Slashdot Mirror
Microsoft Cracked
Lyserjic seems to have been first with the news. Some linkage: CNET. CNN. AP. MSNBC. BBC. MSNBC's story is a copy of the Wall Street Journal article which apparently broke the news - it's the most complete.What's known - the passwords were being sent to St. Petersburg, Russia. They probably had access for about three months.
"Defacements of Linux sites has been rising at a steady rate and now there are more defacements of Linux sites than NT sites."
Do you think that maybe thats because there are more Linux than NT webservers and that its been rising because the amount of Linux webservers is rising(in fact has overtaken NT). I dunno just a guess.
Time is Change.
You sure did. I'd venture to guess you didn't even read it. Go read the MSNBC artcile where it states what "experts" think happened. (In short: QAZ).
And while it doesn't mention a mail client, how much you wanna bet everyone at MS uses Outlook?
--
--
"I personal[ly] think Unix is "superior" because on LSD it tastes like Blue." -- jbarnett
As far as I can tell, defining and enforcing a policy for what is acceptible as email content is a very, very rare practise. I contend that it shouldn't be, no matter what OS you are running.
Which is why I hang around on slashdot telling people to click on my signature - I wrote an open source filter which allows admins to do just this. :-)
My program doesn't solve the problem. But it helps - it allows the admin to make his internal network immune to whole classes of attacks. That can really make a difference.
--
Host your own websites, anywhere!
But I expected the arguments to at least be plausible.
What we have instead, is an argument that Microsoft's software is not at fault; the problem is faulty administration.
This is being claimed despite the fact that Microsoft wrote the freaking software!
If they can't admin it properly, how is it reasonable to expect anyone else to do so?
SHEESH!
--
While I agree with you that this is going to look bad in just about any light, a few things need to be kept firmly in view.
- We do *not* at this point know if the crackers in fact took source code. We know, according to Ballmer, that they did indeed *view* the code. But did they actually get hold of a copy? Without knowing this answer, we can't accurately predict if and how that source code will be distributed to the net.
- Yes, it's true, Microsoft will in all likelihood attempt to spin this as being all the fault of those nasty, evil, commie Open Source people. But is it? The best defense against FUD is the truth, and finding out just who did this, and why, will go a long, long way towards blunting the flood of bullshit that's even now beginning to emit from the general direction of the Pacific Northwest.
- What will Microsoft be able to claim as protection in the event the source *does* get out to the internet? Trade secret status? One of the most important things to come out of all that DeCSS litigation was, if I remember correctly, the statement from the judge that once a trade secret is publicized, no matter how, it's not a secret anymore. What, if anything, can MS use? Copyright violations? Won't hold water if any GNU or other public code is discovered in *their* code. Sure, they might try to invoke the DMCA or something like that, but honestly, what will they be able to prove or accomplish? Once the secret's out of the bag, it's *out* - whether or not that's a good thing.
Yeah, it's for almost damn sure that there's going to be a very, very ugly war of ideologies, rhetoric, and politics resulting from this little stunt. But the key for anyone who opposes Microsoft and its slipshod methodologies which produce, in my not-so-humble opinion, second-rate software, is to keep the debate focused upon the facts and the truth. This exploit was the result of a well-known security issue, one that's been around for months, and one which Microsoft *should* have been able to guard against. This exploit was more than likely the result of a rotten-to-the-core policy decision that allows Outlook to execute arbitrary code with nigh-unfettered access to the operating system internals.Yes, this hack was probably a very, VERY unwise decision by the culprits. Yes, there will be a truly astounding storm of shit over the matter. But, if Microsoft's opponents play their cards correctly and with a bit of savvy, there can be a world of good which comes out of it, too.
But first, maybe we should all sit back and try to figure out exactly what happened, how it happened, who caused it to happen, and most importantly, why it happened.
If nothing else, that approach will choke off some of these tiresome, pointless accusations and counteraccusations.
Chris Tembreull
Web Developer, NEC Systems, Inc.
Chris Tembreull
"My karma just ran over your dogma."
Reuters at Yahoo.
sulli
RTFJ.
If these guys managed to sneak at least a section of all that embedded all-integrated code then Microsoft is in deep trouble.
:)
Its is known for quite long that there is some "secret code" that allows such apps like Excel or Explorer to work more tightly with the core of the system. Even Microsoft, back in the middle of the 90's, recognized that their Excel got a boost in preformance due to such hacks. Now, imagine what will happen if the code gets well known. First Microsoft looses its warhorse. Second, these hacks can be exploited to take control over the system. Note: I am not stating an hypotesis but a fact that I saw with this "all-in-one" mess, two years ago. It's a pitty I didn't have that source code back then
I've always considered the majority of Slashdot readers to be brats, but this goes to show that whatever Microsoft may do to fight the open-source movement, they'll probably win. Why? Because for the most part, it's people like you who make up and support that movement, people lacking any amount of maturity and decency, and for movements to succeed, they must at least be honorable in the face of their enemy.
First let me say I agree the message was in very bad taste. I don't think M$ will win in the long run. Why? History repeats itself. Causes that are championed by the youth of today inevitably win tommorow when the youth of today becomes the decision makers of tommorow (scary, I know).
Historic examples: green movement, peace movement, and probably a lot of other movements I'm forgetting about.
M$ might win the day, but I seriously doubt they'll win the war.
----
Remove the rocks from my head to send email
On the whole, I find that I prefer Slashdot posts to twitter ones because I don't get limited to 140 chars before
Somebody wanna put up a location to the source?
I'd love to see Microsoft source code. We could all benefit from looking at their source. In the very least we could learn what kind of code *not* to write.
Hackers have had access of some sort to Microsoft source codes for perhaps as long as three months. Microsoft can only say they presently have "no evidence" that codes have been changed.
So little is necessary to create a back door, or even an exploitable "bug," how would it be possible for Microsoft ever to say that the codes are uncompromised.
The problem is that MS operating systems are ubiquitous. If a hacker can build-in, directly or indirectly, the equivalent of Back Orifice in EVERY system, what then? Suddenly MS itself becomes the Trojan horse.
This is the fundamental difficulty of closed source solutions -- there is no way for third parties to assure themselves of the absence of serruptitious code. Of course, such code can find itself into open source code as well, but at least there are means to independently verify the work.
Microsoft just says, "trust me." And some of us do. But the more frequent hacker visits occur, the less it matters whether we trust Microsoft -- we have to ask ourselves, "do we also trust Microsoft to effectively defend itself (and thus us) against Microsoft's hackers?"
Info on this is also available at the Washinton Post
Really, this isn't a good thing for MS in any way. If it can be proven to be an inside job (to hold off the legal issues maybe?) and is found out to be, then they're screwed.
If it's a outside job and the crackers beat MS' secuity, now the whole world+dog knows that MS software sucks in protecting data.
On the bright side, it's a win-win for us.
Oh what a great day.
III.IIVIVIXIIVIVIIIVVIIIIXVIIIXIIIIIIIIVIIIIVVIII
Before everyone here gets into a frenzy of self-important "Micro$oft are lusers" posts, I think it's important to discuss just how bad it would be if they have actually had the source code for their operating systems stolen by these hackers. And not for Microsoft, no, but for people engaged in open source projects like Wine, or people building Windows compatible operating systems.
What are Microsoft going to end up doing? They now have the perfect ammunition to claim that these projects have received help in their tasks from people who are willing to engage in criminal persuits, and that these products have improved as a direct result of this crime. Then, all they need to do is take the creators of Wine to court over this, and hey presto, there goes a project which was making Linux look good against Windows.
Unfortunately, because of the hacker ethos about security and the fact that the ranks of open source programmers already include criminals (Randall Schwartz), judges without any real clue are quite likely to buy this.
What is it Slashdot? Microsoft Cracked or Crackers Crack Microsoft? Either way, there's good coverage on Yahoo, as always. Diskore
what do they need laser guidance for?
These are my friends, See how they glisten. See this one shine, how he smiles in the light.
I like your .sig.
These are my friends, See how they glisten. See this one shine, how he smiles in the light.
.. because there have been so many blatant ones. How can anyone say that there isn't a Win32 equivalent of buffer overflows, or string format errors? One of those things they did somewhere down the line for performance was to yank some of the API parameter checking.
But so far, crackers haven't had to look for holes or real problems in the code, because *THE PUBLISHED API, ITSELF CAUSES HOLES*. Windows is still back at the "Morris Worm" days of security, if even that far along. How long ago was that?
The living have better things to do than to continue hating the dead.
You jump to conclusions pretty quickly. You saw someone who wrote a post that offended you, and thus you assume that this person, and most other frequenting this place to be "brats... lacking any amount of maturity and decency", ending your display by declaring death penalty to the person not sharing your taste of humour.
