Microsoft responds to stealth update issue

By Adrian Kingsley-Hughes | September 13, 2007, 11:33am PDT

Summary: Last night I approached Microsoft for comment on the stealth updating issue. Here is the response I received from a Microsoft spokesperson …

Breaking news - Latest from Microsoft

Last night I approached Microsoft for comment on the stealth updating issue. Here is the response I received from a Microsoft spokesperson:

The files that are being updated are part of the Windows Update client itself. Windows Update automatically updates itself from time to time to ensure that it is running the most current technology, so that it can check for updates and notify customers that new updates are available. This is normal behavior, and it has worked this way since the service debuted several years ago.

This is not to suggest that we were as transparent as we could have been; to the contrary, we could have been clearer on how Windows Update behaves when it updates itself. We’ve received helpful and important feedback on this point, and we are now looking at the best way to clarify WU’s behavior to customers so that they can more clearly understand how WU works.

That said, we continue to be confident that the choice to use Automatic Updating continues to be the best decision for many of our customers. Windows Update remains a popular service with our customers because it helps them stay safe and have confidence that they are running the latest software from us.

Nate Clinton, Windows Update Program Manager also comments on this issue.

I’ll comment on these responses later.

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

More from “Hardware 2.0”

Confirmation of stealth Windows Update

Microsoft dodging the real stealth update issues

Topics

Microsoft Windows Update, Microsoft Windows, Microsoft Corp., Adrian Kingsley-Hughes

Adrian Kingsley-Hughes is an internationally published technology author who has devoted over a decade to helping users get the most from technology.

Full Bio
Disclosure
Contact

Vendor HotSpot

The 360° Conversation around Cloud Computing

TECH VISUALIZER brings the social conversation to life... powered by Brocade

Learn More »

Related Discussions on TechRepublic

Did you know you can take part in these discussions with your ZDNet membership?

Ask a Question Start a Discussion

Comments

Add Your Opinion

Join the conversation!

Follow via:: RSS; Email Alert

Just In

Informed By What??

Cardhu 22nd Oct 2007

View in thread

Please Select
Please Select

0 Votes

+ -

Automatic updates

matt.nelson 13th Sep 2007

The people who are screaming rape by Microsoft, concerning automatic updates without permission, are the same people who scream rape when someone touches their collectible Dragonball Z toys.

Reply
Flag

0 Votes

+ -

And what are you doing

Michael Kelly 13th Sep 2007

touching those Dragonball Z toys in the first place? When I was a kid my mother taught me something called "manners". You don't touch something that's not yours because it's rude.

Reply
Flag

0 Votes

+ -

RE: And what are you doing

Qlueless 13th Sep 2007

LOL... thats a good point.

0 Votes

+ -

They are also the same people that complain that there computer has a virus, even though they have not ran windows updates in 3 years, nor do they have updated anti-virus software.

On the other hand I have several computers that are still running WinXP SP1, and I would be quite upset if they were "automaticlly updated", since they would not do the job they are intended to do at that point.

The Auto updates are good for some reasons, but extreamly back in others...

Reply
Flag

0 Votes

+ -

How often do you

straybeat_z 14th Sep 2007

open your front door to the police and let them wander through your house to decide for themselves if everything you own is legal and okay to have?

By the same token, I don't want Microsoft, or anyone else, on my system. Just because I'm forced to your Windows (because of work) doesn't mean they're invited to wander around when they feel like it. If my system's not "up to date", that's MY problem, not their's!

Reply
Flag

0 Votes

+ -

It is an interesting conundrum

ShadeTree 13th Sep 2007

The people that are complaining are the ones that have Windows Update turned off. They therefore are the ones that are not affected. If it breaks the feature they won't even know. Those using Windows Update benefit from the changes but also don't know unless it breaks. Sounds like a non-issue to me.

Reply
Flag

0 Votes

+ -

I think the ones complaining are the ones who set to notify

TripleII-21189418044173169409978279405827 13th Sep 2007

The updates are not supposed to be installed until they are notified and proceed. No one knows whether anything broke yet. Even if it did break some computers, I doubt it would be tracked to the update, most didn't know about it and will revert to the 3Rs and chalk it up to SOP.

A more interesting question, now that the cracker community knows of another attack vector (updates that bypass the user OK), will they start attempting to exploit it?

TripleII

Reply
Flag

0 Votes

+ -

What attack vector?

