al Qaeda Hacks XP?

acaird writes "According to this article at Newbytes, members of al Qaeda may have worked for Microsoft and planted "trojans, trapdoors, and bugs in Windows XP"." This stuff screams of hoax to me, but it is showing up on the Washington Post.

Comments

Where the hell is Microsoft's PR agency?

[Saint Aardvark]

Honestly, things are getting pretty bad for MS if this sort of thing can be published without even a public whipping. :-)

If this goes on..."Next week on Jerry Springer: Bill Gates is sleeping with my sister!"

Re:Where the hell is Microsoft's PR agency?

[LordKariya]

Mohammad Afroze William Abdul Razzak Gates, Jr, arrested by Mumbai (Bombay) police Oct. 2, has admitted to helping plot gaping OS security holes in India, Britain and Australia, India's Hindustan Times newspaper reported Saturday.

There you have it, indisputable proof that Gates and bin Laden are allies.

Re:Where the hell is Microsoft's PR agency?

[Alien54]

Well the way I figure it, they are paranoid enough that someone at MS will try to find out if this is ture or not

And they will find that there is no way to tell if there are Al-Qeada moles, trap doors, bugs, etc. - the difference between that and normal operation may be minimal at best.

That may be the Al-qeada plan to destroy America. make sure all MS products stop working after a certain date

;-)

Re:Where the hell is Microsoft's PR agency?

[GTRacer]

That may be the Al-qeada plan to destroy America. make sure all MS products stop working after a certain date...

What, you mean Microsoft Product Activation and Passport subscriptions?

GTRacer
- How much for WinXP Corporate?

Re:Where the hell is Microsoft's PR agency?

[Tackhead]

> That may be the Al-qeada plan to destroy America. make sure all MS products stop working after a certain date

Huh? Last time I checked, Al Queda wanted to destroy the technological world, not save it!

Re:Where the hell is Microsoft's PR agency?

[Black Parrot]

> Well the way I figure it, they are paranoid enough that someone at MS will try to find out if this is ture or not

> And they will find that there is no way to tell...

Yes, but at least they will qualify for 3 or 4 billion dollars of disaster relief funding, and a play for sympathy may get them a reduced wrist slap from the DoJ.

Re:Where the hell is Microsoft's PR agency?

[Jason Earl]

Maybe Ballmer's dance is part of the process, that looked fairly rigorous. It also didn't look too terribly effective.

Re:Where the hell is Microsoft's PR agency?

[isomeme]

That may be the Al-qeada plan to destroy America. make sure all MS products stop working after a certain date.

No, that's RMS's plan to free America.

Re:Where the hell is Microsoft's PR agency?

[Dwonis]

Funny thing is that it probably wouldn't actually be such a bad thing. I mean, consider the worst-case scenario in the computer industry, then think about where we're headed. Not much different, eh?

not as easy as you might think

[psyklopz]

Speaking as a programmer who works for a big software company, it's unlikely that anything like that would be able to get through.

Code generally goes through peer reviews and quality assurance before it is accepted into the main stream. Say waht you want about MS, but I'm sure they do these things (they can afford it!)

To bypass these failsafes would require a lot of people along the line allowing it to slip through.

Re:not as easy as you might think

[Anonymous Coward]

Yeah, right. All code gets peer reviewed, and it's also verified that the version that's peer reviewed is exactly what's under source control, and QA reads code? That's a fucking joke.

QA generally does not read any code at all, they take the specs for how a routine works, and maybe write some regression tests to make sure it does what it's supposed to, and breaks properly. There's no digging around in the code itself.

As for peer review, when it happens (which it doesn't for every line of code by a long shot) they don't make sure that nobody ever updates that code again without more peer review.

While I don't believe the allegation for a second, it's definitely extremely possible.

Re:not as easy as you might think

[oddjob]

So something like a flight simulator in a spreadsheet program would never make it into a released product...

Back under your bridge, troll.

Re:not as easy as you might think

[Ami Ganguli]

This thing is clearly a hoax, but..

I don't think this would be all that difficult. It's not like the hack has to be obvious. You wouldn't put something like:

if( strcmp( username, "osama" ) ) { uid=0; }

That would be too obvious.

But something more subtle in the logic could easily get through, given the number of such bugs that have made it through without deliberate sabotage.

Re:not as easy as you might think

[Thomas Charron]

I dunno, it could be argued that the engineers that worked on the components of MS Office have in the past slipped in MANY the easter eggs into the product that went unnoticed.

I could also see how it could be done. a simple #progma and redefinition of a core Win32 API function placed in something as silly as stdafx.h might just slip by.

Re:not as easy as you might think

[ianezz]

if( strcmp( username, "osama" ) ) { uid=0; }

Poor ``osama'' user... every other user instantly becomes root, except for him (sorry, couldn't resist - but this is another reason why strcmp() is pure evil sometimes) ;-)

Re:not as easy as you might think

[Computer!]

That's a fucking joke.

While I'd admit that QA in professional software is lacking, there are definately source code reviews in an OS product group. Every line of code is looked at, even if only briefly. The risk of the exploit being detected and erased before a release is too great for the Microsoft interview process (grueling, trust me) to be worthwhile. Especially if the coder is a new employee. It is highly unlikely that a new programmer even wrote a single line of compiled OS code. Most of the time, they are writing tools or test scripts for years before they get to write OS code. Insinuating that someone's entire career was a setup in order to get caught planting some bugs in Windows is a lot more ridiculous than claiming this is a hoax.

Re:not as easy as you might think

[Thomas Charron]

DoH! I have NO idea why I said that. Of course I meant one of the dozens of #pragma warning statement you can make to the Visual C++ NOT issue warmings regarding things such as redefinition of a function declared elsewhere, etc..

You know, the kinds you need to use to manage to include the STL in Visual C++ without generating hundreds of warnings. 8-)

Re:not as easy as you might think

[bonzoesc]

Easter Eggs aren't terrorist exploits. They're usually harmless, and are basically there to make people say "neato" or something like that. Besides, the QA people are listed in the credits, too.

Re:not as easy as you might think

[morcego]

I'm not sure.
You see, I work for a not so big software company right now, but I used to.
It's not that hard to sneak some malicious code into the final product. Quality Arrusance is usualy made only by using the software, not by analising the code. And even if they do analise the code, it's quite trivial to introduce some obscure buffer overflow.
Also, we are forced to remember about that hacking of microsoft internal network some time ago, which they "claimed" give the hackers no access to the code base.
I hate bin Laden as much as the next guy, and think he should die. But, even being a fanactic, the guy is inteligent. And has recources, both personel and money. I think it's very likely he would attempt something like this. I know, in his shoes, I would.

Re:not as easy as you might think

[L-Wave]

its quite possible the code reviewers know the eaaster egg is THERE, usually code reviews are done by co-programmers, not management.

Re:Not as easy as you might think

[Syberghost]

In the first place, I notice that man is a "suspected" Al Qaeda member. From what I've been seeing lately, anyone who has the wrong kind of accent or a copy of the Koran is a suspected Al Qaeda Member.

Ok, but when you pick the suspected Al Qaeda member up, and he says "I'm an Al Qaeda member, and I'd like to enter a formal confession in court, so I can blather on about the evils of western 'civilization' before proudly marching off to die a martyr in your jails", you can excuse journalists for thinking he might really mean it.

Re:not as easy as you might think

[benedict]

People who are willing to eat flaming death aren't
likely to be daunted by the Microsoft interview process.

Re:Not as easy as you might think

[GTRacer]

I suspect Ballmer couldn't code to save his life...

Yeah, but the boy can dance like no pasty overweight man before or since! "Give me a D! Give me an E!"

GTRacer
- Doin' it for the tech writers!

Re:not as easy as you might think

[Francis]

Yeah, right. All code gets peer reviewed, and it's also verified that the version that's peer reviewed is exactly what's under source control, and QA reads code? That's a fucking joke.

I used to work for Microsoft as a dev. (Visual Studio) Although coding practices vary from group to group, many (including our team) have mandatory code reviews before submitting, including ours.

Noone would personaly verify that the peer reviewed version is exactly what's under source control, but come on. Groups are tight knit. You're always going through each other's code on a daily basis. You plant a Trojan, you're going to get caught.

Let's face it. These Al Quaeda has enough problems smuggling weapons onto airplanes. Try smuggling a programmer through a Micrsoft interview process. M$ job interviews are notoriously tough. You would get more bang for the buck building a bomb and giving the federal reserve a good shaking. (No pun intended)

Re:not as easy as you might think

[Mr. Slippery]

Code generally goes through peer reviews and quality assurance before it is accepted into the main stream.

Where is this wonderful place you work?

I've worked for, lessee, eight companies over the years, ranging from the tiny to mammoth international corporations. Only two had code reviews.

At one, a well known company in the computer security field, code for a secure operating system base was reviewed by trust engineers - who were knowledgeable about the theory of security but who were not so knowledgeable about the programming language being use. We'd get questions like "what does char somecstring[16]; somecstring[0] = char(0); mean"?

At the other, a well-known aerospace contractor, reviews of code for a NASA project focused on making sure that your code met the formatting standards required - no one asked me anything at all about the semantics of my code.

Re:not as easy as you might think

[Jason Earl]

Whatever. Excel used to have a flight simulator embedded in it, for crying out loud! IIS had a back door password of "Netscape Engineers are Weenies" spelled backwords.

Not to mention the fact that it seems like Windows has an exploit approximately every 3.5 seconds, and that's without access to the source. A terrorist at Microsoft wouldn't even have to try and embed backdoors into the software. They could just keep track of the exploitable buffer overflows and pass them on to their buddies instead of raising attention to them at Microsoft. Microsoft's entire defense stems around the fact that the "bad guys" don't have access to the code and must therefore guess where the problems are (and even still they have more than their share of problems). Someone on the inside (with access to the source) could easily subvert this process.

Re:not as easy as you might think

[Ratbert42]

I worked for a software company and put a time bomb into one of their products, just to show it could be done. Even when they knew it was in there and what it did, they couldn't find it for hours. I pointed to the exact code and they still didn't understand what it did, but someone said "oh yeah, I saw that last week and thought it looked odd." I doubt he did (such a bullshitter), but even if he had, he wouldn't have figured it out. He would have given up and ignored it. Not anymore. And that's with a team of under 5 people touching that product. Imagine a team the size of the WinXP one.

Re:not as easy as you might think

[Jason Earl]

That's assuming that the terrorists would actually have to plant backdoors. It would be far less dangerous, and far easier, to simply look for buffer overflows and then not report them to management. What good is a peer review if your "peer" is actually looking for exploitable code for their own ends. A remotely exploitable buffer overflow is every bit as good as a backdoor, and if they were in QA they wouldn't even have to write it themselves, they would simply have to let it slide through.

