New XP Vulnerability « Giveaway of the Day Forums

Back to Giveaway of the Day

Giveaway of the Day Forums » Technical notes

New XP Vulnerability

(12 posts) (2 voices)

Started 7 years ago by mikiem2
Latest reply from mikiem2

mikiem2
Moderator

A flaw in Windows was discovered that dates back to win95. Microsoft patched those versions of Windows that still get updates, & now that the details of this flaw have been published, along with a fix that can be reverse engineered, it may be actively exploited [it's common for malware to exploit a vulnerability soon after a patch & details of that vulnerability are released]. This article mentions some ways to protect unpatched Windows versions.

threatpost[.]com/patched-badtunnel-windows-bug-has-extensive-impact/118697/

Posted 7 years ago #
ChrisS
Administrator

I intended to comment further on

I could see a future where the only way to opt out is with an older version of Windows in a VM or using Wine on a Linux PC

from the other thread but I got distracted.

The biggest problem with using older versions is the security vulnerabilities that keep cropping up. They get fixed, which creates new security vulnerabilities, but those fixes don't make it to XP and I can see Microsoft dropping support for Windows 7 and 8 prior to the stated "end of support date" if they can move/force enough people to Windows 10. They may not exactly kill Windows 7/8 but they may orphan them like they did Vista where they're still kind of supported but they will have ongoing compatibility headaches that could be resolved by an "Easy Upgrade to Windows 10". C'mon, won't you just click the icon?

The spying/tracking that everybody and their dog's fleas does is benign compared to what could happen if you're using an OS with known vulnerabilities (and I shudder when I think of all those proud XP users that still routinely connect to the internet). In a lot of ways Microsoft does the hackers job for them - they publish a vulnerability, they publish the fix, and then the hackers look for those who didn't apply the fix. I'm much more concerned about "Ransomware" than I am about Google collecting my personal data (and my beef really isn't that they're collecting it, it's that they're selling it without compensating me).

I'm also not convinced that Linux is all that secure. I think a good bit of its "security" is that it's a low value target. If you're going to troll for security holes then you'd prefer to fish in a big lake rather than in a small pond.

However, an outdated PC is probably still far more secure than the average user's cell phone. If you can hack the phone then you get access to everything it can access.

Posted 7 years ago #
ChrisS
Administrator

You previously mentioned booting to a VHD...

I wonder if installing TimeFreeze, or similar, in a bootable VHD might solve my security concerns with using an older OS and largely render tracking futile? It should be the same system every time it starts but I don't have versions of Windows 7/8 that will create a bootable VHD so I don't know if the rest of the PC would be easily accessible by rogue software. I think it would be more secure than a VirtualBox or VMWare VM but maybe not.

On the other hand, I'm not sure that "opting out" is even possible. If you used an old laptop with TimeFreeze installed for casual web browsing and your real PC for the serious work the various 'bots would record the activity from your IP address to a database. That data could then be collated if desired. It would be a "loose" match since it would be tied to different machine IDs so it wouldn't have as much value but it would still be tied to your IP address.

It may be like Wargames where "the only winning move is not to play" but that's not really a viable option. Besides, the Feds have all of our data and they frequently report "data breaches" so the moral of the story is probably "don't make it easy but it's pointless to go to extremes".

Posted 7 years ago #
mikiem2
Moderator

I can see Microsoft dropping support for Windows 7 and 8 prior to the stated "end of support date" if they can move/force enough people to Windows 10.

It's already happening with Windows 7 -- has been for the last year. I intended to write a separate post or thread about it, but after 3 edits it still comes across too much like a rant. This may too -- if so apologies.

MS 1st started making Update Tuesday artificially difficult with XP as they got closer to the date when they pulled the plug entirely -- afterwards, assuming you added the registry hack to continue receiving updates, things went back to normal on that 1 Tuesday a month. Then they did the same with Vista, which for all I know continues -- they were successful in making Vista so unusable I quit running the one copy we had. And they've been doing the same with win7 for quite some months now, though if you have a powerful enough machine, & wait for Windows Update to do its thing in the background, you might not notice... with its limited resources, a win7 VM running full throttle in a loop for hours waiting for Windows Update to find what's available is Quite Noticeable, especially when downloading those updates may not work once they're finally available.

