Asus ROG Strix XG27UQ review
be quiet! Pure Rock 2 review
Fractal Design Define 7 Compact review
Lian Li Galahad 360 liquid cooler review
Guru3D Rig of the Month - July 2020
Patriot Viper Steel DDR4 3600 MHz (64GB) review
Red Dead Redemption 2: PC graphics benchmark review (revisited)
Kioxia Exceria 960 GB SATA3 SSD review
HP Portable P500 1TB Portable USB3 SSD review
EK-Quantum Magnitude WaterBlock Review
Microsoft releases emergency patch for Windows 7
Microsoft released an out of band emergency patch for a vulnerability in Windows 7 and Windows Server 2008. This was necessary after a security researcher discovered that a Meltdown-patch released in January this year, introduced a new and even bigger vulnerability.
The patch released in January should have protected Windows 7 and Windows Server 2008 systems against the Meltdown attack writes myce. Unfortunately the update introduced a new vulnerability that allowed any random process to read the entire system’s memory and to write data to it. Security researchers Ulf Frisk discovered the new issue and according to him the vulnerability is fairly easy to exploit.
Microsoft reports the vulnerability allowed a logged in attacker to use a specially crafted application to take control of an affected system. “An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights,” Microsoft further explains.
Therefore, Microsoft decided to release an emergency patch outside its regular Patch Tuesday release-cycle. The software giant strongly advises users to install the update as soon as possible. Microsoft hasn’t discovered any attacks exploiting the vulnerability in the wild yet, but the company expects that’s only a matter of time.
Microsoft will Increase Windows license fees for high-end hardware - 03/30/2018 08:12 AM
It has been mentioned before, different Windows 10 licensing models based on the hardware you use. Currently, there is wordout on the street that Microsoft plans to raise license fees for computers wi...
Microsoft DirectX Raytracing - EA Real-time Raytracing Experiment - 03/20/2018 09:12 AM
EA also shared a video demoing Real-time Raytracing. PICA PICA' is a demo and experiment using SEED's 'Halcyon' research engine and Microsoft's new DirectX Raytracing API to do real-time GPU ray...
Microsoft announces DirectX Raytracing for real-time raytracing - 03/20/2018 08:46 AM
Shortly after the Nvidia announcement, Microsoft follows by adding DirectX Raytracing to the DirectX 12 api. According to the manufacturer, the technology clears the way for games that are partly buil...
Microsoft DirectX Raytracing - Remedy Example Video - 03/20/2018 08:46 AM
Remedy Entertainment discussed the experiments and research we have done in collaboration with Nvidia on the Microsoft DirectX Raytracing (DXR) API that enables straightforward access to real-time ray...
Intel and Microsoft release final Spectre Patches up to and including Sandy Bridge - 03/15/2018 04:24 PM
As Intel finalizes them, Microsoft started distributing Microcode updates for the Spectre variant 2, the updates now have a reach from the latest Coffee Lake processors, Kaby Lake (Core iX-7xxx and iX...
Picolete
Senior Member
Posts: 297
Joined: 2014-12-09
Senior Member
Posts: 297
Joined: 2014-12-09
#5534132 Posted on: 04/02/2018 11:38 AM
If I secure my BIOS with a password, shouldn't i be secure from some of this exploits?
If I secure my BIOS with a password, shouldn't i be secure from some of this exploits?
Fox2232
Senior Member
Posts: 10502
Joined: 2012-07-20
Senior Member
Posts: 10502
Joined: 2012-07-20
#5534136 Posted on: 04/02/2018 12:11 PM
It was a joke from my side. Writing code which works at boot time and still allows normal system operation is not that easy in limited space of BIOS flash. So it is one of last targets attacker has on list. (If it even gets to list as each MB requires different BIOS and has different kinks which may prevent system from being operational and therefore lost even to attacker himself.)
Meltdown/spectre and similar are not spawning from BIOS therefore password on BIOS does not protect against them. (OS level attacks.)
But in case they allow attacker to gain control over your system, you do not need BIOS-Admin-Password. You need settings preventing BIOS flashing from OS.
If I secure my BIOS with a password, shouldn't i be secure from some of this exploits?
It was a joke from my side. Writing code which works at boot time and still allows normal system operation is not that easy in limited space of BIOS flash. So it is one of last targets attacker has on list. (If it even gets to list as each MB requires different BIOS and has different kinks which may prevent system from being operational and therefore lost even to attacker himself.)
Meltdown/spectre and similar are not spawning from BIOS therefore password on BIOS does not protect against them. (OS level attacks.)
But in case they allow attacker to gain control over your system, you do not need BIOS-Admin-Password. You need settings preventing BIOS flashing from OS.
Rich_Guy
Senior Member
Posts: 12544
Joined: 2003-05-11
Senior Member
Posts: 12544
Joined: 2003-05-11
#5534159 Posted on: 04/02/2018 02:00 PM
Link to the patch in the catalog ?
Link to the patch in the catalog ?
vonSternberg
Senior Member
Posts: 151
Joined: 2017-09-12
Senior Member
Posts: 151
Joined: 2017-09-12
#5534160 Posted on: 04/02/2018 02:03 PM
Has anyone even been affected by it? I haven't updated my Windows 7 since 2012 and have never had any issues.
Has anyone even been affected by it? I haven't updated my Windows 7 since 2012 and have never had any issues.
Click here to post a comment for this news story on the message forum.
Senior Member
Posts: 10502
Joined: 2012-07-20
And they forgot to mention that attacker may as well flash BIOS (unless flash protected form OS), to have full list of "popular" exploits these days...
...as it seems that flashing BIOS is most important thing attacker wants to do once he has control over system.