Computer Question:Windows Updates?

[fyo]

- However, the security fixes from Windows Update will not patch the most common vectors of infection: Flash Player, browser plugins, and your web browser itself (if running a non-IE browser)

What is the benefit of running Windows Update, again?

The browser is the gateway, but once that data passes through that gateway, odds are, core Windows elements are going to interact with it some of it at some point.

Then there are all the remote code execution flaws that will allow anyone on the same network as you to take over your system. You could avoid most of those issues by locking down your local network, using a NAT router, a properly configured (hardware) firewall etc.

Done all that?

All right, let me return to the previous attack vector -- the browser. As I explained, it's quite difficult to prevent Windows from interacting with the media on the pages you visit. Are you using Media Player? If not, are you using a player that relies on Windows codecs?

Go to this page: http://www.microsoft.com/technet/security/current.aspx

And take a look at the last 6 months worth of CRITICAL (patched) flaws. The majority allow remote code execution.  There are 21 critical flaws in all. That's > 3 a month (and that's low-balling, because MS likes to include multiple fixes in a single patch, sometimes without documenting it properly). Do you honestly believe you aren't vulnerable to ANY of those?

There are critical flaws in codecs, media player, DirectShow (even VLC will use the DirectShow framework), the tcp/ip stack (hard to get around using THAT), activeX (okay, so you're not using that, probably), the Shell handler, Samba, VB Scripting engine (used more than you'd think) and so on.

To avoid ALL of those flaws, you'd pretty much have to turn your computer off (or not run Windows).

You also seem to be ignoring the fact that many third-party applications (and I'm assuming you DO use your computer for SOMETHING) use various Microsoft dll's, frameworks (compositing, codecs, DirectShow, DirectInput, DirectX, .NET etc) and what-not. Even if you keep ALL those applications up-to-date, you'd still be vulnerable to flaws in the Microsoft components that they use.

[Pappy13]

It seems that your cited link indicates that MS has admitted that WGA dials home once every 2 weeks without notification or permission.  Sounds like spyware to me.

If you keep reading it also says that MS was sued as being spyware and the case was dismissed.  In my humble opinion if you take it the courts to decide and you fail to win your case, you can't still argue that it's true.  That's just me.

Missing features, bug fixes, and performance improvements are not worth a potential 20% chance (according to the article you cited) of having my legitimate copy of Windows flagged as unauthorized.

Surely you're not suggesting that 20% of the PC's that use Windows are incorrectly flagged as having an unauthorized copy of windows?  According to Microsoft that 20% number actually refers to the number of false positives of those that do not pass the test, not of the overall number of windows users.  That number is actually under 1%.

From the link in the wikipedia entry

"Last summer Microsoft admitted that over 20% of WGA failures were caused by something other than key piracy, that is, piracy involving either a product key generator or use of a volume licensing key. The company would not reveal the exact nature of these results, other than to say that a portion of them stemmed from unauthorized use of OEM keys on non-OEM hardware (i.e., someone using a Dell copy of XP on a non-Dell machine). At the time, Microsoft refused to comment on the rate of pure false positives, that is, the rate of verifiably incorrect identifications of pirated software. With the release of this latest data, Microsoft said that WGA had a false positive rate "under 1 percent." A more precise number has not been forthcoming."

MS has literally hundreds of updates every year, perhaps thousands.  Compare the under 1% chance to test false positive to the hundreds or thousands of updates that have a chance to prevent you from having a problem? I'll take my chances with the nearly 0% chance of having a problem overall. 

[Pappy13]

This straight from Microsoft...

"To be precise, an actual 'false positive' would occur if WGA identifed a specific copy of windows installed on a system as non-genuine or unlicensed when in fact it was genuine and licensed. Of the hundreds of millions of WGA validations to date, only a handful of actual false positives have been seen. Most of these were due to data entry errors that were quickly corrected and only occurred for a short period of time. "

http://blogs.msdn.com/b/wga/archive/2006/07/16/667063.aspx

So to summarize:

1)  Yes approximately 20% of all WGA tests fail.
2)  The vast majority of those failures are due to non genuine Windows installations outside the US where piracy is rampant.  Over a million PC's in China alone were using a single license.
3)  Many of the "false positives" are in fact true positives where the customer is unaware they are using pirated software or software that somehow violates the licensing.  They only assumed it was a "false positive" because they didn't know they didn't have a valid license.  This can occur if you try to install the same copy of windows on multiple PC's or if you try to install a Dell specific copy of XP on a non-Dell PC for instance or even if you purchase a PC from a less than reputable source.

