Updates for older platforms to protect against potential nation-state activity

https://blogs.technet.microsoft.com/msrc/2017/06/13/june-2017-security-update-release/

by my123 • 9 years ago

110 111 9 years ago

blogs.technet.microsoft.com

norswap• 9 years ago

What the heck does "nation-state activity" means?

sp3322• 9 years ago

It means governments are exploiting the OS instead of random hackers.

gruez• 9 years ago

"Activity" = codename for hacking

my123• 9 years ago

we have taken action to provide additional critical security updates to address vulnerabilities that are at heightened risk of exploitation due to past nation-state activity and disclosures.

It's state sponsored hacking or hoarding of vulnerabilities.

Ded7xSEoPKYNsDd• 9 years ago

Presumably it's another case where an intelligence agency lost control of an exploit they developed, the same thing that happened with WannaCry.

jaclaz• 9 years ago

What the heck does "nation-state activity" means?

That looks hard enough to understand, but additionally it is "potential".

cityhall2• 9 years ago

Russia

Alupis• 9 years ago

Russia

Is that a new way of saying "NSA"?

All joking aside... this is likely the tail-end result of the Shadow Brokers leak coupled with the recently-used exploits in the failed crypto-locker variant "Wanna Cry".

daveloyall• 9 years ago

The page links here: https://support.microsoft.com/en-us/help/4025687/microsoft-s... ...which mentions some MSyy-nnn numbers, some of which have been mentioned on HN before.

1001101• 9 years ago

https://en.wikipedia.org/wiki/WannaCry_ransomware_attack#Att...

kpil• 9 years ago

Interesting question.

"Nation" is really the people, not the country or the state, and the reason it's mixed up to the point of having reached the dictionaries, is the strong nation-states that have been founded in Europe the last few hundred years.

"State" is the organisation that governs a country or region, and in extension all it's concerns.

Activity means hacking.

So... a government organisation from a country of ethnically and culturally distinct people are hacking shit.

news_to_me• 9 years ago

How the fuck are some government orgs still on Windows XP?? Seriously, we need government-wide standards in place so this sort of thing doesn't happen.

eli4• 9 years ago

Strict standards and certifications that make it hard to make changes are one contributing factor to how we ended up here.

louithethrid• 9 years ago

How dare the customer have opinions of there own and vote with there feet and money for it! This is outrageous! Dont they want to go Hipster-Hyper-Heaven?

deathanatos• 9 years ago

I'm not saying the customer shouldn't be able to vote with their feet/wallet, but they should also be aware that code rots, and security vulnerabilities become more known as time goes on. I don't think criticizing an organization for sticking with ever older, ever more insecure software is necessarily wrong.

What makes this harder is that people bought into a platform that doesn't given them access to the code they run. The business that originally created it isn't interested in supporting it further (well, they are, i.e., "Windows 10", but I presume that that's not acceptable to our hypothetical "vote with there [sic] feet" person), and I don't really see that the business should be forced to support it, either. (It's not like MS didn't support it for quite a while, and don't still offer a solution.)

Software evolves. Ideally we're finding more secure and better ways of doing stuff, and shedding the old stuff, though I acknowledge the debatability of that. I acknowledge that it's also unfortunate that UI changes, and bloat, often seem tightly coupled with that. But if people also persist in choosing non-free, non-open source software…

zanny• 9 years ago

We have government wide standards, they standardize on Microsoft's proprietary non-standard products.

Microsoft built this mess for profit, and continue to profit off of taxpayers indefinitely as hobbled state institutions are forced to pay permanent support contracts for old OSes because the states themselves mandated they use this shit by law. I'd love to see how many campaign contributions MS made to representatives pushing laws standardizing on Word or other bullshit MS only tech in state institutions and even worse, in schools.

Public education is infested with Microsoft giving away / heavily subsidizing their locked in products so children are hooked on them for life, and nobody is outraged about it.

Hell, the whole war for the classroom from all parties involved is disgusting. Microsoft, Apple, and Google all push free access to their proprietary services and products to lock kids into their ecosystems. And while Google's platform, Chromebooks, are much more open than their competitors, they offset that by also having the ulterior motive of farming these kids for their big data research (not to say MS and Apple aren't doing it too, just saying Google is far from innocent here).

The whole intersection of state and software globally is a giant mess of corruption. There is way too much profit to be made off taxpayers money for anything close to good intentions to win the day.

gaius2• 9 years ago

I'd love to see how many campaign contributions MS made to representatives pushing laws standardizing on Word or other bullshit MS only tech in state institutions and even worse, in schools.