I must admit that I wonder who is at error here. The post you're replying to is in no way an indication of this person's maturity or decency, nor does it reflect his affiliation with the Open Source movement.
Even so, as have already been stated in another post (redundant here I come:), people make jokes about anything, all the time! This includes war, death, fatal accidents, betrayal heart aches and slapping eachother in the face with dead fish :)
NO topic is too touchy to joke about. Some people may on some occasions be offended by certain jokes (obviously), but in that case I'd make a bet that it's usually the people offended that's the problem, and not the joke.
May we live long and die out
and outline that this happened precisely because Microsoft does not truly participate in 'white hat cracking' efforts. They finally have some levels of acknowledgment of Bugtraq, but they haven't fully embraced it. (let alone extend or extinguish, but perhaps that's the legal focus yet to come.)
That is to their detriment, and what they have refused to learn from the white-hat community has contributed to this break-in.
That's the story we need to put forward, now!
The living have better things to do than to continue hating the dead.
--
Americans are bred for stupidity.
Those things were supposedly made more secure with Outlook patches after the I Love You problems. Now if Microsoft themselves didn't apply their own patch to their softwares and are paying the price of it I can't help but smile and shake my head at how ridiculous this is.
"When I was a little kid my mother told me not to stare into the sun...
"If liberty means anything at all, it means the right to tell people what they do not want to hear"
Now that news of a penetration at microsoft has been reported, whether or not any facts emerge, there will always be conspiracy theories and urban legends of people who hacked MS or own the code.
I love it.
Unfortunately, even if investigators catch the crackers "red handed" with the MS password files and Windows source code, there is no way anyone can be absolutely sure that the code has not been distributed.
Conspiracy theories and legends of rogue cracker terrorists, foreign power "Echelon" projects, and talented grade-schoolers will emerge.
As other readers have pointed out, this is a perfect way for MS to attack all projects aimed at MS compatibility. They will always be able to point at how it is impossible for others to get their programs to work with Windows without having access to the source code. Wow.... all this is a incredible conspiracy on MS's part!
Don't cloud the issues with the facts.
Everyone is out to get YOU. Have a nice day.
will I get sued for posting a link to the Windows source code? And how the hell am I going to get it to fit on a T-shirt??
I used to have a sig, but I traded it in for a glock!
Sorry? If explorer is set to show hidden extensions, it still hides .vbs?
.vbs is different than for .txt, so those 'power users' sure aren't.
I think not.. and I just tried it to confirm this.
And outlook is not part of windows... it's part of office.
And the icon for
I said 'outlook' does not come with windows.
Outlook Express does come with windows, but they are *not at all* the same piece of code. Outlook Express is *not* simply a 'light' version of outlook.. it is mostly a completely different mail package.
All these 'outlook' worms *ONLY* work in OUTLOOK, not in outlook express. Everyone just assumes that when you say outlook, you mean 'outlook express'.
Or if you are truly sick, you can simply use Emacs+Gnus to read Slashdot. Some crazy hacker has actually added a Slashdot backend to Gnus so that you can read Slashdot as if it were just another news group.
That includes Gnus incredibly powerful scoring system (so your problems with slashdot moderation disappear). If you want you can just read the posts from known trolls.
actually, it's not Outlook's fault at all. It is the fault of the architect who decided what Outlook's default security settings are. By default, they're wide open. (stages.vbs proved that), but if the security settings are tweaked a bit, this kind of exploit is impossible. But then again, if they enable those settings, widespread use of this so-called "feature" is DISabled. And if widespread use of this so-called "feature" is threatened, it threatens the feature's usefulness, and hence, the feature itself may as well not exist (yay!).
So basically, the choices are;
1) Develop a feature which allows Outlook to run executable code - so administrators can email software updates to their employees, etc. By default, leave it wide open, so support of this feature is ubiquitous, and so that people actually USE it, and it's touted as a great reason to use Outlook instead of Eudora, etc.
2) Develop this feature, add it to Outlook, but effectively hobble it by setting the security defaults high enough to eliminate the threat of email viruses. If anyone wants to actually USE this feature, designed to aid complicated administration tasks, they'll be required to train all endusers in how to set the security settings so that this feature can be used (has anyone here actually tried to tweak these settings in Outlook? Talk about obscurity!)
3) Leave the feature out, and give consumers NO features that appeal in Outlook over Eudora.
These are my friends, See how they glisten. See this one shine, how he smiles in the light.
http://www.nytimes.com/aponline/technology/27MICRO SOFT.html
The Reichstag Fire analogy is relevant in my view.
sulli
RTFJ.
OK, now that you've all had your fun at the expense of MSFT, it's time to tell about what really happened. I mean, it didn't even get the banner headline in Seattle, it was so lame. We were all paying attention to I-695 being overturned and how Eyman is a dweeb.
Picture this - a dark, shadowy lair on the shores of Lake Washington, in a futuristic (circa 1990s) mansion that has a trout stream meandering throughit and ads for Froot Loops appearing on every wall. Bill G, Dark Overlord, sits in his space age chair, rocking back and forth, as his minions sit uncomfortably, waiting to hear his latest dark plan for world domination.
"Profits!" he screams suddenly. "Noone is buying my Windows 2000 TM R Patent Pending!" he shouts to the cowering lackeys, many recently hired from failed dot-coms that litter the wasteland of King County. They jump in their chairs, and settle back down nervously, awaiting their orders.
"You must crack our servers, in a way that will bring disrepute upon those who oppose us - make it appear to be Open Source Hackers, Russians would be best; everyone knows the Russsians are still mad at us over the cold war. Release all the code to our failed OS - they will assume it was functional. And then - you must go into hiding in Aruba."
They leave, shuddering at the import of his task, knowing that their lives and those of much of the rest of the world shall never be the same after this.
--- Will in Seattle - What are you doing to fight the War?
Yes, you can lock down any key in the registry.
What kills me is the way C|Net blackened WINE developers after all the "Deplorable Acts of Corporate..." bleating from Ballmer, and the obligatory reference to Linux. Safe to say that while there are probably hundreds of thousands of people who would love their copy of Whistler source, anyone doing any serious developement of a project involving, say, reimplimenting the Microsoft API wouldn't want to be in the same building as a stolen copy of code, let alone look at it. Especially after the whole thing with Kerberos.
Wouldn't it just suck to be a WINE developer and wake up one morning with a copy of pilfered source in your inbox, and the FBI knocking to ask questions because they tracked it down from the sender's Russian address?
Fist Prost
"We're talking about a planet of helpdesks."
Fist Prost
"We're talking about a planet of helpdesks."
-Jaron Lanier
um not so simple. Windows Shell Scrap allows an author to "hide" executable code in a file that looks like a text file -
.txt file, you know better than to view .doc files, because you know they have Macros that can be viral. But you open this .txt file, in Notepad, no less, and it executes. You see a little system activity for a few moments, and nothing else, you're infected, and you've just emailed 150 of your closest colleagues the same garbage.
.vbs extension.
For instance, stages virus was actually Stages.txt.vbs. In Outlook, it looks like Stages.txt. If you save it, in explorer, it looks like Stages.txt (even if you told explorer to show all extensions - this is a hidden exception, even Windows Power Users are fooled by this, ironically, your only saving grace is erp! DOS!).
So you see this innocent looking
No other mail client will hide the
Now, you CAN tell Outlook to warn you when it runs executable content from an untrusted source, but the problem is, it SHARES these security settings with Explorer, so if you do this to secure Outlook, you hobble Explorer, which will no longer run javascript from untrusted sources, which amount to like 90% of the websites you're likely to visit.
This is complete horseshit, and there's no excuse for a feature like this.
These are my friends, See how they glisten. See this one shine, how he smiles in the light.
And you would do what exactly with that steaming pile of crap that it is? Have you heard the expression tar'baby before? Once you've even glanced at something like Whistler source, every thing you code involving Windows (think WINE or plex86 here) would be suspect. The worst thing you could possibly do to hurt the OSS movement would be to wantonly distribute something like that. Better to just burn it and pass it around on unmarked CD's if that's your plan.
Fist Prost
"We're talking about a planet of helpdesks."
Fist Prost
"We're talking about a planet of helpdesks."
-Jaron Lanier
I'm interested to hear how the trojan got access to the usernames/passwords - these were sent back to the crackers periodically via email.
Simply sniffing keystrokes in usermode wouldn't have allowed the login keys to be captured (because the logon process runs under a different session), however passwords used for "net use" connections (i.e. connecting to file shares) could be visible (I'm not sure, though)
Sniffing the network requires admin rights (like Unix) and would only give you acces to encypted Kerberos tickets...
Any other ideas on how they did it ?
Yesterday I woke up sucking a lemon...
It's probably wise to check the source code for changes, but what they REALLY need to check is their compilers!!
Outlook's preview-mode and auto-running of attached code takes the human link out of the chain.