[Spider-Dan]

Then there are all the remote code execution flaws that will allow anyone on the same network as you to take over your system.

If someone on your own network is attacking your system, you have problems that extend beyond security updates.

All right, let me return to the previous attack vector -- the browser. As I explained, it's quite difficult to prevent Windows from interacting with the media on the pages you visit. Are you using Media Player? If not, are you using a player that relies on Windows codecs?

I am not using a player that relies on codecs that would be updated by Windows Update.  So that's another dead end.

As for the laundry list of Microsoft critical patches: taking a cursory glance at them, I'm still unconvinced that there is anything of significance.  So I challenge you to find two (2) examples of critical security patches delivered via Windows Update that would:

1) affect a person using Firefox as their browser
2) successfully address the vulnerability in question after the patch was installed

Because the only vulnerabilities I've seen so far that would meet those criteria would require something along the lines of clicking a link in an unfamiliar e-mail or attempting to execute a random shortcut file, which is precisely the type of behavior that I'm talking about when I say that modifying your behavior can prevent your PC from being compromised.

FYI: As far as I can tell, Gecko (Firefox's rendering engine) does its own rendering of HTML, XML, images, etc. (i.e. anything that doesn't require a plugin), so I'm not sure that Windows image rendering vulnerabilities would apply.  I welcome evidence to the contrary.

[fyo]

Pappy, WGA sucks and should be illegal. (A separate point from the one I was making about using the Updates in the first place).

This straight from Microsoft...

"To be precise, an actual 'false positive' would occur if WGA identifed a specific copy of windows installed on a system as non-genuine or unlicensed when in fact it was genuine and licensed. Of the hundreds of millions of WGA validations to date, only a handful of actual false positives have been seen. Most of these were due to data entry errors that were quickly corrected and only occurred for a short period of time. "

That's a lie. A handful? I've seen a handful myself.

Microsoft has, in other situations, said it won't release exact numbers but that it's less than 1%. That's still MILLIONS of users.

They only assumed it was a "false positive" because they didn't know they didn't have a valid license.  This can occur if you try to install the same copy of windows on multiple PC's or if you try to install a Dell specific copy of XP on a non-Dell PC for instance or even if you purchase a PC from a less than reputable source.

And this is one of the many, many reasons WGA sucks and Microsoft should be taken out back and shot. MS may consider an OEM version of their OS tied to a single machine, but they are subject to LAWS (in the relevant location) NOT whatever their post-purchase EULA says. Most countries allow you to sell your copy of Windows, yet another thing Microsoft doesn't recognize and which could easily cause a (genuine false positive) WGA failure.

This reminds me of those warnings before NFL broadcasts... "This broadcast may not be used for any purpose yadaydayada..." which is complete bullshit, since it doesn't take the lawful concept of Fair Use into account. The warnings on DVDs actually made it to court, but a judge deemed that no one could possibly think that they didn't have more rights than those (none) and thus didn't constitute a problem. *shrug*

On a personal note, I can say that I've had my copy of Windows go totally nuts simply because I hadn't used it in a really, really long time. Since I couldn't give WGA access to the 'net (had no connection right then and there), Windows went apeshit. This is something Microsoft WOULDN'T consider a WGA failure (of any kind), since the "service" (their server) wasn't contacted. However, from a user point of view, WGA certainly screwed me royally, despite my copy being fully legal. And, I should note, it didn't come with a stipulation that they could cripple the OS (or even nag me incessantly) if I didn't use their POS often enough and couldn't provide access to the Internet at WGA's whim.

[Spider-Dan]

If you keep reading it also says that MS was sued as being spyware and the case was dismissed.  In my humble opinion if you take it the courts to decide and you fail to win your case, you can't still argue that it's true.  That's just me.

