topic Re: The (Windows) sky is falling! (again ...) in Industry News

The (Windows) sky is falling! (again ...)

rslade — Thu, 16 May 2019 18:14:40 GMT

OK, lots and lots and lots of stories today about a (the?) MS Windows RDP bug/vulnerability/patch.

Yes, if you're running XP, Win 7, Win 2003, or Win Server 2008 you should definitely get patched. (I'm assuming that a lot of you are, and that's why Windows Update still hasn't rebooted my Win 10 machine this week ...) (Which begs the question of why people are still running XP, Win 2003, or Win Server 2008. Yes, I have been disappointed ever since I updated from Win 7 to Win 10, and this is the first time I've been somewhat relieved ...)

But why is everyone so panicked about it? Well, it's a remote execution bug, and it doesn't need a login. Therefore, it could (potentially) be used to create a worm. So far it doesn't seem that anyone has actually seen one, but it could be created. And, for users of XP, Win 7, Win 2003, or Win Server 2008 that would be bad.

Anybody you rely on run XP, Win 7, Win 2003, or Win Server 2008? ...

Re: The (Windows) sky is falling! (again ...)

Flyslinger2 — Thu, 16 May 2019 18:35:18 GMT

My customer has not approved the migration from 2K8 server to 2k16 or higher. We get dinged in IA audits and the response is "oh well". "I'm not given a budget to do a refresh so ..." It's a battle of the witless.

I patch as soon as I can and as often as I can.

Re: The (Windows) sky is falling! (again ...)

denbesten — Thu, 16 May 2019 22:38:03 GMT

@rslade wrote:
Anybody you rely on run XP, Win 7, Win 2003, or Win Server 2008? ...

Device drivers for attached peripherals can be a huge limiting factor. Often times, they are prohibitively expensive or completely unavailable.

My wife's sewing machine is one example. The manufacturer wants much more ($500-1000) for the "upgrade" than the machine is worth. My solution was to remove the networking cable.

At work, our "limiting" peripherals tend to be things like industrial presses, milling machines, assembly lines and the like. The solution there will be network segregation with tight access controls.

Re: The (Windows) sky is falling! (again ...)

dcontesti — Thu, 16 May 2019 23:26:38 GMT

@rslade wrote:
OK, lots and lots and lots of stories today about a (the?) MS Windows RDP bug/vulnerability/patch.

Yes, if you're running XP, Win 7, Win 2003, or Win Server 2008 you should definitely get patched.

And, for users of XP, Win 7, Win 2003, or Win Server 2008 that would be bad.

Anybody you rely on run XP, Win 7, Win 2003, or Win Server 2008? ...

Unfortunately in some environments, those systems exist and others (yes some older) either cannot be patched (some running real time apps) or are so old they are not supported but the application works.

So we rely on network separation or ACL's or firewalls or......any number of methods in an attempt to forestall these issues.

Oddly enough, it does not say there are any "in the wild" threats, just that there is a vulnerability that could become WANNACRY version TWO. Yes I know it's only a matter of time until someone writes that but when I see notes (Like I did today)....that say stop production and patch immediately.....I wonder.

Wonders out loud "Do you think that maybe Microsoft developers should learn how to code securely?????" Just saying....

Re: The (Windows) sky is falling! (again ...)

AppDefects — Fri, 17 May 2019 20:00:32 GMT

XP is vulnerable! Nooooooo! Many hospitals and industrial control systems still depend upon it...

Re: The (Windows) sky is falling! (again ...)

AppDefects — Fri, 17 May 2019 15:24:02 GMT

@dcontesti wrote:
Oddly enough, it does not say there are any "in the wild" threats, just that there is a vulnerability that
could become WANNACRY version TWO.

I think this is click bait, but if you wanted to spend $39 you could find out for sure.

CVE-2019-0708 PoC Exploit on Windows. Release tool exploit via C#, Python Script

Re: The (Windows) sky is falling! (again ...)

dcontesti — Fri, 17 May 2019 19:26:16 GMT

@AppDefects wrote:
@dcontesti wrote:
Oddly enough, it does not say there are any "in the wild" threats, just that there is a vulnerability that
could become WANNACRY version TWO.
I think this is click bait, but if you wanted to spend $39 you could find out for sure.
CVE-2019-0708 PoC Exploit on Windows. Release tool exploit via C#, Python Script

My momma told me not to click on strange links....so no thanks.

Re: The (Windows) sky is falling! (again ...)

CraginS — Fri, 17 May 2019 21:03:06 GMT

@denbesten wrote:...
My wife's sewing machine is one example. The manufacturer wants much more ($500-1000) for the "upgrade" than the machine is worth. My solution was to remove the networking cable.

Uh.... Why does a sewing machine need to be connected to the Internet?

Re: The (Windows) sky is falling! (again ...)

AlecTrevelyan — Fri, 17 May 2019 22:10:40 GMT

@CraginS wrote

Uh.... Why does a sewing machine need to be connected to the Internet

So it can spool all of the forum threads! 😉

Re: The (Windows) sky is falling! (again ...)

denbesten — Sat, 18 May 2019 02:15:35 GMT

@CraginS wrote:
@denbesten wrote:...
My wife's sewing machine is one example. The manufacturer wants much more ($500-1000) for the "upgrade" than the machine is worth. My solution was to remove the networking cable.
Uh.... Why does a sewing machine need to be connected to the Internet?

The sewing machine itself sews in two dimensions (x-y), much like a pen-plotter. It does things like embroidering logo shirts. "Programming" a design involves using a paint-like program on an attached PC to create a long series of "move here, stitch" commands. It is this attached PC that runs XP and had the Internet connection. Collectively, the program, the sewing machine driver and the anti-piracy dongle work only with XP.