This stuff is enabled by default. that, along with the shell scrap crap (that hides the executable code inside what looks, to the user, as a plain text file), is an inexcusable lack of conscientious software design.
These are my friends, See how they glisten. See this one shine, how he smiles in the light.
In system.ini, under the [386Enh] heading, type: MessageBackColor=(Hex colour of choice) MessageTextColor=(Hex colour of choice) Have fun.
WWLUG: Feed the penguin.
Slaves do not overthrow their masters. Occupied countries are never freed by resistance organizations, only by foreign armies or voluntary abandonment.
There is no where left on Earth to run to. The tyrants are subtle in rich countries, and boldly open in poor countries; it's merely a question of whether you're a well-managed resource or a poorly managed one. Even the sea floor has been shared out between the great military powers in treaties, and they have the navies to enforce them.
You can't beat 'em, most can't join 'em, the only option left is to run away, and the only direction left is up.
--------
Somewhere, possibly in Russia, some poor, misled hacker now has to read MS source code.
Poor bastard.
--------
But there is no point to messing with something he doesn't understand. He might waste hours fooling around with some piece of code only to find out that it was the software to control the automatic toilet flushers at Rife Bible College...
I wonder what they found, those probing hackers. If it were merely bare source, Neal above suggests, nothing. Now if it were marketing documents, that would be something; and if it were legal documents relating to all that Federal fuss, well, this would be one interesting crack!
Why did Microsoft tell, and what didn't they tell?
Yours WDK - WKiernan@concentric.net
y'all better try again. Here is the registry hack to DISABLE this oh so useful (to virus spreaders) feature:
delete the key HKEY_CLASSES_ROOT\ShellScrap\NeverShowExt
These are my friends, See how they glisten. See this one shine, how he smiles in the light.
I've always considered the majority of Slashdot readers to be brats, but this goes to show that whatever Microsoft may do to fight the open-source movement, they'll probably win.
/. posters were brats.. then I'd tend to agree with you.
1) How do you know that the majority of Slashdot READERS are brats if they are in fact reading and not posting? If you'd said the majority of
Why? Because for the most part, it's people like you who make up and support that movement, people lacking any amount of maturity and decency, and for movements to succeed, they must at least be honorable in the face of their enemy.
2) How do you know that people like the tastless, lame poster make up and support the open source movement?
I think you're basing your opinions of a fairly large and diverse group of people on the actions of a few morons, who may or may not in fact be in support of Open source. I don't recall anything in that first offensive post that said anything about open-source software. I do recall some insensitive (and, quite frankly, LAME) humor about Microsoft's stability impaired operating system being responsible for the Kursk tragedy.
You make these vast over-generalizations and your own prejudices shine through, overshadowing the original message: the original poster is a jerk.
Please consider the targets of your message before you go off flaming good, undeserving people.
by Mike Buddha -- Someday the mountain might get him, but the law never will.
Just for the record, although I hate Microsoft Corporation and I support open source, a crime like this is still wrong. Crime does not pay.
I am not a lawyer.
--
Don't get too cocky now. Remember that Microsoft's isn't the 1st "flagship" site to be cracked. In fact. I think Sun Microsystems and posibly IBM are the only ones that havn't.
Slashdot, was owned. Apache was defaced, Credit cards were stolen from some Ecomers places.
Just be thankfull the source code for Windows didn't leak out. It wold be so horible if it fragmented into varius incompatible versions.
Huh... What's that ? It's hapening already ?
well at least we don't have to sufer throgh the pain of reading that code.
--= Isn't it surprising how badly I spell ?
Microsoft, on the other hand, inflates the importance of what happened. I mean, after all, who gives a damn about their source code? And then they are crying out of the FBI to help them track down the evil criminals, costing tax payers lots of money, rather than admitting that they did something stupid, fix their processes, and move on.
This quote taken from the Yahoo coverage..
"The code could also be purchased by an unscrupulous company looking to make its applications work more smoothly with Microsoft's dominant operating systems"
Who is 'unscrupolous'?, the company trying to improve their software for the greater good of everyone? I think it is the company that won't reveal the source code...the company that has systematically crippled/sabotaged other companies by keeping their 'intellectual' secrets under wraps in an attempt to leverage themselves into any software based market they see fit to at the expense of others.
I think this quote basically sums up the whole open source/closed source debate.....
Guy
I work nights so I woke up to the radio news about this and an expert saying "If this can happen to Microsoft it can happen to anyone"
I step back and think.. isn't this sort of the way Microsoft responds to everything?
If it's a problem on Linux or Unix its unique to Unix or Linux.
But if it's a problem on Windows it can happen to anyone.
E-mail viruses.. ANYONE can have e-mail viruses (Note in the 1980s Unix experts were saying Unix was immune to viruses.. This is far from a unique clame.. Mac users made the mistake of razzing Dos for viruses... forgetting that everything that made dos viruses posable was present in MacOs.. however absent from anything else)
Back doors are supposidly unqiue to open source yet back doors usually happen as a result of an employee not the result of an unknown coder submitting code.
Anyway... look for the spin.. any time Bill Gates gets hit with a pie in the face we are told we are all hit with a pie in the face..
When Linus locks his keys in his car it's unqiue to Linus...
Side Note: Anyone notice Bill Gates didn't throw a fit but USA, California, SanFransisco Mayor Willy Brown did...
On the other had we do have a point to make...
If Microsoft can't secure it's own network should you trust them with yours?
I don't actually exist.
Microsoft explicitly stated that E-mail attachments are not dangerous because, after all, you don't have to open them. In fact, of course, it's common practice to delete all E-mail from people you don't know sight unseen. So, you must be wrong: Microsoft said so when the Melissa virus came around.
The attitude more commonly found among UNIX sysadmins seems healthier. Yes, we know it's buggy. Yes, we aren't perfect. And if it's broken, it's our fault, and we'll try to fix it. And let's try to keep important stuff somewhere nice and isolated.
What NSAKEY is all about anyway? Did MS lie, and leave a big fat backdoor for spooks? This is the only thing in the w2k source that even vaguely interests me.
Remains? Since when has there been any integrity to MS code?
It's DNS entry currently reads:
Apple's says:
and AOL's says:
Somebody has been busy...
Richy C.
--
It's easy to blame NT, or Inoculate IT, but the real culprit is Outlook.
Microsoft's policy of helping users (even their own users apparently) run binaries and scripts from untrusted locations is absolutely insane. Yes, Inoculate IT should have stopped the virus (theoretically), yes, Windows NT should have more protection against attacks, but the key is that Outlook is a trojan fun house waiting to happen.
Unfortunately, for Microsoft anyway, the fix for this type of thing goes far beyond patching some buffer exploits. They instead have to totally re-think how Outlook (and other Internet software) handle untrusted binaries (that probably includes ActiveX).
That gullibility is manifested not just by the users' poor choices while using the applications, but in their poor choice of the applications themselves.
A long time.
It's not so much due to any specific virtue of Linux, as it is due to selection pressure. On any non-MS platform, there is competition among applications. That means if some incredibly irresponsible app developer releases applications that treat data as code, they will be subject to market forces and backlash and their apps will not become popular among the users of that platform. Go ahead, write an email reader for Linux that executes scripts that are embedded in the emails that it displays, and see if anyone still bothers to use your program once this "feature" has become known.
Whereas among MS Windows users, it's pretty much a given that you'll use Outlook, IE, Word, Excel, etc. regardless of whatever virtues or faults those apps happen to have. The flaws in the overall design philosophy (not just bugs) have been known for years, and yet people still use these apps.
Every single application market other than MS Windows has selection pressure in the direction of increased security, and MS Windows does not. Until the market changes (i.e. Microsoft is hurt), Windows will have significant security disadvantages compared to every other platform.
---
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
5) Or people hack on the source code, put in a nasty virus or trojan, and then distrubute it as part of a shareware/freeware program, or hack the Microsoft site, and put it in as part of "Windows Update"
A few weeks later, 50% of the worlds PCs are wide open
-- 73 de KG2V For the Children - RKBA! "You are what you do when it counts" - the Masso
And making samba work with the secret protocols used by PDCs, and doing the same for Wine, and
perl -e 'fork||print for split//,"hahahaha"'
Indeed, Windows source code leaked. Here's a fragment.
