Slashdot Mirror
Microsoft Hack a National Security Threat
Scott Treadwell writes "The Center for Strategic and International Studies (CSIS) stated in a 73 page report, that the government and the private sector should be concerned about the "
trustworthiness" of future Microsoft products. This, in the aftermath of the October hack into the Microsoft's network in which an attacker allegedly gained access to Windows source code.
"With most military and government systems powered by Microsoft software and more generally reliant on [commercial, off-the-shelf systems], this recent development can pose grave national-security-related concerns""
here
...it took a hack into the holy temple microsoft before Redmond's code was considered a security threat?
Personally, when MS and the NSA started colluding, that's when I started considering MS products to be a security threat. I could never figure out why the justice dept. would want to shoot itself in the foot by hobbling their (indirect) relationship with Microsoft.
Anyway, I suppose the hacker(s) could disclose whatever source they have and claim to do it in interst of National Security(tm). Kinda' like Zimmerman publishing a book containing the source for PGP inorder to get a grandfathered, post facto export restriction waiver.
Perhaps this is all some sort of grade facde by Microsoft to get their Win2K source under the many eyeballs that will (hopefully) make MS's thousands of bugs shallow.
But hey, as the saying goes, "[...] when the going get weird, the weird turn pro [...]" and MS's shares have taken a huge hit lately.
Remember the "NSA key" brouhaha around Microsoft a while back? I'd be equally concerned about MSFT putting stuff in their code on purpose, and not just some group of crackers. Not to mention the inadvertent (or are they? Hmmm.) security bugs that show up every week or so.
The problem is that the "bad guys" may be more resourceful than those working for the government. Also, any code review might have been made under the assumption that this source code would not available to the attackers. Finally, consider this: the source code was lifted from Microsoft's site, Microsoft presumably knows their own software better than anyone and should be best able to secure it. If their site was compromised, how secure should other sites feel that don't have the "Home OS advantage"?
JET Program: see Japan, meet intere
That is what I like about Linux most of all - its security and stability. Its good when I'm working on my portfolio to not have to fearfullt press the 'save as' button all the time. I wish there were more art programs for it though.
The beauty of the 'I Love You' virus, AFAIK, was not in the program code itself but in the insightful understanding of Human Nature it showed. I know when I recieved one, I opened it (tee hee!) in a fit of curiosity. I really was disappointed though :-(
--Anticipation of a New Lover's Arrival, The
Actually its more along the lines of what may have been altered as well as seen. Their is no real way for them to know if something was altered unless they do a full audit, im not even sure they could do such a thing in a reasonable amount of time due to the sheer size of the beasts they area talking about.
Also this code was stolen, it was never open so the bad guys may know something no one else can find out because no on else can see it.
In the long run i dont think either method is inherently more secure. Security by obscurity is know to fail, it has been proven many times. Now this is not the same as publishing a full exploit which imho is reckless and dangerous since it just leads to increased script kiddie attacks.
this space for rent
What surprises me is that they deem a revelation of source code a security risk. That, if anything, shows a lack of faith in OSS.
As much as it may chagrin me to admit it, Microsoft has some thirty-five thousand people working for it, and while they may not be able to or want to audit their code in an OpenBSD-like manner, I am sure they have an entire security department. And I am also pretty sure that they know that security through obscurity doesn't work.
My point, and I do have one, is that Microsoft does have its stuff together, to a certain extent. W2K and NT4, while not suitable for an Internet server, do well in a Microsoft only Intranet environment. If the government gets scared because of 9x or NTKRNL code being let out, what must they think about things who's code has always been available? Yes, it allows for public contributions and improvements, but it also allows for public analysis, scrutiny, and discovery of bugs.
Definitely not a Karma whore,
Mike "My Bucket's Got a Hole in It" Greenberg
http://www.yourmothernaked.com
Umm... Now I'm scared. Hasn't Microsoft always been a security threat? I started this post off as a joke, but then I realized something -- the US government is filing an "Anti-Trust" lawsuit against Microsoft. Now, last time I checked, "Anti-Trust" means that you don't trust them...
So why are they just now saying that they should be wary of Microsoft products? Strangely, I'm reminded of that ad Microsoft ran in Germany, with pictures of penguins with an elephant's trunk, etc..., saying something to the effect of "What if your penguin becomes something else?" It just seems so fitting when reversed. What if your "super-high-security" Windows server suddenly becomes the carrier of a virus the crackers did, when they "cracked" into Microsoft? Nothing! It's closed source; you're left to fear Microsoft. But what about Linux? If it suddenly warps into the same thing, you remove a few lines of code, and go over it to make sure it's secure.
________________________________________________
suwain_2
The article on the CNN site (and the junk "study" they chose to publicize) is nonsense. Since Time-Warner owns CNN and AOL owns TW (or it is about to), and AOL is battling Microsoft, it is obvious why CNN would select to publicize that particular instance of junk science. Some little weasel at CNN is trying to get on the good side of the new bosses.
Which Microsoft hack would this be?
Is this the Windows9x-on-top-of-DOS Microsoft hack?
Is this the "invent your own language" MS Word Grammar Checker Microsoft hack?
Or is this the mutex display bit "one program freezes your OS" Microsoft 3.1 and 95 hack?
Or is this the web-browser-turned-drive-explorer hack?
Or is this the always-locking-up ftp hack?
Maybe this is the "some versions of Direct 3D render bitmaps upside down, others don't, depending on which version of the interface you probe" Microsoft hack?
No, I'll bet it's the unstable "oversized int destroys your registry and requires reinstall" Microsoft hack.
Nyet. It's got to be the brain dead Outlook stationery format Microsoft hack.
No wait, I'll bet it's...
It's about time the government
- got some software that does what they want, not what M$ wants (or what some hacker in Russia wants)
- advocated the use of standards (non-MS TCP, non-.doc)
- reaped some payoff from (arguably) the most successful government program yet (ARPAnet)
Yes, The People's memory is short. Nixon died a hero, Ollie North has a radio talk show and we still use punch card ballots. Maybe it'll take a M$ brekaup AND an hack AND another destroyer blue-screening before they get a clue. It seems that only scorched-earth crises like these work.I sure milatary applications are different, but I doubt that most government agencies have any speacial relationship with MS, In my experience government departments buy and use compters in much the same way any business would.
The point is simple, if the code was lifted, than the code is out there, and the bad guys have it, and the good guys don't. That puts the government, and business that rely on MS code for security are at greater danger than would have been otherwise (not that relying on MS for secutiry was ever a good idea.)
True. There are specific procedures for creating a document on a classified system and then producing an unclassified version of it. And for the reasons mentioned above (pieces of the document remain in the doc long after they are deleted), no unclass MS Word, Excel, Powerpoint documents are allowed to be created on a class machine (it is a security infraction / violation). Only pure ascii text and binary pictures.
I don't get this part: how can this be a Cracking (as opposed to hacking as CNN inaccurately refers to it) problem? No secure system is permitted to be on the Internet without proper encryption, which is supposed to secure the information independent of what OS is being used. So no one can get sensitive information if it is handled properly, i.e., according to the rules.
SDMI: Finally! Music that won't rip or burn! Brought to you by the fine folks at RIAA.
Did you know that there are no viruses for Linux at all (except one that was made as an academic exercise just to show it could be done)?
i think the reasons that there aren't any viruses for linix is because 1) linux is still not as widespread as Microsoft. no reason to make a virus that will attack a minority of users when you can make one that will attack the majority; 2) most linux users (i'm assuming, could be wrong) will be the type who keep up to date on viruses and the like and therefore would know not to open attachments if they aren't sure what it is.
"Leave the gun, take the canoli."
this is just a placeholder till i send back my real sig from the future.
Are we forgetting that Perl and Shell scripts are also "small text file"-based. The problem isn't the "stupid text files", it's the fact that a user on Windows is running as the equivalent of root. Any program you execute (on purpose or by accident) can have total control of your machine. THAT is the mistake.
:)
I can run a "small text file" on Linux that could wreck my machine, but I'd have to be running as root. Otherwise, it can only mess up my personal files, and never touch the system. Unfortunately it'll be quite a pain to re-engineer Windows to actually properly implement security, but that's not MY problem
And yes, I am a Linux user and I love it!
All windows development happens in Redmond.
But...
>>The "ASCII text" restriction isn't exactly an ideal protection.
That's true, of course! But the government doesn't rely on pure technology to solve the security problem. They also screen and train people so that they can trust them with security.
There are no ideal protections, but there are 'cleared' and 'uncleared' people.
SDMI: Finally! Music that won't rip or burn! Brought to you by the fine folks at RIAA.
These concerns are certainly valid! Micro$oft products are inferior for mission critical tasks, and most everyone knows it. Granted, M$'s OSs are great for every John Smith home user.
What I find interesting is the comment about how national security is inheritly as risk because of a potential leak of source code. Why is that dangerous? After all, people @ m$ have had access to the code all along. I think they see the danger because the code was potentially gained by malicious activities.
With that said, what about open source? Wouldn't an OS like Linux be more dangerous because 'hackers' can get the source without effort? NOPE. In fact, I'd like to draw the conclusion that open source OSs like linux are more secure because the everybody can get the code. Security flaws are fewer because of the pure number of eyes looking at the code.
Perhaps the Fed should stop dumping tax dollars into M$ (especially since they are sueing the f* out of 'em). Think about that... FREE and true security, and some extra $$ to give back to the people who pay the bills.