Now, I am not saying that the Al Qaeda has penetrated Microsoft, but I can't imagine that someone working at Microsoft hasn't been tempted to simply overlook a buffer overflow. Especially now that Windows is being used to run some very tempting targets.

Re:not as easy as you might think

[Znork]

This isnt beyond al Qaeda in any way. These arent your random acts of terrorism but long-term plans, so they could easily have had sleepers inside MS for more than half a decade (who could be anywhere they wished. I doubt MS practices random reassignment and random teaming, since that would be a good way to make anyone not a terrorist quit).

MS could do nothing to prevent it. QA doesnt catch maliciously coded bugs, it barely catches the easy bugs with regression tests. Peer review would have to be two or three people meticulously inspecting every programmers code (it's often slower to read and understand code than it is to write it), and the interaction it has with other parts of code. That just wont happen anywhere. If you're lucky you have someone else going over the code for simple mistakes, or looking through it to find a known bug.

And just imagine the fun. 10-20 random root attacks with no available fix, and then inject 5 worms like NIMDA with multiple transmission ways at the same time in different networks in different parts of the world. By the time the anti-virus companies get in order and realize it's more than one or two worms it will be far too late. There wouldnt be a MS machine running in the world after a few hours. Combine it with internal sabotage at MS and it would be weeks or months before service would be back... and then... do it again... and again...

Re:not as easy as you might think

[morcego]

After some obtuse comments on my post, I stopped to think what I would do if I was a terrorist and decided to do this kind of stuff (sabotage WinXP).
That lead me to some considerations:

1- The sabotage would have to be enough so it's usage (or saying I would use it) would cause terror
2- The sabotage would have to be small enough it would pass quality assurance without arousing a flag
3- The sabotage would have to be generic enough so nobody would spot it at a first glance
4- The exploit would have to be complicated enough so nobody else would be able to exploit it before I do
5- This sabotage would have to take a form, or permit some kind of use, that would let me claim responsability for the terrorist act
6- If I could do something misleading, so that when I first attacked, the the original sabotage
would not be found, even after the attack, the better

So, considering all this point, I want to reduce my rating from "Very Probable" to simply "Technicaly Factible".

Unless they are very stupid. Which maybe they are, just like me posting this kind of thing with the FBI sensors and such monitoring everything.

If they arest me for this post, please, let the slashdotters know about it.

Or could it be I'm simply violating the DMCA ?

Re:Not as easy as you might think

[rho]

From what I've been seeing lately, anyone who has the wrong kind of accent or a copy of the Koran is a suspected Al Qaeda Member.

Well, to be fair, there aren't many Al Qaeda members with red hair and freckles who speak in an Irish brogue.

When you're looking for Islamic fundamentalist terrorists, you don't go looking in the VFW hall or round up the Penn State synchronized swimming team.

Re:not as easy as you might think

[hawk]

>Speaking as a programmer who works for a big
>software company, it's unlikely that anything
> like that would be able to get through.

Speaking as a director of the Federal Aviation Authority, it's unlikely that four planes could be simultaneuously hijacked and . . .

hawk, not really an FAA official

Re:not as easy as you might think

[jafac]

there is a "code review" process that can and does take place in some large software companies.

Generally done AFTER the stringent release deadline was met. Engineers will review eachother's codes looking for problems.

But sometimes this process is abbreviated to fix bugs, or move on to the next release to add features so they can compete in the "checkbox war".

It's certainly far from foolproof.
I would also say that in general terms, there is a philosophical engineering difference between a company that has an "engineering focus" and a company that has a "marketing focus" (do the execs come from an engineering background? or do they have MBAs?). Since the company I'm familliar with was a merger of two companies of different "type", I see teams with lineage from one or the other orginal company, and years later, they retain their original philosophical alignment.
Microsoft is a strongly "marketing focussed" company. I wouldn't count too strongly on a rigorous code-review process going on there.

Re:not as easy as you might think

[dark_panda]

What about OpenBSD? Supposedly, their code auditing is pretty thorough.

J

Re:not as easy as you might think

[jayhawk88]

Yeah, I'm sure Bill was real pissed when the lid was blown off that little hack.

Get a clue. If your a PHB code reviewer at MS, there's a big difference between finding out your programmers have actually been having a little fun on the job with a hidden easter egg, and trying to figure out the functionality of backdoorforallah.dll.

Re:not as easy as you might think

[mpe]

Code generally goes through peer reviews and quality assurance before it is accepted into the main stream. Say waht you want about MS, but I'm sure they do these things (they can afford it!)

This sounds fine, but how does it explain things such as "Easter Eggs"? These can be a lot more sophisticated that a "back door"...

Re:not as easy as you might think

[spudnic]

Yes, they do. And that's why they have a reputation for it. They're known as the OS that reviews every line of code. If everyone did it, it wouldn't be a big deal.

.

Re:not as easy as you might think

[mpe]

This sabotage would have to take a form, or permit some kind of use, that would let me claim responsability for the terrorist act

Except that this is supposedly the action of al Qaeda. Which isn't exactly known for claiming responsibility.

Re:not as easy as you might think

[jmv]

Code generally goes through peer reviews and quality assurance before it is accepted into the main stream. Say waht you want about MS, but I'm sure they do these things (they can afford it!)

Oh yeah, that's why they caught the "seineew era sreenigne epacsteN" ("Netscape enrineers are weenies" backdoor for the memory-impared), right?

If that can get through, I guess anything can.

Re:not as easy as you might think

[btellier]

Dude, you're out of your mind if you think that introducing a bug that will get past QA isn't possible. When all the engineers at Microsoft can't take the strcpy()'s and sprintf()'s out of IIS, you think they're really gonna notice an off-by-one buffer overflow in a nested while{}?

Look people, it's not as though this guy has to do IF USER = BLADEN THEN GIVEADMINACCESS(), he simply has to change a buffer size to a few bytes smaller or something similar. Particularly in things like IIS it would be really easy to introduce a hole that it would take ages for competant MS auditors to find, much less the asm hackers on the scene.

Re:Not as easy as you might think

[mpe]

Look at the recent tape of Ossama Bin Laden. The people who hijacked the planes had no idea what was going on until it was time to do it. They got training and got ready, but they had no idea what the mission was until just beforehand.

It has even been implied that only those actually piloting the planes knew the actual plan anyway.

Re:not as easy as you might think

[Pfhreakaz0id]

Oh, those companies where the execs come from engineering backgrounds and don't bother with MBAs are the ones going out of business....

Re:not as easy as you might think

[seanadams.com]

And even if they do analise the code...

Microsost *must* be "analising" their code. It's totaly shit, and they charge "per anum" for the license.

Re:not as easy as you might think

[Computer!]

People who are willing to eat flaming death aren't
likely to be daunted by the Microsoft interview process.


Unlike eating flaming death, you have to be good at something to get hired by Microsoft. Namely: programming. So, no, flaming death-eaters wouldn't get a job at Microsoft. They wouldn't be afraid of the interview, just unlikely to make it through. Nice karma whoring, though. Thanks, moderators for helping.

Re:Not as easy as you might think

[zCyl]

Well, to be fair, there aren't many Al Qaeda members with red hair and freckles who speak in an Irish brogue.

To be equally fair, statistically speaking there are practically no islamic arabs who are members of Al Qaeda either. Do a little division. It's like saying Finish people are kernel developers, or that people who are U.S. citizens work for Microsoft.

Re:not as easy as you might think

[Old Wolf]

The supposedly 'harmless' easter egg might actually be a terrorist program. For example, look up "primenum.c" in IOCCC.org: does it actually do what you think it does, and any QA officer would think?

(PS. I would post a link, if said site were not down).

Re:not as easy as you might think

[benedict]

What about my comment was karma whoring?

(Just because someone modded me up undeservedly
doesn't make me a karma whore.)

Re:not as easy as you might think

[jazman_777]

While I'd admit that QA in professional software is lacking, there are definately source code reviews in an OS product group. Every line of code is looked at, even if only briefly. The risk of the exploit being detected and erased before a release is too great for the Microsoft interview process (grueling, trust me) to be worthwhile.

And when the code for "Netscape Engineers are Weenies" got in there, the code reviewers all had a good belly laugh and said, "let's leave that in there!" Oh, wait, sorry, that was for IIS, which is NOT part of the OS...

Re:Not as easy as you might think

[Anonymous DWord]

Of course, bein gan al queda member...what does that even mean?

I have no idea. Is that Gaelic?

Re:not as easy as you might think

[Jason Earl]

Ok, whatever. It still goes to show how effective Microsoft's "code reviews" are. If it takes them years to find something that was meant to be a joke, then how long is it going to take them to find something that was meant to be a hard to spot backdoor written by a talented coder (there is no questioning the fact that Microsoft programmers are talented folks).

The fact of the matter is that bugs are hard to find in almost any setting. The fact that so few people have access to Microsoft source code simply makes it that much harder to find errors. Microsoft can pretend that they have processes in place to catch these sorts of errors, but when all it takes is the knowledge of one previously unknown buffer exploit it is hard to feel very safe.

Microsoft's entire security policy is based on the fact that the bad guys don't have access to their source code. This assumes, of course, that there isn't anyone inside of Microsoft that is willing to sell (or exploit themselves) security information.

Re:not as easy as you might think

[Computer!]

Oh, wait, sorry, that was for IIS, which is NOT part of the OS...

Whew, thanks, I was almost wrong for a minute there. Anyway, I'm sure at least a couple of programmers saw it and laughed. If that article is true, the discovery team would have kept treason a secret, which is a lot more serious than a little engineering slander.

Re:not as easy as you might think

[benedict]

I guess I'm not a karma whore any more.

Re:not as easy as you might think

[jsse]

Whatever. Excel used to have a flight simulator embedded in it, for crying out loud! IIS had a back door password of "Netscape Engineers are Weenies" spelled backwords.

They've their excuse.

But it's very startling to hear "The cipher is symmetric..." Hey! Can't they do better cipher?! :)

hah!

[kevlar]

I heard they also worked for Firestone and sabotaged their tires!!!

Hmmmm

[Your_Mom]

Unfortunately, since there already so many holes and bugs in XP, we will never know if they really were successful.

Unless they commented there code:

security_hole(); &nbsp&nbsp&nbsp&nbsp&nbsp&nbsp/*b1n l@d1n r00lz!*/

Re:Hmmmm

[Cynikal]

I dissagree, i found XP to be extreemly bug free and stable, which is why this sounds more plausible..

imagine for a moment you are a terrorist.. you want control over the majority of the world's computers.. best way is to embed it into the most widely used OS.. but for your evil plan to be sucessful you have to find a way to make this OS stable enough to be online long enough to implement phaze 2 of the plan.. follow the bread crumbs, the truth will reveal itself.

and what do we have.. XP is a complete turnaround from previous Windows OS's.. i smell a fish.. and whoever fixed all those bugs certainly wasnt your average M$ employee. this didnt "just happen" by itself, people... someone made this happen, and i for one am hella scared..

