Forgot your password?
typodupeerror
Windows Bug Microsoft Security IT

Microsoft Confirms Update-Linked BSODs Required Compromised Machines 199

Posted by timothy
from the calling-that-glass-half-full-takes-chutzpah dept.
Trailrunner7 writes "Microsoft on Thursday confirmed that the blue screen of death issues that affected a slew of users after the latest batch of Patch Tuesday updates is the result of an existing infection by the Alureon rootkit. There was widespread speculation after the patch release that simply installing the MS10-015 update was causing the BSOD condition on some Windows 32-bit machines. However, Microsoft said at the time this was not the case and started an investigation into the problem. In an advisory released Thursday, the company said that it now was confident that the restart problem is being caused by the Alureon rootkit." That seems a harsh way to find out that your Windows machine has been rooted.
This discussion has been archived. No new comments can be posted.

Microsoft Confirms Update-Linked BSODs Required Compromised Machines

Comments Filter:
  • by dmgxmichael (1219692) on Thursday February 18, 2010 @05:02PM (#31190928) Homepage
    Now, I wonder who the first poster is going to be to demand Microsoft test their patches for compatibility with viruses and malware?
    • Re: (Score:2, Insightful)

      by bigredradio (631970)
      First post...that would be you sir.
      • by Jugalator (259273)

        First post...that would be you sir.

        That was a demand?

        • In his defense, the people of Big Red Radio's home planet are extremely polite. I, for one, welcome our Overlords, is actually a variation of their standard greeting.

      • Re: (Score:3, Interesting)

        by jonadab (583620)
        He didn't demand anything of the kind. He only suggested it, if anything in a way that implied it would be an unreasonable expectation. Which it would be, because, frankly, once you become aware that a system has a rootkit installed, the only sane thing to do is a complete format and reinstall.

        Well, you can do some forensics first if you want, and maybe copy off some data (if you're careful about how you do it so as not to infect any system you copy it to). But you're going to boot from known-clean (and,
    • by Rockoon (1252108)
      How about queue up the idiots who demand that microsoft do a checksum on the files it patches...

      ..because in their universe, files that have been over-written still contains bits of the old files that will execute and cause blue screens.
      • by Anonymous Coward on Thursday February 18, 2010 @05:14PM (#31191122)

        The rootkitted library was not a part of the update, just one of the libraries it was using. You should demand that your rootkit vendor stick to published APIs to avoid this in the future.

        • Re: (Score:3, Funny)

          by rve (4436)

          The rootkitted library was not a part of the update, just one of the libraries it was using. You should demand that your rootkit vendor stick to published APIs to avoid this in the future.

          An OS update shouldn't break third party applications such as rootkits. Many people's livelihoods depend on these rootkits. Did you guys at MS even consider how difficult it is to retroactively patch infected torrents once they're out on the net?

      • files that have been over-written still contains bits of the old files that will execute and cause blue screens.

        Why not? DNA contains bits that will de-evolve you back into a frog or lizard or caveman.

        The Archon V2.0
        Graduate, Starfleet Academy biology program.

      • by Johnno74 (252399) on Thursday February 18, 2010 @07:05PM (#31192656)

        Wow, nice way to find/create an anti-ms slant on the story. I can respect people who bash microsoft if they know what they are talking about, but you clearly don't so no biscut.

        Prolems with your theory:

        1) Microsoft updates don't patch files. They replace them. Probably to avoid the issues you assume are happening here (even though they aren't). I'll excuse you for not knowing this.

        2) The file that the rootkit infects isn't the file affected by the patch. The file MS patched WAS 100% clean. The rootkit was either modifying or calling the patched file using a static offset. After the patch this offset was no longer correct and the rootkit caused a bluescreen when it used it.

