Windows update nightmare scenario

[Xircal]

Tomorrow, the next Microsoft Patch Tuesday round takes place whereby those with Automatic Updates enabled will be fed the latest security patches.

There is however a nightmare scenario which, instead of updating machines, could compromise security by downloading malware to systems which haven't installed the emergency patch called KB2718704 issued by Microsoft on 4 June.

For a brief explanation of how things could go pear-shaped if you don't install the patch, see this article: https://isc.sans.edu/diary/Microsoft...Security/13429

A more in depth article which makes fascinating reading can be found here: http://rmhrisk.wpengine.com/?p=52

You check whether the KB2718704 has been installed or not by by going to "Add/Remove Programs" in Control Panel and then in the list of installed programs, check the installed security updates list. In Windows XP, it looks like this:

KB2718704.png

In Windows 7, go to "Programs and Features" in Control panel which should provide a similar view.

If you can't see it in the list, you can download it from here: http://support.microsoft.com/?kbid=2718704

[Just Plain Fred]

Hello all,
Just my 2¢ ( nothing to do with W.S. Lounge) .... Instead of being perpetually "Joined at the Hip" to MS security "Updates" Why not "Ditch" it altogether and get a "Real" ( Pay For) security software and paradigm... and never be again concerned with "Patch Tuesday" ... There are a few ways to do this ....and i have done this for years on XP-Pro,( only about 6 months with XP-pro) Vista, and "7" ..If any are interested on how this works for me, post back and I'll fill you in ... If you think that this is crazy ...scream at someone else... Regards Fred

[Doc Brown]

This appears more directed at enterprise networks, in particular Windows Terminal Services licensing and Windows Server Update Services. Few home users are going to have either of these on thier home network

Instead of being perpetually "Joined at the Hip" to MS security

Either way you are "joined at the hip" to something. And MS Patch Tuesday doesn't go away because because you've opted to pay for something that MS gives us for free. Everything has security vulnerabilities, and that being the case, its the 3rd party stuff (Adobe products in particular) that actually makes a 3rd party patching solution worth looking at.

[Just Plain Fred]

This appears more directed at enterprise networks, in particular Windows Terminal Services licensing and Windows Server Update Services. Few home users are going to have either of these on thier home network



Either way you are "joined at the hip" to something. And MS Patch Tuesday doesn't go away because because you've opted to pay for something that MS gives us for free.

"Doc" ,

Hello..Again speaking for myself.... For example (Norton) NIS 2012 and Malwarebytes Pro... update themselves everyday,and i don't have to "mess" with it at all.... Norton every few hours (pulse updates) at times Also neither of these have ever broken any of my OS's in years of use. Updating is not just once a month but... every day! ( at time's every few hours) So who is more up to date security wise? As far as "MS gives us for free" MSE is a very basic program ..and for most it's OK, but i like to have my security setup the way i want...NIS has so many more features over the Freebies....that there is no comparison. In my opinion "Patch Tuesday" is nothing more than mostly clever marketing on MS's part...Just trying to show that there are other options... In life you get what you pay for .... with the only possible exception being intelligence. Regards Fred

PS: I never patch a working OS...with any of MS's offerings so long as everything is working and stable.. so like i said I'm never concerned anymore with "Patch Tuesday"....Ever!

[eikelein]

@Just Plain Fred:

Hello..Again speaking for myself....

Good, I can accepty that.

For example (Norton) NIS 2012 and Malwarebytes Pro... update themselves everyday,and i don't have to "mess" with it at all

MSE updates it's definitions continually; no messing whatsoever!

Norton every few hours (pulse updates) at times Also neither of these have ever broken any of my OS's in years of use.

Sorry, but you can't have used NIS 2012 for years, right?
And let me tell you, you wouldn't believe what messy machines I had to clean after NIS (or it's predecessors) screwed up royally and did not even uninstall correctly; especially the last one has earned me quite some income, checking with Autoruns for left behind drivers and startup entries.

Updating is not just once a month but... every day! ( at time's every few hours)

It's okay with me if you choose not to distinguish between updates of virus definitions and software updates to protect from existing malware. But please don't consufe the many people here that do not have your expertise with advice that IMHO is really bad for the normal "average Jane" home user.

So who is more up to date security wise? As far as "MS gives us for free" MSE is a very basic program ..and for most it's OK, but i like to have my security setup the way i want...NIS has so many more features over the Freebies....that there is no comparison.

There is a comparison like feature duplication and workload. You may not experience it on your cool machine but ask my customers who still run a vintage 2.4Ghz XP machine with 512MB or 768MB.
Experience with many, many different home installations proves you simply on the wrong side, sorry.

