cannot be exploited."

Take you're pick. All of them are more honest, although like the original the response is pathetic.

20
0
Facepalm

Re: " this does not pose a security threat"

So absolutely NOTHING can go wrong

go wrong

go wrong

go wrong

go wrong

go wrong

go wrong

go wrong

go wrong

5
0
Silver badge

Re: " this does not pose a security threat"

"Since no exploit code was included with the information they provided we conclude it cannot be exploited."

Hi, John Smith 19,

Cannot be exploited maliciously renders the coding as near perfect as is possible in humans. Does Microsoft run such code or merely host IT for A.N.Others?

And is it a Persistent Advanced Cyber Treat and a Practically Real Threat to Current Ancient Running Systems?

Does Microsoft have Golden Geese laying Fabergé Eggs.

1
0
Childcatcher

Security problem? Not for security agencies

Nice way to hide their spyware.

12
1
Anonymous Coward

Typical Microsoft

Typical Microsoft. It's no wonder people are sick to death of using their substandard software.

Typical JJ too, with his MS fact sheet on "haterz" (as though MS "hating" is actually a real thing and not just a PR cover story for their crap software and even worse attitude).

17
1
Silver badge

Re: Typical Microsoft

"as though MS "hating" is actually a real thing"

It's neither here or there. Most techies (myself included) have had a long love-hate relationship with MS. Can't live with them, can't live without. In other words, it's an abusive relationship.

As it happens with abusive partners, there is no standard way of coping with the situation. Some people have stood up and left. Some have succumbed to the abuse and became slaves^W true believers. Some have decided to stay around, rather begrudgingly, for a greater purpose like caring for innocents.

10
1
Silver badge

Possibly....

A design flaw within the Windows kernel that could stop antivirus software from recognizing malware isn't going to be fixed

Obvious Reason: If they fixed the code, the Windows kernel would identify most the rest of Windows as malware.

34
1
Silver badge

That's the spirit!

4
0

Will NOT fix Edge security flaw from yesterday. Edge should be avoided as it was hacked at will at Pawned 2017. Penetrated over and over again. Only browser unhackable in time allotted was Chrome.

But more than anything Edge should be avoided!

9
2
Anonymous Coward

Pawned 2017?

What's this, the largest annual gathering of pawn shops? I'm sure the kind of chrome bought and sold there are harder to crack.

2
0
LDS
Silver badge
Devil

Let's have some sympathy for Windows developers

They have a large backlog of slurpingtelemetry features to add to the kernel, they have no time to fix the bugs, or Nadella fires them if he doesn't see the user data database filling quickly enough.

8
1

Design flaw?

So PsSetLoadImageNotifyRoutine was designed to behave as the researcher described?

So what is the specifiation for PsSetLoadImageNotifyRoutine?

Did the coder(s) responsible for implementing PsSetLoadImageNotifyRoutine have a spec and design?

Did the coder(s) responsible for implementing PsSetLoadImageNotifyRoutine test their implementation against the spec and design?

And what about code reviews, unit testing etc?

Perhaps Maleficent Software needs not the Enlightenment of Software Engineering.

9
0

Page:

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Forums

Biting the hand that feeds IT © 1998–2017