        3) Even if the patch was a delta and not a whole file, and the file to be patched was the infected file, and if the patch _did_ checksum the file first then the checksum would not have revealed anything was wrong. Do you even know what a rootkit is? A rootkit, by definition cloaks itself by modifying the OS so system calls will not reveal the rootkit. Read the file where the rootkit resides and the rootkit will intercept this and return the original file contents, sans rootkit.

    • Depends...

      If MS10-015 was meant to protect against/fix Alureon infections, then yeah, it doesn't seem unreasonable to ask that it not hose the machine.

      OTOH, if the fix was for something else and it just happened to go tits-up in that particular odd case, then yeah, MS is off the hook.

      • by hairyfeet (841228)

        Well it appears that MS10-015 [microsoft.com] patch was for a locally logged on user using a specially crafted app to gain privilege escalation, so it doesn't appear to be designed for that specific rootkit in mind.

        That said considering how many third party apps run on Windows I was always impressed by how few times a MSFT patch caused a problem, and if anything this BSOD should serve as a wake up call to those affected to actually clean up their systems and put on a decent AV. Just this Monday I had a PC cross my desk t

    • by TubeSteak (669689) on Thursday February 18, 2010 @05:30PM (#31191416) Journal

      Don't worry, it looks like the malware authors have already rushed out an update for their rootkit
      http://www.prevx.com/blog/143/BSOD-after-MS-TDL-authors-apologize.html [prevx.com]

    • by dhavleak (912889) on Thursday February 18, 2010 @07:30PM (#31192972)

      I think that award goes to to Timothy -- our fearless fudding editor. I mean, consider how he ended TFA: "That seems a harsh way to find out that your Windows machine has been rooted.".

      Alright, maybe that's a harsh assessment, but after countless other posts like this I'm not inclined to give him the benefit of doubt. Let's recap:
      1. The Alureon rootkit isn't new, and should be detected by any AV worth it's salt
      2. That being the case, affected users were not running AV, or were infected before they installed their AV.
      3. Affected users are running a 10-year old OS.
      4. More recent OSes (64-bit Vista and Win7) have inbuilt measures that render Alureon ineffective (PatchGuard - which checks for signatures on kernel modules).
      5. 32-bit Vista and Win7 would be immune as well if the AV cartel had not threatened to approach the DOJ with antitrust complaints if MS implemented PatchGuard in the 32-bit versions.
      6. MS has made online scanning tools, a malware removal tool, and a free AV/security suite (MS security essentials) that any of the affected users could have used, prior to the update, and they would have been fine.

      So now, short of forcibly enrolling users in "install and run AV 101", what else could you be calling for, Mr. Timothy (editor) when you say that you think this is a particularly harsh way to find out that you've been infected? What the fuck else do you think MS should do? Go back in time, and fucking add patch guard to XP before they release it? I'm really fucking interested in hearing your opinion on this.

      • by smash (1351) on Thursday February 18, 2010 @08:46PM (#31193816) Homepage Journal
        I have no problem with patches bluescreening rooted boxes. If your box is rooted, the only way to e sure to fix it is a reinstall - having patches try to work around rootkit installs is retarded. If you don't know you're rooted, then too bad. Learn to maintain your pc/network.
        • by dhavleak (912889)

          Amen to that.

          I mean, we know there are technophobes out there. We know there are people who just can't understand the importance of running up to date AV, latest updates etc., or simply can't figure out how to do it -- but seriously -- what can you do for such users. You can make your OS more and more secure with it's default settings. You can make free online scanners available. You can make free AV avialable. In as far as you don't get dragged into court for retarded reasons, you can try to make your ke

      • Re: (Score:2, Funny)

        by Garridan (597129)

        Oh snap! Your computer crashed because it had malware! Harsh man, that was real harsh. Couldn't the rootkit like, call you up and say "hey man, I'm in ur system, mining ur dataz", rather than just crash? That would be a lot more convenient, and significantly less harsh. I mean, what are they going to do next -- make the computer insult you, too?

    • by mrmeval (662166)

      That seems a harsh way to find out that your Windows machine has been rooted.