--cr@ckwhore
Skiers and Riders -- http://www.snowjournal.com
Vintage computer games and RPG books available. Email me if you're interested.
Security through obscurity will always haunt microsoft. Obsuruity is obviously the only security they have. That is why they want to shut down bugtraq. Perpetual critical security updates are their only defence against people who uncover flaws in their operating systems. By nature of the way they operate, the crackers will always win. They will not post an update untill an exploit is found and used. The damage having already been done, they use a band-aid.
If voting were effective, it would be illegal by now.
Okay, if we believe for a moment that M$ was not entirely truthful in regards to the intruders not having changed anything [or if M$ hasn't nboticed the changes as yet], then there is certainly a certain danger.
Imagine the intruders, in the weeks they had access to win02 dropped a couple of trojans.
Imagine that any computer running that system in future can be rendered useless / or can be highjacked [chipnapped?] by anyone who has a certain key [like Alt+Tab+F12; Shift+F12; Shift+F12].
Now imagine that a second trojan is activated by the first one and the second's job is to collect all passwords/access codes, etc., compile a list and rename the list as a system or dll file, to be stored in an unsuspicous location.
The rest would then be easy... What if the computer in question belongs to someone working on calssified materials, or worse, on bank loan approvals, etc?
For once I agree that there is a fair chance of some danger to anybody's security - ie. every country's national security. More importantly, a danger to the security of our employers...
well, their concern was the source was modified. In the (gasp! someone read it!) article, the concern was that the source code couldn't be sanitized... if someone did make a change, in millions of lines of code, is microsoft gonna notice?
And well, linux is not that hard to hack into... i've had to deal with too many friend's hacked boxes recently (thanks, RH)... but all computers suck. linux sucks, microsoft sucks, apple sucks... and well, frankly, the longer they suck and are insecure, the longer i've got a job.
---
I'm not ashamed. It's the computer age, nerds are in.
They're still in, aren't they?
---
I'm not ashamed. It's the computer age, nerds are in.
They're still in, aren't they?
hmm... would a post about "Linux a National Security Threat" be insightful? Or maybe the moderater was having homonym problems, and meant inciteful.
---
I'm not ashamed. It's the computer age, nerds are in.
They're still in, aren't they?
---
I'm not ashamed. It's the computer age, nerds are in.
They're still in, aren't they?
hi all (george here)
christ on a stick, i think microsoft ITSELF is a national security threat! the fact that grown adults would trust sensitive security matters to an animated paper clip scares the CRAP out of me. what's next, are we going to drive down to disney world and give the plans for the B-3 bomber to goofy!! or maybe we should fax all of osama bin laddin's movements to daffy duck!! god!!
your bud
-gbd
My mother has been dead for 24 years kid. I wouln't go there If I were you.
M$ stock dropped in 1/2 since last year. If you are a MCSE, you will be broke.
we know you like solaris. now shut up about it already.
The issue of the article is that a hacker outside MS has seen the source code, which makes it easier for him to design attacks. The real problem, however, is not this loss of security, but the general vulnerability of software crufted by the MS development process. Most software developed for the the Gummint is required to have a remaining software fault rate (read 'bug rate') around 1.5 per KSLOC and is supposed to take security seriously. I doubt MS code meets those standards.
The nice thing about open source is that there are many eyes verifying that the code is solid.
so far every fingerprint scanner I have ever seen uses IR so if the finger isn't the right temp, it won't work. Sad part about this is that it doesn't appear to part of the design, its just a constraint of the imaging systems they use.
try running "strings" on the file.
By that defenition nothing is secure. Ease of use and security ARE directly related.
The ability of the admistrator to check the state of his systems, the need for easy, reliable configuration, while balancing the needs of end users are all related to security. If systems are not easy enough to use, than the user is at greater risk due to the probability that he might create security holes by mistake.
There is no such thing as "secure", there is only ever "secure enough".
Uh.. the token phrase 'biting the hand that feeds you' implies that you're *not* paying for the food. If you are, it's not really feeding - it's buying, isn't it? For that matter, US gov't buys stuff from alot of companies, should they all be above the law? Interesting.
-- ATTENTION: do not read this sig. It doesn't say much.
Some systems have to be on the internet despite the fact that they work with sensitive data or provide critical functions. The right approach is to start with a strong firewall with a man in the loop. There are a number of other design rules, including the use of internal compartmentalization and redundancy, that can help. Just remember that no automated system can deal reliably with the threat posed by hacker creativity. There has to be a guard on duty somewhere.
The issue there was really a reporter was using a scapel like a hammer.
PDF's can contain vector graphics, text, bitmaps, etc... the reporter assumed that because he couldn't see it, it wasn't there. What he did is sort of like hidding html text by changing the background and forground to the same colour. Or blacking out text with a magic marker without realizing that you can read it if you hold it up to a light.
No, you haven't. Current security systems are bastardized, ignored, and just plain not implemented well. What you are talking about are cheap, easy ways of increasing our crappy security.
Pretend for a moment that we take the computer you are currently using, and remove all processor cache from it. Now, someone could say "There are always tradeoffs involved with processor design; if you increase the performance of one thing, you will degrade the performance of another." Your response would be to say "That's nuts... all I need to do is add cache to it and look, it works great." You are correct, but only because the processor is so piss-poor designed that there were still easy design additions that could be made for big wins.
However, once you've made all the easy decisions, suddenly the tradeoffs rule comes back in full force. To improve, say, an Athlon, with current technology, would be a difficult undertaking. Because the chip functions as a gestalt, a unified whole, the easy answers don't work. Speed up the FPUs, and do nothing else, and your performance will hardly change at all, because the data can't come in fast enough. The easy gains are gone.
Security is much the same way. Yeah, we can graft some easy stuff onto our crappy systems nearly for free, but as you approach 100% secure, the ease-of-use goes down the toilet. OK, so the drive's encrypted... maybe only the people who know the password should be allowed to use it. Now the user has to enter a password. What if they leave the partition mounted and leave the machine? Should they be forced to re-enter the password every so often? That cuts into ease-of-use. Are they allowed to conduct big transactions without checking again that they are still the authorized person?
After the easy gains, easy-to-use and secure are mutually exclusive, because easy-to-use implies that there are fewer steps and checks being made, and that implies there are fewer steps and checks to bypass/fake if you are trying to breach security.
Of course, the true picture is more complex, this is a simplification. There are other axises in question, like complexity of the security implementation, complexity of the security use, expense, etc. Perhaps we point a camera at the user and try to make sure the face never leaves or changes. But then, perhaps a mask on the face can bypass this, so if we want to prevent that eventuality, perhaps we need to make some other check.
If you've had physics, it's like pressure, volume, and temperature in a gas. All three are related, and all else being equal, less pressure means more volume. All else being equal, more security means less ease-of-use. The full picture is more complicated, but the rule-of-thumb is still quite true.
(And to get back on topic, another one of those axises involves the security of the rest of the system. The entire point of the article is that Windows has now been proven to be weak on that axis as well, along with the ones we are so familiar with.)
The voice communications system used by the FAA enroute centers is currently transitioning from Tandem to Windows NT for the control subsystem. Think about it.
Think about it... you're assuming that Microsoft will give out the entire source tree to Windows 2000 to dozens of universities, but won't let the US Government, a MAJOR customer, take a peek?
Get real.
The people in the US Government who need to know if Windows is secure and backdoor-free most surely have access to all the source code they need.
is this good or bad?
Looking for people to chat about multicopters, coding, music. skype: gtsiros
Another Word Perfect example: Portions of the Starr (Clinton Sex Scandal) Report were undeleted by the media, leading to some embarassing revelations.
MS had there system "brocken into", and now there's a warning saying that it could be comprimising ur security etc.. to ur computer. And MS have the perfect alibie for it.. "well, it must have happend when some of our source code was hached". Becasue if i remeber correctly, there was an artical on MS a while ago, about MS building a backdorr for the CIA or some other group with 3 letters that people get really paranoid about.
Sorry if what i just typed is unreadable, and dosn't kake any sence, but i havn't been much doing work lattely, and i thnk my brain is dissintergating. after all, ur brain is a like anyother mussle, if u don't use it, it will fade away. Or maybe i'm just lazy...
I spose i should have read the artical first, or even just read a few posts so i know what i'm talking about. But then again, that wouldn't be doing it the /. way.
Oh yeah.. it's nre year eve here in NZ, and i'm planing to (well, lack of plan really) to stay at home, hell, i might even go to bed before 12.
The folowing is no exaggeration. There are EXACTLY ZERO power plants--nuclear, or otherwise--in North America that run their critical systems on Microsoft products. This is for several reasons:
1. Microsoft does not make a HARD REAL-TIME OS. For critical systems this is essential, because timing of critical tasks cannot be interrupted by non critical tasks such as switching operator screens or animating cursors and icons. You are more likely to see QNX or something similar in a power plant.
2. Microsoft waives all responsibility for death, injury or serious financial loss due to bugs in their software--REGARDLESS of it's use--in it's standard EULA. "No warranty, expressed or implied" and all that crap. Specifically they state that Windows and it's apps are not suitable for critical medical, aerospace and utility applications. So much for paying for "accountability and liability". If your CANDU goes China Syndrome because of a Microsoft BSOD you can't sue Bill OR his company because they warned you. Similarly if a bank loses your money or the government your tax return they cannot sue Microsoft either. Nobody should depend on Microsoft for accountability--they offer NONE. What they offer is for-a-fee technical support and the fact they are a relatively old, stable company that can offer those services and periodic upgrades for the forseeable future.
