Windows 10 - the message on the tgstation13 welcome page

[mosquitoman]

Bottom post of the previous page:

Because Windows updates, contrary to your retarded beliefs, are there to patch break ins and back doors.

You mean create backdoors. What do you call it when a third party uploads arbitrary files to your pc and executes them without your knowledge or consent? That's malware, pure and simple. If you have windows updates enabled, your system is being directly threatened by a very aggressive piece of malware called Windows 10 that takes over your machine, creates numerous backdoors on it allowing for, among other things, remote code execution and uploading more arbitrary files to your machine without your consent, and irreparably damaging your system often leaving you with no option to restore it to previous state short of wiping it clean completely.

Mind elaborating why?

Windows related security exploits are found on a weekly basis. The Windows patch which comes out on every 2nd Tuesday of the month fixes many such exploits. The latest one, for example, is an exploit with regsvr32 and regsvr64, which handle OLE controls, DLLs, ActiveX stuff - often used by installers to do application - OS ties. Well, it turns out it's possible to get these programs to silently download scripts off the Internet and then execute them. These scripts can, for example, edit your registry and access files and applications, blocked by tools such as App Locker. Whoops. Expect a fix for this on May 10.

I'll be honest, mosquitoman, you're not helping the "Anti Windows 10" team. They have valid complaints they can raise, but you're just going full retard on this, representing their concerns as the stuff of tinfoil hat wearing nutjobs, which they definitely aren't. I really think that the best you can do to promote your opinion is to let someone else take over - someone who actually knows what they're talking about and where the limits of technology are and what Microsoft is actually likely to be doing. I mean you're incredibly easy to argue against, because the concerns you raise are unsubstantiated and easy to counter, I just worry that you're misrepresenting and trivializing the team you're on. There are valid reasons to be concerned with Microsoft and Windows 10, your dumb paranoia isn't amongst them though.

Please tell me a single thing I said that is not true. Is MICROS~1 not uploading arbitrary malicious code to unwilling users and executing it without their knowledge and consent? Are they not forcibly installing their malware on millions of computers whether you want it or not? Are they not collecting tons of data leaving users unable to disable this spyware feature completely no matter what they do short of blocking dozens of servers in the router or similar device they're connecting through? Those are all very real threats that you're exposed to if you have windows update enabled. I've had it disabled on my Windows 7 installation for 3 years now and never had a single malicious file executed on my machine. Do you know why? Because I'm not a dumbfuck and do not run any random executable off the internet. It really is that simple. No way to use 0-days on my machine if you can't get your files on it in the first place.

[DemonFiren]

[youtube]yJLhnts9-oQ[/youtube]
mosquitoman.flv

[LiamLime]

Please tell me a single thing I said that is not true.

Okay.

Is MICROS~1 not uploading arbitrary malicious code to unwilling users and executing it without their knowledge and consent?

Here.

Are they not forcibly installing their malware on millions of computers whether you want it or not?

Here.

Are they not collecting tons of data leaving users unable to disable this spyware feature completely no matter what they do short of blocking dozens of servers in the router or similar device they're connecting through?

Here.

Those are all very real threats that you're exposed to if you have windows update enabled.

Here.

I've had it disabled on my Windows 7 installation for 3 years now and never had a single malicious file executed on my machine.

Bad idea. Reading material: APT, Spyware,Botnet and Ransomware. Read up on how each of these spread, what kind of vectors they use, etc. On a computer, which has not had 3 years' worth of security patches, you are vulnerable to many, many exploits.

Do you know why? Because I'm not a dumbfuck and do not run any random executable off the internet.

Good, that's a good policy, but isn't anywhere near sufficient. Attacks can come in from all sorts of locations, not just files. There are exploits on Word documents, JPEGs, browser sandboxing issues, etc. If you have not been updating your OS, you can get malware to execute on your computer by viewing an image on a website on the internet. While "Don't run anything from the internet" was an effective security measure in the 90s and 2000s, the way malware works has changed, and it's a lot scarier than it once was.

It really is that simple. No way to use 0-days on my machine if you can't get your files on it in the first place.

Oh, you were wrong here too.

To anyone other than mosquitoman: Please do not read the "here" responses as my whole opinion. Some things I point to as wrong can be valid concerns, but not with anywhere near as extreme a sentiment as mosquitoman's post. For my whole opinion on these topics, please read the other posts I've written.

[mosquitoman]

All these things that Microsoft started doing with Windows 10 are well documented in slashdot horror stories and articles on dozens of websites. I have no idea why you'd be denying them. Especially since you offer nothing to counter all of the evidence. I mean, even this very website started showing warnings on the main page, but somehow I'm a paranoid tinfoil hat nut?

By not running anything off the internet I also mean that I'm using a vast array of plugins that block almost all interactive content like javascript, flash, css, iframes, XHR, cookies, etc, unless I explicitly whitelist the domains they're coming from. So, short of some really freaky 0-days, there really is little possibility of someone executing code on my machine without my knowledge. BTW any risky browsing, outside of the few websites I know and trust, and that needs Windows to run for any reason takes place in a separate Win 7 VM running on a GNU/Linux-based system. If you know of a possible vector of attack under these circumstances please inform me.

