Microsoft Microsoft Microsoft

Your day wouldn't be complete without Microsoft news. Ralph Nader has written an open letter to Judge Kollar-Kotelly. Seems he has a few bones to pick with the settlement. MSNBC is running a WSJ article detailing how Microsoft beat down the DOJ in settlement negotiations. Even Israel knows Microsoft is a monopoly. Microsoft reveals its keep-them-in-the-dark plan for Microsoft security vulnerabilities. Amazingly, some security firms seem to be willing to go along with it. I guess they figure setting up a sort of cartel for security flaws is in their best financial interest. SANS is keeping their list of top security vulnerabilities up to date with the latest IIS exploits. And finally, MS wishes their new disclosure rules were used for yet another huge hole in Windows. Microsoft says it's "irresponsible" to expect them to get a patch out for a critical flaw within "a few days". As usual, switch off active scripting, even though that will make essentially every webpage that's designed for IE not work.

Comments

You know what I find funny?

[Uttles]

I clicked on the Microsoft security bulletin. I've never seen one of those before. Back when I first bought my gateway I actually registered with Microsoft online, and so I find it hilarious that an important bulletin such as this is in such an obscure place. I think it's only right for them to send this out to everyone who's registered at least, it's just the right ethical move. We do have to remember who we're talking about though. I'm still laughing about that bulletin. Aren't you supposed to distribute bulletins, not hide them somewhere? Ugh...

Re:You know what I find funny?

[ackthpt]

. I think it's only right for them to send this out to everyone who's registered at least, it's just the right ethical move. We do have to remember who we're talking about though.

Remembering whom you are talking about should explain why they don't send this out. If they really had some competition they'd be letting you know, post haste. Ah, well, another reason why they should have been broken up for the good of the economy which wasn't done for the good of the economy.

Yours.
Theirs.

Re:You know what I find funny?

[Carmody]

Microsoft posted the security bulletin PROMINENTLY in the bottom of a locked filing cabinet in an unused lavatory with a sign on the door that said, "Beware of the Leopard!"

Re:You know what I find funny?

[Tassach]

Any information that MS puts out is going to be a battle between engineering and PR -- The programmers probably want bugfixes announced prominantly, whereas the PR drones see this as a Bad Thing because it involves admitting that they screwed up in the first place.

MS's windows update is a step in the right direction, but it sucks compared to Red Hat's up2date program. It's a service that is well worth paying for. Even if you just download the Red Hat ISOs, consider subscribing to RHN - you are supporting future Linux development and are getting a good service at a fair price. [Disclosure: I own RHAT stock]

Re:You know what I find funny?

[rtkluttz]

MS posted this bulletin to their security mailing list about 8:00 est today. They are doing a pretty good job of notifying everyone in the event of a failure. To get good, up to date information about security go to www.microsoft.com/security. They usually notify of new security issues and fixes within a day or so. The information is there and its not that hard to find. Just in case you still have trouble finding the link for the bulletin mailing list, here is the link. http://www.microsoft.com/technet/treeview/default. asp?url=/technet/security/bulletin/notify.asp

Re:You know what I find funny?

[EFGearman]

You get what you pay for. RedHat has a financial stake in making sure you get your money's worth. Microsoft does not. You've already paid for thier product. So they put out fixes, updates, etc. at their leisure. Where RedHat will lose update subscribers if there is the 'perception' that people aren't getting value for the money spent. The customer can be getting value, they just have to feel like they are not getting value for RedHat to suffer in this way.

Just my $0.02

EFGearman
---

Re:You know what I find funny?

[Zico]

What is it exactly that you're so baffled by? Just because you've never seen them only shows your ignorance, since they've been sending these out for years now. As far as being in an obscure place, where would you expect to find it? I always use the direct link to the bulletin list (www.microsoft.com/technet/security/current.asp), but if I didn't know how to find it, I think I might try www.microsoft.com/security. And whaddaya know, there's a web page there and the second link on the left is for the Security Bulletin service. How obscure. *ahem*

Re:You know what I find funny?

[sheldon]

Go to www.microsoft.com

Click on the link to the side that says "For IT Professionals"

There are Security Bulletins highlighted in the upper right hand side of the page. The ones discussed here are listed, along with a link that says "More".

Right on the top of that list is a link that says "Want to receive future security bulletins automatically?" You might want to click on that and subscribe.

Now for home users, they have the WindowsUpdate feature which easily allows you to download patches. Plus it also includes links to find out more information about the patch... these links go to the security bulletins again.

If Microsoft is hiding security bulletins, they are doing a piss poor job.

Re:You know what I find funny?

[gimpboy]

look look here

basically when you sign up with redhat you get to run up2date on one computer for free. nice for students.

Re:You know what I find funny?

[sheldon]

It's ironic they didn't make the website idiot proof?

Re:You know what I find funny?

[ahaning]

"For IT Professionals"?

Ha! According to the bulletin, the people that should be reading this are:

Customers using Microsoft® Internet Explorer

That's quite a few people. And consider the link you have to click on. Most users of IE probably don't consider themselves IT Professionals. Heck, some of them are afraid to remove icons from their desktop because it might break Windows.

You expect these people to:

1) Visit www.microsoft.com. That's the boring site. They want www.msn.com or www.hotmail.com (these would be much better places to put bulletins.)

2) Consider themselves IT Professionals. That means they have to be REALLY smart (yeah, sure).

Basically, it IS hidden, especially for people to don't think to look for these security vulnerabilities. Microsoft may consider posting these bulletins in more prominent places. However, as someone above pointed out, there are probably battles between Marketing and the Developers (developers developers developers developers....) about what to make easily available.

webpages designed for IE

[Lepruhkawn]

I find it hard to believe that someone on slashdot would complain about webpages designed for IE not working.

If MS security bugs encourages web designers to design gracefully degradable web pages, that's fine with me.

Of course there will be more buges reported in MS

[instinctdesign]

Just as a disclaimer, I'm not one to defend Microsoft is most cases. But what I think most people don't think about is that there have been so many bugs reported in MS software not only because MS releases naturally buggy software, but because the user-base is so huge that there is more of a possibility that these bugs will be found and in many cases used for unfortunately bad purpouses. If Linux/Mac OS/etc was the most widely used, you'd see much the same focus on problems with the software.

That said however, I don't care for MS and the majority of their software that I do use is out of necessity.

Corvair all over again?

[Anixamander]

I'm just waiting for him to declare Windows XP to be "unsafe at any speed."

Re:Corvair all over again?

[dattaway]

Reminds me of a .sig on the newsfroups:

There is more to life than increasing its speed.

Re:Corvair all over again?

[Erore]

Sorry, I wrote this rant and just wanted to put it somewhere. Your mention of Unsafe at any Speed made me think of it.It is a response to Culp's comments last month.

Code Red. Lion. Sadmind. Ramen. Nimda. In the past year, computer worms with these names have attacked computer networks around the world, causing billions of dollars of damage. They paralyzed computer networks, destroyed data, and in some cases left infected computers vulnerable to future attacks. The people who wrote them have been rightly condemned as criminals. But they needed help to devastate our networks. And we in the security community gave it to them.

By listing worms that attacked a variety of operating systems Culp makes it appear that the security threat is equal to all the players in the OS space. What he doesn't do is supply a severity to the listed worms that lets us see that the worst and most widespread of these attacks were against Microsoft systems. Microsoft's dominance in the OS space only increases their responsibility for security breaches, it does not justify their targetibility.

It's high time the security community stopped providing blueprints for building these weapons. And it's high time computer users insisted that the security community live up to its obligation to protect them. We can and should discuss security vulnerabilities, but we should be smart, prudent, and responsible in the way we do it.

What it is high time for is Microsoft to take security seriously. Their operating systems have always been about ease of use, not security. Just like passenger and baggage check in US airports are about hasslefree service. We have seen one consequence of the airports security measures, and that terrible act is the only reason airport security is increasing. Numerous reports in the past few years have pointed to the insecurity of passenger air travel, yet the airlines took no notice. Code Red may well be the clarion call to reconsider the importance of security in your operating system. If your current vendor isn't supplying it, perhaps you should look elsewhere.

Arming the Enemy

First, let's state the obvious. All of these worms made use of security flaws in the systems they attacked, and if there hadn't been security vulnerabilities in Windows®, Linux, and Solaris®, none of them could have been written. This is a true statement, but it doesn't bring us any closer to a solution. While the industry can and should deliver more secure products, it's unrealistic to expect that we will ever achieve perfection. All non-trivial software contains bugs, and modern software systems are anything but trivial. Indeed, they are among the most complex things humanity has ever developed. Security vulnerabilities are here to stay.

According to Ralph Nader automobiles in the 60's were unsafe at any speed. He blew the whistle, and the groundswell response led to drastic changes in the manufacturing of automobiles and the responsibility of those manufacturers for the safety of the cars after the sale had occurred. Fastforward 30 years and juxtapose Microsoft for General Motors and you can hear the whistle blowing. Despite Microsofts attempts to hide behind groups such as the DMCA consumers and lawmakers will not continue to put up with the security risks using Microsoft products make them vulnerable to.

If we can't eliminate all security vulnerabilities, then it becomes all the more critical that we handle them carefully and responsibly when they're found. Yet much of the security community handles them in a way that fairly guarantees their use, by following a practice that's best described as information anarchy. This is the practice of deliberately publishing explicit, step-by-step instructions for exploiting security vulnerabilities, without regard for how the information may be used.

Do not fear he who hath power to kill your webserver, fear he who hath the power to crack your server, steal your financial data and destroy your very business. Prior to a security fix or announcement of a vulnerability you aren't even aware that your system is at risk. The sooner information is released to the consumer, the sooner they can make a business decision as to which is the greater cost: the possibility of having their system cracked and data stolen, bearing the cost in dollars and man hours to move to a more secure system, or the business impact of shutting an insecure service down until the security bug is fixed.

The relationship between information anarchy and the recent spate of worms is undeniable. Every one of these worms exploited vulnerabilities for which step-by-step exploit instructions had been widely published. But the evidence is more far conclusive than that. Not only do the worms exploit the same vulnerabilities, they do so using the same techniques as were published - in some cases even going so far as to use the same file names and identical exploit code. This is not a coincidence. Clearly, the publication of exploit details about the vulnerabilities contributed to their use as weapons.

Again, who is it that we fear? The script kiddies who are all bark, but no bite, or the blackhats who have established user accounts on your servers and has your corporate network as their playground?

Good Intentions Gone Awry

Supporters of information anarchy claim that publishing full details on exploiting vulnerabilities actually helps security, by giving system administrators information on how to protect their systems, demonstrating the need for them to take action, and bringing pressure on software vendors to address the vulnerabilities. These may be their intentions, but in practice information anarchy is antithetical to all three goals.

These methods are only antithetical when you have a dominant market position that is dependent upon people perceiving your products as being easy to use, secure, and hassle free to maintain.

Providing a recipe for exploiting a vulnerability doesn't aid administrators in protecting their networks. In the vast majority of cases, the only way to protect against a security vulnerability is to apply a fix that changes the system behavior and eliminates the vulnerability; in other cases, systems can be protected through administrative procedures. But regardless of whether the remediation takes the form of a patch or a workaround, an administrator doesn't need to know how a vulnerability works in order to understand how to protect against it, any more than a person needs to know how to cause a headache in order to take an aspirin.

Wrong. Providing the exact details of an exploit allows competent administrators or programmers to go to the source of a program or operating system and provide their own fix if none is available from the community at large or the creator of that program. Furthermore, a community made aware of an exploit is able to marshall its resources to provide a fix as soon as possible. Culp's position is only true in a closed source environment where the system administrator is nothing more than a mouse monkey whose idea of system administration and security are the point and click wizards provided by the vendor; or where the risk to customers of using vulnerable systems is weighed against marketing and PR concerns or the availability of programming resources and the cost of providing them.

Likewise, if information anarchy is intended to spur users into defending their systems, the worms themselves conclusively show that it fails to do this. Long before the worms were built, vendors had delivered security patches that eliminated the vulnerabilities. In some cases, the fixes were available in multiple forms - singleton patches, cumulative patches, service packs, and so forth - as much as a year in advance. Yet when these worms tore through the user community, it was clear that few people had applied these fixes.

Many people have faulted the patching process itself for the low uptake rate. Fair enough - we do need to make it easier for users to keep their systems secure, and Microsoft acknowledged this very point in a recent major security announcement. But if the current methods for protecting systems are ineffective, it makes it doubly important that we handle potentially destructive information with care.

One of my cars had a factory recall, some sort of problem with the CV boots. The auto manufacturer contacted me, on more than one occasion, to let me know that my car had a potential problem, where I could go to get it fixed, and they said they would bear the cost to fix my car. I'm not certain which one of the myriad of forms I signed when I purchased the car that signed me up for this protection plan, but it sure did work. In my 7 years of administrating Microsoft networks, the hundreds of products I have registered with them and the thousands of times I have visited their website, never once has Microsoft contacted me to let me know about a security vulnerability in the product they sold me. Making the fix available is not the same as notifying people that there is a problem and a fix.

Furthermore, like the boy who cried wolf, Microsoft products have so many vulnerabilities and the methods for keeping your systems patched are so time consuming that it can become a full time job just to keep on top of it. After awhile you just cry, "Enough!," I've got other things to do than babysit the Microsoft website to find out what the latest vulnerability is. I've subscribed to Microsoft Security alerts, and typically I have found them to be late in notifying me of problems and so filled with PR that it was hard for me to asses to true risk to my systems.

Finally, information anarchy threatens to undo much of the progress made in recent years with regard to encouraging vendors to openly address security vulnerabilities. At the end of the day, a vendor's paramount responsibility is to its customers, not to a self-described security community. If openly addressing vulnerabilities inevitably leads to those vulnerabilities being exploited, vendors will have no choice but to find other ways to protect their customers.

A very good point Culp, vendors must find other ways to protect their customers. What Microsoft has been doing is not sufficient. The whistle has been blown, the users hear it, and they know that Microsoft has not had their best interest in mind. If Microsoft had, they would have found ways to contact users of vulnerabilities and given users incentives to patch their systems.

Responsible Handling is Key

This is not a call to stop discussing vulnerabilities. Instead, it is a call for security professionals to draw a line beyond which we recognize that we are simply putting other people at risk. By analogy, this isn't a call for people for give up freedom of speech; only that they stop yelling "fire" in a crowded movie house.

"Fire" is not being called in a crowded movie house, a fire alarm is being pulled and people are making an orderly egress. The egress is to Apache, Linux, Solaris, and FreeBSD. I'm grateful for that fire alarm, without it I would have found myself surrounded in flames created by blackhats while a Microsoft infomercial drones on the screen telling me, "There is no fire." I've got news for you Mr. Gates, this isn't the Matrix, and we are not all plugged into your grand scheme. Some of us see where you are taking us not just today, but tomorrow, and we're going to stop you.

Most of the security community already follows common-sense rules that ensure that security vulnerabilities are handled appropriately. When they find a security vulnerability, they inform the vendor and work with it while the patch is being developed. When the patch is complete, they publish information discussing what products are affected by the vulnerability, what the effect of the vulnerability is - that is, the type and extent of damage that an attacker could cause through it - and what users can do to protect their systems. This type of information protects users by giving them the information they need to decide whether to apply the fix, but it doesn't put them at risk.

Baaahhhh! Sheep, that is what Microsoft wants for customers. Users who blindly follow them to the slaughter house. But, shepard Microsoft can't even protect us that long. The wolves circle and pick off the sheep one by one. Meanwhile, the lead sheep watch what is going on in the slaughterhouse and they are told by the shepard not to tell the other sheep. Such information would cause a panic in the fold and desertions so great that Microsfts stock price would fall into a irretreivable spiral.

Some security professionals go the extra mile and develop tools that assist users in diagnosing their systems and determining whether they are affected by a particular vulnerability. This too can be done responsibly. In many cases, it's possible to build a tool that performs non-destructive testing and can only be used by a legitimate system administrator. In other cases, the specifics of the vulnerability make it impossible to limit how the tool could be used - but in cases like these, a decent regard for the well-being of the user community suggests that it would better to not build the tool than to release it and see it misused.

I repeat, those who use open source can always go the extra mile, and at the least, patch their own systems.

What You Can Do

Ending information anarchy will not end the threat of worms. Ethics and intelligence aren't a package deal, and some of the malicious people who write worms are quite smart. Even in the best of conditions, it will still be possible to write worms. But the state of affairs today allows even relative novices to build highly destructive malware. It's simply indefensible for the security community to continue arming cybercriminals. We can at least raise the bar.

What is indefensible is Microsoft's lax security throughout an entire series of Windows operating systems, office suites, and back office products. I once heard a joke that Microsoft was in a uproar because they found a virus that Outlook was not susceptable to; the company vowed to quickly rememdy that situation. The best jokes are baised upon some truth, and this joke was very, very funny. Security warnings do not arm cybercriminals, security holes do. Once again, do you really think the most malicious of crackers out there don't know and take advantage of security holes before they are announced? Of course those crackers know, and the sooner the user knows the sooner they can do something about it.

This issue is larger than just the security community. All computer users have a stake in this issue, and all of us can help ensure that vulnerabilities are handled responsibly. Companies can adopt corporate policies regarding how their IT departments will handle any security vulnerabilities they find. Customers who are considering hiring security consultants can ask them what their policies are regarding information anarchy, and make an informed buying decision based on the answer. And security professionals only need to exercise some self-restraint.