3. Microsoft is simply not willing to provide the support that mission critical systems demand. In the typical high-priced, ultra-stable critical systems the source is usually closed, but what you pay for is one-on-one support. If a bug is discovered, the company will send an engineer to look at it and the company will even write a patch to fix your particular problem ASAP. No waiting weeks to months for Service Pack 2 or Hotfix Q286745 or whatever.
4. The most critical of systems don't even rely on PC technology or commodity hardware at all. Even if all the "Critial" PCs crashed, the power plant would not shut down or blow up. It would idle along, all safety systems intact. The operators couldn't adjust any setpoints until the PCs came online, but the current setpoints would be in place. Safety and other ultra-critical systems rely on old but dependable technology used in your typical embedded systems. The continents power systems do not rely on PCs at all. They rely on little $2000 Z80-based PLCs and RTUs, or even electromechanical relays pneumatic or hydraulic systems that have worked well and are subsantially the same as they were in the 1940's and 50's.
Keeping these points in mind, rest assured that planes won't fall out of the sky, there will be no blackouts or hospital patients killed due to a Microsoft Malfunction.
OTOH, you could have your web banking account tapped dry or your Prozac prescription exposed because of un-patched security holes in a Microsoft product (or even poorly secured and administered systems of any sort). THOSE systems rely on closed source, often MS-based commercial software. It's not that closed source is the devils work--it's that Microsoft cannot and will not support their products in a manner REQUIRED for mission critical systems. THAT is what worries me...
Vintage computer games and RPG books available. Email me if you're interested.
The people in the US Government who need to know if Windows is secure and backdoor-free most surely have access to all the source code they need.
Then, assuming they do the sane thing and audit it, how does the hack change anything? One of the points I was making was that there is only a security hole if the U.S. government is already being stupid.
try this link http://www.cnn.com/2000/TECH/computing/12/29/csis. microsoft.report.idg/index.html
The government still put gas in their car when they broke up Standard Oil, and probably still made phone calls when the broke up Ma Bell. That's why it's a de facto Monopoly. You, me, and the government really have no choice but to use MicroCrap.
SDMI: Finally! Music that won't rip or burn! Brought to you by the fine folks at RIAA.
I see no reason why we should need a 73 page report to confirm this.
.VBS made all hell break loose...
MS software has proven to contain lots of STUPID errors as security treats. Take the "ILOVEYOU" virus that wrecked havoc all around the globe, it was just plain stupid that a small text file (I looke at the script) with the suffix
- Knut S.
(one of the first posts?)
hell, I've never gotten a virus in my ~8 years of using windows either... I did get a deltree once, but that was on purpose. I never use antiviral software either, as it is a useless battle, to try to check for every known virus out there. But, I digress, as for my opinion on windows: 95/98 suck ass, and should be burned alive. NT/2000 is an ok system in and of itself, but it's a victim of its own success IMHO. Theres simply too many win 2000 boxes that all have the same security holes. and more people know how to take advantage of those holes than other OSes. I don't think its even the fact the windows has more holes than other oses neccesarily, there's just more boxes out there, and more people trying to find the holes. I personally think that the various *nixes are the most secure network OSes, because they are strongly multiuser, which can have its downsides though, when it comes to usability. But about the whole national security bullshit, why would anyone put important secrets on a computer connected to the internet? No matter how strong your firewall is, it's a stupid idea.
Shit adds up at the bottom...
So some sinister nameless hax0r who maybe, maybe not, managed to download a few source code files despite Microsoft's "world-class" internal network security is a threat to our national welfare - but each and every one of the tens of thousands of Microsoft employees with unfettered day-to-day access to that same source code, well, all of them can be trusted implicitly?
Gee, thinking like that goes a long way toward explaining how Aldritch Ames got away with all he did to subvert the CIA (Completely Incompetent A**holes) so successfully for as long as he did.
Yours WD "untrustworthy" K - WKiernan@concentric.net
it just occurred to me how bitching this hack was, window's closed secret source is where much of it's security lies, now that it's out, it seems we have discovered a blitzcrieg of sorts, an attack on the company thru litigation (anti-trust), thru espionage (hack), and also commercially (linux). now whether microsoft buckling under its own weight is a good thing stands to be seen, microsoft supports the economy, and companies must act quickly to swallow up their market share.
______
"Sorry, but I don't there's anything charming about ignorance and carelessness." -LordNimon
Somebody once posted or quoted here that running microsoft OS's on the net was like planting the same strain of corn throughout the entire country, and that a single corn disease could wipe them all out.
It doesn't matter whether or not some crackers futzed with the 'doze source. I think all of us agree that it's so darned insecure and widespread that even as a checksummed audited binary, it's a national security threat.
All a foreign nation needs to do to really screw us over is combine the growth mechanism of melissa or ILOVEYOU and the bittersweet tang of back orifice (modified enough to fool the 2 year old virus patterns most people are using), and they've got us by the balls.
Windows by itself is a threat to national security. Thankfully, we have alternatives who's component schemes have ACL's built in , whose source has been audited for buffer overflows, and for the most part are free. The applications are there, and free, to replace office, explorer and most other things.
And I know this works in practice, too. Because I've never owned a windows box in my 20+ years of computing, I've been able (combined with some common sense) to avoid getting a single virus, without the aid of virus scanning utilities.
"Let him go, Ralph. He knows what he's doing." --Otto Mann (simpsons)
With Open Source, at least those who are seriously concerned about the security of the systems they run can do a thorough and targetted audit of the code to satisfy (to some reasonable degree of satisfaction) themselves that their systems are secure.
With Closed Source, you have to trust the vendor, the disgruntled former employees of the vendor and any cracker who might gain access to the source that there are no exploitable security flaws.
---
This has been said so many times before, and everyone seems to agree, but no one does anything about it. The weakest part of the chain is invariably the human factors. The oft-cited example of people putting sticky-notes with their passwords on their moniters is sadly enough true way too many times. Or using personal information as a password. Or using the same password everywhere.
You have to assume distrust with sensitive information. One place i used to work at was compromised, not because of weak passwords, but because the network was sniffed and they wern't using SSL.
I would be willing to bet that the intrusion into Microsoft wasn't a flaw in their web server, or any other program misconfigured. I would bet it was some kind VPN account that was compromised.
Until people come to terms with the fact that you can't always trust the people you should be able to, things like this will continue to happen.
Check out my sysadmin blog!
Broken links abound. Here's the real one.
max
This article seems to contain a few contradictions. It seems a trite ironic that the US government is willing to admit that most of their machines run Microsoft software, yet they continue to take Microsoft to court. (Bite the hand that feed you, anyone?) If I recall, one of the recommendations made in the trial was to make Microsoft open source at least parts of their software. And yet, access to that source code constitutes a security risk. There is a slight contradiction here!
On another note, if we are ever to convince big-name organizations (ie. the US government) that Linux is a viable option, we can't exactly agree with the content of this report. If unwittingly revealed source code is bad, what is intentially released source code? They don't like code that may have been modified by one person, but we want to offer them an alternative in code that has been modified by hundreds of people. Somewhat humorously, the Linux community may have to defend Microsoft on this one.
By the way, you might want to fix that link.
"I believe that a scientist looking at nonscientific problems is just as dumb as the next guy." -Richard Feynman
I mean, what do they expect? They make the proper functioning of the government and the military dependant on the products of one single software giant who won't even let them look at the intrinsic workings of their software (the source) and without planning ahead what to do if it breaks.
Now they need a security breach at MS to recognize this is a bad idea after hundreds of previous security holes didn't open their eyes? And what will all this lead up to? A few papers how this security breach isn't all that important for national security (and in fact it isn't, reagarding all the other gaping security holes in MS products) and that's it.
The alternatives i see are:
- look out for alternatives to work with and put them into use at least in some places, so if the security breaches in one OS forbid it's further use the alternative is ready for use in an overseeable time (anything less than a year is unrealistic here)
- engage in the development of the software they use (open source is a good starting point here if you don't want to do it from scratch) so at least they have a little control over the security and when holes will be patched.
All this is of no use if the people handling critical data aren't minimally trained (it is a bad idea to download software from the net and run it, regardless of the OS you use. If the OS faciliates this (like running applications from mailprograms at a mouseclick) it only makes things worse).
"By the way if anyone here is in advertising or marketing... kill yourself." -- Bill Hicks
I frequently select the whole document and copy/paste it to a new document to lose all the crap as documents tend to grow in size as they are edited and doing this makes the file size drop by quite an amount. I lost a Mb on one document recently doing this so that it would go on a floppy.
I love stacking my barbecues in the shed at the end of summer - you can't beat a bit of grill on grill action.
Vintage computer games and RPG books available. Email me if you're interested.
Now, I'll point out that we're not talking single user operating systems in a non-networked environment
Becuase such a system would be utterly useless for any government (with the possible exception of Sealand).
I still can't believe that the entire US Government's computer net is run by Microsoft!! Who are their network engineers? Have these people been sleeping while Microsoft was selling them crap that had "crap" written on the label and the entire geek community was referring to it as crap?
This is stupid. If some third-world country takes over their network (which is entirely possible) they deserve it.
NT error of the day: Operation could not be completed because operation was completed successfully!
