Slashdot Mirror
Microsoft Admits To Backdoor In IIS [updated]
Ninkasi writes: "Here is a rather alarming article from Yahoo which claims that Microsoft has a backdoor password into IIS web servers running FrontPage 98 server extensions. Here's another brilliant example of how closed source development models are a threat to security and privacy on the Internet." The article says that Microsoft "plans to alert customers as soon as possible with an e-mail bulletin and advisory published on its corporate Web site." This is really just too perfect. Update: 05/14 07:48 PM by T : Actually, it is too perfect -- guess this particular possibility for built-in backdoors is old news. Sorry.
I would recommend the installation of Apache server in lieu of IIS.
Apache, on the Internet's World-Wide-Web network at hypertext transfer protocol site www.apache.org, is the world's most popular Internet server for World-Wide Web services. Internet Information Services, on the other hand, is not. I have published additional guides on the subject, which can be purchased for $19.95 each.
linuxcodersareweenies
We have all known about the back door for a while, but the date encoded in the URL is 2001 05 14. I can only presume that it's taken this long for Microsoft to admit to the backdoor. Admission is good. MS did the right thing, a year or so late!
If you are an IT professional using Frontpage you should be fired. Everyone worth a bit knows that Frontpage is a toy that sucks. And you also don't install the InterDev extensions on production either. But this is shit about as interesting as Oracle's INTERNAL/SYSTEM login and password. I mean you have to be a professional.
because they're experienced at going down several times a night.
Code reviews on a team basis are one thing, as are the inevitable bugs that slip through the cracks in this environment.
Backdoors which have been specifically placed there *by design*, as an implementation of corporate policy regarding control and access to 'fielded products', is another thing entirely.
Your company - Microsoft - has a particularly bad habit when it comes to shifty, underhanded policies such as this backdoor situation, and therefore it's not unreasonable to expect that the community at large raise alarm torches when holes such as this are discovered.
I don't disagree with you that security by peer review has its flaws.
But then, so does Microsofts' aggressive predatory business practices.
; -- the corruption of government starts with its secrets. a truly free people keep no secrets. --
That's amazing! I've got the same combination on my luggage.
Rev. Dr. Xenophon Fenderson, the Carbon(d)ated, KSC, DEATH, SubGenius, mhm21x16
I'm proud of my Northern Tibetian Heritage
So they gave us the DLL with the offending code. I've not looked to see how big the DLL is but wouldn't it be pretty straightforward to locate the backdoor password now?
The fact of the matter is that, short of releasing source code, there is no way that your customers can be sure that there aren't any backdoors. For example, it would be much easier for your Dev team to insert a method called PayEntireDevTeam() than for one member to insert the mythical PayTim() method. For Tim to get away with the insertion of his method he would have to be more clever than all of the reviewers. But if all of the auditors were in on the backdoor then there is no defense.
I would like to think that Microsoft would be trustworthy on this account. But this is the same company that released a spreadsheet that doubled as a flight simulator. Quite frankly, I doubt that a whole lot of auditing actually occurs. And if you can convince a group of Microsoft employees that a flight simulator is an important feature of a spreadsheet, then inserting a backdoor should be child's play.
Neither Linux nor Apache has ever had a security problem that was intentional. This particular problem wasn't a bug, it was a backdoor. Some clever coder at Microsoft even used a joke password.
At least with Linux or Apache there is some chance that someone else is going to catch something this idiotic. With Microsoft the problem apparently can remain unreported to the general public for years. Clearly there is a difference between some random buffer exploit and a backdoor that was specifically placed there by an employee and that was somehow "missed" in the code review.
I disagree. Open Source Peer Review relies on a voluntary effort. Throw the source up on FTP site, and hope someone reads it.
Commercial software on the other hand frequently has frequent code reviews done internally. Other staff looking at code to fix it, or sometimes group code review sessions.
"Get your head out of the sand, please."
Wow, I think maybe your tin foil hat needs some adjustment today.
Oh blather. You attribute to malice what is obviously explainable through incompetence. It would be pathetically illogical to believe there was a Microsoft conspiracy to introduce back doors to all their software.
The problem with conspiracies is they fall apart the larger the group is who knows about it. Why just this week before Congress they are talking about Ted Olson's involvement in the vast right-wing conspiracy to discredit President Clinton.
Everybody pretty much even knew that existed, but couldn't pin down who was involved. Well now the evidence is leaking out because of one disgruntled former magazine editor.
And that was a conspiracy involving only a couple of dozen people.
Microsoft has thousands of developers, on the other hand...
You should do a search on google.com for Aluminum Foil Deflector Beanie.
I think you need a replacement.
That only works if the compiler can detect the routines which generate output. Given a new compiler or a significantly revised version of the compiler, this will not work. So, if I have two compilers, compiler A and B, I can use one to compile the other, and then compile the first one again, and I'll have a clean compiler.
Engineering and the Ultimate
Whoever you bought your product from. If I buy it from RH, they are responsible.
With free software you get whatever you want. You want access to the source? You got it. You want to pay someone else to be held accountable? You got it. Anything is possible.
Engineering and the Ultimate
Recompile? But wait, can you trust the compiler? Ken Thompson says you can't.
- Tal Cohen
Okay, as much as I hate MS products and their lack of options, the revelation of this back door is NOT perfect.
It means that there's a bunch of poor bastards out there who're going to get their systems trashed because they believed in Microsoft.
Yes. This may be a wicked little ego boost to the mindless OSS boosters. But to everyone else, it's a pain in the ass and potentially VERY damaging to some people's sites/businesses.
So gloating to the point of calling this "perfect" is WAY off-base. And, frankly, I'd expected a little more from you guys.
Chas - The one, the only.
THANK GOD!!!
Chas - The one, the only.
THANK GOD!!!
> This is an old story, sorry to rehash...
It's an old story AND THE LINK IN THE POST TWO LEVELS UP POINTS TO IT!
--
rant
Get your head out of the sand, please.
I believe, as the poster you replied to, that this isn't corporate policy. Not because MS says so (MS has close to zero credibility in my eyes), but because the backdoor was so stupidly executed. MS has a lot of good engineers - if this had been an official policy, it would have been nicely executed, and if uncovered would look just another random security hole. It would probably even be harder (but more reliable) to exploit than the non-intentional ones!
Eivind.
Doubting the existence of evolution is like doubting the existence of China: It just shows that you're uninformed.
Are you crazy? That was a great joke. Bravo.
+1 Funny.
Wow, the goatse.cx link would be on topic for once....
Well, unemployed weenies I guess...
Well, unemployed weenies I guess...
Actually I use FreeBSD which is from a different (in fact that papa) fork than OpenBSD.
All things aside, all questions of Linus, Bill, Mac, etc. aside, the Microsoft backdoor does illustrate a major advantage of Open Source:
Security.
While I can see the theoretical, practically this is not true. In practical terms almost no one actually analyzes the source with any intensity apart from the people who are the primary programmers (hence the ones who would likely be planting the backdoors). I do CVSups on my FreeBSD fairly frequently and I'm basically entrusting that machine absolutely and entirely to the FreeBSD CVS controllers (which of course means if they were compromised I'd be ownzed). I'd wager >99.5% of open source users are exactly the same way: You presume that because the source is available there are tonnes of selfless individuals busily auditing it, but the reality is quite different.
The simple reality is that most current software projects are HUGE and there simply isn't enough time in a lifetime for each of us to analyze all of the code we run with anything more than a cursory glance. And if anyone thinks they'll scan through and see
// Embed backdoor
if (strcmp(password,"REDHAT")==0) {
      iPriority=1000;
}
then they have a enormously naive impression of how a backdoor would be embedded in code subtly. For all you know a number of the software products you are running might be waiting for a magic byte string to come along when it bows to its real master.
why does my netscape browser hang each time i try
to read the tuvit website?
Question: How long do you think that Microsoft REALLY knew about this back door?
Question:How many systems have they accessed or could they have had acess to because of this?
While I agree that noone may have looked at all the source, I think it is a little more difficult for things like this to happen with open source.
As far as kernel patches go I think Linus does look at the patches as well they are usually reviewed by other developers and it is not a matter of here take my word. Besides you don't usually put usernames and passwords in the kernel you put them in other software.