My company can adopt a corporate policy that only open source software will be used for all mission critical systems because only open source has a proven track record of quick security fixes. Instead of worrying about a security consultants policy on security disclosures, a customer would be better served by keeping security in mind when evaluating software solutions. First avoid the obvious danger.

For its part, Microsoft will be working with other industry leaders over the course of the coming months, to build an industry-wide consensus on this issue. We'll provide additional information as this effort moves forward, and will ask for our customers' support in encouraging its adoption. It's time for the security community to get on the right side of this issue.

The security community has always been on the right side of the issue, it is Microsoft who has not. Even now they are trying to sway others to their position instead of adopting that held by the long standing security community.

Re:Corvair all over again?

[ivan256]

I have yet to see a root level exploit in windows that has lasted even near as long before being patched.

I'm sorry, but a bug that is found today in NT 4.0or 2000 has most likely been around since the product came out. You're trying to say that Windows bugs don't exist until someone finds them, but Linux bugs are retroactive since the version that they are in came out. Compare apples to apples.

When the root exploit was found in Linux, the patch was available the very same day. Microsoft can't get a security fix out and tested with "a few days of work". They have hundreds of well paid programmers Linux is written by loosely tied mostly unpaid volunteers. You need to get the wool out of your eyes.

Re:Corvair all over again?

[Florian Weimer]

Interesting read, thanks.

For what it's worth, here is what I wrote after I read Culp's essay for the first time:

I agree that some aspects of the current computer security community are quite strange. A few parties have indeed conflicting interests: They sell products which wrap around other software in order to enhance its security (from a purely methodological point of few, a questional practice in itself). In addition, these parties discover and analyze vulnerabilities (sometimes in very great detail), and they are clearly benefitting from the recent Microsoft worm craze.

However, a few of Scott Culp's arguments are slightly wrong and do not reflect reality. For example, he claims,

the publication of exploit details about the vulnerabilities contributed to their use as weapons.

Is this really true? And if it is, could it have been avoided? After all, an attacker knows which components are vulnerable (just by reading the vendor announcement), and he or she can compare the machine code of the vulnerable and fixed versions. Of course, the recent worms didn't show a very sophisticated design. But it is really reasonable to expect that the attackers of the future are unable to retrieve the necessary information from a few pieces machine code?

In addition, we should remember that the most visible worms were targeting closed-source, proprietary systems. By the same argument, operating systems based on free software would be facing a tremendous amount of worm-based attacks because it's much easier to write these worms based on the publicly available information. However, there is no evidence supporting that, and this is very unlikely that this is just caused by different market shares.

Furthermore, Culp questions the usefulness of detailed information on vulnerabilities to administrators:

Providing a recipe for exploiting a vulnerability doesn't aid administrators in protecting their networks.

I whish this were true, but I have seen circumstances under which additional information is essential, even for system administrators:

• Vendors do not release complete information. Over and over again, products are not mentioned, either due to neglect or because they are no longer officially supported.
• Vendors release vulnerable versions after a vulnerability has become known, and after public authorities (such as CERT/CC) have stated that these vendors do not ship vulnerable versions of the software.
• New vulnerability types might exist in a wide range of software from different vendors, even though they do not share common code.
• If code is shared, some vendors respond faster than other ones. No vendor information might be available for some products.

This means that responsible system administrators have to check their system themselves in order to be sure that they are not vulnerable.

Unfortunately, closed, automated tools do not help much in this context, at least without partly re-introducing the concept of full disclosure. Past experience suggests that the vulnerability has to be actually tested in order to minimize the number of false negatives. Our main concern are remote buffer overflow vulnerabilities, and even if such a testing tool is closed-source and does not contain any actual exploit code, it is not too difficult to snoop the network traffic, insert the appropriate exploit code, and try the result on some victims. In addition, testing tools require time to write and distribute, which is unacceptable in most cases. (Usually, the attacks start after the first advisory has been released, the Microsoft worms are rather exceptional in this regard.)

But my favorite argument is the following one, which has been rehashed in many, many different contexts, most of the time suggesting that software vendors should be exempted from responsibility for the consequences of using their products:

All non-trivial software contains bugs, and modern software systems are anything but trivial. Indeed, they are among the most complex things humanity has ever developed. Security vulnerabilities are here to stay.

Nearly error-free software exists and is in wide use, but of course not in the general-purpose computing business. There are no technical reasons (or even mathematical ones, such as Goedel's Incompleteness theorem) for software being faulty. There is complex software which is believed to be close to zero defects, and Donald E. Knuth has shown with TeX that it is possible to write such software for use on workstations even if it uses tricky algorithms and it is fairly large. Poor software quality has different roots, many of them related to business models which force vendors to continuously release substantially different software versions, in order to generate a constant revenue stream from customers upgrading to the newest version.

In addition, there is no evidence that the security vulnerabilities exploited by the worms were related in any way to the overall complexity of the system. If we look at typical buffer overflow problems in free software (for obvious reasons, we can't do that with Microsoft software, but there is no indication that Microsoft source code is entirely different), these problems are local problems in most cases, which could be caught automatically by using different software construction tools, often obvious from local code inspection, and a local fix was usually sufficient. If software shows buffer overflow problems because of its overall complexity, something is very wrong.

Indeed, security vulnerabilities will not disappear soon, but not because of fundamental technical problems. And even if complexity starts to become an issue, why not reduce complexity, then? Security vulnerabilities are going to stay simply because too many people accept them.

(And, by the way, like Windows and Solaris, Linux is a trademark, and since we aren't talking about the kernel alone, we should probably call this operating system "GNU/Linux".)

Re:Corvair all over again?

[SirSlud]

> your arrogance is exactly what causes CIOs NOT to go to open source...

And CIOs who don't do things because of the percieved 'arrogance' of a community as projected onto all of its members (especially considering that CIOs rarely have to interface directly with that community but rather delegate his/her employees to work with such and such tools) is exactly what causes software developers and engineers to think CIOs are morons. It's a two way street. ;)

Actually, that may also sound trollish, but I do FreeBSD at work, w2k at home, so no trolling intended. I just like to flip things around.

Actually, as a developer, I think it's important that these exploits get distributed in a step by step case. Why? Because history proves humans are only proactive when they /have/ to be. MS's software is sometimes a little 'holey' because they have enough market share such that they really dont have to worry /too much/ about security. Their policy for updates is: 'the less you know, the less you need to do about it! the less you need to weigh your alternatives, cause you don't have any! boy, don't we make your job easy!'.

Microsoft is living proof of:

'People hate it when you make them think, but they love it when you make them think they're thinking.'

Giving you source forces you to think: "Everyone knows how to get into my system, so is it really worth leaving it up?" That should always be the right question to ask, if you are managing security. You should always weigh against the worst case. In fact, this forces you to accept that worst cases DO HAPPEN, and makes sure you never have your eggs all in one basket from an infrastructure and business process perspective. If you are truely locked into some system, and cannot live, at all, with it down, you've done something wrong.

Keeping the source from you forces you to ask: "Boy, how easy would this be for coders to recode somewhere else in an original form from the bullitens description, and might they target me? maybe?" You'd have a nice simple anbigous problem to solve, and I'll bet 9 of every 10 CIOs would rule in favour of the customers needs at the risk of security, just because they cannot devine how serious or easy the exploit is, and thus whether or not its worth unplugging mission critical stuff until there is a fix available.

By endorsing a single-path process (being 'just wait for us, dont worry your pretty little head'), they put their own customers at risk. As a CIO or technology manager, your bottom like is the WORST CASE scenario. If the guy who discovers the vulnerability doesn't distribute the source at large, but secretly distributes it to one or two black hats, what good does Microsoft's proposal do you? None. By distributing the code, you force the worst-case on everybody, and thats about the only way you get everybody to actually do something.

For chist sakes, books which describe how to build dynamite are available at your local library. Do you accuse the authors for every TNT related explosion? Of course not .. instead, this empowers /everyone/ to be able to make TNT, thus putting the blame where it truely belongs: the malicious exploiter.

Heck, its not even out of the question that some bitter MS employee internally takes the source to an exploit and distributes it secretly to black hat. You simply cannot control information, so it's best to empower everyone with it so that you're on the same playing field as the script kiddies or the well connected black hats.

Anyhow, it really comes down to accountability IMHO. Non relased source code allows CIOs or admins to justify not taking action because 'no one had the source and MS hasnt done anything about it yet'. Honestly, thats what I think.

Re:Corvair all over again?

[scrytch]

(And, by the way, like Windows and Solaris, Linux is a trademark, and since we aren't talking about the kernel alone, we should probably call this operating system "GNU/Linux".)

Linux is a trademark of Linus Torvalds. GNU/Linux is a trademark of nobody. Despite Linus's strident claims to be disinterested, if you want to point at an official term, it's the one Linus owns.

I run cygwin. Does that make it GNU/Windows?

California also says

[sulli]

"fuck you" to MS/DOJ. Gillmor's piece is pretty good:

"California deserves special credit for its stance. Bill Lockyer, the state attorney general, has emerged as the most important public official in America when it comes to holding back the Microsoft tide."

Re:California also says

[Amazing Quantum Man]

As a proud Californian, I'm willing to admit that the MA Attorney General (who's name escapes me) deserves a heck of a lot of credit too.

Re:California also says

[Rupert]

I wonder if Mike Hatch (MN Attorney General) is going to have time to pursue Microsoft now that he's also suing baseball.

My preferred solution: break Microsoft into 28 operating companies. Give one to each MLB owner. Let Bill & Steve run baseball. Benefits of this solution are that baseball still gets run like a monopoly, but by people who are good at running a monopoly, and baseball comes with a built-in anti-trust exemption. Microsoft goes down the tubes, just like baseball has been doing for years. And best of all, programmer salaries get to match those of baseball players.

Re:California also says

[joshwa]

That would be Tom Reilly.

Re:California also says

[re-geeked]

As a Minnesotan who applauds Hatch for both stances, and would gladly cross the street to spit in either Gates' or Selig's eye, I must offer my congratulations.

Ironically, the Twins are being singled out because Minnesotans refused to buy a forced upgrade -- a stadium.

Does that make the Saints=Linux in this analogy?

Keeping bugs a secret..

[b-side.org]

Firestone tried it, and, while software bugs might not kill people, they certainly do some damage. What did it cost them, $41.5M?

How are software bugs, especially critical ones, different from design flaws in a tire?

Re:Keeping bugs a secret..

[Anonymous Coward]

Your PC case doesn't roll over and kill 3 of your family members when the OS blows out.

Re:Keeping bugs a secret..

[SteveX]

If there's a flaw in your car tire, then you know your car tire may blow out and hurt you. Increased distribution of the information lowers the risk (people may change the tires, stop driving it long distances etc).

If there's a security hole in your OS, increased distribution of the information will do MORE damage (unless you believe that everyone that hears the information will immediately patch or repair their servers themselves - since if the info is distributed before a patch is available, then the vendor can't help you yet).

Big difference - bad analogy.

- Steve

Re:Keeping bugs a secret..

[gmhowell]

While I agree with the sentiment, the logic is faulty. The tires resulted in deaths. To my knowledge, nobody has been killed by a BSOD.

(Of course, there is also some evidence that the drivers were at fault at least as much as the tires. And, there is the argument that microsoft has done vast economic damage to the country, including government and other businesses. But I don't think either of these really has to do with your question.)

Re:Keeping bugs a secret..

[innocent_white_lamb]

It's not like the nuclear power plants run Windows.

I wouldn't be terribly surprised to discover that some water treatment plants run on Windows. I know of one fairly-sizable town whose water treatment plant runs on Macintosh, believe it or not.

Think Walkerton, Ontario, for the consequences of a screw-up in a water treatment plant.

Re:Keeping bugs a secret..

[theancient2]

Is it necessary to publish details on how precicely to exploit the problem? That much info isn't necessarily going to help system admins. All they really need to know is: here's what the problem is, it's caused by a problem in this area, here's some things you can do to reduce the risks. If nobody else has found the bug yet, could it possibly hurt to withold the details for another few days until a solution is available? Is it worth giving the information to all of the people of questionable intentions at the same time? The vast majority of the population does care about this kind of thing. They'll get the patch when Windows XP downloads it automatically for them. By pubilshing this information, you may be helping out a tiny number of people, while putting a much greater proportion of the population at risk.

I seriously wonder if the people publishing these exploits are mainly interested in indirectly harming Microsoft by giving hackers instructions on how to wreak havoc on Microsoft software.

You wouldn't expect Microsoft (or any other company for that matter) to publish details on how to exploit their software before a patch was available. That would be irresponsible. So why is it so wonderful for other people to do it, except that you like seeing Microsoft suffer? Not to mention all of the innocent people who are affected by the problem because someone decided to hand out loaded weapons to every 12 year old hacker on the planet. Thanks, but I'll do without this kind of "community service."

Re:Keeping bugs a secret..

[prizog]

software bugs might not kill people

Wrong!

Re:Keeping bugs a secret..

[jimbolaya]

I'm a software engineer, and I appreciate when bug report includes step-by-step instructions on how to reproduce a bug. Two reasons for this: One, so I can find the bug, and two, so I know if I have indeed fixed the bug. If I repeat the step, and the program no longer fails, it's likely that I've fixed the thing.

So, the step-by-step instructions for an exploit can be looked at as a bug report (I'd argue that is exactly what they are) that the responsible company can use to find and patch the bug, and that a sysadmin can use to verify that the patch was correctly installed (using due caution, naturally).

Re:Keeping bugs a secret..

[SteveX]

The analogy is flawed because, in the case of the tires, keeping the information a secret will result in more deaths, while in the case of exploits, keeping the details secret will (generally) lead to fewer incidents.

There have been plenty of cases where vendors have found the holes themselves and released patches. According to your logic the vendor should say "There's a hole in our product; here's how to exploit it; we don't have a fix yet" even when there have been no known exploits.

Again.. it's not possible for more death to occur by telling people that the tires are flawed.. It is possible for more exploits to happen with full disclosure.

I'm all for full disclosure once a patch is available, and I'm all for full disclosure after a fairly aggressive time allowance for the vendor to come up with a patch (like, two weeks). I'd also go for full disclosure once there's a well known exploit in the wild - but if I find a vulnerability and report it to Microsoft, I think the correct thing to do is wait until Microsoft releases a patch before telling the world about it.

Re:Keeping bugs a secret..

[tcc]

>Your PC case doesn't roll over and kill 3 of your family members when the OS blows out.

Not true... when IE freeze on that specific p0rn site and your wife comes in the room at the same time, and CTRL-ALT-DEL doesn't work anymore (ahhh life's unexpected coincidences), and you're too slow to reach the reset button... tell me where the case/keyboard/monitor ends? If it doesn't kill you... you'd wish it did :)

that last one is NOT a hole in windows.

[turbine216]

And finally, MS wishes their new disclosure rules were used for yet another huge hole in Windows.

If you read the security bulletin, it's not referring to windows at all. It's a problem with Internet Explorer version 5.5 or later.

Seems that that little slip exposes a great deal of anti-M$ bias. Not good for a supposed "news source".

Re:that last one is NOT a hole in windows.

[avdp]

ahhh... but Microsoft claimed in court that IE could not be removed from Windows so this is indeed a security hole in Windows.

Unless... *gasp* you're calling Microsoft a liar and telling us that IE and Windows are indeed two separable products?

Re:that last one is NOT a hole in windows.

[turbine216]

right, and Gates also claims to be singularly responsible for the invention of DOS. But you and i both know that that's bullshit.

IE can certainly be removed from windows. I've done it several times. It's a huge pain in the ass, and it's not something that the average user-at-large would want to consider doing, but it can be done. So to put it bluntly, IE != Windows.

Re:that last one is NOT a hole in windows.

[turbine216]

please. I hate gates as much as anyone. He and his company are the very thorns in the side of technological progress, as far as I'm concerned. But the one thing that I hate nearly as much as a megalomaniacal CEO and his oppressive corporation is BIASED NEWS. It's not news if it's got prejudice built into it...it's propaganda.

Re:that last one is NOT a hole in windows.

[gergi]

the point is... MICROSOFT said IE could not be taken out of Windows. It is an integral piece of Windows according to Microsoft. So if an integral part of Windows has a bug, Windows has a bug!

Of course, If IE can be removed from Windows, Microsoft has lied before the courts.

Either way, Microsoft is either lying or has another bug in their OS. Which way would you like to have it, Mr Gates?

Re:that last one is NOT a hole in windows.

[turbine216]

I beg to differ. For example, about 90% of the machines here at the Environmental Protection Agency are running Windows 98SE, with IE 5.0.

Here's a headline for you: NONE OF THEM ARE VULNERABLE TO THIS EXPLOIT..

Since you can hardly begin to argue that 98SE is not current (it makes up at least 50% of Windows installations, and that's certainly and underestimate), then it is reasonable to say that WINDOWS does not have a flaw. Only after the introduction of IE 5.5 or higher does the vulnerability surface.

I realize that my opinion on this matter will not be popular, since the majority of slashdotters favor open-source operating systems. However, this is still a NEWS site, and it can only remain that way if the NEWS is unbiased.

Re:that last one is NOT a hole in windows.

[cavemanf16]

And to add to this claim: Yes, there are programs like 98lite that can 'get rid of' IE, but it's obviously not something the Microsoft team decided to include in their own software.