/*printf("WelcometoWindows3.11");&nb sp;*/
/*printf("WelcometoWindows95");  ;*/
voidmain()
{
while(!CRASHED)
{
display_windows_logo();
display_copyright_message();
display_bill_rules_message();
do_nothing_loop();
look_for_new_hardware();
sleep(10);
look_again_for_new_hardware();
scandisk();
if(detect_cache())
disable_cache(); if(first_time_installation)
{
make_50_megabyte_swapfile();
do_nothing_loop();
totally_screw_up_HPFS_file_system();
search_and_destroy_the_rest_of_OS/2();
hang_system();
}
write_something(anything);
display_copyright_message();
do_nothing_loop();
do_some_stuff();
if(still_not_crashed)
{
display_copyright_message();
do_nothing_loop();
basically_run_windows_3.1();
do_nothing_loop();
do_nothing_loop();
}
}
if(detect_cache())
disable_cache_again();/*just to be sure*/
if(fast_cpu())
{
set_wait_states(lots);
set_mouse(speed,very_slow);
set_mouse(action,jumpy);
set_mouse(reaction,sometimes);
}
printf("WelcometoWindows98");
if(system_ok())
crash(to_dos_prompt);
else
system_memory=open("a:\swp0001.swp",O_CR EATE);
while(something)
{
sleep(5);
get_user_input();
sleep(5);
act_on_user_input();
sleep(5);
}
create_general_protection_fault();
}
-
Roses are #FF0000, Violets are #0000FF, find / -name '*base*' |xargs chown -R us && mv zig greatjustice
However, as bad as this is, it is good for free software as highlights the benefit of having access to the source and the drawback of proprietary software. It should be strongly stressed that this break in and possible insertion of back doors in literally millions of computers via MS software just underlines things we all already know: When the source is not open, the consumer has *no* way to prove its level of security.
In the past MS and others have used the ``argument'' that having the source available to black hat hackers makes free / open source less secure. This (false) argument rested on the assumption that Uncle Bill kept MS source under lock and key. Today this argument is now double false.
If a bunch of microsoft employees receive something which looks like notepad.exe in a vaguely plausible sounding message "This is the new version of notepad for Whistler, please test it" then someone is going going to run it, whether they just click the link or have to manually extract and uudecode and unzip it. The hackers only needed one gullible person...
Any e-mail software can receive executables, any person can run the executable without checking it. That's why there is software around to check for malicious code, and it didn't work.
This is obviously bait, but I'll bite.
Do you have first-hand personal knowledge that Microsoft employees would do something "moronic" like downloading a trojan?
As I've mentioned before, I used to be a program manager at Microsoft. As a whole, I found my co-workers there to be some of the most computer-literate, intelligent, and most capable people I've ever worked with (rivalled perhaps by my new company, Avacet). I can not think of a single one who was not educated about the dangers associated with blindly running executables that come in email.
Also, Microsoft's network security was rather strong, especially considering that they have something like 25,000 employees worldwide and hundreds of thousands of machines to deal with.
Seriously, feel free to critique MS technologies -- I do it myself all the time. But an uniformed criticism of everybody who works there is just inappropriate.
Seriously, though... one of the more serious reasons that viruses/trojans spread more easily on Win32/Mac is "user imbecility/gullibility". And one reason (among many others!) why Linux/BSD was considered secure is that (1) users were much more sophisticated, and (2) the OS often compromised on security over 'ease-of-use'.
Today, with Linux (not BSD though (thankfully!)) reaching more and more into the newbie space (I'm just waiting for the first "for-newbies" distro (oh, wait, Corel comes to mind)), how long before something like this happens on a Linux box? Remember, there are a lot of newbies out there running Linux (and also Win2k/NT, for that matter) on their PCs with exactly one user account -- "root"! (or "administrator".)
Most class idiots aren't pulling down A's. Microsoft software is almost standard (as in, it's there and used)in business environment.
As some people have pointed out, if someone makes the source to Microsoft software avaiable, a whole pandora's box could open:
- 3rd party programmers may be able to increase the stability and speed of their software under Windows.
- By examining the source to say, Windows ME, Windows 2000, etc, we may have proof that Microsoft does or doesn't code their OS's to break specific peices of software.
- As others have pointed out, this berak in proves just how insecure NT is. However, if the source is published, it may be possible to make NT more secure.
Of course, this makes it impossible for Microsoft to ignore obviouse problems with Outlook running vbs scripts from an e-mail.--
Intelligence is definitely a recessive trait.
It seems from reading the news articles that the writers don't agree on what's worrying about this. Is it worrying because...
GROGGS: alive and well and living in
Someone has. Well, not quite to the OpenBSD level, but each patch has been read by someone. And there is an unbroken patch link from linux 1.0 to current versions, so I guess the chances of those patches having been looked at are pretty high.
perl -e 'fork||print for split//,"hahahaha"'
Your naiveté makes me hope you never administer any network I use.
The exact same type of crack could happen on ANY Unix machine, not properly safeguarded. Get an e-mail with a binary attachment, chmod 744 attachment, it runs, displayes a really cool screen hack or small game of some type. It also spawns a child process, but you're probably unaware of this.
This child process sniffs out passwords, because hey, any user account can sniff packets, not just root. People log into other computers, all the while this program gets user acct & password after user acct & password. It then sends out an e-mail to a remote address, listing all these new shiny user names & passwords, what machine they were connecting to, and voila, this cracker suddenly has user accounts. Now he's free to move onto higher level attacks.
Don't fool yourself for a second -- Microsoft's biggest mistake was that it wasn't using a more secure firewall to protect it's local machines - these machines should have been INVISIBLE to the entire internet, only available to MS's intranet.
The award for the "hackme" LinuxPPC contest was that you could get the hardware, but I didn't know that with the www.windows2000test.com you would get the whole Windows source code! ;-)
Jacco /var/log
---
# cd
-------
Warning: Slashdot may contain traces of nuts.
Well, y'd have to be running some program as stupid as Outlook, which runs arbitrary executable attachments, inside your supposedly "clean environment". I can't imagine a competent UNIX sysadmin would set things up this way.
perl -e 'fork||print for split//,"hahahaha"'
"Don't fool yourself for a second -- Microsoft's biggest mistake was that it wasn't using a more secure firewall to protect it's local machines - these machines should have been INVISIBLE to the entire internet, only available to MS's intranet."
Very good point.
I had the fortune of visiting the Microsoft Campus last year, and while there got a chance to go to the Museum they have. All of the computers in the lobby had internet access, yet they also had access to non-museum MS machines located around the campus. I know at least a few of them were probably not intended for public "consumption" due to the contents of some of the shared folders - nothing too fancy, but probably important stuff for MS.
> I'm a Linux user in all, but if MS fall I want
:)
.|` Clouds cross the black moonlight,
> them to fall the right way and no other
Precisely, couldn't agree more. Let them hang themselves, rather than someone coming along assassinating them.
(Mind you, if it can be shown to have been an M$ product that was cracked, I'd feel justified in saying they had hung themselves
> It's Illegal all I have to say about it...
Well, there might be that.
I think it's more to the point that you'd be breaking the license agreement by so doing, myself; laws come and go and we've got a shed-load of stupid ones doing the rounds just to prove the point, but settle for "right" and "wrong" instead. If you're doing what the license at the top of the source file says you shouldn't, you're doing the Wrong Thing(TM).
~Tim
--
~Tim
--
Rushing on down to the circle of the turn
2)The people who broke into MS are criminals. I'm not sure about this either. OK, they did break in and they did copy information, but we don't know much more than that.
3)Judges are stupid. Nope, not always true. I doubt the fact that MS code was "stolen" will make all other programing illegal.
4)MS code is worth copying. I don't need it, or Wine for that matter, do you?
So, does this make MS open source?
Friends don't help friends install M$ junk.
Would you care to explain how?
Han-Wen Nienhuys -- LilyPond
The break seems too weak to believe. Doesn't it seem like orchestration with the government to reinforce the Anti-Hack Treaty ? Showing such case to europeans and other signaturers may be a good reason. You cannot forget that government of USA entered in the World War II alleging that a ship was sunken by german sub and it was not true.
sourceforge purrhaps???
if (!signature) { throw std::runtime_error("No sig!"); }
Actually quite a few banks use unix for their core systems. I worked at places which use RS/6000's running AIX.
If their shareholders found out they'd been keeping it secret, then the directors could go to jail.
perl -e 'fork||print for split//,"hahahaha"'
"the company couldn't say one way or the other whether source code had been stolen."
In other news, a new build of Wine was released today boasting 100% emulation of the Windows environment at native speeds. When asked to comment, the dev team replied "We could tell you how we did it, but then we'd have to kill you".
(note to morons : go check on freshmeat just in case!)
-Billco, Fnarg.com
St. Petersburg (!AP) -- St. Petersburg police have found the bodies of three young computer experts. The three were found in one of the their apartments, lying on the floor in front of their 486 running SuSE Linux.
"Our police experts stated that they were those who broke into Microsoft's servers and stole large amounts of code", says a police agent via translator. "Experts were able to tell from lengthy headers, pointless libraries, and pointers to nowhere-in-particular that this must be actual code for Windows 2000' successor."
After a preliminary exam, forensic pathologists state that their deaths were all caused by ruptured lungs.
"If I didn't know better, I would think that they would have died laughing", said the pathologist.