Microsoft also took steps to make working around Windows Update more difficult. They ended the old listing designed so IT folks could see what updates were being released, download & test them. The pages with the month's kb hotfixes aren't live for some time after the updates themselves go live, & then many of the links to those pages are broken, & some pages never do make it live. So I do a bit of a dance... last Tuesday after ~45 minutes this copy of 7 finally listed available updates, so I updated it & then rebooted to a copy of 10 where finding updates took less than 30 seconds. After that I updated other copies of 10, usefully killing time for the KB pages to go live on microsoft[.]com.

Back in 7, I went through the Update History, tracking down the info for each update & downloading the patches. To apply them to other copies of 7 in VMs & on hardware I use Task Mgr. to kill the Trusted Installer [sometimes have to kill it more than once as it re-spawns], use Services to kill Windows Update, run a patch .msu, then repeat, kill Trusted Installer, Windows Update, & run the next patch.

With their development tools MS also defaults to effectively eliminate compatibility with XP, to a lesser extent Vista, & I expect with the upcoming anniversary releases, compatibility with 7 will further decline. Right now I've already had problems with software like Bitdefender being written to target 10, & no longer working properly in 7. Microsoft's big push to use their universal platform for all Windows software abandons 7 entirely.

As far as Microsoft's current development efforts go, everything new targets Android & iOS, followed by their store, ignoring 7. While their browsers look like they may be headed the way of Windows phones, Internet Explorer isn't getting much needed new versions, with development focused on 10's Edge.

MS has publicly said that it's coercive tactics to get people to upgrade 7 to 10 will end once the free upgrade is no longer available at the 1 year mark. The may extend it of course -- some feel that they probably will -- &/or they might offer pricing like they did for 8, so you can buy a real license cheap etc. And the 1 year mark could also be when MS takes the gloves off. They could make forced updates to new builds something you have to pay for. And they could take more steps to make 7 harder to use. It's hard to say now that MS has taken to what I expect to see on a TV ad for some new miracle frying pan.

[Maybe I place too much importance on it, but MS announcing a new tool for 10 that is anything but bothers me, maybe more than it should... *to me* it seems to clearly cross a line, not falsely hyping something but misrepresenting it entirely.

With 10 MS has tried to move the focus to Windows Update & away from ISOs or setup packages. With their Insider program they've moved from focusing on pros, or at least more experienced & knowledgeable folks, to the often loudmouths who love to overstate their limited understanding. So I can see marketing-wise why Microsoft may not want to come out & say that 10 can now download an ISO & run setup, rather than updating builds through Windows Update, without those options in the setup dialog. But to hype it as a new tool rather than capability that's always been there to me is misleading to the point of a lie.]

Posted 7 years ago #
mikiem2
Moderator

I went on too long in the 1st post -- sorry -- so wanted to put this separately...

In a lot of ways Microsoft does the hackers job for them - they publish a vulnerability, they publish the fix, and then the hackers look for those who didn't apply the fix.

You're more than right -- the stats I've seen published are, if true, really amazing. In some cases it takes less than 24 hours for a patched vulnerability to be turned into an exploit, packaged, & a live campaign started. And more than 3/4 of those hit with malware &/or exploits were/are hit because of known vulnerabilities that patches were available for, but had not been applied.

From the criminal's point of view it makes great sense. By definition most criminals want more return for less investment, i.e. more $ for less work. So you can find & employ someone(s) with great intellect & skills to find vulnerabilities you can exploit, but such people are rare & expensive -- that's why companies pay millions a year in bug bounty programs, & why zero day exploits are generally expensive, rare, & only used in limited fashion on high value targets. Or you can let the software companies do your work for you.

When a patch is released it can be reverse engineered. And when at the same time full information on the vulnerability is released, you've got a tutorial. And when proof of concept code is released at the same time, you've got an example that *might* even be copy & pasted. Even if you could only hope to target 10% of all the Windows devices out there, & I have no idea what the real number of unpatched Windows is, that's still many millions of targets. And all for very little work.

I'm also not convinced that Linux is all that secure. I think a good bit of its "security" is that it's a low value target. If you're going to troll for security holes then you'd prefer to fish in a big lake rather than in a small pond.