According to MS's own glossary, spyware is defined as "a program that collects information, such as the Web sites a user visits, without adequate consent. Installation may be without prominent notice or without the user’s knowledge."

WGA collects information with no consent (and transmits it back to Microsoft).
WGA is installed without prominent notice.
If you have Windows Update set to Install Updates Automatically, WGA is installed entirely without the user's knowledge.

By Microsoft's own definition, WGA is spyware.

Surely you don't believe that the question of WGA's status as spyware is decided entirely by whether or not MS's opponent's lawyers are able to defeat Microsoft's lawyers in a lawsuit?

So to summarize:

1)  Yes approximately 20% of all WGA tests fail.
2)  The vast majority of those failures are due to non genuine Windows installations outside the US where piracy is rampant.  Over a million PC's in China alone were using a single license.
3)  Many of the "false positives" are in fact true positives where the customer is unaware they are using pirated software or software that somehow violates the licensing.  They only assumed it was a "false positive" because they didn't know they didn't have a valid license.  This can occur if you try to install the same copy of windows on multiple PC's or if you try to install a Dell specific copy of XP on a non-Dell PC for instance or even if you purchase a PC from a less than reputable source.

Let's take everything you said as fact.  From the MSDN article you cited, of the 20% of all PCs that fail WGA, 80% of those are because of actual piracy.  That leaves 20% that fail due to data entry errors, improper installation procedures, or something else that is not actual piracy, or 4% of the total population.

The excuse that WGA flagged a system because of various licensing antics does not carry water.  MS themselves does not dispute that the copies of Windows are, in fact, genuine (i.e. not pirated or counterfeit); they have simply determined that that have been installed in a manner inconsistent with their licensing.  WGA does not advertise this "feature," and I'd argue that said feature is of zero value to the consumer.

So again, given that Windows Update itself seems unlikely to patch the actual programs that I need patched to browse the Internet (read: Firefox, Flash, et al), a 4% failure rate for something that provides little-to-no actual benefit is about 4% too high.  If I have to patch all my key programs manually anyway, why expose myself to the risk of WGA (or other future MS shenanigans) unnecessarily?

[fyo]

If someone on your own network is attacking your system, you have problems that extend beyond security updates.

I take it you don't use public WiFi networks.

(Or semi-public wired networks, like many businesses).

I am not using a player that relies on codecs that would be updated by Windows Update.

I'd be interested in knowing what player that is. VLC uses the FFMPEG library for *almost* everything, but will use DirectShow codecs (on Windows) if FFMPEG doesn't have support for the relevant codec. And it will do so without asking you.

As far as I can tell, Gecko (Firefox's rendering engine) does its own rendering of HTML, XML, images, etc. (i.e. anything that doesn't require a plugin), so I'm not sure that Windows image rendering vulnerabilities would apply.  I welcome evidence to the contrary.

True.

However, all browsers cache images (unless you explicitly tell them not to). As such, they are stored on your computer. If you open the cache folder (in your profile folder) using Windows Explorer (which is what 99.99999% of everyone uses to browse files), Windows will parse those images regardless of whether or not you actually open the image in an "external" viewer. Even if you tell Windows (at least XP) not to generate thumbnails etc., it will still do it (just not show it).

Because the only vulnerabilities I've seen so far that would meet those criteria would require something along the lines of clicking a link in an unfamiliar e-mail or attempting to execute a random shortcut file

You don't need to execute it (and that goes for oh so many things in Windows these days). Take, just as an example, the following remote code execution flaw from 4 days ago:

http://www.microsoft.com/technet/security/Bulletin/MS10-046.mspx

The vulnerability could allow remote code execution if the icon of a specially crafted shortcut is displayed.

So I challenge you to find two (2) examples of critical security patches delivered via Windows Update that would:

1) affect a person using Firefox as their browser
2) successfully address the vulnerability in question after the patch was installed

The less you do with your computer, the less exposed you are. The two examples already presented in this reply fit the bill, provided you actually "do" normal stuff with your computer (in addition to using Firefox).

Others that fit with "normal usage" of Firefox:

MS10-007 / KB975713
The vulnerability could allow remote code execution if an application, such as a Web browser, passes specially crafted data to the ShellExecute API function through the Windows Shell Handler.

