October 24, 2007

Windows automatically updating itself: Case closed?

October 22nd, 2007

Posted by Mary Jo Foley @ 12:52 pm

It’s time for the latest — and possibly final — installment of the seemingly never-ending saga of “Why is my copy of Windows automatically updating and rebooting itself?Windows automatically updating itself: Case closed?

In the last episode, the Windows Update Product team stated on its blog on October 12 that neither Automatic Update (AU) nor the bunch of patches that Microsoft rolled out on October 9, Patch Tuesday, were responsible for reports from Windows users earlier this month that their machines were automatically updating without their approval.

The Product Update team continued to investigate. At some point (I’m not sure exactly when, as the time stamp does not reflect the post update time/date) the team updated its blog again, suggesting a few possible causes for the reports by certain Windows users of their machines updating automatically. On the team’s list of possible reasons that AU settings can be (re)set or changed:

  • “During the installation of Windows Vista, the user chooses one of the first two recommended options in the “Out of Box Experience” and elects to get updates automatically from Windows
  • “The user goes to the Windows Update Control Panel and changes the AU setting manually
  • “The user goes to Security Center in Windows Vista and changes the AU setting
  • “The user chooses to opt in to Microsoft Update from the Microsoft Update web site
  • “The user chooses to opt in to Microsoft Update during the installation or the first run experience of another Microsoft application such as Office 2007.”

In short, Microsoft’s explanation was that users were knowingly or unknowingly changing their own Automatic Update settings and complaining about the results.

I went back and asked some of the many readers who complained in the comments on my blog post, as well as the additional ones who sent me e-mail, about both Vista and XP automatically updating even after they had indicated they did not want automatic updates to take effect automatically. I showed them Microsoft’s explanation. To put it politely, many did not feel Microsoft’s explanation was adequate. Here’s one reader response from a user who said that his XP machine rebooted itself this month, despite his AU settings being set to off:

“I’m not buying their explanation. I — for several years — have always shut off Windows update. I don’t want anything installed on my computer unless I know about it. If something is done on my computer, installations or whatever, I want to control it. I don’t allow any software vendor to update my software unless I’m aware of it. This includes Sun, Firefox, Thunderbird and others. I’m a computer tech and am keenly aware of how software changes can have adverse effects on a computer. I especially don’t trust Microsoft. Why and how Microsoft made changes to my computer very much concerns me and makes me more wary of MS than ever.”

Another reader astutely replied that he cialis daily generic thought that the users might be experiencing the problem noted my ZDNet blogging colleague David Berlind back in August. Berlind documented how Vista could force unwanted and immediate reboots on users. Microsoft’s explanation, at that time, was that users running in non-admin mode might be subject (knowingly or unknowingly) to the whims of their administrators. Microsoft’s explanation to Berlind:

“Because an administrative user had configured the machine to automatically stay up to date, the reboot is not postpone-able by a non-admin. Allowing a non-admin to override an admin’s wish is not the right default for security sake. This behavior is also controllable by policy to allow a non-admin user to interact with Windows Update. So yes, what [you] experienced is by design and justifiable as it does not allow a non-admin to go against the wishes of the administrative user. And again if running as a non-admin is his normal mode of operation, then there are policies which can be set to tweak behaviors more to his liking.”

I went back to the spokesperson for the Update team and asked whether it might be possible that this same policy decision was what was causing so many users to report that Vista and XP were automatically updating their machines against their wishes right after Patch Tuesday this month. The spokeswoman forwarded me the same response sent to Berlind, noting that it applied to Vista and XP.

The spokesperson said users who felt these settings were inappropriate should get their admins to change the policy setting in Windows Update so that a restart does not happen automatically after a scheduled install. (As Berlind noted back in August, changing this setting is not something many average users will be able to do easily.)

Microsoft is pointing users to this TechNet article explaining how to stop their machines from patching themselves without their approval, as well as this piece, which is specific to managing Windows Software Update Services settings.

There are still a number of unanswered questions, in my mind, regarding this matter. Why are reports of machines updating themselves automatically surfacing now, over the past several months, and not before now — especially in the case of five-year-old Windows XP? Are we going to start seeing these kinds of complaints flood in every month right around the time of Patch Tuesday? And are there other reasons beyond those Microsoft has suggested as the causes of Windows machines automatically patching and updating themselves which might be at fault here (as the reader I quoted is suggesting)?

Microsoft considers this Windows Update case closed. But is it? And should it be?

Permalink • Print • Comment

Attack of the PDFs

October 23rd, 2007

Posted by Ryan Naraine @ 1:13 pm

Attack of the PDFsLess than 24 hours after Adobe shipped a fix for a gaping hole affecting its Reader and Acrobat software, PDF files rigged with malware are beginning to land in e-mail spam filters.

The discovery of the active attacks have underlined the need for Windows users to immediately scan machines for vulnerable software (I recommend the Secunia’s free software inspector) and immediately apply all necessary patches.

According to Erik Kamerling, an analyst in Symantec’s DeepSight Threat Management System team, the e-mail-borne attack is using the ‘mailto: option’ vulnerability discussed by Petko D. Petkov in September and confirmed earlier this month by Adobe.

[ SEE: Free utility looks for missing security patches ]

Symantec has tagged the threat as Trojan.Pidief.A, a malware file that’s being used to lower security settings and download more malicious executables on to the compromised computer.
The rigged document is delivered as a piece of spam with a filename such as ‘BILL.pdf’ or ‘INVOICE.pdf’.

When executed, Kamerling said the malicious code tries to disable the Windows Firewall with a ‘netsh firewall set opmode mode=disable’ command, and then downloads a remote file via FTP from 81.95.146.130 (the remote file is ‘ldr.exe’ and is a Downloader trojan).

At 4:00 PM EST, the host 81.95.146.130 is alive and still currently serving ‘ldr.exe’ over FTP. This server is known for hosting malicious software, Kamerling warned.

The DeepSight team is recommending that network administrators:

  • Block the delivery of PDF files in email.
  • Advise employees to not read or execute PDF files from unknown or untrusted sources.
  • Block access to the network and IP address involved in this attack.
  • Apply the patches outlined in Adobe Advisory APSB07-18 as soon as possible.

Ken Dunham, director of global response at iSIGHT Partners, said the attackers are using two rootkit files to sniff and steal financial and other valuable data from hijacked computers. The rootkits are installed in the Windows directory as 9129837.exe and new_drv.sys.

[SEE: ‘High risk’ zero-day flaw haunts Adobe Acrobat, Reader ]

“Anti-virus detection is extremely poor for the exploit files and payloads involved in this attack, averaging cialis daily 5mg only 26 percent out of 39 updated programs tested during the time of attack,” Dunham said, nothing that the two attack servers are linked to the notorious Russian Business Network (RBN).

Dunham has found linkages between this attack and the zero-day Vector Markup Language (VML) attacks from September 2006. “Servers in the attack are also linked back to other malicious attacks involving Animated Cursor exploitation and Snifula and CoolWebSearch installations of code,” he said.

* Ryan Naraine is a freelance writer specializing in Internet and computer security issues. He can be reached at naraine SHIFT 2 gmail.com. See his full profile and disclosure of his industry affiliations.

Permalink • Print • Comment
« Previous Page
Made with WordPress and the Semiologic theme and CMS • Sky Gold skin by Denis de Bernardy