In my opinion "Patch Tuesday" is nothing more than mostly clever marketing on MS's part

For you maybe but definitely not for "plain Jane".

...Just trying to show that there are other options... In life you get what you pay for

Yeah, you described it above, many buttons and knobs to turn and fiddle with "just like I want it". Your wants are may be bad advice for people with less know-how than you have!

.... with the only possible exception being intelligence. Regards Fred

Good to see that you can laugh about yourself; may I join in?

PS: I never patch a working OS...with any of MS's offerings so long as everything is working and stable.. so like i said I'm never concerned anymore with "Patch Tuesday"....Ever!

No comment; that IMHO is beyond reason. Sad, sad.

To summarize: Since I do my home computer fixer-upper thing I have urged and implored my customers to ONCE every week check manually for updates because Automatic Updates in Windows is in my experience only 75% dependable. They do that and have NO problems. The example from the beginning of this thread is mute and pointless for them because that update would have been in place. Apparently it was on ALL my customer's computers because I got no calls at all.

As you said correctly, just my opinion and experience from 30 years wit PCs.

[Drew1903]

I feel like I'm commenting on the obvious.

Set Windows Updates to Auto & w/in a day or 2 of Patch Tuesday, make sure all is in that should be. Best Practice is wkly check.
Critically important... Always keep Windows Updates up to date!

Do not use 3rd party apps to the neglect of Windows Updates

I own an IT consulting firm. Both me & the company are MS Partners. Also, I am a registered beta tester for MS. Security, Best Practices and good & proper advice are of paramount importance to IT Pros, such as myself, for the sake & service of our clients.

Oh, and a word on Norton:
Over the years, countless times, have removed it not, installed it; either @ my recommendation or the customers' request. It is a pesky pain, it has a huge footprint, things blow right by it & it is a resource hog; & that's being a gentleman about it. Always discourage Folks from using the wretched thing.

Cheers,
Drew

[Drew1903]

Referring to the OP... Checked Update History, patch went in 3/6/12

Drew

[Tinto Tech]

"I never patch a working OS...with any of MS's offerings so long as everything is working and stable.. so like i said I'm never concerned anymore with "Patch Tuesday"....Ever!

The difficulty with this approach is that there are attack vectors which do not need an unstable or "broken" system.

Referring back to Xircal's post, the threat here is generated by a forged Microsoft certificate. A user's machine will accept any content signed by by this certificate, not because the machine is bad or broken in some way, but because the certificate is fraudulent.

If a user browses an allegedly secure website, whose content is signed by a fraudulent certificate, they may be tricked into thinking that the site is genuine, whereas in reality it may be stealing data.

My understanding (though I'm perfectly willing to be corrected) is that the particular certificate in question is used to sign Windows Updates and hence introduces a vulnerability during patching. So in a sense JPF's approach protects him from the threat from that particular fraudulent certificate.

However, his approach does nothing to prevent similar threats from hundreds of other fraudulent certificates issued by compromised Certificate Authorities over the last year.

Any machine that has not implemented the patches to revoke these fraudulent certificates remains vulnerable to sites attempting to steal data, and unless the fraudulent site is on a blacklist somewhere, there is nothing that a local AntiVirus or AntiMalware package can do about it.

[Drew1903]

Remember, Folks, as I oft say to clients. 99.9% of Windows Updates are security related... the rest functionality. And security is, @ least, that important. So, put them in, always!

Cheers,
Drew

[eikelein]

I feel like I'm commenting on the obvious.

Set Windows Updates to Auto & w/in a day or 2 of Patch Tuesday, make sure all is in that should be. Best Practice is wkly check.
Critically important... Always keep Windows Updates up to date!

Do not use 3rd party apps to the neglect of Windows Updates

I own an IT consulting firm. Both me & the company are MS Partners. Also, I am a registered beta tester for MS. Security, Best Practices and good & proper advice are of paramount importance to IT Pros, such as myself, for the sake & service of our clients.

Oh, and a word on Norton:
Over the years, countless times, have removed it not, installed it; either @ my recommendation or the customers' request. It is a pesky pain, it has a huge footprint, things blow right by it & it is a resource hog; & that's being a gentleman about it. Always discourage Folks from using the wretched thing.

Cheers,
Drew

Drew, Thank you. It fels good to hear another voice of reason.

