On May 11, 11:55 pm, Roy Schestowitz <newsgro...@xxxxxxxxxxxxxxx>
wrote:
> __/ [ Tom Shelton ] on Saturday 12 May 2007 05:49 \__
>
>
>
>
>
> > On May 11, 8:50 pm, Roy Schestowitz <newsgro...@xxxxxxxxxxxxxxx>
> > wrote:
> >> Hackers hijack Windows Update's downloader
>
> >> ,----[ Quote ]
> >> | Hackers are using Windows Updates' file transfer component to sneak
> >> | malicious code downloads past firewalls, Symantec researchers said
> >> | Thursday.
> >> |
> >> | The Background Intelligent Transfer Service (BITS) is used by
> >> | Microsoft's operating systems to deliver patches via Windows
> >> | Update. BITS, which debuted in Windows XP and is baked into
> >> | Windows Server 2003 and Windows Vista, is an asynchronous file
> >> | transfer service with automatic throttling -- so downloads
> >> | don't impact other network chores. It automatically resumes
> >> | if the connection is broken.
> >> `----
>
> >>http://news.yahoo.com/s/infoworld/20070510/tc_infoworld/88424;_ylt=Am.
>
> > Very disingenuous... There is no hole in windows update, or in BITS.
> > It's just saying that some malware is begining to take advantage of
> > built in services to do their dirty work. The malware has to already
> > compromised the system before it can take advantage of BITS. BITS is
> > a nice component - I've used it in my own code to implement auto-
> > update functionality.
>
> You are challenging Symantec's word here. Will you maintain the opinion that
> they overreact or deceive?
>
> --
> ~~ Best regards
>
> Roy S. Schestowitz | Play Reversi:http://othellomaster.comhttp://Schestowitz.com | GNU is Not UNIX | PGP-Key: 0x74572E8E
> roy pts/2 cg001a.halls.man Sat May 12 05:12 still logged in
> http://iuron.com- proposing a non-profit search engine- Hide quoted text -
>
> - Show quoted text -
>From the article you posted:
<Quote>
Although BITS powers the downloads delivered by Microsoft's Windows
Update service, Friedrichs reassured users that there was no risk to
the service itself. "There's no evidence to suspect that Windows
Update can be compromised. If it has a weakness, someone would have
found it by now.
</Quote>
That is from "Oliver Friedrichs, director of Symantec's security
response group". Symantec is not saying windows update or BITS is a
vector of infection. There just saying that some malware is using the
service after it gets on to the system....
--
Tom Shelton
|
|
