Windows Update: A single point of failure for the world's economy?

From: Richard M. Smith (rms_at_computerbytesman.com)
Date: 08/19/03

  • Next message: pageexec_at_freemail.hu: "Re: PointGuard: It's not the Size of the Buffer, it's the Address" 
    To: "BUGTRAQ@SECURITYFOCUS. COM" <BUGTRAQ@SECURITYFOCUS.COM>
Date: Tue, 19 Aug 2003 12:47:48 -0400

    Hi,

    The Washington Post has an article in today's paper saying that
    Microsoft is mulling over making the Auto-Update feature of Windows XP
    be turned on by default. The article can be found here:

       Microsoft Weighs Automatic Security Updates as a Default
       http://www.washingtonpost.com/ac2/wp-dyn/A11579-2003Aug18

    This move by Microsoft sounds pretty scary to me. I am willing to bet
    that if Microsoft proceeds with these plans, the Windows Update Web site
    could easily distribute and install new software on hundreds of millions
    of Windows computers in a day or two.

    The risk here is that the system could be exploited by a disgruntled
    Microsoft employee and become the ultimate malware distribution system.
    It seems to me that the Microsoft is in the process of creating a single
    point of failure for the world's economy.

    I am wondering what sort of security and accounting systems that
    Microsoft has in place to prevent an insider attack on the Windows
    Update Web site?

    As one data point, yesterday I updated my wife's Windows Me laptop at
    the Windows Update site to repair the DCOM security hole. One of the 20
    patch files I downloaded was something for DirectX. This patch file
    caused the laptop to blue screen of death in some VxD near the end of
    the Windows boot process. Luckily for me, the system seem to repair
    itself after the 4th reboot. I really didn't relish the idea of
    explaining to my wife how I broke her laptop.

    Richard M. Smith
    http://www.ComputerBytesMan.com

  • Next message: pageexec_at_freemail.hu: "Re: PointGuard: It's not the Size of the Buffer, it's the Address"

    Relevant Pages

    • Re: Snail pace printing through wireless link
      ... Microsoft Defender is not installed by default on XP. ... a format and clean install) ... PC3 and the laptop work perfectly well on the same network - surely ... Windows - Shell/User ...
      (microsoft.public.windowsxp.print_fax)
    • SecurityFocus Microsoft Newsletter #176
      ... MICROSOFT VULNERABILITY SUMMARY ... Microsoft Windows XP HCP URI Handler Arbitrary Command Execu... ... PHPNuke Category Parameter SQL Injection Vulnerability ... Microsoft Baseline Security Analyzer Vulnerability Identific... ...
      (Focus-Microsoft)
    • SecurityFocus Microsoft Newsletter #49
      ... Subject: SecurityFocus Microsoft Newsletter #49 ... Microsoft Windows NNTP Denial of Service Vulnerability ... Microsoft IIS SSI Buffer Overrun Privelege Elevation Vulnerability ... Microsoft ISA Server H.323 Memory Leak Denial of Service... ...
      (Focus-Microsoft)
    • SecurityFocus Microsoft Newsletter #153
      ... MICROSOFT VULNERABILITY SUMMARY ... ZoneAlarm Random UDP Flood Denial Of Service Vulnerability ... FloosieTek FTGatePro Mail Server Path Disclosure Vulnerabili... ... Microsoft Windows NetBIOS Name Service Reply Information Lea... ...
      (Focus-Microsoft)
    • [NT] Cumulative Security Update for Internet Explorer (MS04-025)
      ... Get your security news from a reliable source. ... * Microsoft Windows NT Workstation 4.0 Service Pack 6a ... Navigation Method Cross-Domain Vulnerability ...
      (Securiteam)