full-disclosure - Windows Update: A single point of failure for the world's economy?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20030819230602.1bfc59c8.michael@bluesuperman.com>
From: michael at bluesuperman.com (Michael Gale)
Subject: Windows Update: A single point of failure for
 the world's economy?


	Hey - just think of it this way - if Microsoft goes ahead with the auto patch install. All someone needs to do is get a automated install of any Linux ( preferred Slack ) version on to the patch server and BANG !!! Everyone is running Linux :)

Michael.


On Tue, 19 Aug 2003 12:47:25 -0400
"Richard M. Smith" <rms@...puterbytesman.com> wrote:

> Hi,
> 
> The Washington Post has an article in today's paper saying that
> Microsoft is mulling over making the Auto-Update feature of Windows XP
> be turned on by default.  The article can be found here:
> 
>    Microsoft Weighs Automatic Security Updates as a Default 
>    http://www.washingtonpost.com/ac2/wp-dyn/A11579-2003Aug18
> 
> This move by Microsoft sounds pretty scary to me.  I am willing to bet
> that if Microsoft proceeds with these plans, the Windows Update Web site
> could easily distribute and install new software on hundreds of millions
> of Windows computers in a day or two.  
> 
> The risk here is that the system could be exploited by a disgruntled
> Microsoft employee and become the ultimate malware distribution system.
> It seems to me that the Microsoft is in the process of creating a single
> point of failure for the world's economy.
> 
> I am wondering what sort of security and accounting systems that
> Microsoft has in place to prevent an insider attack on the Windows
> Update Web site?
> 
> As one data point, yesterday I updated my wife's Windows Me laptop at
> the Windows Update site to repair the DCOM security hole.  One of the 20
> patch files I downloaded was something for DirectX.  This patch file
> caused the laptop to blue screen of death in some VxD near the end of
> the Windows boot process.  Luckily for me, the system seem to repair
> itself after the 4th reboot.  I really didn't relish the idea of
> explaining to my wife how I broke her laptop.
> 
> Richard M. Smith
> http://www.ComputerBytesMan.com
> 
> 
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html