full-disclosure - Unofficial Microsoft patches help hackers, not security

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed Jan  4 19:08:42 2006
From: toddtowles at brookshires.com (Todd Towles)
Subject: Unofficial Microsoft patches help hackers,
	not security

Joe Average (aka netdev) is confusing "patch" from llfak with the leaked
non-ready pre-release official Microsoft patch.
 
"Patch" from Ilak is good, pre-release patch from Microsoft bad.
 
http://djtechnocrat.blogspot.com/2006/01/wmf-six-days-til-checkered-flag
.html
 
-Todd


________________________________

	From: full-disclosure-bounces@...ts.grok.org.uk
[mailto:full-disclosure-bounces@...ts.grok.org.uk] On Behalf Of
Christopher Carpenter
	Sent: Wednesday, January 04, 2006 12:59 PM
	To: full-disclosure@...ts.grok.org.uk
	Subject: RE: [Full-disclosure] Unofficial Microsoft patches help
hackers,not security
	
	

	 

	 

	
________________________________


	From: full-disclosure-bounces@...ts.grok.org.uk
[mailto:full-disclosure-bounces@...ts.grok.org.uk] On Behalf Of Joe
Average
	Sent: Wednesday, January 04, 2006 11:50 AM
	To: Niek; full-disclosure@...ts.grok.org.uk
	Subject: Re: [Full-disclosure] Unofficial Microsoft patches help
hackers,not security

	 

	From my blog:

	 

	""[Unofficial patches are available, as is a leaked official
patch] [Unofficial patches are merely used by hackers as a tool to patch
machines they've compromised, to stop other hackers hacking the same
machine, although the machine is still accessable to the hacker.] [The
consumer goes along to Windows Update on Tuesday and doesn't think they
need a patch, because Microsoft tells them its not needed. Little does
the consumer know their machine was patched by a hacker, who now has
control over their computer network.]"" 

	 

	It means the unofficial patch is as harmful as the vulnerability
and exploit code its self.
	
	

	------------snip------------------

	 

	While this might be the case with binary-only patches, the patch
released by Ilfak Guilfanov comes with the source.  Review it and
compile it yourself if you are concerned.

	 

	Chris

	 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060104/243e8776/attachment-0001.html