[Just Plain Fred]

Hello all,
Just would like to respond and comment...My "Security and OS" paradigm is an "Option" that i put forth to the "OP's" post ..It is based on my personal experiment ongoing for some 5 or so years now...Just to show that there are other options.. I care not if any want to do this or not ...none of my business....This is an ongoing experiment to test the "but what if "kinda thing"... Using (Various times) Norton 360, NIS 2010,11,12...and Malwarebytes Pro only...No Ms stuff at all ...Set to Never check, blah ,blah, blah.

1. Vista OS (Aprox 2007) ... (Same PC) One Partition OS with all MS Patches and Updates taken up to SP-2 ..the other with none.... Using my own Security... Results ...after running them side by side The patched OS had a few minor bug's, and had diverged about 4 GB from the un-patched OS... no security issues with either...

2. Windows 7 to SP-1 (32 and 64) same experiment (Same PC multi boot ) both with all and both without any patches or updates.... Similar results
No security issues..about the same divergence

3. XP-Pro....only run with the patches and updates that came with it (SP-3) ...never adding any since so far so good (about 6 months or so)

Bottom line ....After about 5 or so years with Vista and a few years with "7" , 6 months with XP ..."No problemo". I continue with all these OS's (multi boot) PC and run each as the mood strikes.. and post my results at times ...The difference is.... I have actually done this ...not like some who have not and just "Blow Smoke" Regards Fred

PS: If you decide to to this ...you will loose your "Common Wisdom Merit Badge"

[genej313]

I'm just curious. I have that KB but the date is 5/12. I tried your link, went through the validation hoops, but when trying to run it, was told it is not applicable to my computer which is a Win7 Home system with 4GB Ram. The date on the new KB was 6/3. Nothing is not working, I'm just wondering why it wouldn't be applicable. If you had any idea that is. Thanks. :^)

[genej313]

I am with you two. I used Norton Utilities for DOS, it had many wonderful features including the ability to enter a .com file and modify it with text in one window and hex in the other and at the time I was tending 200 PS2 machines, updating, upgrading, repairing and trouble shooting, installing programs and more. But when Peter Norton sold his soul to Symantec the trouble started. I did use Norton Utilities on several machines dutifully upgrading each year but over time it became a monstrous resource hog, was so glitchy as to be useless and all of the neat features from Peter Norton's original company disappeared with the Windows versions. Removing it was a pain, you had to, and probably still do, go to Symantec's site to get a special removal tool and even that didn't work well. I gave it up for good a LONG time ago. I don't use Suites for anything anymore, preferring standalone products that I have learned about over time from LangaList, Scott Finney and in recent years here. I've never had a security breach and have never had a virus get to my machine. The only trouble I ever had I couldn't fix was the infamous mupsys issue with XP Pro that resulted in a blue screen of death, and really did kill one machine. Symantec totally ruined Peter Norton's brilliance in my opinion and I'd never use anything they sell in the rest of my lifetime and probably not in my next one either, lol.

[Just Plain Fred]

Symantec totally ruined Peter Norton's brilliance in my opinion and I'd never use anything they sell in the rest of my lifetime and probably not in my next one either, lol.

genej,

Hello... I think that your comments about Norton products are unfair. I have used Norton 360, NIS 2010, 11, and now NIS2012.. It is not a resource "Hog" anymore than any other ..See this post starting around #22 on in comparing NIS 2012 against MSE... CPU usage.I find NIS 2012 to be a good program that by far exceeds MSE in form or function. It (Norton NIS2012 ) can be completely custom tailored to any users needs ...almost to a fault. Regards Fred

PS: NIS even has a real time display to show how much Norton's CPU use is Vs The System.

[eikelein]

@JustPlainFred

genej,
Hello... I think that your comments about Norton products are unfair. I have used Norton 360, NIS 2010, 11, and now NIS2012.. It is not a resource "Hog" anymore than any other ..See this post starting around #22 on in comparing NIS 2012 against MSE... CPU usage.I find NIS 2012 to be a good program that by far exceeds MSE in form or function. It (Norton NIS2012 ) can be completely custom tailored to any users needs ...almost to a fault. Regards Fred

PS: NIS even has a real time display to show how much Norton's CPU use is Vs The System.

Sorry Fred, but there are many out here whose experiences with many years of NIS on many, many customer's machines are simply opposite of what you insist on. That NIS works for you is fine; to project your personal experience onto others is IMHO the potentially dangerous part here.

None are so hopelessly enslaved as those who falsely believe they are free (J. W. Von Goethe)

None are so hopelessly enslaved as those who falsely believe in NIS (or McAfee or Trend Micro, or,or,or...).