Major flaw in Windows systems... make sure you've patched it.

[SecretMbr_735754 2,158]

http://www.zdnet.com/article/google-our-brilliant-spectre-fix-dodges-performance-hit-so-you-should-all-use-it/

"Google's 'moonshot' fix for the hardest-to-solve of the three Meltdown and Spectre CPU attacks seems to have paid off."   Attacks?  What attacks?  None reported.

So here's one of the first solutions being offered.  There's another article titled Microsoft: No more Windows patches at all if your AV clashes with our fix .  That sounds like nonsense so I'll read it and shred it best I can --sounds like another ploy to get you to install Win 10 which will slow down most Win 7 machines to a slug on a salted sidewalk.

[rsc204 21,869]

On 10/01/2018 at 9:31 AM, RandyE said:

There you have it: psychotic fantasies of wealth and power or actualization of human social and technological skill.  Choose one.

You do understand that companies are not in business to improve humanity or provide a social service, right? I mean, if that happens along the way, so be it, but companies are in business to make money, period.

35 minutes ago, RandyE said:

There's another article titled Microsoft: No more Windows patches at all if your AV clashes with our fix .  That sounds like nonsense so I'll read it and shred it best I can --sounds like another ploy to get you to install Win 10 which will slow down most Win 7 machines to a slug on a salted sidewalk.

The answer is really very simple. MS's current fix alters the way the OS works so dramatically that most AV software not designed to work with it will throw up a false positive. Worse still they'll do that with critical Windows system files and processes. Long and short, your AV will try to halt necessary system operations and break Windows in the process. To avoid this, a flag set in the registry will confirm that your AV is updated to work with the patch, until said flag exists in the registry, MS will not offer you the update. You know, the one you don't think we should install anyhow.

Quote

During testing of the patches for the two attacks, Microsoft discovered some antivirus had been making "unsupported calls into Windows kernel memory" that stop a machine from booting or cause blue screen of death (BSOD) errors after the patch is applied. To avoid this issue, it introduced the new rules...

...As he notes, the bypass technique some vendors are using is similar to the way rootkits work, which involves injecting their product into a Windows hypervisor to intercept system calls to memory locations that Microsoft changed in response to the Meltdown attack.

"Because some antivirus vendors are using very questionable techniques they end up [causing] systems to blue screen of death -- aka get into reboot loops. This shouldn't be possible in the latest operating systems, but some antivirus vendors have managed it by taking themselves into the hypervisor... Antivirus makers really shouldn't be messing with systems like this."

This has got nothing to do with forcing users from Win7. It got everything to do with AV software being poorly designed and doing things it shouldn't. However, because of the changes the patch makes, this is now a very serious problem and MS are making sure they don't get blamed for patches messing up Windows where 3rd party software is at fault.

No one is going to see more than a 30% performance hit using the updates, not to mention that's totally unlikely for any normal user. Under very specific workloads, there is a real problem, but most people are going to see a very minor difference, more like 5%.

If that's what you took away from reading up on the matter, then I don't know what you were reading frankly (quotes from your link). You know not everything has to be a conspiracy and it's not like MS created this problem either.

[SecretMbr_735754 2,158]

The great thing about computer tech. is that the machinery is mostly stable and pliable.   There's not a lot of moving parts to deal with and unless the problem is a defective chip, there's usually a way to re-program the machine.  The challenges here are how to keep the user's machines operating sufficiently without major impact from having to deal with potential hostile access to RAM memory while processing sensitive data.  An added encryption process may be a solution, and in that direction I can imagine a new level of processing that could achieve in reality what is found to be more falsely claimed of 'quantum' machinery, which doesn't actually exist, and which in strictest physics and computer tech. science is considered mostly 'fantasy'. 

So yes, these issues may be a constructive direction for computer science.  Instead of more fantasy tech., we may improve real tech.   The first solution is good news that serious technicians are stepping up to the plate.

Computer science and technology has nothing at all to do with business in itself, it has to do entirely with people doing real work of designing and constructing computer machinery.  'Business' is merely a fantasy dependency suffered by some people who think they can 'rule' and 'profit' without ever doing any real work.  Actual skilled people merely 'tolerate' them because they do at least organize the work space and collect the materials required to do the job.  

