Cryptogram Judges MS Security

johnfoobar writes "The latest issue of Bruce Schneier's Cryptogram has a section entitled 'Judging Microsoft' which aims to "provide a list of measurable recommendations, so that the community can judge Microsoft's sincerity." Required reading if you use Microsoft products." Update: 02/15 18:15 GMT by M : A better link is Schneier's first essay this month, which is about Microsoft's "Trustworthy Computing" initiative.

Comments

Covered previously

[Animats]

Earth to Slashdot - that Counterpane article was discussed on Slashdot last week.

Re:Covered previously

[thagale]

Wrong. This article came out today, in the Cryptogram, which comes out Monthly on the 15th. As such, it was not reported last week. :)

Re:Covered previously

[oddjob]

The article in Cryptogram may be new, but the section in question was published elsewhere and was discussed in an earlier slashdot article.

Re:Covered previously

[oddjob]

Just to back you up, here's the old article

Security Community Reacts to Microsoft Announcement
by Hemos with 471 comments on Friday January 25, @11:25AM

The Counterpane article is the same as the earlier Security Focus article.

Re:Covered previously

[alecks]

This article is CRAP:

"The best prevention for attacks against a feature is for the feature not to be there. "

LOL!

Re:Covered previously

[ScumBiker]

How can you laugh at that? Obviously a feature needs to be secure all by itself and also be secure in the way it interacts with other features. Having a feature not be installed at all simply makes it even more secure. In fact, a feature that isn't installed is by default 100% secure. It can't be used, accesed, smurfed, or kidnapped for nefarious purposes. Thus, it's completely secure. Microsoft's practice of installing everything under the sun is probably it's biggest insecurity. Yes, you can choose not to install some stuff, but how many Joe Users install their own operating system?

Re:Covered previously

[Maserati]

Heck yes. If it aint there, it aint a feature.

That isn't all that's wrong with it either. He takes his notes on the seperation of data and code, and then uses the example of executable content in emails as the example of the problem. Wrong. The problem is data mixed with source code and compiled into the binaries. [1]

He then goes on to be right about the need for a 'sandbox" for untrusted code, which is definitely needed for the mixing of "[executable] code and data [in documents such as email or spreadsheets]." Comments in brackets are mine and intended to make the statement accurate.

[1] In my limited coding experience this makes for difficult revisions when the data has to be changed. In real projects the problem is undoubtedly much more widespread and of greater severity.

Re:Covered previously

[Anonymous Coward]

To add a bit more fuel to the fire, anybody who actually bothered to read the essay in Crypto-Gram would have noticed that not only did Bruce link to the original on Security Focus, he also linked to a couple of comments in the Slashdot thread. Should I even bother mentioning that the Trustworthy Computing essay was originally published on News.com on January 18?

here goes...

[Em Emalb]

I think one major thing that will be lost in all the flaming about how MS sucks and is so unsecure is this:

They are making an effort now. I firmly believe that this is a good thing. Of course, there will be the usual rebuttals:

what took them so long
why are they caring about security now, etc.

Hey who cares why or how, just consider this a good thing that they are more involved in security now. Btw, remember the last time MS went after something with a vengeance? I do.

*shudder*

Re:here goes...

[fishebulb]

the more important thing is: Whether they will actually do anything.

How is this security going to be achieved, fix a few wholes and be a little more careful in the future, then throw the rest of the budget at a multi million dollar ad campaign saying Win XP is the most secure ever?

Re:here goes...

[swagr]

what took them so long
why are they caring about security now, etc.

Hey who cares why or how

Microsoft cares about security becouse Microsoft cares about profit. When lack of security and stability meant lower profits, Microsoft cared.

Recall when Microsoft went after Java (the language, not the platform). Didn't work. And how's their VM compatability with 1.4 now? If "security" doesn't work out for them, what makes you think they won't switch gears and worry more about drop shadows?

Re:here goes...

[GroovBird]

Excuse me.

They never went after the language, only the platform. Who restricted them from including a VM? Why exactly did they make J++? Why did they 'embrace and extend' the platform with COM specific stuff?

Why are they so keen on providing Java support for .NET?

And how's YOUR compatibility with 1.4 now??

Re:here goes...

[Sj0]

How do we know they are really going to make an effort? Microsoft PR has been full of shit since the first press release. From the Windows 1.0 release "just two months away"(when it was really a full 18 month development cycle from completion), MS PR makes promises it doesn't intend to keep, and often lies outright ("Windows ME is the fastest, most reliable Windows 9x ever!").

