Windows Update Glitch

[Patsy Murphy]

Cool it with the Microsoft bashing. It doesn't add anything to the discourse, and frankly, you're just being snarky. I'm not asking you to sing romantic sonatas under Bill Gates' balcony, but we get it - you don't like Windows, and you prefer Linux. Fantastic. This anti-Windows contingent has expressed their views - be it bashing, expressing dislike, or encouraging users to try Linux in a VM - more than once across numerous threads. But, honestly, give it a rest. It's tired.

Rhit - you're confusing Malch with Jim.

Rhit isn't confusing anybody.

Malch just noted the event occurred. Jim raised the ante by taunting the Windows advocates. And they happily took the bait.

And you're wrong - as noted - this story has merit in this forum. So long as MS's policy around Windows 10 is mandatory patching, their screwups are quite germane. People are constantly asking here if they should update to 10 and this is a key reason why they should not

And here was me thinking the glitch relates to Win 7

It doesn't matter that this update is harmless-

It obviously does to you when you read the next part of your quote

it points to a complete lack of release control or quality engineering.

It's on top of their recent history of releases tracking patchings and win10 installers as "important updates" with a generic description.

Regards Patsym

 

[Austinian]

http://www.theregister.co.uk/2015/09/30/windows_update_glitch/

Malch, my hat is off to you.

With one simple link, no comment of your own, and no further posts by you in this thread, the hornets' nest got thoroughly stirred up.

That's what I call skillful. :-D

Well done, no sarcasm intended.

 

[SushiEater]

http://www.theregister.co.uk/2015/09/30/windows_update_glitch/

Malch, my hat is off to you.

With one simple link, no comment of your own, and no further posts by you in this thread, the hornets' nest got thoroughly stirred up.

That's what I call skillful. :-D

Well done, no sarcasm intended.

I bet million bucks that he did not have any intentions to do what you said he did.

 

[CAcreeks]

I saw this one for myself when I updated my Win7 VM earlier. I said this one doesn't pass the smell test so decided not to install it. lol

Let's just hope M$ is telling the truth. Can you imagine if hackers figured out a way to infiltrate Windows updates? lol

Below's the same story from Ars Technica.

http://arstechnica.com/security/201...uspicious-windows-update-delivered-worldwide/

Thanks Lylejk, I do not read Ars (longa, vita brevis) as much as El Reg. I had not known about these tidbits in the article:

"Assuming the worst, that Windows Update has been compromised, it wouldn't be the first time. The Flame malware reportedly developed by the US and Israel to spy on Iran hijacked Windows update so it could spread from one PC to another inside infected local networks. Earlier this year, researchers demonstrated an attack on the Windows Update servers used by large organizations to patch large fleets of computers they operate."

Auto updates always seemed problematic to me, because all that's needed to insert malware is to fake a DNS host name. I guess DNS is fairly secure, but only because of national and international co-operation.

 

[guido1953]

http://www.theregister.co.uk/2015/09/30/windows_update_glitch/

Malch, my hat is off to you.

With one simple link, no comment of your own, and no further posts by you in this thread, the hornets' nest got thoroughly stirred up.

That's what I call skillful. :-D

Well done, no sarcasm intended.

I bet million bucks that he did not have any intentions to do what you said he did.

--
Photography Director for Whedonopolis.com

+5

 

[Austinian]

I saw this one for myself when I updated my Win7 VM earlier. I said this one doesn't pass the smell test so decided not to install it. lol

Let's just hope M$ is telling the truth. Can you imagine if hackers figured out a way to infiltrate Windows updates? lol

Below's the same story from Ars Technica.

http://arstechnica.com/security/201...uspicious-windows-update-delivered-worldwide/

Thanks Lylejk, I do not read Ars (longa, vita brevis) as much as El Reg. I had not known about these tidbits in the article:

I read them both nearly every day. They're both good, but The Register has better humo(u)r.

"Assuming the worst, that Windows Update has been compromised, it wouldn't be the first time. The Flame malware reportedly developed by the US and Israel to spy on Iran hijacked Windows update so it could spread from one PC to another inside infected local networks. Earlier this year, researchers demonstrated an attack on the Windows Update servers used by large organizations to patch large fleets of computers they operate."

Auto updates always seemed problematic to me, because all that's needed to insert malware is to fake a DNS host name. I guess DNS is fairly secure, but only because of national and international co-operation.

