Hacker News Reader

You're right! It's rarely about who creates the backdoor/update channel/law but about who can leverage and abuse it (hacker, next president, etc).

We are slowly starting to realize how big these issues are. I hope.

Ahem, the next president?

That ties into the overall point of the comment that the person using the backdoor may not be the one who created/mandated it, i.e. one president that people trust mandates a backdoor but never uses it improperly, but the next president after them is more unscrupulous and uses that backdoor for nefarious purposes, effectively piggy-backing on the trust of the previous president.

The point is that it might not be appropriate to give someone the keys to the castle even if you trust them completely not to abuse that power, because people don't last forever in a position and that power will eventually pass to a successor who may be less trustworthy.

I laughed out loud reading this. This is a great, very clear explanation (though I think you may be responding to a joke). Can I get you to write my comments from now on? :)

This is an important approach to this problem. If you attack a hypothetical future leader, everyone can picture someone that might be worse, whether or not they like the current leader. It's a good way of avoid being dismissed over partisan concerns.

This seems to be a pretty big blind spot for our two-party system here. Every president I can remember has set precedent by using some rule/loophole in the powers granted to the Executive Branch and then their party gets bent out of shape when the next president uses that same technique to do something they don't like.

Doing the 'right thing' the wrong way just conditions the American public toward accepting an autocracy. While particularly bad for one party, it's not great for either of them, and certainly not for the citizenry.

Honestly, when the big bad comes around, any loophole will be used, the eternal classic being a state of emergency.

If everyone abuses these loopholes anyway, then maybe there's a chance that they'll be closed in time. One can dream, right?

Same reason why you would never trust any country to be a nuclear power, no matter how trustworthy it seems to be.

Specially one which has used nuclear weapons against civilians in the past.

Oh, wait, never mind ...

The problem is that once a country is a nuclear power, taking the nukes from them is kinda hard. Even when you simply don't trust them.

Current president isn't intelligent enough to pull the political maneuvers to pull this one off -- even his base would be up in arms. You can't say "bigly cyber" and click your heels three times and get back doors.

Also in the case of hostilities, there's no way you could block this channel ( OS updates ) on a large enough scale, fast enough. This vector would be utilized in advance.

> Android phones and Linux distributions don't have a single update channel for all of them

This is pretty much saying that, because an OS is open source, that means anyone can put it on almost anything and sell it, so the fact that the original developer can't control all possible distributions of the software that said software is untenable.

In practice, that is not how it works. You don't approach broad deployments of Android or, say, RHEL while getting supplied by a half dozen different OEMs. You pick one and stick to it. In much the same way Windows shops work - you normally either go with just Dell or just HP.

Hell, you can't lump Linux and Android in the same boat either. Vendors never guarantee perpetual phone OS updates on Android, because they always abandon their devices. The exception might be Google, maybe, with one of their device series from the last 5 years since the Nexus 4 which did get dropped, but you might be able to get a perpetual update contract with them for an extended support period. I have no idea.

But for something at Government scale, adopting Android is actually really trivial. At least it used to be - you could have just approached Cyanogen to support all devices with a guaranteed support period. Now I'm not sure if there is a corporate entity to barter with backing Lineage, but the same principal applies. There are ways around Android's horrible update model.

For desktop Linux, though, its no competition. You will always be going to one vendor, using that one vendor, and getting consistent updates from that singular vendor. Be it Dell or Red Hat or Canonical or whomever you plan to contract with. They aren't going to be throwing Gentoo randomly on a couple of your thousand Ubuntu boxes, and if you want they will certainly preconfigure the images to point the update servers to your own self hosted ones to control updates if you really want to.

True, but there's still a difference: One organization will homogenously use a single distributor/vendor/update channel within itself, sure. But different organizations might use different vendors, or even different sections of an organization if they're bureaucratically separated enough (e.g. not sharing budgets and IT staff).

If you're running Windows, you're getting it from Microsoft, end of story.

> If you're running Windows, you're getting it from Microsoft, end of story.

You talk as if nobody ever bootlegged Windows.

In the context of a large government agency that wants support and ongoing updates, yeah. Nobody bootlegs Windows.