Btw, remember the last time MS went after something with a vengeance? I do.


Yeah, it was on slashdot yesterday. Bribing politicians with a vengence. Too bad they can't do the same thing to their customers (think "Windows is more stable...and here's your kickback to prove it!")

Re:here goes...

[iiii]

They are making an effort now.

That is the question. Certainly it would be a very good thing if they are making the effort, but are they? Schneier said it better than I could:

"...I hope he's right when he says that Microsoft is committed to that challenge. I don't know for sure, though. I can't tell if the Gates memo represents a real change in Microsoft, or just another marketing tactic. Microsoft has made so many empty claims about their security processes -- and the security of their processes -- that when I hear another one I can't help believing it's more of the same flim-flam. "

Re:here goes...

[Anonymous Coward]

Microsoft cares about security becouse Microsoft cares about profit.

Congratulations, you have just pointed out that MS is a business. *GASP*

Re:here goes...

[swagr]

First. If you are going to say something, please say it. Rhetorical questions are not a response, and they require more effort to reply to. But since you asked:

They never went after the language... Why exactly did they make J++?
To go after the language.

Why did they 'embrace and extend' the platform with COM specific stuff?
Why are they so keen on providing Java support for .NET?
To go after the platform.

And how's YOUR compatibility with 1.4 now??
Off topic.

If you didn't understand my point, I will make it clear. Microsoft, like most commercial entities, is self serving. Their "security" efforts are ultimately for their own good not ours.

Re:here goes...

[tbmaddux]

"Hey who cares why or how, just consider this a good thing that they are more involved in security now."

I'm not so sure. Read these comments from the Cryptogram by Nathan Myers. He argues convincingly that their new security program could be a sham, that we should be able to detect it as such fairly soon, and that if it is a sham, end users will be less able to maintain their systems' security.

Involvement is good, but it needs to be real.

Re:here goes...

[Anonymous Coward]

Microsoft cares about security becouse Microsoft cares about profit.

Congratulations, you have just pointed out that MS is a business. *GASP*

Congratulations, you just pointed out that I pointed out that Microsoft is a business. *GASP*

How long shall we play this game? Current score 2:1 for me.

Re:here goes...

[aardvarkjoe]

Microsoft cares about security becouse Microsoft cares about profit.

What does that have to do with anything? Do you judge products on the motivations of the creator, or on their actual merit?

Re:here goes...

[shut_up_man]

The last time they went after something with a vengeance (the net) it was just another matter of shovelling internet features into all their products, in the gonzo MS style. Like Bruce says, security *cannot* be reached using this method. It requires a radical turnaround in attitude, method and implementation, something that might be beyond the company... simply because it's contrary to their core ethos. Securing products costs money, it slows you down, and it doesn't score points with the feature-hungry consumers.

Re:here goes...

[swagr]

If you ever expect a patch, upgrade, new version, new products, enhancements, customer service, etc. then motivations are important.

Otherwise merit will suffice.

Re:here goes...

[Sj0]

Congratulations, you just pointed out that he pointed out that you pointed out that Microsoft is a business. *GASP*

Repetition is fun!

Re:here goes...

[aardvarkjoe]

If you ever expect a patch, upgrade, new version, new products, enhancements, customer service, etc. then motivations are important.

It seems to me that all of these contribute to the merit of the product. Patches, upgrades, new versions, etc. add value to the original product, even if they don't come in the same box.

Again, I really don't care if someone provides good support because they like their customers or because they want my money tomorrow. What difference does it make?

Re:here goes...

[mazachan]

It is interesting how XP is claimed to be the most secure ever. Especially when there is a gaping security hole with how xp handles encrypted ZIP files. If you open a directory with the folder view, double click on the zip file and a new window will pop up. Then just drag the file from the ZIP folder back to your folder. No need for password.

Re:here goes...

[Ixohoxi]

"Remember the last time MS went after something with a vengeance?"

There's a big difference between putting Company ABC out of business and producing highly secure software. The former can be accomplished by the book, or by crook. The latter can only be accomplished by the book. It remains to be seen how willing Microsoft will be to do things this way, considering how unconventional they have become.