Besides, I've set Mozilla to be my default mail and html program, and that works great, as long as I don't have any instances of IE open on the desktop at the same time. As soon as you open one IE window, Windows decides that it should open ALL webpages in IE instead of mozilla, like I've told it to do on ALL occurrences of running across HTML files and links people post to IM clients, programs, etc. So I completely agree, it's a Windows problem, not just an IE problem. What's funny is that despite warning people how active scripting can cause problems without having all the appropriate security patches installed, they're displaying this info with an .asp page! Now that's what I call a short attention span.

Re:that last one is NOT a hole in windows.

[tb3]

It's a problem with Internet Explorer version 5.5 or later.

Not necessarily. The Microsoft Security Bulletion states, "Previous versions are no longer supported, and may or may not be affected by these vulnerabilities."

So you're screwed if you upgrade, and you're screwed if you don't.

(Safly posted from Mozilla 0.9.5.)

Re:that last one is NOT a hole in windows.

[turbine216]

you're absolutely wrong.

I clearly pointed out that the problem is not a part of windows, as it is not a problem until IE is introduced to the mix.

Re:that last one is NOT a hole in windows.

[turbine216]

And how does a bullshit claim from microsoft negate the fact that IE can definitely be removed from windows?

Re:that last one is NOT a hole in windows.

[1010011010]

I'll jump in, too:

Microsoft has stated under oath that IE is a necessary component of Windows. They want us to buy into that reality.

So, a bug in IE is a bug in Windows. Or Bill Gates is a liar and a purjurer. Which is it?

Re:that last one is NOT a hole in windows.

[1010011010]

It's Microsoft's own bias/propaganda in the news story, then: they are the only ones claiming that IE is an integral part of WIndows. So they announce a security hole in IE, which is an integral part of Windows, therefore there's a new hole on Windows. It's all very simple. Why should the public let MSFT or its apologists claim that, on the one hand, IE is an integral part of Windows, and on the other, that it's not? It has to be one or ther other. Pick.

Re:that last one is NOT a hole in windows.

[jcostom]

Oh bite me. I guess you didn't notice that several of us had the same thought at the same moment and posted a response to the nitwit who started the thread, huh?

Mod me down for thinking? Yeah, bite me.

Re:that last one is NOT a hole in windows.

[donutello]

How does this get modded up as insightful? Microsoft is either lying about IE being part of Windows or this is a Windows bug. They can't possibly be wrong on both counts. Pick ONE count on which you'd like to hang them and stick with that.

Re:that last one is NOT a hole in windows.

[avdp]

hmm. no. You can't - looking at it right now.

And don't forget...

[Anonymous DWord]

The Register, and How Microsoft invented open source, by Billg

Re:And don't forget...

[ksheff]

Gates is still full of it. Open source/free software didn't start because of commodity PCs. Sure having them helps get more people involved, but to claim that MS is responsible for that is ridiculous. How many different CP/M machines were available at the time? That was the standard for business micros before their purchased 'quick & dirty OS' hit the scene. The only reason their crappy software took off was due to it being cheaper and having IBM associated with it. It's just like his different revisions about how MS found out about the internet. Given enough time, I'm sure he'll be talking how it was another MS innovation. A couple years ago, he was talking about how "we are at the beginning of the internet". Sounds like he's a decade or two off to me.

What I got from the story was that Bill's pissed that he can't legally lift GNU code, sell it, and then claim it was their 'innovation'. IMHO, the only standards that MS likes are those that lock in customers. He also misstate's the FSF's purpose. They don't want to eliminate programming as a profession. They want to give the user freedom. As a side effect, companies wouldn't be able to generate the obscene profits that MS enjoys, which is why Bill dislikes it. As crazy as he sounds at times, on the issue of copyrights and other related topics, I think RMS is probably more in like with Thomas Jefferson and other Founding Fathers than Gates, Rosen, et al could ever hope to me. Which makes me think: if he were alive today, would Jefferson view Gates & company as good candidates for Liberty Tree refreshment?

I can't read the details of the security flaw

[Genaro]

because I disabled scripting.

Yes. You need scripting in order to get details of the security hole. On the other hand they recommend you to disable scripting.

Odd.

Yes. I have to use Windows at work.

Yes. I could use Mozilla.

Re:I can't read the details of the security flaw

[jmv]

Yes. You need scripting in order to get details of the security hole. On the other hand they recommend you to disable scripting.

It's the new MS security policy: "if you can't read this page, you're not vulnerable"!

Re:I can't read the details of the security flaw

[Billly Gates]

Moderators change the score 5: interesting to Score 5: funny. Yes I know he was serious and informative but on the other hand it is quite funny.

Re:I can't read the details of the security flaw

[micromoog]

Yes. You need scripting in order to get details of the security hole.

This is just not true. The author of the post is lying to try to be cool.

Re:I can't read the details of the security flaw

[Florian Weimer]

In addition, it seems that you have to connect your Windows XP box to the Internet in order to install security upgrades. Yes, to the Internet, you cannot download the upgrade files on a host which is not vulnerable and then transfer it to the vulnerable one (for example, over your internal network).

I wonder when Microsoft starts shipping security upgrades to their registered customers via snail mail. In the past, when I was young, I did use Microsoft products, and I received a problem notification only once: Microsoft told me not to install some kind of Access update because it would shred my databases (not that I'd used Access for any serious work). Pretty weak, because they advertised the benefits of being a paying, registered customer very aggressively (you would get support, updates, and so on, the usual story).

Microsoft is collecting enormous amounts of data about their customers. Perhaps it's time to use it not just for marketing (and perhaps scaring people off from copying their software), but for notifying customers that there are severe problems with Microsoft programs.

Re:I can't read the details of the security flaw

[hackman]

After making their reccomended changes I can't use
Windows Update either. Very interesting, how ironic that MS stuff is these days.

Re:I can't read the details of the security flaw

[Pseudonym]

...and why isn't microsoft.com in your trusted zone, hmm? Don't you trust them or something?

Nader has credibility

[Tassach]

For better or worse, it's good to have a high-profile individual like Nader get involved in this. While anyone can file a letter during the public commentary period, or an amicus curae brief (if they have a valid interest in the outcome of the case), judges are more likely to pay attention to comments that come from respected public figures than they are to listen to J. Random Public. At least his letter will be read by the judge herself, instead of just being skimmed by a junior clerk and tallied up in the appropriate columns.

Of course, Nader's stance at the far left at the political spectrum could hurt things if the judge has right-wing leanings (as appears to be the case). At least Nader isn't as rabid as RMS. As much as I admire his commitment and idealism, RMS's uncompromising attitude and abrasive personality could do more harm than good. (Also, RMS's reputation is pretty much confined to geeks, whereas Nader has mainstream recognition.)

Re:Nader has credibility

[snarfer]

could hurt things if the judge has right-wing leanings

It strikes me how much we all seem to be recognizing that the courts now operate based on their political leanings instead of the foundation of law.

Re:Nader has credibility

[Pathetic Coward]

Credibility? High profile? Nader is about the most hated man in political life; no Democratic politician, consumer group, conservation group, et cetera will return his calls now.

Re:Nader has credibility

[re-geeked]

A deplorable fact which, when combined with the fact that this judge is a Clinton appointee who seems perfectly willing to roll over for MS, makes one wonder if "right" and "left" have been replaced by "for sale" and "not for sale".

Re:Nader has credibility

[Ian Bicking]

Maybe you meant right and left were replaced with "for sale" and "for rent".

Re:Nader has credibility

[Malcontent]

The fact that Clinton appointed her really has nothing to do with it. Judges often hide their political beliefs and sometimes presidents will appoint judges that lean (slightly) to the other side to play games with congress. Also judges sometimes become more radical after they have a permanent post.

All in all it's a sick state of affairs in this country. The political party you belong to has just as much impact as the facts of the case if not more.

Alternate Plan - Security Escrow

[dpilot]

OK. Let's let Microsoft keep their security flaws secret. Do any of us think that will really work?

Part2: The flaws do need to be placed in 'escrow' in a secure database, with a planned release date, perhaps 6 months after first notice.

Then let's see if the situation is better or worse. After all, Code Red exploited a months-old hole, which could have been discovered by monitoring Microsoft's own update pages. Somehow it doesn't seem to me that the course of the Code Red mess this Summer would have been affected in the least by Microsoft's proposed policy.

Or do they consider publication of a bugfix tantamount to 'Security Anarchy', because it lets others know that a hole exists?

But the real goal here should be that we want to keep Bugtraq and the like alive for our own use. Let Microsoft mess their own sandbox, just don't mess ours.

Quote

[MouseR]

Microsoft says it's "irresponsible" to expect them to get a patch out for a critical flaw within "a few days"

Are they referring to the recent release of XP?

Re:Quote

[emissary47]

> Are they referring to the recent release of XP?
yes! the whole product is a "critical flaw" ...

have a look at the movies here
(the "DanceMonkeyBoy" mpeg, explains it all) and you stop wondering about microsoft ...
(first i thougt the steve balmer movie was from an psychiatrist ... but it wasnt) ;)

Re:Quote

[BluedemonX]

Dude, that looks more like a wrestler promo from a really bad indy outfit somewhere in rural Quebec.

WOW.

Tony Robbins he ain't.

Re:Quote

[Fesh]

Holy living waffle iron. I think that's the most disturbing thing I've seen in years. And I read PLIF. *shudder*

Thanks Ralph

[Drath]

Thanks Raplh, this is why I voted for you.

Also I like seatbelts.

Oh really?

[Mr. Sketch]

Microsoft says it's "irresponsible" to expect them to get a patch out for a critical flaw within "a few days"

Funny, Open Source software can have a patch out within a few days, why can't Microsoft?

Re:Oh really?

[gmhowell]

Let me play devil's advocate (seriously):

Yes, you can get a patch to kernel 2.foo very quickly. But it can take weeks/months for RH to get a package out. Perhaps M$ can get the code fixed, but not quickly send out a package (and in some ways they do. They send out hotfixes, and only later service packs).

Why? In both instances, the companies have to make sure that by fixing one problem, they don't create several others.

So yes, you can get quick fixes to Samba, the kernel, etc. But it takes time for commercial vendors to roll out the patches.

(And, having said all that, I used to use Progeny, and am switching to Debian. They get out patched packages really damned fast.)

Re:Oh really?

[tb3]

Mod Parent Up!

The details of this story are staggering. Microsoft take days to look into the problem, threatens the discoverers in order to cover it up, blames the discoverers when it does hit the fan, and finally say that it will take weeks to produce a patch!

No wonder they want everything suppressed. They're hiding their own incompetance!

Re:Oh really?

[Number6.2]

Because, deep down inside, Microsoft is trying to figure out a way for you to pay for the fix. It would be "irresponsible" of them to release anything of value without extracting money for it.

Is it a "bugfix", or is it a "feature upgrade"? Know what the difference is? Oh ye$$$$$$$....

Here's an ugly one

[Anonymous DWord]

SF Gate has an article about how the states are "sabotaging" the settlement:

Why are they asking the court to derail the settlement, effectively guaranteeing that the case won't be resolved for years? The state attorneys general claim the high ground as defenders of consumers, but it is hard to see what consumers of software would gain in prolonging this legal agony.

Uhh, ok...

Re:Here's an ugly one

[Znork]

Hmmm... I wonder if the SF Gate checked if Sally C. Pipes was actually a living person or if it was the good old send-grassroots-letters-from-the-dead tactic.

Re:Here's an ugly one

[tb3]

My guess is real, but with a hidden agenda. A quick search turns up the Pacific research Institute, a Libertarian think tank. So, they'd be against any form of government 'interference' and very pro-Microsoft in this instance.

Personally, I like Berke Breathed's take on libertarians, "I'd be a libertarian if they weren't all a bunch of tax-dodging winers."

security software

[whiteben]

Perhaps the scariest line in the securityfocus.com article is this one:

The bylaws will also include an agreement that any security software produced by members of the group will be engineered in such a way that it can only be used for lawful purposes.

Yet again, we have a software usage agreement that restricts the types of things for which the software can be used. This is silly and ironic. If some sort of authority were set up to police the observance of this, we'd be a huge step closer to the scary world RMS describes in the famous essay set in a (hopefully) fictional future. Without such an authority, MS and friends would essentially be relying on the honor system which it hates so much.

I guess that MS and friends would rather have the sense of security they get from restrictive user licenses and the like. Folly.

BEN

Re:security software

[elmegil]

any security software produced by members of the group will be engineered in such a way that it can only be used for lawful purposes.

If only Search Warrants and the other powers being expanded in the name of Anti Terrorism could be engineered in such a way....

Re:security software

[j7953]

The bylaws will also include an agreement that any security software produced by members of the group will be engineered in such a way that it can only be used for lawful purposes.

Yet again, we have a software usage agreement that restricts the types of things for which the software can be used.

No, it's not a usage agreement. If you engineer the software so it can't be used for unlawful purposes, there's no need to have that in your license agreement or whatever. E.g. a software that checks whether an exploitable security hole exists but doesn't make harmful use of the exploit would be legal to publish because there simply is no way to use it for unlawful purposes.

The more subtle point here is that this goes directly against Free Software, because you can make sure that people will not build malicious software based on the code only if they don't have the code in the first place.

Re:Someone...

[geekoid]

If you weren't AC I would tell you where you can get them, where to find patches, and who to contact about getting a fix.

BBC Article

[calibanDNS]

The BBC also has an article today detailing some of the groups and corporations that are lining up to take on Microsoft on several different fronts.

They could learn from Apple...

[CokeBear]

Microsoft says it's "irresponsible" to expect them to get a patch out for a critical flaw within "a few days".

Pardon my french, but *bullshit*.

Apple released iTunes 2.0 on a Saturday night. When a major bug was found, not only did they pull the installer *immediately*, but they fixed the bug and had a new one up in its place (properly labelled 2.0.1) within 24 hours. Not only that, but they have also said that they will pay for DriveSavers recovery for anyone who lost data to the bug. Can anyone imagine MS responding that quickly? On a *weekend* even! (Or accepting responsibility for its bugs like that?)

Re:They could learn from Apple...

[Jagasian]

Can anyone imagine MS responding that quickly? On a *weekend* even! (Or accepting responsibility for its bugs like that?)

Note that I am a Debian Linux user, so I have no bias in favor of Microsoft, but come on, the real question should be "Can anyone imagine MS shipping a product with such a horribly-stupid-of-stupid-critical-lose-every-flaw as the recent iTunes 2.0 ultra-blunder?" Apple is no hero for bringing out a fix as fast as they did; simply because such a fix never should have been necessary in the first place.

I have seen Microsoft release products that do really stupid things, but I have trouble recalling the last time they released a music application that unnecessarily formats your harddrive. I mean, come on... MS is bad, but are they as bad as Apple? If Apple was as popular as MS, you would probably be singing a different tune about iTunes 2.0?

Debian Linux has a community run software testing process that would never let something like iTunes ship as "stable".

Re:They could learn from Apple...

[throx]

I agree that Microsoft (and any software company for that matter) should get patches out as soon as possible - especially "within a few days". At the very least, a workaround or protection measure that is somewhat more useful than just disabling Active Scripting should be posted within 24 hours.

Full disclosure should follow the announcement of a bug after 30 days or whenever a patch is released, as is standard practice on security mailing lists. Not having full disclosure hanging over a company's head allows them to become lax in protecting their customers which when it comes down to it for Microsoft is exactly what Scott Culp's job should be.

As for "Can anyone imagine MS responding that quickly?", yes. They responded in about 24 hours to the Ping of Death bug (IIRC). They were only beaten by the Linux devs who responded in about 8 hours.

To be fair though, the iTunes bug (which would wipe all your MP3s without any external provocation) and a IE bug (which requires a hostile site to set up the flaw) are in somewhat different circles. I wouldn't even make a comparison between a bug freshly released product and a bug in a browser that has been released and is in common use. Pulling the IE installer is really going to solve a lot of problems...

Apple has been fairly slow at fixing some of the security issues in OS X - many were just postponed to 10.1, so I wouldn't hold them up to being the paragon of truth and justice right now. Go look on their web site and see if you can find full disclosure on any of the problems of OS X...

Linux is even descending into the game of playing petty politics with security issues. Alan Cox should know a lot better than to play into Microsoft's hands the way he seems to be. Not announcing Linux flaws simply gives credence to Microsoft's current bad behaviour.

Re:They could learn from Apple...

[markmoss]

When a major bug was found, not only did they pull the installer *immediately*, but they fixed the bug and had a new one up in its place Excuse me, had a new bug up in it's place???

On the other hand, if it was Microsoft, the patch probably would be a new bug. 8-(

Re:They could learn from Apple...

[ivan256]

You're one of those people who thinks that every codepath should be retested if one of the developers changes a comment, aren't you?

Re:They could learn from Apple...

[1010011010]

"Can anyone imagine MS shipping a product with such a horribly-stupid-of-stupid-critical-lose-every-flaw as the recent iTunes 2.0 ultra-blunder?"

Yes.
My personal favorite is all the times that netlogon stopped working on an NT box, necessitating re-installation of NT. Installing and patching all the installed applications again was a lot of fun. Not.

Re:They could learn from Apple...

[Happy Monkey]

I have seen Microsoft release products that do really stupid things, but I have trouble recalling the last time they released a music application that unnecessarily formats your harddrive.

Well, the license for the latest release of Media Player claims the right to delete other software from your computer. Of course, it's not a bug - it's a feature.