Bill Gates, and Bin Laden, the two biggest forces of evil in the world working together.. shudder

you sure this isn't from the *NY* Post?

[Frothy Walrus]

c'mon, this is such a pile of bullshit it's ridiculous.

Microsoft spokesman Jim Desler said Afroze's claims about the company were "bizarre and unsubstantiated and should be treated skeptically."

for once, we can all agree with a Microsoft spokesman.

Those bastards hacked the linux kernel too!

[zyqqh]

And they even left OVER 700 SEKRET MESSAGES IN THE SOURCE CODE!

Observe:

% grep -ir 'a.*l.*q.*a.*e.*d.*a' /usr/src/linux | wc -l
704

Time to outlaw leenuks, I say.

Re:Those bastards hacked the linux kernel too!

[limejuice]

and 7 + 0 + 4 = 11 ! OMG! Run for the hills!

Re:Those bastards hacked the linux kernel too!

[ksheff]

Why even do that? The following reduces the number of times a grep process has to be spawned.

find /usr/src/linux -type f | xargs grep -i "a.*l.*q.*a.*e.*d.*a"

Re:Those bastards hacked the linux kernel too!

[slamb]

Off-topic but important

find /usr/src/linux -type f | xargs grep -i "a.*l.*q.*a.*e.*d.*a"

Don't do that. You're right; it is much faster. But it's less safe: it breaks if filenames contain whitespace. Ideally, they wouldn't, but remember the iTunes 2 installer? It axed entire partitions for this very reason. Filenames on a lot of systems do have spaces. Code that breaks on them is bad.

Instead, do this:

find /usr/src/linux -type f -print0 | xargs -0 grep -i "a.*l.*q.*a.*e.*d.*a"

It requires GNU find and xargs. But it really is much, much better. (It uses a null character instead of a space/newline as the seperator. Filenames can't contain nulls, since the system calls expect C-style null-terminated strings.)

(GNU bashers: There is a reason people prefer their tools. They really are better in a lot of cases.)

"rigorous processes"

[Geeky]

From the article:

According to Desler, Microsoft has rigorous processes in place during the development of Windows to ensure the security and integrity of source code

I can sleep easier now.

don't worry

[bnitsua]

These backdoors, trojans, etc. are rendered useless by the backdoors, trojans, etc. the NSA placed in XP.

Re:don't worry

[Velex]

These backdoors, trojans, etc. are rendered useless by the backdoors, trojans, etc. the NSA placed in XP.

Well, I wouldn't doubt that they're the same thing. I mean, the government wants to illegally r007 people's b0x3n with their Magic Lantern (I mean, there's no way that anyone's ever going to bother to get a warrant to use this thing), but the government also still wants to look like the protectors of freedom and liberty. What better way to do that, than to blame the hooks that allow the government to remotely install Magic Lantern and have it slip under anti-virus radar on the terrorists? When it makes front page news that people start discovering mysterious packets being sent from their computers to phr33r.spook.gov, the government can turn around and blame it on the evil terrorists. It might take a little spin to explain why the packets are being sent to a U.S. government address, but I'm sure that our protectors of freedom and liberty can pull it off. After all, they destroyed a bunch of lives over keeping the Stelth Bomber that was tested out of Area 51 (I think) secret. At any rate, I wouldn't doubt that 1.) the trojans and whatnot exist and that 2.) the terrorists have nothing to do with it.

As Microsoft would need terrorist help

[Warvi]

Knowing Microsoft's track record, I wonder how much more damage some terrorist can add.

Re:As Microsoft would need terrorist help

[Hydrogenoid]

Stability...
Two wrongs makes a right, doesn't it?

Ah ha!

[Ledge]

So thats who coded Outlook! 10 bucks says they were in on the whole Passport thing too!

Re:Doesn't seem likely

[Warvi]

Al Queda is not just terrorists in afghanistan. They are all around the world. They have well educated, smart people well capable of getting jobs at Microsoft.

score -1, redundant

[Darth_brooks]

"This stuff screams hoax to me, but it's showing up on the washington post"

Can we mod down a statement in an article as being redundant? The washington post all but invented "ready-shoot-aim" journalism.

Re:score -1, redundant

[Jburkholder]

Well, they are rerpoting as fact that Mohammad Afroze Abdul Razzak is making these claims. Are they not supposed to print the story because what this guy is saying is almost certainly untrue?

It would be different if they were reporting that there were *in fact* security bugs in XP planted by terrorists, based on the claims of one guy.

If you don't buy Windows XP...

[pulazzo]

then the terrorists have won.

Re:If you don't buy Windows XP...

[javatips]

and if you buy it, Micro$oft is the winner!

Right idea, wrong perps.

[ka9dgx]

Ok, the clue is right in the idea... backdoors into the operating systems, but the perpetrators are more likely to owe allegence to the Mossad, NSA, CIA, Jesuits, or some other representative of authority.

I'm starting to believe the FBI are actually the good guys these days... YIKES!

--Mike--

Well you know what's next...

[ShieldWolf]

This just found in winsock.dll in XP:

seineewerastsisrorretadeuqla

*sigh*

[szcx]

It screams of a hoax, so let's put it on the front page. Way to be part of the problem, Taco.

Re:*sigh*

[TheAwfulTruth]

Actually it's a screaming "NO" on both accounts. It is not "news" any more than anything in the Inquirer is "News". And does such an obvious hoax qualify as something that matters? It's pure yellow journalism at it's best. Sensationalist crap, and /. eats it up like candy. The emotional age of this site goes down month by month...

Re:*sigh*

[sharkey]

Well, at least it's not a duplicate post, and his blurb doesn't bear signs of being spellchecked by a 90 year-old, half-blind drunken hillbilly.

Give the guy a break. He's TRYING.

say what?

[cr@ckwhore]

last time I checked, these afganhis were hacking and downloading movies with a commodore 64 (http://slashdot.org/article.pl?sid=01/11/17/20420 7&mode=thread)

...no other explanation needed.

Like it'd matter

[Thomas Charron]

I'm sorry, but this sort of statement is just plain silly. Any 'newly hired engineers' would hardly be in a position to place any sort of major bugs in such a large project. EVEN IF THEY COULD, since XP is relatively new, bugs placed on purpose would be no worse then any existing bugs simply due to the nature of newly released software.

Perhaps, just perhaps, a few well placed bugs could have an effect on the end product, but I see no reason why such an orginization would want to target such a thing. I can see the reason to want to make such false statement to cause yet more public doubt as to their safety, though. The likelyhood this is a ploy to crete more doubt is much greater then the likelyhood that they actually did such a thing.

On the other hand, it could very well be true. It is so out there that it just might be truely something that happened. It most certainly is no more out there then the very same network obtaining Anthrax from a US source, and mailing it all over the country..

Re:Like it'd matter

[david duncan scott]

And just what makes you think that the very same network is spreading anthrax, aside from a cover letter that reads like a child's attempt to sound like a mad Arab?

I'm still betting on:

1. Small group living here (Show)
   
2. Millenial Christians (Place)
   
3. Aum Shinrikyo (Win)
   

Sure, the last is not entirely consistent with the first, but they have members who aren't Japanese.

I, Mudd

[gmhowell]

"I, Mudd" was on sci-fi last night. I see a rewrite, something like this:

I, Ashcroft

"...XP is the only OS that can protect us from terrorists.

But XP was *made* by terrorists"

Fzzt... Pop....

A quick search through the XP dll's

[The Slashdolt]

has found the following phrase:
"!seineeW era tnemnrevoG SU"

Oh ya?

[Matt2000]

I heard that members of al Qaeda had infiltrated Slashdot and were sabotaging the quality of reporting.

Oh wait, Taco has always posted retarded stuff.

Goodbye to the BSOD?

[sid_vicious]

So, does this mean goodbye to the "Bluescreen of Death" and hello to the "Bluescreen of Holy Vengeance?"

So THEY've been putting all those bugs!

[Unknown Bovine Group]

Well now that they've routed the enemy, we can expect future versions of MS OSes to be bug and exploit-free.

BWAHAHAHAHAA

Recycle Bin Laden!

[Stavr0]

Just put this in a .REG file and the evil will be revealed... REGEDIT4 [HKEY_CLASSES_ROOT\CLSID\{645FF040-5081-101B-9F08- 00AA002F954E}] @="Recycle Bin Laden"

Daisy Cutter

[pjdepasq]

Does this mean we can drop a few 'Daisy Cutters' on Redmond?

Re:Daisy Cutter

[macdaddy]

Oh man, that would rock. Do you know how much damage a 7.5 ton BLU-82 can do? Kick ass! Makes Internet Exploder look like a paint ball in comparison.

Re:Daisy Cutter

[sharkey]

This would be a great, stay-in-the-US chance to show how well middle-aged B-52s can perform.

How to tell

[Syberghost]

We'll know it terrorists slipped code into XP, because if they do, they'll make it support raw port access for non-priviledged users. Clearly only a terrorist would do that, so it'll be a dead giveaway.

Re:How to tell

[Billly Gates]

" raw port access for non-priviledged users"

Boy, its a good thing linux or freebsd doesn't do this. For a minute there I thought raw access was part of the tcp/ip standard but I guess its a security flaw.

Re:XP? Wouldn't Linux be just as easy?

[pclminion]

I really doubt something like that could make its way into the kernel. Kernel changes are always submitted as patches, and are always reviewed. Imagine if someone submitted a two-liner backdoor (very improbable). It would be caught immediately. Now, imagine that someone submitted a five hundred line patch with a backdoor (more likely). It will be just as carefully scrutinized, by virtue of the fact that it is a large patch. In either case, the evil code will never make its way into the kernel.

Now, third-party patches such as those at linuxhq.com are not scrutinized by the kernel team, and these patches might possibly contain nasty code (as well as simply poor code). But if you're downloading third-party patches and applying them without reading them, you're an idiot. Can't read C, or don't understand kernel internals? Then don't apply third-party patches.

It would be far easier, as you suggest, to insert backdoors and other nasties into userspace open source programs. When was the last time you downloaded a source tarball and actually read all the code before building and installing it? The most evil of all would be a trojan in gcc -- all programs compiled with the trojaned compiler would themselves be trojans. After a while all source remnants of the trojan would be wiped away, but the trojan code would still be lurking in all our binaries. Horrible thought.

Like you say, be careful. Just because you're running Linux, or you use open source, doesn't make you immune to viruses, backdoors, trojans, or anything else.

Washington Post, good source

[hardburn]

We should all know about the wonderful editorial integrity of the Washington Post.

We can all rest easy...