I think Microsoft has realized that their own software needs to be addressed first and foremost if they are to win the war against Linux. Of course, like in "War Games", the game can't be "won" per se. The only victory is NOT to play. Thus, the sooner Microsoft stops trying to "beat" Linux, the better for everyone.

Some consider it irrelevant that until recently, Microsoft could have cared less about security. They have hidden behind UCITA and their monolithic EULAs, all the while reducing security by increasing programmability. Their oversimplification, while giving developers more control, also gave hackers more control.

Choose to ignore facts if you wish, but your own credibility is at stake. To say what happened a year ago doesn't matter this year is just as dumb as saying this year doesn't matter once it's over. Responding to a "usual rebuttal" with an equally "usual rebuttal" isn't the best way to discredit them... or is it? You make the call.

Re:here goes...

[Anonymous Coward]

Slashdot posted a link to the "request for comments" regarding the Tunney act, the proposed Microsoft settlement and Microsoft's astroturfing.
http://www.codeweavers.com/~jwhite/tunney.html

In the comments section, one of the slashdot readers observed that Microsoft, under the proposed settlement, is allowed to keep secret anything having to do with security. Just as the "freedom to innovate" clause in the previous settlement provided a loophole big enough to fit Microsoft through, the "security" clause will provide Microsoft with a similiar loophole. Seen through this light, Bill Gate's memo is merely outlining a strategy to allow Microsoft to continue its basic business practices.

http://slashdot.org/comments.pl?sid=26726&cid=28 87 300

Re:here goes...

[Shiny Metal S.]

What does that have to do with anything? Do you judge products on the motivations of the creator, or on their actual merit?

From what I see in the post, Swagr seems to judge the company, not the product per se. This means that as soon as secutity is not a buzz-word of the month, Microsoft will probably no longer care about it as much as it cares now. I think it is quite reasonable.

Re:here goes...

[Anonymous Coward]

-1, redundant

Spoiled sport.

Re:here goes...

[jsprat]

If you open a directory with the folder view, double click on the zip file and a new window will pop up. Then just drag the file from the ZIP folder back to your folder. No need for password.

That means the encrypted ZIP file is at least as much to blame as XP, if not more so. The 'encryption' is too weak.

If the encryption requires the cooperation of the program opening it to be effective, it isn't encryption at all. It's about as secure as the mailbox in front of my house. Anyone who wants to open it can.

Re:here goes...

[Shiny Metal S.]

Again, I really don't care if someone provides good support because they like their customers or because they want my money tomorrow. What difference does it make?

But the whole problem is that you have to trust them. They sell you the product and they don't tell you how it works. They assure you that it is secure/stable/whatever, but they don't show the internals to anyone. They say that, in spite of their whole history, this time they make it in a different way. That is why you have to trust them, you don't have anything else you can depand on. And when you trust them, you should know their intentions.

Re:here goes...

[Tony-A]

RedHat might be more secure than OpenBSD, but that's pretty long odds.
Without testing everything against all possible combinations, the reputation of the vendor is probably the best and maybe the only reasonable guide to future performance.

Re:here goes...

[Anonymous Coward]

> They are making an effort now. I firmly believe that this is a good thing.

You won't really know this for several months yet. So far, just words with not enough time to judge actions over a long term. It's only a good thing if they really mean/do it, not just say so for the shareholders.

Re:here goes...

[Dyolf Knip]

No, they say they're going to focus on security. Given the kind of BS they've spouted off in the past along these lines, why should we take them at face value now?

Until they actually prove themselves with a fairly secure product, I'm going to be wary of any company that employs a 'Security Assurance Director'.

trust

[ryusen]

a friend of mine once said, "trust is a funny thing. you never really know if you can trust someone, till you find out you can't."
microsoft, right now, is in that stage. people have just started discovering that they can't trust microsoft. wheather they can or not is not the issue, but the perception of trust is ruined. it will take a long period of dilligence and commitment to prove themselves worthy of trust again. on the other hand, i kind of wish many other companies would make an honest attempt to regain our trust

Re:trust

[RazzleFrog]

The question is - has the average user actually lost trust in Microsoft? I know so many average (and below-average) users who know next to nothing about the security problems. At work all the patches are delivered invisibly to them and at home they have dial up connections and don't stay on long enough to be a real target. The few people who have fallen victim to the Outlook viruses feel more embarassed at their own stupidity than they feel angry at Microsoft.