ShadeTree 13th Sep 2007

Just because Microsoft has a back door doesn't mean the hacker community knows how to exploit it. Also, if this exploit broke Windows Update 100s of millions of users would be complaining.

0 Votes

+ -

You can't be serious?!

TripleII-21189418044173169409978279405827 13th Sep 2007

What attack vector, they have the patch, they have the code, they can decompile it to find out HOW the update bypasses the user notify preferences, just like they DO WITH EVERY OTHER security patch.

Why does a patch have to affect hundreds of millions to be the fault of the patch. If the patch were to break, oh, let's take a sample.

Anyone running AVG with STAT array XYZ with Nvidia drivers where patch SP-XXXYY does not already exist because they blocked it. I doubt there are hundreds of millions who run that exact config. Hmm,maybe MS missed that configuration during their exhaustive testing, like they have MANY MANY times in the past with patches, missing something and thereby breaking something.

Point is, don't shove patches with NO NOTICE, bypassing user preferences to machines, that way, when something does break, they have a clue where to look.

You are one of the VERY few pooh poohing this as an actual problem/deficiency

TripleII

P.S. While it is a problem, I have posted in other blogs that MS has every right to update their computer, you agreed to the EULA.

0 Votes

+ -

Are you serious?!

mdemuth 13th Sep 2007

If anyone could shove code into the Windows Update stream, they would have by now. What ever mechanism that prevents automatic updates from getting patches from anywhere else (I'm assuming public/private keys) would prevent Windows Update from updating itself from elsewhere.
Please, get real and give it a rest.

yes I agree, however, that MS should have
1. made this very clear to start with
2. not updated the updater

0 Votes

+ -

They don't have the patching mechanism.

ShadeTree 13th Sep 2007

They only have the files that were changed. If as you contend the people have selected notify they will know if the patch broke their system when the next patch Tuesday rolls arround and they don't get any patches. There is a malicious software removal patch every month. Your arguements just don't hold water!

0 Votes

+ -

But how does it really differ from any other service

xuniL_z 14th Sep 2007

such as Adobe's updater that accesses your machine, checks it's software version, and if out of date, has the access to splash a window on your screen. It's not installing anything w/o permission but depending on who is logged in, could install anything it wants.

I suppose someone could take the flash plugin and rip it apart and figure out how it's being accessed by it's updater.

0 Votes

+ -

EULA not justification

blarman_z 14th Sep 2007

Just because a EULA is present does NOT mean it is enforceable under contract law. California for one has rejected Microsoft EULA's in the past because they can be modified solely at Microsoft's behest and without agreement from the user. In addition, a EULA is not the only legal entity in play, here.

Basic contract law dictates that both parties to a contract must be cognizant of the terms of the contract and that neither party can be under duress during the agreement or the contract is unenforceable, i.e. null and void.

Just because Microsoft CAN do it does NOT mean that they SHOULD or that they have the legal RIGHT to. The federal law which prohibits tampering with another person's computer (aka hacking/cracking) can also apply here, as the intrusion was neither approved nor welcome despite the EULA. Microsoft may license the software, but the computer hardware is NOT theirs, and modifying anything means making changes on the hard drive (writing new files, etc.). And Microsoft owns 0% of the hard drive or memory.

The best thing to do in any case is simply to complain - make a big enough stink either in the press or with your pocketbook (switch to Linux) and I guarantee MS will change their tune.

0 Votes

+ -

Correct

Cardhu 17th Oct 2007

zkiwi 14th Sep 2007

You're not even trying to read to what I wrote.

0 Votes

+ -

FYI

xuniL_z 14th Sep 2007

Did you read that on wikipedia? Is this news? Of course, every possible attack vector is more than likely being looked at....what's your point?

Do you have a solution to the methods being used? When you run AV software and tell it it can update automatically, you are opening up another vector and have done the same thing as agreeing to the Microsoft license. But these are clients checking then requesting, if needed, a download from a verifiable source. It's not the other way around. I don't see that as a stealth update. Do you?

It's really probably as safe as you downloading something from the internet from a known site and running the file. Especially since you don't run AV software on your Mac, right? Whenever you do that, you've opened up an attack vector.

What about Google desktop. It keeps an open connection to the internet perpetually. Think it's safe?

That's twice in a week's time you've used the "river in Egypt" quip...did you just stumble onto that for the first time, maybe on wikipedia and now think it's clever as can be?

happy

0 Votes

+ -

Frothing much yet?

zkiwi 14th Sep 2007

I made a comment indicating that auto-updaters have been and are used as attack vectors.