Apache probably watches out for back doors pretty closely I'd imagine or at least hope.
I don't want a lot, I just want it all!
Flame away, I have a hose!
Only 'flamers' flame!
On the contrary, that's the first time that link's been on-topic in quite a while.
Caution: contents may be quarrelsome and meticulous!
Your right to not believe: Americans United for Separation of Church and
Microsoft has thousands of developers, on the other hand... ...and how many over see the finial compile time?
hmm
my guess would be less than a couple dozen...
Paying taxes to buy civilization is like paying a hooker to buy love.
Ohh yea, good call on this one.
Paying taxes to buy civilization is like paying a hooker to buy love.
Last week it was the IIS overflow bug, now its a low level password left behind. I love showing this stuff to potential clients, it always swings them from competitors to our lovely web farm...
This is what passes for secure these days?
As opposed to the 46 security fixes for RedHat 7 in the 32 weeks since last October 4, the 6 security fixes for RedHat 7.1 in the 4 weeks since April 16, or the 47 security fixes for Debian 2.2 in the 18 weeks since January 10? I'll let you do the math and see how those averages compare to the one you got for your Windows 2000 installation.
And why would installing those fixes take you all day? I know the other guy who responded to you didn't know what he was talking about, but you don't have to reboot after each service pack or hotfix. Install them all from a script and reboot once after the whole thing is done. Because I'm such a nice guy and always helpful to newbies, I'll even get you started on a suggested batch file for you:
Note: I've expanded all my hotfixes and the service pack with the -x switch, which is why they're all in separate directories and run via the hotfix.exe command instead of the original name of the .exe file you downloaded. If you don't want to expand them like me, the switches above work just the same whether you're using the original, unexpanded .exe or hotfix.exe.
For the service pack (update.exe): -n = don't backup files for uninstall purposes, -z = don't reboot, -q = quiet mode, -u = unattended mode, -o = overwrite OEM files without asking.
For the hotfixes: -n = don't backup files in an uninstall directory, -z = don't reboot, -q = quiet mode, -m = unattended mode. For the last hotfix in your script, replace the -z with a -f, which forces all applications to quit before the automatic reboot.
Go take a leak, grab a coke, or whatever, come back in about 5 or 10 minutes, and your computer will be waiting for you to log in.
Cheers,
Um, no. You have a faulty memory. Allow me to show you how wrong you are. This news.com article from yesterday explains how this is a case of Yahoo! reposting news from a year ago. This news.com article from April 2000 contains the initial Microsoft reaction, and I quote, "Microsoft said its engineers included a secret back door including the phrase 'Netscape engineers are weenies!' in Web site authoring software that could allow hackers to gain unauthorized access to potentially thousands of Web sites." Once they actually looked at it instead of reacting to media questions, they realized there was a hole there but not some secret backdoor.
Know why you couldn't find that Yahoo! article anymore? Because they removed it after realizing they screwed up.
Cheers,
Hey, no sweat — seems like they're all substandard these days! ;)
Cheers,
I'm not sure why they insisted on removing that kind of comment. It's lots of work, and though the comment isn't ideally informative, it's sure better than no comment at all.
Perhaps many of their coders were under 18, and wouldnt' be allowed to look at the code?
Caution: Now approaching the (technological) singularity.
I think we've pushed this "anyone can grow up to be president" thing too far.
I know for a fact that there is another backdoor in at least windows 95. some time ago i got on the MS irc servers with a normal irc client and was doing stats and such on the server and found a channel an opper was hiding in. i obviously brought attention to myself. i was doing nothing but ircing on my connection. seconds after joining the oppers channel i noticed my modems send light going at full ball when i was doing nothing but idling in this channel on irc. my belief is that the opper sent some command to download my registry but i am not sure exactly what was being sent. after about 10 seconds it had not stopped and i switched off my modem. that was a few years ago but i know i was not dreaming it. it was also very near to the time when connecting to msn caused your registry to be sent, which is why i assumed it was my registry being sent to the MS irc opper. as an aside i have also posted info previously about win2k sending out multicast data to a MS owned ip during win2k installs, incase your interested :)
meridian at tha.net
[annoying organ music]
Kids, don't forget to send in those Ovalteem labels for your free Windows XP Product Activation DECODER RINGS!
Tune in next week for our latest episode - Ballmer's Big Blunder!
[more annoying organ music, followed by station identification]
== Paul Rickard, Editor of The Microsoft Boycott Campaign ====
Really. I've never seen that picture, just the one after Bill has left.
--
--
"Outlook not so good." That magic 8-ball knows everything! I'll ask about Exchange Server next.
MS selling you the OS, the compiler, the web server, the mail server, the database, the office applications...it's a very dangerous situation if your company takes its privacy seriously. Combine that with Microsoft Passport and Hailstorm and you'd have to be either psychotic or stupid (possibly both) to use .NET.
-jon
Remember Amalek.
The problem with using Passport and Hailstorm on top of using IIS, NT/2000, SQL Server, Exchange, Word/Excell, MSC++, etc. is that you don't know what back doors there are in these apps. They are all getting more and more integrated together. Do you packet-sniff your lines? Are you sure what data is being sent where? Do you know what extra code is being placed in your code by MS' C++ compiler?
I'm not saying there are back doors, or even that MS _as a company_ wants to do that. But there are 30,000+ Microsoft employees. All it takes is a couple of programmers in a couple of different departments, working together to put in a set of related trojans. With millions of lines of code, they'll probably slip through code reviews. Heck, with some misleading comments in the code, they'd pass through a code review pretty easily.
How much effort would it be for someone to add code to Excel to automatically email any document which has the words "Payroll Report" in it? Cross-reference the names with people who have Microsoft Passport accounts. Maybe we can find some direct deposit records and have those automagically sent off. I could probably get a fairly complete picture of all information about you, to use as I see fit.
Paranoid? Maybe. But it only takes a couple of rogue programmers.
-jon
Remember Amalek.
>Has anyone look at everyline of code in KDE or the linux kernal itself...
Linus and AC have.. but then some Q&A person reviewed every line of Windows code so that dosn't really help.
There are two advantages with open source.. even more so with open source Unix like systems..
You can fix the software.. or you can toss the software.
You are quite familure with the "fix" option.. So let me run over the "toss" option.
With free software (it dosn't need to be open) you invested no money so in tossing the software you aren't throwing money away.
Let's say Linus starts blamming application programmers and end users for defects in Linux. (Ahem.. Microsoft.. Ohh not that Microsoft was the first or only.. Just the best example today..)
Ok so now what? Well you dump Linux... How? I mean I invested umm well.. nothing...
Ok yeah but all my Unix code...
UNIX code.. Switch to BSD.. make some tweeks if nessisary..
At the apps level same deal. If the develuper starts acting goofy and untrustworthy then dump the bad app and switch to something else.
File format issues...
When writing code you almost always come up with something to save that the current standards don't recognise. The solution is simple.. enhance the existing standard or write your own format.
It is usually easyer and better to just write your own format.
Rarely (if ever) is this format documented. Open or closed. The user dosn't need it.
If the user needs to switch from one app to annother he needs to convert his files from one format to annother... No can do mister..
With open source you CAN read the source and discover the format. From there it's pritty brain dead easy.
So basicly open source software has an easyer escape path.
Solarus is pritty blasted secure. But if that ever changes you may have problems.
(Being Unix escaping Solarus is easyer than escaping Windows)
Basicly Unix/Posix and open source provide escape paths that tend to be cut off by closed source propritary systems.
I don't actually exist.
On the older topic the issue of Q&A procedures came up.
A lot of people see open source as being so great becouse you can fix the bugs when the software breaks.
The objective of Q&A is to fix the bugs so when you get the product it is already working.
If the code is writen correctly Q&A can do it's job..
A point was made (in a very crude way) that poorly writen open source isn't going to be easyer to fix under "many eyes". Weak fradual code is going to break no matter what system you use to fix it. Making ANY changes breaks the code.
I should now mention one of the OTHER advantages of open source...
In reality there is only one thing you CAN do with poorly writen code... toss it...
But when you invest $100 to $1,000 into software you are stuck with it.
Having spent no money on the software you downloaded and installed you can throw it away.