One of the police experts who determined that the code was in fact Microsoft's also began laughing uncontrollably, and was rushed to a nearby hospital. He remains in serious condition and on heavy sedatives.
DrQu+xum: Proof that the lameness filter doesn't work.
Al Gore has the quote "I invented the Internet" fused to his name. It's been used time and again to demonstrate Gore's penchant for hyperbole, his untrustworthiness as a leader. Many of you probably already know, though, that Gore never actually said that he created the Internet, but rather that he was the key political figure in the early days of funding the Internet (still an inflated claim, but nowhere near as sensational as the other.) Does the fact that he never actually said what countless media outless attribute to him, often as a direct quote, make any difference whatsoever to his image and reputation? Nope. The media and his opponents decided to nail him to the wall with a hyperbole of their own, and with a bit of hard work and luck, it has become Truth. Truth, in that wonderful Orwellian fashion of 'if all official sources report the lie as the Truth, then the lie becomes the Truth, and the truth a lie.'
It wouldn't matter how much you or I knew the truth, much like it doesn't matter that Al Gore never actually said that he invented the Internet. The Sheep and PHBs everywhere will swallow whetever pill they're given, and you can bet dollars to donuts that the story line wouldn't play out in favor of Open Source. If you think it's hard to convince your superiors to utilize an Open Source model now, try and imagine the brick wall you'd hit with your boss' brain automatically substituting "what happened to that stolen MS code" for "Open Source".
For the moderators out there, I'm not saying that I think Open Source is theft, just so that's sufficiently clear. I'm just saying that it's worth considering the damage that the mass media PR monster could do to the Open Source movement, especially in light of the fact that most major media outlets are heavily invested in (and guided by) large, mean corporations. Think about it.
Obliteracy: Words with explosions
Perhaps this is a UK-only phenomena. Eventually the BBC etc might stop assuming that their audience thinks of computers as huge semi-sentient boxes with spinning tape drives and flashing lights that talk to their operators. Or that Microsoft are the best and only software source in the world. ("How could this happen to Microsoft of all companies?" asked the same interviewer.)
And the use of "hacker"...
/me goes up in a puff of unsmoke.
"None are more hopelessly enslaved than those who falsely believe they are free." -- Goethe
I work with bright people too who don't know any better. On an MS box that screen saver runs as root, but most don't know what that means. Someone who does not program and has never been exposed to *nix would not. They have been assured that their data is safe and trust that it is. That's the way it goes.
MS employees might better know their software than people who listen to the MS sales department but, again, can you vouch for everyone? From Bill down to secretaries and janitors on the night shift? I don't think so.
Friends don't help friends install M$ junk.
WOW! Have you been on slashdot very long? It's very appropriate here.
---
DO NOT DISTURB THE SE
Now that you mention it though.. it is kind of odd that only a couple of days ago we read that Wine can now run Microsoft Word 2000 and Excel 2000. Coincidence? :-)
I'm certain a group of 31337 h4x0r2 in St. Petersburg will be deterred by an American law against breaking into computers.
I know, I know, you can't expect to make sense of laws related to computers or efforts by the clue-challenged to pass them.
--
Someone you trust is one of us.
You really need to think before posting. Most of the security compromises you list for Linux are _local_ compromises. That means, you must already have a shell to do them. If you have a shell on Windows, getting root is even easier, unless you have all of the security updates. When NT4 was first released, almost every kernel call did not do proper checking, and you could comprimise security with _any_ kernel call. As far as _network_ security goes, securing Linux is just like securing any other OS - you check the network programs. The way you secure the console is by simply removing unwanted SUID programs. With Windows, you can assume that if someone is at the console or telnetted in (which you _can_ do with the proper software), you should assume they have administrator priviledges. As far as security advisories, most Linux security advisories come from the people developing the code, not from being cracked. This means you get to secure your machine _before_ script kiddies get their hands on things. With NT, the advisories are normally based on someone actually being cracked. Please think before posting, and make sure you understand the topic at hand.
I'm not even trying to say "Linux is better than Windows" with this post. I'm just pointing out that your arguments are comparing apples to oranges (network security to local machine security, and published exploits to theoretical problems).
Engineering and the Ultimate
Not even close. We figured it out, if you take all 60 million lines of code and shrink it small enough to print onto (let's be generous) 15 feet of cloth, the font size would be about 13 atoms tall. Given the nature of cloth, hardly any of the "paint" would actually end up on the threads. Most would fall through the holes. You would in fact get a tshirt that was kinda stiff, and solid white.
V
order the biggest freakin' code review in history.
If I were a hostile cracker, I wouldn't go the "data hostage" route -- to risky. The police will follow the money.
Instead, posing as an engineer, I'd slip a few buffer overrun vulnerabilities, just where I could use it. Knowing the cruftiness of MS operating systems I'd have my own private back door into any system shipped with Windows for years to come.
Give a man a fish, and he'll eat for a day. Hand a fisherman a crate of hand grenades and he'll catch all the fish in the river.
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
I'd expected more mature responses to MSFT being hacked than childish attacks either blaming NT like the above post or claiming that MSFT being hacked is good for Open Source like others I've seen. Frankly *nix and Windows are roughly equivalent in default security (except for OpenBSD) and only through the machinations of a good sys admin is either OS properly secured.
For those that believe *nix is somehow more inherrently secure than Windows here are a few sources that may refute that claim The major security issues in Windows are Outlook (disable preview pane, be careful with attachments) and Internet Explorer (disable Javascript). Doing that and using a firewall like ZoneAlarm is most of the securing that a typical Windows box needs. On the other hand due to the use of insecure C libraries (str* functions, *scanf functions, etc) most of the services that are enabled by default in a typical Linux install are insecure (especially RedHat the primary consumer Linux OS in the U.S.). Take a quick look at security sites like Attrition.org, CERT, SANS, rootshell, SecurityFocus, etc and check the results. Defacements of Linux sites has been rising at a steady rate and now there are more defacements of Linux sites than NT sites. CERT regularly has more Linux and Unix security advisories than for Windows. The SANS (System Administration, Networking, and Security) Institute top ten list of security holes has more entries for *nix than Windows. A quick search of the terms "linux" and "windows" on Rootshell's seearch engine come up with 84 downloadable exploits for Linux versus 39 for Windows.
The above post is not intended to be flamebait (I run Win2K but plan to reinstall Linux on my second machine so I am a Linux user) but as a counterpoint to the above post which was rated +5 when I replied to it.
Second Law of Blissful Ignorance
AVAILABLE - Slightly frazzled security Admin seeks Immediate Position after undertaking imposssible task at unnamed Redmond, WA. employer. Canned due to circumstances beyond control. Will take any offer not relating to windows. Added Plus - Able to interpret arcane source code for popular and possible unintentially Open Source Operating System (you hear that Larry E.?). Used to long hours and sleepless nights, anything's a change for the better. Looking for stock options (in a company that's still gonna be worth something in a month).
Imagination is the silver lining of Intelligence.
See what happens when you rely on InoculateIT / Innoculan AntiVirus software. It missed a common trojan for 3 months. Oops.
Apparently the hackers were looking for some good or brilliant source code, and they weren't able to find it. This explain also why Microsoft persons are sure that source code wasn't compromised: "It's impossible to make it worse than that" one spokeperson said.
This has nothing to do with the OS used. It's an employee who introducedd the Trojan by opening an attachment.
Once again this prooves the weakest link in any security is the human factor.
"When I was a little kid my mother told me not to stare into the sun...
"If liberty means anything at all, it means the right to tell people what they do not want to hear"
Weren't those same experts characterizing the risk that someone broke into their network as "remote", too?
Evryone knows the standard procedure for security break-ins. Isolate all machines, compare all binaries to archived copies, etc, etc.
RFC 2196, now does that ring a bell?
But of course not, it's going to be "bad hackers versus oh-so-nice Microsoft" all over again. Microsoft's software and OS design lacks in security, but guess what, it's going to be someone else's fault...
free the mallocs!
Any project started within the last 3 months may be potentially vulnerable to a legal Denial of Service attack, yes.
I refuse, however, to believe that there's a Court of Law in the world that's bone-headed enough to believe that project X, running for Y years and fully documented in that time as an open project (cf WINE), has benefited from the unrelated, unadvertised and recent breaking out of MS source code.
Come on.. Doom-saying is all fun and games, but please do try and stay within the bounds of reality...
--
I'd rather have a bottle in front of me than a frontal lobotomy
All MS would have to do is persuade the government that it is in the interests of the US New Economy and the perpetuation of the Long Boom to drop a few laser-guided fuel-air explosives on Sealand.
This was PRECISELY my first thought when I read these pieces: this is a staged event for some reason as yet to be revealed.
Of course, as a reluctant user of NT, I *know* it's vulnerable, and the fact this occured doesn't surprise me at all. What IS surprising is we haven't heard more of this coming out of Redmond; it can't be the first time.