So what was the "business need" for an Internet connection? Windows/app updates, downloading clip-art and emailing images for approval prior to stitching the design. When XP EOLed, air-gaping was the outcome of our risk analysis, primarily for reasons of ROI.

Re: The (Windows) sky is falling! (again ...)

Flyslinger2 — Sat, 18 May 2019 12:13:41 GMT

If that Russian hacker makes his way into that network and is able to takeover the sewing machine what rogue clothing could we expect? 🙂

The weakest link breaks the chain. I remind myself that all the time. Most times it is the actual user. In this case definitely tech.

Re: The (Windows) sky is falling! (again ...)

CraginS — Sat, 18 May 2019 13:31:18 GMT

@Flyslinger2 wrote:
If that Russian hacker makes his way into that network and is able to takeover the sewing machine what rogue clothing could we expect? 🙂

Mark,

Commie Russki RED Hacker?

Don't you mean rouge clothing?

Re: The (Windows) sky is falling! (again ...)

rslade — Sat, 18 May 2019 18:15:53 GMT

> CraginS (Advocate I) posted a new reply in Industry News on 05-17-2019 05:03 PM

> Uh.... Why does a sewing
> machine need to be connected to the Internet?

For the same reason a sniper rifle and a ... ummm ... how do a put this without
running afoul of the dreaded "community" pr0n filter ... personal intimacy
enhancement device? does ...

====================== (quote inserted randomly by Pegasus Mailer)
rslade@vcn.bc.ca slade@victoria.tc.ca rslade@computercrime.org
A ship in port is safe, but that is not what ships are built for.
- (John A.?/William?) Shedd
victoria.tc.ca/techrev/rms.htm http://twitter.com/rslade
http://blogs.securiteam.com/index.php/archives/author/p1/
https://is.gd/RotlWB

Re: The (Windows) sky is falling! (again ...)

rslade — Sat, 18 May 2019 18:43:53 GMT

> @CraginS wrote Uh.... Why does a sewing machine need to be connected to the
> Internet

> AlecTrevelyan (Contributor III) posted
> So it can spool all of the forum threads!

Have a care, Alec. You could get stitched up for patching Cragin's post so that
you can needle him and embroider the discussion.

(Gloria once considered getting a networked sewing machine. I warned her that, if
we connected it to our home network, there was a good chance she'd be quilting
something and it would start spelling out "YOU HAVE NEW MAIL" ...)

====================== (quote inserted randomly by Pegasus Mailer)
rslade@vcn.bc.ca slade@victoria.tc.ca rslade@computercrime.org
Every exit is an entry somewhere else. - Tom Stoppard
victoria.tc.ca/techrev/rms.htm http://twitter.com/rslade
http://blogs.securiteam.com/index.php/archives/author/p1/
https://is.gd/RotlWB

Re: The (Windows) sky is falling! (again ...)

rslade — Sat, 18 May 2019 19:00:53 GMT

> Flyslinger2 (Community Champion) posted a new reply in Industry News on

> If that Russian hacker makes his way into that network and is able to takeover
> the sewing machine what rogue clothing could we expect?

Mao jackets?

====================== (quote inserted randomly by Pegasus Mailer)
rslade@vcn.bc.ca slade@victoria.tc.ca rslade@computercrime.org
There are two ways of constructing a software design: one way is
to make it so simple that there are obviously no deficiencies,
and the other way is to make it so complicated that there are no
obvious deficiencies. - C. A. R. Hoare
victoria.tc.ca/techrev/rms.htm http://twitter.com/rslade
http://blogs.securiteam.com/index.php/archives/author/p1/
https://is.gd/RotlWB

Re: The (Windows) sky is falling! (again ...)

dw_98 — Mon, 20 May 2019 01:20:06 GMT

Can anyone advise if the patches for win xp includes all embedded win xp or only Windows XP Embedded SP3 x86?

Can this patch be used for any win xp embedded os?

Re: The (Windows) sky is falling! (again ...)

dw_98 — Mon, 20 May 2019 01:25:03 GMT

Does Microsoft provide any verification tools to check if the os is still vulnerable eg after patch?

Re: The (Windows) sky is falling! (again ...)

Caute_cautim — Mon, 20 May 2019 03:53:47 GMT

Simply ask the Banks why the majority of them are still running Windows XP on there ATMs?

Why, cost?

Regards

Caute_cautim

Re: The (Windows) sky is falling! (again ...)

rslade — Mon, 20 May 2019 17:51:53 GMT

> dw_98 (Reader I) posted a new reply in Industry News on 05-19-2019 09:20 PM in

> Can anyone advise if the patches for win xp includes all embedded win xp or
> only Windows XP Embedded SP3 x86? Can this patch be used for any win xp
> embedded os?

You can probably get more detail at
https://support.microsoft.com/en-us/help/4500705/customer-guidance-for-cve-
2019-0708

====================== (quote inserted randomly by Pegasus Mailer)
rslade@vcn.bc.ca slade@victoria.tc.ca rslade@computercrime.org
Metabolically challenged - politically correct term for dead
victoria.tc.ca/techrev/rms.htm http://twitter.com/rslade
http://blogs.securiteam.com/index.php/archives/author/p1/
https://is.gd/RotlWB

Re: The (Windows) sky is falling! (again ...)

rslade — Mon, 20 May 2019 18:36:47 GMT

> Caute_cautim (Community Champion) posted a new reply in Industry News

> Simply ask the Banks why the majority of them are still running Windows XP on
> there ATMs? Why, cost?

Yeah, definitely cost.

Remember the old joke:

Q: If you have two products, both almost identical, but one is labelled "This doesn't work!" which one do you buy?
A: Depends on which one is on sale ...