[ColonicAcid]

Oh sweet summer child.

[iamgoofball]

i'm just gonna go out on a limb here and just say what we're all thinking:

mosquitoman is doing illegal shit that he doesn't want anyone to find out about, because i'm expecting him to say next that his entire OS is actually on a USB stick and he also browses with tor via the windows VM running on GEE ENN YUU PLUS LINUX running off his USB stick with his computer ready to fry at any moment so the feds don't find his totally legal pictures

[mosquitoman]

If you're one of those nothing to hide nothing to fear people then please post your entire browser history from the last month as well as the contents of all your emails and instant messages you've sent and received. Surely only criminal activities require rudimentary privacy and computer security.

No way to win with you guys. I was just given wikipedia links about spyware and ransomware a few posts earlier because somebody thought I care too little about security, now this guy thinks I must be an arms dealer because I actually do care about security. Damned if you do, damned if you don't.

[oranges]

not everyone cares about certain things in life as much as you.

Such is the way of things

[iamgoofball]

If you're one of those nothing to hide nothing to fear people then please post your entire browser history from the last month as well as the contents of all your emails and instant messages you've sent and received. Surely only criminal activities require rudimentary privacy and computer security.

sure, i'll look into it

[LiamLime]

Mosquitoman, unlike you, I actually follow security news. I offered a reference to regsvr32 and regsvr64 as an example of a recent vulnerability, I offered the answer to the question you just asked in the post you replied to: You are vulnerable to a 2015 exploit in JPEG processing which will bypass everything you have listed. You're vulnerable to several 2015 and 2016 OpenSSL exploits, etc. I've done my fair bit to back up my claims and gave examples to back them up. Of course I have more examples to give, but would have to look up details about them again. These were the ones that came to mind off the top of my head. If you can't even counter these ones, then there isn't really much of a point in me looking up previous examples. I'm also not going to go through the backlog of sources I read to find references to what I'm talking about, because that requires a lot of work, and you've shown no effort in even giving solid examples that indicate the validity of what you've said, so I don't feel pressure to give weighty references to the easily googleable examples I listed, considering you have failed to even provide examples, let alone weighty references to them. As to the Wikipedia articles: Please read them. It will be a much more productive discussion when you can demonstrate that you know the fundamentals of malware, because you have not demonstrated that you know what kind of malware exists, how it works and how it spreads.

Yes, you can continue to cherry pick issues in my posts and only reply to one point out of every 5 I raise, or you can continue doing your "BAH, I AM RIGHT, MICROSOFT IS SATAN!" replies, which address nothing. You aren't going to be convincing anyone with that, though, as it is more a sign of your delusion and misunderstanding of the situation than mine. You can notice in this thread that the people who are wary of Microsoft or Windows 10 have quieted down - not because we've convinced them of anything, but because they don't want to be on the same team as you.

Also, just to make it clear before it even becomes an issue, I am definitely not of the "nothing to hide, nothing to fear" mindset. I am very much pro privacy, believing that it is a human right (and it is). But doing everything you can to prevent one entity from gaining access to your data, while trusting VMWare/virtualbox for virtualization, Ubuntu/other for OS, Mozzila/Google for browser, noscript/sandboxy for isolation, etc. It's just stupid. You are inherently trusting many entities here, why you are singling out Microsoft as the one deamon that cannot be trusted, I don't know. Especially since Microsoft has so far not really snown any intention at doing anything truly evil (selling data, etc.).
Also I really don't care which solutions you use, I listed some examples for virtualization, linux, browser and isolation - other brands are available. No matter what you use, there's inherent trust involved.

And yes, chances are I'm wrong on individual details. For example, it may be that OpenSSL's integration is tied to the browser and not the OS, it may be that the identified issues only affect servers and not clients, I don't remember for 100%! But if you can't point out even the most glaring of mistakes in my posts, then clearly you don't know more than I.

[mosquitoman]

The difference is that software like Firefox, Virtualbox, Linux kernel, uMatrix, uBlock Origin, all of which I use as parts of my security stack are examples of free and open source software which means that I actually know fully what they do, and can inspect and modify the code. The entire program runs on my computer and does not require data from third party servers to perform rudimentary operations. Even if it does require that, I can control what it sends and what it does on my machine. So there is really no party that I have to trust blindly, unlike users of proprietary software. That is why I single out Windows 10, and although there are many other programs that perform data collection, the operating system is a vital component that oversees all computing that takes place on the machine so naturally it has the widest reach.

I love how you flaunt that you know more than me about malware and in the same paragraph try to scare me with OpenSSL exploits which were server side security holes that exposed servers, and not users Truly you must be an expert. That JPG "exploit" is actually a method of delivering code encoded in JPG via the browser, so Windows updates won't help you with that either. It was designed to bypass antivirus software that might be scanning the scripts on the website and preventing their execution in case it smells something dodgy. This way the code flies under the radar and is reconstructed from the image using an otherwise fairly harmless piece of js that only executes the payload. I know how this works because I wrote a small tool that uses similar method for hiding data in PNGs. And of course this will be stopped short by my browser anyway since there is no javascript that will run the binary hidden in the JPG on my machine unless I whitelist the site. And even if the browser becomes compromised somehow, I can just restore the VM from an earlier clean snapshot with no problems.