This would be where you open e.g. a PDF file with Firefox. The vulnerability exploited would not be in any Adobe product, but a Windows API. And, as your criteria stipulate, it would be fixed by applying this patch.

Similarly, there are a handful of critical flaws within the last 6 months related to DirectShow, codecs, etc. If you downloaded an AVI file (or MP3) file with Firefox and navigated to the Download folder, you'd already be exposed -- even before playing the file with your NON-Microsoft player.

If you want to limit this to the (completely unrealistic) scenario of no other programs being involved, fine:


MS10-009 / KB974145

TCP/IP stack. If you have IPv6 enabled and the attacker can send ICMP packets to you (not unusual, although a NAT router or hardware firewall would prevent it), you are open to this attack. All you have to do is have your computer connected to a network / the Internet.

MS10-042 / KB2032276

Help and Support Center. Doesn't sound relevant, does it? But Firefox registers (or at least did) the hcp handle by default, meaning you'd only have to follow a link on any web-page. A meta-refresh redirect of an iframe would presumably work as well. Even a site that allowed iframes by others would suffice (Facebook, MySpace etc all did, not sure if they still do). Popops are another delivery vector (there have been several instances of popular "normal" sites serving ads (popup and otherwise) with malware). Full (and I mean full) details in this little exposé:

http://seclists.org/fulldisclosure/2010/Jun/205

Conclusion from the above: In general, choice of browser, mail client or whatever is not relevant, they
are all equally vulnerable.

KB2032276 / MS10-043

Have Aero turned on in Win7? Then this affects you. The "problem" is that Firefox (or any other program) uses Windows libraries or APIs in order to accomplish a wide range of things. In this case, it's Firefox's GUI that triggers the vulnerability when running Aero (as would any other app with a GUI). Exactly how the exploit would work in this particular case is beyond me, but then I'm not a cracker

---

And those 3 were just from the critical flaws of the last 6 months.

[Spider-Dan]

I take it you don't use public WiFi networks.

(Or semi-public wired networks, like many businesses).

No and no.

I'd be interested in knowing what player that is. VLC uses the FFMPEG library for *almost* everything, but will use DirectShow codecs (on Windows) if FFMPEG doesn't have support for the relevant codec. And it will do so without asking you.

I use Media Player Classic (mplayer), with a fairly robust set of FFMPEG codes installed.  That is, when I am watching videos on my PC at all; I do the majority of my non-Flash video watching on an XBMC machine hooked up to a TV.

However, all browsers cache images (unless you explicitly tell them not to). As such, they are stored on your computer. If you open the cache folder (in your profile folder) using Windows Explorer (which is what 99.99999% of everyone uses to browse files), Windows will parse those images regardless of whether or not you actually open the image in an "external" viewer.

I think I have browsed through my cache folder maybe two times since Windows XP was released.  Maybe.  I don't think it is a realistic threat vector.

Take, just as an example, the following remote code execution flaw from 4 days ago:

http://www.microsoft.com/technet/security/Bulletin/MS10-046.mspx

The vulnerability could allow remote code execution if the icon of a specially crafted shortcut is displayed.

How does this shortcut get on to your PC?

Others that fit with "normal usage" of Firefox:

MS10-007 / KB975713
The vulnerability could allow remote code execution if an application, such as a Web browser, passes specially crafted data to the ShellExecute API function through the Windows Shell Handler.

From what I can tell, these kinds of problems (ShellExecute exploits that utilize passing of malformed URLs) have also been patched at the Firefox level in the past.  If that's still the case, keeping Firefox updated (which should be among your highest of priorities) would make the Windows patch redundant.

TCP/IP stack. If you have IPv6 enabled and the attacker can send ICMP packets to you (not unusual, although a NAT router or hardware firewall would prevent it), you are open to this attack. All you have to do is have your computer connected to a network / the Internet.

I literally do not know a single person who is directly connected to the internet (i.e. not behind a router) in 2010.

In any case, I don't dispute that the exploits that you mention are potential threats.  But as I see it, these threats still pale to WGA and WGA-like successors.  While manually installing patches is certainly best, I still prefer careful PC usage to Windows Update.