The issue is that you can't always trust your sources for files/updates. However, and more importantly, if the auto-updating is being done without your knowledge (stealthily) then you as the person responsible for your system's security have a vector that is active/open that you are unaware of.

Are you trying to say that you like the situation of a vector that was (deliberately or negligently or inadvertently) hidden from you?

0 Votes

+ -

No

xuniL_z 14th Sep 2007

whach you mean, frothing? I don't froth. I write more'n some but no frothin. when you read my post, try to imagine someone who is v e r y c a l m.....and read it that way. If i'm frothing, you'll know it.

I don't love the idea, I agree with that much, but I don't think it's as horrible as some are making it out to be. (you use or create web services?) I think they are doing it in accordance with your agreement, and always have since WU was into'd and it's for the good of security.

Think about Google desktop. There is an open connection to the internet from your desktop 24/7 if you don't shut down your machine or disconnect from the net. You think that is ok? Not trying to divert the subject, but I never hear people like you complain about anyone else. Like Apple loading QT when you thought you were loading iTunes. Talk about a huge trojan. happy

0 Votes

+ -

No, very different.

Kid Icarus-21097050858087920245213802267493 14th Sep 2007

Apple didn't silently install anything. They tell you what you are getting. They didn't come into your house and install it without you knowing it, without your permission. You downloaded the freakin software yourself read about what you are downloading.

Stop trying to pass blame.

Or do you already have iTunes and QT, and Software update TOLD you there is an update for both? Because on my PC it TELLS me I have updates if they are available for both, they don't just spontaneously and silently install themselves. Just got an update today.

0 Votes

+ -

No

Ole Man 14th Sep 2007

Not if it's Lord Microsoft, eh?

I'd hate to see the stink you'd raise if Open Source pulled a boner like that. Oh wait! You already did. When did Google secretly install something on a computer without the user's knowledge or consent?

The response to your imaginary vision that is sure to come will be your own mantra, "It's never happened to me".

0 Votes

+ -

FY own I

Kid Icarus-21097050858087920245213802267493 14th Sep 2007

AV software is set to receive updates, Windows isn't.

I allow AV software to update not Windows.

Get it?

Clear enough?!?!??

Is any of this sinking in?

0 Votes

+ -

but shills like

xuniL_z 14th Sep 2007

zwiki and yourself are prepared to say how a wu update is going to kill a mission critical apps.

That is senseless. You can turn off MS update as easily as AV.
again, they should have announced it somehow, but there is a chance they couldn't if the client needed loaded before any new updates.

0 Votes

+ -

If you read what Adrian wrote...

msalzberg 13th Sep 2007

a couple of days ago:

Microsoft Corp. has started updating files on computers running Windows XP and
Vista, even when users have explicitly disabled the operating systems? automatic
update feature, researchers said today.

you'll see that turning Windows Update off doesn't stop the files from being
changed my Microsoft.

Unless I'm reading that wrong, which is always possible wink

Reply
Flag

0 Votes

+ -

Kind of

mdemuth 13th Sep 2007

0 Votes

+ -

OK, I got that..

msalzberg 13th Sep 2007

but what's the case here?

"explicitly disabled the operating systems? automatic update feature"

Sound as if it should have updated nothing, including itself. Even if "don't auto-
update" is chosen (as I have it), that should still mean that nothing is auto-
updated.

I think this is all much ado about little (not nothing), and Microsoft should change
the way they do this. If all affected files relate specifically to Windows Update, it
should have no effect on any properly written software, ie, software that only uses
documented APIs.

0 Votes

+ -

My thoughts too

rapson 13th Sep 2007

"I think this is all much ado about little (not nothing), and Microsoft should change the way they do this."

While this isn't the big deal that others are making it out to be, Microsoft shouldn't have done it this way. Updates to Windows Update should go through the same mechanism as other updates. But since it was only the WU application itself that was updated, there isn't any danger to the system or other applications, and this doesn't present an attack vector. Unless WU itself can be considered an attack vector, and no one has yet used it as one.

Carl Rapson

0 Votes

+ -

re: my thoughts also

deaf_e_kate 14th Sep 2007

"But since it was only the WU application itself that was updated, there isn't any danger to the system or other applications"

It was this time, just imagine if this hadn't been picked up and exposed, they could continue doing it for loads of other files without having to declare patch notices - and thay may have already being doing it for ages.

For people who don't think this is a problem, i think they need to wake up and smell the coffee, get your head out for the sand etc and see the potential problems. Its not surprising Windows security and MS's attitude to it is pants with these sort of denials of an issue.