All of that doesn't change that Windows 10 is being uploaded to client machines without the knowledge of their owners, installed without consent, and as soon as it's installed starts data collection about the user, his machine, and his habits on a massive scale. Those are undeniable facts, proven beyond all doubt. Call me crazy, a tinfoil hat nut, call me gay, doesn't matter, it's all true.

[LiamLime]

The difference is that software like Firefox, Virtualbox, Linux kernel, uMatrix, uBlock Origin, all of which I use as parts of my security stack are examples of free and open source software which means that I actually know fully what they do, and can inspect and modify the code. The entire program runs on my computer and does not require data from third party servers to perform rudimentary operations. Even if it does require that, I can control what it sends and what it does on my machine. So there is really no party that I have to trust blindly, unlike users of proprietary software. That is why I single out Windows 10, and although there are many other programs that perform data collection, the operating system is a vital component that oversees all computing that takes place on the machine so naturally it has the widest reach.

There's a fallacy (don't remember the name) that goes along the lines of "Something being checkable implies someone has checked it". There is no guarantee that open software behaves the way you expect, especially if you use compiled binaries. I mean it was like 2 or 3 months ago that the Mint Linux website was compromised with the binaries containing malware. This stuff happens. Additionally: For most of these you don't really know for sure what they're sending back home. uBlock Origin, for example, uses the filter list from another adblock provider with edits of their own. (this may be out of date, it was the case when they launched though)

I love how you flaunt that you know more than me about malware and in the same paragraph try to scare me with OpenSSL exploits which were server side security holes that exposed servers, and not users Truly you must be an expert. That JPG "exploit" is actually a method of delivering code encoded in JPG via the browser, so Windows updates won't help you with that either. It was designed to bypass antivirus software that might be scanning the scripts on the website and preventing their execution in case it smells something dodgy. This way the code flies under the radar and is reconstructed from the image using an otherwise fairly harmless piece of js that only executes the payload. I know how this works because I wrote a small tool that uses similar method for hiding data in PNGs. And of course this will be stopped short by my browser anyway since there is no javascript that will run the binary hidden in the JPG on my machine unless I whitelist the site. And even if the browser becomes compromised somehow, I can just restore the VM from an earlier clean snapshot with no problems.

Yes! Good! Finally, I got you to READ! Keep at it, get to the advanced persistent threat stuff and modren ransomware!

All of that doesn't change that Windows 10 is being uploaded to client machines without the knowledge of their owners,

Yes

installed without consent,

Yes!

and as soon as it's installed starts data collection about the user, his machine, and his habits on a massive scale.

Not if you disable it, it does default to on, though...

Those are undeniable facts, proven beyond all doubt.

The opposite is proven, if you disable it, it stops all telemetry and machine-specific data collection apart from the Cortana / bing search stuff. And even that, as I understand, requires Cortana to be enabled, which is a choice.

Call me crazy,

This was your least crazy post! None of us are calling you crazy because we disagree with your stance. We're calling you crazy because you're taking it to improbable extremes with essentially no backing for your claims.

a tinfoil hat nut,

Not if you continue to argue with arguments, instead of shouts!

call me gay,

I don't care whether you are or aren't

doesn't matter, it's all true.

Almost everything in this post was true! Good job!


Also, doing steganography doesn't mean much. Steganography mostly exists outside the field of security, being recognized as a mostly impossible problem to solve on the decryption or detection side, simply because it's impossible to predict alternate bandwidth vectors - there are just too many. There are checks against some common methods (frequency spectrograms in audio, colour charts in images, LSB of images or audio, etc.), but those are very limited in both scope and effectiveness.

[ThanatosRa]

Will you PLEASE just switch to some manner of linux build and fuck off already.

[mosquitoman]

Will you PLEASE just switch to some manner of linux build and fuck off already.

I am already using a GNU/Linux system but ridiculing Windows users and victims of Microsoft in general is one of the greatest pleasures in life.

[oranges]

[youtube]2k0SmqbBIpQ[/youtube]

[ThanatosRa]

And with that, I ask, no BEG that you lock the thread. Everything we're going to get out of this thread has been achieved.

[LiamLime]

I had fun

[Ricotez]

good thread, had a laff

[MrStonedOne]

"Malware, short for malicious software, is any software used to disrupt computer operations, gather sensitive information, gain access to private computer systems, or display unwanted advertising."

Watch as somebody loses out on a competitive match because of forced updates: http://oddshot.tv/shot/fl0m-2016050255729957

Reminder that an update put adware in to ie on windows 7/8 mixed in with an important security patch: http://news.softpedia.com/news/microsof ... 1559.shtml

oh, and what would we call GWX.exe? looks like malware to me.

if Microsoft wanted people to stop rejecting updates, maybe they should make them not contain malware, and make the os not force them down your throat in a malware like way.

[iamgoofball]

mso please stop being retardeddddddddddd

[iamgoofball]

"it interrupted a comp game!!1! its malware"