[fyo]

In any case, I don't dispute that the exploits that you mention are potential threats.  But as I see it, these threats still pale to WGA and WGA-like successors.  While manually installing patches is certainly best, I still prefer careful PC usage to Windows Update.

I'd rather risk having to go through some annoying steps to roll back a Windows update than have somebody own my system, steal my banking details etc. But that's just me.

Before I go on to address the rest, I'd like to point out that a flaw like the Security Center (HCP) one, is ONLY addressed by getting the fix from Microsoft. If you don't do that (or take steps to manually disable the handler), just viewing a web page is all it takes for someone to get full access to your system. And since the site I listed contains sample code for an exploit, do you honestly believe no "bad guys" are abusing this?

Oh, and I just thought you should know... Microsoft is patching 8 critical flaws allowing remote code execution on Tuesday (a new record, btw). Betting you won't be affected by a single one of those?

(A further 2 flaws addressed also allow remote code execution, but are "just" market important, not critical -- only a single one of the critical flaws is related to IE, the rest are "Windows").

I use Media Player Classic (mplayer), with a fairly robust set of FFMPEG codes installed.  That is, when I am watching videos on my PC at all; I do the majority of my non-Flash video watching on an XBMC machine hooked up to a TV.

So you always check the codec requirements of any clip before you watch it? (I'll admit I don't).

I think I have browsed through my cache folder maybe two times since Windows XP was released.  Maybe.  I don't think it is a realistic threat vector.

It was an example. The pertinent point is that any media file you get, whether PDF, video, audio, image or a Word Document (even a plain text document) gets read by Windows as soon as you open the containing folder. It doesn't matter what you use to display the file, Windows as already gotten its hands on it.

How does this shortcut get on to your PC?

This was in direct response to your claim that a shortcut had to be clicked. I merely pointed out that it doesn't; it only has to be viewed.

From what I can tell, these kinds of problems (ShellExecute exploits that utilize passing of malformed URLs) have also been patched at the Firefox level in the past.  If that's still the case, keeping Firefox updated (which should be among your highest of priorities) would make the Windows patch redundant.

I have no reason to believe that generally to be the case and I was unable to locate any information on Firefox fixes for the shell handler flaws I tried.

I literally do not know a single person who is directly connected to the internet (i.e. not behind a router) in 2010.

A router or cable modem is not sufficient. It has to perform NAT (in what is often called moderate or strict mode), as opposed to just forwarding everything anyway. Comcast cable modems shipped like this not too long ago.

Regardless, every time you use your Internet connection, you are using the TCP/IP stack in Windows. Even if you are behind a properly-configured NAT router, you would still be vulnerable to attack by a server that you initiated a connection to. In other words, if the server at www.example.com is hacked, YOU are stuffed just by visiting the site.

[Pappy13]

Pappy, WGA sucks and should be illegal.

Says who?  Not the department of justice which dismissed the case against MS.  That's your opinion.

That's a lie. A handful? I've seen a handful myself.

A handful of what?  False positives or just WGA failures.  WGA failures happen all the time, but it's because the program is working as designed.  Lots of illigitimate software out there.  If you're saying you've seen a handful of WGA false positives, are you absolutely sure it was a false positive?  How would you know?  Sometimes it's hard to spot a fake CD. PC Manufacturers have been caught selling brand new PC's without a valid license.

Microsoft has, in other situations, said it won't release exact numbers but that it's less than 1%. That's still MILLIONS of users.

Who says?  Less than 1% could mean millions or 10, we don't know.  Only MS knows that and the article I read above says it's a handful which in MS speak is probably thousands or 10's of thousands, but not millions.  Also note that it says most of those were early on, like in 2005 when the software was first released and that the problem has been corrected.  False positive WGA failures are very rare according to MS.  If you don't believe MS, that's fine but it always struck me as much ado about nothing.  I've have worked for about 5 different VERY large companies that each have had 10s of thousands of PC's with Windows on them and I have yet to hear about a WGA false positive on any of them.  I'm pretty sure that if there was demonstrative proof that false positives happen all the time we would know about it.  It happens, but it's rare.