The idea of hijacking Windows updates interested me enough for a few minutes' research as to how Flame might do this:

http://www.computerworld.com/articl...rs-reveal-how-flame-fakes-windows-update.html

"But as both Symantec and Kaspersky pointed out, Flame doesn't actually compromise Windows Update. It doesn't somehow infiltrate Microsoft's service -- and servers -- to force-feed malicious files to unsuspecting users.

Instead, a Flame-infected Windows PC can, in some situations, make other machines on a network believe it's Windows Update."

See the link for details.

 

[CAcreeks]

The idea of hijacking Windows updates interested me enough for a few minutes' research as to how Flame might do this:
http://www.computerworld.com/articl...rs-reveal-how-flame-fakes-windows-update.html

"... a Flame-infected Windows PC can... make other machines on a network believe it's Windows Update." See the link for details.

Wow.

Microsoft has revoked the X.509 certificates that made Flame possible, but some (most?) software pays no attention to certificate revocation.

Even if we go off-network as in Battlestar Galactica, we still run the risk of encountering Cylons.




Number Six, portrayed by Tricia Helfer

 

[Austinian]

The idea of hijacking Windows updates interested me enough for a few minutes' research as to how Flame might do this:

http://www.computerworld.com/articl...rs-reveal-how-flame-fakes-windows-update.html

"... a Flame-infected Windows PC can... make other machines on a network believe it's Windows Update." See the link for details.

Wow.

Microsoft has revoked the X.509 certificates that made Flame possible, but some (most?) software pays no attention to certificate revocation.

Does Windows Update? That would be what matters here.

Once a networked PC has been infected by malware, many bad things can happen that have nothing to do with Windows Update.

Even if we go off-network as in Battlestar Galactica, we still run the risk of encountering Cylons.


Number Six, portrayed by Tricia Helfer

That sure ain't the old Battlestar Galaxative with Lorne Greene... :-D

 

[lylejk]

Yes; Cylons were definitely much better looking with the new series Battlestar Galactica. lolol

 

[CAcreeks]

Microsoft has revoked the X.509 certificates that made Flame possible, but some (most?) software pays no attention to certificate revocation.

Does Windows Update? That would be what matters here.

I'm not sure, but this KB makes me think that prior to Windows 8 and Server 2012, the OS did not automatically revoke certificates until patched in June 2012.

Loading…

support.microsoft.com

 

[Austinian]

Microsoft has revoked the X.509 certificates that made Flame possible, but some (most?) software pays no attention to certificate revocation.

Does Windows Update? That would be what matters here.

I'm not sure, but this KB makes me think that prior to Windows 8 and Server 2012, the OS did not automatically revoke certificates until patched in June 2012.

https://support.microsoft.com/en-us/kb/2677070

Well, that looks like bad news for any remaining Windows 7 users who never applied any security updates.

But after all this time, all those unpatched machines have probably been recruited into so many botnets a few more infections don't matter. ;-)

 

[Jim Cockfield]

Cool it with the Microsoft bashing. It doesn't add anything to the discourse, and frankly, you're just being snarky. I'm not asking you to sing romantic sonatas under Bill Gates' balcony, but we get it - you don't like Windows, and you prefer Linux. Fantastic. This anti-Windows contingent has expressed their views - be it bashing, expressing dislike, or encouraging users to try Linux in a VM - more than once across numerous threads. But, honestly, give it a rest. It's tired.

Yes, I agree that here is too much in the way of bashing, and I've been guilty of that myself.

But, the opposite is also true, where users will support whatever the developers give them, and lash out at any users that make comments criticizing them.

What many fail to realize is that Windows 10 represents a huge departure from previous Windows versions in some areas.

For example, Windows 10 Home users will have automatic updates, like them or not, with no way to "opt out" of them; whereas users of previous versions of Windows had the ability to opt out of those updates as desired. That way, they could be notified of them without downloading and installing them until they could better determine if there were any problems by reading through forums to look for issues others may be having with them.

I've done that kind of thing for years, where I'd wait a while after new updates are released before installing them, making full disk image backups first in case of any issues.

Microsoft has managed to release "botched" updates for years, causing issues to users. There are many articles about that. Fortunately, the update that the first post in this thread referred to did not appear to cause any harm. But, a number of other Microsoft Updates have caused issues.

