Apple Not 'Fully Patching' all OS's

Implications?  And to what degree?  Only most serious, and how often?  So what then is an upgrade? seems perilous for users.   Also in Schneier with comments, 

Apple clarifies security update policy: Only the latest OSes are fully patched  in ArsTechnica

New document confirms what security researchers have observed for a few years.

ANDREW CUNNINGHAM - 10/27/2022, 12:18 PM

Earlier this week, Apple released a document clarifying its terminology and policies around software upgrades and updates. Most of the information in the document isn't new, but the company did provide one clarification about its update policy that it hadn't made explicit before: Despite providing security updates for multiple versions of macOS and iOS at any given time, Apple says that only devices running the most recent major operating system versions should expect to be fully protected.

FURTHER READING

PSA: Apple isn’t actually patching all the security holes in older versions of macOS

Throughout the document, Apple uses "upgrade" to refer to major OS releases that can add big new features and user interface changes and "update" to refer to smaller but more frequently released patches that mostly fix bugs and address security problems (though these can occasionally enable minor feature additions or improvements as well). So updating from iOS 15 to iOS 16 or macOS 12 to macOS 13 is an upgrade. Updating from iOS 16.0 to 16.1 or macOS 12.5 to 12.6 or 12.6.1 is an update.

"Because of dependency on architecture and system changes to any current version of macOS (for example, macOS 13)," the document reads, "not all known security issues are addressed in previous versions (for example, macOS 12)."

In other words, while Apple will provide security-related updates for older versions of its operating systems, only the most recent upgrades will receive updates for every security problem Apple knows about. Apple currently provides security updates to macOS 11 Big Sur and macOS 12 Monterey alongside the newly released macOS Ventura, and in the past, it has released security updates for older iOS versions for devices that can't install the latest upgrades.  ... ' 

Windows Update Coming Up: New and Improved?

I was handed a test copy of the first windows OS by Bill Gates, when we represented our enterprises' test of the idea.   It was not fully installed at our company for over a year, ever since have worked with Windows at a number of companies.  Ever getting more and too complex, but so did our technical jobs.  Now are we ready for Windows 11?   And what will that be?    Here a speculative look.

Microsoft's next generation of Windows — What we know so far     By Mayank Parmar in BleepingComputer

Microsoft will soon reveal their next generation of Windows at an upcoming press event later this month. Here is what we know so far about Microsoft's new version of Windows.

The upcoming press event is scheduled for June 24th and coincides with a public webcast of the live Windows reveal at 11 AM EST.

"Right now we're releasing Windows 10, and because Windows 10 is the last version of Windows, we're all still working on Windows 10." - Jerry Nixon.

However, as pointed out by Microsoft watcher Mary Jo Foley and highlighted by Rich Woods on Twitter, Microsoft has never publicly said in plain words that Windows 10 is the last version of the Windows operating system.

Only one developer evangelist only gave the statement. However, the Microsoft PR team never denied it.

In fact, Microsoft is slowly dropping hints that suggest Windows 11 is around the corner. For example, the company recently uploaded 11 minutes long relaxing music video on YouTube, which shows off sunlight passing through the Windows logo to form the number '11' on the surface. ... ' 

Details of VxWorks Vulnerability Found by Armis

More on the topic mentioned recently about extensive vulnerability of common embedded OS.

200 Million Devices—Some Mission-Critical—Vulnerable to Remote Takeover 
in Ars Technica
by Dan Goodin

Researchers at California-based security firm Armis have identified 11 vulnerabilities in various versions of VxWorks, an operating system (OS) that runs on more than 2 billion devices worldwide. The researchers found about 200 million Internet-connected devices (some of which may be controlling elevators, medical equipment, and other mission-critical systems) are vulnerable to attacks that give bad actors complete control of those systems. The vulnerabilities, collectively known as Urgent 11, include six remote code flaws and five less-severe issues that allow a range of security issues including information leaks and denial-of-service attacks. None of the vulnerabilities affect the most recent version of VxWorks, or any certified versions of the OS, including VXWorks 653 or VxWorks Cert Edition. "Such vulnerabilities do not require any adaptations for the various devices using the network stack, making them exceptionally easy to spread," according to the Armis researchers .... "

Most Everything is now Vulnerable

As part of a project,  I am looking at hacking vulnerabilities, and have been following some of the security press.   Another remarkable discovery.  That the vulnerabilities in the VxWorks embedded  OS exists in hundred of millions of devices.  Some have existed without discovery since 1987.    In particular IOT devices, but also most anything that connects to the net.  An sample excerpt of specific vulnerabilities were posted here:  https://www.grc.com/sn/SN-725-Notes.pdf   Page 10-    This will be covered in the Vegas Black Hat conference next week on August 8-  So expect more details then.  Given all the healthcare, mobility and IOT systems involved, this is very serious.

See also coverage in Wired:   https://www.wired.com/story/vxworks-vulnerabilities-urgent11/

(VxWorks has been corrected for this problem, but you must update your systems now)