I'd think that Linux on a individual's PC/laptop would be more secure because the type of person that would run Linux on their own machines would tend to be more technically knowledgeable, & do less stupid stuff frankly. Otherwise again you're probably more than right. Open source software is most often under funded, so there just isn't the skilled man [or woman] power to worry about security. That's something many companies in the software industry are now trying to help, realizing that they depend on open source too much to take it for granted.

However, an outdated PC is probably still far more secure than the average user's cell phone. If you can hack the phone then you get access to everything it can access.

Which is why I don't let anything that could be sensitive near anything Android. ;) I use separate accounts, e.g. the Amazon account for the cells & tablets & Kindle etc. has only ever seen prepaid cards with usually low amounts I can better afford to lose.
As far as I can tell there really is no security software that's as effective as what you can get for Windows. You're supposed to rely on the big name stores, but they've all hosted malware. And the nature of the mobile OSes is that they cannot be installed by the end user, so they cannot be updated by the end user either. Apps yes -- OS generally no. And that's if your cellular carrier doesn't get in the way, but they have zero incentive not to get in the way, because they save money not testing updates, and make money when you buy a new phone so you can have a current OS.

Mobile OSes like Android may be even more vulnerable because from the beginning it was designed to run on very limited hardware that couldn't support the resources needed by added security, to have most of the files inaccessible to the user but not to software, & to run apps designed for the lowest common denominator. And because Google took the easier route, modifying Linux & leaving things like drivers to OEMs, they're now in the position of trying to fix stuff that is unfixable without breaking compatibility with many or all Android apps, which is their bread & butter.

*Maybe* they'll do better with Chrome now? A user installable, updateable OS that could run Android apps designed for desktops could be a bit of a game changer. With future versions of Chrome being able to run Android apps, *maybe* those desktop apps will happen? Maybe future versions of Chrome will let the user install it, or maybe Chromium or Linux will be given access to the Play store? I could see those scenarios maybe making enough $ to spur a lot of development effort. Only having Chrome on select under powered & over priced hardware, not so much.

Posted 7 years ago #
mikiem2
Moderator

I wonder if installing TimeFreeze, or similar, in a bootable VHD might solve my security concerns with using an older OS and largely render tracking futile? It should be the same system every time it starts but I don't have versions of Windows 7/8 that will create a bootable VHD so I don't know if the rest of the PC would be easily accessible by rogue software. I think it would be more secure than a VirtualBox or VMWare VM but maybe not.

I think one issue is the records that are written in Windows, another is the interaction between Windows & software with some other entity online, another is being able to track whatever activity to an individual. The 1st might be handled by in effect destroying the copy of Windows you used. The impact of the 2nd *might* be reduced by not having any identifiable info in that copy of Windows. The 3rd may be impossible, but you can make it harder. You can disguise your ip, change the MAC address, & using enough copy/paste, reveal little about how you type & how you typically talk [kinda like Bumblebee in Transformers ;)].

To have something that could leave absolutely no records on your hardware, maybe something here might give an idea or three?...
I haven't been there for a while, & don't know how their projects have fared since UEFI & secure boot etc. have become more common, but reboot[.]pro had some nice solutions. They can work with Grub [I have a USB stick with several using a Grub boot menu], & I *think* I saw where Grub works with UEFI etc. I've got several copies of XP & win7 that boot from a CD/DVD/USB stick, work on most hardware because they include their own driver packs, and run completely on RAM disks. They could access any connected hard disks, but having attached hard disks was not necessary. I have also used the portable V/Box launcher & run a full win7 VM after booting to one of these.

RE: VirtualBox... With V/Box itself, you can change the MAC address -- it even has a random generator for that -- but you'd still need a VPN if you wanted to prevent someone(s) from capturing traffic, e.g. your ISP. A VPN or TOR or proxy should take care of the ip address. The V/Box VM's network can completely exclude the host & the host's hardware -- I've attached a USB network dongle, attached it to the VM so it had exclusive use of that network, & it works. The only way the V/Box VM knows that the host exists [& shares files etc.] is by seeing it on the network -- if it doesn't see it, it doesn't exist, can't write to it or interact with it.

