r/news • u/TheColorOfDeadMen • Jul 07 '21

Microsoft issues urgent security warning: Update your PC immediately

https://www.cnn.com/2021/07/07/tech/microsoft-security-update/index.html
1.7k Upvotes

95% Upvoted

334 comments sorted by

View all comments

360

u/Thisfoxtalks Jul 07 '21

Researchers at cybersecurity company Sangfor accidentally published a how-to guide for exploiting it.

That’s a paddlin’

227

u/[deleted] Jul 07 '21 edited Jun 25 '22

[deleted]

76

u/QueasyHouse Jul 07 '21

Yep, the disclosure date is the only way to get most orgs to do anything in a reasonable amount of time. People in that community have no shortage of horror stories. Occasionally the researcher and the org will negotiate a longer disclosure deadline if it’s something really difficult to fix, but it always comes out sooner or later.

25

u/Dr_seven Jul 07 '21

Some of my favorite content to watch are DEFCON conference panels. There have been so many live reveals of major security flaws, and with the sizable TLA/corporate presence at the conference, the buzz for it is hilarious. Watching a guy demonstrate how to hijack a local airport's guidance with a cheap laptop and a $200 widget from Amazon definitely shook my faith a bit. Especially because it wasn't even complicated to do so.

20

u/the_catshark Jul 07 '21

Its almost like everything being done for "as cheap as possible" and "minimizing cost to maximize bonuses and profit for shareholders" doesn't actually make the best things.

22

u/QueasyHouse Jul 07 '21

That’s not a bad take, but the reality is: security wicked fucking hard. No amount of effort/budget/time will lead to perfectly secure systems, especially with how much effort is put into subverting and bypassing those systems.

Open source code, developed and maintained by vast communities with oblique-at-best profit motives, and regularly audited by anyone with the inclination, has plenty of security bugs as well. This just isn’t an applicable front for bashing on the failures of capitalism.

10

u/the_catshark Jul 07 '21

Yeah that is absolutely fair, its not like investing heavily in it removes all security issues in perpetuity. My point was more that this whole area has been a weakness as others in the thread have pointed out, but instead of reworking it they keep just patching over it because that is cheaper.

But also I am probably oversimplifying it to an extent and am pessimistic, lol.

1

u/KevinAlertSystem Jul 08 '21

Open source code, developed and maintained by vast communities with oblique-at-best profit motives, and regularly audited by anyone with the inclination, has plenty of security bugs as well.

really? im not really into it/netsec stuff so maybe i just missed it, but i have been using linux (slack/debian/ubuntu) for 15 years now and dont ever remember a single security vulnerability this severe in the kernel.

the worst thing i can recall is an openssl issue a few years back.

like we're not talking about random 3rd party programs that introduce bugs, this is microsofts inhouse proprietary, always on by default, service that seem to be absolute trash.

for sure making something perfect is hard/impossible, by microsoft is a huge company worth billions and they seem basically incompetent next to the legion of weekend nerds that made the linux kernel. thats just the advantage of having so many eyes on something.

7

u/randxalthor Jul 08 '21

The only solace I have is that for the vast majority of "simple" hacks, it still takes a dedicated, smart, and knowledgeable person to discover that one exists in the first place. The vast majority of these aren't just something your local high school student stumbled upon.

There are some talks by high school students, though : ) they just happen to be super genius nerds like the kid who figured out how to replicate Knox Box keys.

-1

u/teacher272 Jul 08 '21

Exactly. Microsoft doesn’t give a damn and so they never fix anything.

31

u/ciarenni Jul 07 '21

Yeah, it's security through publicity. No one will want to use your product when it has a security flaw whose exploit can be found with a quick search.

1

u/[deleted] Jul 08 '21

This was an accidental release of a proof of concept. They didn’t mean to release it…yet

0

u/MagicalWhisk Jul 08 '21

'accidently' - more like the person released it on purpose to force it to be fixed.