Intelligence report has sent a remarkably alarming warning: as many as 1 billion networked Personal Computers across the globe are allegedly at risk because Windows Error Reporting (aka Dr. Watson) sends its report in the clear, according to Websense® Security Labs™.
Websense recently processed a sample data set from the Websense ThreatSeeker® Intelligence Network to investigate the security risk from popular applications and services.
“We determined enterprise and public sector networks are inadvertently leaking information, which could be used by a threat actor as intelligence to craft specific attacks and compromise networks.
“One troubling thing we observed is Windows Error Reporting (a.k.a. Dr. Watson) predominantly sends out its crash logs in the clear. These error logs could ultimately allow eavesdroppers to map out vulnerable endpoints and gain a foothold within the network for more advanced penetration,” the report read.
On why it is a concern, “80 percent of all network-connected PCs use it – that’s more than one billion endpoints worldwide”.
Dr. Watson reports information that hackers commonly use to find and exploit weak systems such as OS, service pack and update versions.
Crashes are especially useful for attackers since they may pinpoint a new exploitable code flaw for a zero-day attack, ‘Information is also sent for common system events like plugging in a USB device’
“Now it is true that this information is hugely valuable to Microsoft MSFT +0.35% and also to the rest of us. For it’s what is used to try and make the operating system, Windows, work better over time and given the number of us that still use it that’s a highly desirable outcome.
“However, there are a number of problems with it being sent in clear. For a start, anyone gaining access to that flow of information obviously has a great deal of information about where Windows is currently failing. That’s a great start to finding the vulnerabilities and flaws that allow the design of exploits,” the report contained.
It’s not entirely simple to gain access to that error reporting traffic but it most certainly can be done with a variety of man in the middle methods. Or, more importantly, if, just as an example of something unlikely, a spy agency had fibreoptic links into the backbone it could deliberately sniff for such traffic.
And this would give it a lovely database of those machines that haven’t been updating their service packs and thus have known vulnerabilities.
It’s a rather large and gaping hole that much of this traffic is moving unencrypted. Websense, thus suggested that computers on any network should be sending their reports to a local server, within the network, there to be encrypted before being sent off to Microsoft.