I don't think the possibility that this is a way for Microsoft to reign in the Open Source movement is paranoid AT ALL. With M$ having its market share threatened by Open Source stuff, why not create an excuse that the people releasing it are ripping off internal code stolen from M$. Indeed, it makes perfect sense, and it wouldn't surprise me if the lawsuits start flying within 6 months.
I worked at a place where we had REAL break-ins, and the last thing you want to tell your customers is that you've been hacked. The fact that M$ is being so forthright about this--in direct contradiction to the way they typically stonewall against any less-than-flattering news--points to an entirely different motivation than just being honest.
Remember, the people that report these stories have extensive relationships with M$. There can be no doubt that they are spinning this is such a way as to ultimately benefit M$, or any initiative that M$ may find to its liking.
By the wall, Randall is *NOT* a criminal. Yes, he was convicted, but that means about as much as the stain on Monica's dress. Judge for yourself; go here for more information.
"The more corrupt the state, the more numerous the laws."--Tacitus, The Histories
According to the report, unknown hackers managed to procur a password to Redhat's network servers. They then used the password to download the blueprints to all of Redhat's products. Even worse, the password was circulated widely over the internet, allowing thousands, potentially over a million hackers to repeat the exploit.
One person familiar with the case said it appeared the hackers initially gained access to Redhat's corporate computers by exploiting a hole in the company's "FTP" software. This software is used to transfer files between remote computers. The hackers discovered that the password "anonymous" allowed them access to all of Redhat's intellectual property.
Most damning of the report's accusations is the claim that internal Redhat officers have known about the vulnerability for months, even years, but failed to alert customers or close the security hole.
The breach may have allowed hackers to insert instructions into the blueprints for Redhat's products, including the recently released Redhat Linux 7. One anonymous insider called such practices "common." When asked if they were planning an extensive audit of their code, Redhat officials repeated their reply, "What the hell are you talking about?"
Considering the antitrust case going on, can Microsoft leverage this to show that Windows "now isn't closed" and "the code is in the wild" and thus claim they shouldn't be treated as a monopoly?
Could this have been "allowed" to happen? Note there seems to be a great deal of confidence no source code was changed, just code stolen.
Not rational sepculations, of course, merely interesting ones to explore the depths of paranoia.
"The Sage treasures Unity and measures all things by it" - Lao Tzu
Although I could see how some people might not see this event as a negative to begin with. :-)
--
. . . for Microsoft to be able to explain the back doors they have placed in software when the get found. Golly! There's a back door in Win2K?! Those nasty Russian Mafia people must've put that there. We'll comment that out, er, uh . . . remove that in the next service pack!
CEE5210S The signal SIGHUP was received.
...what in the hell would hackers want with Microsoft's plans? Script kiddies, sure. Crackers, of course. But actual hackers? No self-respecting hacker would ant or need to crib from Microsoft's notes. That would be like copying off the paper of the class idiot.
"How perfectly Goddamn delightful it all is, to be sure" Charles Crumb
I wonder what now Microsoft has to do to save face in light of these action being taken agianst them. As a Big player in the world of softawre this will hurt alot of thier products. For instance if the source code for IIS was stolen I feeel really bad for people who run NT servcers hey could find an exploits even quicker and I would think it would be harder for microsoft to fend these type off attacks.
Sorry, greedy little troll, RMS does live within the law and FSF software has noting to fear at all from this BS.
Friends don't help friends install M$ junk.
Why was this modded to insightful? Any UNIX machine wouldn't have a mail client that automatically runs executables attached to email. On a default install for most UNIX what mail clients do you have? pine, elm, maybe mutt? In each of these files you could have to go out of your way to save the file, chmod it, the run it. Anyway, since when is Microsofts intranet not invisible to the internet?
Richy C.
--
It doesn't matter what OS you're running or what Email proggy you use if the person is dumb enough to run random executables.
But what happens when an email program provides a preview feature that will open an email and show you the first few lines and an auto-execute feature that will run an arbitrary program when the email is opened?
What happens when both features are enabled out of the box? Is a heart surgeon to be called stupid because he spends his days reading up on heart surgery instead of all the intricacies of computer security?
Aah, change is good. -- Rafiki
Yeah, but it ain't easy. -- Simba
Erm, ask for proof ?
No matter how much you think Bill Gates is the anti-christ or hate Windows, this is most assuredly NOT good news. The judges, the lawyers, and the law enforcement that will certainly become involved in this case will look at one point, and one point only: someone broke the law. Know what else? They don't understand you, and they don't care that you want Wine to work better or an Open Source Windows.
In the interest of fairness, let's look at this from their point of view. "Hackers" (does anyone know what this word means anymore?) have been getting a lot of bad press lately. Hacking into Microsoft's site adds fuel to the fire. Stealing Microsoft's code is fanning the flames.
Everyone is making jokes about how insecure MS products are, as if Apache or Slashdot have never been compromised.
Even more worrisome is the opinion of the everyday, ordinary citizen. Some of which have made money off MS stock. Many of which use a computer, but aren't as "in" to them as we are. I bet you lunch that they see stuff like this and feel "insecure". And I guarantee you, when something like Carnivore comes along, the average person will suport it, because it makes, at least in their mind, the online world a safer place.
So laugh now about Microsoft's problem. Joke about an OSS Windows, regardless if they want it or not.
Ladies and Gentlemen, if you're old enough to understand, it's time to realize that this is most assuredly Not A Good Thing.
Disclaimer: MY computer runs Linux/BeOS.
Other possible motives include economic espionage, though experts said only a rogue company might knowingly buy stolen software, using it either to improve its own products or make those products more compatible with Microsoft's best-selling operating systems.
I'm not sure how you can label a company as ROGUE whose purpose is to provide more compatible software...maybe now we'll get open source windows...
If you make a public registration somewhere
try/create standard cypherpunk/cypherpunk first. (or was is cypherpunk?)
(Please mod up if you know what I'm talking about)
Gee, somebody who GETS IT!
Take a PC, install a default copy of RH 6.2, hook it up to a static IP DSL modem. Come back in a month or two, and you'll find that you have at least 1 or 2 "volunteer" sysadmins!
The difference between NT and Linux is that you are given the control to make Linux VERY secure. You just aren't given the low-level control needed to make NT anywhere NEAR as secure.
It takes time, and extreme attention to detail - bit it CAN be done.
-Ben
I have no problem with your religion until you decide it's reason to deprive others of the truth.
yup. Since the original host (infection 0?) was infected via an email attachment, it would have been easy for the attackers to tunnel through the firewall (port 80, perhaps: outgoing information encoded in the URLs).
It could have been in the attached MS Word .DOC file as well. And anyone who goes to ther MSDN site for various tech info, having to use IE with full ActiveX enabled to make the sites work right, is potentially infected. Or anyone using the MSDN Libraries, including MSVC Help, of recent couple years (which also don't work well without internet connection enabled).
Their whole "vision thing" of hypertext documents which seamlessly integrate your computer (via the MSDN Libraries, including compiler help files) into the Microsoft servers, reporting (if they wish so) anything you look up, any articles you read and for how long, anything you search for, which code samples you extract, ... even without coupling with ActiveX, is a virus/trojan handcrafted for industrial espionage, all by itself.
I wish only Bill Gates' machines and those of the other brains behind the Microsoft all-is-one (or is it one-is-all) "vision" got some of their own medicine.
BTW, I just typed in my first message in here, and this luxuriously spacious /. edit box with its eye pleasing courier font makes Microsoft Notepad seem like an ultra-ergonomic editor from the future. (The only cure for this is to make the web designer here use this exact edit box for three days for all of her editing work; by the second day the edit box would be twice as wide and three times as tall and user could set their own non-fixed pitch fonts. By the third day she would suggest dumping it altogether and using something like Userland's Manila editor .)
whois microsoft.com
also whois aol.com ; whois apple.com ; whois whitehouse.gov
How did they do it? Simple. Whenever you register a nameserver IP address, you have to include a domain name for the nameserver. I think the only thing checked is that the IP address pings and the domain name is part of a real domain.
--
"Open source is good." - Steve Jobs
"Open source is evil." - Microsoft
I don't care how M$ falls. They've made it clear that they'll stoop to any level to get more cash, but now the shoe is on the other foot. But I would not insert any windows code into a linux app. linux is not the OS of thieves. And that would make linux just as bad as M$.
//rdj
No one can understand the truth until he drinks of coffee's frothy goodness.
--Sheikh Abd-Al-Kadir, 1587
In fact, it's probably the biggest misconception he made.
Relying solely on a firewall is the single biggest mistake a company can make.
True, a proprely configured firewall can make a huge difference, but _real_ security involves securing every machine on the network. A firewall won't fix a problem with bad client (such as Outlook) executing code it's not supposed to. A firewall won't fix a problem with a web/mail/whatever server running behind it.