I'm sure a lot of open source develupers would prefer you didn't consider this option but it is valuable to know that you are not stuck with it before you get a chance to try it out.
(This is the whole guiding idea behind shareware.. Try before you buy. Freeware has this same advantage. Actually you have this advantage with video games in some cases if the store carrys a console with the games running)
So in short bad products that are byond repair can be disposed of in open source.
Now it would be munch nicer if coders would just not make crap code to start with. Open source dosn't prevent it any more than closed. It's just easyer to dispose of.
I don't actually exist.
You are right, the NSA would be much more discreet. One thing one must remember, the smaller the circle, the less chanced for compromise.
I would be surprised if the NSA didn't use MS products as a mole. As far as letting MS know, I doubt it.
If MS uses the exploits for industrial espionage, I don't know. But I am sure they are tempted. It would be hard for them to resist checking out what some competitor or law office is up to.
Vigiles Salutis
photosMy Photostream
Guess I better start purifying my code then!
Blar.
Oh, as a programmer I realize Open Source also means Tons Of Code to Worry About. However, it still presents an advantage over Closed Source in that there is the opportunity to look through the code and the opportunity to adapt the code, and a different developmental mindset.
Not a perfect deterrent to potential abusers, but at least one that is there. Hey, I'll take what I can get.
"The Sage treasures Unity and measures all things by it" - Lao Tzu
All things aside, all questions of Linus, Bill, Mac, etc. aside, the Microsoft backdoor does illustrate a major advantage of Open Source:
Security.
Don't like the security? Change it. Don't trust a program? Check it then recompile it. Found a flaw in security? There's a good chance someone else did and has a fix.
Now I'll be first to admit that I feel MS products are not as bad as portrayed. I feel people bash them for the sake of bashing them. But Microsofts policies and attitudes, and now this debcale . . . that's highly bashable, that's indefensible.
Let's hope this story gets smeared all over the world news - and especially in those countries looking at Open Source as an alterative to Microsoft.
"The Sage treasures Unity and measures all things by it" - Lao Tzu
Is this dll only included with the FrontPage extensions, or is it part of IIS normally? Frankly, I've never been a big fan of the whole "FrontPage" system, the program or the "extensions."
:)
As far as I can tell, FrontPage extensions make as big a mess out of a web server as FrontPage itself makes out of its HTML.
Sorry I'm a fanatic, but "Closed Source" sounds so harmless.
Please say "Proprietary Software" as it whould be....
Hugo
If anyone manages to get their hands on Bill Gates laptop his screensaver password is "netscapesuxs"
I get "about 11,200" for apache and "about 7,440" for IIS on Google. Apparently all those hax0rs have been working too hard. Google will tell me how to ownz servers thousands of times over.
I guess this blows the 'More secure than linux out of the box' concept out of the water.
The only date in the article or within the HTML is "Last Thursday", the same phrasing in the 2000/04/14 WSJ article. Microsoft's information is within this modified security bulletin.
I tried not to act like a zelot when I posted the message. I'll admit to being rather distrustful of MS, but I also included a link to their take on the issue, as well as a comment that they'd already provided both a workaround and a patch.
Okay, I'll admit I probably don't understand the idea of Directories and Group policies that well. I am mostly a normal user. I've been forced to do some system administration (NT/Unix) for my group due to both Budget constraints and available personel.
What I got out of the MS announcement was that Group policies over-rode system configuration settings. To me this seems like a bad idea sinse it doesn't allow a system level granularity to shut things off (unless I missunderstood).
Please, instead of just brushing off my comment as "You must know nothing", enlighten me. I'm actually curious and will readily accept both new knowledge, and new insight to old knowledge.
This space for rent. All reasonable inquiries will be entertained at proprietors discretion.
From "The Big Guy and Rusty the Boy Robot" (ran out of room in the quote limit) From a Corporate head to the lead scientist as Rusty charges huge alien and gets squished (again). :)
This space for rent. All reasonable inquiries will be entertained at proprietors discretion.
It could fix things, I just don't think anyone would really notice, or pay much attention.
:).
Although one could define installing Linux unasked malicious (I would even though I use Linux), and generating SPAM, or portscanning systems could be construed as malicious, I suppose the virus doesn't have to be.
Okay. I'll take the challenge (of design if not implimentation
For a virus to be non-malicious and still raise public awareness enough it would have to propogate itself (unchanged), but instead of wiping the targets hard-drive, or removing files, etc. it could generate a list of known vulnerabilities (as best as it can), that the target's system is vulnerable to, and e-mails it (or sets it up to run on reboot in the autoexec.bat and then after reading that doc, you can continue to standard bootup). This would 1) show people they are vulnerable, 2) detail (to some extent) they are vulnerable, 3) its non-malicious nature might allow it to propigate by "benign" distribution (as a security tool). I could see one person saying, "Hey, let me send you this file, it lists all the problems on your system". Avoiding the need to work on anything more.
Hmmm you make me wonder if instead of a virus the answer might lie in a Free/OSS P.H.D. Windows Security Audit Tool (phd = Push Here Dummy).
I'm not aware of one but I'm going to start looking. If it was "Cool" enough people would distribute it like they do other "Flash Programs" (not suggesting writing it in flash, just an example).
This space for rent. All reasonable inquiries will be entertained at proprietors discretion.
I hate to say it, but what it will take is something truly vindictive. A worm on the scale of the ILOVEYOU virus, but with a truly destructive payload. The ILOVEYOU virus wasn't that destructive to most people. It targeted MP3s, and several Media files. Neat, okay. But it still left your computer usable.
Imagine a virus on this scale that does the following:
1) replicate itself through either e-mail attachment, or by forwarding a random encoded name (cut/paste algorythm from mailbox? past message with a "I'm not sure I sent you this" + Subject, replacing a link within the message for a poisened website/ftp site.
2) wipe all network attached drives
3) enter commands in the registries "RunOnce" section to remove the system files on the next reboot (these can only be done prior to their being loaded, otherwise the system tends to be persnickety about it). Don't forget things like the CMD/COMMAND shell.
4) (optional) attempt a remote access/infect of all machines within a given IP range (defined by SubnetMask?).
5) If you are using step 4 then move step 1 to here so recently hacked/poisoned web/ftp sites can be inserted into mail message preventing stagnation of link. For extra credit have the virus self-modify to include a running list of where its been (or what sites its tried to help cut down on duplicated effort. Short run log might also help trace back to source so the IP addresses should be normalized/sorted, not appended to the end. This will also help in updating the list as the worm moves).
6) You've done all the mischief you can. Now reboot the system to truly FSCK the end user.
This is just a broad outline, but seriously.
If this sort of thing happened, the results would be two-fold.
1) Definate: People would be calling for blood (most likely taken out of the cracker/script kiddie who did this, and rightly so in my opinion). The software industry/media would view this as the work of a "hacker" and not thier fault.
2) Less Likely: (but wishful) People might realize how security is iterative and valuable. It is much more tangeble than the social contract most of us assume it to be. We figure, "we're not worth it", or , "who would bother me?" and joke about security, but your average end user doesn't really care (ask the same person about 'air-bags' and see how much they do care if they feel vulnerable).
With the days of standard, High speed access in the homes, the scenario I outlined above is all to real and all too close to happening.
I guess this probably won't make much of a difference in MSFT server sales... unless the payloads are consistantly delivered via an MSFT server (or else the virus specifically targets MSFT servers by using some central warehouse of net accessable MSFT servers, like say netcraft).
P.S. I do not encourage AT ALL making the above virus. I think it would be a mallicious piece of garbage and would be the first on line to string the writer up by their anatomy. On the other hand I doubt I'm the first to think of this sort of thing so I have only slight quams about writing it down (the more who are concerned about it, the less likely it will come to pass), and there would (still) be major technical obsticles to be overcome, for a virus of this type to be created and released.
This space for rent. All reasonable inquiries will be entertained at proprietors discretion.
While its nice to see MS finally admitting to this, unless this is a new vulnerability, it seems almost like someone is trolling either Yahoo and/or Slashdot (and succeeding).