As a former "black hat"

[CmdrTroll]

Back when I was in high school, I was a script kiddie. I would DDoS my classmates to show how k-RaD I was. I had an extensive network of trin00 and BO2k zombies at my disposal. It was fun. For a while.

The best thing I learned from my experiences as a skript kiddie is that BUGTRAQ, BoS, and every other sysadmin-visited list was the last to hear about new security flaws. Sure, on occasion, @stake or the ISS X-Force would come up with something novel. But the majority of the time, I would see sploits circulated by my Russian friends on IRC weeks before anyone even mentioned the vulnerability on BUGTRAQ. Consider the BIND 8.2.2-P5 flaw: I had the ADM sploit for it weeks before an advisory was even issued.

Stopping full disclosure won't hurt the script kiddies. It will hurt the admins, who won't have enough information to patch their source base to fix the problem. (As a FreeBSD admin with a good grasp of C, patching a security hole takes on the order of minutes now.) But it will help this cartel to keep privileged information to themselves, so that hapless admins like myself will not have the information we need to defend ourselves. And it helps Microsoft, who can honestly claim that their systems are more secure than UNIX when the UNIX admins can't defend themselves more quickly than the M$ admins can anymore. It's just capitalism at work.

-CT

Re:As a former "black hat"

[lildogie]

Maybe I'm naieve, but...

> But the majority of the time, I would
> see sploits circulated by my Russian friends
> on IRC weeks before anyone even mentioned the > vulnerability on BUGTRAQ....

> Stopping full disclosure won't hurt the script
> kiddies. It will hurt the admins, who won't
> have enough information to patch their source
> base to fix the problem.

Seems to me some reverse-espionage is in order. Last time I took a security course, it was recommended that a savvy security admin lurk in the dark areas, just to share the information XPerience earlier than the public.

Golly, a business-savvy person could even make money that way.

What Microsoft doesn't understand is that if black hats are trading the information, they can't really tell the white/grey hats from the black ones, over the internet connection.

Or can they?

Let's not be the pot calling the kettle black

[JoeBuck]

It is proper for us to reject Microsoft's attempt to keep its bugs secret. But this means that we must also reject Alan Cox's attempt to protest the DMCA by withholding discussion of security holes in Linux, under his false belief that the DMCA somehow forbids such discussion. We need to openly discuss our bugs. Otherwise we are, in effect, supporting Microsoft in their effort to stifle discussion.

Yes, the DMCA is a bad law, but it's not infinitely bad. It does not forbid discussion of bugs or circulation of patches for bugs; claims otherwise are based on confused readings.

Re:Let's not be the pot calling the kettle black

[ryants]

I think the difference between Microsoft's tactics of making customers slaves and ducking responsibility for their own products and Alan Cox's "civil obedience" protest is sufficiently clear that no parallel can be drawn between them.

Re:Let's not be the pot calling the kettle black

[Frater 219]

But this means that we must also reject Alan Cox's attempt to protest the DMCA by withholding discussion of security holes in Linux, under his false belief that the DMCA somehow forbids such discussion.

It is thoroughly possible that Alan's interpretation of the DMCA is wrong, and that yours is right. However, it is Alan and not you who is at risk if he is right. It is unseemly to chide him for refusing to take what he deems to be a serious legal risk, when you yourself are at no such risk.

I'm pretty sure that Alan's point is not that "discussion of bugs" in general is prohibited by the DMCA. It is that a bug in the permissions functions of a kernel could serve as a method of evading access controls -- and that dissemination of methods to evade access controls is prohibited.

Don't forget that Alan is not the only party at risk, either. Since he is employed by Red Hat in developing the kernel, Red Hat might also find itself liable. Indeed, Alan probably has the advice of Red Hat's lawyers in the matter. He isn't in a position to go against that.

Even if you are right and Alan is wrong, the matter serves as an able example of what the lawyers call a "chilling effect" upon speech. The DMCA is vague! The matter of whether Alan is at risk is unclear and contentious -- that's why we're having this discussion. In such an environment, people such as Alan and companies such as Red Hat are going to err on the side of excessive caution. Their speech will be "chilled", even if the risk is imaginary. That's part of why restraints upon speech are so dangerous.

Re:Let's not be the pot calling the kettle black

[Velex]

It is proper for us to reject Microsoft's attempt to keep its bugs secret. But this means that we must also reject Alan Cox's attempt to protest the DMCA by withholding discussion of security holes in Linux, under his false belief that the DMCA somehow forbids such discussion. We need to openly discuss our bugs. Otherwise we are, in effect, supporting Microsoft in their effort to stifle discussion.

Not at all. The way I see it, there are two things at work here.

1. As pointed out in other posts, Alan Cox is not the one censoring himself, but rather it is the DMCA, which has the enforcement of the entire populace of the United States behind it. That is what it means to make a law, to create a policy with the enforcement of every single individual in the country where the law was made. On the other hand, Microsoft is the one that is censoring itself, without respect for the DMCA, whether or not it applies to the bug as it did to the bugs that Cox refuses to discuss in a forum intended for United States audience.
2. More importantly, the intents of the actions are completely different and somewhat incomparable. When Cox refused to discuss security of the Linux kernel, he had two intentions:
   1. Cover his own ass from possible litigation from the people of the United States, represented by John Ashcroft.
   2. Drive a message to the people of the United States that the DMCA is a bad law, and they should seek its immediate repeal.
   On the other hand, Microsoft, while their intention is also to cover their ass, it's not from litigation and legal hot water, it's from their own bad PR. Microsoft isn't even trying to seek repeal of the DMCA, for obvious reasons. Whereas Cox was making a political statement, Microsoft is just trying to censor bad PR.

Therefore, it is right and consistent that we can hate Microsoft for censorship, and applaud Cox for censorship, because there are deeper levels and motives than simply censorship.

Critical Flaw

[Nitroshock]

Microsoft says it's "irresponsible" to expect them to get a patch out for a critical flaw within "a few days".

A Microsoft spokesman was later heard saying - "We didn't fix it in the first place, what makes you think we're going to now?"

From Ralph Nader's Open Letter

[libre lover]

From the open letter:

The agreement provides Microsoft with a rich set of strategies to undermine the development of free software, which depends upon the free sharing of technical information with the general public, taking advantage of the collective intelligence of users of software, who share ideas on improvements in the code. If Microsoft can tightly control access to technical information under a court approved plan, or charge fees, and use its monopoly power over the client space to migrate users to proprietary interfaces, it will harm the development of key alternatives, and lead to a less contestable and less competitive platform, with more consumer lock-in, and more consumer harm, as Microsoft continues to hike up its prices for its monopoly products.

To think that a man who ran for President "gets it" with respect to Free Software boggles the mind. As days go by I just keep feeling more and more vindicated for having voted for him.

Re:From Ralph Nader's Open Letter

[pi radians]

Comments like this are mind-boggling. I understand where you are coming from and all, but still, asking a citizen living in a democratic country to vote for his second choice (Gore) instead of Nadar is such an annoying comment.

You and all of your fellow Gore voters should have voted for Nadar.

What I just said is along the same lines of what you told us.

Just so you realize, it's not democracy if you say "You can vote for him or him, but not for that guy."

Ass.

Re:From Ralph Nader's Open Letter

[rjamestaylor]

As days go by I just keep feeling more and more vindicated for having voted for him.

And as the days go I'm glad you all voted for him instead of the fat, now-beared guy, too. Really.

Re:From Ralph Nader's Open Letter

[frank_adrian314159]

To think that a man who ran for President "gets it" with respect to Free Software boggles the mind.

And to think that most of the Neanderthals on Slashdot still think it the height of humor to castigate him as a loon. I don't want to be a troll, but I find it the penulimate irony that people who can wax rhapsodiacally over RMS bitch about the one nationally recocognized politician that seems to actually "get it" when it comes to Free Software.

The ulitimate irony is, of course, that anyone actually takes these Neanderthals seriously enough to bitch about it :-(.

I made my mistake in the last election by wasting my vote on Gore. Next time, it's Green all the way, baby...

Re:From Ralph Nader's Open Letter

[re-geeked]

I understood the consequences, in my case being that Gore would win Minnesota by a little less, and a third voice might gain some legitimacy and federal cash. Perfectly pragmatic (unfortunately it didn't come to pass).

Those consequences were not, by the way, that Gore lost. He did that his own corrupt self.

Pragmatism is necessary, but then assuming that "we can never challenge proprietary software" would have seemed pretty pragmatic before GNU, wouldn't it?

Someone has to be the wild-eyed idealist.

Re:Not to mention Apple . . .

[davebo]

. . . which managed to get an OS X root exploit patch released in just over a day.

But what do I know.

Something Amusing

[DarkZero]

As an experienced IE user, I immediately took the usual steps to get around IE vulnerabilities. I immediately turned off Active Scripting (it was a blunder on my part that it wasn't disabled, because I didn't know IE6 had added THAT MUCH new stuff), and then went to Windows Update...

You can't go to Windows Update to download patches any more after you've turned Active Scripting off. Microsoft sends you to a page telling you to turn Active Scripting and all sorts of other dangerous things back on.

Redmond dumb-asses.

Re:Something Amusing

[tswinzig]

You can't go to Windows Update to download patches any more after you've turned Active Scripting off. Microsoft sends you to a page telling you to turn Active Scripting and all sorts of other dangerous things back on.

Oh dear Lord, whatever shall I do?!

What? Set active scripting to 'prompt' mode, so that I can decide when I want it used? What? Turn it on momentarily while I access Windows Update? What? Add Microsoft.com to my trusted sites list momentarily?

No... instead I will point out how ironic this is on the Microsoft-friendly site, Slashdot.

I'm sure in Linux-world you never have to make compromises in functionality, right?

MS Rallying end-user support?

[Xerithane]

From the article:
The person who discovered this vulnerability has chosen to handle it irresponsibly , and has deliberately made this issue public only a few days after reporting it to Microsoft. It is simply not possible to build, test and release a patch within this timeframe and still meet reasonable quality standards.

I was reading through the "Irresponsible" link, as well as the vulnerability report. Information Anarchy is the phrase they have coined to display that information really doesn't want to be free. This, if successful, will cause a very adverse association to open source developers I think. If they "edjucate" their end-users into thinking that information should be tightly controlled by a centralized source, than it's easy to make the connection that the open-source community is villifying the information management structure that Microsoft and friends is working so hard to manage for the best interest of the consumers.

They claim it's not feasible for them to release a patch within 5 days. Why do I have a feeling that this code segment is probably less than 50 lines, hell - you could provide a hack just to filter malicious URLs in less than that and release that patch in well under a day or two without sacrificing what we all know as Microsofts high standards of quality.

Maybe I'm paranoid, but it seems this is a much larger tactic towards a revised SSSCA that will be in Microsofts best interest - much easier to add a clause saying it's illegal to release unauthorized security information about a companies product to an unapproved bill.

Re:MS Rallying end-user support?

[sheldon]

In other news Microsoft pulled the patch for MS01-054 on WinME systems because of reports of endusers having problems.

Part of Microsoft's responsibility is to ensure the fix doesn't break something. That means that it takes a few days to go through testing, etc.

If you don't understand this, you don't believe in the software field.

Re:MS Rallying end-user support?

[Xerithane]

Tell me, what could possibly break by doing a sanity check inside of the URL request?

You could do it with JavaScript, preface all pages with an onLoad() and verify the URL isn't malicious. Don't tell me that will break things, the only thing it will break is this security flaws break. A quick patch to fix the security flaw, followed by an update that fixes the back end problem. Granted, some problems you can't do this with, but changes a block of code that just verifies that the cookie is secure wont break shit, unless they purposefully have the code in their for internal reasons.

If they can't release a patch within 3 days, they deserve the negative publicity.

Re:MS Rallying end-user support?

[sheldon]

Please do tell me. What is your rule set for identifying whether a URL request is legitimate or not?

Have you taken a look at the URLScan utility for IIS? It does what you talk about. It's also highly configurable because there is no way for Microsoft to know in advance what might be a legitimate URL request to your web server.

Now how do you expect to build a rule set for determining for the client what constitutes a valid URL?

Never mind, it's obvious you don't know the first thing about software development.

Re:MS Rallying end-user support?

[Xerithane]

No, I haven't taken a look at URLScan, I do UNIX only. This vulnerability affects Internet Explorer by the formatting of a specific URL. You did read the release right? This has nothing to do with IIS. I believe that the browser should have a valid URL check, similar in style to Mozilla's (type in gibberish not formed correctly and it sends you to a keyword search). It seems more obvious that you didn't read the article, nor understand that I was speaking of this specific example of a way to get a quick patch out.

Never mind, it's obvious you don't know the first thing about software development.
Qualify that statement and I will give you a little bit of credit for your argument. Until then you are just being under-informed and trollish.

Re:MS Rallying end-user support?

[sheldon]

Uhh, you obviously didn't understand the point of URLScan. I was using that as an example of the complexity of URL filters, in this particular case building a ruleset for a known quantity takes a reasonable amount of work, you are suggesting building a ruleset for an unknown quantity.

As far as qualifying that statement, I thought it was fairly obvious from my response. I asked you to provide a ruleset for parsing valid URL strings. Just some simple perl regular expressions would do.

Wouldn't you think that the fact that you can't do so in 5 minutes might point to the fact that the task of building a URL validator into the browser may be a bit more than a days work? That's only a small part of the analysis piece, you still have to validate it, codify it and then test the additional code against a rather large matrix of current browser versions and environments.

The point is, the feature you suggested is far more complicated than you think it is. That's not to say it's impossible, which seems to confuse you.

I read the article. The difference is, I happen to know a tiny bit about programming, and you obviously don't.

Re:MS Rallying end-user support?

[Xerithane]

<I>As far as qualifying that statement, I thought it was fairly obvious from my response. I asked you to provide a ruleset for parsing valid URL strings. Just some simple perl regular expressions would do. </I>
Uhh, no you didn't.

<I>I read the article. The difference is, I happen to know a tiny bit about programming, and you obviously don't.</I>
Yes, obviously it is so difficult to write a valid URL parser that Apache has a problem with it, and Mozilla, and hell, even Slashdot.
You want a URL parser, pick a language. You said perl here ya go (brackets ommited to appease slashdot's stupid filtering):

sub validateURL
my @ValidInstructions = (
'[^/]\.(htm|html)', ## Allow only top level that end in .htm or .html
);
if ( /(http|ftp):\/\/([A-Za-z0-9:_\.]+)\/(.*)?/ )
my ($req, $domain, $path ) = ($1,$2,$3);
## Lets check for user combinations, denoted by :
if ( my $userinfo = split(/@/,$domain) )
my ($user,$pass) = split(/:/, $user);
for( my $i = 0; $i < $#ValidInstructions; $i++ )
return 0
if ( $path !~ /$ValidInstructions[$i]/ );
else
return 0;
}

I'll leave it as an excercise to figure out where the brackets go
So, all you need to do is add to the valid handler array, and writing reg-ex's for this is not the most efficient method, nor would I recommend it. But, it's also exceptionally easy to verify that the file is there and check the parameters in case of a dynamic page to ensure it's not a malicious intent (go read any howto-secure-a-CGI for more info).

I just spent about 5 minutes writing this out, with cold hands and all my other text. It's not far more complicated than I think it is; I'm just a good programmer. Before accusing people of how hard something is with knowing "a tiny bit about programming" find out that the person you are talking to does network development for a living. Thanks.

I'd like to take the opportunity to try to have you take a deep breath, and realize that you had no idea who I am before you started your assumption that I wasn't a programmer and just some ass-clown. I've written anything from URL validators to email validators, to pthreaded socket connection. You didn't know that though, you just instantly assumed I was talking out my ass saying that this was just such a wonderful easy idea and I just couldn't understand why they couldn't do it. It's called prioritizing of tasks, someone is in charge of this particular affected code. Whether it be in the URL validation or the cookie retrieval code (I'm not sure how IE is structured), this fix is none-the-less simple, and not an amazingly complex feat of engineering talent.

Re:MS Rallying end-user support?

[sheldon]

Actually yes I did ask you to provide a ruleset, you simply ignored that and went off on a rant about urlscan.

Now I would like to know if you believe that your function will match properly 100% of all valid URL requests that the client might wish to perform?

It doesn't appear that way to me. The most obvious right off the bat being that you missed https requests.

Again the point, which you appear to be missing is that while this is not impossible, it's obviously not as ludicrously easy as you think it is. Yes, you've thrown together a neat hack... now you push this out to your customers and they'll come screaming at you as to why they can't get to their favorite website. The other solution of actually fixing the problem that's being exploited may very well be easier, and most certainly easier to test.

You see, I didn't make any assumptions. I knew exactly the kind of hack programmer you were from your attempt to describe the task as simple without fully appreciating the scope or the possible consequences of a badly defined ruleset.

Better luck next time.

Re:MS Rallying end-user support?

[Xerithane]

Again the point, which you appear to be missing is that while this is not impossible, it's obviously not as ludicrously easy as you think it is. Yes, you've thrown together a neat hack... now you push this out to your customers and they'll come screaming at you as to why they can't get to their favorite website. The other solution of actually fixing the problem that's being exploited may very well be easier, and most certainly easier to test.

It is easy. Look, I don't really care about your opinion of me. If someone can construct a malicious URL than you can deconstruct it. Obviously IE already does this to return the cookie. It is not hard. If you think it is hard, than I know exactly the kind of lame-ass programmer you are. Oh, so what, I didn't include https.. boo-hoo. Apparently a moderated liked it, didn't they? Easy enough to reject a request based off of a scope.