IMO, that's a subject that more debate is needed about (forced updates to Windows 10 users); and if users are not aware of that behaviour and complain about it to Microsoft, then no action will be taken. As the old saying goes "the squeaky wheel gets the grease". ;-)

The same kind of thing is true regarding Windows Privacy. Major changes were made in Windows 10 as far as the default settings for sending information back to Microsoft; where changing that behaviour is very difficult (requiring going through many different settings screens and/or using third party programs designed to modify registry entries to better protect your privacy.

Again, that's a major departure from earlier versions of Windows, and it's exactly the type of thing that users need to be aware of before upgrading to Windows 10, and how to handle privacy if they have already upgraded to it.

If that kind of thing is not being debated in forums, with complaints about it to Microsoft, then nothing will change.

I get the impression that you may not be familiar with all of the issues regarding the direction that Microsoft has been taking. Look through articles at any major Computer related publication and you'll find many of them discussing and debating these types of issues.

We're not just talking about the main functional differences between one Operating System and another; as we're discussing more serious differences regarding things liked forced updates (not only related to Critical Security Vulnerabilities, but feature updates that Microsoft wants us to have, too), and major changes in your Privacy when using Windows.

Sure, perhaps my posts have been a bit harsh and sarcastic towards Microsoft. But, please do not assume that it's purely Microsoft bashing, as I've been using every version of Microsoft Operating Systems since the earlier DOS 2.x releases, and still use Microsoft Operating Systems in dual boot configurations as needed.

The problems that users face now need to be understood and debated. Otherwise, users may not realize just how much they're giving up in the areas of Privacy.

It could be argued that others do the same thing (Google, Apple), gathering as much data as they can get away with for marketing purposes. But, Microsoft is taking this type of thing to a new level compared to previous Windows releases, and if users do not know about it and complain to them about it, then nothing will change.

The same thing applies to Updates. Again, we're not just talking about updates related to Critical Security Vulnerabilities. We're talking about Microsoft forcing updates for anything they want to change, even if that's pop up adverts about their products in notifications in your system tray.

They're already doing it, and I don't see that slowing down unless users complain loudly about it; as I certainly don't want my operating systems turned into Advert Delivery Platforms.

Yes... we should debate those types of issues in a more civil manner. But, I see problems on both sides, where many users will defend the actions of their favourite software at all costs, even when it's obvious that the developers' behaviour is unethical.

So, I'd hope that you take more interest in what is happening in the OS arena, and allow civil debate on important subjects like what Microsoft is changing in their Operating Systems that impact it's users.

--

JimC
------

 

[SushiEater]

1. Win 10 home is designed for....home user. If you are an expert don't use this version. Simple as that.

You complained that some updates may cause problems? How do you know that not updating will not cause problems? That is what updates are for. There is absolutely no difference between getting OS now and incremental updates and one year from now in SP1 version. There is absolutely no guarantee that SP1 will have fixed updates.

There is a reson why these updates called Security updates. The new security holes are found every day and MS has to patch them. Home user might not run updates at all, I know it from experience. My wife just ignores updates.

2. As far as spying you have no idea if MS was not spying before. Not a clue. They just choose to disclose it now but it doesn't mean they were not doing it before. Besides they don't call it spying. They call it Telemetry. Again, lets take a look what my wife is doing. If something goes wrong and the message comes up saying "Do you want send message about this error to Microsoft" what do you think she would do? Of course she would click on Yes. She is not an expert!!! She is still running Win7 and would not let me upgrade to Win10 because she simply does not care.

Now, since you are the expert go pay for Win10 Enterprise and you can have all of the controls you want. I did!!!

--
Photography Director for Whedonopolis.com

 

[Mark H]

Cool it with the Microsoft bashing. It doesn't add anything to the discourse, and frankly, you're just being snarky. I'm not asking you to sing romantic sonatas under Bill Gates' balcony, but we get it - you don't like Windows, and you prefer Linux. Fantastic. This anti-Windows contingent has expressed their views - be it bashing, expressing dislike, or encouraging users to try Linux in a VM - more than once across numerous threads. But, honestly, give it a rest. It's tired.

Yes, I agree that here is too much in the way of bashing, and I've been guilty of that myself.

But, the opposite is also true, where users will support whatever the developers give them,...

Let them - honestly, what difference does it make.

You have your take on things - let them have theirs.

You aren't going to change much about Microsoft's, or any other big corporation's ways, by 'debating' (and repeating yourself several times over, often within the same message post) on Internet forums like these - that is just delusional.

Use your own prerogative, and don't buy/use their product(s) - send them an email, start an on-line petition, picket their HQ with a placard or something if you must (but not here) . The vast majority of Windows users are perfectly happy to leave their PCs with fully automatic updates, and will rarely if ever have any issue whatsoever.