The bottom line is that if a machine needs to talk to the internet, it _needs_ to be secured, because an improperly written app can make any firewall completely useless.
OTOH, it's always possible to get a trojan to a person's PC, f.e. by let the person download some moronic 'gadget' for the desktop. But it would have been way more difficult that way.
--
Never underestimate the relief of true separation of Religion and State.
"These were all very bright boys - cheerful, helpful and good at their day programming jobs" said apartment resident Canya Bolyevtis. "But last weekend that changed when they started walking around in a daze after an all-night session, as if they had been exposed to some terribly traumatic thing."
Californian software analyst Rich McGee says the teens were foolish to allow themselves to be exposed to Microsoft source code.
"Here you have some very bright young guys with some Unix experience suddenly coming into contact with the C source for kernel32.dll. I think they were unprepared for the shock."
St. Petersburg police chief Konstantin Bolygubov thanked the public for the information that led to the arrests, saying it was the easiest raid he had done in a long time.
"When we broke down the door, none of them moved," he said. "They were all just staring in horror at the screen of a PC in the corner of the living room."
--- Hot Shot City is particularly good.
What about the claims by some that M$ uses portions of GPL'd code? If that was revealed in the any sources absconded with, could this not work in open source's favor? Granted, M$ will still take the position the material was illegally obtained (probably rightfully so) and try to supress it (fat fscking chance). This could give the free software movement some justifaction for its model and some teeth for any legal wrangling they felt they should do.
just a thought...
-'fester
NT *does* have a proper security structure, even moreso than Unix does.
I wonder if this could be the beginning of Microsoft being forced to open its code to major customers (at least)--those that will demand the code for independent review (say, Fortune 500 companies and major governments).
Along this line I am reminded me of controversial tactics used in the homosexual community to "out" prominent persons publically against their will.
Is it time to start a Planet Open? A movement to force companies to "open" their wares against their will?
Such a thing would be illegal--and participating would make one liable to Mitnick-type incarceration (or worse!).
But, it this inevitable?
Now hiring experienced client- & server-side developers
-- @rjamestaylor on Ello
Not sure about that. IMO the problem was that a *stupid* computer was let to take decisions (i.e. running a program) instead of a - supposedly - *intelligent* human operator.
The policy of dumbifying computer users to sell more software is backfiring on M$oft ( not much, but some).
Good automation practice should rely on *sinergy* between man and computer, allowing each one to do what it does bests : computer to quicly perform repeated stupid tasks ; human to analyze data and take decisions.
Ciao
----
FB
Really. I find that hard to believe.
More likely, NT admins just generally don't think about the TCP/IP world in the same terms unix asdmins do.
You absolutely *can* secure an NT box, to the same degree you can secure a unix box.
That knocking sound you hear is the FBI at your door. I hear Thursday's desert is stewed prunes at Levenworth. Don't worry, I'll donate to your commisary account.
Pay no attention to the man behind the curtain with all your metadata.
> (and please don't blame 'untrained users' - on a
> properly configured *nix system, an untrained
> user couldn't do any harm...)
That depends on your definition of "harm".
They certainly can do things like use the same password for your system as they use over unencrypted connections elsewhere.
Stuff like that can at least open the door to harm. Lets face it - no system is completely bug free - and once someone gets on by sniffing a password - its that much easier for them to use the latest root exploit
(assuming they need root - last time one of our users had a password sniffed - the guy who broke in just setup an IRC bouncer - fucking looser too - I got the job of logging and monitoring his IRC sessions while we were gathering evidence for the Authorities. Just sat around in IRC all day talking about how "we can take over this channel" or "We want that channel" - get a fucking life!)
-Steve
"I opened my eyes, and everything went dark again"
It seems michael has forgotten to include the link to the original article on the Wall Street Journal - it's here - login 'slashdot123' passwd 'slashdot123'. Very long, comprehensive and insightful.
Richy C.
--
This reminds me very much of a point I have
frequently made to a friend of mine about
the security of his network.
He had claimed that he didn't need to worry about
security because his networking folks had
provided a very secure firewall.
"Really," I said, "Do you have any Windows
boxes on your network."
"Yes," he replied.
"Do they run Outlook?" I inquired.
"Yes," he replied.
"Then why do you bother to run a firewall at all?"
I went on to explain that anyone could infect
Windows boxes behind his firewall via email
(which almost every firewall in the world
is configured to pass). Once infected this
Windows box could subvert his whole network
and tunnel anything it needed back out via
SMTP (we do after all, have examples of
tunnelling IP via SMTP).
My friend thought I was nuts. Seems that something similar happened to Microsoft itself.
Guess I'm not nuts. There is no network
security on a network which has Windows
present.
Sigh. That thing on your desk is not a computer. It is an amplifier. If you are smart, it allows you to be very, very smart. If you are stupid, it allows you to be very, very stupid. Outlook allows folks to be very very stupid bigtime. When anyone who has any DP skills at all is in big demand, sooner or later, you will find someone who you have hired that is going to amplify their stupidity bigtime. You don't hand your car keys over to your 10 year old, but many places are doing the equivalent with Outlook, and other M$ products. I personally feel that the risk/reward against a tightly coupled rice-pudding OS/Application model such as M$ brings out. I shed no tears that they have been given a dose of their own medicine...
--
If it's a outside job and the crackers beat MS' secuity, now the whole world+dog knows that MS software sucks in protecting data.
From all the articles, it looks like this was a Trojan that may have been secreted during the execution of some email attachment. Knowing MSFT, they'll probably spin this as a virus similar to Melissa or ILOVEYOU and the general public will stop blaming them.
After all, no one is calling for their heads after Melissa and ILOVEYOU even though the main reason they caused so much damage is the lack of security built into Outlook and the ease of using Virus Building Script. Instead we'll probably get a lot of hacker crackdowns with this breakin, perhaps another Kevin Mitnick type case where he got reamed for seeing Sun's Solaris source. It's very possible to see the culprits doing massive jail time for supposedly causing MSFT zillions of dollars in lost revenue by merely looking at the source like Sun did with Kevin Mitnick. This is especially possible in the current climate of UCITA and the DMCA. I wouldn't consider that a win, would you?
Second Law of Blissful Ignorance
Bah humbug!!
When are people going to learn to use SSH???
I use it on my own local network at home, even behind my "invinsable" linux masq gate.
jonkatz@slashdot.org
All it says is they had access to stuff... and sniffed passwords. What evidence do they have that these 'blueprints' were stolen?
And they continually talk about whether stuff was modified.
And they think that this might be a 'data hostage' situation.
Hardly. I think said hackers would simply distribute the source around a bit then post it to usenet. THAT would be cool.
Local root exploit are quite common, and tend to be fixed late compared to remote root exploits. Some admins think they should only mind about remote exploits because they trust their users.
Statistics show how wrong they are. And even if you can trust your users, can you trust what they get in the mail?
____________________
Ni!
What's with all the negative noise here!
They were probably well intensioned Hackers trying to fix bugs in M$ code!
They can't legally see the code, so they did the next best thing!
-- "To ask a question is to show ignorance; Not to ask a question means you'll remain ignorant."
If the Windows and Office source code starts circulating around, coder may just start coding stable apps and improve it since they'll have access to *everything*.
Bah, some dude in Scandinavia or Russia will release an open-source distro of Windows and we'll all end using and praising it... Imagine that, the Ultimate Revenge(tm)! MS forced to embrace OSS or else they die! Haha! Some are already creaming their pants, I know that for sure.
Linux is in danger!
/max
-- It's always darker before it goes pitch black.
I've seen some pretty dumb things on Slashdot and I've seen some pretty offensive things on Slashdot, but never a post like this.
This ranks up there with the jokes that came out after the Challenger accident and after Oklahoma City. The Kursk was a tragedy. It may not seem that way to an American, but it shattered the emotions of the Russian people. To further imply that Microsoft had any part in that tragedy is simply childish.
I've always considered the majority of Slashdot readers to be brats, but this goes to show that whatever Microsoft may do to fight the open-source movement, they'll probably win. Why? Because for the most part, it's people like you who make up and support that movement, people lacking any amount of maturity and decency, and for movements to succeed, they must at least be honorable in the face of their enemy.
Just sickening. Whoever moderated this up for being funny should be shot. Mark me down for flamebait or what have you, but the fact remains, many open-source zealots and programmers are simply brats.
From what the MSNBC article said, the crackers initially got access because some poor MS employee inadvertantly ran a trojan email attachment, then did some sort of password sniffing.
It should now be completely clear that attachment-running programs such as Outlook are dangerous and should not be used by any business which has sensitive data, i.e. any business at all. Any business which jeapordises my personal privacy by using such software is acting negligently, just as if they left their locks unlocked and their safe open at night.