The public conception of Microsoft is very far from that of the average Slashdot reader. I overheard on the subway the other day a woman raving about how much she loves Windows XP. She was telling this other woman that she added memory and upgraded to XP and it is like having a brand new machine. I felt like asking her if she downloaded the UPnP patch but I try to avoid talking to people on the subway. I also work with hundreds of people who love Windows 2000.

So there in lies part of the problem. The public doesn't really know and for the most part doesn't care about the problems. Try going to an average user and explaining all of this to them and see if you don't get the look. We have to seriously root for Microsoft to fix the security holes not because they need to improve their image but because the average user doesn't care.

Re:trust

[ryusen]

you've got a very good point, but i was talking about the computing public.... those that are more aware of the issues... if you take the general populace i doubt many could tell you who the last 3 vice presidents of the us were (this is of course speaking about americans).
even at my job i see a greater decreating confidence in microsoft amonst the technically inclined. there seems to be two camps.

1. those that use ms product implicitly (even though many of them have countless problems). this camp graduated from the "no one ever got fired for buying IBM" school.
2. those who preffer to use non-ms products when ever possible. this is a slow, but apparently growing minority

atleast where i work that's the two camps...

Re:trust

[RazzleFrog]

I agree that in the computing public, even those pro-Microsoft, have lost a lot of faith in them. Unfortunately, at least where I work, we have to cater to the users. Just the upgrade from NT4 to 2000 was a political nightmare even though it went without a hitch. People are paranoid as all hell about any changes.

By the way, the last 3 VP's is not that difficult for most people because they are pretty humurous. Dick Cheney's safe location, Al Gore's internet, and Dan Quayle's potatoe [sic].

Re:trust

[Anonymous Coward]

Hey, if Quayle's using Debian, he must be smarter than we thought.

Re:trust

[marktwain]

Wishful thinking.

Corporations, the bigger the worser, are not about trust, they are about making money.

But wouldn't being trustworthy make them money? Sure, in theory, but in the real world a corporation's "trust index" doesn't show up on their balance sheet.

P.R., of any sort, is useful to a corporation. P.R. does not equate to trust.

Re:trust

[ryusen]

it's kind of like that line in "Fight Club," where he explains that his company doesn't do safety recals unless the cost of the recal would be cheaper than the cost of the law suits when x amount of people die, because of faulty manufacture...

yes i know it's wishful thinking but as long as those coperations know that we will hound them to the end of their days, they might actually conceede some of their profits for quality... even if just for some good publicity

Re:trust

[Bishop]

two words: Ford Pinto. Ford was harmed for years after the public lost trust in Ford due to the Pinto.

For those who might not know. The Ford Pinto was a cheap poorly designed car of the 70s that had a nasty tendancy to burst into flames when struck from behind in minor collisions. Ford execs knew of this problem but decided against a recall as the cost was greater then the cost of a few lawsuits. see the internal Frod memo and more information

recursive story?

[The Slashdolt]

The story points back to a story previously on slashdot

Anti-innovation

[October_30th]

Nothing in the article addresses the problem that you MUST have a feature-over-security attitude to make a killer application.

Nobody wants to have a secure product in which you have to manually enable all the great features because of which you bought it in the first place! Secondly, no-one has time to keep up with all the security alerts. That's why an automatic patch system is absolutely necessary.

Microsoft is being realistic. The author of this article is not.

Re:Anti-innovation

[c_chimelis]

Nothing in the article addresses the problem that you MUST have a feature-over-security attitude to make a killer application.

I disagree with this. To develop a commercial application, there should be a good balance of both features and security. It's true that you may compromise on that third security code audit that you were planning to get the thing out of the door and onto a palette, but it's irresponsible (and could constitute negligence legally) to knowingly develop an insecure product just because you want to add more features.

Also, keep in mind that the marketroids always want you, the end-user/customer, to believe that they're acting in your best interest by releasing a buggy product Right Now(TM), so of course they're going to try to convince you not only how much you really need those new features (which will go unused in somewhere around 80% of the install base), but also to imply that you would've had to wait an inordinate amount of time to receive the product if they had gone back over it with the proverbial "fine-toothed comb" known as a security audit. In reality, however, security audits should definitely NOT be the afterbirth of development...proper security programming practices should be enforced during development so that the code can be as secure as possible from the day the code is first written. Using C functions like gets() without doing overflow checking, for example, is just asking for trouble in most cases, and every competant programmer knows it...the question is, why should it be ok to not write the overflow check or to use a different call that's safer instead? I don't see the difference in time between typing gets() and typing fgets() with a few more arguments when the code is first written? Sure, you could argue that, after thousands of development hours, the few extra seconds adds up, but if it saves you millions in PR and legal expenses, why wouldn't you change your development practices?