I keep hearing it will be the Year Of The Linux Desktop and it keeps never happening. That's why. No need for any wacky conspiracy theories, for the average user who just wants their computer to be a tool to get work done, the choices are Windows or Mac, and for large organisations who want to centrally manage machines, the choice is... Windows.

cityhall2• 9 years ago

From the stories I've heard I wouldn't be surprised if some were still on DOS. It's hard to develop in house with a tightly controlled budget and it's hard to outsource when you're dealing with sensitive data.

lb1lf2• 9 years ago

DOS? I still have to maintain basic CP/M proficiency as one of the pieces of heavy machinery in our workshop is controlled via an über-proprietary interface firmly embedded in an M68k machine.

We only got rid of the VMS controlled CNC lathe a couple of years ago - it ran off a VAXstation something-or-the-other. A 2100, methinks.

Granted, these machines didn't pose much of a problem besides scarcity of spare parts - neither of them had any need for a network, anyway.

necessity• 9 years ago

I wouldn't be surprised if some traffic-related agency was using Windows98, I've seen everything from supermarkets and grocery stores to banks and post offices using Windows98 here (Brazil).

giarc2• 9 years ago

I work for a healthcare organization with 100,000+ employees serving a population of just over 4.2 million. I went from XP to Windows 7 last month.

mrweasel2• 9 years ago

One of the regions in Denmark is migrating from Windows XP to Windows 7 and the to Windows 10. They have yet to provide a good reason for not just skipping Windows 7

maxxxxx2• 9 years ago

When you have a complex system with very specific characteristics you can't upgrade that easily. We have machines with Windows 2000 and XP in the lab that do what they need to very well. Every new Windows version adds new restrictions so an upgrade would most likely require a rewrite of the code. It's not that easy.

I can imagine there are plenty of systems still on DOS.

0x02• 9 years ago

I keep a winxp vm around for some old games. Many of the download links at https://support.microsoft.com/en-us/help/4025687/microsoft-s... , especially in table parts 2 and 3 for winxp go to 404 pages. Also, ie for winxp does not seem to be able to even open the windows update website any more. Any tips?

chrisper• 9 years ago

Just download it normally and move it to your VM through network share or whatever.

sp3322• 9 years ago

Have you tried manually installing SP3 first? I remember an old PC I had to troubleshoot wouldn't install anything else until I had that.

mrighele• 9 years ago

I tried to install Xp in a VM a few weeks ago to see if I could run a few old games. The iso I had was for XP Sp2, and I couldn't find a download link for the Sp3 installer on the whole Microsoft site. Links from search engines become "the file is no longer available" or something similar

0x02• 9 years ago

Yeah, I'm sure it has SP3, and I think also all the regularly issued windows updates up until EOL. Anyways, it looks like more updates are coming online now. Perhaps they published the links before publishing the linked pages.

DuskStar2• 9 years ago

I can't help but feel that Microsoft providing these security updates long past XP's stated EOL date will only decrease security in the long run. After all, if any "big enough" vulnerability results in getting a patch anyways, why upgrade/firewall that old XP system running your equipment? And I'd bet that people will expect the same treatment for Windows 7, too.

People never learn when disaster is narrowly averted. People learn when their decisions mean everything is on fire.

jimmaswell• 9 years ago

Anyone still using XP at this point is obviously not planning to upgrade to a new OS in the first place. I'm certain there are virtually no XP users who would have been swayed to finally upgrade by these specific security patches being withheld.

DuskStar2• 9 years ago

Maybe not from security patches being withheld, but I'd bet that Britain's NHS has done something to improve security following their encounter with WannaCry - and I know my university's hospital system did.

ch4s33• 9 years ago

Imagine if you will a hospital system say, the VA, which owns a number of MRI machines, x-ray equipment, or similar which runs Windows XP. Now imagine that these machines were built by a company that was acquired and dismantled and therefore can no longer provide updates. Now imagine that these machines are connected to the local network behind the firewall, but can not be air gapped... for reasons. These machines work just fine, other than having an old OS. Should they get scrapped?

codefined• 9 years ago

I'd say yes, especially if they're not getting security updates and are connected to the rest of the network.

Honestly, the cost of it getting broken into seems to be significantly higher than the cost of upgrading the systems.

mrweasel2• 9 years ago

Should they get scrapped?

Of cause not, but the hospital knew that the Windows XP running their multi-million dollar scanners would be end-of-life before the scanner it self. They should have required that the software be placed in escrow for the life time of the scanner, so that other parties could do any needed updates, if the supplier failed to do so.