[Silur 3,309]

I never put updates on my XP. Never have any  problems with XP3. Have working copies of everything. Not worried about Windows XP and today. The horror of opening Your computer - it's Your horror!!!  ... I have and work with Paragon Exact Image 7.0 for my fine work from 2005!!! And more - I have HP my wife's notebook with Win 8.0 (before that Win 10} - this is my horror every Sunday... Win8 and Win10 systems only works for himself and thinks about his development and not about my work!!!

Really - I love Microsoft Corp. - for they finished support XP!!!   

Windows Vista, Millenium, 7, 8 10 - only ugly grey copies like XP. Nothing new - but there are many new money.    

And there are always weak spots to penetrate ... 

[rsc204 21,869]

1 hour ago, RandyE said:

 'Business' is merely a fantasy dependency suffered by some people who think they can 'rule' and 'profit' without ever doing any real work.  Actual skilled people merely 'tolerate' them because they do at least organize the work space and collect the materials required to do the job.  

Really, I'm sure those Google engineers don't work for a business that is a monopoly on internet advertising then? Also, in no way did they bother to make a fix that didn't loose them computing power because they are one of the worlds largest users of such compute-intensive resources. I.e., such a loss would hugely increase costs, so they found a better solution. Fact is, development is usually driven by money, that's the reality of the world we live in. I didn't say I was a fan of capitalism, but I am a realist and that's what's going on here.

[twalsh102 1,601]

Based on your statements, whether it's your own thinking, or someone else's which you agree with, I have to think the you have never worked for a business in any capacity the gave you insight into what it actually takes to run a successful business.  Nor have you ever created a business from scratch that would give you the experience to know how much hard work is required to allow you to not only pay the bills necessary create and sell your "product", and pay your employees, but to also put food in front of your own family at dinner time.

Apparently all one needs to do is buy the land, and build a factory, then collect all the necessary tools and raw materials and throw them on the factory floor, all of course without any thought of recompense for everything you've provided, and BOOM! all the necessary skilled workers magically appear out of nowhere; BOOM! necessary designs appear out of thin air; BOOM! everyone agrees on the necessary procedures to create the designed product; BOOM! all the employees work for free until the first products are able to be sold; BOOM! advertising appears out of thin air to drum up demand for your product; and BOOM! eventually the first dish washer goes out the door.  There's just one problem - your original intent was to build rocket engines!

Frankly, your statements about business sound like something I would have expected out of a fervent Communist Party member, circa the 1930's!

[Silur 3,309]

24 minutes ago, twalsh102 said:

Based on your statements, whether it's your own thinking, or someone else's which you agree with, I have to think the you have never worked for a business in any capacity the gave you insight into what it actually takes to run a successful business.  Nor have you ever created a business from scratch that would give you the experience to know how much hard work is required to allow you to not only pay the bills necessary create and sell your "product", and pay your employees, but to also put food in front of your own family at dinner time.

Apparently all one needs to do is buy the land, and build a factory, then collect all the necessary tools and raw materials and throw them on the factory floor, all of course without any thought of recompense for everything you've provided, and BOOM! all the necessary skilled workers magically appear out of nowhere; BOOM! necessary designs appear out of thin air; BOOM! everyone agrees on the necessary procedures to create the designed product; BOOM! all the employees work for free until the first products are able to be sold; BOOM! advertising appears out of thin air to drum up demand for your product; and BOOM! eventually the first dish washer goes out the door.  There's just one problem - your original intent was to build rocket engines!

Frankly, your statements about business sound like something I would have expected out of a fervent Communist Party member, circa the 1930's!

You should never speak about what You don't know ...

[SecretMbr_735754 2,158]

1 hour ago, rsc204 said:

I didn't say I was a fan of capitalism, but I am a realist and that's what's going on here.

Of course I'm not too lost in fantasy myself that I don't see the profit motive even behind any of the people working to develop any fix for their master's business.   I'm separating the skills and the machines from the non-skilled sector.  Lawyers, Politicians and Capitalists are not skilled labor.  In a real world, they would make excellent allocators of materials, organizers of work and safety monitors.  There's a job for everybody in a technological future!     

I suppose this topic will continue to get more interesting as the 'Big Fix' unfolds.  So stay tuned.

[SecretMbr_735754 2,158]

Jumping to conclusions and making wild assumptions is something we avoid doing necessarily in skilled work.  Its always an honor to work with skilled people where the dialectic is a process of solving a problem and making something work, its a constructive and beneficial process.  The end results are usually satisfying and fulfilling for everybody. 