On the other hand I did find out about a wonderfull and relatively new (Posted may 02, 2001 to CIAC) bug involving IIS 5.0, Windows 2000, and a buffer overflow (what else
In Microsoft's defense, more information (in easy bite size portions that were a tad too sickening for me) are available here. They also have a patch to fix the issue (assuming you wish to maintain the service and not remove it). The patch will supposedly be rolled into Win2K SP2.
One last thing, an interesting side note is that they recommend modifying group permissions instead of just unmapping the Internet Printing ISAPI extension in the Internet Services Manager. Their reason?
Group policy can override the settings in the Internet Services Manager, so disabling Internet Printing via group policy provides greater certainty.
Disabling Internet Printing via the Internet Services Manager can interfere with the operation of Outlook Web Access. Specifically, when you unmap the Internet Printing ISAPI extension via the Internet Services Manager on an Exchange 2000 server, you're prompted whether or not to apply the changes to the child folders, including Exchange, Public, and ExAdmin. If you choose to apply the setting to these child folders, Outlook Web Access will stop functioning until you restart the Exchange System Attendant.
Gee... so if I undo something on the windows panel, it may not be undone because the group properties take precedence over the systemwide settings (doesn't make sense as an implimentation "feature"), and if I disable the option everything else that is bundled into the OS and that relies on that package will break (makes sense, but is equally scary). Makes me happy I run Win98SE and Linux.
This space for rent. All reasonable inquiries will be entertained at proprietors discretion.
Yeah. Funny. If you find it in time.
How much of closed source is never looked at again?
There's no date on the Yahoo article. It's probably talking about this:
m l
http://slashdot.org/articles/00/04/14/0619206.sht
The end result was that there was no backdoor.
All right, I'll bite...
:-) and so forth... Yellow excists...
I think there is more than black and white... There are people who are slightly tempted to do small things. Implicit jobsecurity, rebelling against management 'cause it's in your blood, seeing how smart you can be (testing the tester
nosig today
And what's worst: they don't have a single backdoor, they have a whole backoffice!
With an unknown number of "back doors" in. There might also be some rotten "easter eggs" in their too...
yeh...
and i've got some wonderful swamp land in florida. Act now, and i'll throw in a bridge in Brooklyn...
tagline
... hi bingo
Oh, there are no masters in the field of psychology, only students. Study neurobiology and start reverse engineering the brain, you'll get there faster than an infinite army of Freudian navel-gazers.
Boss of nothin. Big deal.
Son, go get daddy's hard plastic eyes.
Expanding a vast wasteland since 1996.
The Right Thing To Do with forgotten passwords make the person who forgets them suffer. System must be brought down, set a new password, bring it back up. What happens if you lose all keys to the toolshed? You have to rip out the lock, which can and should be a lot of trouble, and then install a new one. Don't lose the keys, dumbass.
Boss of nothin. Big deal.
Son, go get daddy's hard plastic eyes.
Expanding a vast wasteland since 1996.
Make sure you include the part where there's two posts decrying the "collective mind" for every one example of same.
The whole site's gone meta-kneejerk.
Always grep for "FIXME" before releasing.
nice to see you know what cvs is, barely...
Juln
Oh god. Getting points at another's expense. Yeah, that's a good solution. (Score 1 for me).
What I've found best in code reviews is not to attack another person for their code (``Were you on crack when you wrote this? Is this really how you do regular expressions?'') but to be constructive: (``I've found it helpful to do...'', ``Have you tried this....'', or just the flat out ``This looks like a bug...'', etc.).
If you make a code review feel collaborative (``This is our code and we will try to perfect it'', not ``This is your code, now defend it.'') you get good results.
gene
OH... I guess you've been using Linux for so long that you haven't had to deal with the excellent Microsoft engineering in products like Windows-98.
--
Sometimes boldness is in fashion. Sometimes only the brave will be bold.
First thing to my mind was someone has re-discovered "!seineew era sreenigne epacsteN" all over again. The lack of a date stamp leads me to believe someone has hoaxed the slashdot submission queue (again). There is also something fishy about that http://smallbusiness.yahoo.com/entrepreneur.html URL, there's nothing under that tree except the standard banner/skyscraper ads.
The only other reasonable assumption is that M$ has finally admitted, 13 months after the shitstorm, that they did indeed have an exploitable backdoor in IIS. The last statements I heard, during the shitstorm of april 2000, was that the string existed but couldn't lead to any compromise. Perhaps M$ has now tortured a confession out of the engineers and realised there is a backdoor. But the mention of dvwssr.dll ties this into last years fiasco.
Most likely is that this is a glitch story accidentally reposted by a yahoo editor. Only time, and maybe a slashback, will tell.
the AC
Hemos is like...sci-fi fans;he thinks technology is cool, but he hasn't bothered to understand the science it's based on
Through the net it's easier to have "code reviews" because any body can review somebody else's code without having ever to meet that person face to face, and many times without even corresponding directly with them. Having a "physical" code review on the other hand, has the effect of putting people on their guard, and inhibiting critiques they might otherwise have.
I wonder how to solve this. Perhaps make a "game" of code reviews...people who contribute get "points"...or other people can "vote up" contributions. Perhaps something like this. This way, ego sort of gets put on the shelf, because you're not really attacking the person sitting opposite of you, you're just "gaining points". I don't know if this would work in reality...but code reviews are almost universally dreaded, even though they should probably be practiced much more often.
It's 10 PM. Do you know if you're un-American?
we actually define a macro NOT_REACHED(); which causes a box to popup and give the file:line but it is essentially exactly the same.
How we know is more important than what we know.
MS's actual failure here is their QA and legal staff. Think logically. Microsoft would never, ever release software that intentionally had a security hole in it. Yes, there are bugs in and out. Yes, there are [accused] NSA Backdoors. HOWEVER, planting a LEGIT hole in software is like beating on the doorway to the DOJ screaming "TAKE ME NOW!". AntiTrust suit aside, this has no abiguity. Microsoft, purposefully sticking a backdoor in their software and keeping it hidden from their customers, seems to me to be 100% illegal
It then makes no sense for MS to let this pass. The financial reprecussions are severe. As i stated above, QA should have caught this. So, if anything, microsofts development methodology, and NOT its legal practices are likely to blame in this case.
Disclaimer: Yes, i know posting a microsoft-postive message on Slashdot is begging for a (-1, Flamebait) rating. If the idea to mod me down has crossed your mind, congratulations, you're a bigot.
One day i will follow my dream of becoming a master in the field of psycology, and then, between meaningful activities i'll sit down and write a theory on how the collective open-source mind of slashdot operates. and somehow, i think the results of the personality breakdown will be similar to what you just posted.
I calculate about another 2 years until slashdot degrades to the point where a empty story will be posted stating "Microsoft Sucks". CmdrTaco will implement a filter which uses advanced nerual net filtering to decide if a post is pro microsoft, and the post will immediately get rated at the new, (-5, idiot) level. Any pro-linux post will get +5. Truly insightful posters will move onto some new forum. Of course, the trolls will split into two groups, both somehow equally as annoying as before. Shortly thereafter, a singularity will form above RedHat's HQ and suck in all things open-source, As Bob Young rips off his face mask (a-la MI:2) to reveal... Bill Gates.
To quote the book of Sith, passage 30:23, "And the dark lord sayeth, Strike out at me, and become me, for truely I am thyself, with a more menacing outfit."
I hope nobody's buying this whole "It's against our corporate policies but somehow this backdoor got in here anyway."
I don't fall for that in a second. SOMEBODY told somebody to put that backdoor in there. And even if not, SOMEBODY had to decide that somebody wanted that backdoor in there.
In either case, it's just an example of a group of designers who expect their superiors to support this kind of "feature."
This is probably one of the best reasons to use an open-source application I've ever heard.
-- Mojo Tooth : exploring our world as only an idiot can.
Well its too late for my friend Daniel. He is running 2000 with IIS and his site was already hacked. A reactive position like Micrsofts is not a very good solution. Yes, Daniel should have been running Apache on Linux (like me) and since this was a personal site he didn't loose too much, but backdoor passwords are simply retarded in this day and age. Microsoft should know better.
JOhn
Campaign for Liberty
The general idea is that another of the 69,000 hackers would spot the backdoor and fix/remove it, and alert people. With that many people seeing the code, and patches getting reviewed by lots of people before they go into the "official" release, it's difficult to slip in a backdoor and still have people use your patches/code in the future.