What I do is have copies of the VHDs with my VMs on them. I have one VM set to use a D:\VMs\win10.vhd file. When I've made changes to it I copy the original on top of it, & it's exactly the way it was before those changes. If I want to keep those changes, I copy it somewhere else to save as an original. If I want to use the same file located somewhere else, I delete the file *listing only* in V/Boxes Media Mgr., then point the existing VM at the same file in whatever new location. That win10.vhd file could be erased when I'm done, or I could put it on a RAM disk before it's run, or I could put it on a small partition that's quick & easy to completely wipe. I do have that particular VM registered to me however...

If I wanted to be more anonymous I could use one of Microsoft's downloadable Windows VM trials, where I don't have to enter any identifiable info. If I don't want anyone to see I had & used something like the TOR browser in that VM, I can add it, use it, then delete that *copy* of the VHD. For a Really light weight VM I've run a Chrome VM that takes up less than 2GB, that could more easily be copied to a RAM disk than my 12GB win10 VM, which is otherwise the smallest.

For copies of Windows, Windows 7-10 trials might work. Win7 has nag screens etc. if it's not activated, but you can extend the trail date indefinitely. I'm not that sure about 8/8.1, but I installed a preview in a VM, then updated it until the 1st preview of 10, & up to that time it never showed anything about not being activated. I have installations of 10 that started as Insider previews before the RTM, & they're still activated. OTOH my son has an unactivated copy of 10 that he says rarely if ever reminds him, & has never become unusable.

Posted 7 years ago #
ChrisS
Administrator

I've got several copies of XP & win7 that boot from a CD/DVD/USB stick

Yeah, that would be the way to go. I have to laugh at myself, I was trying to get a internet-only browsing system but still felt compelled to have access to programs that I would never use in that environment. I think I need to join "Software Anonymous"... they have a "12-click program" don't they?

I can connect using a Ubuntu LiveCD but it takes a long time to boot so I started wondering about other distributions. I might have to play with some of the "Desktops" listed at The LiveCD List and see if I can find one that's quick to load from a CD and actually works.

Posted 7 years ago #
mikiem2
Moderator

I've got several copies of XP & win7 that boot from a CD/DVD/USB stick

Yeah, that would be the way to go.

DO see what you find & think of reboot[.]pro then Chris. There's some pretty sharp people there, as they use these setups to diagnose & fix PCs, workstations, servers etc. that they visit on-site, so they can't count on anything being there already. Many of the projects are set up so anyone can do it, with prepackaged apps, scripts etc. They keep it legal by having the user supply their own copies of Windows.

I see these ads & posts & such elsewhere for putting whatever version of Windows on a USB stick etc., but what they never mention is that Windows has to install drivers to work with the hardware, and once that happens, it's not too much different than a permanently installed copy -- it won't work on another PC. The versions these folks help you create include universal driver packs that with the exception of the network adapter are pretty much hardware agnostic.

And the copies of XP & 7 I have set up are pretty close to full versions of Windows, with a desktop, Start Menu etc., & in most cases I can install software [temporarily] as well as use portable apps. I have copies of 7 that are minimal, copies that have more software installed & so are larger, copies that find apps on a separate USB stick or drive & add those to the Start Menu. I set up the V/Box portable launcher so I could when wanted/needed run a full copy of 7 that had whatever apps installed normally. I also had [have] quite a large collection of portable apps, using the format & menu/launcher from portableapps[.]com, & that worked well with these small Windows setups. All that was using 8GB RAM -- that's what I used putting together the win7 systems, so don't know how well they do with more or less than that. They can be quite tiny, e.g. I have a USB stick with (1) LiveXP ISO @ 96MB, (1) LiveXP ISO @ 108MB, (1) win7 32 bit ISO @ 352MB, (1) win7 64 bit ISO @ 330MB, using a Grub4DOS boot loader/menu.

Posted 7 years ago #
mikiem2
Moderator

Besides, the Feds have all of our data and they frequently report "data breaches" so the moral of the story is probably "don't make it easy but it's pointless to go to extremes".

And they want more...

threatpost[.]com/dept-of-justice-makes-plea-for-mass-surveillance-hacking/118792/

I'm troubled by 3 things mainly from that article -- though I'm sure there's more to be worried about.