[mattb325 28,899]

Perhaps, twalsh102, you would like to take the opportunity to re-assess your post to user RandyE and address him in a way that you would care to be spoken to by someone else who had a difference of opinion from yours. At the end of the day, it is his decision whether to patch his equipment or not. Rsc204 has been at pains to point out the very real risks to him (and others contemplating following his advice) should he leave his equipment unpatched, so your post adds little value.

While I have had the distasteful misfortune of seeing your true colours via PM exchanges, the over-reaching, sarcastic tone of your above post runs contrary to the public image you usually contrive on these forums.

[SecretMbr_735754 2,158]

I'm a bit of a showman so I have to take some responsibility for inciting some people with excessive passion, and sometimes that too can be constructive at least in gaining better and stronger understanding, its not that unusual, it doesn't make me any more special than anyone else.    With that said I'll point form my logic in dealing with the 'threat'.

* The general consensus in the tech. community, especially among people like us who are either hobbyists or employed technicians, is that its better to wait for the scenario to play itself out before rushing to take drastic measures that may result in disappointment.

*  The threat, in best research that I can personally do, is that the vulnerability is not easily exploited, requires considerable knowledge of computer science that would be unusual in the malicious coding sector.  The bad guys are good, but the good guys are usually better. 

* The threat requires a comprehensive and widely applicable solution which will require the best of the best to do the work of solving the problem, and that takes a lot of time and thorough testing.

* There are in the meantime very effective antimalware countermeasures that people can use to boost security sufficiently that no malicious code can be installed and executed on their machine.

* Bottom line is the vulnerabilities cannot be exploited unless malicious code is installed and executed.

EDIT:

* last point, if the bad guys do succeed in exploiting the vulnerability, their ultimate target would more likely be higher in range than the common user, although the common user may be victimized in the process, the satisfaction of the malignant agent would be in attacking the higher ups.  That means the higher ups will be forced to serve and secure all us little people or else lose in their own game of world domination.

[T Wrecks 10,210]

Just popping in for a friendly and general reminder of our lead principle here: please discuss the topic, not each other.

That being said, I'm also going to wait a little before I deploy any patches/fixes. Since I go without AV software altogether and base my security concept on preventing malicious code from even loading (let alone executing), this is not much of a difference for me - but it's also an approach I wouldn't recommend to everyone: if something does slip by, it gets messy. For others, installing patches directly may be a better choice because even if these screw up the computer temporarily, they can be rolled back, and data can be restored. If an exploit gets through, however, the result may be permanent data loss, which is clearly and obviously worse.

[Prophet42 1,503]

1 hour ago, RandyE said:

* The general consensus in the tech. community, especially among people like us who are either hobbyists or employed technicians, is that its better to wait for the scenario to play itself out before rushing to take drastic measures that may result in disappointment.

*  The threat, in best research that I can personally do, is that the vulnerability is not easily exploited, requires considerable knowledge of computer science that would be unusual in the malicious coding sector.  The bad guys are good, but the good guys are usually better. 

* The threat requires a comprehensive and widely applicable solution which will require the best of the best to do the work of solving the problem, and that takes a lot of time and thorough testing.

* There are in the meantime very effective antimalware countermeasures that people can use to boost security sufficiently that no malicious code can be installed and executed on their machine.

* Bottom line is the vulnerabilities cannot be exploited unless malicious code is installed and executed.

I totally agree with the 'wait' philosophy on the patch (actually any patch).  Let others be the guinea pig on applying the patches.  When things settle down and the patch becomes stable, then apply it to your machine.  Very rarily is a securty patch so urgent that you need to apply it immediately.  I mean just look at the AMD fiasco with the meltdown patch Microsoft released on the 4th.

I would recommend checking out Wood Leonhard on 'Woody on Windows' or his blog 'Ask Woody'.  He always seems to give level headed advice and usful information on applying the Microsoft patches.

[SecretMbr_735754 2,158]

On ‎2018‎-‎01‎-‎12 at 12:06 PM, twalsh102 said:

I have to think the you have never worked for a business in any capacity the gave you insight into what it actually takes to run a successful business.  Nor have you ever created a business from scratch that would give you the experience to know how much hard work is required to allow you to not only pay the bills necessary create and sell your "product", and pay your employees, but to also put food in front of your own family at dinner time.

The opposite would be true on all points above for me personally.   So hopefully that's enough to answer that question.  I don't see the experience and process as simple as what you've represented, there are a far wider number of variables and conditions than what you've delineated.  A business is not a bubble.