--------------
--------------
$_='hfflbwfsbhfzp vs';s/(^.{4})(.{7 })(.+$)/$3 $2 $1/
I merely cite the book as a really great basic introduction. And especially in this Internet world, the average user would find that installation quite tedious to use; needing to be present to put a finger on a plate during boot, no backups, no Internet access, etc etc....
Vintage computer games and RPG books available. Email me if you're interested.
Of course, that's completely bogus and runs counter to decades of experience with computer security. If Windows were so full of holes that people with access to the source code could break in, Windows would be compromised a lot more than it is. Besides, lots of people have access to Windows source code already, and such security holes would be hard to keep under wraps. If Windows wants to become more secure, it needs more public exposure of its source code, not less.
It is scary to think that people like Hamre and his think tank are considered authorities when it comes to "cybersecurity", as they call it.
NTFS supports an Execute permission bit too. One could disable it in the user profile directories, and see what breaks.
Of course, one big problem on Win2000 is 'legacy' programs that like to write all over the drive, making it virtually impossible to even get close to a permission setup like a typical Unix. (For example, %TEMP% is set to a private profile directory, but some software just uses C:\TEMP anyway.)
No you haven't, since the system is still harder to use. You have to log in with you finger, etc (I didn't have to log in to my Windows ME machine, untill I made it part of a microsoft network). Inversely proportional implys one goes down as the other goes up and you example backs that.
If you could show where the easy of use goes up, then you would have refuted it. Even where it stays the same (although that won't be as impressive).
-no broken link
Amusing as this is, I think the concern arises not so much because of the breach of the source itself but moreso that this breach of Microsoft security demonstrates an oversight in basic security procedures on Microsoft's part. If this oversight in security (which I believe involved yet another patch to IIS) became evident on Microsoft's own systems, what does this the future hold for client systems?
...
I mean, if Microsoft can't even get their own security right
Just a few random thoughts,
Rob
This reminds me of that scene in "Pirates of Silicon Valley" (I know you watched it, so just 'fess up) where Bill and his pal are late for a flight and he says something to the ticket agent like "Do you realize what I'm carrying here? Critical software just like the software that runs your planes? That runs this building? yadayadayada..." Basically a threat, you recall it got the plane turned around and Bill made his flight after all.
:) from Redmond, that is one singular sort of arrogance there.
What was cute and probably apocryphal in the TV movie is frightening and possibly apocalyptical if we think of that brand of arrogance as posessed by the man who supplies the pentagon with their 'critical' software.
And, judging by the responses to the DoJ (Justice Department. Don't mention it, Fantastic Lad...
SDMI: Finally! Music that won't rip or burn! Brought to you by the fine folks at RIAA.
This sounds like a mistake (probably somewhere down the line of the story). The original probably came from a known security problem with MS word where you can see revision history in some documents (I don't know enough about it to say if it is always on). There is a feature in word that will allow you to have it save revisions. You can later look at revisions and see the strikethoughs of past editing. There are U.L.s about companies putting humourous stuff in documents like "This client is a boob", which are later edited out but saved in the revision history.
The easiest way to make sure a document is revision free is to cut and paste it into a new document. The new document will not contain the revisions.
-no broken link
The easiest way to make sure that the machine you are working on won't do all of this is to simply copy everything, open a new document and paste, saving the new document for redistribution.
:) Working in an academic institution, there are a lot of dumbasses that use M$ Word as their default Email Editor and there are a lot of petty rivalries between departments. Its always fun to send this stuff out to everyone and watch the reactions...
I always love looking at others docs to see if they had anything negative to say about shit I'm working with and putting it right back in so this it is in plain text when I email the guys back
blah blah blah
clif
I believe governments are able to purchase source licenses for Microsoft Operating Systems.
That small US government probably can't afford it though!
the military's view is: if it's been proven commercially, it's cheaper to use off the shelf than to build custom stuff.
I dunno bout the rest of the government, but the military is horribly strapped for cash... cutting cost is the biggest priority...
--
Peace,
Lord Omlette
ICQ# 77863057
[o]_O
Yes, what I wanted to say was the following:
At a Mac, you have to enable something to be insecure.
At Windows, you have to disable something to be secure.
Yup, they trust Microsoft enough to power state of the art navy vessels, and I can only assume they've fixed the it-stop-dead-now feature of a few years back, and have fixed the last bug that could cause such problems.
IMHO using Commercial Off The Shelf Software (or for that matter hardware) in a warship is utter stupidity. This stuff was designed for a nice safe office environment. It makes about as much sense as the USN buying a passenger liner and painting USS W H Gates on the side.
A secret agent running around as a senior Microsoft programmer could cause reams of damage, for anyody interested in real power over Windows boxes
The most likely concern is that there are "security by obscurity" issues in Windows.
The sensible solution would be to either write from scratch or use open source (N.B. not an off the shelf linux CD, since you can't buy "Red Hat Warship" or "Suse Submarine") both ways people familiar with the specific requirments can put together a suitable system. Which is likely to include such things as high availability, highly redundant and damage tolerant networking shock and seawater resistant hardware (with intergral UPS), etc. (Also should the whole thing fail manual overrides.)
Of course they probably never did an actual audit nor do I think they audit every service pack or DLL. It would not surpirse me one bit to know that some foreign nationals or subcranted employee put in all kinds of crap into not only the kernel but the thousands of DLLs and activeX controls that make up windows.
War is necrophilia.
Your name and the title remain because they are not part of the document text.
They can be edited from the File menu, Properties option.
I've just tested that, and it seems to be bullshit. At least it is under word2000. I haven't word word97 in ages, but I certainly don't remember it there either.
Maybe they were referring to fast saves (which I always disable)? Fast save only writes document changes. A full save re-writes the entire document to disk. That's been known and documented behavior for years.
Not knowing or forgetting is incompetence.
Just tried with fast save enabled. Still doesn't happen.
There was a thing where people distributed a PDF with sections blacked out. On slow machines the text could (momentarily) still be seen as the black boxes were drawn on a different layer to the text. Even that was incompetence, rather than a real flaw in the app.
Guess it's a case of acronym overlap.
BTW, IMHO, /. needs an FAQ detailing all the BDSA's. (Bloody Damned Stinking Acronyms).
There's always a handful of geek-speak all caps terminology there to amuse and confound.
-Fantastic Lad
1) No coporate entity should have absolute control over the operations, however minimal, of a government. I think most of you would agree that a coporation, whether it is Sun or Microsoft, should not infiltrate a government agency in that manner. As a point, I am aware that the US Military and various agencies use the services of Sun Microsystems. However, my understanding is that Sun is contracted for customized development work, of both OS'es and apps (rather than just running out and buying 50 workstations preinstalled).
2) Its also my understanding that the original BSD distribution, developed at Berkley was contracted by the American government for use in critical systems. If that was the case, then why is a consumer OS like Microsoft Windows seeing such proflific use in government operations. Economic deals with major corporations should not dictate what what OS is holding our sensitive information. Again, American or Canadian, that basic point of fact should make you think.
3) If it was government policy to use a specific *nix, one or many (ie OpenBSD, FreeBSD, Linux, whichever was most appropriate for the particular task), then numerous engineers and scientists could be utilized to strengthen weak areas and improve already effective areas. In effect what would be happening is a re-conribution of code back into the main source trees of each distribution, or flavour. This would be the same as an influx of intellect and dollars into this area of Computing.(I also think most of you would agree that many of the best, and brightest minds in CS and OS development around today are working in government agencies - whether or not you know their names, this is the truth).
Finally, throughout the computing industry, it is being recognized that computing technology no longer exists only in the realms of research and science. This technology has become critical to the functioning of society, in a very practical, day to day sense. I did read an article recently on Ars-Technica about the recognition that fault tolerant computing is now getting. To this end, the government should seriously evaluate the use of a consumer OS. For instance:
Does NASA buy 50 Aibo robot dogs to launch into space? No
Do they hire TRW or Boeing to custom build equipment on a contract basis? yes
So, if these agencies already have a method for contractng the services of companies to design fault-tolerant and secure systems for various military and aerospace operations, why should the database which stores my medical, personal, or credit information be any different? In both cases, the lives of individual citizens is at stake.
I am certainly not trying to simplify the situation or even offer a blanket solution. I am saying one thing though no government should be purchasing and using off the shelf, shrink wrapped software to hold any of our information. Period.
Flame away if u think I am way off base =)
Now I don't program too much, but the source code I have looked at required a lot of examining to find out what the functions do, where these constant variables came from and what they mean, what this class means, and so on. And something tells me it would be difficult for a hacker to understand any one part of the Windows source code, especially since s/he wouldn't have access to all the source code (they don't keep all the source in one nfs, obviously). Then on top of that, the hacker has to add his/her own little hack that knows the name of the class to instantiate, how to contact the internet from within Windows code (which I doubt all that information was contained in the same location in the network) and then leave the source code there, with the new hack glaring at any programmer who looks at it (especially since all info has to be hard-coded in there).
I don't mind not using Windows because I don't trust its security, but this seems like a little bit too much. If you want to credibly bash Windows, don't overexaggerate problems like this.
I really hate signatures, but go to my website.
I believe governments are able to purchase source licenses for Microsoft Operating Systems.
By the time they finished wading through those millions of lines of bloat, the version would be obsolete. With Free operating systems, it is possable to follow the changes as they happen and not have to re-analyse everything from square one.
