Hacker News

AV had traditionally run as SYSTEM on Windows (and, in the past, often had kernel mode drivers too). I've always thought it was a terrible idea. It opens up exciting new attack surfaces. Kaspersky and McAfee both had privilege escalation vulnerabilities that I can recall. There have been a ton in multiple products over the years.

Some files under Windows are protected as the TrustedInstaller user, which is a more restrictive level of permissions than SYSTEM.

> It runs in two modes, passive and aggressive

Lol

I don't think SP2 made much of a difference in the popularity of XP. It was already dominant, and it's mostly remembered as "legendary" because it had become the target platform for every hardware and software vendor on the planet. Windows 98 was too flaky to engender any serious friction to upgrades, and Windows 2000 was not consumer-friendly enough; XP effectively unified the consumer and professional desktop markets, and became the gold standard.

SP2, if anything, slowed down adoption, since it threw a bunch of spanners in the way of third-party code. It was probably necessary, just to stem the flow of bad press, but no mean a key in XP's overall success.

There were several points in time (after the SP2 too) when installing WinXP with an active internet connection was nearly impossible, because it would get infected during the installation and shut itself down halfway through it.

> Windows XP Service Pack 2. After that thing windows XP became a legend.

God that was an era. XP SP2 was a great OS, IE was the best browser, MSN was the most popular messenger, Skype was acquired, HTC's Windows CE devices were shipping real web browsers that worked over 3G.

By the end of the Ballmer era, Microsoft has lost the OS, the browser, the messenger, the meeting service and mobile.

That's how the exploit works.

Tney gave it a sexy name and set up a website about it (a github repo, at any rate), instead of just talking about it in a mailing list and getting a CVE like a proper bearded security researcher.

Only if you’re running daemons as root. Which would be an idiotic move to begin with because that’s not how distros package their services. So you’d have to intentionally make this mistake.

No.

Probably, but is that service deployed as part of the base operating system or a third party package? Can you remove the service if you deem the crazy service behaviour is unnecessary or too risky for your usecase?

Not quite every week, but yeah it has a lot. And if the target uses sudo at all you don't even need an exploit!

But nobody mentioned Linux. There's no need for whataboutism. They both shouldn't have these vulnerabilities.