On ‎2018‎-‎01‎-‎12 at 12:06 PM, twalsh102 said:

Apparently all one needs to do is buy the land, and build a factory, then collect all the necessary tools and raw materials and throw them on the factory floor, all of course without any thought of recompense for everything you've provided, and BOOM! all the necessary skilled workers magically appear out of nowhere; BOOM! necessary designs appear out of thin air; BOOM! everyone agrees on the necessary procedures to create the designed product; BOOM! all the employees work for free until the first products are able to be sold; BOOM! advertising appears out of thin air to drum up demand for your product; and BOOM! eventually the first dish washer goes out the door.  There's just one problem - your original intent was to build rocket engines!

Not sure if your interpretation makes sense to me.  It seems to add in some kind of missing details that are not represented but simply omitted to support a conclusion that is not consistent with the premise.  The conclusion would lead one to believe that building rocket engines requires nothing of the above, in a sense all such is wasted effort if all that is required is building rocket engines.  The logic doesn't follow.

On ‎2018‎-‎01‎-‎12 at 12:06 PM, twalsh102 said:

Frankly, your statements about business sound like something I would have expected out of a fervent Communist Party member, circa the 1930's!

I don't even vaguely see any association at all to these references.  The technical and social research I've done tracking back through to the early industrial revolution are strictly in regard to means of production and availability and allocation of resources and support of human civil structure, more so from sociology and anthropology points of view than economics and politics which do not facilitate education and skill or advance of technology.   There are really no labels to attribute to my point of view, its positive materialism (somewhat of a label I suppose), oppositional to ideology and hierarchy --negative materialism.   So it gets a lot more off topic to go into discussion any further, but hopefully, this gives a different view than what may have been apparent. 

[Prophet42 1,503]

To emphazie T Wrecks' reminder, this topic is about the 'Major flaw in Windows Systems'.  If the discussion continues to stray from the original post, it will be locked.

[SecretMbr_735754 2,158]

From Wired:

"In a statement responding to the Meltdown and Spectre research, Intel noted that "these exploits do not have the potential to corrupt, modify, or delete data," though they do have the ability to spy on privileged data. The statement also argued that "many types of computing devices—with many different vendors’ processors and operating systems—are susceptible to these exploits," mentioning ARM and AMD processors as well."

So far it looks the vulnerabilities are all about spying on data entered into memory, not like a key-logger, but if an account number or password is in some stage of process it could potentially be passed to a malcious program and sent out through the firewall.    The probe component would also have to reside in memory, so that's where a resident AV monitor could seemingly easily flag it. 

It looks to me to be quite a set-up of malicious code required to achieve each step, including the routing of stolen data, without any detection, on a well-defended and secuirty monitored machine.

[SecretMbr_735754 2,158]

Here's an update on what's happening with the Meltdown and Spectre research:

Intel asks customers to halt patching for chip bug, citing flaw (JANUARY 22, 2018 / 10:55 AM / UPDATED 2}

https://www.reuters.com/article/us-cyber-intel/intel-asks-customers-to-halt-patching-for-chip-bug-citing-flaw-idUSKBN1FB2M9

Points taken from the article linked above:

* The issue of the faulty patches is separate from complaints by customers for weeks that the patches slow computer performance.

* Patches released after months of development caused computers to reboot more often than normal and other "unpredictable" behavior. 

* Intel asked technology providers to start testing a new version of the patches, which it began distributing on Saturday.

[SushiKii 5]

On 1/23/2018 at 3:29 PM, RandyE said:

Here's an update on what's happening with the Meltdown and Spectre research:

Intel asks customers to halt patching for chip bug, citing flaw (JANUARY 22, 2018 / 10:55 AM / UPDATED 2}

https://www.reuters.com/article/us-cyber-intel/intel-asks-customers-to-halt-patching-for-chip-bug-citing-flaw-idUSKBN1FB2M9

Points taken from the article linked above:

* The issue of the faulty patches is separate from complaints by customers for weeks that the patches slow computer performance.

* Patches released after months of development caused computers to reboot more often than normal and other "unpredictable" behavior. 

* Intel asked technology providers to start testing a new version of the patches, which it began distributing on Saturday.

Does Amd get affected by this as well?

I have an amd processor and i wonder about the patches with that. Though i havent seen much slowdown on my system.