Similarly, the vast majority of PC, tablet, phone users, etc are perfectly happy to run with default privacy settings, whether it's Windows, Android, IOS or whatever else, with GMail bots scanning every email, and the vast majority will be totally oblivious and have pretty much no issues, and will 'live happily ever after'.

To the vast majority these are mostly just accepted non issues (even though I may sometimes see differently myself).

I say all this as someone who is actually quite neutral, neither allied to one side or the other - just grounded/pragmatic, and certainly not paranoid or alarmist, about these things.

...and lash out at any users that make comments criticizing them.

What many fail to realize is that Windows 10 represents a huge departure from previous Windows versions in some areas.

You are 'making a mountain out of a mole hill'.

Most people really don't care that much - and those few that do care, can, more often than not, usually take care of it themselves.

 

[guido1953]

Excellent synopsis, thanks.

 

[Jim Cockfield]

1. Win 10 home is designed for....home user. If you are an expert don't use this version. Simple as that.

You complained that some updates may cause problems? How do you know that not updating will not cause problems? That is what updates are for. There is absolutely no difference between getting OS now and incremental updates and one year from now in SP1 version. There is absolutely no guarantee that SP1 will have fixed updates.

There is a reson why these updates called Security updates. The new security holes are found every day and MS has to patch them. Home user might not run updates at all, I know it from experience. My wife just ignores updates.

You don't seem to "get it". We're not only talking about Security Updates. Microsoft is updating features and applications, too --- totally unrelated to security vulnerabilities.

Read the Windows 10 EULA. I started pointing out this behaviour even before Windows 10 was released. For example, here:

6. Updates. The software periodically checks for system and app updates, and downloads and installs them for you. You may obtain updates only from Microsoft or authorized sources, and Microsoft may need to update your system to provide you with those updates. By accepting this agreement, you agree to receive these types of automatic updates without any additional notice.

http://www.dpreview.com/forums/post/56151795

Unless you've had your head stuck in the sand, surely you've noticed the articles about this kind of thing in virtually every major computer related publication.

Microsoft is calling Windows 10 "Windows as a Service" now, pushing that it will be a constantly evolving Operating System.

Of course, that also means they may do things that some of us are not happy with. For example, asking for a monthly fee if we don't want to see adverts in Solitaire, as discussed in this post:

http://www.dpreview.com/forums/post/56332764

Or, how about updates that are solely to promote Microsoft Products, as discussed in this more recent post:

http://www.dpreview.com/forums/post/56525988

2. As far as spying you have no idea if MS was not spying before. Not a clue. They just choose to disclose it now but it doesn't mean they were not doing it before. Besides they don't call it spying. They call it Telemetry. Again, lets take a look what my wife is doing. If something goes wrong and the message comes up saying "Do you want send message about this error to Microsoft" what do you think she would do? Of course she would click on Yes. She is not an expert!!! She is still running Win7 and would not let me upgrade to Win10 because she simply does not care.

Now, since you are the expert go pay for Win10 Enterprise and you can have all of the controls you want. I did!!!

Uh, uh. right. You went with Windows 10 Enterprise, huh? Please explain how a user can do that without a larger contract with Microsoft encompassing many workstations.

My guess is that the newspaper you apparently work for had a contract with Microsoft, and that has nothing to do with your preference or assertion that others can "go pay for Win 10 Enterprise".

Sorry, it doesn't work that way.

Also, if your issues are already solved, why did you post this thread on using a hosts file to try and block Windows 10 from "phoning home"?

http://www.dpreview.com/forums/post/56513511

Of course, as pointed out, that wouldn't work anyway.

I dunno. Perhaps the moderator is right, since there appears to be little point in debating the pros and cons of newer features in Windows with some users. Or, perhaps I should give up on any civil debate with you, and just add you to my ignore list, as others here have already done; since it appears that logical debate is just not possible with some members.

But, I'm hoping that other members here may actually be interested in what is happening with the changes that Microsoft is making, and may want to understand them and debate their pros and cons.

--
JimC
------

 

[guido1953]

You are doing it again. If you want to be a participant here, then you need to admit defeat and simply stop the bashing and constantly defending your position. Let it go, you simply can not , and never will win. People here simply do not share your Microsoft concerns.