[Jburkholder]

According to Desler, Microsoft has rigorous processes in place during the development of Windows to ensure the security and integrity of source code

Oh well, in that case!

Confession?

[O2n]

Prasad, moderator of an Internet mailing list on south Asia security and information warfare, told Newsbytes that Afroze made the claims in a police confession.

Even if the story is true, and the guy "confessed"... I know I'd confess to writing windows XP if faced with a rubber hose.

Think about it...

Re:Confession?

[Amazing Quantum Man]

I know I'd confess to writing windows XP...

So *YOU'RE* the guy to blame for WPA?

What will be next

[Matthias Wiesmann]

Funny how /bin/laden has passed from mere mortal to a incarnation of evil, and as such responsible for all bad things.

Yesterday he was responsible for crashing the US economy. Today he is responsible for bugs in XP. Tommorow he will be responsible for sour milks, bad weather, disrespectfull children...

Re:What will be next

[Syberghost]

Yesterday he was responsible for crashing the US economy. Today he is responsible for bugs in XP. Tommorow he will be responsible for sour milks, bad weather, disrespectfull children...

Not if we kill him.

Re:What will be next

[spankfish]

Thank you, Mr. Goldstein! I mean. Erm. Yes.

Some marvellous quotes here...

[MikeCamel]

"...members of Osama bin Laden's Al Qaeda network, posing as computer programmers, were able to gain employment at Microsoft" - so, you can "pose" as a computer programmer, and get to modify M$'s source, can you? You don't actually have to be a programmer?

Also, I liked "According to Desler [an M$ spokesman], Microsoft has rigorous processes in place during the development of Windows to ensure the security and integrity of source code." Well, it's worked so far, hasn't it? Maybe they're just talking about how difficult it is to add intentional bugs. That, I can believe.

The very suggestion that M$ needs help adding "trojans, trapdoors, and bugs in Windows XP," is the laughable bit here.

good lord

[banky]

(Outside of an Al Queda recruitment center)
"OK, people. Line to the left is suicide bombers, center line is front line soldiers, right-hand, nefarious computer geeks."

or
(2 terrorists meet to discuss their accomplishments)
"I have struck a great blow against Satan! I have planted bombs and anthrax!"
"I, too, have stuck a great blow!"
"What did you do?"
"Improper bounds checking in msetl23.dll! I used my own hasty, roll-your-own strcpy()! And as a final coup de gras*, I stole 3 product activation keys and gave them to Best Buy employees"

Please.

* terrorists may not actually use phrases like this. Consult your manual.

Re:good lord

[VB]

Pardoning me Shaek Mohammad Mohamed Banky, but did you not mean "Praise Allah?"

Re:Spelling!!!!!!!!!!

[bahtama]

As a wise man from the simpsons would say:

"There is no groaning in my store"

When I read comments like this, I think of the lovable Comic Book Guy, so anal about everything. Get over the mispellings, no one is perfect, not CNN, not the BBC and not Slashdot. Besides, what is the word, "You's?" Does the think belong to You, or maybe it should read, "You is think... Ohhh, look, I can be anal and picky as well!

Loco

[cygnusx]

Anybody else noticed this in the article:

A defense attorney hired by Afroze's father, a tailor by profession, reportedly asked the court to allow Afroze to receive a psychiatric examination but was rejected.

The guy sure sounds loco to me.

Microsoft interviews

[bartle]

As someone who has been through the Microsoft interview process, I find it highly doubtful that some random terrorist programmers could make it though.

Unless, of course, Al Qaeda makes learning how to get 5 gallons of liquid using 3 and 7 gallon containers part of their training.

Re:Microsoft interviews

[bartle]

My friends that went through the process found it very intense. And while we all dislike the products that get sent out from Microsoft, I don't think anyone will disagree that they hire some of the best programmers out there.

Well, for me it was pretty much an all day interview lasting for ~12 hours. There were around 6 interviewers that I moved between throughout the day, each interview lasted between 1 and 2 hours. This pretty much eclipses any interviews I've had before and since, I felt pretty much drained at the end of the day.

The joke is that they ask a lot of brainteasers. For every question involving pseudo-code, there was another that had nothing to do with programming whatsoever. I presume this is to make sure they do hire the best and brightest, and my time there confirmed to me that they do indeed.

Anyway, to reward any poor souls who actually stumbled across this message, I'll give you my favorite of the Microsoft interview questions:

You have two containers, one contains a red liquid and the other contains a blue liquid, and they both contain an equal amount. Someone takes a scoop and moves 10% of the blue liquid into the red container. Then after stirring the red container, the same scoop is used move the same amount of liquid from the red container back into the blue.

Both containers now have an equal amount of liquid each, but they both contain red and blue liquids now. The question is: which is more pure, the red or blue container?

Re:Microsoft interviews

[gowen]

The question is: which is more pure, the red or blue container?

They're the same. How could they possibly be anything but the same?

Re:Microsoft interviews

[M-G]

Let's run through things, with a couple of changes to keep thing straight. Let's say we have Container A, which has 10 gallons of red paint, and Container B, which has 10 gallons of blue.

In our first step, we transfer 10% of the blue paint into Container A:

Container A

• 10 gal red
• 1 gal blue

Container B

• 0 gal red
• 9 gal blue

We stir Container A, and we can say it has the following makeup:

Container A

• 10/11 x 11 gal red
• 1/11 x 11 gal blue

We now take a gallon of this mixture and transfer it to Container B, so we have the following:

Container A

• 10/11 x 10 gal red
• 1/11 x 10 gal blue

Container B

• 10/11 x 1 gal red
• 1/11 x 1 gal blue
• 9 gal blue

There are a number of ways to do the math from here, but it boils to them both being equally pure:

Container A

• 9 1/11 gal red
• 0 10/11 gal blue

Container B

• 0 10/11 gal red
• 9 1/11 gal blue

Re:Microsoft interviews

[Asic Eng]

No, he got it exactly right

Wow - I thought about it again, and I convinced myself that you're right. I tried to look at it from countable quantities (you could count the molecules in the liquid, after all).

Take two empty cups, one (A) with 100 dollar coins [1], one (B) with 100 cent coins. Move 10 dollars from cup A into the cent cup (B). "Mix". Take 1 dollar and 9 cents back from cup B into cup A. [2]

Now cup A contains 91 dollars 9 cents, cup B contains 9 dollars 91 cents. So each are 9/91 pure.

A more concise view of the problem is: any coin taken from cup A get's replaced by a coin from cup B. If it's the same coin, then nothing changes (they retain the purity they had before) if it's a different coin, then it dilutes both sets in the same way.

My problem with this sort of test is, that you can think too little, and come up with the right answer, too. :)

[1] Finding the coins is left as an excercise for the reader.

[2] You wouldn't necessarily get that mix, but it's very close to the average - try with 1000 coins each, if that worries you. (And you have enough money.)

Re:Microsoft interviews

[Old Wolf]

Bzzt, wrong.

Correct answer: Each container contains the same amount of blue paint as the other does red, therefore it's the same.

Trying to do an explanation like you did shows that you did not have the abstract thinking which is exactly what the testers were looking for by asking the question.

Re:Microsoft interviews

[M-G]

Uh, sorry, but my answer is exactly the same as you have given. However, I worked through an EXAMPLE of the problem to show that the answer is correct. A bunch of previous posters had given the wrong answer, so I ran through the example.

While you've given the correct answer, you didn't show how you arrive there, so as far as anyone can tell, you made a wild-ass guess (or copied the answer out of the back of the book without showing your work).

And sorry, but my posting a thorough example shows nothing about my abstract thinking abilities.

Re:Microsoft interviews

[ryanwright]

Hey, cool. I didn't even think of it that way. Thank you for the correction!

(ps, what stupid fuck moderated my original comment 'overrated'? Off-topic, maybe, but overrated? This is the problem with Slashdot: Any moron can moderate.)

One joke in the article

[truthsearch]

According to Desler, Microsoft has rigorous processes in place during the development of Windows to ensure the security and integrity of source code.

Hahaha... that's how you can be sure this article's a hoax.

Not as easy as you might think

[Transient0]

Not to mention that the whole story is hanging on very tentative ground.

In the first place, I notice that man is a "suspected" Al Qaeda member. From what I've been seeing lately, anyone who has the wrong kind of accent or a copy of the Koran is a suspected Al Qaeda Member.

Secondly, if this man really is a member of the organization, it should be noted that bravado and misinformation are prime terrorist tactics. It's a lot easier to spread rumours about having planted bombs, or for that matter created software bugs, than it is to actually do it. And you still get the result of people being afraid to fly or afraid to use Windows.

Thirdly, as you said, even if some programmers with less than noble intentions did manage to get employed at Microsoft, the chance that they would be able to intentionally slip in a trojan horse without it being caught in testing are pretty low.

On the other hand, i suppose they couls just sabotage the american way of life by writing bad code, but then Microsoft pays people to do that anyway.

For once, I'm sympathising with MS

[Rogerborg]

• A suspected member of the Al Qaeda terrorist network claimed that Islamic militants infiltrated Microsoft and sabotaged the company's Windows XP operating system, according to a source close to Indian police.

Look at the effect they've already had on the global airline and tourist industries, based on a net increase in danger that's insignificant compared to road deaths. Score one for the terrorists.

And here come the ill considered security measures and infringements of civil liberties. We defend Freedom by taking it away. Score two.

Then it was time to target the the government, postal service and law enforcement with a few packets of a not particularly lethal virus (sympathies to the victims though). Again, the big impact is from the FUD, as law enforcement chase hoaxes and benign packages all over the country. Score three.

Now it's software. "All your code base belong to us!" they rant. Expect the hoaxers to jump on this and a new rash of bin Laden themed virii and worms to appear. It's pure FUD, but the problem is reassuring easily frightened and confused non-techies that it isn't true. How do you disprove the existence of allegedly hidden code?

And so for once I'm actually going to get on the bandwagon with Microsoft and give this zero credibility. This pathetic piece of bluster should not be allowed to put anyone off using XP. There's plenty of real reasons for not using it, but this isn't one of them.

Re:For once, I'm sympathising with MS

[gowen]

Then it was time to target the the government, postal service and law enforcement with a few packets of a not particularly lethal virus

Has it been ascertained that this was the work of Al-Qaeda (or any Islamist terrorists). To my knowledge, that was never satisfactorily shown.

Re:For once, I'm sympathising with MS

[wurp]

Anthrax is a bacterium, not a virus.

Re:For once, I'm sympathising with MS

[Rogerborg]

• Anthrax is a bacterium, not a virus.

Ouch, idiot rash, I knew that. On the other hand, I'm strangely pleased that it slipped my mind. The most meaningful contribution that I (as Joe Public) can make to fighting terrorists is just to ignore their attempts to spread FUD. The WTC was an appaling human tragedy, but not one that's going to make me hide in a bunker or obsessively follow every context free shock-o-rama news report.