I'm sorry, I get that you can't throw away expensive hardware, just because Microsoft no longer patch that version of Windows required to run the software but: EVERYONE knew that the hardware would be in use beyond end of life date for the operating system. So why isn't that included in contracts and support plans? Do banks and hospitals even care enough to ask how the supplier plans to deal with an EOL operating system?

guimarin2• 9 years ago

seems like a false choice. why couldn't i understand what functions these machines exactly needed and then put a small linux box between them and the network which monitors all incoming/outgoing traffic and only allows allow-list items to pass on to the ancient XP device.

swiley2• 9 years ago

If there where a requirement by the hospital that they have access to the source for everything this would just be a matter of hiring a consultant.

SomeStupidPoint2• 9 years ago

Absolutely.

It's the only way that large institutions will come to properly value the security trade-offs of their decision to buy closed-source, proprietary systems.

Why should the VA get to externalize part of their purchasing decision on to Microsoft?

eli4• 9 years ago

And add to that the machines are very expensive and there are laws that make it very difficult/illegal to make unapproved modifications to this equipment.

mjevans2• 9 years ago

Those machines should NEVER have shipped with a closed source OS (that wasn't the responsibility of the manufacture) in the first place.

The fault lies entirely with the manufacturer for not providing a system fit for use/sale.

alkonaut• 9 years ago

This keeps being repeated. But it doesn't excuse it. Either a machine is kept secure/up to date or it's not connected to the internet. If a hospital feels it can't just disconnect the unsafe machines, well then air gap the whole treatment network.

Perhaps there exists an easier middle ground solution such as somehow putting a safe proxy machine in between the unsafe machine and the internet using a very simple controlled communication to the unsafe machine?

Should they be scrapped? Maybe not. But not just left as they are either.

Most importantly: don't BUY that next MRI if it's approved only for a certain OS version and it's a general purpose OS such as Windows, and it will be connected to the internet. If you DO buy it - calculate with writing it off within the support window for the OS. That will show its true cost.

Further, equipment using general purpose OS'es should stop being approved for one version and automatically qualify for newer versions. Alternatively the approval should not be valid beyond the support window unless the machine is air gapped.

cblock811• 9 years ago

Those machines are still the responsibility of the hospital and it's their obligation to update them so that the safety and security of their patients is upheld. Inconvenient things happen and companies are expected to adapt to those situations and respond rather than say "it's not our fault", especially in something as critical as medicine.

tajen• 9 years ago

Do you actually want to be x-rayed by a machine running "just fine" on WinXP and not ever air gapped?

thingification2• 9 years ago

Is it possible this means it was a mistake to buy those systems, because they are not based on open source software?

One objection is that these systems may have been the only ones on offer that met requirements. I think one has to consider collective effects, though: were people prepared to 'irrationally' say "I'm still not buying it, because it's not open source", we would end up with open source MRI machines. Of course that's unlikely to happen at present simply because there is NOT a consensus that open source software is important or even a good thing in this context -- but this argument addresses THIS objection.

That kind of stance happens in some situations, and not currently in this one. I don't think that's an immutable state of affairs. Also, I don't think it's because of the high direct costs of saying "no": refusing to pay kidnappers also has a high direct cost and an analogous collective benefit (I'm not aiming for a hyperbolic moral comparison there, I just picked that because, as an extreme case, it makes the point clear).

gaius2• 9 years ago

Kudos to Microsoft for doing this. Who else in the world is patching 16-year-old code well past it's EOL, for free?

AndrewOMartin• 9 years ago

Certainly not the people whose code is much older than 16 years and not simply declared EOL for profit reasons.

csydas• 9 years ago

Blizzard? Diablo 2 got a patch just this year.

I get what you're saying, it's nice that they're doing this, but it's not really so much a goodness of the heart thing as it is that there is a super critical bug to many versions of Windows and there happen to be enough XP machines around that they're a significant threat. The bugs are big enough and the threat great enough that there's probably less cost in patching than there is in dealing with any of the potential fallout.

thehardsphere7• 9 years ago

That's a mighty big assumption that they're doing it for free. It's very possible they have enterprise customers who paid, and now they're releasing for everybody.

Dunno for sure because I'm not familiar with their practices here. But it's a thing.

joosters2• 9 years ago

It's downloadable for free, right there on the page. You are twisting the meaning of words for no good reason.

askvictor2• 9 years ago

I'm sure you could find some oss projects

IshKebab• 9 years ago

I'm sure you can't. You might find open source projects that are older than 16 years, e.g. Linux. But that's not the same.

Nobody is maintaining Linux 2.4, which was released in 2001. Its support only lasted until in 2010 as far as I can tell.