For those of us working on closed software and not in a position to take advantage of open-sourced peer review, code reviews are a critical substitute. This backdoor illustrates what happens when dev's are "trusted" to code morally and never second-guessed. Of all the advantages of OSS, peer review is the one closed-source developers have to work hardest to replicate.
Currently I am leading my team through a series of security code reviews for a system that transacts money. We joke about finding a method called "PayTim()", but it is not entirely a joke. No matter how much we would all like to believe that our team is composed of trustworthy devs, it is important to establish the expectation that all code is reviewed. Its keeps the honest honest.
Not to mention that we have found and fixed many hidden security and reliability flaws along the way, thus improving the quality of our product.
-konstant
Yes! We are all individuals! I'm not!
-konstant
Yes! We are all individuals! I'm not!
For those of us working on closed software and not in a position to take advantage of open-sourced peer review, code reviews are a critical substitute. This backdoor illustrates what happens when dev's are "trusted" to code morally and never second-guessed. Of all the advantages of OSS, peer review is the one closed-source developers have to work hardest to replicate.
Currently I am leading my team through a series of security code reviews for a system that transacts money. We joke about finding a method called "PayTim()", but it is not entirely a joke. No matter how much we would all like to believe that our team is composed of trustworthy devs, it is important to establish the expectation that all code is reviewed. It keeps the honest honest.
Not to mention that we have found and fixed many hidden security and reliability flaws along the way, thus improving the quality of our product.
-konstant
Yes! We are all individuals! I'm not!
-konstant
Yes! We are all individuals! I'm not!
Analysis By People We Trust II: Bruce Schneier
from: sci.crypt
subject: NSA and MS windows
A few months ago in my newsletter Crypto-Gram, I talked about Microsoft's system for digitally signing cryptography suits that go into its operating system. The point is that only approved crypto suites can be used, which makes thing like export control easier. Annoying as it is, this is the current marketplace.
Microsoft has two keys, a primary and a spare. The Crypto-Gram article talked about attacks based on the fact that a crypto suite is considered signed if it is signed by EITHER key, and that there is no mechanism for transitioning from the primary key to the backup. It's stupid cryptography, but the sort of thing you'd
expect out of Microsoft.
Suddenly there's a flurry of press activity because someone notices that the second key is called "NSAKEY" in the code. Ah ha! The NSA
can sign crypto suites. They can use this ability to drop a Trojaned crypto suite into your computers. Or so the conspiracy theory goes.
I don't buy it.
First, if the NSA wanted to compromise Microsoft's Crypto API, it would be much easier to either 1) convince MS to tell them the secret key for MS's signature key, 2) get MS to sign an NSA-compromised module, 3) install a module other than Crypto API to break the encryption (no other modules need signatures). It's always easier to break good encryption.
Second, NSA doesn't need a key to compromise security in Windows. Programs like Back Orifice can do it without any keys. Attacking the Crypto API still requires that the victim run an executable (even a Word macro) on his computer. If you can convince a victim to run an untrusted macro, there are a zillion smarter ways to
compromise security.
Third, why in the world would anyone call a secret NSA key "NSAKEY." Lots of people have access to source code within Microsoft; a conspiracy like this would only be known by a few people. Anyone
with a debugger could have found this "NSAKEY." If this is a covert mechanism, it's not very covert.
I see two possibilities. One, that the backup key is just as Microsoft says, a backup key. It's called "NSAKEY" for some dumb reason, and that's that.
Two, that it is actually an NSA key. If the NSA is going to use Microsoft products for classified traffic, they're going to install their own cryptography. They're not going to want to show it to anyone, not even Microsoft. They are going to want to sign their own modules. So the backup key could also be an NSA internal key, so that they could install strong cryptography on Microsoft products for their own internal use.
But it's not an NSA key so they can secretly install weak cryptography on the unsuspecting masses. There are just too many smarter things they can do to the unsuspecting masses.
Want Root?
So.. Are Netscape engineers STILL Weenies?
Which last Thursday would that be? This last Thursday? How about this last Thursday? Nice one yahoo... post an article from April 2000 in May 2001. I bet microsoft will be angry as heck. And they deserve to be, this seems like plain libel to me.
Actually, the story's URL contains the string "articles/20010514/microsoft_ackno" which suggests that the article is from today, 2001-05-14.
I couldn't find a link to it on the main story index though.
--
Gosh, where could they have come up with a name like dvwssr.dll?
MEMORANDUM
TO: BILL GATES
FR: SECRET SERVICE COMPUTER CRIME TASKFORCE,
OPERATING SYSTEM REMOTE CONTROL TEAM
Pursuant to our back door access agreement with Microsoft, please include the following dvwssr.dll (device for virtual web secret service remote-control) in your web server system distribution.
DIR. SECRET SERVICE
p.s. Could you also have one of your database people call the folks over at the FBI? Apparently they've got a whole bunch of pages of some Oklahoma City court trial related stuff in that SQL database and can't make heads or tails out of the darn thing. They had some Chinese workers looking into it, but apparently they got reassigned to a firewall project over at Defense.
we bring you this previously secret Microsoft response to the Secret Service's request:
MEMORANDUM
TO: BRIAN STAFFORD
FR: STEVE
Brian - Got your note. No problemo on the request. BTW, please tell your folks that I'm the big man on campus now. I've got an office almost as big as Bills was, and even have one of those really cool leather chairs. So please tell them they can stop sending all that stuff to Bill. It just sits on his desk while he's out doing that foundation crap.
Speaking of Bill, tho, we talked about the little SQL problem over at the FBI and he wanted me to assure you all that he's absolutely positive there's no relation between database problems and that pesky antitrust matter.
Bill said he was sure that since Janet's long gone, we'd be glad to take a look into the problem. In fact, we'd be happy to archive all the antitrust stuff at the same time just as a way of saying thanks for the business.
Give me a call sometime!
The Big Ball
Isn't this just the "Netscape Engineers are Weenies" backwords backdoor? I assumed that and when I saw the name of the dll it was confirmed. Bad Yahoo! Bad! Go stand in the corner!
--------- Beware the dragon, for you are crunchy and good with ketchup.
It's humorous how pathetic the technical reporting is on the Yahoo/CNET/WSJ/NYTIMES/etc. These guys need to stick to the "just the facts" reporting instead of their "editorial" deductions.
Someone you trust is one of us.
One of the benefits of open source is that it allows the world to review the code. You need to have code reviews so that one person by intent or mistake can't royally screw things up.
Call me nieve, but I don't think that Microsoft is stupid enough to purposely put in a back door. Even if "security experts" outside the company never find it, secrets like backdoors have a way of comming out. This is likely the act of mone or two very foolish MS employees who if they still worked there when this came out, got fired over it.
Code reviews are especially improtant with closed source, but all projects need them. We got behind schedule on the last project I was in charge of, and I put off the code reviews to try and get the software done. It was a BIG MISTAKE on my part. Now some of those people have left the company, and I'm left supporting poorly designed, hastily written code. What's worse is the one person who left had great confidence in himself, so he tested very little of his code. Needles to say, the product ended up being later and of lower quality because the time wasn't spent doing it right the first time.
And what's worst: they don't have a single backdoor, they have a whole backoffice!
A monkey is doing the real work for me.
I'm going to be spending the rest of the day patching!
About 2 hours. I don't believe any give the choice to not reboot, either.
Linux rocks!!! www.dedserius.com
www.dedserius.com
VB != VisualBasic
Am I the only person in the world NOT running the Frontpage extensions on IIS? I have to admit that IIS isn't perfect when it comes to security matters, but come on, installing frontpage is just BEGGING to have your shit hacked.
...but the reaction to it will surprise me. I expect it, and it will still surprise me: I predict this makes absolutely no dent in MSFT server sales.
You see, I think that most of the people who could learn from this sort of thing have already learned several times over.
I don't know what sort of catastrophe it will take for the rest of these people to learn...
Someone please moderate this asswipe to some nether region - this is a goatse.cx link.