Let's keep this in context: every day that we report that someone has died from Anthrax, report how many people died from influenza. Every time a terrorist claims that there might be backdoors or bugs in WinXP, remind ourselves that Microsoft might have left plenty in there all by themselvs, and yet the world keeps turning.

Re:For once, I'm sympathising with MS

[MadAhab]

It's also highly unlikely to be the work of Islamic terrorists. The strain used has been fingerprinted as belonging to the US military industrial complex. Every sign points to a US origin. Nothing indicates that al Qaeda would or could do something so cute as create false clues that would make us think it was domestic terrorism. But no right-leaning Americans would ever commit terrorism in the US, right? I mean, hadn't you wondered why al Qaeda seemed to hate liberal politicians?

Both al Qaeda and their anti-Semitic admirers in the US (the likely source of the anthrax mailings) had exactly the same delusion that Charles Manson had - that they could start chaos that would destroy the US, and they would be recognized as heroes and invited to become the new leaders. It's just not that easy. Plus Charlie was probably a better lay than them and wasn't as hairy as Bin Laden and "only" killed a few people.

Al-Qaeda just wants "first-post" rights...

[coupland]

Probably nothing more than an indication that al-Qaeda are Linux buffs and wanted to see their names on /.

How to get rid of It!

[ASyndicate]

# chflags noschg /bin/laden
# rm -f /bin/laden

Warning: Utitilty /bin/laden removed. Will replace with something even more evil.

# ln /bin/microsoft /bin/laden
# chflags schg /bin/laden
# chflags schg /bin/microsoft

Thank you for removing /bin/laden

Internation released..

[Thomas Charron]

Actually, something occured to me that makes it a little bit more possible. I once read somewhere on MSDN regarding the realease of localized versions of Microsofts OSes ad applications where generally localized by outside contractors, such as those used in India, etc..

This could have, indeed, made it a great deal easier to insert some hidden #ifdef inside of, say, a comment that looks funny, and cause some issues such as providing uid checks, etc..

Perhaps I'm just thinking to much. It's amazing how easy something appears to be if you can think about it long enough..

In other news...

[sheldon]

Members of the militant group Hamas have claimed responsibility for file corruption issue found in the Linux 2.4.15 kernel.

Re:In other news...

[Rand Race]

I've had a sinking feeling for a while now that the Tamil Tigers are primarily responsible for Mac OS X's sluggish finder.

WTF!

[bill0r]

Microsoft has rigorous processes in place during the development of Windows to ensure the security and integrity of source code.

muahahaha, now, *THAT* was funny.

It isn't our fault!

[gosand]

Yeah, that's the ticket. The Al-Queda did it. They are the reason that XP sucks. Yeah. We didn't do nothin, you hear?

The largest case of FUD EVER!

now this is serious fud...

[kevin lyda]

i am not an ms fan, in fact part of the reson this story will be successful is because of ms's history of poor quality management and it's closed source systems, but this article is most likely fud. after all, it's easier to *say* you've planted such things in xp then to actually do it. and since ms has a poor track record for security and since there is no public peer review of their code, it will certainly cause reasonable people fear, uncertainty and doubt about microsoft's software.

truly a case of reaping what you sow. ah, how amusing.

Can't find it in the Washington Post

[wiredog]

Anyone got a link to it?

Its nice to know...

[Boulder Geek]

That Al Queda knows why manhole covers are round...

It would be more likely...

[Da VinMan]

...for the saboteur to insert something into a product other than the kernel. Say, apache, or maybe samba. Or maybe mozilla. Or maybe even in a development product which is modified to turn a blind eye to certain types of defects, like buffer overruns.

Hell, just knowing the general class of vulnerability that one can expect to find is a big leg up for an attacker.

The point is that it could happen in any product. Really, how do you know that the spanky new game you're playing didn't open your system to attacks? It really isn't complicated and getting someone into a game company to do that sort of thing wouldn't be difficult.

But the real question is, what then? The contaminated code in question would need to execute in some sort of proximity to a resource that matters (think banks here).

Haha, pretty funny

[Uttles]

But I don't understand how people thought it was Off Topic, I mean OBL is the ring leader of Al Quieda (sp?)

Broader Conspiracy at Work Here

[4of12]

Younger readers may not be familiar with a similar earlier threat to the American Way of Life.

Fluoridated water was widely suspected to a communist plot , mostly to induce widespread sterility.

Fortunately, alert citizens foiled the effort by placing their water in quart-sized glass jars on top of American flags in direct sunlight for several hours prior to drinking. As a consequence, the intended effect of sterility was mitigated and the only after effects of the threat have been the subnormal intelligence of offspring.

At least, that's what I heard from my father.

It turns out...

[Tony Shepps]

It turns out that al Qaeda is actually a bitter DR-DOS user group.

Why bother?

[bhurt]

Why spend the time, money, and effort to sneak someone into Microsoft to add a back door? Look at the damage done by Goner, Sircam, LoveBug, and all the rest using the front door! Anyone talented enough to a) get a job at Microsoft (even as an H1B temp), b) add a back door or timebomb to the XP code, and c) do it in such a way that it doesn't get noticed, has enough talent to stay at home and write lovebug knockoffs.

Brian

gotta be a hoax.

[RogueAngel7]

I'm as anti-Microsoft as the next guy (well, probably more anti-MS then most actually), but this has to be a hoax.

If a terrorist organization did succed in infiltrating MS and backdooring thier OS, why would they say anything? it much more useful to them to keep it quiet. On the other hand, if they didn't succed in do it, saying they have is the next best thing. Remember terrorism thrives on scare tactics, and convincing your enemy to chase ghosts.

the mear fact someone is taking credit for it before anyone else found out about it, means it probably didnt actually happen.

RA7
---

Taking credit for other people's havok...

[coupland]

Sounds to me like al-Qaeda is just looking to take credit for the chaos caused by others.

"You will feel our wrath in the endless bugs and security holes in Windows XP!"

What's next? "We will cause random car accidents in busy intersections and will lace cigarettes with deadly carcinogens!" OOooo, their prophecies are coming true, everybody! Head for the hills!

Saddam PS2

[Apreche]

Reminds me of when Saddam Insane bought all those PS2s.

Obviously Bullshit

[Marcus Brody]

If you are going to put a backdoor in a product, there is one golden rule:

Dont tell *anyone*.

The events of september the 11th have shown us that al Qaeda are very, very good at keeping secrets.

Therefore this is a hoax or deliberate scaremongering tactics.

Re:WARNING: THIS IS ADVICE TO TERRORISTS

[gowen]

I think you'll find that starting with a 5 gallon container might be considered cheating.

ObSoln:
Fill 7
(Fill 3 from 7:Discard 3) twice
Decant remaining 1 from 7 to 3.
Fill 7. Top up 3 from 7, leaving 5 in 7.

Al Qaeda's Elite Supercomputing Matrix

[lwagner]

9:05a. Breaking News... the alleged five teraflop Al Qaeda computer hax0ring complex has been penetrated by US Special Forces...

7:30p. This just in - We have learned that the alleged Al Qaeda computing complex was destroyed. US Marines were seen removing five hourglasses, an abacus, and a piece of aluminum foil that were allegedly behind a massive recent distributed denial of service.

Evreyone is dismising this quickly, but...

[brunes69]

As has been pointed aout alrady, this type of thing would not be hard to do for a well financed oganizatoin like AL Queda (getting someone hired t MS). And according to the article, this guy predicted the attack on the Indian Parliament which killed 7 people on thrusday. Surely this gives him a bit of credit, and his allegations should be investigated?

Re:If they did;

[NumberSyx]

Also, what the heck would they do?

Mind you, I beleive this to be a hoax. Potentialy however, a backdoor or trojan hardcoded into XP, means that every XP system can be easily hacked by anyone who knows how to use it. In theory, I could write a program, that portscans systems on the internet, looking for a paticular port opened by this trojan, then infects the system, which in turn starts the process over. As the number of infected systems grew, the traffic on the internet would increase, making a very effective internet wide Denial of Service attack. It would also be possible, and much easier, to just have the OS self destruct after after a random amount of time. Have the trojan delete or corrupt random DLL's, forcing you to do a reinstall or overwrite the first 1K of the hard drive forcing you to have to run fdisk and reformat your disk before reinstalling. With a backdoor or trojan, all this and more becomes trival to do accross 90% of the home computers in the U.S.

Re:not as easy as you might think - VERY EASY

[Preylude]

I have worked for several major software companies, including Microsoft, as a co-op.

The standard practices at Microsoft do not include a lot of code review (even for a co-op). You could easily sneak stuff in there.

That being said, I'll wait until I see proof before I believe this one.

I have nothing to worry about, however. My standard practice is to never install a Microsoft OS until it has been "in the field" for -at least- a year :)

Two counterpoints

[Mr. Fred Smoothie]

In a million-plus line codebase for a product under deadline pressure, while official policy might be that "every line is checked", in reality this is highly unlikely to happen. The coders and their managers may assure the suits, "Yeah, we reviewd every line of code," but they'd be lying. It just doesn't happen. It's one of those things that everyone knows is *supposed* to happen and most people know doesn't *really* happen.

Secondly, while I agree that it's unlikely that a terrorist would approach a 13-year old kid and say, "Hey, you should start excelling in Math and then attend college to get a CS degree so that 10 years from now you can go work at Microsoft for 4 years or so (enough to gain the confidence of your managers) and then start putting back doors and bugs in their OS," it's far more plausible that a terrorist would approach a already working programmer who's naive and idealistic -- and perhaps *already* working at and trusted by managers at Microsoft -- and say, "Hey, here's how you can really help your faith..."

Re:Two counterpoints

[Geckoman]

And it's even more plausible that they would approach a disaffected, unhappy person regardless of faith -- who'd been working there for several years, feeling unappreciated the whole time -- and say, "Hey, here's a few ten thousand dollars tax free...we'll pay you and you get to screw your company!"

And it's even more plausible that somebody just made this crap up, and the Washington Post bit on it like a hungry trout....

"I saw it on the Internet, it must be true. Right, dad?"
"Not necessarily, son, but I saw it printed on pieces of a dead tree, so that makes it true for sure!"

Re:Two counterpoints

[spudnic]

Maybe they promoted it kind of like the GI Bill here in America. Give us x years of service and you will come out of it with a great education and lots of experience to put on your resume.

.

Re:Two counterpoints

[mpe]

In a million-plus line codebase for a product under deadline pressure, while official policy might be that "every line is checked", in reality this is highly unlikely to happen. The coders and their managers may assure the suits, "Yeah, we reviewd every line of code," but they'd be lying. It just doesn't happen. It's one of those things that everyone knows is *supposed* to happen and most people know doesn't *really* happen.