Just for the record, I have written extensive complex isolation algorithms for data a helluvalot more complicated than a URL could ever be. You did make an assumption, you are just too bull-headedly stupid (yes, you are stupid. You have proved this well beyond any reasonable doubt) to understand that to some people, sifting through large scale data analysis is easy because it's what certain people really like to do, and do it well. Sorry if you have a hard time understanding how to parse a URL, but other people don't. Now, if you think you can provide an algorithm to accurately find a T/A stop in a DNA sequence to match up a contiguous sequence from splices with a higher than 97% success rate I'll start listening to you.

Prrof in the pudding

[snarfer]

The point of the Microsoft suit was to bring back competition. Innovation was stifled because no one could get investment $$ if they were in a market Microsoft was even thinking about entering.

So what is the effect on investment capital of the settlement?

The proof is in the pudding. Is Red hat stock up? Is Palm or Be stock up - or is anyone coming in with a bid that beats Palm's paltry $11 million? Is there venture capital available for companies to compete with productivity apps or streaming audio?

Re:Prrof in the pudding

[Zico]

Red Hat is trying to sell a product that can be downloaded for free. Why again do you expect investors to be lining up behind them? Especially when the only time they've been able to show profitability is by using accounting tricks -- in other words, if they continued "making money" at the same rate, they'd be bankrupt in a number of quarters.

Palm is on a not-so-slow path to www.f---edcompany.com. Everybody realizes that it's in trouble, including Palm itself. If they thought their real troubles spawned from Microsoft getting a favorable settlement, they wouldn't have just shitcanned their CEO.

Hell, Microsoft probably doesn't even plan for world domination, they've gotta be surprised by how easily it continues to be given to them by all these completely incompetent companies that you seem to be in love with. Next up: Sun Microsystems. :)

Seems your check bounced..

[Svartalf]

Here's a reality check...

Microsoft made PC vendors deals they couldn't refuse (and when they accepted, couldn't afford to get out of) to put their stuff on machines. If it's already on the machine, most people won't bother to get a different program unless it's so atrocious as to be unusable. Doesn't matter if it's free- it'd have to be 100 times better for the average person to bother with getting it. Once you're in that position, it's very difficult to shift the player in place because of network effect- it's nothing at all to do with how "good" a program is.

Re:Of course there will be more buges reported in

[gorilla]

Many of MS's problems aren't bugs, they're designed to work that way. MS has had a poor record of thinking about security. They tend to think more of features, and what can the enable, rather than what shouldn't be permitted. Allowing a macro to be automatically run on opening of a document, which can then have full access to the system, is a classic example.

Re:Ralph Nader's hypocrisy

[snarfer]

Ralph Nader has long campaigned for the government to have monopoly control on all economic activity

This is just lying right-wing ideological crap. He has said that the public (government) has a right to limit the actions of corporations when those actions might harm the interests of the public.

Re:Linux Linux Linux

[M_Talon]

So many holes in this rant, which ones to choose? Let's go with this one.

I can sell my Copy of XP if i wish, if i sell my NFL tickets it can be scalping.. Microsoft doesn't price point XP, they give it a value. I can buy XP and sell it for 30 bucks or 300 bucks, whatever the consumer is willing to pay. I can't do that with Baseball tickets, nfl tickets ore phone service.

Try selling your copy of XP online, and watch how fast MS stops you because of licensing issues. If you actually sell it on the street, they could still nail you if they find out. You can resell your sports tickets at face price without violating scalping laws. Phone service is a service, not a product, and thus is non-transferable.

Or how about this one?

So why all the resistance on microsoft? Why not make it a perfect world and attack the NFL, MLB, NBA, WNBA and your local telco megopoly who restrict your choices and charge you exhuberant prices and rip off the consumer.

Because there are other sports and other phone options, and for the most part those don't do such blatant anti-competitive practices. You don't see the NFL trying to create a baseball team. M$ wants to control the entire computing experience and then some...and they make no bones about it. And of course, the biggest point is that MS has been found to be in violation of law for their monopolistic practices, and yet they still fragrantly defy the law. That makes them a viable target for criticism, pure and simple.

Here's why the government lost

[tb3]

From the MSNBC article:

In a classic display of Microsoft pugnacity, the company hammered opposing government lawyers on nearly every conceivable point, no matter how small. Eventually exhaustion became a factor, lawyers on the government side acknowledge.

So let's make sure the state attorneys general keep their lawyers adequately supplied with No-Doze!

The Bug

[Anonymous Coward]

Cookie Data in IE Can Be Exposed or Altered Through Script Injection

Originally posted: November 08, 2001

Summary

Who should read this bulletin: Customers using Microsoft® Internet Explorer

Impact of vulnerability: Exposure and altering of data in cookies.

Maximum Severity Rating: High

Recommendation: Customers should consider disabling active scripting in the
Internet Zone and the Intranet Zone. Customers using Outlook Express who have
not set OE to use the "Restricted Sites" Zone should do so as a best practice.

Affected Software:

Microsoft Internet Explorer 5.5
Microsoft Internet Explorer 6.0

Technical details

Technical description:

Web sites use cookies as a way to store information on a user's local system. Most
often, this information is used for customizing and retaining a site's setting for a
user across multiple sessions. By design each site should maintain its own cookies
on a user's machine and be able to access only those cookies.

A vulnerability exists because it is possible to craft a URL that can allow sites to
gain unauthorized access to user's cookies and potentially modify the values
contained in them. Because some web sites store sensitive information in a user's
cookies, it is also possible that personal information could be exposed.

Microsoft is preparing a patch for this issue, but in the meantime customers can
protect their systems by disabling active scripting. (The FAQ provides step-by-step
instructions for doing this). This will protect against both the web-hosted and the
mail-borne variants discussed above. When the patch is complete, Microsoft will
re-release this bulletin and provide details on obtaining and using it.

Mitigating factors:

A user must first be enticed to a malicious web site or to open an HTML e-mail containing the malformed
URL.
Users who have applied the Outlook Email Security Update are not affected by the HTML mail exploit of
this vulnerability.
Users who have set Outlook Express to use the "Restricted Sites" Zone are not affected by the HTML mail
exploit of this vulnerability because the "Restricted Sites" zone sets Active Scripting to disabled. Note that
this is the default setting for Outlook Express 6.0. Users of Outlook Express 6.0 should verify that Active
Scripting is still disabled in the Restricted Sites Zone.

Severity Rating:
Internet Servers
Intranet Servers
Client Systems
Internet Explorer 5.5
High
High
High
Internet Explorer 6.0
High
High
High

The above assessment is based on the types of systems affected by the vulnerability, their typical deployment
patterns, and the effect that exploiting the vulnerability would have on them.

Vulnerability identifier: CAN-2001-0722

Tested Versions:
Microsoft tested Internet Explorer 5.5 SP2 and 6.0 to assess whether they are
affected by these vulnerabilities. Previous versions are no longer supported, and
may or may not be affected by these vulnerabilities.

Frequently asked questions

Why isn't there a patch available for this issue?

The person who discovered this vulnerability has chosen to handle it irresponsibly,
and has deliberately made this issue public only a few days after reporting it to
Microsoft. It is simply not possible to build, test and release a patch within this
timeframe and still meet reasonable quality standards.

What's the scope of this vulnerability?

A malicious web site with a malformed URL could read the contents of a user's
cookie which might contain personal information. In addition, it is possible to alter
the contents of the cookie. This URL could be hosted on a web page or contained in
an HTML email.

What causes the vulnerability?

The vulnerability results because of an unsafe handling of cookies across IE zones.

How would an attacker carry out an attack using this vulnerability?

An attacker could attempt to maliciously exploit this vulnerability by hosting a page
with a maliciously crafted URL. They could also send the victim an HTML email with
a similarly crafted URL.

In the case where the attacker hosted a web page, would he have any way to
compel me to visit the site?

The attacker could not force you to visit his site. Instead, he would need to entice
you into performing some action that would cause you to visit the site. There are,
however, a variety of actions that could be used to do this, from visiting a web site
that would redirect you to the attacker's, to opening an HTML e-mail that
referenced the attacker's site.

In the case where the attacker sent me an HTML e-mail, would simply opening
the mail allow me to be attacked?

Yes. It is possible for an attacker to craft an HTML email in such a way that it
would exploit this vulnerability on opening the mail.

Why does changing my IE settings help protect me against a mail-borne
attack?

As we mentioned above, HTML e-mails are just web pages sent via e-mail. Outlook
uses the IE security architecture to limit what HTML e-mails can do when opened.
By default, Outlook 2002 opens all HTML e-mails in the Restricted Sites Zone.

Is this a permanent change?

No. Microsoft is working to develop a patch that will eliminate the vulnerability.
When it's completed, you'll be able to install the patch and then return your IE
settings to their previous values.

How likely is it that I could be affected by this vulnerability?

It depends on your web browsing and e-mail habits. Customers who exercise care
in choosing the sites they visit, and who are careful not to open obvious spam and
other untrustworthy e-mails would be at less risk from this vulnerability. However,
customers can easily make a configuration change that will provide complete
protection.

What's the configuration change that will protects against this vulnerability?

Customers who are concerned about this vulnerability should disable active
scripting. All web pages (and HTML e-mails, which are just web pages delivered via
e-mail) are categorized into one of several zones, and the settings in each zone
dictate what actions can be taken within it. By disabling active scripting in the
Internet zone a user can prevent an attacker from exploiting either the web-borne
or mail-borne versions of this attack.

How do I disable active scripting in Internet Explorer 5.5 and 6.0?

On the Tools menu, click Internet Options, click the Security tab, and then click Custom Level.
In the Settings box, scroll down to the Scripting section, and click Disable under "Active scripting" and
"Scripting of Java applets".
Click OK, and then click OK again.

I am a network administrator. How can I disable active scripting in my
enterprise?

With new deployments of Internet Explorer, an administrator would use the IEAK and disable active
scripting before building the package and rolling it out to client machines.
For currently deployed client use Profile Manager to create an auto-config INS file to make registry changes
needed to disable active scripting on the client machines with Internet Explorer already installed.
For administrators that prefer to use SMS or login scripts, the following are the registry changes that would
disable active scripting on the client machine:
HKLM\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings\Zones
HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings\Zones

There are five different sub keys under each "Zones" key. Each key control a
different security zone. The key names are 0-4.
= Your computer
1 = Local Intranet
2 = Trusted Sites
3 = Internet
4 = Restricted Sites
There is then a DWORD value under each zone number key that must be modified to disable active-scripting
for each zone.

REG_DWORD value is "1400" to be modified.

Setting this value to "3" (from "0") will disable active scripting.

HKCU setting changes take effect immediately. However the HKLM settings
would most likely require a reboot.

Patch availability

Download locations for this patch A patch will be posted as soon as it is available.

Additional information about this patch

Installation platforms:
This patch can be installed on systems running Internet Explorer 5.5 and 6.0 when available.

Obtaining other security patches:
Patches for other security issues are available from the following
locations:

Security patches are available from the Microsoft Download Center, and can be most easily
found by doing a keyword search for "security_patch".
Patches for consumer platforms are available from the WindowsUpdate web site
All patches available via WindowsUpdate also are available in a redistributable form from the
WindowsUpdate Corporate site.

Other information:

Support:

Technical support is available from Microsoft Product Support Services. There is no charge for
support calls associated with security patches.

Security Resources: The Microsoft TechNet Security Web Site provides
additional information about security in Microsoft products.

Disclaimer:
The information provided in the Microsoft Knowledge Base is provided "as
is" without warranty of any kind. Microsoft disclaims all warranties, either
express or implied, including the warranties of merchantability and fitness
for a particular purpose. In no event shall Microsoft Corporation or its
suppliers be liable for any damages whatsoever including direct, indirect,
incidental, consequential, loss of business profits or special damages,
even if Microsoft Corporation or its suppliers have been advised of the
possibility of such damages. Some states do not allow the exclusion or
limitation of liability for consequential or incidental damages so the
foregoing limitation may not apply.

Revisions:

V1.0 (November 08, 2001): Bulletin Created.

Reality check for you...

[Svartalf]

Doesn't matter if the exploit is disclosed or not- people still find them, more often than not before they're announced. All the announcement does is put it in the open (open disclosure isn't a script kiddie's friend- it often times means that the exploit's hole is plugged and they can't use their toys on some or most machines anymore...).

There's loopholes in any system. They will be exploited. It's whether or not you know about the loophole and can fix it that makes all the difference between being 0wn3d or not.

Re:They could learn from Linux...

[toupsie]

Well Linux still hasn't solved the bug that prevents it from being an Operating System you would be comfortable having your parents use. I have no problem putting Mac OS X in front of my technophobe mom.

Re:Ralph Nader's hypocrisy

[Bearpaw]

"Ralph Nader has long campaigned for the government to have monopoly control on all economic activity ..."

Gross exaggeration makes your point weaker, not stronger.

They do distribute them

[ergo98]

I got this in my inbox at yesterday at 9:14pm (EST). If you really care about security with Windows machines look at this page, specifically that mailing list service.

From the FAQ...

[don_carnage]

Why isn't there a patch available for this issue?

The person who discovered this vulnerability has chosen to handle it irresponsibly, and has deliberately made this issue public only a few days after reporting it to Microsoft. It is simply not possible to build, test and release a patch within this timeframe and still meet reasonable quality standards.

Hehe.

Re:It's not a security flaw

[rmadmin]

I don't use microsoft products either. But when nimda infected how many damn IIS servers, my poor little T1 sure as hell noticed it when all those IIS machines started scanning my servers.

How about when sircam started e-mailing random documents to anyone in the address book. I got a load of random files for absolutely no reason at all. An inadvertant spam.

Just because you don't use Microsoft products doesn't mean Microsoft products can't be used to attack your machine(s). Indirectly, your still effected somtimes.

Re:Of course there will be more buges reported in

[Kadin2048]

I'm not sure I agree with this. I think that, in general, there are more bugs in Microsoft's software because there are fewer people looking at the code, not because there are more people looking at the end product.

On another note, I'm not sure that Microsoft has any grounds for demanding to be notified about flaws in the final releases of their software. If they want to keep bugs from becoming huge public brouhahas, then they should either fix them in-house while the software is still beta, or open the source up and let other people actually fix it. They're out of line to say that people should find bugs in their ware, tell them, and then sit on their discovery while some cubicle slave works to make a patch, and Microsoft takes the credit for saving the day.

Re:Of course there will be more buges reported in

[Znork]

In the cases where Linux or unix has a majority market share Microsoft still leads the exploit statistics by far.

Of course, it's not as simple as saying that MS sucks, but it's a combination of bad design (dont put everything in every program, dont have unlimited interoperation between everything) bad programming(dont use admin privilidges if not absolutely necessary, also a design issue maybe), bad installation policies (dont install everything or even anything but the basics by default), bad admins and bad will.

The combination of these elements end up in software you dont want to be running because it will stink from a security point of view.

So, no, you wouldnt have the same amount of problems on Linux at least. You'd have problems, yes, but not nearly as many. Unless, of course, the general policies among linux distribution vendors change to install everything insecurely by default, but hopefully that wont happen, and in the Linux world you can always change to another vendor if one of them goes seriously astray.

Bug Non-disclosure

[Mike1024]

Hey,

Bindview, Foundstone, Guardent, @Stake, and Internet Security Systems joined with the software-maker to declare they would immediately begin

Wasn't @stake formed from hacker group l0pht? Yes, I think they were! They used to attend Def Con, and work on Back Orifice and L0phtCrack?? Didn't they get banned from BugTraq because they posted links to thier site in the place of good, solid descriptions?

My, how times change.

-M

Re:Bug Non-disclosure

[EllF]

clarifications:

• @stake was not "formed from" the l0pht. the l0pht comprises part of their research and development team.
  
  
• back orifice was the child of cDc, not the l0pht. there is some overrun between the groups. l0phtcrack was theirs; it is an invaluable resource for system admins as well as black-hats.
  
  
• lots of people attend DefCon. doing so does not make you evil. lots of people are hackers. same point.
  
  
• they did not get "banned" from bugtraq, they split from them. there is a difference. they continue to release proof-of-concept code and whitepapers, but their formatting was not compatible with the bugtraq system.
  
  

not sure what your beef with @stake is, but they are a decent security company. that has been their focus since their inception, and they are easily among the best in that field. they have a number of brilliant minds working for their management (dan geer, president of USENIX, for example) alongside a powerhouse of a R&D team.

Hard to get a patch in a few days?!

[SquierStrat]

Okay, some vulnerabilities might be difficult to get fixed in a couple of days...but with a team of programmers as large as they have...months is quite a stretch...they still have God knows how many vulnerabilities in NT 4 that have been known for some time! The linux folks can patch stuff rather quickly with a fraction of microsoft's financial and wetware resources. Show me the problem.

Legality

[truthsearch]

Does anyone think that withholding software bugs is illegal? It was illegal for Firestone to withhold information because it irresponsibly cost lives. Security holes generally do not, but they do cost companies money. Holding back info for a security flaw will definitely prevent many admins from changing system settings, limiting current development, waiting for a patch before releasing, etc. That in turn will cost money if the flaw is still exploited.