I wish I could say that this marks the beginning of the end of such "back-door enabled" software. However I fear that this will not be the case.
perl -e 'fork||print for split//,"hahahaha"'
Of course, this seems to be more or less happening naturally without the source!
PJRC: Electronic Projects, 8051 Microcontroller Tools
? I don't get it.
YOu can select 'run attachment' from just about any mail client. How is this bad? It's a USER CHOICE to execute something mailed to them.
Whether or not it's a script is not the point.
I agree, it was stupid to have scripts that executed off a single click (a-la those trojans a while back)... so you didn't have time to think...
the earlier story about Wine running Excel and Word takes on new meaning.
Lacking <sarcasm> tags,
How many email clients on Unix have that option at all, never mind enabled by default like Active Scripting. Yes, I know admins should turn it off, but why include it at all? I can think of very few advantages of it's existence.
> True, but you (or the original AC) were talking
> about Unix, not Windows. You can't go into
> promiscious mode unless you're root on Unix.
True - of course under true64 if the admin throws the interface into promiscuous mode - by default it ends up setup so that any user can then sniff the network - kind of lame. Took some digging through docs to figure out how to avoid that.
(turned out to be simple - though I forget it now - one of those "things we needed to do once")
> And since most systems use shadow passwords,
> you can't get at the hashed passwords
> unless you're root, either.
Yup - and even then you still need to attack them. Good luck if the system uses cracklib (or equivalent). As an added bonus - the salt makes it so that its fairly CPU intensive to crack passwords in parrallel (probably doesn't apply to MD5 hashes - but they arn't as limited as the old crypt() stuff anyway)
-Steve
"I opened my eyes, and everything went dark again"
And MS didn't pick this up? On August 14, 2000, PC Mag ran a story on this trojan and only rated it a 5 out of 10 for harmfullness. WTF?
Pay no attention to the man behind the curtain with all your metadata.
It's not as if they stole anything valuable, is it?
Everyone is guilty. Except the thief. The poor guy just had to do it, hadn't he. Can we from now on describe crime as 'crime' regardles who is the victim.
Please...
-M-
I would like to die like my grandfather did - sleeping. And not screaming in terror, like his passengers.
Has anyone take a look at MSFT stock chart? It's rising!
Well Windowzers nothing to worry about. It were Microsoft partners who sneaked the code.
Microsoft partners:
"AAAAAAAHHHhhhhhh. AT LAST!!! Now we can get a look at that dumbiness of kernel exception that has been segfaulting our code for 10 monthes and get a fix for it...
Hello? Mr. Investors? We finally get a solution to our problems. This time code will be stable and fast. Soon a new set of fresh killer-apps will be on the market. So Windows will still live for some time...
Investors:
Ok Dealers NOW you can buy some of that M$ stock."
Ah, yes, evil hackers from Russia stealing the "software blueprints". Smells like the plot of a James Bond movie.
"And now, Mr. Bond, by altering the blueprints I will be able to take control of every desktop computer on the planet! I'll have an entire cybernetic zombie legion at my disposal!"
"We're one step ahead of you, Smirnoff. Office is a very fragile piece of code. Change even one line and the whole thing will come crashing down like a house of cards. The worst you'll be able to do is crash every computer. And who would be able to tell the difference between that and the way Office normally runs, eh?"
"Curse you, James! Now I'll have to kill you by an incredibly intricate device which you'll no doubt escape. The only way out of your cell is to cross this tile floor. Land mines are hidden under nearly half the tiles. Fancy a game of full-contact Minesweeper, Mr. Bond?"
Chelloveck
I give up on debugging. From now on, SIGSEGV is a feature.
We are confident that the integrity of Microsoft source code remains secure.
But who are the competitors?
--
CNET : News : Entertainment & Media : Story
-----
If Bill Gates had a nickel for every time Windows crashed...
Okay then..
With this news in mind, can someone explain why MS shares have gone up nearly 5% so far today?
-- MartinG To mail me: echo kewyjlcxyzvjfxbqwh | tr bcefhjklqvwxyz
Actually, when I tried out the network edition of Colel 1.0 ( the one you find on magazines and on the 'Net), I was astonished to find out that the installer did not ask for root password ( I guess it was considered too complex a concept for newbies to grasp). As a result my box was perfectly installed - and anybody could became root with no password.
Not a big thing, for a unix/linux user - but I would not be surprising if Corel users are still surfing the Net without protection for their root accounts.
Ciao
----
FB
No. It's just about the software which comes with NT and Microsoft sells for NT and everybody uses on NT. An equally stupidly-designed UNIX mail reader would be equally bad. But most UNIX systems don't use such software.
perl -e 'fork||print for split//,"hahahaha"'
Just what we need. A high-profile company that has decent lobbying skills getting hacked just as we face more and more legislation against hacking.
And this on the hells of the story below about pushing for more UCITA support. crap.
---- The price of freedom is eternal vigilance. -Thomas Jefferson
Segfault has some underreporte d details in its coverage :)
people will ALWAYS find humour in what hits close to home. There are jokes about racism, terrorism, death, war, destruction, ships sinking, murders.. anything. humour is a normal mechanism for human beings to cope with anything serious. you don't have to like it, you don't have to do it. I admit to making racist jokes, lesbian jokes, homosexual jokes.. just about anything. that doesn't necessarily mean that I am a racist, womanhating homophobe though...I have friends in all those classes..
//rdj
No one can understand the truth until he drinks of coffee's frothy goodness.
--Sheikh Abd-Al-Kadir, 1587
It doesn't look like it; the news articles seem to imply that it was just some low level accounts cracked and just read-only access to anything important. (Yeah, like they could slip an extra bug into Windows source code and anyone would notice)
But that wasn't my first thought. That headline, "Microsoft cracked", is terrifying! Are all the Windows users here keeping their systems up to date? If you aren't, you're probably vulnerable to the new "Win9x doesn't always check whole SMB passwords" bug, the old "malformed IP packets confuse the hell out of Microsoft engineers" bugs, or a whole plethora of Outlook exploits (including a buffer overflow when email is downloaded, so turning off previewing and javascript won't help).
But if you are keeping your Windows box up to date, then you'll be one of the hundred million computers that get 0wn3d by the first person to crack windowsupdate.microsoft.com and stick in a trojan. This isn't just a Microsoft problem, of course; every OS vendor (even taking the broadest definition of "vendor" for Debian people) keeps their repository of updates, and all the good ones have an easy way for users to sync with those updates.
I still think that Windows Update, and the idea of autoinstalling security updates from vendors in general, is a good thing; it certainly beats having millions of exploitable computers hanging off the net. But that central download source then becomes a central point of failure for your operating system security; God help us all if Microsoft ever really gets cracked.
Oh well, I have not installed windows on a machine in more than 2 years. Will not be doing it again anyway.
Friends don't help friends install M$ junk.
and read an account of the Windows upgrade that was behind the Kursk disaster.
try { do() || do_not(); } catch (JediException err) { yoda(err); }
that all your data is stored on a remote, secure server at Microsoft.
I'd like to jump into conclusions. Bear with me for a second here.
Say that the recent high profile cracks (a.k.a. hacks) are only the beginning of a tidal wave, where companies are attacked for fun and profit. The world cries for help, and out goes the countries (US and Europe, for starters) and
What will happen? At first, things will look promisingly better:
- Hacking sites will be banned and closed. The few which will remain will go on-line and off-line quite a bit, and spend their time mirroring and evading law enforcement
- The script kiddiez will be gone! What used to be a game will have some kids arrested, and the rest will be scared s***less and cease to function
- High profile cracks will become the sign of stupidity, as the cracker is sure to find the feds outside his place in a matter of hours
But in the long run, we will start to see, IMHO, deeper influences:- Underground groups would form. They will use the Internet for communications, just as before, but will probably be more closely-knit and use steganography and/or encryption as standard means for communications.
- Most of these groups would be benign, acting with the spirit of true hacking, but some will be malignant secret societies. I'm speaking of highly intelligent people, with the know-how and intention to commit those cyber-crimes, and some form of fscked up ideology about how "we must hurt them to prove they can't touch us".
- All kinds of those groups will work feverishly in research of new technologies to subvert security systems, which will be slower but continue nevertheless, while
- OTOH the security systems development will shift into lower gear. After all, the hackers are gone, right? The high profile dudes are in jail or on the run. Let's leave the door open at night, who cares?
A dark era is coming. Information will be limited to the few who dare have it. The majority will live in the bliss of ignorance, while the few will silently loom in the shadows, waiting for their chance. Some will treat it as a game, knowing they control the power and get high on the feeling. Some will silently slip into places and perform subtle acts which will really pass unnoticed, like long range logic bombs and backdoors. System administrators will grow lax and less educated, while hackers-crackers will rummage their systems undisturbed.Call me paranoid and pessimistic. Flame like hell.