0 Votes

+ -

No biggie, update updating update

DannyO_0x98 14th Sep 2007

Didn't this updating happen overnight 8/28. Wasn't the WGA Service/human error
problem on 9/1? Are we 100% positive that they are not related?

Any way, even if Windows Update is purely orthogonal, sometimes patches -- and
this has happened to all the big vendors -- have errors. Without permission or at
least notice, the user has no hints as to what went wrong.

Incidentally, Microsoft is hearing us say that we want them to say that they will be
doing stuff without giving us notice or asking permission -- more transparecy, in
their marketspeak. I'm hearing that we want notice and the ability to say not quite
yet for the machines we administer.

0 Votes

+ -

I disagree; it isn't a 'little'

mdemuth 13th Sep 2007

That whole 'slippery slope' concept. Today, auto-update can update itself without notifiying anyone, tomorrow what? I mean, it is for my own good, right?

It was a VERY poor decision on MS's part to have the tool behave in this manner, without notifying the users in big, bold, neon letters. When it comes to MS, people accuse first (whether they have a clue or not, see the previous posts and talkback) and never bother to go back and forgive.

Another problem, coming from a programming background, is that almost everything inter-relates in Windows. Having gone through 'dll hell', I'm unhappy with any updates I don't know about. I've come down on Apple about doing that, I hold MS to the same standards.

With any luck, it is a tempest in a tea-pot, and MS will learn.
Even I won't hold my breath, however

0 Votes

+ -

The difference between "turning off" and "disabling"

laura.b 14th Sep 2007

I have a suspicion that the wording "disabled" is probably in most cases simply turning off. Now, if the updater has been actually disabled totally, of which there is a method to do so, then I don't even see how this could have happened. Kind of like trying to call a phone that is unplugged (landline, not cell, of course). However, if all you have done is "turned it off" or "right-clicked and disabled" then it is probably still running in a minimal fashion as a way to prevent accidental disables leaving you totally vulnerable - offering minimum protection, that is to say. I used this analogy on another post - it's like when you turn off the tv. It still draws juice even though it's off because it is set to "resume" to the channel that it was previously on and to save your settings, etc. However, if you unplug the tv, it is no longer pulling any juice. If you simply disable the updater from the menu or just "turn off" the automatic updates, you probably have not totally shut the program down.

I could be wrong, but this makes the most sense. It obviously had to be running at some level or it couldn't have phoned home for the update.

0 Votes

+ -

Re: Kind of

none none 13th Sep 2007

I'm assuming if you go into services and actually disable the service, it should update nothing, including itself. If you choose 'don't auto-update' from the control panel, the service is left active...

I thought Windows' stock in trade was it's intuitive and easy to use. The choice presented to the user in the control panel is "Turn off Automatic Updates." The meaning of the choice label is clear. If the undocumented "Really turn off Automatic Updates" choice is given by going into services, braving the warnings, and stopping the service, then the best thing you can say about Windows is it gives the appearance of intuitiveness and ease of use.

But if it's not really either, what else does it have going for it?

happy

0 Votes

+ -

Re: It is an interesting conundrum

none none 13th Sep 2007

The people that are complaining are the ones that have Windows Update turned off. They therefore are the ones that are not affected. If it breaks the feature they won't even know.

Missing the point of the complainers.

The people who are complaining are the ones who thought they were turning off automatic updates and found out Windows is unresponsive to their commands. The feeling is that Windows is going behind their backs, leading to the realization that computer they keep data they care about on may be an unwelcome, untrusted outsider in their home office.

By way of disclosure, I use Windows nearly every day but only for work and only on a computer provided by my employer. I don't have to trust my employer's computer, my employer does. I do have to trust my personal computer where I keep data I care about.

That's why I use Linux.

happy

Reply
Flag

0 Votes

+ -

You're the one that missed the point!

ShadeTree 13th Sep 2007

The majority of the complianers are people like you that are looking for any way you can to tear down Microsoft to make your own choice of OS appear more relevent. As I said below. Do you know of anyone that has suffered any damage from this policy? If not, what are you complaining about?

0 Votes

+ -

Re: You're the one that missed the point!

none none 13th Sep 2007

The majority of the complianers are people like you that are looking for any way you can to tear down Microsoft to make your own choice of OS appear more relevent.