One is that continuing their trend of widely published misinformation, perhaps started with the infamous FBI vs. Apple suit in CA... the gov is saying it will help their fight against ransomware. That doesn't originate in the US, so any search warrant is pretty much irrelevant. And the FBI's stance on ransomware, as published, is you probably ought to pay it if you don't have a backup. If you're a big enough company I suppose they might take a report, but there's really little that they can do.

Two is their trend of using malware & exploits themselves. Which overlaps with number three, how much do you trust every individual in the gov to be A) completely apolitical & honest, & B) very competent?

Posted 7 years ago #
ChrisS
Administrator

perhaps started with the infamous FBI vs. Apple suit in CA

It was pretty clear that it was a smokescreen to get an iPhone hack. Otherwise, the FBI would have been saying "We can't investigate if the phone doesn't do the job for us".

But the questionable activity isn't limited to the FBI. This (http://financialservices.house.gov/news/documentsingle.aspx?DocumentID=400102) is from last December:

The Consumer Financial Protection Bureau (CFPB) has undertaken a dozen large-scale data collection efforts, gathering highly sensitive information on millions of American consumers even as the Bureau’s director has acknowledged that data held by the CFPB is “not 100 percent secure.”

The greatest Financial Protection threat facing Consumers is probably the Consumer Financial Protection Bureau.

Posted 7 years ago #
ChrisS
Administrator

This is more of an "f-stop vulnerability" but As It Searches for Suspects, the FBI May Be Looking at You:

The FBI has access to nearly 412 million photos in its facial recognition system—perhaps including the one on your driver’s license. But according to a new government watchdog report, the bureau doesn’t know how error-prone the system is, or whether it enhances or hinders investigations.

The size of the total pool of photos the bureau can access, which was not clear until the new report from the Government Accountability Office, is shocking even to those who have been paying close attention to the FBI’s growing use of biometric data,

When in public you should always wear large sunglasses and a big floppy hat because sunscreen doesn't provide enough protection. Once your biometrics are hacked, you're hacked; but, don't worry, data security is demonstrably a top priority. Given that a top is a spinning reality you might consider upgrading to the extra-wide brim hat...

Posted 7 years ago #
mikiem2
Moderator

The greatest Financial Protection threat facing Consumers is probably the Consumer Financial Protection Bureau.

I've been trying to come up with something that sounded at least a little less pessimistic, but I'm still stuck with a sci-fi sort of analogy where we've all had kill switches installed, then handed over their control to 2 people, one being pure evil personified, the other having an IQ in the lower double digits.

The kill switch part no doubt comes partly from my 20+ year battle with illnesses that different governments & medical communities did their very best to not just deny & ignore, but actively discouraged & even sometimes forbade research -- they even acted to harm the stricken, literally forcing treatment proven to be harmful. But that's another story...

Another part that applies more directly comes from the healthcare industry itself. There are all sorts of studies showing how its IT practices lag far behind most every other biz. A new study shows how healthcare workers frustrated by their poorly designed & implemented IT & software, work to go around security measures constantly. And now apparently the bad guys & gals have brought old malware back to life, combined it with methods to exploit IoT [Internet of Things] devices, & programmed it so that it moves laterally throughout a healthcare facility's network, seeking out unpatched & vulnerable medical devices. So your records are stolen, including any financial data, while your care is jeopardized by poor software habits [e.g. leaving patient records open, so another doc orders procedures thinking they're for another patient -- allegedly it's happened], while some black hat hacker twiddles the knobs for whatever equipment you're hooked up to, &/or quite possibly changes your meds & dosage.

The final part comes from so-called big data itself, & all these governments & government agencies wanting to collect every bit of it for their own use. Banks already use 3rd party companies that create a computer model of you, much like what advertising companies do, only using hard data to predict when you haven't made a purchase that shows up on your account. It's probably safest to assume that the gov gets at least some of that predictive data along with everything else regarding your banking history, & might itself [now or in the future] have the same sort of modeling software from agencies like the NSA. From the IRS we know that the US gov penalizes people that it disagrees with politically. I can't imagine it being a huge stretch for the gov to penalize those that it *predicts* have views &/or probably do [or would do] something that the gov doesn't like, technically similar [& doable] to targeted advertising practices today. And of course, being the gov, one can imagine Welcome signs hanging on their servers.

Posted 7 years ago #

RSS feed for this topic

Reply

You must log in to post.