The Navy doesn't use Windows to run its defense systems nor does the Air Force use it for guidance systems. As far as I know, they don't use off-the-shelf commercial products for critical systems. They do use it for support systems, however. Things that are critical for any kind of large organization or business to operate correctly, such as inventory tracking, messaging, accounting, etc. Of course, crippling a supply chain is just as devastating as taking out a critical weapon during a time of war, but it's like ships are going to run aground and planes fall out of the sky as a result.
Have you got a link for that, preferrably not on microsoft.com?
And I assume all formatting will remain the same. Even with footers, headers, etc.
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
But let's look at it this way. We'll consider a default Window ME install to be very useable, but rather insecure.
How useable do you think the Windows UI is for driving a tank or an aircraft carrier. You need to add quite a bit on for flight sim remember...
Now, add a small filesystem layer that encrypts and decrypts everything to and from the hard drive. Replace the usual login password with something that checks an individual's physical traits(such as DNA or maybe fingerprints). Make sure that it's checked as soon as possible. I'd replace the BIOS with whatever checks for the DNA/fingerprint. We'll also assume this workstation isn't physically connected to any other.
If it's not connected to anything else how are you going in install the biodata on it in the first place, if it's not networked? Anyway unless something of the biometrics is used as the encryption key then anyone with physical access to the hardware can get at the data, which is probably useless sat on the workstation anyway. What do you do when someone else uses that workstation?
Could this be the beginning of the next big scare tactic that the government will use to fund big missiles?
If it's a national security issue then the machines shouldn't be on the internet.
No, no. It's not "being on the internet" that's a problem. It's that some highly untrusted individual had a chance to insert malicious code into the OS.
Like "if you dertermine yourself to be in a position to fire a missile: fire the missile ".
The danger is that this might go undetected for years until we learn "the hard way".
Roger.
c'mon, the Army chose Mac for obscurity, not security.
cat
You failed to mention any sort of human protections; DNA/Fingerprints are very easy to get ahold of. I can convince you to put your finger on it, one way or another.
Especially if the system cannot tell the difference between a living person and one very recently dead. It's not as if this is a difficult "trick", it crops up in many films and TV shows where biometrics are used.
I have faith that those of us who don't trust them now would be sure to point out the contradiction to all who did should such an occurence come to pass.
You're forgetting something - it doesn't have to contain a remote exploit to be dangerous. What if somebody inserted a simple michaelangelo style virus into the code? Every government employee walks into his office on July 4th to find that his hard drives are crashed beyond recovery.
During a brief stint at Los Alamos as a researcher I heard this story: The classified portions of an MS Word document were highlighted and cut out so that the document could be sent to individuals without the proper clearance. Unfortunately, because the "Undo" feature works across sessions (the undo information is stored in the saved document) all the uncleared recipients had to do was Edit->Undo to see the classified portions.
.DOC (and for that matter PDF) files as being identical to what would be output if was printed. Black out parts of a paper document (and photocopy it) and there is nothing "underneath" attempt to do something similar with certain types of electronic formats and there might well be things "underneath". It's a WYSIWYG problem. You may get more than you see...
The problem here is people treating
While it is troubling that the closed source OS (some flavors/pieces, anyway) may have been exposed to an 3l33t3 few and chances are their motives are nefarious, that security snowball has enough momentum to keep it from attaining it's .NET Web ubiquity.
Much more concerning is the simplicity the Linux/UNIX vendors have put into their installations. From CD-ROM to *N*X system in less than 30 minutes for anyone. The one who most disturbs me is RedHat with the ServerInstall option. Every service, none secured. Since these boxes are usually put on public IP's to perform some service(s), they usually have the most potential for causing problems to servers that have been locked down. It would be nice to see a firewall script installed and enacted in any distribution, with instructions on how to unfirewall certain things post-install. This might help cut down on the DDOS agents out there. The hundreds of compromised hosts they're talking about are most likely not Micro$oft systems. The vulnerability was on port 111.
The RPC vulnerabilities have been around forever, along with the WU-FTPD problems, but, they have been around for ages and fixes, or at least host access and firewall techniques have been around just as long. For some reason, the patches just don't get applied, and, the systems get taken over. I just hope with all this newfound popularity, the Open Source OSes don't earn the same bad security wrap Windows has earned. And, I do mean earned. Because we can do something to secure our systems, if we think security is important. It is and we should.
Linux rocks!!! www.dedserius.com
www.dedserius.com
VB != VisualBasic
You should have a look at the Jargon Dictionary. It explains some of the widely used acros, at least those from the IT sector.
A copy can be found at http://www.netmeg.net/jargon.
Fight hunger. Filet a politician and send him to a 3rd world country of your choice.
A similar exploit occurred with PDF files on the NY Times web site, where documents were posted pertaining to the CIA-assisted coup which installed the Shah of Iran. The names of certain operatives were blacked out in the graphics layer to protect their identities, but the text was still present in the document.
There are a number of univerisities and other companies that do have access to the windows source code. Even if someone saw it from inside the firewall, it doesn't mean that they get any new information that isn't known in certain circles already. I don't see the new threat here.
Well slashdot seem to be so worried about security, that they wouldn't even post the link to the CNN story! :)
http://www.cnn.com/2000/TECH/computing/12/29/csis. microsoft.report.idg/index.html
True, MS could start blaming bugs on that hacker. However, they have stated that no source code was changed. If they turn around and start blaming bugs on the hackers, the confidence in their products will plument drastically.
--
Its funny how the government is now looking into possibly not using Microsoft products based on this incident. Last I checked at Attrition they couldn't even lock down their Unix stations either.
Maybe Mickeysoft should just open their source code to the industry everyone knows their op sys can only get better this way and maybe their programmers could stop focusing on all the patches they have to create stemming from posts @ SecurityFocus
Does this mean that since Glock sells to foreigners some of whom may be terrorists they should stop using them for possible leaks of information to customers, or perhaps because they'll be a fair leverage?
Gov sucks.
Windows2000 Spoof
Thanks for the memories
LANL has a lot more security problems than that. I did a stint over there, and the security was deplorable. There were lots of people who had computer accounts that shouldn't have (including me). Password security wasn't enforced, shadowed passwords weren't being used. It was laughable. And the physical security wasn't too much better in most places. Most of the medium security places (ie. not the plutonium facility) didn't bother to check laptops and bags and such going in and out.
But I ramble.
-Todd
---
"The details of my life are quite inconsequential..."
What has kept Microsoft employees from doing the same thing?
The potential to be hanged for treason? The fact that even the amazing MS marketing department couldn't overcome the negative publicity MS spying for an enemy power? Since MS is the employer, they know that they bear responsability for the work related things their employees do, so they police it. They do not bear (legal) responsability for what A third party did without their permission.
As soon as the break-in became known, MS gained plausable deniability. Anything found becomes "Obviously the work of that evil foreign hacker".
I doubt that the fear level before was zero, it's just a lot higher now.
So the CSIS says there is a security risk because someone could gain insight into the code:
"Whoever stole proprietary secrets at the heart of the ubiquitous Windows program can hack into any PC in the world that uses it and is connected to the Internet".
They seem to hold the view that security can only be preserved by keeping the code closed. This statement implies that open source software is inherently insecure. The good thing is that nobody can verify that Microsoft has actually done some work to improve the security of it's products whereas in open source projects it's not that of a problem to admit having security issues much less showing the solution to the problem. Let's hope this fact will convince people to be wary when using closed source products in production use.
floki
from the to-stupid-for-words dept.
Yup, they trust Microsoft enough to power state of the art navy vessels, and I can only assume they've fixed the it-stop-dead-now feature of a few years back, and have fixed the last bug that could cause such problems. Or maybe now the ships just reboot faster. :)
A secret agent running around as a senior Microsoft programmer could cause reams of damage, for anyody interested in real power over Windows boxes-- e.g. any nefarious government, corporation, or super villan.
It should also be easier to subvert existing programmers, now that they can't retire in a year like they planned due to the stock nosedive.
I run a small network at work with a Win2K server and 98/ME/2K clients. You have to log into the domain to get access to sensitive files, and the server vaildates your password. The stupid part is that the client computer stores its own copy of the password! That means that if anyone gets access to a client computer they have the passwords of everyone who has logged in there.
I bet that there is a registry key somewhere that would turn this "feature" off, but my point is that the whole Microsoft mindset is not geared toward security. Leaving gaping holes in security by default, Microsoft has arguably made thier products easier to use, but at what expense? If security were a priority, user-friendliness would evolve rapidly. Securty, however, does not just spring up out of the ground.
If someone sees a problem in open source software they're using, they'll most likely report it to the developer because they themselves are at risk of that problem. This problem will then be fixed by a submitted patch from the finder, or from the developer themselves.
If someone sees a problem in closed source software, they're most likely looking very carefully for it, and are looking for an exploit that they can abuse to harm other's systems.
Security through obscurity is no security at all..
Hiding the mechanisms in a black box just means that when a problem is found, it will most likely be exploited before it will be fixed.
--
Soma: because a gramme is better than a damn.
The government doesn't use Windows, Linux or xBSD for its truly sensitive documents. Instead, the DoD uses Wang's XTS-300, which is tested more extensively than the OpenBSD project and is the highest security rated operating system in existence, as seen here. One thing I thought was cool about this system is that you can't tell with 100% certainty disk space because users could in theory devise a scheme where they could pass messages encoded in changes in availability. For the same reason, if you time a process, some margin is added to the value you would get, which makes message passing take extremely long. The full specs of the Common Critera, an updated "Orangebook" are here.
