[HN Gopher] A Windows Update bug is renaming everyone's printers...
___________________________________________________________________
A Windows Update bug is renaming everyone's printers to HP
M101-M106
Author : ohjeez
Score : 80 points
Date : 2023-12-04 19:59 UTC (3 hours ago)
(HTM) web link (www.xda-developers.com)
(TXT) w3m dump (www.xda-developers.com)
| kobpow wrote:
| Imagine hacking into a key supplier's driver software and
| sneaking in defective metadata to Windows Update. Wouldn't this
| result in mass installation on various systems? Sounds like a
| serious vulnerability in security.
| lionkor wrote:
| No worries - if word gets out, you can simply deny the windows
| update! Oh wait, you can't.
|
| This may be an attack vector, for sure
| Jerrrry wrote:
| chaining accessing a likely air-gapped rsa private key to sign
| the malformed update with an already unlikely attack vector of
| a metadata parsing exploit itself means this is pretty pie in
| the sky
| radicalbyte wrote:
| I expect that many of the players have their private keys not
| only on accessible machines but also likely under version
| control. Probably on a cloud platform.
| fathyb wrote:
| I always liked imagining big players like Apple, Sony,
| Microsoft, Nintendo, etc.. taking absurd measures to
| protect their private signing keys, something like that
| Coca-Cola recipe vault.
| bombcar wrote:
| I've seen some documentaries implying that about some of
| the root keys for things like certificates, but you
| _know_ that there are some laying around in easy to use
| format ...
| radicalbyte wrote:
| That was my assumption considering that is exactly what
| we did do for our covid certificates. Ran on the same
| infra as passports which is gold standard.
|
| Microsoft? YOLO with their crown jewels:
|
| https://techcrunch.com/2023/07/17/microsoft-lost-keys-
| govern...
| Jerrrry wrote:
| You can split any key into x/n pieces that require x
| outta n keys to approve a transaction.
|
| All senior dev's, physical locations, board members,
| hell, even all stock holders, could cryptographically
| vote via an agreed upon method for any actions.
| pxeboot wrote:
| Didn't Sony get hacked and had a nearly completed film
| leaked? I hope the others you listed have far better
| security.
| mschuster91 wrote:
| > chaining accessing a likely air-gapped rsa private key
|
| Unfortunately, who knows if that's the case? Whoever was
| behind Stuxnet managed to steal the crown jewels of not just
| one but _two_ different companies. There 's a lot of
| companies with credentials to sign Windows kernel level code
| out there... which is also the reason why Apple is so
| insistent on getting rid of kext's - they want to get rid of
| the entire business model of allowing _anyone_ but themselves
| to run kernel-level code on ordinary macOS machines.
|
| [1] https://en.wikipedia.org/wiki/Stuxnet
| jowea wrote:
| Even for a state-level actor?
| realusername wrote:
| It seems that the QA on Windows is getting worse and worse, this
| kind of high visibility bug should be caught beforehand.
| Nextgrid wrote:
| There hasn't been any QA for years now. The old QA team that
| gave us masterpieces like Windows 7 has since been laid off.
| realusername wrote:
| That explains why it's going downhill then. It's sad to see
| what Windows has become even if I'm really not their biggest
| user.
| whalesalad wrote:
| QA on Windows? Is that a thing?
| RobotToaster wrote:
| QA? You mean the users?
| sydbarrett74 wrote:
| Eliminating QA was one of Nadella's first substantive acts as
| CEO. There has been no such thing as QA at Microsoft for the
| better part of a decade.
| dabbz wrote:
| QA elimination was a Terry Meyerson decision. There's a
| multitude of reasons he was asked to step down (allegedly).
| JohnFen wrote:
| But then why didn't they put QA back in place after he
| left?
| freedomben wrote:
| The more "oops" things like this get pushed in automatic updates,
| the more I begin to despise our modern culture of continual
| updates. This is by no means just a Microsoft/Windows problem
| either, this affects everything nowadays. My damn Pixel watch
| suddenly has a bug where if I turn around and walk back down the
| road I just came on, it rolls back my distance, like an old
| school odometer that is just tied to wheel rotations.
|
| I'm so sick of having working software one time, and the next
| time I open it it's broken or worse, has a completely overhauled
| UI and I don't have time to learn the new way to use it.
|
| As a dev I love CI/CD, but as a user I'm beginning to actively
| despise it for the UX that it's led to. I think too many people
| have decided that QA isn't needed anymore because "we'll get bug
| reports and can patch and deploy them quickly." That's a
| _terrible_ philosophy and you are bad and you should feel bad if
| that 's how you ship your software.
| rkagerer wrote:
| I've always despised it. I demand control over the timing of
| updates, and I allow only very few exceptions in any of what I
| consider my critical infrastructure.
|
| It means I pass on buying or using a lot of modern hardware /
| software. It also means my PC won't fail the night before a big
| delivery deadline for a multimillion dollar project for a
| client (and yes, I also keep duplicate spare hardware and
| backups to mitigate against regular failure).
| JohnFen wrote:
| > I begin to despise our modern culture of continual updates.
|
| I started fully despising it a number of years ago. I think
| it's one of the worst fads that has swept through the industry.
| I hope that eventually it will die a horrible death.
| easton wrote:
| > bug where if I turn around and walk back down the road I just
| came on, it rolls back my distance, like an old school odometer
| that is just tied to wheel rotations.
|
| Ah, they must be using the classic physics definition of work,
| where if you start and end in the same position you didn't do
| any work.
|
| (...does nobody at Google actually look at the step number?
| Isn't that half the use of these watches?)
| doubled112 wrote:
| Displacement: 0
| ifyoubuildit wrote:
| Absolutely. I don't trust any software these days. It might
| work today, but it's only a matter of time before the company
| outgrows the need to satisfy my requirements and I get left
| behind.
|
| At least with local software you could keep an older version if
| you needed to. With everything in the cloud with a subscription
| model, you can't get off the ride before they drive it off a
| cliff. Which it feels like they will do more often than not.
| randerson wrote:
| This explains the confusing email I got from Microsoft Family
| Safety last week saying that my child (who uses a locked down
| Windows PC for gaming) had purchased the HP Smart application
| from the Microsoft store for $0.00.
| urbandw311er wrote:
| Great, I can't wait for the promised utopia when things are all
| "joined up" and my PC automatically orders me ten litres of
| unwanted HP toner when this happens.
| sonicanatidae wrote:
| Even better, it'll happen while you own a Brother printer. lol
| thedanbob wrote:
| > After the printer metadata incorrectly identified everyone's
| printers as HP LaserJet printers, Windows installed all the
| software needed for an HP printer to work smoothly, including the
| HP Smart App.
|
| Tangential, but I absolutely hate printers that force you to
| install an app (or should I say spyware?) along with their
| drivers.
| rplnt wrote:
| Even more tangential, you can extend that to most common
| peripheral hardware. And it's kinda outrageous an OS would be
| forcing this down on their users.
| JohnFen wrote:
| Any printer that has to have special software (including
| proprietary drivers) is not fit for purpose, in my opinion.
| ssss11 wrote:
| The dev: "update works on my machine... now let me just print
| that document to my printer M101-M106"
___________________________________________________________________
(page generated 2023-12-04 23:01 UTC)