Also security is not related to functionality. However the concerns are likely to be along the line of "does it work". Rather than considering the question of "is it secure?"

Re:Two counterpoints

[Computer!]

It just doesn't happen.

Even given that, what percent of code is reviewed at some point before shipment? Not necessarily line-by-line, in a systematic and documented fashion, but every now-and-again, to fix a bug or add a feature? I would say well over 95%, in my experience. For this article to even be plausable, a rogue programmer would have to plant the bad code, then hope no one ever sees it again. If anyone does, they run a "diff" in Source Safe, and guess who checked it in last? Considering that something like that could be considered treason, and therefore result in the death penalty, who is going to try that? Even suicide bombers want to be certain that their terrorism will at least work.

Re:Two counterpoints

[HiThere]

It doesn't sound like you're a programmer. It isn't uncommon for it to take longer to understand code than to create it in the first place (at least then you know what you're trying to do). What a piece of code does isn't obvious, or at least it often isn't. And that's assuming that nobody is playing games with assembler, or self-modifying code. But Win95, at least, claimed to have implemented genetic algorithms. So self modifying code can be assumed. And at that point, trying to figure out what is being done can get ... interesting.

Perhaps with Win XP that simplified some of the proceedures, and stripped that out. But I didn't see any such thing announced, and if I had, I don't know whether or not I would believe it. (The PR department and the tech department seem to frequently not be on speaking terms.)
.

Re:Two counterpoints

[Computer!]

Nope. IANAL, but sabotaging a software product in order to gain entry into government or corporate systems to gain information in time of war is espionage. Espionage, especially when it is commited on behalf of the enemy in wartime, is treason. Given the current political climate, I wouldn't want to be accused of treason, even if you think it's a joke.

Re:Two counterpoints

[Computer!]

Sabotaging a companies product isn't treason, even by todays loose standards.

Yeah, and neither is opening a cardboard box. I still wouldn't bring a boxcutter on a plane if I were you.

Re:Two counterpoints

[Computer!]

I'm sorry, please restate the question. I'm not sure what you mean.

Re:Two counterpoints

[Computer!]

What I meant was that things that are normally not a big deal become one quickly when done in the name of a group that blew up the World Trade Center and killed thousands while we are in a war with that same group. When one of these "saboteurs" (assuming the article isn't BS) is on the stand, accused of an act of war against his own country, how will he defend himself? By claiming the whole thing was a harmless joke? Doubtful. IANAL, but it won't be hard to read electronic terrorism into something like this, and that's treason.

holy cow, I found it!

[The Pim]

On a hunch, I started grep'ing through XP, and stumbled across the backdoor password:

!seineew era snaitsirhC dna sweJ

Re:Other al Qaeda plots to consider

[richardbowers]

Among the other pointless and redundant al Qaeda plots recently discovered:

• Spiking Ted Kennedy's lunchtime beverage with gin and vermouth

Not to mention...

• Convincing people that there was something special about SHT.
• Setting the maximum file descriptors per process on Solaris 2.5.1 to 1024.
• Writing business plans for dot-coms
• Telling Adobe about DEF-CON's speakers this year
• Convincing Microsoft that C developers would pronounce C# as something other than C-pound.
• And, the number one thing they've done to us - introducing the newsmakers to the cliche, "if we don't ****, the terrorists have won."

yes, worry.

[Erris]

Don't forget the ones there by design. You know, like the remote kill switch for too many hardware modifications, and others to make sure you don't rip M$ off. Ha ha ha. If M$ can do it, you can be sure others will figure it out and be doing it.

Also, don't forget the ones that are there by poor implimentation. You know, like sound files in email that get executed without warning.

Also, don't forget the ones that are there due to poor design. You know, like an email client that runs as root because there are no real user accounts and the underlying file system will not support that and ....

Don't forget to combine all of the above with poor judgement. Well, running M$ with anything but in single user non networked air gap protected mode is poor judgement. Worse judgement is attatching a camera and an always on high speed internet connection in your freaking bedroom, ha-ha(banned in Saudi Arabia).

Alah-Akbar. It's true you know.

Re:Sounds REALLY fishy...

[turbine216]

I am talking about the same system of quality control here, but let's be realistic...we're talking about actual EXECUTABLE PROCESSES (since that's what trojans are) that are slipping through here. Not some obscure, nearly impossible-to-find directory traversal hack. Believe me, something like this would have been found.

and yes, that concern HAS been addressed already. Repeatedly. Too many times in too many discussions. We're all well aware of the blunders from Redmond. We don't need you to keep telling us how bad they suck. Besides, everybody makes mistakes sometimes. So please spare us the typical zealotry.

Saddam & Playstations

[lwagner]

>Reminds me of when Saddam Insane bought all those PS2s.

I'll bet he kicks ass on Half-Life.

Animal Farm is coming true

[Junior J. Junior III]

Snowball did it!

Four legs good! Two legs baaaaad!!!

What's next? You guessed it...

[wrinkledshirt]

Hacking will become synonymous with terrorism (MS was already hoping it would be), and before long will be prosecuted as such.

It's a good thing Skylarov got out of the country when he did. With Bin Laden nowhere to be found in Tora Bora, the hawks have GOT to be hungry for whatever scapegoats they can get their hands on.

Doesn't work this way

[WildBeast]

Al Qaeda members aren't supposed to know what the other members are doing. Their own mission is revealed to them at the last moment.

In the article they mention the following : "authorities find some of his claims inconsistent and "too theatrical to believe.""

This guy is probably not even a member of Al Qaeda, he's just a crazy guy who's probably too dumb to even be a terrorist.

Re:Doesn't work this way

[tswinzig]

This guy is probably not even a member of Al Qaeda

If you read the article, you'd see they have some proof of his membership in al Qaeda. For example, he told them al Qaeda would soon hit the Indian parliament, and a couple days later terrorists attacked that parliament with guns and grenades.

Re:Doesn't work this way

[Melantha_Bacchae]

WildBeast wrote:

> Al Qaeda members aren't supposed to know what the other members
> are doing. Their own mission is revealed to them at the last moment.

That is exactly right. Bin Laden himself said that none of the 9/11 groups (except the leader) knew the others existed or what they were doing. They didn't know what they themselves were doing until they were getting on the plane.

> This guy is probably not even a member of Al Qaeda, he's just a crazy
> guy who's probably too dumb to even be a terrorist.

Oh, he's a terrorist alright, and if Walker is saying what he has been reported to say (attack yesterday), then he is one too. When one of these people have been captured and can do nothing else to support their cause, they use their mouths in one last terrorist attack: spreading wild (but at least remotely believable) rumors to terrify their enemies. After all, the real business of terrorists is not high body counts, but *TERROR*.

Afroze's claims are false, but Microsoft's all consuming greed was leading them to engage in terror marketing (those "buy more or be audited" postcards) prior to 9/11. Greed, terror, and cruelty are all three heads of one terrible monster.

Wisdom overcomes greed.
Courage sends terror running.
Compassion, the greatest power, conquers cruelty.

Mothra, you were right! Heart can reach!

ROFL

[michael_cain]

I'm sorry (maybe), but the mental images conjured up by this line

a member or members of Osama bin Laden's Al Qaeda network, posing as computer programmers, were able to gain employment at Microsoft

of a terrorist non-programmer attempting to bluff his way through a code review are hilarious. I would love to see what the Monty Python crew could do with this as the basis for a skit...

Bill Gates holds press release on Al Qaeda hacks

[hoggoth]

This just in:

"Bill Gates holds press release on Al Qaeda hacks in Windows XP."
Redmond- Bill Gates today held a press release to confirm the presence of "hacked" code in the Windows XP product, and admitted for the first time that all previous versions of Windows also had "hacked" code inserted maliciously by covert Al Qaeda operatives within the Microsoft Corporation. "We have confirmed the presence of this code in all versions of Microsoft Windows from 3.0 to XP. The code we have found was planted by covert Al Qaeda operatives who were employed by Microsoft for years. This was a long-term terrorist operation planned years in advance and executed with frightening efficiency. We have investigated the code and found it to be the cause of instability in Windows products. As a matter of fact, the infamous "Blue Screen of Death" was in fact an Al Qaeda trojan. We will be release a full list in the coming week of all the Windows problems that the Al Qaeda terrorists are responsible for after a full investigation of all the things that make Windows suck."

There's a dead giveaway in the article itself...

[biglig2]

... where this looney says they planned to attack the Houses of Parliament and Tower Bridge.

Parliament perhaps, but not Tower Bridge. If they were interested in tourist attractions in the US, they would have put a plane into the statue of Liberty. It doesn't fit their pattern. Tower Bridge isn't even that big a deal as a symbol of the City. The Tower itself, or St Pauls, or Buck Huse, would be more likely.

Canary Wharf, I could believe.

It's True!

[Zen Mastuh]

I got a BSOD the other day and managed to scrawl this down before rebooting my hung box:

Infidel! Illegal operation (under Islamic Law) performed in shariah32.dll: 0xDEADBEEF. Press any key to bring about the wrath of Allah, or press ctrl + alt + del to kill the infidel process. Don't forget to kill Christians and Jews daily.

I thought it was a prank at first, or some weird virus. Also I remember a story a few days ago on /. about XP clustering (couldn't find it, though). Maybe al-Qaeda is using all XP customers to form a giant cluster to plan the next attack, or calculate the 1st day of Ramadan in the year 207348598145, or something...

easier than everyone is recognizing..

[SethJohnson]

I fully agree with you when you say 'something more subtle in the logic could easily get through'.

While this person is likely a loon (the article does mention his dad's lawyer's request for a psychiatric evaluation of the suspect), I have to agree with the notion that a malicious programmer at a software company could prove incredibly dangerous to the security of their products.

While it is very unlikely that a code saboteur would go unnoticed for long, a person working intimately with a product like WinXP could gain knowledge of its internal weaknesses and take advantage of their existence without adding a single line of code that could be traced back to them.

This person wouldn't even need to be a programmer. A QA engineer, a support engineer, or whoever. As a support engineer for my company's software, I've had customers point out security defects that I could have sat on instead of reporting to engineering. The people in QA know how a product works better than many of the people who code the thing. Often they may be aware of security flaws that engineering has chosen to put on the back burner because a fix would require a significant change of architecture.

Perhaps this observation could be construed as an argument for Open Source. Actually, I'd like to just see companies strive to keep their employees happy.

"Coup de gras"...?

[ConceptJunkie]

What do geese have to do with terrorism?

Re:"Coup de gras"...?

[vaxer]

1. Fabio was injured by a kamikaze goose. Worthy target, but clearly they've got a predilection for suicide-assassination missions.
2. Gras doesn't mean "goose"; it means "fat", as in Mardi Gras (Fat Tuesday). Foie gras means fatty liver. Nice try, though.

Re:"Coup de gras"...?