      I wish every update had such a botnet killer in it. Damn that would be sweet. I'm tired of the spam and the bandwidth killing. Failing that we could enact a government tax of 25cents an email. HA!

      Q: Would it be possible to run a hypervisor as part of an OS so that the OS maintainer be it the evil empire or ahbuntu could detect and eradicate malware and virii? I've done similar with ghost in the past but I am not up to speed on virtual machines yet.

    • by Pharmboy (216950) on Thursday February 18, 2010 @08:10PM (#31193434) Journal

      Now, I wonder who the first poster is going to be to demand Microsoft test their patches for compatibility with viruses and malware?

      To be fair, Microsoft is year ahead of Linux in this area. Linux isn't compatible with almost every kinds of virus/malware. Wine is helping by providing the APIs needed for some malware, but Linux (iptables in particular) still interferes with the proper operation of some of these programs. Like it or not, if you want to run these malware programs reliably, you should stay away from Linux. At least Microsoft lets you run *most* of these viruses after an update.

    • by gig (78408)

      Why don't they just make their operating system incompatible with viruses and malware? Somehow everybody else manages it.

  • Not that harsh (Score:5, Insightful)

    by bigredradio (631970) on Thursday February 18, 2010 @05:03PM (#31190938) Homepage Journal
    Yeah a BSOD is harsh, but finding your bank account mysteriously drained of funds is more harsh. At least they found out.
    • by hey! (33014)

      [A Microsoft representative comes to a System Admin's place of work for a little meeting.]

      MR: Thanks for making time to meet with me.

      SA: No problem. So what's this all about?

      MR: I don't know how to say this, but it seems that you... well you aren't entirely in control of your systems.

      SA: You mean you're selling a new management tool?

      MR: No, no nothing like that. It's just that there are certain things... Well let's say there are things about your system that you don't know that you really ought to be aware

  • by jandrese (485) <kensama@vt.edu> on Thursday February 18, 2010 @05:04PM (#31190962) Homepage Journal
    The bluescreen may be painful, but it is far less painful than having your information stolen by criminals. Assuming of course the people who own the machines are savvy enough to properly install their firewalls and virus protection next time.
    • by Locutus (9039) on Thursday February 18, 2010 @05:25PM (#31191334)
      it was probably about 6 years ago when a number of goverment offices American Express, and others including CNN had their computers BSODing. CNN even stayed on the air for a few hours just talking about how the computers were all rebooting. The cause of that was that the computers were part of a botnet and an update to the botnet caused BSODs.
      In plain language, many government computers and businesses computers have been infected without them knowing it. And as I mentioned, large companies with financial ties like American Express. You can not secure Windows without unplugging it from the network. There was a CIO of one company which got hacked and he ended up quiting saying something much the same. Businesses who insist on Windows are insisting on something which is very very difficult to secure.

      Now I wonder if this is what took out all those Norfolk VA computers. The ones which it was said that they don't think it was something they got off the internet but in the same breath said they don't know what caused it or how it got there.

      LoB
      • by Anpheus (908711)

        You can't secure any unverified code without unplugging it. And verifying, truly verifying code is expensive and laborious and will likely never be done for something as huge as Windows or a Linux distro.

        Unfortunately, the cost-benefit analysis of verifying code against a spec and proving the security of it shows that it's not worth it in the vast majority of situations.

        • Re: (Score:2, Interesting)

          by geekprime (969454)

          Couldn't a deep packet inspection reveal the botnet behaviors regardless of how good the rootkit was?

          Sounds like a home router feature to me...

          • by X0563511 (793323)

            SSL or any other common encryption scheme throws that out the window.

        • All you need to do is verify that the files on the drive are the files released by the vendor(s). An extra step would be to make sure that they're the most recently patched versions as well.

          That can be done with a bootable Linux CD and a list of the various files, their locations and different checksums of each of them.