That can change, once you've assumed that Microsoft can't legally deal with them.

So... the reason it's so trivial to locate Windows and Office, and the reason why KMSPico et exist... is so that the latest version of Windows - and updates - actually propagate, er, fully.

Presumably so that Microsoft doesn't get bad press, and maybe due to (shady but arguable) legal implications.

Oh wow.

> The exception might be Google, maybe, with one of their device series from the last 5 years since the Nexus 4 which did get dropped, but you might be able to get a perpetual update contract with them for an extended support period

Eh, Nexus 5x was The Phone for a while, released September 2015. EOL was announced in October 2016, software updates last until September 2017.

So it's still allegedly supported, but Android 7 update caused bootloops on a bunch of phones and Google determined it was a "hardware issue". Maybe it was, but I feel like Linux/Windows would work around this kind of issue, rather than shrugging and asking you to talk to the manufacturer.

Yeah, you need a Heavy Enterprise style vendor.

In virtually all Linux distros you can switch software repositories or delay or block updates altogether. And if they go the Linux route they can always choose a distro maintained inside the EU.

This isn't really true. I know that both Google and Amazon (and likely others) have their own versions of desktop Unbuntu, and, importantly, all software comes from their own PPAs (including OS / kernel updates).

In terms of the "kill switch" threat, this pretty much removes it.

Additionally, desktop Linux systems are similar and open enough that it wouldn't be a big deal to move to Debian / others if Canonical went up in smoke or were compromised. It certainly wouldn't cost end users file compatibility.

It's interesting because some cities publicly documented their switch to Linux, then came back to MS things (for some reasons). But in the end having open source, untied software is of political importance if you want to avoid being tied.

Munich never switched back, which is probably the city you are talking about, but Microsoft has been throwing millions of dollars into both defamatory propaganda against the city and attempts to either elect officials to force them back to Windows or to buy off key officials to make it happen.

It is extremely crooked when you read the narrative as its unfolded over the last decade. Microsoft is extraordinarily aggressive in maintaining its monopoly in the public sector.

I remember articles but nothing by Microsoft. Maybe influenced by MS though. There were a few other cities too IIRC.

ps: hooray for liberal private business right :)

Yea I remember reading about this in Linux Format magazine (yea I pick up a copy occasionally when at the bookstore...great read on all things Linux, and FOSS) a few years ago. It is crazy how far Microsoft will go if the stories are true. If Munich wants to use LibreOffice, then let them, or maybe make an OS that doesn't require an almost unfathomable amount of resources.

I'll bet you that would be the year of 'linux on the desktop' at last.

Disclaimer: Employee, not on Windows.

> With Windows 10, some editions cannot even postpone installing those updates for long.

Not saying that users will necessarily find the place to do it, or understand the implications of this action, but anyone can permanently postpone installing the updates by disabling the service.

http://www.thewindowsclub.com/turn-off-windows-update-in-win...

I think you were referring to the "defer updates" feature which is only available in Enterprise (and maybe Pro, I'm not sure about that one.)

As a home user, I would prefer to be able to select which updates I want to download/install, and when. I don't want to blanket disable all updates, because of course I do want security updates as soon as possible, but I want to be able to block specific updates for however long I want, potentially forever (in Windows 7, the "Hide Update" functionality does this nicely).

I make it a habit on my Windows 7 system to read each and every update's KB entry and determine if I want it. I wish I could do this with Windows 10.

In short, I don't think disabling the update service in Windows 10 is even remotely an ideal solution to this problem.

You can't do it anymore on Windows 7, because they switched to the consolidated patch model of 10. Now, the possibility you have are mainly a linear security only channel, and a linear security+stability(+eventually features) channel.

Right, I forgot. Well, at least with Windows 7, you can choose to install only security rollups, whereas with 10, AFAIK, you have to take it all or nothing.

This is why I'm in the process of switching to Linux as my daily driver and for service hosts. Putting all sorts of shit in the urgent security patch category was the final step. If you can't trust a security patch you can't trust microsoft at all.

I wish I could remember the exact things they pushed but I have a feeling they were windows 10 related.