[SecretMbr_735754 2,158]

38 minutes ago, SushiKii said:

Does Amd get affected by this as well?

https://www.pcworld.com/article/3246189/security/microsoft-halts-meltdown-patches-windows-amd-pcs-unbootable.html

There's a few recent articles from reputable computer tech. websites, after reading a couple of them, it seems AMD is not effected by the Meltdown vulnerability, but a patch previously released for Meltdown and Spectre caused some AMD machines to become unbootable. Athlon and Sempron are mentioned in the article linked above.   This is specific to Microsoft Windows 10.  There is a replacement patch for Win 10 now.

Its got to be a very complex issue with so many different chips, machines, devices, hardware, operating systems potentially impacted, and so many different patches and anti-malware conflicts.  So its a good idea to focus on exactly what system specifications, hardware, etc. you have and then look for a variety of information specific to your system.  

At this point there's not much of a general 'catch-all' solution, and likely won't be except by manufacturing new chips.  It would be interesting to know exactly how the same vulnerabilities came to be at the same time on so many different products from different manufacturer's, but so far that seems to be not being reported with much depth.

[SushiKii 5]

7 hours ago, RandyE said:

https://www.pcworld.com/article/3246189/security/microsoft-halts-meltdown-patches-windows-amd-pcs-unbootable.html

There's a few recent articles from reputable computer tech. websites, after reading a couple of them, it seems AMD is not effected by the Meltdown vulnerability, but a patch previously released for Meltdown and Spectre caused some AMD machines to become unbootable. Athlon and Sempron are mentioned in the article linked above.   This is specific to Microsoft Windows 10.  There is a replacement patch for Win 10 now.

Its got to be a very complex issue with so many different chips, machines, devices, hardware, operating systems potentially impacted, and so many different patches and anti-malware conflicts.  So its a good idea to focus on exactly what system specifications, hardware, etc. you have and then look for a variety of information specific to your system.  

At this point there's not much of a general 'catch-all' solution, and likely won't be except by manufacturing new chips.  It would be interesting to know exactly how the same vulnerabilities came to be at the same time on so many different products from different manufacturer's, but so far that seems to be not being reported with much depth.

Ah ok then will look for that.

[Odainsaker 2,137]

Microsoft brings us TOTAL MELTDOWN!

Aaaagggggh!  KABOOM!!!

As if Meltdown and Spectre were not bad enough, it turns out Microsoft had even more seriously bungled their updates meant to mitigate those vulnerabilities by creating an even bigger and scarier vulnerability.  The updates released in January and February of 2018 for 64-bit Windows 7 and Server 2012 R2 systems had incorrect settings that inadvertently can allow hackers relatively easy and total read/write memory access, a vulnerability now named "Total Meltdown."  Eeek!

Microsoft's March 2018 updates supposedly fixed the Total Meltdown problems buried in the January and February updates, but the March update for Windows 7 and Server 2012 R2 have other problems widely reported after public release, including memory leaks, breaking IP addressing, and BSODs.  Later information now suggests the March updates may still contain the Total Meltdown flaw.  In light of these problems, Microsoft does not seem to be fully recommending the March updates for some systems and stopped them from installing automatically.  It is hoped, but not promised, that Microsoft might fix these bugs in the upcoming April updates.

Windows 7 users monitoring their updates are now in a bind.  The buggy March updates supposedly had a fix for Total Meltdown, but they are not necessarily recommended by Microsoft itself.  Rolling back from the January and February updates, which first introduced the Total Meltdown vulnerability, leaves users back again open to Meltdown and Spectre.  There are as yet no known actual exploits for Meltdown, Spectre, or Total Meltdown, but the creation of an exploit for Total Meltdown is reported to be "trivial."  It's a test of risk management.  The wonderful site AskWoody with its Microsoft DEFCON system does not as yet recommend applying any of the March patches.

Microsoft two days ago released an emergency fix, KB4100480, for 64-bit Windows 7 and Server 2012 R2 systems that have the January, February, and surprisingly even the March 2018 updates in order to plug Total Meltdown.  It is not fully known what other side effects this patch has, but talk is trending that those affected systems should either immediately apply that patch, or rollback to the December 2017 updates in order to avoid the serious threat of Total Meltdown.  It is expected that this fix will be rolled into the upcoming April updates, but the April updates themselves will still have to be publically vetted.

 

This looks like the trend going forward as the fallout of Meltdown and Spectre continues.  Next up, Chernobyl patches, Three Mile Island hacks, and Fukushima exploits.

Aaaagggggh!  KABOOM!!!