Up until recently, Microsoft has enjoyed an era without being held accountable for the bugs in their products (security and otherwise). That is changing now, however, and they really need to treat this as more than just a PR issue (it's becoming more of a legal issue as well). Let's face it, Microsoft is taking heat about this not because of their market position or pervasiveness...not even because their products are compiled from millions of lines of code...it's because they don't stress a proper security-oriented (read: sane) development process.

Don't be brainwashed by them saying that security is the killer of timely/rapid innovation or release schedules because it simply isn't true unless they're development practices say that security is an afterthought rather than an integral part of their programming practices.

Re:Anti-innovation

[Oink.NET]

Nobody wants to have a secure product in which you have to manually enable all the great features because of which you bought it in the first place!

Microsoft itself would now supposedly disagree with that point. As part of their new security effort, they are reviewing all parts of their code, including default configurations.

As part of the security initiative, every manager has to justify not only the group's programming decisions, but how the software is configured as a component of Windows.

Program managers are being asked, "Are 90 percent of your users using this feature? If not, then you better have a good reason for enabling that feature by default," Howard said.

The goal is to make an everyday user's computer secure by default, he said. "Not everyone needs IIS (Microsoft's Web server) by default," he said. "Not everyone uses Index Server by default. So today, those features are turned off by default."

Quoted from this article.

Re:Anti-innovation

[Pfhreakaz0id]

Except IIS isn't installed by default. Not on a users (i.e. non-server version)

Re:Anti-innovation

[markmoss]

Using C functions like gets() without doing overflow checking, for example, is just asking for trouble in most cases, ... I don't see the difference in time between typing gets() and typing fgets() with a few more arguments when the code is first written?

In my experience, five minutes spent on overflow checks initially will save an hour in debugging. Unless you get _unlucky_ and the flaw isn't discovered in debugging. But then, I take bugs more seriously than an MS coder has to. When I release a program, I wrote it all by myself for internal company use. I'm going to get yanked out of my office to _look_ at any bugs that pop up, and have three senior managers breathing down my neck while I fix it. Microsoft programmers are insulated from that by sheer organizational size -- tech support gets the bug calls, not the programmers, and tech support probably won't be able to track down the lazy bastard responsible for the bug and make him fix it himself. Beyond that, MS shuffles most tech support off to the OEM's...

Re:Anti-innovation

[Anonymous Coward]

IIS is installed (and running) by default on Windows 2000. Anything post Windows 2000(including .NET server) does not install IIS by default.

Re:Anti-innovation

[jo42]

> including default configurations.

Does this mean that they will no longer pull asinine stunts like giving Everyone full access to the root of an NTFS drive? Or giving Everyone full access to \Inetpub\* in default installations? Or installing NetMeeting, Media Player and other cr*p on a server?

And when will this happen, mebbe 2 years from now when they release Windows XP 2004 (or whatever the fork their marketing droids call it)?

Re:Anti-innovation

[Pfhreakaz0id]

thus quoth the AC:

IS is installed (and running) by default on Windows 2000. Anything post Windows 2000(including .NET server) does not install IIS by default.

Not on Windows 2000 Pro (workstation). It does install on Server versions (personally, I think it should install on server version but turn the services off by default, but that's just me).

MS02-005 cumulative patch

[jamie]

Bruce Schneier wrote in this month's Crypto-Gram, sent out this morning sometime:

"Anyone remember Scott Culp ... touting how fast Microsoft was at patching problems? There's a new vulnerability in IE that Microsoft is busy ignoring."

This was the first I'd heard of it, though I've gone to microsoft.com and asked to be put on Microsoft's mailing list for security alerts. About three hours later, the email finally arrived from Microsoft, four days late:

To: jamie@mccarthy.vg
Subject: Microsoft Security Bulletin MS02-005
Date: Fri, 15 Feb 2002 07:33:02 -0800

Title: 11 February 2002 Cumulative Patch for Internet Explorer
Date: 11 February 2002
Software: Internet Explorer
Impact: Run Code of Attacker's Choice
Max Risk: Critical
Bulletin: MS02-005

This is a cumulative patch that, when installed, eliminates all previously discussed security vulnerabilities affecting IE 5.01, 5.5 and IE 6. In addition, it eliminates the following six newly discovered vulnerabilities...

