Considering MS's typical QA with updates, this shouldn't be terribly surprising. I'm going to guess that this was a test patch that got loose. Big companies aren't fault immune, if anything they are fault prone.
That was my point, yeah.
I'm not saying the OP's link is a result of these vulns being exploited, but them being exploited is always a possibility in the future if it hasn't already happened or been fixed.
Disclosure: MSFT employee, no knowledge of this beyond what I've read in this thread, though.
NEVER turn on auto updates on windows. Read all the KBs, then choose to install, ALWAYS. If you have a corp network, use WSUS and stop all updates and check them. If the KB is content-free like the new ones, no install. I avoided the whole CEIP bag of shit and Windows 10 upgrade notification hell thanks to that.
I'm sure this won't increase my load as the family technical support person at all.
Shouldn't Microsoft be signing updates so that redirection attacks don't work?
Edit:
Elaborating on my question; I mean much more like Linux distributions which sign both packages (updates) and the index of those files. Some distributions use multiple hashs/digests to make collision attacks far less likely to succeed.
Such an attack could be either the traffic at layer 3 redirected via router compromise, via some name resolution weakness (possibly even to localhost as a way of malware upgrading from being able to edit the hosts file to having system level services).
The signing of both the update files and the list of updates could offer protection from an attack that would thus need to be valid for all of the signature checks, not just a single check.
Based on the info in the post, I'd guess that this is a test update of some sort and that it was pushed by mistake.
Disclosure: MSFT employee, but no knowledge of what this is about.
Microsoft sign updates and utilise HTTPS.
Given how few users are impacted by this suspect update, it may be the result of malware on their local machine. If malware has root then all bets are off, the signing requirement can be removed.
The odds that parties outside of Microsoft have access to their update signing key is actually seems pretty likely given the Snowden revelations. Consider the Stuxnet distribution strategy -- what a boon it'd be to be able to deploy that sort of machine-specific payload via the built-in update kit.
http://security.stackexchange.com/questions/101520/weird-win... https://www.reddit.com/r/techsupport/comments/3mykv1/weird_w...
This does strongly suggest a compromise of the Windows Update servers or of some bit of infrastructure that connects people to them, but also suggests that whoever the attackers are, they made a mistake - a successful compromise executed correctly would not leave so much evidence around. It's quite possible that they've been compromised for awhile, and this is a buggy update to the existing malware.
We programmers like being specific. Sometimes these sorts of details matter.
If MSFT is anything like where I work, that "payload" is a picture of a cat.
http://www.zdnet.com/article/microsoft-accidentally-issued-a...
Now the spy updates are not hidden, and marked as "Important." They're bound and determined to force this crap down our throats. Bastards.
"Because f*ck you, that's why." The rallying cry of the corporate world.
I uninstalled each of those KBs manually from the "Installed Updates" screen, then changed the update policy. I used to use "download and install manually" but now I'd prefer only being notified, and THEN deciding whether or not I want to download whatever is offered. I then re-ran the check for updates, and hid the offending KBs.
That was earlier this month. After reading this article, I decided to have a look and see if there was anything fishy in my update history (beyond the listed KBs that I don't want). Nothing there, at least, but my hidden updates were un-hidden (along with Silverlight and Skype, two more "do not want" things that I always hide).
Interesting that the update in question is also 4.3MB?
Unless, of course...
But that would be a wee bit obvious.
Unless the servers are compromised and used as C&C?
It's already done. About 5 hours after the post was first opened on the forum. There's also an article on ZDNet.
http://www.zdnet.com/article/microsoft-accidentally-issued-a...
http://www.zdnet.com/article/microsoft-accidentally-issued-a...
That being said, that something like this could happen should raise lots of questions about the amount of oversight on updates hitting windows, and the general security of such systems. I'll wait for an official response or a reverse engineer before I decide what's going on here.
