Microsoft’s out-of-date driver list left Windows PCs open to malware attacks

MS is looking a lot more like another advertising company, but the day late copy others method hasnt left them; its somewhat sophomoric.

A release Windows Update (not preview or Insider or whatever) a while back deleted my My Documents folder thanks to quality <unwanted Microsoft product> code. As far as I can tell, no improvements in quality culture or testing have occurred since that time, just a bit of a "mea culpa" over the small detail that Insider testers had been complaining and filing reports about "Windows Update deleted My Documents" and nobody looked at the reports.

Another reason to make sure you have automated backups, I guess.

Work forces me to use Outlook (the web version) and it's the worst mail program I've ever used. I repeatedly need to mark the same mails as read (last week I got a mail which kept marking itself as unread each time I switched to a different folder and back). A more minor, but still ridiculous, thing is that I can't create a top-level folder named "Calendar" (WTH?). But you'll be glad to know they localised this bug, so you actually can't create such a folder using the word for "calendar" in whatever UI language you chose. The default theme makes it really hard to distinguish mails which are read and which are not. I could go on and on.

I have no idea how a company like Microsoft releases such a turd to the world. And supposedly they're focused on "The Cloud"(tm) now, not Windows. So it should be in a better state than Windows.

When it comes to Windows, I love the overall kernel design. But when it comes to using the system, it seems to really lack polish. The myriad of little dysfunctional details (mostly in things which were added after Windows 7) just kills my ability to work with the system without getting angry at it.

A numerator without a denominator is useless. Microsoft's ecosystem is much, much larger and complex than that of Linux (where things just fall over and die if no one touches them for a few years) and MacOS (which aggressively culls old APIs and features).

Such drivers may enable local attacks like the Razer driver issue (one description at https://www.bleepingcomputer.com/news/security/razer-bug-let...) since plugging in a particular device (or, really, a cheap USB chip that will fake the proper device IDs) can automatically download & install the vulnerable driver.

I largely concur with Raymond Chen's reasoning on the subject. However, there are two distinct factors Microsoft does not seem to realize as problems:

1. There has been a precedent in Windows to run everything as local administrator. Linux has always had the user vs. root paradigm, but Windows - at least in the client versions - has always just defaulted to administrative accounts.

2. Features designed to provide more fine-grained control of token privileges, such as UAC, process integrity, and virtualization, have been excluded from security bug bounties as being "not a real security boundary". This stance is somewhat counterintuitive and quite dangerous.

Combine those two with the fact that Microsoft never provided sane secure defaults for any of their software; it just goes to show that Microsoft is not concerned nor bothered with securing their software.

That shifts the issue of "don't run as admin, stupid" responsibility from the user to Microsoft to a large extent.

Did I miss something? If you have something that -should- have a non-reversable hash indicating that it is signed should that not work in all cases? I mean I don't see how anyone could argue that is "ok" even as an admin. At the very least it should throw up a warning and say "this driver is signed but it's not jiving with what is supposed to be there and likely malware so you shouldn't install it or know exactly what you are installing"

Maybe. But identifying vulnerable drivers being used in prolific malware and providing a signature to block them isn't.

Sure but checking a driver signature isn't, in this case it simply didn't work.