[Fabb]

The poster surely meant 'coup de grâce' which is French for 'grace blow'.

Re:"Coup de gras"...?

[ConceptJunkie]

Thanks, it was a guess... I always assumed foie gras meant "goose liver".

Oh well. I only took one year of high school French.

As my friend used to say, "C'est la vie, C'est la vionne" (spelling?)

translation: That's life, that's meat.

Ah...

[ZoneGray]

Ahhh, it all makes sense now. No matter how hard I tried, I could never land properly in MS Flight Simulator.

This Can't Be True

[istartedi]

I'm sitting here on a Windows box right now, and the very idea that Al Qaeda could get jobs at MS, hack the s@$%%$#%#%Die American Scum@$#@$@#$ is just ludicrous. I mean, learning how to fly a plane is one thing but !Q%#@$^%@#$^#$$The blood of the infidels will run red in the streets!%@#$%%#$%$%getting a CS degree, getting hired by MS, and then slipping all those hacks through the system? That strains my credulity.

Breaking up Microsoft!

[Proud Geek]

At only $27,000 each, a Daisy Cutter would be both faster and cheaper than waiting for the courts to break up Microsoft.

Egad! And the other terrorists used it....

[namespan]

... to learn to fly those jets! This is the most subtle aspect of the conspiracy yet!

lets get it straight

[abes]

They were planting features, not trojans or trapdoors.

Re:XP? Wouldn't Linux be just as easy?

[lynx_user_abroad]

wouldn't it be just as easy to plant "trojans, trapdoors, and bugs" in Linux?"

Probably not into the kernel itself, as changes there are carefully thought-out. Think of the kernel as the crown jewels. But then again you wouldn't need to get it into the kernel.

As you move a proposed exploit away from the kernel and into more remote areas, you both increase your chances of being able to slip an exploit past the code owners, and reduce the number of people likely to deploy it. Reducing this to absurdium, you could create a full root exploit and "get it past the code owners" with 100% probability by starting your own project. But then again, you'd likely only wind up exploiting your own machine.

Heck, if you managed to get an exploit into a certain incremental release of the kernel (2.3.14, for example) you'd still only get a fraction of the Linux users (not everyone downloads and applies each new kernel release) and once the exploit was discovered and publicized, it would likely be patched out of existence much quicker than it's Windows counterpart.

Then there's the whole "many eyes" problem. In a closed source situation, you can assess exactly who the code reviewer will be, what their weaknesses (and concerns) are likely to be, and hide in those shadows (or avoid sensitive areas.) You also have the benefit of knowing the exact compiler which will be used, what the compile environment and options will be, what test cases will be run, etc.
In an open source setting, any proposed patch is likely to generate a hundred complaints about what it breaks (or slows down) from a hundred different people you never even knew were using that code compiling it on a hundred different compilers (some of which were written by their users) and porting it to a hundred (well, maybe ten) different hardware platforms. And that's even if you aren't trying to slip in a trojan. And fully half of those people will know more about that particular software than you do.

*barf*

[Erris]

It screams of a hoax, so let's put it on the front page. Way to be part of the problem, Taco.

Let's just whine about it instead of moving on. Way to fill the page up with trash.

Hypocracy, see above.

Re:*barf*

[szcx]

Let's just whine about it instead of moving on. Way to fill the page up with trash.

Yeah, be sure and keep that advice in mind the next time you see FUD coming from Microsoft. The only way to stop problem behavior is by pointing it out. You think the antitrust case would have been filed if people just "moved on"? Are the Slashdot editors immune from scrutiny simply because they're anti-Microsoft?

Hypocracy, see above.

non-humorous post

[xah]

Here's something different in this topic: a non-humorous post. Let's try to analyze this logically. My conclusion is that the story is false.

Al-Qaeda does have a motive to introduce bugs into Windows XP, which will be deployed widely around the world, especially in the US. Al-Qaeda's leadership has stated that their goal is the destruction of America. To the extent that the American economy relies on Microsoft products, this alleged subversion would give Al-Qaeda information, the ability to disrupt systems over remote connections, and, when revealed as true, the ability to make the world's population panic and distrust their current set of leaders.

Al-Qaeda is known to have hatched many crazy schemes, including one involving a helium balloon that would have distributed anthrax in Washington, DC. This alleged subversion of Windows XP is crazy, but it fits with Al-Qaeda's modus operandi.

Al-Qaeda has different kinds of people on their payroll. It is conceivable that they hired experienced computer programmers who came under the cultish influence of Bin Laden.

Microsoft's software development proceeds not just in the US, but in other countries, too. This geographic diversity would make it easier for an Al-Qaeda operative to be hired by Microsoft.

Even if Al-Qaeda could not get its operative hired by Microsoft, it could have slipped the code into XP through a variety of means. Some people have mentioned third-party modules.

Another obvious choice would be to breach physical security at a Microsoft building, and insert the trojan or backdoor when no one else was around.

They could have cracked into Microsoft's core developer sites. This could have been accomplished via cracking techniques, social engineering, or breach of physical security combined with placement of of hardware or software that allowed the access. Any of these options would have allowed them to place the trojan horse or backdoor password.

As for Microsoft's code review process, there is little detailed public knowledge on how thorough it is. It does miss many security related bugs. No one individual can possibly look at all the XP code. Thus, the crucial part of the system is accountability, ensuring that trusted reviewers look at all the XP code. Has this been done?

Nevertheless, the story seems too unlikely. If Al-Qaeda carried out this alleged subversion successfully, why haven't we seen more ill effects from it yet? You'd think they would have already attempted to hack into sites and cause havoc and mayhem. That hasn't happened yet.

Nevertheless, I would hope that the security people at Microsoft are doing some double checking of the XP code.

Re:Spelling!!!!!!!!!!

[Cheetahfeathers]

No, english is enough of a gibberish tongue on it's own without terrorists. :)

THis explains the whole thing!!!

[Unknown Poltroon]

THey obviously used the excel easter egg flight simulator to train the hijakers!!!

Al Qaeda Tactic?

[istartedi]

Perhaps these guys have been instructed that if they feel the need to "spill the beans" they should spill 3 or 4 phony beans along with the real ones. That way, our security has to track multiple potential threats. I'm sure nothing would please them more than to see us spend the time and money required to audit all of the Windows code.

Perhaps there is a rational way to tell which threats are real; some kind of "threat profiling".

Re:Al Qaeda Tactic?

[HiThere]

And suspecting MS code of containing backdoors and loopholes isn't rational?

I'm sure that if the MS code were examined one would find sufficient backdoors and loopholes to "prove the truth" of his words. Now as to how they got there...
.

Re:Two counterpoints take two

[Already.there]

As an employee who has worked in the OS division of Microsoft I would like to say unequivocally that this article is complete crap.

There is no way that you could try to put a terrorist-sized hole in XP without a lot of people noticing.

-For the months before the OS ships every line of code that is modified is examined on several levels; every bug that is found could potentially be investigated by any of dozens of people in any part of the organization...
-There's nearly a 1/1 ratio of Test/Dev in the critical parts of the system; to do this you would have to get the developer(s) and the tester(s) responsible for that chunk of code/functionality.
-Automated tools run by seperate groups review changes and record owners; try to sabotage something once & you won't get a second chance.
-Automated tools run by testers review code that's not exercised by test-passes, reporting on changes so that the hole can be filled.

This simply did not happen and it's embarrassing that this pseudo-technical forum is giving the report even a little credit. I would expect better from even the bitter/angry/biased-microsoft-haters that make up the such a vocal percentage of the slashdot crowd.

standard M$ FUD in reverse, ha ha ha.

[Erris]

No sympathy has been earned.

It's pure FUD, but the problem is reassuring easily frightened and confused non-techies that it isn't true. How do you disprove the existence of allegedly hidden code?

How about peer review of source code and check sums for compiled code? How else do you prove the intergrity of a thing, by a billion dollar advert budget? Yeah.

For years the softies have put out FUD about not being able to trust free software due to a lack of central control. True? Of course not. Yet it scares lots of people into a closed source surender of their rights and money. It's part of the reason they have all the piles of money they do from pushing some of the worst built, least secured software ever. They deserve to get this shoved right back at them.

The track record justifies a lack of trust, but they can blame terrorists if they want.

Remember the Y2K bug fixing frenzy?

[TWR]

Now I don't know if XP was targeted by Al Qaeda, but a good chunk of Y2K work was outsourced to places like India, where this self-proclaimed terrorist was picked up.

Given the long-term planning that Al Queda is known for, and their penchant for using the tools of the West against the West, I would be unsurprised if they planted people into companies doing Y2K patchwork for major financial institutions or other mission-critical systems. Most of that code was NOT code reviewed due to time constraints, and the work was done overseas by the lowest bidders. This is a recipe for disaster and was predicted as such years ago. Now that we know exactly how crazy these motherfuckers are, the warnings seem a lot more important.

Just my paranoid guess.

-jon

Too late... they've stroke already...

[tcc]

Where they've hit is already public knowledge...

Re:XP? Wouldn't Linux be just as easy?

[Jason Earl]

The amount of people that have access to the Linux source code is several orders of magnitude greater than Windows. That works in Linux's favor. Linux programs also are regularly ported to several different architectures. That's useful too. A lot of times subtle bugs can be found when the source is ported. Especially if it is ported to a radically different architecture using a totally different compiler.

Not only that, but Linux source code sometimes gets reused. That sort of thing helps as well. There is nothing like having someone else reuse your code for something totally unrelated for shaking out bugs.

Not that Free Software is perfect, but it certainly seems better than the alternative (in this regard).

Re:Two counterpoints take two

[spudnic]

So what are the QA procedures for Solitaire? I'm sure that gets almost as much runtime on most office machines as the networking stack.

I don't think they would have had to put a backdoor into the kernel for them to cause problems.
.

Re:If they did;

[Hostile17]

it is highly unlikely that there'll be fibre optics being piped into Tora Bora.

You assume there are no Terrorist Cells anywhere else in the world. There is plenty of fiber in the US, Germany, Finland and many other countries. This also asumes one needs a highspeed connection to hack, this is also not true, all that is needed is a laptop and a phone line, preferably a payphone or a phone in a motel room far from where you live.

They are evil.

[Mullen]

Wow, al Qaeda is evil, they worked for Microsoft!

Re:Dancing Monkey Boy

[ThatComputerGuy]

Hell, maybe you can just swab some of that sweat off of him at any of his pep rallies..

Re:Spelling!!!!!!!!!!

[MadAhab]

You got it. The only way to respond to a troll is with a better troll. Oh, wait, did I just hit "submit"? Damn.

Re:not as easy as you might think - VERY EASY

[mobiGeek]

My standard practice is to never install a Microsoft OS until it has been "in the field" for -at least- a year

My policy is half of that: the first half!

