Slashdot Mirror

← Back to Stories (view on slashdot.org)

FBI, Pentagon Talk to MS about XP Hole

Posted by timothy on from the step-inside-the-circle-of-trust dept.

(eternal_software) writes: "The Associated Press is reporting that the FBI and Defense Department are talking to Microsoft about the serious flaws found in the XP operating system. As we all know, the most recent flaw allowed any XP machine to be hijacked simply by connecting it to the internet. The government is getting involved because of growing U.S. concerns about risks to the 'net as a whole." In fact, the FBI would like you to go a bit beyond the MS patch. davecl points out the updated page put out by the National Infrastructure Protection Center about this vulnerability as well.

14 of 405 comments (clear)

  1. Serious Stuff by smooc · · Score: 2, Informative

    Although I refuse putting a Windows box directly on the internet (and btw neither a linux-box) even for home use, I know a lot of people who do.
    Especially all the unaware homeusers like my landlord for example. For systemadmins it already difficult to keep up to date with all the patches even with the various *update programs, at least they are firewalled

    And yet they (the homeusers) are the most vulnerable!

    And Microsoft proclaimed this was its most secure OS ever.

    --
    - In Memoriam: Jeroen de Bruin (1972-2004), bye bro
  2. National/International Security Concerns by ackthpt · · Score: 5, Informative
    Utterly fascinating that the DoJ (FBI) is looking into these flaws for the difficulty exploits could cause people, after basically letting M$ off the hook in the monopoly punishment phase. Hope the states prevail, and if you haven't written your opinion in (to the court), here's another reason why monopoly for a universally adoptedand used O/S is bad.

    Public comment is invited within 60 days of the date of this notice. Such comments, and responses thereto, will be published in the Federal Register and filed with the Court. Comments should be directed to Renata Hesse, Trial Attorney, Suite 1200, Antitrust Division, Department of Justice, 601 D Street NW, Washington, DC 20530; (facsimile) 202-616-9937 or 202-307-1545; or e-mail microsoft.atr@usdoj.gov. While comments may also be sent by regular mail, in light of recent events affecting the delivery of all types of mail to the Department of Justice, including U.S. Postal Service and other commercial delivery services, and current uncertainties concerning when the timely delivery of this mail may resume, the Department strongly encourages, whenever possible, that comments be submitted via email or facsimile.

    After all the blather and FUD from Redmond, they again pushed a product out the door with great media hype which is again unsecure. It would be so ironic if Microsoft were punished for this kind of negligence after getting a slap on the wrist. I don't expect that to happen though.

    --

    A feeling of having made the same mistake before: Deja Foobar
  3. Re:all rightey then! by lseltzer · · Score: 2, Informative

    three options, and it asks you which you want:

    1) download updates automatically and ask the user whether to install them
    2) notify the user automatically that updates are available and ask them whether to download and install them
    3) none of this

  4. It's to be expected... by jmichaelg · · Score: 3, Informative

    ...that security will suffer when you make an os too easy to use. It's an age-old tradeoff: security vs. ease of use. Moreover, with more features comes more complexity and with more complexity come more security holes.

    Don't want to check to see if there's a patch needed for your OS? Don't worry, we'll have the OS check for you. We can't guarantee that your computer will be talking to our servers when it downloads the patches but hey! it'll be automatic! Come to think of it, we can't even secure our own servers so we're not too sure what you'll be downloading even if you are talking to our servers but hey! - it's automatic!

    I can't think of a better argument for limiting the services an os provides than this fiasco.

  5. UPNP is all about handling NATed devices by weave · · Score: 5, Informative
    I haven't seent his mentioned much, but UPNP is all about handling NATed devices. There is a UPNP SDK developed for Linux, but until someone builds a useful kernel module out of it, Linux users are SOL (or maybe they are fortunate).

    Why care? Well, I found out after installing MSN Messenger that most of the features are useless behind a NATed network unless your router/firewall understands UPNP. Of course, Microsoft ICS and Servers understand it. I was getting frustrated since I couldn't use MSN messenger except for messages behind my home linux firewall. ICQ features like file transfer work fine by port forwarding the necessary ports or using a kernel module for it.

    So, here's the interesting bit. UPNP works by telling the other client on the other end what your private IP address is. Microsoft's docs say this is necessary for the other client to be able to find out how to talk back to you. I think this is stupid. The other end of an MSN connection just needs to look at the source IP in the packets it receives and just send there and hope the owner of the IP knows what to do.

