Technology

That’s still a lot of people that use that damn driver. I know at least in medical billing there’s always someone still using a damn fax machine. Almost every claim passes through fax technology at some point, although more and more of it is being emulated.

Where I work, it’s used mostly by emergency rooms that don’t want to use anything else.

This is not an environment where you want an exploit.

Are there any figures for how widespread that Agere chip is? I wonder if any German companies are going to be bit in the aas by this lol

Thanks for the details!

I wonder how often they clean stuff up like this. That crossed my mind earlier, I’m sure there is a bunch of “dormant” software that could be cleaned out or made optional in some way.

But the making it optional idea is easier said than done. Especially from a standpoint of discoverability and usability.

I expect it's stuff like ATMs, Coinstar machines. Things that may need to phone home regularly but don't need to sit online constantly.

It already happened with Windows 7. They still released the patch there.

Nope, 0-day means it was exploited in the wild before the company knew about it. Basically, the company had to rush to patch it because it was already being exploited. It means black-hat hackers found it and exploited it before the white/grey-hat hackers reported it. If white-hat hackers found it first, they’d have already alerted the company and given time to patch it before they announced the vulnerability. But since the black-hat hackers found it first, it was a 0-day.

0-day patches are often a bodge, at best. They often consist of “just disable the vulnerable component entirely” to give the company time to work on a more long-term solution. And that’s exactly what happened here. MS didn’t take time to actually fix the driver; They just ripped it out and said “sucks if you needed it. It’s gone now.”

Nope 0 days means

Zero-day vulnerability: A software flaw that attackers discover before the developer does.

Zero-day exploit: The method hackers use to take advantage of this unknown vulnerability.

Zero-day attack: An attack that uses a zero-day exploit to damage a system, steal data, or plant malware before a patch is available. This is a serious risk because no defenses are in place for this specific flaw yet.

The first is the most common one found in the press and is usually reported to the company so they can patch it, before press release.

Perhaps, either that or they made a very quick fix making updates to address them the day before this patch release.

Except they will stay on their high horse and only give it to extended support this time around, that way they get what they want and they'll be able to spin it against the people who didn't opt in.

Wow, that's hilarious.

Yeah, they did the same for Win7 for a long time. Win7 was so widely used (and people were so hesitant to upgrade after the awful 8/8.1 mess) that like 25-30% of all the computers in the world were still using it several years after support officially ended. It forced MS to continue issuing critical vulnerability patches for Win7, long after support officially ended. Because they didn’t want to be responsible for creating a massive “literally a quarter of all PCs in the world” botnet when they stopped patching things.

These are fixed, but microsoft still includes backdoors for Israel.

The attacker had to already be logged in to the machine for this exploit.