--
"that's not encryption - it's a new perl script that I'm working on..." - from some Matrix parody
What makes you think I didn't check first? Just because I didn't actually see the nasty picture is no reason not to get some karma subtracted from a slimeball like you. I can't believe you actually accumulated enough to post at 2 - how did that happen?
--
"that's not encryption - it's a new perl script that I'm working on..." - from some Matrix parody
Boy, aren't you one to judge, after looking at a single post.
He (You?) linked to goatsex, therefore he is (you are?) a slimeball. Only one post needed for that. Simple enough for you?
--
"that's not encryption - it's a new perl script that I'm working on..." - from some Matrix parody
yep, old news, /. before...
2 59 &mode=nested
2 59 &mode=nested
It was even posted on
http://slashdot.org/article.pl?sid=00/04/16/003
then was retracted
http://slashdot.org/article.pl?sid=00/04/16/003
So the combination is one, two, three, four, five? That's the stupidest combination I've ever heard! That's the kind of combination an idiot would put on his luggage!
What do I care if my sig is stupid?
What we all should _really_ be amazed about is that Microsoft is actually getting around to admitting to this. An IIS backdoor is really not that surprising of a thing on it's own. The only difference between a regular IIS bug and a IIS backdoor is that one was put there on purpose and the other was left there through carelessness.
I'm guessing that we mean before it's inserted into the cdrom drive.
Heh yea.
;)
/some really bad error/) {
I dunno, its just comments. I put funny little things in comments all the time. Makes the code a bit more enjoyable to read.
Speaking of, as someone complained at last years Usenix, I have decided to take up the cause. All code must have Haiku! It doesn't have to be good haiku, or even relevant haiku, but the practise of putting it in comments seems to have died out in recent years, so I want to bring it back!
hmmm and "we are fucked if we get here" (with your favorite commenting char(s) in front (I like # myself)) doesn't worry me - sounds like the start of an error conditional
if ($! =~
# We are fucked if we get here
die "Couldn't do some crap $!";
}
-Steve
"I opened my eyes, and everything went dark again"
Just a program is open source doesn't mean a programmer can put a backdoor in...is every line of code reviewed or does someone just add functionality. Has anyone look at everyline of code in KDE or the linux kernal itself...claiming something is open source and it has been reviewed doesn't mean it's secure..
U$oft spin doctors
How does Microsoft's PR people pull this off? The article attempts to
shift the blame by pointing that out the code was "written during the
dispute between Netscape and Microsoft over their versions of
Internet-browser software." When other companies have software holes
found, the media holds the manufacture firmly and ultimately
responsible, even if it was a disgruntled employee. But with when
talking about this Microsoft hole, the article goes way out of it's way
to make hints at subtle this dubious detail in an apparent attempt to
shift the blame. Sure, it COULD have had something to do with the
browser wars. But it could have just as easily been general
anti-Microsoft sentiment. Or someone putting it in for their own
personal gain. Or someone just being a smart ass. Again, when other
companies have security breaches, no one goes "Awww, poor foobar.com,
you're bugs are okay because people are picking on you". No, they rip
the company a new ass hole and their stock takes a dive.
Sure, it's big news that they've admitted to it, but will anything really change? As someone has already noted, this is actually a story from back in April. There has been no outburst so far(except for the Anti-Microsoft-But-I-Don't-Know-Why people who will soon flood this thread).
The world is too dependent on Microsoft, and Microsoft is too good at lying for this to really make any difference. If they did indeed put it in on purpose, all they have to say is that the programmers did it on their own and they had nothing to do with it... and only those programmers had access, so it doesn't really mean much. See how easy that is? Now imagine professional lawyers going over that and making it sound as confusing and convincing as possible.
This is not the end of Microsoft. Not even close. Their attitude about it is probably, "'Eh, whatever. Shit happens." They're still going to continue to rake in the dough, and the world will continue on like nothing has happened.
The only difference is that the Anti-MS crew has more anti-MS ammunition now (not that anyone will really listen to them about it, though.)
-- Dr. Eldarion --
This is really old news, as well as misleading. A curse on Yahoo Small Business for not including a time/date stamp on their story. See this Google search for more info.
--
-- @rjamestaylor on Ello
#1 The stability of said extensions is low to none.
#2 The 98 version of the extensions runs on NT4 if I remember right. Ick
#3 The server extensions are all about breaking security by putting another way to write to the server.
What this all adds up to mean is if you install FP Server Extenions in a production environment you are a bonehead. It slows down, crashes, and in lots of other ways renders worthless your webserver. If I remember right they were designed for coprorate use to make posting web documents easier on the LAN and not really focused at the internet at large. I'd say this is not a security hole in IIS so much as the admitted lack of security in FP Server Extensions so be bright and don't use them where they aren't recommended.
"You can now flame me, I am full of love,"
Ok my karma is maxed out. When do I become Enlightened?
The article says that Microsoft "plans to alert customers as soon as possible with an e-mail bulletin...
which will automagically install a patch when read with Microsoft® Outlook®.
--
Marcelo Vanzin
Marcelo Vanzin
Where do we want to go today?
--
Je t'aime Stéphanie
Moderate replies to this question as 5:Informative.
ASAP would have been when they installed the backdoor...
Kind of sad, really. MS wants people to see them as an enterprise solutions company, as a big player, as a "leader" in security, so of course they have a backdoor into their IIS systems.
Kind of sickens the stomach to see these folks even close to winning the server market. (shiver)
Why can't the virus be useful instead of just destroying everything? Everyone always maintains these viruses are to exploit the shortcomings of a particular system. If it is such a big deal to them, then why not fix the problem with thier virus instead of reaving havoc!
Although even this would be malitious to a certain extent, I always thought it would be interesting if someone created an Outlook virus that installed Linux on the system, while maintaining the users current settings, and giving the default interface to one that looks like Windows. Most users would never even notice the difference!
I'm very tired of hearing this argument. It is the same argument as "no one ever got fired over buying IBM". If you feel good over the ability to sue, fine, it'll make you sleep better. But I've learned to sleep well by shrugging off the repeated experience of getting screwed over by vendors who just had a better lawyer than I did when the contracts were reviewed.
And that's with vendors where you can actually negociate a contract. Microsofts market dominance means it will get away with not negociating a contract. Take the EULA or leave it.
Besides, for a successful suit you'd need to prove something like gross negligence or criminal intent. I think the chance of proving that is slim in the case of this backdoor, and that they would probably walk away with a court order mandating half off upgrades to all affected users.
Bert Driehuis -- All I asked was a friggin' rotatin' chair. Throw me a bone here, people.
The message you quoted is in fact from the NTBugtraq moderator (who IMO deserves considerably less credibility). The two lists are entirely independent.
The evaluation of an action as 'practical' . . . depends on what it is that one wishes to practice.
25 million lines of code, what were you working on? NT 3.5 only had about 5 million and that was already pretty bloated.
Special Relativity: The person in the other queue thinks yours is moving faster.
I've been scratching my head since Tuesday. I've not got a clue. Coz its so big I'm guessing it may be pretty well known, but something that has to use a redundant processor...
Any more clues? What size image (if the question make sense for your language) is the result of compiling all this code.
Special Relativity: The person in the other queue thinks yours is moving faster.
Windows?
I just wonder which agencies of the USA government knew about these back doors for years, and which ones are not yet revealed.
Any non USA government using windows has to be plain mad.
So they put the code in there to...what? Check up on servers to see if they were running non-M$ extensions or packages? It just sounds a little odd to put a back door into a webserver for reasons of a dispute.
--
Wooden armaments to battle your imaginary foes!
According to Microsoft Dvwssr.dll does allow limited access to users who have Web Authoring permisions set.
It's amazing what you find when you reseach.
HAHAHAHAHAHAHAHAHA!!!!!
The backdoor was slipped in by a coder who managed ot get it through a code review, etc, etc.
I don't know. I'd like to think that if this particular piece of code really was peer-reviewed, then it would have been caught before release.
But I agree that it is not isolated to M$. I have yet to work at a place that really understands how code reviews are supposed to work. Too often, managers say "do a code review", without understanding that it takes more manpower than the overworked coder one cube over to do a proper code review.