[Spider-Dan]

I'd rather risk having to go through some annoying steps to roll back a Windows update than have somebody own my system, steal my banking details etc. But that's just me.

Setting aside the presumption that the "next WGA" is even capable of being rolled back, I'd rather take the responsibility of using my computer safely myself than give Microsoft the opportunity to arbitrarily make my computer useless.

So you always check the codec requirements of any clip before you watch it? (I'll admit I don't).

Like I said, I rarely watch any non-Flash video on my PC anyway.

A router or cable modem is not sufficient. It has to perform NAT (in what is often called moderate or strict mode), as opposed to just forwarding everything anyway. Comcast cable modems shipped like this not too long ago.

No modern consumer-grade router is going to ship without NAT (and for the record, when I said I didn't know anyone without a router, that's what I meant).

In any case, since this entire line of discussion is about me and what I do, I'm probably a bad example to pick if you're trying to prove a point.  I run NoScript on Firefox in Windows, I have a Linux fileserver that I use for browsing questionable sites at home, and I regularly set up Linux machines for friends and family that have had problems with malware.

So if this conversation has done anything, it's convinced me that I shouldn't be using Windows to browse the Internet at all.  Because I'm not using Windows Update, no matter how you slice it.

[Pappy13]

In any case, since this entire line of discussion is about me and what I do, I'm probably a bad example to pick if you're trying to prove a point.

Agreed.  So if we were to talk about a typical Windows user, do you think it would be wise for them to install the updates?

[fyo]

Says who?  Not the department of justice which dismissed the case against MS.  That's your opinion.

Yes, my opinion. Hence the should.

A handful of what?  False positives or just WGA failures.

False positives.

Yes, I'm sure they were real. They are actually not difficult to "cause". Switching components and IP address.

I've also seen quite a few false positives that MS might not consider false positives (but that their customer service reps "cleared" in the system, so that the license number would validate afterwards, which is an admission of a false positive). These were caused by people using a vendor-specific OEM Windows license on new computer. It was perfectly legal in the relevant jurisdiction (which is why Microsoft's customer service fixed it).

Only MS knows that and the article I read above says it's a handful which in MS speak is probably thousands or 10's of thousands, but not millions.

I've have worked for about 5 different VERY large companies that each have had 10s of thousands of PC's with Windows on them and I have yet to hear about a WGA false positive on any of them. 

Very large companies don't use WGA, so that's not exactly a surprise.

They use WSUS servers to push specific patches to all their Windows computers. WSUS provides companies the ability to select exactly which patches are applied (and forced) to which systems. This level of fine-grained control is essential to ensure that mission-critical applications are not adversely affected by patches.

[fyo]

Setting aside the presumption that the "next WGA" is even capable of being rolled back, I'd rather take the responsibility of using my computer safely myself than give Microsoft the opportunity to arbitrarily make my computer useless.

Then it was probably time for a reinstall anyway

So if this conversation has done anything, it's convinced me that I shouldn't be using Windows to browse the Internet at all.  Because I'm not using Windows Update, no matter how you slice it.

Your usage pattern doesn't seem to point to a NEED to run Windows, so why not jump ship completely?

I very, very rarely boot up in Windows (one thing that can cause problems with WGA), using Linux for everything.

[Pappy13]

Yes, I'm sure they were real. They are actually not difficult to "cause". Switching components and IP address.

This should not cause a false positive, it will however require you to reauthenticate.  That's 2 seperate issues.  Anytime you change components you have to reauthenticate, that doesn't necessarily mean it's going to fail WGA.

I've also seen quite a few false positives that MS might not consider false positives (but that their customer service reps "cleared" in the system.

Depending on the circumstance this might be perfectly reasonable.  If the product key had been previously registered you might have to have customer service "clear" it.  That has actually happened to me when I've had to reinstall my OS several times.  While it might be inconvenient, it's not really a false positive.  Maybe that's not the case you are talking about, I'd have to know the exact circumstance.  For the most part it's explainable and not really a false positive on non geniune software, but more of a data issue that causes the WGA to require reauthenticating.  The point is that it can be cleared with a simple phone call to MS.

Very large companies don't use WGA, so that's not exactly a surprise.

Agreed.  That was a bad example.