Can't edit but I found a new example when looking to see if I could be vulnerable to WannaCry.

In the May 9th 'Security Rollup'; "Updated Internet Explorer 11’s New Tab Page with an integrated newsfeed." [0]

I cannot disentagle this update from the other ACTUAL security updates.

[0] https://support.microsoft.com/en-us/help/4019264/windows-7-u...

Yes, I was referring to the "defer updates" feature. The Pro edition has a limited feature - you can defer updates a little while - if you're in a managed domain, you can defer for longer but not forever.

However, if you make a practice of not installing any security updates at all, you create a bunch of other not easily solved problems for yourself.

Your interpretation may be true, but it's certainly not literal, since they literally state their interpretation (in bullet points, for clarity) and that ain't it.

(most of the Windows deployment under consideration would be enterprise edition, and they don't take updates automatically)

File under: garden variety EU chest beating.

> Microsoft Windows is both so widely used and so infrastructure-critical (you can't replace it with a different OS and keep running your native Windows applications)

If the US declared war on part or all of Europe, and caused Microsoft to send updates bricking legitimate Windows installs within that region, the victims could still use pirated Windows to run their native Windows applications. I doubt there would be any legal repercussions.

Then again, if US declared war on Europe, they'd just brick the hardware (which is what bricking usually means), or take out key parts of the backbone, then it doesn't really matter what the capabilities of individual users are.

When the problem is "we need to be able to run our existing native Windows applications", this matters. No matter what Microsoft does, a country can't be prevented from running their own native Windows applications on their own machines. They have all the necessary software and expertise locally. One strike is not a victory.

If MS, for whatever reason, bricked an entire country during wartime, the war would likely be over before most folks could figure out Bittorrent.

the victims could still use pirated Windows to run their native Windows applications. I doubt there would be any legal repercussions.

When...a month after ? Too late. Damage's done. War's over.

That is an unusually optimistic view of what it takes to win a war.

Maybe, but I doubt the next major war will involve tens of millions of soldiers occupying and then rebuilding a country, ala WWII.

Because today it's easier to destroy a country completely without boots on the ground, so people won't have to occupy it and won't bother to rebuild it?

IMHO, major wars will only happen somewhere in Asia...between China, Russia, India and Pakistan (all nuclear powers). They all have border issues are relatively large countries and China and India have potential to be local superpowers. China will need Lebensraum and move into Siberia and that might start it all. USA will probably seek to sell arms to both sides and stay out of it:).

It would take a huge amount of time, effort and money to reinstall and reconfigure, say, 80% of all computers in a country that happen to be running Windows 7 or newer. To recover all the data from backups (assuming the backup servers weren't running Windows as well). To replace any literally bricked hardware.

Meanwhile, many very critical systems that happen to be implemented on Windows would shut down for weeks or months. Look at the current ransomware attack on the NHS. Now imagine taking down all health services, ISP services, maybe electricity or gas or water companies, supermarkets, distribution and shipping management, police and government records...

Yes, these things usually have non-Windows components on big iron or Linux servers. But if you take out all the Windows clients, and however many Windows servers do exist, then the system as a whole cannot function.

This could be a part of a (cyber)war effort. Instead of, or before, sending in the army to attack, you cripple the enemy's economy and civil infrastructure. You even have a chance of maintaining plausible deniability if you attack the MS update distribution channel, or serve them a sufficiently secret order that doesn't get leaked.

Although its not much of a hurdle (as MS provide the hurdle too) don't modern large scale MS-based IT systems still rely on a local controller to push updates? This used to be the case with domain controllers a few years ago.

They can if they want to. It's called WSUS - Windows Server Update Services. But all it amounts to is a glorified local mirror and central point for pushing updates. You still don't know what individual updates do, still can't cherrypick individual fixes out of monthly rollups, still can't install some update without installing they prerequisite updates. And, like you pointed out, you can't fully trust the WSUS software, which also talks to Microsoft to update itself.

WSUS might delay or stop an attacker who takes over the MS distribution channel from publishing an update telling all target computers to shut themselves down right now. But a smarter attacker will distribute a time bomb as part of a legitimate update, that people will install for legitimate reasons, and that will be triggered after enough computers have installed it. The trigger may not even come via the Windows Update channel.