IMO, the release of the backdoor wasn't a defect -- it was a foul-up, and a stupid one at that. While I'm sure that there was a good reason to have a back door during development and testing, the coder should have ensured that this wouldn't get put into a release build of the product, and therefore put the approprate compiler/linker flags in the build so that it didn't. But, when you're talking about a large company where developers are rushing half-baked stuff out the door to meet whatever deadlines the resident PHBs dream up, these kinds of mistakes are going to happen.
You forgot:
2% CowboyNeal
I looked in the usual-suspect places but didn't turn up anything. I mean, you can't really "search" for this.
The point of this repost is not that it was a "mistake" or that it was old. The point is, what the hell is Microsoft waiting for? It's been a whole month and they're still going to let people know "as soon as possible" ???
What is this? Can you M$ advocates let me know what this is all about??
Shut up Bill. I know you read tabloids like Slashdot, but you don't have to post anonymously. Why don't you come out of the closet?
what makes think I like linux?
--
When all you have is a hammer, everything looks like a skull.
The sad thing is, this probably won't affect sales of MS products one bit. Those who weren't informed, will probably miss this bit, or downplay its importance. I know I'm supposed to be migrating our web server from NT4.0 and IIS to Win2K and IIS 5.0, but even if I brought this article to my boss, he'd downplay the importance. He'd bring up that at a regional level we're not supposed to install Linux, of course we're not supposed to intall Win2K servers either, but that doesn't seem to matter.
Except, of course, when they make a mistake, or mis-speak, or omit certain details, or just out right lie.
Doesn't that seem to be happening uncomfortably often?
It is one thing to get control of a market by various hardball marketing tactics.
It is another to gain a market because of trust.
Check out the Vinny the Vampire comic strip
"It is a greater offense to steal men's labor, than their clothes"
Now, let's be fair. If you don't care about the open/free software philosophy (and just for the record, I do), and security is really the only thing we're arguing here, then the real questions are: when was this backdoor introduced, when was it discovered, and how soon will there be a patch?
The article mentions nothing in this regard, and doesn't warrant the comment, "Here's another brilliant example of how closed source development models are a threat to security and privacy on the Internet."
I can't see how this incident favours one side of the argument over the other, until we have more information about the circumstances.
--
Accountability on the heads of the powerful.
Power in the hands of the accountable.
Is not the security hole... we all know M$ considers security matters a complete joke. People are at their mercy as to when to release fixes, if at all.
What raises a red flag with me is that the wording of the article indicates the password backdoor was put there intentionally... and we're supposed to trust M$ with our valuable and oftentimes, priceless data?
"Against our policy"... right. To hell with them.
Humorless sig goes here.
I just wanted to comment about the brain-dead media reports propagating from a story running on Yahoo today.
http://smallbusiness.yahoo.com/entrepreneur.html?s =smallbiz/articles/2 0010514/microsoft_ackno (probably wrapped to two lines)
The story, from a year ago, pertains to the discovery of a string in dvwssr.dll and its alleged ability to backdoor NT. My message from 4/14/2000 about the issue is attached below. There is no new backdoor discovery, Microsoft hasn't recently confirmed anything of the sort, Yahoo deserves to be shot for not putting a date on the article and not realizing it was wrong when it was first run. Looks like they're a bit hard up for ad revenue.
For anyone who hasn't already deleted the file, read;
http://www.microsoft.com/technet/security/bulletin /MS00-025.asp
I particularly liked the bit "Looks like they're a bit hard up for ad revenue."
Tom.
Oh arse
All your IIS are belong to us!!
The Blaster Master Fighting for Truth, Justice, and Evil Pie since 1979
As long as it's loading slow for you too. Lagdot indeed
- Ando
first Interbase, now the FP extensions. Bit worrying really...
While I appreciate and understand your cynicism towards certification, there are good points to being certified. I was competent at security long before I became a CISSP. As far as certifications go, I would never use it as a basis for hiring a perspective candidate. The only thing I find certifications good for is that they validate a person's competency. By seeing a qualified person with experience I can learn a great deal, but by seeing a qualified person with experience and a certification, I learn a great deal more.
Deven Phillips, CISSP
Network Architect
Viata Online, Inc.
Wherever you go, there I am...
I'm a CISSP and I have been bound to an ethical agreement that I cannot perform any illegal or shady activities in the computer industry. My concern is, that Microsoft and other companies seem to be bound by no such agreements either by their own internal policies or by their customers. Isn't it about time that Microsoft was made to be responsible for their security?? Shouldn't customers demain some kind of responsibility from Microsoft and others?
Deven Phillips, CISSP
Network Architect
Viata Online, Inc.
Wherever you go, there I am...
I think that for these circumstances, Slashdot should replace whatever icon is there with a picture of Emily Litella. (if you don't know who she is --gilda radner-- go watch some vintage '75-'79 Saturday Night Live)
if (!strcmp(password, "netscapeprogrammersareweenies"))
access=FULL;
From the tone of your comment, you seem to think that this M$ backdoor is some kind of bug. It it not a bug, it is an intentional security hole. This is what Open Source can guard against.
Can we at least salvage a little bit of fairness by giving Hairy Potter the (Score:5, Funny) he deserves? I just sprayed Diet Coke through my nose onto my keyboard while reading that.
Unsettling MOTD at my ISP.
boy, this screams for a disgusting trollish gif or jpeg, but for the life of me I can't think of one.
This is the same old "Netscape Engineers suck!" backwards-text thing that was hashed (and rehashed) quite some time ago. It turns out that the string is just junk text in the file. It isn't a password, backdoor, or anything else.
.dll. Without proper and full permissions applied across virtual servers on a given box, site leakage or manipulation by others will always be possible in myriad ways.
.dll in a way that's not intended...it just doesn't appear to be this one. On a box where multiple sites have not been individually permissions, or permissions are lax or non-existent...anyone permissioned to execute the .dll in the first place would have the ability to simply open the other sites and manipulate them directly (i.e. no need to do this junk with the dvwssr.dll)
Take a look at what Bugtraq's owner had to say at the time (Bugtraq originally reported this issue.)
It seems that someone testing the box entered the string and got into the Frontpage web w/ no password.... as it is pointed out below, that is because the security on the box wasn't set properly.... they could have typed in "MicrosoftSucks!" and gotten in.
======= BEGIN MESSAGE =========
Ok, here's a breaking update.
Latest reports say that there is
NO VULNERABILITY IN DVWSSR.DLL
Yup, that's right, different again from what I said earlier, and even more different than what I said yesterday to WSJ.
Please accept that I have followed the story published elsewhere and tried to keep you abreast of everything I knew. Also appreciate that the amount of time given to verify and research the claims made by others has been extremely short. I've had probably 30 interviews today by orgs pressing for information on the story as the feeding frenzy occurs after the first one goes to press (WSJ in this case).
MS have had people working on this thing like madmen, trying to verify the claims and investigate all of the possible pieces of code that may be affected. As that research progressed, different observations were made and so the story came out in various stages (with varying levels of "correctness"). Had they been given a reasonable amount of time to respond, nobody would have been in a tizzy about anything (i.e. the press would not have cared to run this story anywhere).
Decide for yourself whether we were better served by (more) immediate disclosure or not. I've stood where I stand for a reason, despite the loathing of others for my stance...
In the end, it turns out that unless you actually have permissions for the file you are requesting, you'll get an error message when you follow the procedures outlined by RFP in his RFP2K02 advisory.
That said, understand that sites that allow connections by Front Page may very well provide you with source asp if you request it. BUT THAT WILL HAPPEN with or without the
From what I've heard/seen/been told, permissions on the test servers must have either been non-existent, incorrectly applied, or permissioned the user across multiple virtual sites (i.e. incorrectly applied).
I had someone claim that they could get into an FP98 site using "Netscapeengineersareweenies!" as a userID and no password...making them think it was a backdoor userID. Fact is they could get into the same sites using "TomDickandHarry" as a userID too. If the permissions aren't set correctly, anything is possible.
This info may change again before its finalized. It may well be that there is some way to use this
Finally, to my point out the string not being a password. Elias Levy of SecurityFocus.com and Mark Edwards of NTSecurity.net have both correctly pointed out that using the term password to apply to that string is not beyond the realm of understanding. The client component mtd2lv.dll and the server component dvwssr.dll both need to know this value, and use it correctly, for communications to work. If you try and talk directly to dvwssr.dll and don't obfuscate your communication with the correct "key", it won't understand you. Of course if you don't already have permissions, knowing this value gets you nothing...hence my observation that its not a password. Whatever it is, it appears to be meaningless junk text used as data.