I believe not too many people are interested in expending that kind of effort to get into a mac, what with there being such a greater percentage of unix/linux and nt out there. Also, note most exploits against Windows do not use the shell, instead injecting code, or employing social engineering and/or scripting exploits. I don't see any reason why these techniques are any less applicable to Mac. Maybe, just maybe, it's the relative obscurity Mac enjoys that motivates hackers to look elsewhere.
BTW Not to push your professor under the bus, but I beleive he is repeating what he read here.
cat
Code that is freely available and constantly auditied or,
Code that is only available to two groups, the company selling it to you, and the bad guys who hacked the company selling it to you.
Grammer Nazi, fuck off!
I think some UNIX-style operating systems have integrated protection from this sort of simplistic DoS attack, as well, aside from disk space/inode quotas.
I used up all my sick days, so I'm calling in dead.
im 32 kid. and you are????
M$ stock dropped in 1/2 since last year. If you are a MCSE, you will be broke.
If it was the .pwl files you thought of, all you have to do to get rid of them, is to add the line
del c:\windows\*.pwl
in the logon script.
__ elacin
And what bug flew up your ass?
M$ stock dropped in 1/2 since last year. If you are a MCSE, you will be broke.
Can somebody please explain how M$'s software's security problems is news for nerds?
:-P
This dosn't belong here on slashdot
- Knut S.
Not from what I have learned in my computer classes at Georgia Tech (from Prof. Mark Guzdial). The reason that Macs are used is that since there is no command line by default, that its much harder to do something interesting (or dangerous) if you DO get in.
Want to see every step I took to start my company? http://www.rowdylabs.com/blogs/pitchtothegods
OpenBSD isn't as secure as you think it is.
M$ stock dropped in 1/2 since last year. If you are a MCSE, you will be broke.
um, ok. Not really. A friend of mine sold it to me for $6,000. Its a 300mhz Sparc 2, with 64mb ram, and a 15inch monitor. Its upgradable to 1gb of ram, and 650mhz. It does the job for building perl scripts, and messing around on the net. No, I don't have a static ip. Im on my supervisor's, LAN with DHCP. 10 megabits.
You must be thinking I am someone else. And my name isn't 'JD'. My name is Dave Uperton. I live in LA, Ca, where I have lived for the past 8 years.
M$ stock dropped in 1/2 since last year. If you are a MCSE, you will be broke.
I think the original poster is a little confused. Word 97 and 2000 both support tracking changes to a document, however it's an optional feature that must be turned on to be useful. Despite this, however, it's known that Word documents can carry all sorts of data that has been deleted, on the clipboard, or from apps running on the same machine. Running a 'strings' command on a word document will often reveal data that was never in the document, was removed from the document at some point and other tidbits of information.
I used up all my sick days, so I'm calling in dead.
If you open this with Acrobat Reader, you just get a black box--
/Catalog
/Page
/ProcSet [ /PDF /Text ] >>
/Pages
/Length 6 0 R >>
/Outlines
/Title (Layer 1)
/Visible true
/Preview true
/Editable true
/Printed true
/Dimmed false
/Color [20224 32768 65535 ]
/Page
/PDF /Text ]
/Font
/Type1
/F1
/Helvetica
/MacRomanEncoding
%PDF-1.2
1 0 obj
<<
/Creator (Adobe Illustrator_TM_ 7.0)
/Producer (Acrobat PDF File Format 1.1 for Macintosh)
>>
endobj
2 0 obj
<<
/Pages 4 0 R
/Type
/Outlines 7 0 R
>>
endobj
3 0 obj
<<
/Type
/Parent 4 0 R
/Resources <<
/Contents 5 0 R
>>
endobj
4 0 obj
<<
/Kids [ 3 0 R ]
/Count 1
/Type
/MediaBox [ 0 0 612 792 ]
>>
endobj
5 0 obj
<<
stream
endstream
endobj
6 0 obj
0
endobj
7 0 obj
<<
/Count 0
/Type
>>
endobj
xref
0 8
0000000000 65535 f
0000000009 00000 n
0000000123 00000 n
0000000193 00000 n
0000000303 00000 n
0000000394 00000 n
0000000448 00000 n
0000000466 00000 n
trailer
<<
/Size 8
/Info 1 0 R
/Root 2 0 R
>>
startxref
516
%%EOF
8 0 obj
<<
/Length 9 0 R
>>
stream
1 0 0 1 0 -21 cm
BX
/Layer <<
>> BDC
/PointText <</Matrix [1 0 0 1 62 507] >> BDC
BT
0 0 0 1 k
0 i
%%Note:
0 Ts
0 TL
100 Tz
/PgfFormat <<
/WordGlue [100 100 200]
/CharGlue [0 0 5]
>> DP
/CharFormat <<
/AutoKerning true
>> DP
/F1 12 Tf
0 Tw
0 Tc
0 Tr
1 0 0 1 62 507 Tm
/Pgf BMC
(Lameness filter encountered. Post aborted.) Tj
EMC
1 0 0 1 62 492.5000 Tm
/Pgf BMC
() Tj
EMC
1 0 0 1 62 478 Tm
/Pgf BMC
(Junk character post.) Tj
EMC
ET
EMC
299 465 m
299 521 l
58 521 l
58 465 l
299 465 l
h f
EMC
EX
endstream
endobj
9 0 obj
623
endobj
3 0 obj
<<
/Type
/Parent 4 0 R
/Contents 8 0 R
/Resources <<
/Font <<
/F1 10 0 R
>>
/ProcSet [
>>
/Rotate 0
/MediaBox [ 0 0 612 792 ]
/CropBox [ 0 0 612 792 ]
/PieceInfo <</Illustrator7.0 <</LastModified (D:20001130154110)>> >>
>>
endobj
10 0 obj
<<
/Type
/Subtype
/Name
/BaseFont
/Encoding
>>
endobj
1 0 obj
<<
/CreationDate (D:20001130154110)
/ModDate (D:20001130154110)
/Creator (Adobe Illustrator® 7.0.1)
/Producer (Acrobat PDF File Format dob for Macintosh)
/Author ()
>>
endobj
xref
0 1
0000000000 65535 f
1 1
0000001819 00000 n
3 1
0000001450 00000 n
8 3
0000000754 00000 n
0000001430 00000 n
0000001707 00000 n
trailer
<<
/Size 11
/Prev 516
/Root 2 0 R
/Info 1 0 R
>>
startxref
2002
%%EOF
--but, if you have a text editor, well...gee.
NOTE TO CIA: Rasterize!
Your mouth is like Columbus Day.
How are you going to get that assembly code to execute on my box, with sufficient privaleges to trap for that kind of behavior?
Or that even if they did, it would work?
Can they test every possible binary resulting from compiling an open source system?
The gov doesn't run that M$ crap. %97 of them Run Solaris, Linux. Mostly Solaris, or SunOS.
a sa .gov
http://uptime.netcraft.com/up/graph/?host=www.n
M$ stock dropped in 1/2 since last year. If you are a MCSE, you will be broke.
You missed my point. That thing about Windows ME was just to disprove the "usability is inversely proportional to security point".
Using that very simple and easy-to-implement security scheme I mentioned, you increased security several times over what it was before - with almost no loss in useability. By what that poster said, the 400-500% gain in security would have meant a serious loss in useability - obviously not so.
Now, since I'm in the mood for a little fight:
Points 4 and 5 have nothing to do with security. They had to do with good computing in general - always have a backup. I will ignore them.
1. You're right, you could do all those things. But it's all of a sudden a HELLUVA lot harder than a regular Windows ME install. And there's no guarantee you'll be able to decrypt the drive before you die. It could take that long. But only a minor speed loss is incurred(with the proper algorithms).
2. The ACLs and such you mention are for multi-user systems. Windows ME is not a multi-user system. Sure, you can have different backgrounds and preferences for different users, but that does not a multi-user system make. Since Windows ME is a single-user system, no ACLs are required.
3. See point 1 above.
4. Ignored.
5. Ignored.
6. Good idea about the "duress" password. Point taken.
7. We're talking about security vs. useability here. I am saying that with a certain value of security, you don't lose that same value in useability. The TEMPEST protection measures, though, shouldn't hamper useability of the operating system - although the size of such a computer might be a hindrance.
8. You can write a 2 line VB program that will grind my computer to a halt; I can write a 4-5 hundred line Intel assembly program which will completely preclude those particular VB instructions from ever being run.
9. It's still very usable. Games, word processing, office apps.
10. You're wrong there. Money buys a lot of things - including respect. Some of my employers pay Microsoft to have a team of engineers on standby, 24 hours a day, with access to Windows source. And Microsoft *HAS* given source to other companies.
Now, I'm not going to lambast you for purposefully taking my argument as something it wasn't. Before you say anything else, consider for a moment the point I was trying to make, and then refute the point itself - not my example.
Dave
Barclay family motto:
Aut agere aut mori.
(Either action or death.)
Barclay family motto:
Aut agere aut mori.
(Either action or death.)
...it's the only way to be sure!
Isn't rather funny how the government trusts ANY operating system that even the manufacturer cannot make secure, lets face it, if ANYONE should be able to make windows secure Microsoft should be the one, however in light of this recent incident I don't believe that it is even possible for windows to be anything even resembling secure. The first problem is the fact that it's closed source, the second problem is that it's sloppy, these two things make it impossible to improve (at least for anyone who doesn't work for MS) and impossible to find out exactly what is and what isn't secure, this should be reason enough to NEVER use this OS in any application where security is the key... but well, it's the government.
