News for hackers. Stuff that matters.
Re:Zero-click, wormable, cross-platform remote code executio... by jacquesm on Monday December 07, 2020 @10:45AM (#25333240)
Avoid Microsoft for stuff that is important, and don't install their software on your machines if you can help it.
Re:Zero-click, wormable, cross-platform remote code executio... by coldtea on Monday December 07, 2020 @12:43PM (#25334617)
Yeah, because other companies or FOSS have a better track record.

E.g. we can drop Exchange for email for a safe alternative like Sendmail.

Re:Zero-click, wormable, cross-platform remote code executio... by roel_v on Monday December 07, 2020 @12:52PM (#25334735)
Or wuftpd. I once accidentally dropped my keyboard, and it turned out that the keypresses that generated were a remote root exploit for wuftpd.
Re:Zero-click, wormable, cross-platform remote code executio... by jacquesm on Monday December 07, 2020 @12:56PM (#25334809)
What are the chances of that happening, that's pretty neat!
Re:Zero-click, wormable, cross-platform remote code executio... by roel_v on Monday December 07, 2020 @02:03PM (#25335780)
Eh, at first I thought so too, but then it turned out my neighbours nan once accidentally hacked the US Navy that way, so after that I didn't feel all that special any more :(
Re:Zero-click, wormable, cross-platform remote code executio... by jacquesm on Monday December 07, 2020 @03:22PM (#25336908)
Hehe, that's hilarious.
Re:Zero-click, wormable, cross-platform remote code executio... by 35fbe7d3d5b9 on Monday December 07, 2020 @01:57PM (#25335699)
With wuftpd? P(x)=1
Re:Zero-click, wormable, cross-platform remote code executio... by boogies on Monday December 07, 2020 @02:19PM (#25335972)
Maybe I’m in a filter bubble, but I’ve never heard of anyone else assigning such low priority to exploits like this.
Re:Zero-click, wormable, cross-platform remote code executio... by jacquesm on Monday December 07, 2020 @12:50PM (#25334715)
Yes, Google has a better track record. You brought open source and - totally unrelated - sendmail into it.
Re:Zero-click, wormable, cross-platform remote code executio... by coldtea on Monday December 07, 2020 @12:53PM (#25334767)
>Yes, Google has a better track record.

Do they? This is just from last month: https://www.zdnet.com/article/google-patches-second-chrome-z...

>You brought open source and - totally unrelated - sendmail into it.

No, you brought the totally unrelated "Avoid Microsoft for stuff that is important, and don't install their software on your machines if you can help it." as if Microsoft is the only place to ever had a RCE...

Re:Zero-click, wormable, cross-platform remote code executio... by jacquesm on Monday December 07, 2020 @12:56PM (#25334803)
That's Chrome, not meet.

As for bringing in unrelated stuff, no that was still within the context of Microsoft's meeting software. It was someone else that brought in the OS.

Re:Zero-click, wormable, cross-platform remote code executio... by dylan604 on Monday December 07, 2020 @03:25PM (#25336948)
Reminds me of the old joke: VirusScanner: We found a virus on your machine called Windows. You you like to remove it?
Re:Zero-click, wormable, cross-platform remote code executio... by pjmlp on Monday December 07, 2020 @11:12AM (#25333491)
Starting by anything running on top of Electron.
Re:Zero-click, wormable, cross-platform remote code executio... by ROARosen on Monday December 07, 2020 @11:41AM (#25333795)
Especially if said machines are actually built by Microsoft.
Re:Zero-click, wormable, cross-platform remote code executio... by boogies on Monday December 07, 2020 @12:00PM (#25333999)
In which case they may be nice enough to block some of their software for you https://www.techrepublic.com/article/microsoft-blocks-major-...