 

[Austinian]

I dunno. Perhaps the moderator is right, since there appears to be little point in debating the pros and cons of newer features in Windows with some users. Or, perhaps I should give up on any civil debate with you, and just add you to my ignore list, as others here have already done; since it appears that logical debate is just not possible with some members.

Does there *have* to be a continuous debate about Windows 10?

Is it just not possible for us to accept that not everyone has the same priorities and opinions, and move on from there?

 

[SushiEater]

1. Win 10 home is designed for....home user. If you are an expert don't use this version. Simple as that.

You complained that some updates may cause problems? How do you know that not updating will not cause problems? That is what updates are for. There is absolutely no difference between getting OS now and incremental updates and one year from now in SP1 version. There is absolutely no guarantee that SP1 will have fixed updates.

There is a reson why these updates called Security updates. The new security holes are found every day and MS has to patch them. Home user might not run updates at all, I know it from experience. My wife just ignores updates.

You don't seem to "get it". We're not only talking about Security Updates. Microsoft is updating features and applications, too --- totally unrelated to security vulnerabilities.

Read the Windows 10 EULA. I started pointing out this behaviour even before Windows 10 was released. For example, here:

6. Updates. The software periodically checks for system and app updates, and downloads and installs them for you. You may obtain updates only from Microsoft or authorized sources, and Microsoft may need to update your system to provide you with those updates. By accepting this agreement, you agree to receive these types of automatic updates without any additional notice.

So what? Do you think Microsoft making these updates to waste your time or theirs?

http://www.dpreview.com/forums/post/56151795

Unless you've had your head stuck in the sand, surely you've noticed the articles about this kind of thing in virtually every major computer related publication.

Someone has to write something about something otherwise they are going to go out of business.

Microsoft is calling Windows 10 "Windows as a Service" now, pushing that it will be a constantly evolving Operating System.

Fantastic, I have no problem with it.

Of course, that also means they may do things that some of us are not happy with. For example, asking for a monthly fee if we don't want to see adverts in Solitaire, as discussed in this post:

http://www.dpreview.com/forums/post/56332764

Aha, that is the beauty of software. I installed Win 7 Solitaire and if that is not available someone would write another version of it.

Or, how about updates that are solely to promote Microsoft Products, as discussed in this more recent post:

http://www.dpreview.com/forums/post/56525988

Another beauty of the open market. Someone will write software to stop advertising.

When you watch your TV you have no choice but to watch commercials, right?

I don't watch live TV. So I skip commercials.

There is always work around.

2. As far as spying you have no idea if MS was not spying before. Not a clue. They just choose to disclose it now but it doesn't mean they were not doing it before. Besides they don't call it spying. They call it Telemetry. Again, lets take a look what my wife is doing. If something goes wrong and the message comes up saying "Do you want send message about this error to Microsoft" what do you think she would do? Of course she would click on Yes. She is not an expert!!! She is still running Win7 and would not let me upgrade to Win10 because she simply does not care.

Now, since you are the expert go pay for Win10 Enterprise and you can have all of the controls you want. I did!!!

Uh, uh. right. You went with Windows 10 Enterprise, huh? Please explain how a user can do that without a larger contract with Microsoft encompassing many workstations.

My guess is that the newspaper you apparently work for had a contract with Microsoft, and that has nothing to do with your preference or assertion that others can "go pay for Win 10 Enterprise".

Sorry, it doesn't work that way.

Also, if your issues are already solved, why did you post this thread on using a hosts file to try and block Windows 10 from "phoning home"?

You are mixing two totally different stories here. I was talking about upgrade issues.

Even Enterprise version calls home.

http://www.dpreview.com/forums/post/56513511

Of course, as pointed out, that wouldn't work anyway.

So far it is working. I also figure it out how to block all IP addresses in the router.

And I just found out how to completely disable Cortana for good.

I dunno. Perhaps the moderator is right, since there appears to be little point in debating the pros and cons of newer features in Windows with some users. Or, perhaps I should give up on any civil debate with you, and just add you to my ignore list, as others here have already done; since it appears that logical debate is just not possible with some members.

You are not debating, you are pushing your point across and if someone does not agree with you, you get mad.

But, I'm hoping that other members here may actually be interested in what is happening with the changes that Microsoft is making, and may want to understand them and debate their pros and cons.

 

[kelpdiver]

Does there *have* to be a continuous debate about Windows 10?

Is it just not possible for us to accept that not everyone has the same priorities and opinions, and move on from there?

That would be true of nearly every routinely appearing topic here.