IANAL, but I personally think MS could be sued by a company attacked through a hole kept secret by this security gang. It should in fact be illegal to withhold information about known flaws in any product, since knowing of those flaws may change the value in the customer's eyes. I see that as indirectly constituting fraud.

Anyone know of any precedence or the true current legal standing of such a situation?

Re:Legality

[RocketScientist]

You're not a lawyer, fortunately for MS they have a bunch of lawyers who write their EULA's. They specifically bar anyone who clicks their license from suing them because their software sucks ass (I think that's even a direct quote).

Re:Legality

[truthsearch]

But there are some things a contract can not protect you from. For example, if a contract is made for the purpose of an illegal act, that contract isn't binding. If the EULA goes against a state or federal law, that part of the EULA can't be used to prevent you from sueing them. That's why I'm wondering where the current law stands. I'll keep searching online law libraries, but you practically need a law degree to understand the law.

(Which, by the way, I think is totally improper. How can you be expected to follow a law that the average person can not understand? That's one way to gain control over a population, but I'll save that conversation for another time.)

Re:Legality

[Calle Ballz]

Shrink Wrap License absolves microsoft from any responsibility. You have to click 'I Agree' everytime you install...

Re:Legality

[1010011010]

Here's an idea: don't let lawyers make law.

If a law cannot be read and understood by a jury of citizens without explanation from a lawyer, the law is declared null and void. Maybe we can front-load a jury in the legislative process; before a bill becomes a law, it must be certified as understandable by a jury of average (non-lawyer) citizens.

Re:Ha ha ha!

[turbine216]

Just try running without IE
already doing it.

My gaming machine at home runs windows 98SE, and after using 98Lite, it's running beautifully without the scourge that is IE. Mozilla takes care of my web-browsing functions in its place, and I'm a happier man for doing it.

Re:Of course there will be more buges reported in

[iabervon]

I think if Linux or MacOS, as they are currently, were the most widely used, MS would still have more reported bugs, because there's just so much MS stuff. There's the kernel, the GUI, many applications, etc. With Linux, bugs in these would be reported against different entities.

Also, MS software is integrated on a large scale without sufficiently restrictive interfaces to cleanly separate it into individual programs. Since the number of potential bugs in a program grow faster than the length, this makes such integrated code more likely to have bugs; and, in fact, many MS bugs are due to interactions between different projects. With the Linux model, code is in relatively small chunks, which communicate over limited interfaces, so there is much less opportunity for cross-project bugs.

So I think that, to a certain extent, the reason that there are so many MS bugs reported is mostly that there are so many opportunities for MS to make mistakes, due to their size and the architecture they have chosen.

Re:Of course there will be more buges reported in

[Flower]

Couldn't put it better myself.

I recently attended a SANS course on IIS. According to the instructor, MS enables features to lower support costs. If it's already on nobody will call to get it working. WFM is a similiar tale. It was designed to eliminate support calls but an employee realized it could be expanded to function like tripwire.

Personally, I think if someone needed Internet printing enabled on a web server they would search for a TID instead of spending money calling MS if they couldn't noodle it out. But I'm guessing I'm just optimistic here.

Corrections

[freakinPsycho]

Speaking as someone who was at the conference, I would like to make a few corrections.

First, it wasn't Microsoft that proprosed the idea at the conference.

Second, the idea of this is to try to get people to follow a standard way of reporting vulnerabilities and force companies to take a responsible role in addressing and responding to vulnerabilities.

Third, this is not designed to try to hide vulnerabilities from anyone.

Basically, it works as thus:

Joe Random Person finds a vulnerability in a program or service. He then documents the vulnerability, along with sample code to reproduce the bug. He contacts secure@company.com with the information he has. Joe is now expected not to release information on the bug at this time, but will stay in contact with the company.

The company now has to respond with a couple things.
1) Acknowledgement of the bug
2) An estimated date when it will be fixed
3) Any further questions the company may have

The company will be responsible for keeping in touch with Joe and provide updates on timeframe.

Once there is a patch in place or a fix has been implemented, the company goes public with the bug, including high level information on the exploit. This will not contain code that will exploit the vulnerability, but rather a description and model by which it could be exploited. The company will give credit for the find to Joe. Joe is also free to release his own high-level description of the issue.

After the grace period (around 30 days, there are exceptions), full information on the exploit is released, including code that can be used to exploit the vulnerability. This grace period is intended to allow administrators to have a chance to patch their products. At this time, Joe can also release a full paper with sample code and more details. Again, full credit is given to Joe for the find.

The intent of this is not to prevent the details from becoming public. It is rather intended to lessen the damage that can happen after the release of exploit code. It is not gaurenteed to prevent damage, just to try to help reduce it.

There could be errors in this, and don't take this as a summary of the eventual document. This is my summarized take on it.

Re:Corrections

[LukeyBoy]

The problem is that this method of reporting doesn't force the company to do shit. Imagine Joe send a new vulnerability he's uncovered to Company X. They acknowledge the bug, thank him and promise a fix in 60 days. Sounds like a long time? Take a quick look at the track record of Microsoft, er, Company X for their promptness in releasing patches.

Given that amount of time, a thousand other people like Joe have found the exploit. If 1% of them are the bad guys then they'll end up taking down or DOSing systems all over the place.

Another scenario is that Joe is one of very few idiots that reports the bug and keeps his mouth shut. After all, who wants to piss around and waste time documenting a bug in someone else's product, and then hoping you'll get a response from bugs@microsoft? Meanwhile, the aforementioned bad guys don't report it and continue to exploit the security hole. The company, under the impression that so few people have discovered this bug, continually delays fixing the problem.

The only way that the average Joe (ha ha) can ensure that his proprietary commercial software is secure is by posting the exact methodology of any exploits he happens across in the software he owns, thereby forcing the corporations hand. Take Code Red, Blue or Pink as an example. That forced Microsoft into releasing several patches and making them much more available.

As for the 30 day grace period, are you high? What kind of patch needs 30 days for a competent sysadmin to implement? Yeah yeah, large company, testing environment first, then production. But 30 days? Come on. That's as dumb as beliving it takes over a month to fix an overflow in a call to strcpy! Oh wait...

Sorry, I'm done.

Damnit...

[nathanh]

Moreover, the agreement appears to give Microsoft too many opportunities to undermine the free software movement.

Why did you USAnians not vote this guy in as president? Nader has consistently shown himself to be perhaps the only American politician with any clue, ever.

Instead you lot went to a two party choice between Mr Personality and The Chimp. And the Chimp won!

The world weeps.

Re:Damnit...

[Chris Johnson]

Well, I voted for him. And I'd do so again, look at the way he isn't just taking his marbles and going home, but still trying to make a difference. Nader is awesome. I hope I can get another chance to vote for him. Not only Microsoft can benefit from stubborn, dogged persistence!

Quick slashdot poll: how many of you believe that if Nader had got elected, the Justice Department would have responded to winning every case including an en banc session of the Court of Appeals by letting the defendant go without even fining them?

This is a beautiful, horrible example of everything Nader was talking about in his campaigning. He was RIGHT. He still is.

So much for the l0pht

[mcSey921]

Anyone else remember when l0pht.com used to be the place to find information on Windows vulnerabilities? I see that @stake is one of the 5 security companies announcing this anti-information coalition.

Heh, security through obscurity! That's a good idea that has always worked for Microsoft;)

More info on the IE cookie vulnerablity

[sheetsda]

The following is a excerp from an email sent to the bugtraq@securityfocus.com mailing list yesterday:

Microsoft Internet Explorer has a vulnerability which allows a malicious
website to access any cookie in the browser's memory or those stored on
disk. Cookies are used by web sites for storing preferences, statistics
and tracking users, but also for storing more sensitive information such
as session keys and even usernames and passwords. Cookies are used by
many (probably most) online banks, webmail systems, and other sites
requiring user authentication.

Access to cookies may allow an attacker to retrieve passwords or other
sensitive information, or hijack authenticated web sessions.

What makes this possible are certain features of "about:" URL handling of
IE. For some reason, an URL starting with "about:" can contain html code
that will be interpreted by the browser. For instance entering the URL
"about:<h1>hello</h1>" brings up a page with the heading "hello". The URL
may contain JavaScript as well. Going to the following location with IE
causes an alert box to be displayed:

about:<script language=JavaScript>alert('ALERT');</script& gt;

Finally, the about URL may have a hostname placed after the colon, and IE
uses that hostname when determining the cookies to use:

about://www.anydomain.fi/<script language=JavaScript>alert(document.cookie);< /script>

The above URL would result in IE displaying cookies of www.anydomain.fi
in the alert box, assuming that the site has been visited and it has set
a cookie which hasn't expired.

A malicious website can have a piece of JavaScript redirecting the
browser to an about: URL similar to the one above, and do anything with
the cookie information of any selected domain. Instead of showing an
alert box, the JavaScript code might just pass the cookie contents to a
script or a CGI program which could quietly store the information to a
file and then redirect the browser elsewhere or show some seemingly
harmless web content.

A web page for testing the vulnerability can be found at

http://www.solutions.fi/iebug

Re:Ralph Nader's hypocrisy

[Tassach]

And more to the point, Corporations are legal entities created by the government (supposedly) for the public good. It is only because of a defective supreme court ruling that corporations are granted the same rights as natural persons; it is right and proper (and within the bounds of Constitutional authority) for the US government to regulate the activities of corporations.

If corporations want to enjoy the rights of natural persons, then they must also accept the responsibilities of natural persons as well. The senior management and board of directors of corporations must be held PERSONALLY accountable for the illegal actions of the corporations. Microsoft wouldn't keep defying the courts if Gates, Allchin, and Balmer were actually faced the possibility of being sent to prison for their criminal activities.

I'm suprised that some ambitious Federal prosecutor hasn't gotten the bright idea of bringing up Gates & Co on federal conspiracy charges. (Conspiricy to violate the Sherman Anti-Trust Act, for example). It is a federal felony for 2 or more people to conspire to break a federal law. Hell, if they really wanted to go for broke, they could call MS Continuing Criminal Enterprise, and invoke the RICO act. [Shudder. Even Bin Laden doesn't deserve to have that draconian piece of shit law used against him]

Why there systems are so bad

[VEGETA_GT]

One thing I know talking to a friend who was on a microsoft programming team. They do not get bonuses on quality / security of code, but on the fact of how fast they can get it out for cash. Basically as I was told, there software is never really fully tested. With 2000/nt, until patch 2 came out for either of them, they where riddled with security holes and bugs. Microsoft is a moneymaking company, not a quality software company. From someone as big as microsoft, they easily could test there products extensively, but that would cut down on there profits. O dam we could not do that to pore old billy boy gates could we.

Personally, I would not care if microsoft is a monopoly if they would be some what inventive (they just re vamp others ideas) and put out quality code.

My 2 cents plus more

Re:Microsoft Reveals Anti-Disclosure Plan

[Znork]

Of course, it also misses the point that network security admins may need to do massive exploit scans to locate vulnerable machines on their networks. There are a lot of people who admin networks with thousands of machines.

And it misses the point that one may not have a 100% trust that the vendor gets the patch right and would like to test vulnerability after patching.

Re:Linux Linux Linux

[Znork]

Go call Microsoft and ask them if you can sell your copy of XP, eh?

Hint of what response you can expect: In. Your. Dreams.

Re:The problem is people like you

[dachshund]

Oh for pete's sake. Might as well go out there and bitch out every kid who's ever sprayed graffiti, if you think it'll put a dent in that problem.

Though that strategy looks downright effective compared to yelling at "grownups" who've seen the error of their ways.

Sept. 11 As Justification

[krmt]

On Sept. 28, she told the parties in the Microsoft case that 'the recent tragic events affecting our nation' demanded a prompt end to litigation that had already roiled the stock market and generated economic uncertainty.

That exhortation hit home. After Sept. 11, 'the world had changed, with war abroad, threats at home and a deteriorating economy, creating a powerful dynamic to settle,' says Richard Blumenthal, Connecticut's attorney general and one of the more-aggressive state officials involved in the case.

While I see the reasoning behind this, shouldn't the Sept. 11 attacks make us more appreciative of our freedoms than of our money? All the politicians are running around talking about freedom being the American ideal, shouldn't they be more focused on maintaining freedom than money in this case also?

Re:Linux Linux Linux

[kin_korn_karn]

and yet they still fragrantly defy the law


So THAT'S what that smell is! I thought it was just my cubemate's brain frying on this old code.

...every website made for IE??

[Wonko42]

As usual, switch off active scripting, even though that will make essentially every webpage that's designed for IE not work.

"Active Scripting" is the term Microsoft uses to refer to client-side JavaScript and VBScript. Thus, disabling active scripting will not only break pages designed for IE, it will break any page designed for any browser if that page contains JavaScript or VBScript (remember, there's an addon for the Windows version of Netscape 4.x that gives it the ability to run client-side VBScript and ActiveX controls).

Furthermore, Michael, switching off Active Scripting is not the only way to avoid falling prey to this exploit. In order for the exploit to work, someone must convince you to go to a specially-formed URL. Being smart enough to recognize malicious URLs would allow you to avoid this security hole without disabling Active Scripting.

I find it disturbing that you're so obviously biased against IE (and apparently also uninterested in learning details before representing your own uninformed misconceptions as "fact"). I've never made the mistake of thinking of Slashdot as an unbiased news source. A predilection towards open-source rather than commercial software is one thing, however, while openly vehement bias based on false conclusions is another.

For your own sake, and for the sake of Slashdot's journalistic integrity (ha ha), please at least do a little bit of fact-finding before posting knee-jerk stories like this.

Re:...every website made for IE??

[dvdeug]

> In order for the exploit to work, someone must convince you to go to a specially-formed URL.

No. They must convince you to go to a webpage or open an HTML email. Have you never gone to a webpage where it loads a popup (i.e. another webpage)? Or redirects you to another webpage? That's all they have to do.

Cookie vulnerability found here:

[savaget]

Cookie vulnerability found here

Poetic Justice: My favorite Nader quote

[Adhoc]

Reading this gave me a warm fuzzy feeling inside.
-----------------
The level of fines that would serve as a deterrent for cash rich Microsoft would be difficult to fathom, but one might make these fines deter more by directing the money to be paid into trust funds that would fund the development of free software, an endeavor that Microsoft has indicated it strongly opposes as a threat to its own monopoly. This would give Microsoft a much greater incentive to abide by the agreement.

Re:Poetic Justice: My favorite Nader quote

[Chris Johnson]

Sweet! I totally missed that. What a kick in the teeth to the 'we need to punish them but not so's they'll object' mentality. It doesn't even matter if this approach bears fruit or if it's just bureaucratic and useless: if it's what Microsoft will absolutely hate, hell yes, do that! I hope the Judge reads this bit with special interest. Talk about an effective deterrent :)

Missing FAQ #1

[rjamestaylor]

Why does this bug exist in the first place?

The manager responsible for this piece of Internet Explorer was overbudget and entrusted its development to a college co-op with Visual Basic experience.

It's all so clear now...

Fart in a windstorm

[fdisk3hs]

Pissing in the ocean. That's what this "unnamed organization", otherwise known as the "Security KGB", will accomplish. I'm amazed at how many businesses aren't making enough money from the internet, and thus are trying to legislate out free speech. I'm having a blast, personal economic downturn and layoff aside, watching these companies that have never actually had a product to sell, crying because the big bad internet is out of control, and that they can't compete against free products that do EXACTLY THE SAME TASKS as their pay-products. Waaaa...
Welcome to the open market and the information age, crybabies exit at the rear...

Slashdot editor bias

[sheldon]

It's interesting. I've already read every one of these articles linked to by slashdot in the last few days.

But the bizarre thing is how biased slashdot is with their presentation. If you actually quick thru on the links and read the stories, you'll understand why.

For instance, why wasn't this article from news.com linked as well, considering it is Scott Culp responding to a lot of the questions and accusations?

http://news.cnet.com/news/0-1014-201-7819204-0.h tm l?tag=bt_bh

Re:Slashdot editor bias

[frank_adrian314159]

My favorite quote:

Are you trying to hush up those that find these vulnerabilities?

Absolutely not. Our reputation and our practices speak for themselves.

He's right. Says it all, I think.

Re:Slashdot editor bias

[kindbud]

I love the title to the article you cited.

Security woes: Who is to blame?

As if there's any question? The publisher of the sofware with the flaw is responsible. Why, do I detect a bit of bias in the Cnet article's title?

I like this one too (Scutt Culp is giving the answer here)
Q: Why the name information anarchy?
A: Well, because it's accurate. The practice that the essay was discussing was the practice of throwing exploit information out freely on the Internet without regard to how it might be used.

What about the practice of throwing flawed software out freely on the Internet without regard to how it might be used?

Then he goes on:
There has been a long debate, for years, about how much information ought be disclosed about security vulnerabilities. And for the longest time, folks arguing both pro and con could cite theory about why their position was correct. But the five worms (Ramen, 1i0n, Sadmind, Code Red and Nimda) that were released over the past year answer the question with actual data and conclusively.

I would say so too. Amazing how two people looking at the same data can come to opposite conclusions. I guess it depends on whose ox is gored. Security be damned, they've got a reputation to protect!

Re:Slashdot editor bias

[sheldon]

"What about the practice of throwing flawed software out freely on the Internet without regard to how it might be used? "

Open Source developers do this every day. What should we do about it? Execute them?

Microsoft's point is entirely valid.

This isn't to say your point isn't valid as well, but I'd like to know what you expect to be done about it. At least Microsoft is offering suggestions.