    However, UPNP apparently knows how to handled multiple chains of NAT networks, kinda like I guess an old fashioned UUCP bang path. Problem is, it seems like one can modify that "bang path" to route return packets to false places. Can you say DDOS?

    So I sent a rant to my friends about this on December 10, and about how UPNP is a security hole waiting to happen according to posts I read out of google searches...

    Here's my rant...

    I read the tech article about msn messenger and NAT devices. In order to do pretty much anything beyond chat, you can't be behind a NAT device unless that NAT device is a Microsoft device.

    Basically, it suggests installing Windows ICS for home users and corporate users should use a 2000 server for NAT and msn's extra features will work.

    Fuckers...

    ICQ works just fine behind a NAT. They are basically just trying once again to leverage one product to sell another....

    Their explanation is that the client must send its IP address to the other user so it knows where to send files, audio, video, etc, and since it's got a private IP, it screws up. So it needs to query the NAT device for what ITS IP is. But that's really stupid since there is already a connection open for chatting and all the other client has to do is look at that connection for the source IP and use that instead and everything else would just work....

    Someone on a newsgroup said this is another security hole waiting to happen. Basically, it's trusting client for security. I send a connection to your msn messenger client and tell it what IP to send its stuff to? What if I send it the IP address of someone I am trying to DOS? Arrgh...

    They'll never learn...

    Microsoft claims UPNP is a universal open standard. It'd be interesting to learn more about its origins and who is really controlling development of it, security of it, etc. Microsoft claims all manner of peripheral vendors will be supporting it.

    Is the concept itself as flawed as it seems, or is this just yet another case of Microsoft's implementation of something being flawed?

    1. Re:UPNP is all about handling NATed devices by weave · · Score: 3, Informative

      Sorry, bad link in my comment above. The UPNP Linux SDK is at upnp.sourceforge.net

  6. Re:did anybody notice this.... by mESSDan · · Score: 3, Informative

    No, it is a part of XP, in the system properties, it's called Automatic Updates. It's also available in Win98/ME through the Critical Updates program you can get through Windows Update. You can turn it off at will.

    --

    -- Dan
  7. Does it? by barzok · · Score: 3, Informative

    I set up an XP Home Edition box on 12/14 and after installation, went to Windows Update. Found a dozen (4 critical, 4 non-critical) updates waiting for me.

  8. Re:Trust us! by Oily+Tuna · · Score: 2, Informative

    You can disable UP&P and SSDP before connecting. Instructions for doing this can be found by non-internet means.

    net stop ssdpsrv
    net stop upnphost

    --
    Mmmmmmm ... sushi.
  9. Re:Just a thought/Microsoft a target? by fanatic · · Score: 3, Informative
    Microsoft might be on their list for these reasons:

    How about the biggest reasons:
    • They hire lots of foreign programmers, (see their support for H1B visas) making them pathetically easy to infitrate
    • they neither know nor care about security - never have, never will, couldn't fix it if they wanted to because their corporate culture is 'features, Features, FEATURES!'
    --
    "that's not encryption - it's a new perl script that I'm working on..." - from some Matrix parody
  10. Gov shouldn't be using MS anyway by MrResistor · · Score: 3, Informative
    That statement isn't meant from the point of view of OSS zealotry (although I certainly have some feelings in that direction), but because the NSA has never rated an MS product as being secure in a networked environment. Part of the NSA's job is to issue information security recomendations, which other agencies are then supposed to use when putting together their systems.

    IIRC, NT at some point was rated secure when not networked.

    --
    Under capitalism man exploits man. Under communism it's the other way around.
    1. Re:Gov shouldn't be using MS anyway by SuiteSisterMary · · Score: 3, Informative

      An OS is never rated secure; a system is rated secure. That includes OS, hardware, programs running, and physical setup, amoung several other things. Note that most standard UNIX systems are immediately disqualified from the first 'secure' rating of C2 because they tend not to have ACLs, amoung other requirements.

      --
      Vintage computer games and RPG books available. Email me if you're interested.
  11. NTFS Journaling by _Sprocket_ · · Score: 3, Informative


    How much longer has Windows (NT) had a journaling filesystem than Linux?


    My understanding is that NTFS' journaling was rudimentary at best. It hasn't been until its recent incarnation (introduced with Win2k) that its managed anything close to a true journaling file system.
  12. Did you say "Free Karma"? by Dog+and+Pony · · Score: 2, Informative

    Hehe. Worth a try, I guess. Here is one link about that very thing:

    You are welcome. :)