And to quote, "there's another theory that states that this has already happened."

Windows users should be blocking all Microsoft spyware with a DNS blackhole, except for when they occasionally want to pull in an update. I would share mine, but it's only running on a micro instance...

I rarely hear about black hole dns, and I often wonder why it's not more prevalant? Does anyone have insight into the pros and cons involved?

You need to be slightly technical to set one up and make sure your devices use it, and if you use a VPN that intercepts DNS like mine does, you need to host it on a publicly addressable IP.

Personally, I'm glad more people don't use it or I'm sure Microsoft would resort to hard-coded IP's and other methods, which require a very configurable router to block (like OpenWRT).

pf can block by IP address, so you could just set up an OpenBSD router. Again, technical, but if it ever DID become necessary, I can't think of a good way for MS to address that.

There are lots of ways. Think of it from an anti-malware perspective: how can the botnet agent on my PC, which has OS-level privileges, discover and communicate with the daily command-and-control server, if each day the network admin blocks the previous day's CnC server IP address?

Any network communications that the OS is allowed (or that a Microsoft program or driver that the OS trusts is allowed) can be used to carry extra data about which IPs to talk to in order to exfiltrate "telemetry" or download updates. DNS and WHOIS queries (where MS can publish arbitrary queryable records), peer to peer DHT-like networks (ditto), Tor (designed not to let your router/firewall know who the OS it talking to), the list is endless.

I'd assumed win10 was already doing some of this. My one VM that runs it is still not getting network access. Doesn't need it, and I don't trust it. But good to know, thanks.

depends who you're trying to thwart

TV downloading updates? it'll probably work

trying to stop MS from spying on you? they have engineered parts of the stack to avoid things like firewall and hosts file blocks, so presumably they have an IP hardcoded in case you block all their hostnames at the DNS level

Selectively pulling updates doesn't seem feasible. Consider that:

* Microsoft does not disclose what (most) updates do and it's not feasible to reverse engineer all of them to check.

* Multiple updates, including critical security patches, are published as a single monthly rollup and cannot be (easily) separated from one another.

* The Windows 10 Update client doesn't officially support cherrypicking some updates and delaying others indefinitely; if you let it connect to the (real) Microsoft update server it will try to install all available updates.

* You're not downloading individual per-update executables and checking their hashes; you're running a program (the Windows Update client) that, once it trusts the server it connects to, uncritically runs any code the server sends to it.

Now consider all of that when the adversary controls not just individual update contents but the whole update server or delivery channel...

You can also use a separate computer to manually install Windows updates:

http://www.windowscentral.com/how-download-and-install-windo...

Granted, the DNS blackhole is more about blocking the spyware than isolating single updates.

I wasn't aware of the MS Update Catalog. It's nice to know that it's an option. This does allow installing single updates without using the Microsoft Update client

It's not a long-term solution, though: 1. You need to know the KB article ID of the update you're looking for. And again, the individual update descriptions or KB articles frequently just say "something was fixed" but not what. 2. Some updates will probably fail to install because previous updates to the same component weren't installed. Conversely, updates that just give you the latest version of a file or application might auto-install the older updates you wanted to skip.

In any event, even if you successfully skip most updates, the main outcome will be that your system will be that much less secure and easier to take over using published vulns even without a backdoor...

I think you're saying you intentionally use an unpatched OS with known actively exploited and patchable vulnerabilities, you do so in situations where the machine is connected to the public internet, and you think the thing you should be worried about is Microsoft attacking your machine via Windows Update.

I don't think you need to worry about the number of people wanting to replicate your configuration exceeding the load your micro instance can handle.

> you do so in situations where the machine is connected to the public internet

Where'd you get that from? My "micro instance" is clearly not on my Windows machine. My Windows box is behind a pretty over-the-top firewall (which isn't even necessary on a private network for the exploits that are public). Not every vulnerability makes you remotely vulnerable behind your NAT, and I wish more of the people obsessed with update-hygiene understood that.

Is my solution good for a corporate network? Obviously not, because you can't control the attack surface.