Please run windows update now

[joquendo at e-fensive.net (J. Oquendo)]

On Mon, 15 May 2017, bzs at theworld.com wrote:

> Oh great a design review!
> 
> Hello Valdis, I am Barry Shein. I've done decades of internals and
> kernel work.
> 
> Ever use any Windows since about Vista? It throws up those warning
> pop-ups when you're about to do something it decides needs
> confirmation?
> 
> That was almost certainly my invention.
> 
> I described the idea on an anti-spam list and two Microsoft engineers
> contacted me to discuss whether this is feasible etc.
> 
> Never got a thank you tho.
> 
>  > 
>  > How do you throw a pop-up warning for that?  Pre-run it and see how many >
>  > might get executed? And how do you tell that the sequence ends up destroying
>  > the file rather than creating a new one?
> 
> You count the number of destructive opens in the kernel and if it
> exceeds a threshold (for example) you stop it and pop up a warning.
> 
> For example.
> 
> As I said this is the sort of thing which is suitable for an end-user
> OS and no doubt annoying in a server OS.
> 

*popcorn* ... What was the original thread about? Because
once upon a time as a proof of concept for "undetectable"
viruses on *nix, (was for a competition where I was not
allowed to be play post disclosure of PoC), anyway, I
created a really really bad mechanism to negatively
impact ALL BSDs, Solaris, Linux, it was *nix agnostic.


Bigger takeaway, malware/scumware/whateverware authors
target Windows because there are more users. For someone
dealing with security 24x7x365, I can state MS has come
a very long way from what they were, including dealing
with MSRC and other departments. Do you have any idea
how difficult it is to deal with certain *nix projects?
Freshmeat? Github, hobby...

Apples and oranges. And I CAN COUNT the number of
destructive opens read, and write on any nix system, so
perhaps we should kill this thread before it becomes:
my NetBSD toaster is better than your windows powered
refrigetor.


-- 
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
J. Oquendo
SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM

"Where ignorance is our master, there is no possibility of
real peace" - Dalai Lama

0B23 595C F07C 6092 8AEB  074B FC83 7AF5 9D8A 4463
https://pgp.mit.edu/pks/lookup?op=get&search=0xFC837AF59D8A4463