Actually, I thought the title was correct, but I'm not sure if it refers to the hacking of the website or the hacks who write Microsoft software. :)
--
Some keywords for the NSA in the Lord of the Rings universe: One Ring bind find Sauron quest Nazgul freedom
Let them be scared. Let the fear snowball.
Call on God, but row AWAY from the rocks!
How do you remove this history? And for other possible history for confidential documents. Thanks. :)
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
Time and time again, security through obscurity has failed. One article which goes into this in detail is: on Slashdot . (Or use your favorite search engine for the phrase "security through obscurity" )
If someone were to make an assembly-language hack against any open-source system, they would already have all the tools to hack any system.
No operating system can prevent physical hacking of the system. If you have enough access to a system to insert a boot disk, then you have enough access to the system to physically remove the hard drives and examine them elsewhere at your leisure.
Never play leapfrog with a unicorn. Or a juggernaut.
Or is it that Microsoft so little knowledge of security that their own system is compromised?
Open source with many eyes can enhance security...Closed source that hackers have the source to is a security breach.
Fight Spammers!
I gave it a very boring test on Word97... Using simple text, there are no problems.
I created a doc with the body of "This is confidential information" then the alphabet in lower case, then the same thing, except that it was not confidential information and the alphabet in upper case. I saved it, ran strings on it, and I saw all of my text (and the full name as registered in the product!)
I then selected the text with the mouse, hit delete, and checked strings.
All the information was gone... except that Word appeared to have taken the words "This is confidential information" as a title, and kept it in the document. The lower case alphabet was gone though. Of course my name was still there.
When I closed Word and reopened the second document using the run history, the undo buffer was empty.
Does the USA also trust the non-USA MS employees and network?
This is terribly frightening. It is against all computer security regulations to remove a MS document (in fact, any non-ASCII text file) from a system of higher classification to a system of lower classification. There's just too much possibility for a breach of security.
For instance, if a SECRET powerpoint file exists on a network rated for TOP SECRET processing, it cannot be moved down to a network that is only authorized to process SECRET - even if the data matches classification. Why? It's not just to be a pain in the ass of those who need to get information to different people - what if there is a graphic/textbox behind a "rectangle" shape that matches the background (white, in most cases - not hard)? You've passed that text/graphic without even knowing it.
I've seen this happen, and it's a nightmare.
BTW - even if you copy an ASCII file 'down', you need to do it with a special program to ensure that no extra bits are copied off the system...
The most effective, most used, and most trusted security measures are locks, guards, vigilance, and effort. I don't care if you run triple-encrpyted, Extra-Tasty Secure BSD/Linux/WinNT..etc, if they have got to the computer, you are, for the most part, screwed.
That's why computers with secret/confidential/top secret data are physically locked up, and physically isolated from the internet. Places like the NSA run on a system where if an unauthorized person is in the room, flashing lights go off so you don't talk about secret things. You get layed out on the ground and searched if you have a badge that says "I need an escort" and you don't have an escort. These sorts of measures are what keeps us safe on a national security standpoint.
Insiders (i.e spies) in the Gov't are always going to be able to get to the data, no how many retinal/finger/rectal scans you require. Computers are not really a big issue. Sure, stuff like data left over on hard drives after you've "emptied the trash" used to be a problem. But that sort of thing has been covered now. People, as always, are STILL the only big security hole.
I am speaking from personal experience here. I work for a federal contractor that deals in information that requires a clearance.
I think that computer security issues apply much more to the real world then the military. But the rest of the government, well, that worries me too. And its still the people that worry me rather then the computers. A smart person with windows 95 is more secure then a stupid one with the most secure OS.
Want to see every step I took to start my company? http://www.rowdylabs.com/blogs/pitchtothegods
Us slashdotters have better watch out, I'm told its pretty easy to get the source to linux. :)
Generally, people writing code for a warship would want a safety-critical system. I think most safety critical systems are blue-screen free... While governments may use ms os's for their office type stuff, and they may be (just may be...) hackable, there's no danger at all of a nuclear plant blowing up, or some secret SDI platform in the stratosphere nuking Texas. Bit of a shame really...
If you can't see this, click here to enable sigs.
And now you will see "Apparently slashdot is quoting trolls."
THEY WILL QUOTE YOU, TROLL.
OpenBSD isn't as secure as you think it is.
Yes it is. It says so on their web site
Hey! Don't dis rot13! It worked for hundreds of years.. true that was about two millenia ago but...
Vintage computer games and RPG books available. Email me if you're interested.
AHA! good point. I would agree with you. I guess this raises the question of whether or not all of this talk about the dangers of hacking is really nothing more than government FUD/propaganda to allow laws that violate the constitution to be passed only so that the government can police the 'net. I think anyone with half a brain can see this point. It does not stand to reason that the military does not have access to the source of the operating systems that control mission critical applications. If that were truly the case, then one could argue that the US military has no idea how to run an effective military. Which would be scary as shit.
-- This sig is.
No system connected to the outside is 100% secure, be it unix, windows, MACOS, whatever. If it's a national security issue then the machines shouldn't be on the internet.
Regarless, the biggest security threat is the lack of dilligence displayed by users and admins. Far too many people use their name as the password or use no password.
Jesus used to be my co-pilot, but we crashed in the mountains and I had to eat him.
:)
M$ stock dropped in 1/2 since last year. If you are a MCSE, you will be broke.
I'm not sure how deeply you are involved in the technical aspects of your co-generation facility, but I must say that the statement that your entire emissions control runs on NT is probably not completely true. I don't dispute that your operating and engineering control workstations and perhaps other components of your DCS might be NT powered. However, the very important parts at the "front line" of the control system have no Microsoft code at all.
PC-based controllers most often use a customised, hard-real-time replacement NT Kernel. In the case of the controllers used in the Ovation system, architecturally they are pretty much the same as a PC (Probably a Pentium-100 to 133 with 8-32MB RAM. I Thing GE Fanuc or Modicon or someone has something like that too), but they run a custom RTOS, NOT Windows NT and NOT Solaris. Your systems also probably make use of Allen-Bradley PLCs, which while can take instruction from an NT-based control PC, do not depend on a controlling PC to operate.
It's been a few years since I've been in the control room of a generation facility and I'm sure NT has improved to the point that it can play a bigger role, but I bet that even today, the intricacies of start-up and shut-down sequences are NOT handled by NT-based PCs. I am aware that every important system in a generating plant has two or more layers of redundancy. I am unaware, however, of a completely NT/Commodity PC-based control system that offers true "bumpless" failover to a hot-standby. If there is such a beast, I'd be very interested in seeing it.
As to the comment that if your emissions control system goes down the plant goes down. I'm sure it would. But say some catastrophe were to take out all your NT worksatations (that can happen--remote as it might be). Without those important NT machines, how would the plant go about a safe, controlled shutdown? Probably with the assistance of a lot of embedded controllers, PLCs and so on. I'm not saying Windows NT is not to be found in important functions of a power plant. I'm saying that neither it NOR ANY OTHER non-real-time, commodity-PC-based operating system (yes that includes Linux--except perhaps the hard-real-time Linux some day) ever has a direct connection to systems that are "life-or-death" important. You might "run" the plant using NT workstations, but you probably "CONTROL" it with more specialised hardware and software.
Hmm.. it would be so nice to see .govs running OpenBSD. Sure, they also need well trained staff, but OpenBSD makes the use of crypto much easier. (and no, this isn't an anti-Linux post, I also use Linux every day and it's a great system, but it also lacks "secure non-US distributions" where you could have all the Good Stuff already included)
Vintage computer games and RPG books available. Email me if you're interested.
--
You don't need a weatherman to know which way the wind blows.
I find it interesting that they openly accept any software just because it is made by a large "trust worthy" company.
But since that software may have been compromised by somebody from the outside they are afraid.
What has kept Microsoft employees from doing the same thing? Or, as some would want us to believe, keep Microsoft from doing anything.
Any time a company (or a government) uses closed source software, there has to be a level of trust.
-I just work here... how am I supposed to know?
Well simple, even tough Linux "could" be more difficult to hack than Windows (I'm no guru, so I'll just suppose it is), it's still as unsafe as Windows, because while WinNT code "could" have been stolen, Linux source code is available freely all over the Net, so if someone analyses it well, they could find a hole and exploit it, just as what they would do with the Windows source code.
It's most likely some gov't hack who needs to say *something* to insure his cushy job is safe. Nothing more. Remember when the US Navy had to reboot damn near an entire *WARSHIP* because it
had the bad taste to depend on M$?
The Microsoft angle is only one part of the report, which also discusses open-source, mobile computing, distributed computing, and nanotechnology. The specific areas of concern are predictably:
1. threat of disruption of communication
2. threat of exploitation of information
3. threat of manipulation of information
4. threat of destruction of information or infrastructure
It should read "Microsoft a National Security Threat".
-Rob
Gang, in the 80s it used to be that software had to go through a IVV cycle (independent verification and validation), before you could use it for anything critical. Admittedly, this slowed stuff down, but it had its merits. Even if M$ has the best of intentions and tries the best it can, I don't think I really, really want to bet my ass on their efforts. Do you?
There's a simple solution that Linux advocates use to give themselves perfect security: They just chant "security through obscurity is bad" over and over, and then they are magically secure!