Re:Slashdot editor bias

[kindbud]

What should be done about it is to inform everyone as soon as problems are discovered.

That is a period at the end of that sentence, it means there is nothing further to add. What we're doing now is what should be done.

Re:Slashdot editor bias

[sheldon]

Ahh good.

Then Microsoft is off the hook. I'm glad we've settled this and no longer have to read these ridiculously biased slashdot stories.

Re:Slashdot editor bias

[kindbud]

How are they off the hook? I said they exploits should continue to be released, Microsoft's feet should continue to be held to the fire, despite their protests, so how is this letting them off the hook?

People like you...

[Daffy Duck]

People like you are one of the reasons that Microsoft is getting off the hook.

Guess what? It's people like you who are the reason MS is off the hook. People who always vote for the 2 major parties rather than their conscience, guaranteeing that just the Dems and GOP will be in power and giving every corporate lobbyist a convenient two-stop shopping trip.

If more states would have the balls not to do winner-takes-all selection of electors, it would be a nice start. What would be even better would be to adopt a better method of reckoning the winner than first-past-the-post.
Otherwise, all "good Democrats" should be busting their asses trying to get Ross Perot to run again in 2004, so he can split the Republican vote away from Dubya just like he did to his dad. Is that a responsible way to have to run an election?

The current system requires people to play mind games like "I'd like to vote for X, but I'm really afraid Y might win so I'd better vote for Z since he's got more money than X". There's no reason people should have to do this - and no reason why campaign financers should be able to count on people doing this so that they don't have to have a qualified candidate to succeed, just a lot of cash.

Do a little poking around about "strategy-free" voting methods that give every voter the incentive to just vote his conscience. These things can all be changed state-by-state.

Re:People like you...

[Daffy Duck]

I ordinarily wouldn't reveal something like this, but since you think you know me I'll just point out that I wanted to vote for Nader but when it got down to the wire and looked like Bush really had a chance, I voted for Gore. Imagine that one of us naive idealists could possibly have worked that one out!

There's nothing to stop you from voting "realistically" and still working for electoral change. I cast my vote for Gore because the straight plurality system had a gun to my head.

Oh, and to anyone who says that a vote for Nader is wasted: as it turns out my vote for Gore was wasted - it didn't keep Bush out of the White House and it blew my chance to show support for a third party.

Look up the name "Condorcet" if you think things like this are inevitable. Popular elections can't be perfect, but the way we do them now is almost the worst way possible.

"The enemy of my enemy is my friend" only applies if you can't count higher than two.

Well duh!

[Arandir]

As usual, switch off active scripting, even though that will make essentially every webpage that's designed for IE not work.

Well duh! If you're creating webpages just for IE you get what you deserve. There are standards out there and if you use them you will be fine. If you don't use them you only have yourself to blame.

I've stopped blaming Microsoft and starting blaming these webmaster who ought to know better.

Re:Of course there will be more buges reported in

[Snootch]

Nope. It's not.

The Netcraft survey crawls through all those little Melvin machines which each have an httpd running that nobody ever accesses.

Nobody cares about them. They are irrelevant.


Actually, it tends to go the other way - IIS installs as standard on a heck of a lot of WinNT boxen that do no hosting, and as (much as we hate to admit it here) most small businesses (big enough to have an always-on connection but not big enough for their own IT dept) use Windows. Most Apache installs are meant to be there.

Re:Of course there will be more buges reported in

[czardonic]

If Linux/Mac OS/etc was the most widely used, you'd see much the same focus on problems with the software.

Microsoft's products are buggier because they are more ambitious in terms of functionality and target user base. Designing software that is only used by people with software knowledge is much easier than designing software for the general public. Creating an application that accounts for all the possible mistakes and questions that the average user is going to have is a huge undertaking. Add to that the extra functinality that M$ adds to its products (for better or worse), and it is not mystery why it has more bugs. Sure it crashes more, but is also DOES more.

As such, the idea that more bugs will be found in software if it gets wider distribution puts the cart before the horse. In order to get wider distribution, software must expand ease of use and functinality, and thus expose itself to the introduction of bugs (if it is to be released in a timely manner). However, users, as history has demostrated, care more about features than they care about bugs. Again, as history has demostrated, the most stable OS you can create, even if it is free, can not compete with an OS that includes the functionality that people want and, more importantly, is easy to use.

Doubly ironic...

[mblase]

...because Microsoft is implicitly saying that it's okay to enable Active Scripting on Microsoft sites because you can trust them. Despite the fact that they're the ones who gave you this security vulnerability in the first place.

Keep us in the dark huh?

[BLKMGK]

Gee, maybe that explains why http://packetstormsecurity.org has had the rate of submissions slow from many a day to one or two every couple of days. I KNOW vulnerabilities are being found but it's REALLY hard to explain to management why they MUST rollout a security patch if I cannot PROVE to them that, yes its a problem! Has everyone rolled over?

WTF is wrong with these folks?! I can see it now - we're all going to have to sign up to some sort of subscription service to learn about the various vulnerbailities. No doubt it won't be free, right? I have a VERY hard time believing that @Stake aka L0PHT signed up for this. My opinion of those fine folks just dropped into the basement. I never thought I'd see the day when they would cowtow to Microsoft, it's a sad day indeed for the security industry.

Who are we doing this for? The children? National Security? Oh wait - Bill's cash. Seems to have greased the DOJ wheels pretty good, guess things are bad all over when the security industry sucks it up too. This just makes me sick.

Any good full disclosure sites out there taking over where PacketStorm died? If so I'd appreciate some URLs. BTW, some of the folks on our team swear the SecurityFocus has pulled data OUT of their vulnerability database in recent months. Cannot confirm it for sure but when you know you looked it up previously and then it's not there later you have to begin to wonder....

P.S. If RFP signs on Hell will have frozen over. Thankfully he doesn't appear to take cash for his efforts!

Re:Keep us in the dark huh?

[ryanr]

The only info we have pulled out of the vuldb that I can remember was the telnetd exploit. This was because the copyright holder insisted. We do on occasion have a duplicate BID, or consolidate several into one when it becomes clear that they are the same. Therefore, you may sometimes see a particular BID number "go away", but the info exists under another BID. We also had a few temporary problems while we switched from Roxen to Apache a few weeks ago, and I recall that not all info was showing up for a while.

But basically, no we aren't pulling anything out.

Re:Ralph Nader's hypocrisy

[Junior J. Junior III]

Why? Microsoft isn't the government.

Not yet anyway.

Re:Of course there will be more buges reported in

[west]

They tend to think more of features, and what can the enable, rather than what shouldn't be permitted. Allowing a macro to be automatically run on opening of a document, which can then have full access to the system, is a classic example.


I will point out that this exactly how the vast majority of people think as well. In most ways, MS is giving the customer exactly what they want.

People are not trained to think about computer security (and would probably give up on computers if they had to). Thus, they only see security measures as a hindrance. I've certainly heard people complain that Java applet's can't really to anything useful since they can't do what an ActiveX program can...

Blaming MS for badly thought out security is like blaming Hostess for making fatty foods. They're both addressing what there markets wants, not what "is good for them".

Re:Try disabling unnecessary services

[Arandir]

I've been on broadband for one year now, with both Slackware and FreeBSD, and not once have I been hacked. I have logs that show people tried but not got through. Of course I'm only running a client box so I shut off virtually everything, but if I know enough to secure my box at home, you would think that the guys getting paid to admid servers would be evern more paranoid.

The bastards are going to know the exploits before you do, so make that part of your equation. Don't plan on the known avenues of attack, plan for the unknown. Expect that someone *will* break in and have a plan in place for that eventuality.

How Microsoft invented open source, by Billg

[bstadil]

Why all the MS bashing? If it wasn't for MS there would be no OpenSource. ;-) Read today's TheRegister
Quote: The open source movement wouldn't exist without Microsoft, Bill Gates told his company's shareholder meeting earlier this week. Open source is also a follower, not an innovator, and destroys jobs, the economy and world peace (we made that last bit up).

Re:How Microsoft invented open source, by Billg

[sdo1]

Well, in a way Mr. Bill is right. If it weren't for the fact that MS's software is in many ways fundamentally flawed, then there likely wouldn't be a -need- for open source. Would Linux be where it is today if MS software was solid, crash-proof, secure, and if everyone here just loved them to pieces? No, I don't think it would.

-S

Re:Yet more Anti MS vomit from the folks at slashd

[jejones]

Ah. Rolls Royce isn't a better car, otherwise more people would use it, right?

Of course, Linux is free, so the reason more people don't use it isn't the same as the reason more people don't drive Ferraris or Mercedes Benz...the average person doesn't want to mess around with his or her computer any more than he or she wants to have to do his or her own car repairs, and thus if, thanks to MS's restrictive OEM licenses, you have to build your own computer to run Linux and have to install it yourself and, thanks to the applications barrier to entry, have to go looking for Linux applications, the average person won't bother, but will instead be an obedient consumer and use Windows.

Earth to AC: Read The Fine Court Decision. MS has a monopoly, and can and does use it to crush competition.

In other news...

[MrResistor]

Hacker Group the L0pht Completes Corporate Sell-Out

*sigh*

Re:Of course there will be more buges reported in

[sheldon]

What do you mean still?

RedHat has release more bulletins about security vulnerabilities this year than Microsoft has.

At the rate RedHat is going the ratio will be 2 to 1 next year.

Is linux registered??

[Calle Ballz]

From this article...


Arming the enemy
First, let's state the obvious. All of these
worms made use of security flaws in the systems
they attacked, and if there hadn't been security
vulnerabilities in Windows®, Linux, and Solaris®


I thought Linux was a registered trademark? Because it's free, does that mean they don't have to recognize their trademark with ® signs they like to toss up all over the place???

apt-get update and apt-get upgrade

[Erris]

up2date on Red Hat is nice, but apt-get on Debian is free in all ways. With a few sites specified in /etc/apt/sources.list and the subject, you update worries are over.

Why can't M$ get a patch out in the "few days" of warning they had? Because they are too bussy breaking other people's applications to fix their own code. M$ is rulled by the $, don't think engineering has any power any more. If PR and management wanted a good reputation, you would think they would quit trying to screw everyone.

He should focus on TicketMaster

[ClosedSource]

I have a lot of respect for Nader (I even voted for him), but I don't think he knows much about computers or software. MS is an easy target and Nader hasn't had been particularly effective at protecting consumers in recent years. I wish he would do more to break the Ticketmaster monopoly which is far more comprehensive than Microsoft's and has measurably harmed consumers financially.

up2date is free on a small scale.

[gimpboy]

i've been using up2date on my computer at home. after you login you get one free "seat" (i dont remember the word they use).

so when you start up2date on a computer the first time you create a profile of that computer at redhat. you can move this seat between computers so you can still use it for free if you have multiple computers. this is nice because it cuts home users, like myself, some slack.

Re:Of course there will be more buges reported in

[Jayde Stargunner]

I don't know, last time I checked IIS was only installed by default if you upgraded from a box with PWS on it. This is *not* a very common happenstance, and I fail to see why the "IIS installs by default" mantra is so prevelant, given that it *hardly ever happens*.

Great Quote from the WSJ

[Skip Head]

Here is a little quote from the Wall Street Journal article:

James rejects these criticisms and says the decision to protect Microsoft's security provisions was "one of those 'duh' issues". He continues: "Microsoft has security protocols. Are we going to tell everyone how they work? Do you want people to get access to your credit-card information when you shop on line?"

Knowing how a security protocol works should not make it less secure. I can read how SSL works, but that does not make it less secure. Same with Kerberos, DES, RSA, etcetera. A proper security protocol should be secure even if you know how it works. Security through obscurity DOES NOT WORK.

This quote sounds like it came from Microsoft, but get this: he works for the DOJ! This guy James was the one in charge of the negotiations with Microsoft. He is supposed to be on our side.

It seems like he knows very little about computer security. It also seems like he believed whatever the Microsoft lawyers told him. No wonder they arrived a such a one-sided settlement.

Re:Great Quote from the WSJ

[mgkimsal2]

It's all the more funny when you realize that precisely BECAUSE people use MS products (IIS) they've put hundreds of thousands of credit cards at risk - nay, they've actually BEEN stolen. OK - not every credit card stolen is stolen from MS technology, but it *seems* an higher proportion are from MS-based systems than non-MS-based systems.

So if a higher proportion are stolen from MS systems, it's because MS security is worse. If not, then credit cards can be stolen from any system, and there's nothing special about MS security that would be compromised by a disclosure.

Pathetic

[nowt]

Microsoft says it's "irresponsible" to expect them to get a patch out for a critical flaw within "a few days".

Either they or their technology are pathetic.

Re:Of course there will be more buges reported in

[1010011010]

So, there's apparently a huge market for poorly designed, poorly implemented, but "feature-rich" and "easy to use" software.

Okay.

Re:Of course there will be more buges reported in

[1010011010]

"Install IIS" is on by default in the Windows NT Server 4.0 installer.

Irresponsible? Conventional wisdom is wrong...

[weave]

OK, someone was irresponsible by releasing details so soon after notifying Microsoft and they say that is irresponsible.

Maybe so, but what I don't get is this expectation everyone has that these security holes go through the same steps...

1. Discovery
2. Notification
3. Disclosure
4. Exploits

The real danger is when someday someone will discover one of these huge gapping holes, not tell a soul, and then exploit them for profit, terror, extortion, or simple chaos.

We've been lucky so far. For Microsoft to try to divert the entire blame is what is irresponsible. Remember who created the security hole in the first place....

I'm a MS supporter, but this is ridiculous

[Quadell]

Usually, I think MS has an undeservedly bad reputation. But I can't stomach their assertion that open discussion about their bugs is somehow unethical.

From Microsoft's article:

We can and should discuss security vulnerabilities, but we should be smart, prudent, and responsible in the way we do it.

Who chooses what sort of speech is smart, prudent, and responsible? The speaker? Or Microsoft? Since they branded it irresponsible to reveal a security flaw only "days" after telling Microsoft about it, it seems obvious to me that this is a request to let Microsoft control all discussion about their security flaws. This is patently unacceptable.

If we can't eliminate all security vulnerabilities, then it becomes all the more critical that we handle them carefully and responsibly when they're found. Yet much of the security community handles them in a way that fairly guarantees their use, by following a practice that's best described as information anarchy. This is the practice of deliberately publishing explicit, step-by-step instructions for exploiting security vulnerabilities, without regard for how the information may be used.

I don't think it's best described as information anarchy. Anarchy is an emotionally loaded term, like piracy. But anarchy just means "not centrally controlled or regulated". Do we want all discussion of security to be centrally controlled and regulated? If you replace the phrase "information anarchy" with "free speech", the article becomes much more enlightening. The author seems to try to address this by saying:

By analogy, this isn't a call for people for give up freedom of speech; only that they stop yelling "fire" in a crowded movie house.

But the movie house is on fire. The bug exists - your private information is vulverable. The responsible thing for Microsoft to do is admit that they made a mistake, and work to put out the fire. Unfortunately, they've chosen to blame the messenger.

It's natural for a powerful organizion to want to surpress speech that points out its flaws. It's natural - but it should never be tolerable.

Does enabling features lower support costs?

[hearingaid]

Interestingly, Apple has generally taken the exact opposite approach. I haven't run OS X yet so I don't know what the precise situation there is, but out of the box an OS 1-9 machine has no network services enabled by default, except the basic support for AppleTalk/EtherTalk, while Windows boxen, particularly NT systems, have a bunch of open ports by default. I suspect that OS X probably has some open ports; *nix tends to necessitate it. I still get paranoid about syslogd. :)

I've never heard that Apple gets tons of support calls from this policy.

IVV under a different name

[denshi]

IVV is just a name for a common meme in software development. Nowadays you'll find it called 'unit testing' and 'test-first design'.

And your interpretation of Pogo sucks. The correct line is:

"We have met the enemy, and he is us. We are surrounded by insurmountable opportunity."

.....and it has nothing to do with software design, military or otherwise.

BTW, what does it mean for a software design to 'get to first base', as you put it?

Re:Ralph Nader's hypocrisy

[Pxtl]

I've often thought about this, and the company itself should be punished as well, and with severness similar to what you or I go through. Criminal Negligence Causing Death would come up more then once in a while in a company lifetime. You or me? A few years in the clink. Corporation? 00.3% hit out of their profits. Right. How bout they are denied the right to sell products for a 4 year period? Maybe when shareholders start noticing their stocks disappearing they might invest in companies that with more morals then a thailand organ-harvesting racket.

Why it takes MS so long....

[jpmorgan]

There's a reason why MS takes so long to get security patches out.

A previous posted mentioned Apple with the iTunes installer nuking the hdd, and how they got a patch out quickly, implying that if Apple can do it, MS should be able to too... well, things aren't quite so black and white:

The problem in the iTunes installer was a small typo in a bash script. The behaviour of the installer script is so simple that it's fairly obvious what effects the change would make. Easy patch. If only all bugs were so easy to fix.

A relatively short while ago some info regarding few vulnerabilities in Exchange (I think it was Exchange...) were released to the public@large by some third party. MS rushes out patches and lo and behold! A fairly significant proportion of users reported serious issues after installing the patch - it was messing up other parts of the system. MS rushed out a second version of the patch, which again wasn't satisfactory. It took 3 iterations of the patch to get something that seemed to work successfully on almost every machine it was installed on!

What went wrong? The Law of Unintended Consequences reared its ugly head.