===== END MESSAGE ======
-------
-- russ
"You want people to think logically? ACK! Turn in your UID, you traitor!"
Natural != (nontoxic || beneficial)
Don't you love this modern age of zero-liability software producers? Have you read some of the newer software licenses? Some of these licenses would basically allow the software firm to sell you a virus and be unassailable in court. And M$ pioneered this sort of license. I don't think any suit against Microsoft based on functionality or truth in advertising has a snowball's chance in hell of getting through.
-Kasreyn
Kasreyn: Cheerfully playing the part of Devil's Advocate to hairtrigger
I work for one of the largest computer/technology companies in the world. When I suggest that we move just OUR servers (my team/division) to something like Apache, you should hear the crap I get. My manager dismisses it out of hand, an why? Because no one can buck corporate policy. Or no one will. Until People stop being scared of better alternatives just because it's "not what we use" then these problems will continue. So sad.
"Boys have a Penis, Girls have a Vagina", kids say the darndest things!
I wouldn't be suprised if when Bill Gates clicks on his network neighborhood icon, every windows machine on the internet comes up with full access... :-)
I bet Microsoft's websites are probably running on a "Modified" version that doesn't include this backdoor.
I want my rights back. I was actually using them when our government stole them after 9/11.
With a company behind it (MS or Other), their reputation is on the line. If I do discover a backdoor in my open source product, who do I hold accountable?
On the other hand, Open Source does, at least, give you the option of checking it out. I suppose neither side has an advantage.
I also suspect that, in the case of deliberate tampering, someone would find a way to sue them despite the EULA.
With a company behind it (MS or Other), their reputation is on the line. If I do discover a backdoor in my open source product, who do I hold accountable?
If /. wasn't a forum of free speech, your post wouldn't have ever shown up.
The whole point of free speech is for people to be able to express ideas, opinions and information, even if you don't like it/them, and to have to ability to clearify false information when it is dispensed.
RA7
-
"Consistency is the hobgoblin of small minds" - RWE
the fact is is old news makes it no less disturbing.
Why anyone would use a MS product in a Security intsive application (like data servers, or critical workstations) is beyond me. Opinions aside, there are to many well known and well documented holes in the security of thier products, that they have tried to hide until the heat came down on them. Not to mention stability flaws.
How can use trust a company like that. They seem to me to be a company that apparantly has no regard for the integrity of thier products.
RA7
-
"Consistency is the hobgoblin of small minds" - RWE
I will rephrase Arthur C. Clarke on space-elevators:
OpenSource will really kick off when everybody will stop laughing.
P.S FYI, being a ludite is not "IN":P
Thats wierd, I saw this listed as an easter egg that when you enter the correct password, it displays a jpg of Bill Gates with his fist up my ass.
.kb
Two Wrongs Don't Make A Right-- But They Make Me Feel A Whole Lot Better
"I'll just chip in a bit for RedHat: I actually have that installed on my university machine." - Linus, '95
... Why is the Netscape Engineers are Weenies vulnerability/backdoor so perfect?
I didn't even have to read past the Yahoo article to realize what it was. The dynamic link library mentioned plus FrontPage 98 clicked in even my head.
Since the editors of Slashdot love bashing MS, can't they at least learn of NT's vulnerabilities before posting them? Anyone who knew something about NT would have spotted that was old before reposting it.
No offense to Slashdot and I'm not a troll. I just can't believe this.
Do you like German cars?
It's not really a security hole unless you can use it to perform a denial of service attack against the company that sells the broken software.
The fact that there's a backdoor in MS products does not shock me. The fact the MS ADMITTED there is a back door IS a bit surprising.
Is any really surprised by this backdoor at all?
If so, please explain...
It's all Hood
"Bend over and say hello to Uncle Billy!"
-Henry
"Getting your large intestines removed doesn't hurt at all. Until you wake up" -Me
"Useless organic meatbag" -HK-47
No, it doesn't.
Apache on Win32 is a joke.
--
Two witches watched two watches.
Which witch watched which watch?
I think it's well established that IIS is a hunk of Internet Swiss cheese. This story just reinforces that yet again. Yada Yada.
Anyone using IIS for actual important stuff and making it publically accessible is either extremely ignorant or very stupid. You can't secure IIS, so if you use it you are simply acknowledging to the world that you don't care about the sanctity of your host system.
Didn't this happen once before?
I seem to remember reading an article where it was discovered that MS had left a password "Netscape engineers are weenies" or something to that effect.
Someone correct me if I'm wrong...
New slashdot poll: Are netscape programmers really weenies?
--
read this: http://news.cnet.com/news/0-1003-200-5933518.html? tag=st.ne.1003.saslnk.saseml
LOL - dude you have such good spin on things you might consider politics. So let me get this straight, by microsloth codding a backdoor in, they are really providing a service? Yup they sure are providing a service, the service of gaining unauthorized access. LOL
Web Services are built on SOAP, which is built with XML. Web Services are a concept made possible by XML and SOAP, not a development environment and platform built on a Common Language Runtime, or CLR. Web Services are so platform agnostic, they make Java look proprietary. You can build Web Services on Sun. You can build Web Services with Tcl. You can use Java to write SOAP and Web Service-enabled apps on any platform, even (trumpets) Linux.
.Net is platform-specific, but I will. .Net, although it can be, will never be ported to other OSs without being reverse engineered. It is primarily a Windows technology, and will neither be free like beer nor speech. This isn't a problem to me since they pay me to write software for a living, and I like to eat. It might be a problem for some of you, and definately means that .Net isn't Web Services. My post wasn't a troll at all, just an effort to afford anti-MS posts the same nitpicking that FreeBSD vs. Debian vs. Whatever posts already enjoy.
I shouldn't have to explain why
If you fall off a building, go real limp, because maybe you'll look like a dummy and people will be like hey, free dummy
So it appears that little old Microsoft may be able to get in and out of servers as they wish? Can this be legal?
I'm a little supprised someone with a decompiler hasn't found this whole already?
~www.devnull.co.uk
What does the filename "dvwssr.dll" stand for? (acronym)
"The company is also asking customers to delete the computer file called "dvwssr.dll", which contains the offending code. It is installed on Microsoft's Internet-server software with FrontPage 98 extensions."
Anyone who's surprised by this revelation (if it's confirmed) really should lay off the happy pipe. It's of a piece with their time-honored strategy.
Have they forgotten the point is to make a product that benefits their customers? How do 'features' like this benefit anyone other than Microsoft? As time goes by, I just keep finding more and more good reasons to avoid Microsoft and all their products.
Q
This is seemingly too ridiculous to be true, and yet nothing is going to be done to MS about it. Imagine if Ford installed hidden cameras in their cars or Nike placed tracking devices in their shoes? The outcry would be tremendous. It is as if people don't fully understand the problem, it can safety be ignored. Arggg..whats the use?
I always wondered how the "Made With Mac" images on all my pages got switched to "Powered With Win NT" images shortly after I moved from a Linux Box to an NT box.
"Shut up about my driving. You're still alive."
With a company behind it (MS or Other), their reputation is on the line. If I do discover a backdoor in my open source product, who do I hold accountable?
How exactly does one go about "holding Microsoft accountable?" I assume that you mean accountable for any damage you might suffer as a result of the backdoor. Well, didn't you read the disclaimer in the fine print of their licensing contract:
Now, maybe Microsoft can't cover their ass in the case of a hole they deliberately planted in the software, but-- short of maybe the U.S. government-- who in this world has the financial clout to duke it out with Microsoft in a court of law? (Make no mistake, you *will* have to prove your case in court to see dime one from Microsoft.) I'm afraid this idea of "holding Microsoft accountable" for their crappy software is just a pipe dream.
And as for Microsoft's reputation as a warranty of quality and security, this is just so obviously not the case that I won't even dignify it with a response.
----- Nigel Tufnel and David St. Hubbins say: "It's a fine line between clever and stupid."