Like I said, I couldn't care less what Microsoft does to its users. I'm not complaining. I'm just pointing out that your narrow damage criterion is beside the point. It's a matter of trust and betrayal, like Adrian said in his first post on this.

You don't have to agree, but you could make a counter argument that's not ad hominem. But as far as my choice of OS, sure maybe there's a Windows formatted file or two I can't open but that's a small tradeoff for the ability to trust my OS.

Here's something that happened to me. My kids use Windows PCs, and I'd configured them to use the name server at 192.168.1.1 for DNS lookups. Lo and behold if I don't see with my own eyes DNS queries going to microsoft.com anyway.

Not every time. Most of the time the DNS queries went to the right place but every once in a while Windows ignored the user's commands and checked in with MS's own name server,

Did I suffer "damage?" Of course not. Did MS suffer damage? You bet. Lesson learned: no matter what the user thinks he's commanded Windows to do, Windows is doing what Microsoft wants it to do. Secretly. If I wasn't monitoring network traffic for another reason I never would have known that Windows was ignoring my command to use the local name server.

So yeah, I can relate to the complainers. They checked the "Turn off Automatic Updates" box and Windows continued to update files. Or they checked the "let me choose when to install them" box and Windows didn't do so. I set the DNS settings and Windows occasionally used a Microsoft name server on some schedule that was unknown to me and beyond my control.

I might not expect my kids to obey my every command as if it was the word of God. My kids have their own agendas and priorities and I understand that. But my devices? I am God. Call me old-fashioned.

Do you know of anyone that has suffered any damage from this policy?

Obviously Microsoft has. It wouldn't be in damage control mode otherwise.

I did get your point. Your point is people have nothing to complain about until they're materially damaged by MS. If only their trust is violated, they have no business complaining.

I just think that's BS.

happy

0 Votes

+ -

No, I'm certain you missed the point.

ShadeTree 14th Sep 2007

Let's examine the situation. No one claims to have been damaged by this silent update even though it has been going on since the inception of Windows Update. The only difference is now you know it is going on. I suspect there are a lot of things going on in Windows, OSX, Linux, etc. that you don't know is going on. So who is damaged. At best you can argue Microsoft has been because of the negative PR. So if Microsoft is the only one damaged and they caused the issue what is your complaint? You say they violated a trust but the truth is you didn't trust them in the first place. The majority of Windows users have Automatic Updates turned on so their trust wasn't violated. The only ones who could possibly say their trust was violated was the ones that have turned off automatic updates. But was it really? The only thing that was updated was Windows Update itself. It is an isolated part of the OS that is only used for the function they are not using. No harm, no foul!

0 Votes

+ -

How liberal can you be?

Ole Man 15th Sep 2007

So if someone is sneaking into your house and installing silly little games (as far as you know, they COULD have been doing anything they wanted, since you had no knowledge of what they were doing), you have suffered no harm?

Now that's what I call TRUST. Actually, there are terms that better describe it, but protocol prevents me using them.

0 Votes

+ -

I have it set to download, but don't install

notsofast 14th Sep 2007

and what they're doing is wrong. It's not that I wouldn't have installed it, it's that there is absolutely NO REASON for them to install it.

The excuse that they have to install or people can't download updates is complete and utter BS. Is MS now saying that anyone that installs from their original CD (Pre SP1, SP1 or SP2) is SOL?

Of course not. The system will force them to do some updates to WU and then move on.

I normally find myself defending MS when I post here, but there's simply no defense on this issue.

The absolute most they could consider is downloading no matter what, but not applying the update until the use agreed to do so.

But even that is unnecessary, since they clearly have a way to update fresh installs form old XP CDs.

Reply
Flag

0 Votes

+ -

No what they are saying is they ....

ShadeTree 14th Sep 2007

... will automatically update WU show that they will get the required updates. The assumption that they are using WU to update WU is wrong! I know for a fact that a recent change to WU on the server side broke the client side. Until the "stealth" update ocurred there was no way to use WU manually or in an automatic fashion.

0 Votes

+ -

Re: "... sounds like a non-issue to me."

Cardhu 17th Oct 2007

My gosh.

Reply
Flag

0 Votes

+ -

what?

justnews4812@... 19th Oct 2007

Read the post above you!!!!!

Reply
Flag

0 Votes

+ -

RE: Microsoft responds to stealth update issue

BlogWatcher 13th Sep 2007

Good work staying on top of this issue, Adrian.
Why isn't George Ou covering this issue? His Real World
IT column whines about how Apple displays fonts, but
not about stealth Windows Updates?