Hacker News Reader

Comment by dpark | Hacker News Reader

I doubt it. It looks to me a lot more like a test update that was pushed to production unintentionally rather than malware. A server compromise pushing malware as an update would presumably try to make the update look legitimate in order to maximize how long it went undetected.

Disclosure: MSFT employee, no knowledge of this beyond what I've read in this thread, though.

View on HN

Exactly as predicted: http://arstechnica.com/security/2015/09/nerves-rattled-by-hi...

Also, big whoops.

They've gone through the process to put the "test" update to production servers, so I'm pretty sure this is intentioned. Though they might thought this is ok wo/ harms.

> a test update that was pushed to production unintentionally rather than malware

This position seems to be based on the assumption that malware is less likely to be subject to mistakes than MSFT.

Want to check with the PR dept? ;)

It's based on the assumption that it's more likely that someone made a harmless but embarrassing mistake than that someone shipped a major security bug in a critical system, which was then exploited by someone simultaneously skilled enough to hijack the Windows Update servers to deliver malware and incompetent enough to completely screw it up.

Random text but real TLDs also just smells like test data to me. Someone smarter than me could probably do the statistical analysis to determine if this is actually random or pseudo-random garbage typed by a person. Given the fairly long runs of all-caps and all-lowercase in the description, I'd guess a person typed this out (presumably as part of creating a test or test suite).

You could rephrase that as:

> A test update getting accidentally pushed out is more likely than a compromise of the Windows Update system.

Reply on news.ycombinator.com