          Anything that isn't on that list is suspect and can be quarantined.

          The advantage of a system like that is that it is easy to use to spot even unknown rootkits.

          • by Anpheus (908711)

            You're missing the point, unverified code is insecure code. Whether that's Windows or Linux.

            For example, can you prove without a doubt that there exists no kernel or kernel module flaw that could result in running arbitrary code from an innocuous file on the filesystem at boot time? No, not even close. There's simply no way you could make that claim.

            While it's improbable that such flaws exist in the Linux kernel, it's entirely possible. It's possible that there exists a flaw that allows hijacking a running

          • Re: (Score:3, Informative)

            by cusco (717999)
            "a bootable Linux CD"

            Work in the real world much? The network that I'm currently plugged into has 69,000 workstations on it, and 27,000 servers, plus another couple thousand ancillary computers like DVRs and cash registers (yes, they all run Windows). The hospital that I'm going to be working at tomorrow has over 1200 nodes on its network of which at least a hundred are considered non-rebootable life-safety systems (yes, almost all of those are Windows). That brilliant idea might work at your home off
      • by bertok (226922) on Thursday February 18, 2010 @08:18PM (#31193534)

        it was probably about 6 years ago when a number of goverment offices American Express, and others including CNN had their computers BSODing. CNN even stayed on the air for a few hours just talking about how the computers were all rebooting. The cause of that was that the computers were part of a botnet and an update to the botnet caused BSODs.
        In plain language, many government computers and businesses computers have been infected without them knowing it. And as I mentioned, large companies with financial ties like American Express. You can not secure Windows without unplugging it from the network. There was a CIO of one company which got hacked and he ended up quiting saying something much the same. Businesses who insist on Windows are insisting on something which is very very difficult to secure.

        Oh, I assure you, they know about it. They're just too incompetent to do anything about it.

        I was once at a large bank, and I was warned not to plug my laptop into the bank's network. At first I was thinking "this must be for security reasons, they clearly don't (and shouldn't) trust some random consultant's laptop on their network", but then I was told that it was for my own protection. Apparently the bank network was so lousy with viruses that a laptop without the latest patches would last only minutes before it was rooted. I keep my work laptop patched, so I did plug in. I ran Wireshark for a few minutes, which detected about a dozen hack attempts on my machine. On top of this, many of their servers were running ancient versions of windows, many at RTM patch levels. I suspect they were all infected, but I didn't have a chance to look into it.

        It's not just one or two financial institutions, from what I gather, many of the larger ones have infections.

        This is what excessive bureaucracy does to IT: the amount of paper work required to approve a patch is so onerous that IT managers simply don't patch servers. The paper work is meant to prevent the minor problem of 'unapproved' patches causing disruptions, but the end result is even worse, which is unpatched machines with rampant infections.

  • by Itninja (937614) on Thursday February 18, 2010 @05:05PM (#31190986) Homepage
    Microsoft needs to start testing against all known (and future) viruses and other malware. It just makes sense.
    • Microsoft needs to start testing against all known (and future) viruses and other malware. It just makes sense.

      WHile I'm not sure how they would go about testing against future viruses, short of bringing Johnny Carson's Carnak out of retirement, you would think that at the very least they could add a rootkit scanner to the front of the update. That way the update could fail gracefully with a note explaining why it couldn't proceed, along with a list of steps necessary to get the system clean, and helpful

      • by dave562 (969951)

        And how is that going work? They're going to ship out their patches on DVDs that you have to boot the machine from? People already bitch about having to reboot their servers once a month. Can you imagine having to physically visit every server with a DVD / USB stick? Give me a break.

  • by Nzimmer911 (1553899) on Thursday February 18, 2010 @05:06PM (#31191004)
    I think that this approach should become the industry standard for retaliation against malware. What better way to force complacent users to cleanup their machines than to disable them? Less botnets = more bandwidth for the rest of us.
    • Some ISPs notify their customers if they're participating in a botnet, and cut their service is nothing is done about it. They're only doing it out of their own interest, but I wouldn't mind federal governments making this mandatory.