If you look at the security holes that poke up in MS stuff, they often look like they result from some complex interaction that Microsoft's developers never expected. These interactions are partially the fault of the way they seem to design their systems and partially due to the vast number of configurations they end up operating in. Unfortunately, when you're fixing a bug that's resulting from some complex and probably subtle interaction between different components of your application (or even worse: another application) then your change could have drastic and far-reaching effects.

To help mitigate this problem they do extremely extensive regression testing. Typically, before a patch gets posted it's run through some of the weirdest and craziest system configurations they can think of to make sure it doesn't break anything, and if it does they figure out why and fix it. This takes time. Lots of time!

Re:Why it takes MS so long....

[Chris Johnson]

Um- one of the links this very article includes addresses Microsoft's plan for stamping out error disclosure. The Register has also reported on this recently. The other half of Microsoft's plan is to rely on silently updating Windows computers with security patches. Microsoft also bundles unrelated stuff with security patches, megabytes worth of it.

So the problems that Microsoft patches cause are not solely due to 'oh, Microsoft software is so much more sophisticated and advanced!' but due to bad planning and inappropriate bundling combined with lack of disclosure of what's being altered. And it is going to get MUCH worse, not better. To cap it off, if they are able to suppress disclosure of bugs and security holes, they don't need to regression test anywhere near as hard as you seem to think they are doing- because all that will happen is that Windows boxes will mysteriously die and there won't be any publically disclosed link to connect that with Microsoft updates.

Hell, if they can truly cut off all disclosure, they can just STOP any work on security patches entirely. Who'd know?

Question:

[ocie]

Failure to address Ill Gotten Gains

Ill Gotten Gains, or Bill Gotten Gains.

Nader?

[DrCode]

While I'm glad he's chimed in on this, I'd say he's just as, if not more, "uncompromising" and "abrasive" as RMS.

Total miss of point

[Srin Tuar]

Sure, lets enable scripting "just this once", because Microsoft servers have never been infested by worms or trojans right, so we can trust them.

Besides, its much easier to leave the nice dynamic content scripts all over the site than to just provide a basic HTML with the exploit warning and patch link.

They might as well make the whole security notification system an ActiveX control- because those have such good security, much better than a simple text file.

Sarcasm off, one would think that security advisories could avoid using the tools that generate the majority of the security advisories.

Re:Of course there will be more buges reported in

[Hostile17]

Sure it crashes more, but is also DOES more

This is not an excuse, it is also only half true, Windows XP does crash more, but it certainly does not do more than RedHat Linux 7.2

Corperate coersion -- Microsoft and baseball

[melquiades]

Actually, this a useful comparison. The Twins issue is all about coercsion: St. Paul voters (bless them) decided a few years ago not to fund a new stadium for the Twins with tax dollars. There was a lot of bucking and hawing, but the public's message consistently was, "We want the Twins, but we don't want our taxes to fund them." Here's a great feature from Minnesota Public Radio about the whole history of the issue.

A few days ago, the major league basball owners voted to eliminate two teams. It's front-page headlines here. Here's the catch: they've announced that they'll eliminate two, but not which ones. They're basically trying to whip up a lot of public sentiment, and daring the various cities with struggling teams to outdo each other in tax subsidies. It's a disgustingly coersive power play.

And I expect to see the same from Microsoft. If -- we could only wish! -- the court threatens a remedy that will actually have any effect, they'll start dangling their carrots and tying their heroines to the railroad tracks. They already do this in their rhetoric with these far-fetched missives about the economy, freedom, and Technological Progress.

But I expect to see some concretely coersive tactics from Microsoft aimed at the government and the public as a whole, similar to what the baseball owners just did. What will they be? I don't know. But I expect it -- Microsoft is the slyest bunch of bastards on the planet when it comes to business strategy. Any theories?

Re:Corperate coersion -- Microsoft and baseball

[re-geeked]

What will MS baseball-like coercive tactics be? You mean what have they been?

The messages baseball is sending to Minnesota are "if you don't give in, they're'll be no team" and "because, a stadium is the solution to all that's wrong with your team"

Microsoft's messages are "if you don't give in, the economy will be ruined" "because, MS dominance is the one thing that can save the tech industry".

Of course, both are lying about the fact that their greed got us in the spot -- baseball's refusal to embrace revenue sharing is the real reason for the revenue disparities among teams, and fear of MS caused both a lack of innovation in the now-decimated PC industry and a squandering of tech capital in the unprofitable areas outside of MS influence -- dot-coms.

What happened to the dot-com investors is not at all unlike what's happening to the "small-market" teams: trying to compete in a lucrative sector, but forced to only play in the unprofitable backwaters, serve as "subcontractors" to the bully, and hike costs to compete with the bully, the teams and dot-coms were losers before they started.

Mind you, both the dot-coms and the small-market owners were also blinded by greed, but it's the public that paid the price.

What price will Gates ever pay? Or Steinbrenner?

Well it's possible that they are each strangling their own golden goose (MS the software industry, and MLB baseball itself), but it's taking its time dying.

In either case, I'd like to the goose live, and I think the bullies have to be stopped to let it happen.

Re:Corperate coersion -- Microsoft and baseball

[melquiades]

Microsoft's messages are "if you don't give in, the economy will be ruined" "because, MS dominance is the one thing that can save the tech industry".

Yeah, absolutely. But I'm thinking of the step from rhetoric to concrete threats. It's one thing for the baseball owners to say, "The Twins are in trouble." But it's another thing for them to actually start axing teams.

Microsoft doesn't just talk trash -- they walk the talk. Think, for example, of how they threatened to make Windows processor-independent by porting NT to Alpha when Intel fell out of line.

Up until now, their threats to the government and the public -- like the ones you mentioned -- have only been rhetorical. But I expect to see them threatening to, say, move Microsoft to another country, or change licensing so as to hurt government agencies, or....well, who knows -- I'm not as clever as they are, and I can't see it coming.

Re:Grey hats

[Happy Monkey]

Wow. Your post
made me wobble
and sway
down to the
floor, with
visions of
"Spy vs Spy vs Spy"
swirling
around my head...

pirated copies of windows don't get patched

[BroadbandBradley]

Many Many people I've helped support for the ISP I work for have never heard of windows update, or never been to the site to get updates. I suspect the issue is that so many copies of windows are pirated, and those users think they'll be discovered by MS if the run windows update.
I like that XP makes people pay, folks will not pay and seek alternatives...what, you can run the corporate version and make as many copies as you like?....I wonder if MS did that on purpose?

Re:Of course there will be more buges reported in

[irix]

I tried many of the IP addresses that showed up in my apache log during the recent Code Red (and it bretheren) attacks to see what machines were compromised.

You know what - most of them were on subnets owned by DSL and cable providers, and when you requested a page from them you got back either nothing or the "welcome to IIS" page.

"hardly eveer happens" my ass - it happens all the fscking time.

Kids, it's time for a song.

[trilucid]

Quoting from "Don't Drink the Water":

"'Cause you're all dead now

I live with my justice

I live with my greedy need

I live with no mercy

I live with my frenzied feeding

I live with my hatred

I live with my jealousy

I live with the notion

That I don't need anyone but me

Don't drink the water

There's blood in the water
"

Interpret as you see fit. Sorry 'bout the copyright infringement, Dave.

Re:Of course there will be more buges reported in

[psamuels]

RedHat has release more bulletins about security vulnerabilities this year than Microsoft has.

Ah, but you see, you're not necessarily comparing apples to apples. The following could be an interesting exercies:

How many vulnerabilities from each company...

• are exploitable with the default install of the OS?
• are exploitable with the default configuration, assuming you installed the vulnerable component?
• are remotely exploitable, i.e. you don't need a local account to use them?
• are locally exploitable?
• are local DoS attacks (Joe User, logged in locally, can reboot the machine, or crash it, or kill a system service, or hang a service so that it no longer works properly)?
• are remote DoS attacks (same, but without need for a local login)?

I haven't done this exercise, but I strongly suspect that it would show that MS and RH have very different views of what constitutes a "security problem" that needs to be reported & patched. I'm guessing most if not all of the MS bulletins are remotely-exploitable holes, and that most are probably not mere DoS holes. The RH bulletins, on the other hand, will have a lot of temp file vulnerabilities -- which, in the MS world, would not even be considered bugs, much less security holes.

Re:Of course there will be more buges reported in

[Anonymous Coward]

In my experience, I always thought that a large part of the MS bugs come from the fact that MS offers features (no sarcasm) that are inherently prone to security flaws. I've never once heard of a user security being breached when they were off a network and writing a document in notepad.
Examples include

VB scripts + extension hiding => viruses (and what-have-you).
macros => viruses.
inter-application communication => security flaw.
autoextract/running of downloaded software => general fscking up of computer.

Now, not all the features require that bad things come from them and there is definite programmer and management error. Although my description of it is perhaps unnecessary: What they need to do is demarcate all functions,methods,variables and objects that are capable of being abused as security flaws, regardless of whether the abuse could only come from within the layer of code above that method or whether it could be used outside. When the final stages of development come there needs to be an inside-out evaluation of all the possible paths that can be taken to reach those methods/functions/variables and which of those pose risks. Those risks need to be evaluated and if they find them to be acceptable risks, they simply need to mark them in their released product documentation. Of course, if they are found to be unacceptable risks then they need to reduce them in whatever manner or else provide warnings during operation that the user may hurt themselves doing whatever it is that opens that hole.

[please note that I'm not in the mood to look up terms such as trojan horse, worm, etc. to figure out where they all go, think of "virus" used above as a generic term.]

notification

[tahpot]

the worst fact about this is that i had to read it on /.
when ie loads for the first time it checks with a MS server... why can't it make a quick to check for awful security flaws like this and notify the user?

Re:Most Effective Remedy

[Chris Johnson]

Sorry dude: Macs have bundled IE for _years_. You can't not purchase Microsoft products indirectly by getting a Mac!

Do the best you can under the circumstances. I use Macs, and I make a point of throwing out IE and using iCab or netscape or something- and I also go into the system folder, and throw out the large amount of operating system code (to support IE) such as ActiveX support and a host of OS extensions Microsoft insist upon building into Macintoshes.

Interestingly, this seems to make the Mac more stable. But the bottom line is you cannot either avoid indirectly purchasing Microsoft products- or even running MS OS code! by using stock Macs. They come with extensive Microsoft code and you have to literally go in and take that garbage out if you want to run a non-Microsoft MacOS.

How's that strike you? Does that make you more or less persuaded that Microsoft is dangerous and all-controlling? Maybe your original vow is all the more worthwhile seeing as you CAN'T do it without either going incredibly DIY to the point of building your own computer and running nothing but Linux, or abandoning computers entirely.

Did you know it was that bad?

Re:that last line....

[Xerithane]

I find it easier to believe he's not a troll, and just someone with a misguided assumption who thinks they are entitled to voice their opinion without knowing anything. Which they are entitled, I find it more satisfying to debunk such folk, and hopefully get them to stop and think the next time they open their mouth without really understanding all aspects of the discussion. Getting in an argument with a coder who does mostly network based stuff (including a lot of internet-app development) and saying they don't know code is a great example :)

Re:They could learn from Linux...

[toupsie]

Jeez, you promote Mac OS X and you become a right wing crackpot? Steve Jobs is going to have one funny joke to tell Bill Clinton the next time they hook up.

The DoJ doesn't understand the issues

[gotan]

Microsoft lawyers invoked a more-threatening world when they proposed inserting a security exemption in a different part of the settlement. The exemption applied to provisions that require the company to disclose the inner workings of Windows to competitors who want to make all sorts of software that works well with Windows. The company said it needed the exemption to guard against cyber-sabotage.
[ ...]
Microsoft?s competitors and some of the states claim that these technologies are used so commonly that the provision could shield a number of Microsoft?s products from competition.
[...]
James rejects these criticisms and says the decision to protect Microsoft?s security provisions was ?one of those ?duh? issues.? He continues: ?Microsoft has security protocols. Are we going to tell everyone how they work? Do you want people to get access to your credit-card information when you shop on line??

James (the Justice Department antitrust chief) either uses very cheap rhetorics here (to cover up how bad that deal is) or he really doesn't understand the issues (and i don't know what's worse, the DoJ in cahoots with MS, or them being too dumb to do their job). Microsofts argument is just plain ridiculous. Everyone knows. that good security protoclos don't rely on obscurity, but on good crypto and a good protocol. You can't rely on obscurity especially not for Software which is sold worldwide, and open for everyone to take apart and scan for holes (even if that costs some to wade through all that assembler).

Also there are open source implementations of secure protocols (openssh to name just one). By Microsofts argument they couldn't work at all. If the DoJ is incapable of understanding the issues, or at least ask someone who does, and just sitting there nodding their heads when anything comes up they don't understand, i can really understand, how that 'agreement' came to be. And the statement about such measures being necessary to protect credit-card information shows, that he doesn't know enough to make the deal that is needed to keep microsoft in line. That wouldn't be too bad, if at lest he would rely on some advice in such situations.

TODO: Education

[_Sprocket_]

I'm not sure what the solution should be, but SOMEthing needs to be done.

...

Cmdr, since you seem to oppose stricter rules on full disclosure, what do you think could be done to make things more secure for us here in the trenches (who don't want to become security experts just so they can run a PC)?

Please allow some constructive criticism. The concept of not knowing what the situation is, what a proper solution is, but calling for something to be done is very simular to shooting blindly in to the dark. I can agree to looking for an action to take - to seeking a target. But taking blind potshots is just as likely to end up hitting an innocent bystander or your own foot.

As others have pointed out, the exchange of information is going to happen one way or another. Illicit data gets exchanged via an underground community every day. Restricting the highly visiable and open channels will not stop this. Doing so is just a wild shot in the dark.

But you still want to do something. What to do?

My advice is to educate yourself, or get help from a friend or hired professional. And there's ample history that points to this concept.

The microcomputer hit the market. Killer apps showed up that drove them in to homes and businesses. Individuals either had to learn how to set up and use these devices themselves or hire others to do it. One could argue the beginnings of IT departments and consultants.

Networking small computers begins to catch on. Now there's a new wave of technology. Existing support staff either learned the new technology or increased their ranks with already knowledable staff. The IT department takes on a whole new level of responsibility.

The Internet hits the mainstream. Smaller, private networks interconnect to a world-wide network. In many cases, this involves a whole new series of networking concepts and technology. IT picks up the pace. There is more training to be done.

Enter information security. Individuals and businesses learn that world-wide network access is a two-way street. Many products and services are woefully inadequate. There is, once again, a whole slew of new concepts and technologies to learn.

Each step involves a minimum level of knowledge required to go it on your own. The huge advantage with the infosec portion is that, thanks to open disclosure, there is also a wealth of information available online. There are also some very good books on the subject. Sure - a lot of that stuff is mainly for the hobbiest or professional. But there is also a wealth of information for the beginner - the basics.

So what does the average end user do? Educate themselves. Learn the basics. Or hire / offer a beer to someone who can help you. Look at what products you're buying and using. Security reviews of products (especially security products like personal firewalls) are fairly common. Do a bit of product research. Use the best that you can find/afford.

If you've been around computers for any length of time these concepts (education, product knowledge, and expert help) shouldn't be new.

One final, parting shot. One of my favorite infosec concepts is the inverse relationship between functionality and security. The more secure something is, the harder it is to use (and vise versa). Functionality is what has been driving the IT industry for the last couple decades (at least). Its made it possible for a wide degree of products that "just work" with little knowledge from the end user. However, this has also lead to huge insecure infrastructure.

Re:Nader is a tool.

[(void*)]

Which stupid moderator modded that as insighful? This is outright libel without any proof.

See you in metamod!!

Re:that last line....

[sheldon]

Heh. Well, it was a rather simple point. This other fool doesn't seem to understand the difference between hacking and programming. He's obviously never had to release code to a production environment and suffer the wrath of users complaining about the lack of testing.

What's surprising is he still thinks he is right. Sigh, well quality control is something you learn with experience I guess.

you forgot "fun"

[QuantumG]

Here's how it goes:

1. Discovery
   
2. Perl based DOS script
   
3. Useful exploit
   
4. Break into lots of boxes
   
5. Extensive 0-day trading
   
6. Security alert from admin to random company
   
7. Re-discovery
   
8. Exploit
   
9. 1-day trading by kiddies who work at security companies
   
10. In house advisory
    
11. Notification
    
12. Post to bugtraq of advisory / patches / exploit
    
13. non-private trading by kiddies who read bugtraq
    
14. armies of kiddies attack shitloads of machines
    
15. Distribution advisories
    
16. Some admins fix their boxes.
    
17. CERT advisories
    
18. Someone who is *really* bored writes a worm.
    
19. News services pretend that no-one knows about these sploits and no patches have been released
    
20. A few more admins fix their boxes.
    

Re:Of course there will be more buges reported in

[Snootch]

Every way-kewl-radical Linux user throws up apache to show off to his friends.

Yes, but said lamer is unlikely to put it on a permanent, upstreamable connection - generally by the time you're big enough to reserve an IP, you are a small company, and are therefore less likely to be a lamer putting up Apache to show off.

Re:I'd send direct mail but... no address :-(

[ryanr]

Strange, my email addr used to show in my messages. Must be one of the things that changed with one of the upgrades, and I never noticed. ryan@securityfocus.com . Anyway, I'm glad to hear that you find us useful, I love to hear that stuff. Thanks!