Search the Community
Showing results for tags 'windows'.
Found 3 results
In early January 2015, researcher Michael Heerklotz approached the Zero Day Initiative with details of a vulnerability in the Microsoft Windows operating system. We track this issue as ZDI-15-086. Unless otherwise noted, the technical details in this blog post are based on his detailed research. To understand the significance of his report, we need to go back to the last decade. In mid-2009, Stuxnet was released against the Iranian nuclear program. Attributed to the United States and Israel, Stuxnet used multiple zero-day attacks against Windows to attack the Iranian centrifuges. It was discovered in June 2010 by VirusBlokAda and reported to Microsoft. In February 2015, Kaspersky Labs' Global Research & Analysis Team released findings that attacks included in Stuxnet were in use as early as 2008. The initial infection vector was a USB drive that took advantage of a vulnerability in the Windows operating system that allowed simply browsing to a directory to run arbitrary code. Windows allowed for .LNK files, which define shortcuts to other files or directories, to use custom icons from .CPL (Control Panel) files. The problem is that in Windows, icons are loaded from modules (either executables or dynamic link-libraries). In fact, .CPL files are actually DLLs. Because an attacker could define which executable module would be loaded, an attacker could use the .LNK file to execute arbitrary code inside of the Windows shell and do anything the current user could. To prevent this attack, Microsoft put in an explicit whitelist check with MS10-046, released in early August 2010. Once that patch was applied, in theory only approved .CPL files should have been able to be used to load non-standard icons for links. The patch failed. And for more than four years, all Windows systems have been vulnerable to exactly the same attack that Stuxnet used for initial deployment. To see how it failed, we need to examine the fix itself. To show the vulnerability in action, we made a brief video:
So I install 7 all is good as can be expected from a company in which has been literally taken over by poopypants , who seem to be in league with guiding you in your 'experience' The power switch gets a new machine. Re-install winblows 7 - a month later activation fails. Sure M$ I get it, you are so butt tight that even though the software was leased through a vendor (you think you own it but you do not) - It's been paid for, but M$ complains that it's a different machine so it cries that the disk might be used by several machines. Bull tripe! They have the ability to activate, update and track, but no , they do not. M$ has yet to figure out a way to know if the specific disk / license key is currently in use. Imagine that. Explain how this can be. So you do the phone thing with Mr.voiciypoo and dude coughs up a new key sequence. Might sound silly that I complain about this, because there absolutely has to be much more to this circus.