--
Sometimes it's best to just let stupid people be stupid.
But PDF's can be disassembled. If the text is there, then is could be peeled off. More to the poing, the black layer could be peeled off. I think that all that you would need is PageMaker and a Win32 (any version) system.
I must admit that I haven't tried this, but PDF's were never intended as a method for secrecy.
Caution: Now approaching the (technological) singularity.
I think we've pushed this "anyone can grow up to be president" thing too far.
I haven't heard this story related to any classified material, but it's certainly quite feasible. Or, the commercial sector stories may just have been adapted.
An interesting theory that because attackers now may have microsoft's source its now a threat to our nation?, I was just wondering how that works when FreeBSD, OpenBSD and even Linux are all open source operating systems and does that pose a national security threat? No.. No it doesn't and almost all the major internet sites are powered by some form of an open source flavour of Unix.
Does XML count as text? What about hex dumps? There are lots of ASCII files that shouldn't be moved. Then there's the problem of steganography...
The "ASCII text" restriction isn't exactly an ideal protection.
Caution: Now approaching the (technological) singularity.
I think we've pushed this "anyone can grow up to be president" thing too far.
What are you talking about? Any OS, when it source code is first exposed to the eyes of the masses, will become less secure for a short time (as security holes are found), and then more secure in the long run (as the holes are fixed). So for Microsoft, opening the source would be first a threat, then a bonus later on. Since Linux's source has always been open, there is no threat stage to go through; it's all bonus by now. Jeremy
I don't care if it's 90,000 hectares. That lake was not my doing.
Who the hell are you talking to?
M$ stock dropped in 1/2 since last year. If you are a MCSE, you will be broke.
Guess this means that script kiddies can nuke countries instead of just other computers now...
:)
(I know, it's not quite that bad)
But in all seriousness, this could be pretty bad. Who knows what kind of information is "protected" on windows machines. Who knows who might get their hands on plans for various weapons, etc, or just cause havoc with various databases throughout governments worldwide.
Maybe they should get some of those copy protected hard drives
Dark Nexus
Dark Nexus
"Sanity is calming, but madness is more interesting."
If you want a secure system.... Get digital Unix. It runs a 64 bit OS, which is actually unusable on 32bit Unix systems, or the 16bit windows systems. I believe there are some rumors going around about bringing Unix out to 64bit totaly. I for one would LOVE to see Solaris running like that. When I was in the army we used Solaris for everything. Security was a top issue. You can secure Solaris just as well as any other OS. It is just more complicated, and most people don't bother with it. When I got out 3 years ago I decided to buy a sparc and run it here.
M$ stock dropped in 1/2 since last year. If you are a MCSE, you will be broke.
So the U.S. government trusts every single Microsoft employee with the authority to make changes to the source code?
Whether or not an intruder gained access to the source, the U.S. government would be fools to trust something for sensitive operations without performing a full security audit on the source themselves.
Since the US govt is now considering this unauthorised access to Windows' source code to be a 'security threat', doesn't that help to confirm suspicions that there is secret backdoors in Windows put there for the purpose of clandestine surveillance of Windows users? And now the cat is out of the bag.
well subject says it all ...
possible end to "NO SOURCE" Microsoft? Let's hope.. I for one would not mind.... But think of the scariness of Seeing Microsoft source would be? not only is it large and complex but there would be 100 bugs per page. You would have to get 100 men just to rework it and it would take them about a month at the least. :)
The difference is that Microsoft code is only open to people who will abuse it, and linux code is open to people who for the most part will analize it and make it better and more secure. I think the best thing would be for Microsoft to open the source completly (under a strict license so they can still make money) and benifit from open critisim on the net. I know that this will never happen, but its an idea
Are we forgetting that Perl and Shell scripts are also "small text file"-based.
:o)
... is the fact that a user on Windows is running as the equivalent of root.
ALMOST..
Perl and Shell scripts that are "small text files" can't be arbitrarily executed.. you have to chmod +x them first.
This is a subtle, but very important distinction. It provides a mechanism that stops arbitrary code from being executed. (The user needs to save it, then chmod +x it, then execute it)..
Granted it's not inconceivable that someone could write a MUA that would perform these steps automatically, but (in general) Unix programmers have more brains than this... which leads us to another issue: MS programmers (in general) wouldn't know a security hole if it came up and bit them on the ass (which, if you read NTBugtraq, happens pretty frequently
The problem
Nope. The problem is that the system will run arbitrary programs based on the file name. The issue of "everybody is root" is an issue, but a minor one, as Windows is not a multi-user OS.
http://www.cnn.com/2000/TECH/computing/12/29/csis. microsoft.report.idg/index.html
If this doesn't work, the problem with the original link was a space after csis. and before microsoft
Caution: Now approaching the (technological) singularity.
I think we've pushed this "anyone can grow up to be president" thing too far.
Of course, the good old Mac OS has no root level access, so as off-the-shelf systems go is pretty damn secure. It also happens to be the easiest to use off-the-shelf OS going. ... Of course, Apple is shucking both ease of use and security with OSX. But then again, OSX is what you all said you wanted, wasn't it?
Need anything more even be said?
You mean using Microsoft software didn't pose a gigantic security threat before they were hacked?
From a systems design standpoint, this is not fully true. Yes, there exists a balance between real usability and real security. However, a well-designed system can shift this tradeoff into the "it's not usable"-"system takes care of it" plane. A properly implemented system, with excellent design decisions, can greatly gain security while not compromising usability. As design of machines that directly interact with people improves, more and more features that were previously considered necessary hindrances or even okay-designed features will be replaced by user-transparent, "intelligent" features. For example, some recognition system based on some combinaton of biological analyses will sooner or later replace the current scheme of entering a user name and a password to gain access or sticking a key in the lock to unlock it.
[an error occurred while processing this directive]
How are you going to get that assembly code to execute on my box, with sufficient privaleges to trap for that kind of behavior? My server is set up in such a way that gaining the level of access required to run your code is (hopefully) very difficult.
Whereas with closed source, you really don't have a full understanding of how to attack it.
Don't be so sure. Someone goes looking, and finds a security hole in a closed-source OS. Nobody else has seen it, because nobody else was looking. They write a program to exploit that bug, and distribute it. You now have a security problem.
The open-source difference is, lots of people are looking at the code, and bugs are more likely to be found. Since the people finding these bugs also depend on the software themselves, they're quite likely to report the bug to someone who can write a patch, or patch it themselves and submit their patch to be reviewed and distributed.
--
$x='S24;r)>63/* h@<5+oZ)32"5cz';$me='phroggy'x$];
$x=~y+ -xz+\0-Tx+;print$_^chop$me for split'',$x;
I'm a CRO at a mid-size co-generation facilty and our entire emissions control system is run on NT 4.0. If our emissions control goes down, we shut down. An increasing number of newer facilities are using Westinghouse Ovation as their DCS (distributed control system). Ask Westinghouse, about half are on solaris and the other half NT 4.0. Sure, there is usually at least one if not two layers of redundancy, but if you lose your dcs, you will shutdown.
Security and ease-of-use are mutually exclusive, and are usually inversely proportional.
I disagree. In many cases, yes, security can limit useability. For instance, the most secure system is one that has been broken down to its individual molecules and scattered out into space on a hundred million different probes. Of course, at that point, it's not very useful.
But let's look at it this way. We'll consider a default Window ME install to be very useable, but rather insecure. Now, add a small filesystem layer that encrypts and decrypts everything to and from the hard drive. Replace the usual login password with something that checks an individual's physical traits(such as DNA or maybe fingerprints). Make sure that it's checked as soon as possible. I'd replace the BIOS with whatever checks for the DNA/fingerprint. We'll also assume this workstation isn't physically connected to any other.
All of a sudden, you have an incredibly secure system, with the same useability(maybe a little slowdown for encryption/decryption, but there are fast, secure algorithms availble). So no I've already refuted the "inversely proportional" part.
Now, I've yet to see a security implementation that doesn't hamper useability in some form, but to say that it's impossible is downright moronic. Just because you can't think of a way to do it doesn't mean it's not possible.
Dave
Barclay family motto:
Aut agere aut mori.
(Either action or death.)
Barclay family motto:
Aut agere aut mori.
(Either action or death.)
Vintage computer games and RPG books available. Email me if you're interested.
The lab could educate the secretaries and researchers about the "gotchas" of every commercial product they use (and they do try), but people are bound to forget or make mistakes. If they deployed open source software they could inspect and modify the code to make these holes unavailable.
Andamooka: Open support for open content.
It's not Microsoft Hack a National Security Threat. It's Microsoft Windows a National Security Threat. How many security holes can people exploit in Windows? And the gov't uses Windows in its networks? Sounds to me like we've got a genuine National Security Threat (TM) . . .
You can never be sure of anything unless you check it yourself. Mere "trust" is seldom an option when it comes to mission-critical applications. And while trust if acceptable in commercial systems (if it breaks, let's sue them) it just isn't an option when break-of-trust involves lives or national security.
That's why I understand that banks use Microsoft products, but i get very scared when aerospace or medical systems even go near Windows...
-----
free the mallocs!
Did Nostradamus really say that? I thought he predicted the world would end last summer, so I can't see why he'd make any further predictions. But if he did say it, that is really damn funny.
--
Obfuscated e-mail addresses won't stop sadistic 12-year-old ACs.
Win dain a lotica, en vai tu ri silota