Re:There's a dead giveaway in the article itself..

[Yet Another Smith]

Canary Wharf would be a great target if it were better known. Parliament and any of the castles would be likely choices, along with MI-6. Of course the IRA has already nicked that one once.

St. Pauls seems unlikely to me, because they've always avoided religious targets. They seem to really take aim at the flashy secular elements of western civ. Sbarro's pizza, the World Trade Center, the Pentagon, discos, etc.

And this just in from Boeing security....

[Anonymous Coward]

Latest news reports advise that a cell of 4 terrorists have been operating at the Boeing Renton site. Police advised earlier today that 3 of the 4 have been detained.
Boeing security stated that the terrorists Bin Sleepin, Bin Drinkin and Bin Fightin have been arrested on immigration issues. The Police advise further that they can find no one fitting the description of the fourth cell member, Bin Workin, in the area. Police are confident that anyone who looks like Bin Workin will be very easy to spot in the plant.

Re:And this just in from Boeing security....

[talks_to_birds]

Yeah..

Bin Workin would stand right out at the Lazy B...

t_t_b

Remember how to spot terrorist coders

[WillSeattle]

Ask them questions they won't know the answers to.

Like talk about the Grey Screen of Death and see if they notice. Or see if they can tell you what TCP/IP stands for - hint - it's not Taliban Control Program/Intifada Protocol like they think.

And if they don't get all hot and bothered by the BSD booth babes, you know they must be terrorists.

-

Even if it's not true...

[bero-rh]

... it clearly shows how Open Source Software is more secure than proprietary software, contrary to Microsoft's favorite claim in defense of NT/XP servers.

Nobody could possibly claim a terrorist organization got its patches into the official releases of Open Source tools.

What?

[Anonymous Coward]

I don't know about you guys, but how the hell to you "pose" as a programmer? Either you are, or your not!

lol

I think next week maybe I'll pose as a surgeon or a lawyer and get a raise!

Re:WARNING: THIS IS ADVICE TO TERRORISTS

[BluBrick]

Cheating?

When all you need is 5 gallons, it makes really good busines sense to trade in the 3 and the 7 for a single 5.

That's a better answer than the correct one. And that's BOUND to make a good impression as M$.

Re:Two counterpoints take two

[jazman_777]

There is no way that you could try to put a terrorist-sized hole in XP without a lot of people noticing.

So, are those who install Outlook aiding and abetting Terrorism? It sure is a huge hole in the system...

Microsoft are the terrorists!

[IGnatius T Foobar]

We've known for a long time that Osama bil Gates is a digital terrorist, the ring leader of the "Active Qaeda" terrorist network.

Re:Two counterpoints take two

[crucini]

That sounds reasonable. However, by that logic there should never have been any exploits for a Microsoft product, right? Maybe you are assuming that the trojan would be glaringly obvious. I would assume the opposite - that it would be the kind of vulnerability we've already seen many times in IIS and Outlook. Something that could be called an honest mistake.

I still don't really believe the story, but I think you are dismissing it too lightly.

Hole in the argument

[HiThere]

I believe that early on there was a bugged version of gcc that went undetected for years. (The binary didn't match to source, but whenever it was recompiled it patched itself to still contain the bug.)

I don't remember what the bug did. Or even, actually, whether this is folklore rather than truth, though I remember it as truth.

Still, even if it were folklore, it seems a feasible scenario (as long as one assumes that the compiler doesn't get renamed, e.g.).
.

Re:Hole in the argument

[woggo]

That wasn't gcc. That was the original UNIX C compiler. You probably want to read Reflections on Trusting Trust, Ken Thompson's Turing award lecture.

Basically, he hacked the C compiler to allow a backdoor for him if it was compiling login. He also hacked the compiler to produce a hacked version of the compiler if it was recompiling itself.

Don't believe this!!

[snake_dad]

It's al just FUD to cover up the Magic Lantern introduction. Really.

I am not an expert in GA & GP, but

[Mr. Fred Smoothie]

AFAIK, GA doesn't necessarily mean "self-modifying-at-runtime" code. It can merely mean code included in the finished product was selected due to its "fitness" to some purpose, using a process where successive iterations were performed and the best candidates chosen, altered using some form of tranformation akin to "mutation" and "recombination" and used as input to the next iteration.

I.e., while the code was being modified during the GA process, the result is the most "fit" bit across all iterations, included statically in the final program.

For example:

1. "I wonder what set of parameters can best be used to tune this algorithm -- A1 -- to produce more accurate results more quickly"
2. assemble a list of sets of parameters, and some algorithm -- A2 -- which runs A1 parameterized with each set of parameters in the list, selects the 5 that worked best, records that, creates a new list of sets constructed from bits of the previous winners
3. iterate n times
4. use the winning set of parameters over all iterations as the parameters to A1 in codebase C1.

Re:I am not an expert in GA & GP, but

[HiThere]

Yeah, that's a weak version of a genetic algorithm. And the code that it creates is still impermeable.
.

Malice?

[Frank Sullivan]

"no evidence of malicious code in the operating system has been reported".

Never attribute to malice that which can be adequately explained by stupidity. :}

Re:Two counterpoints take two

[Mr. Fred Smoothie]

it's embarrassing that this pseudo-technical forum is giving the report even a little credit

Well not all of us have the "benefit" of having worked at Microsoft, so you'll have to forgive us if we're ignorant as to the exact procedures used to test code there. Additionally:

For the months before the OS ships every line of code that is modified is examined on several levels; every bug that is found could potentially be investigated by any of dozens of people in any part of the organization...

OK. Do you have any description of this process that's more concrete than "examined on several levels?" Are all of the "any of dozens of people in any part of the organization" programmers? Is their level of debugging skill equal to or greater than the skill of the most skilled programmer producing the code? How many people investigate the bugs that aren't found? (Careful, this last one is a trick question)

There's nearly a 1/1 ratio of Test/Dev in the critical parts of the system; to do this you would have to get the developer(s) and the tester(s) responsible for that chunk of code/functionality.

OK, so assume *one* chunk is targeted. Does that mean they'd have to get *one* programmer/tester pair? Two? Is it inconceivable that there is a piece of the system advanced enough that there are only a couple people skilled enough to work on it? Is it conceivable that, in such a case, a *large* enough amount of money exists to corrupt those small # of individuals? What criteria are used to determine which pieces of the system are "critical?" Is browser code which allows files with spoofed content/file types to execute on the machine an example of this type of "critical code?"

Automated tools run by seperate groups review changes and record owners; try to sabotage something once & you won't get a second chance.

And these automated tools can distinguish between bugs and deliberate vulnerabilities, perfectly? Is the person writing the tools more skilled than the most skilled programmer writing the production code? What tests are done on the testing tools to determine that they work adequately?

I hope you get my drift. Do I personally believe that terrorists have infiltrated Microsoft and planted bugs in the code? Not likely. Is the scenario conceivable? Absolutely.

With all due respect, 95% my ass

[Mr. Fred Smoothie]

Few of the companies I've worked for, as a contractor *or* an employee, have had mandatory code review as part of the "official" process. Of the one or two that did, neither had any mechanism to determine whether the code was actually reviewed, and at both of them, especially as deadlines got nearer, code reviews were frequently not done even though everyone agreed they were supposed to be.

Is this good? NO! Is it common? In my experience, in the literature of our industry, and of the opinion of most of the programmers I personally know (which is a large sample), it is the *rule* rather than the exception, unfotunately.

Re:With all due respect, 95% my ass

[Computer!]

I wholeheartedly agree, but over any significant period of time, unless the code never has any bugs, or is never changed, it will be worked on by someone other than the programmer.

Re:Sensationalism at its finest...

[talks_to_birds]

• "The same thing could as likely to have happend in open source software."

Shoo, M$ troll...

t_t_b

Bugs?! ...

[degauss]

Could this just posibly be Microsoft's latest ploy to disguise all the bugs and problems that already exist in their programs?

Re:Two counterpoints take two

[edp]

"-For the months before the OS ships every line of code that is modified is examined on several levels; every bug that is found could potentially be investigated by any of dozens of people in any part of the organization..."

That is the only one of your statements that could be likely to actually result in catching an intentional security hole, and I won't believe it at face value without supporting evidence, such as a description of the actual code review procedures. The typical code review in the industry (and I've seen other major operating system code and supposedly secure procedures in accordance with DoD standards) may be to check that the code being modified is in the area it purports to fix a bug or whatever and is by an engineer who knows that area. On occasion, a reviewing engineer may check the code to see that it changes the behavior in the way it is supposed to. Rarely would an engineer scrutinize the code to see if it subversively changed the code in a way it wasn't supposed to.

"-There's nearly a 1/1 ratio of Test/Dev in the critical parts of the system; to do this you would have to get the developer(s) and the tester(s) responsible for that chunk of code/functionality."

The conclusion of that statement does not follow from the first part. Only the developer needs to be an adversarial agent, because a tester is not necessarily going to catch an intentional security hole. I think it is not even likely, because a designed hole isn't going to show a lot of evidence. E.g., a buffer overrun error is an error whenever the buffer is overrun, whether by 1 byte or 1 million. A designed hole may show up only when certain data is presented, and testing would never catch such a hole. This is why I only believe your code-review claim would catch a hole, if there were a real, meaningful code review.

"-Automated tools run by seperate groups review changes and record owners; try to sabotage something once & you won't get a second chance."

All this means is that changes can only be made by persons assigned to work on that particular code and must be associated with a recorded bug fix or design specification. That is little impediment to adding a security hole; it just means the code implementing the hole has to be submitted to the source along with a recorded bug fix or design specification in the same area.

"-Automated tools run by testers review code that's not exercised by test-passes, reporting on changes so that the hole can be filled."

As above, testing will not catch a design hole.

This doesn't mean I believe there is a terrorist-planted hole in Windows, just that I don't believe Microsoft's procedures would be likely to catch one.

From the article

[Fjord]

"According to Desler, Microsoft has rigorous processes in place during the development of Windows to ensure the security and integrity of source code."

Yeah, but not the security and integrity of Windows

Chant heard at Al Qaeda training camp....

[reynolds_john]

Developers! Developers! Developers! Developers!

Re:Two counterpoints take two

[jsse]

As an employee who has worked in the OS division of Microsoft I would like to say unequivocally that this article is complete crap.

Just curious, have they fired the dudes who are responsible bunches of holes in IIS and Outlook?

I meant, I'm just curious. Thanks in advance, Bill.

Re:XP? Wouldn't Linux be just as easy?

[Jason Earl]

Huh? I have been using Linux since 1995 when I wandered into Linux-land looking for an inexpensive C compiler.

Is there some part of my argument that you feel is naive, or are you just trolling?

Delivery Not Included

[Proud Geek]

Nope, delivery is extra. Do you think finding someone to sign for it will be a problem?