      This isn't the first time that an update from Microsoft breaks an infected PC. It's not something they plan or test for, nor should they.

  • by Anonymous Coward

    Huh? I thought Netcraft confirmed that BSD was dead. Oh waaaiiiitttt... BSOD
    Ok nevermind

  • by pwnies (1034518) *

    That seems a harsh way to find out that your Windows machine has been rooted.

    Or a good way, as it will force people to find a way to fix it. Who knows, maybe it will even teach some people some things about the dangers of rootkits.

    • Re: (Score:3, Insightful)

      by mlts (1038732) *

      Even better, it gets the machine off the net, so other people are not victims of DDoS attacks, spam, automated scans, and other crap that might come from a botnet client.

      I admit I sound like a jerk here, but I'd rather have a machine with a BSOD than a rootkitted box. Reinstalling or reimaging a machine may be a bit time consuming, but it is nowhere the time it would take to recover access to compromised bank accounts, Web accounts, gaming, and dealing with identity theft issues.

      • by couchslug (175151)

        "I admit I sound like a jerk here,"

        No, you don't.

        Lusers (the term fits in this case) don't care about securing their machine unless it gets broken. Malware that breaks machines provokes an immunue response, while parasitic malware usually does not.

  • That seems a harsh way to find out that your Windows machine has been rooted.

    Don't worry, I'm sure the author(s) of the rootkit released a patch within 24 hours that automatically updated the infected machines to make the rootkit "compatible" with the security update.

  • Don't worry (Score:5, Informative)

    by wiredog (43288) on Thursday February 18, 2010 @05:12PM (#31191088) Journal

    The malware has been updated [theinquirer.net] so that it won't cause a crash.

  • I wouldn't be surprised if the rootkit authors were at work on a patch for this BSOD. They will of course send it out via auto-update.

  • Be Gentle (Score:5, Funny)

    by e2d2 (115622) on Thursday February 18, 2010 @05:17PM (#31191196)

    That seems a harsh way to find out that your Windows machine has been rooted.

    What do you want? Some cuddling before breaking the bad news?

    "Sweety.. you got rooted" .. as it goes in the _wrong_ hole.

  • bsod (Score:3, Insightful)

    by confused one (671304) on Thursday February 18, 2010 @05:18PM (#31191206)

    That seems a harsh way to find out that your Windows machine has been rooted.

    There are plenty of people who think that tracking down all the machines in these botnets and disabling them is a reasonable way of dealing with the problem.

    • That is the only effective way of dealing with the problem.

      The alternatives are to ignore the problem.

  • by HTH NE1 (675604) on Thursday February 18, 2010 @05:25PM (#31191340)

    So is Microsoft rushing out an update to their Malicious Software Removal Tool to clean up this rootkit?

  • by Culture20 (968837) on Thursday February 18, 2010 @06:08PM (#31191992)
    And I mean that sincerely. Please BSOD more botnets.
  • > Users affected by this problem can fix it by replacing the infected driver
    > with a new one via the system console.

    But that would break Alureon! Is an update available for it?

    • Re: (Score:2, Funny)

      by Pyrus.mg (1152215)
      As mentioned above if you are an Alureon user an update has already been surreptitiously deployed to your pc and you can safely let Microsoft secure your system without losing any Alureon functionality.
  • That seems a harsh way to find out that your Windows machine has been rooted.

    I don't know about anyone else, but I would think that any way you find out your machine is rooted is going to be harsh. Sure, the not booting thing is annoying (still don't know why Windows or Intel/AMD chpsets don't support a Target Disk Mode for events like this), but finding out that someone else has had free reign over your machine for who knows how long (whether it is currently booting or not) is a harsh reality.

"Just think of a computer as hardware you can program." -- Nigel de la Tierre

Working...