AnimalMuppet2• 9 years ago

I don't remember their name. They're a small RTOS vendor based in San Diego. Maybe 8 years ago, we were using their previous (i.e., not under current development) RTOS, and we hit a bug. We called them up, asking for them to create a fix. My boss mentioned that our support agreement had lapsed (expecting that he would have to send them a check to get them to work on it). They said, "Doesn't matter. We wrote it; we'll fix it."

I would gladly give them credit by name, if I could just remember who they are...

mrpippy• 9 years ago

Express Logic? (makers of ThreadX)

an273• 9 years ago

Small price to pay for having dominated the OS market for decades, by forcing OEM's to always only ship their OS...

toredash2• 9 years ago

Sad part is that there will still be owners of WinXP who won't patch their systems.

Angostura• 9 years ago

Because the manufacturer of their embedded system went bust, for example.

toredash2• 9 years ago

Or they just don't patch their systems.

EdSharkey• 9 years ago

I imagine Microsoft gets a dump truck full of cash to open support up on XP like this. I wonder who paid?

TAForObvReasons• 9 years ago

US pours tens of billions of dollars into legacy technologies: http://www.gao.gov/products/GAO-16-696T -- no doubt a large portion of that made its way to Microsoft

ocdtrekkie3• 9 years ago

Well, the US government's already paying them to maintain XP to begin with. So the patches already exist internally at Microsoft, and it costs them nothing if they just decide "Hey, this patch is such a big deal, we also want to let everyone else have it". Isn't really gonna change the fact that the US government's still paying them for the work.

And computer security benefits from herd immunity tactics, so it's best to get virus updates in as many hands as possible. It's why Microsoft has never really prevented pirated copies of Windows from getting security updates. They benefit from not having old machines potentially causing problems for newer ones, and even just avoiding the bad PR from massive malware attacks.

daxfohl• 9 years ago

For that matter the government may well be dictating the patch release schedule too. And certainly the skeptical among us can wonder what else may be in these patches.

weinzierl2• 9 years ago

Could be related to the The Shadow Brokers threatening to release a new stash of exploits in June, this time targeting Windows 10.

From their announcement on 2017-05-15 [1]:

In February Microsoft is missing patch Tuesday. TheShadowBrokers is knowing, Microsoft is missing to be making patches for Eternal exploits.

[..]

In March Microsoft is releasing patch for SMB vulnerabilities. TheShadowBrokers is knowing this is being for Eternal exploits. TheShadowBrokers is still waiting and not releasing.

[..]

In April, 90 days from theequationgroup show and tell, 30 days from Microsoft patch, theshadowbrokers dumps old Linux (auction file) and windows ops disks.

[..]

Eternal exploits is not being ZeroDays. [..] patch was being available for 30 days before theshadowbrokers is releasing dump to public.

[..]

TheShadowBrokers Monthly Data Dump could be being:

web browser, router, handset exploits and tools

select items from newer Ops Disks, including newer exploits for Windows 10

compromised network data from more SWIFT providers and Central banks

compromised network data from Russian, Chinese, Iranian, or North Korean nukes and missile programs

More details in June.

Their latest message is from 2017-05-29 [2]:

Q: What is going to be in the next dump?
TheShadowBrokers is not deciding yet. Something of value to someone. See theshadowbrokers’ previous posts. The time for “I’ll show you mine if you show me yours first” is being over. Peoples is seeing what happenings when theshadowbrokers is showing theshadowbrokers’ first. This is being wrong question. Question to be asking “Can my organization afford not to be first to get access to theshadowbrokers dumps?”

[1] https://steemit.com/shadowbrokers/@theshadowbrokers/oh-lordy...

[2] https://steemit.com/shadowbrokers/@theshadowbrokers/theshado...

throwanem• 9 years ago

What the hell is with all those present progressive forms?

weinzierl2• 9 years ago

Has been discussed on HN at length in the respective threads. Some people believe it's to make language analysis harder.

Kenji• 9 years ago

Why is nobody punishing the responsible nation states? I think the nation states who have such irresponsible intelligence agencies should pay every last dime of Microsoft's patching efforts and the damages the hacks and leaks cause.

empath75• 9 years ago

Well it's a combination of the us and Russia in this case.

qb452• 9 years ago

If we are talking malware being leaked or escaping to the wild, it's more like the US, Israel and maybe some not-yet-caught European states cooperating with them.

dragonwriter• 9 years ago

Why is nobody punishing the responsible nation states?

Because the nation-states involved are legally immune, because of sovereignty and sovereign immunity, and rather resistant to other forms of coercion because of substantial economic power, conventional military forces, and nuclear weapons.

pessimizer• 9 years ago

Nation-states are the law. Punishing a nation-state means going to war.

Updates for older platforms to protect against potential nation-state activity

Related Stories