What Microsoft didn't mention was that, before I got its security alert, someone had posted to bugtraq this assessment of their patch:

From: Thor Larholm <Thor @ (no spam) jubii . dk>
To: "'bugtraq@securityfocus.com'" Subject: Update on the MS02-005 patch, holes still remain
Date: Tue, 12 Feb 2002 15:25:11 +0100

...2 critical vulnerabilities are still remaining.

1. codebase localpath
Allows execution of arbitrary commands.
Publicly known since January 10th 2002.
Severity: Critical.

2. XMLHTTP
Allows reading of local files.
Publicly known since December 15th 2001.
Severity: Critical for homeusers.

Re:MS02-005 cumulative patch

[Florian Weimer]

This is a cumulative patch that, when installed, eliminates all previously discussed security vulnerabilities

This is vendorspeak; "previously discussed" means "confirmed by the vendor" and not "discussed on BUGTRAQ". The phrase "all known security defects" means "all the defects we have admitted so far", and so on.

Re:MS02-005 cumulative patch

[popular]

Funny, the message timestamp on my alert says 2/11@5:40, and my inbox says it was received at 5:34. My clock and theirs may be a few minutes apart, but it would seem that I got the message almost immediately.

Re:MS02-005 cumulative patch

[jamie]

Here are my headers, if you'd like to compare... no idea what's going on but I definitely did not get it on time. And the Date header is late too so I doubt it's just that it took their mail server 3 days to send out all their mail :)

Received: from delivery.pens.microsoft.com ([207.46.239.106]) by
redacted.myserver.com (8.11.6/8.11.6) with ESMTP id g1FFWrH08680 for
<jamie@mccarthy.vg>; Fri, 15 Feb 2002 10:32:54 -0500
Received: from tkmsftddsq03 ([10.201.232.135]) by
delivery.pens.microsoft.com with Microsoft SMTPSVC(5.0.2195.3651);
Fri, 15 Feb 2002 07:33:02 -0800
Reply-To: <3_25598_49103BFC-EA1D-4AA3-A1F7-F957B901CAD1_V G@Newsletters.Microsoft.com>
From: "Microsoft"
<0_25598_49103BFC-EA1D-4AA3-A1F7-F957B901CAD1_V G@Newsletters.Microsoft.com>
To: <jamie@mccarthy.vg>
Subject: Microsoft Security Bulletin MS02-005
Date: Fri, 15 Feb 2002 07:33:02 -0800
Message-Id: <7df801c1b636$0e09ff70$87e8c90a@tkmsftddsq03&gt ;
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
X-Mailer: Microsoft CDO for Windows 2000
Thread-Index: AcG2NgfOqr2I0ZX1Smi+i9X6FSULLw==
Content-Class: urn:content-classes:message
X-Mimeole: Produced By Microsoft MimeOLE V5.50.4522.1200
X-Originalarrivaltime: 15 Feb 2002 15:33:02.0403 (UTC) FILETIME=[0E180930:
01C1B636]
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by redacted.myserver
.com id g1FFWrH08680
Status:

Re:MS02-005 cumulative patch

[popular]

My apologies for lollygagging (personal/corporate info omitted):

Received: from (filter).(mydomain).com ([10.17.33.8]) by (mail).(mydomain).com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13)
id 1BFXNM4R; Mon, 11 Feb 2002 17:33:46 -0600
To:
Received: from DELIVERY.PENS.MICROSOFT.COM (207.46.239.34[207.46.239.34 port:2302]) by (filter).(mydomain).comMail essentials (server 2.429) with SMTP id: transfer for ; Mon, 11 Feb 2002 5:35:01 PM -0600 ;transfer smtpmailfrom
X-MESINK_Inbound: 1
X-MESINK_MailForType: SMTP
X-MESINK_SenderType: SMTP
X-MESINK_Sender: 0_25598_711CEFBC-9E26-4B63-AF47-40632830B320_US@Ne wsletters.Microsoft.com
X-MESINK_MailFor: (myname)@(mydomain).com
Received: from TKMSFTDDSQ01 ([10.201.232.196]) by delivery.pens.microsoft.com with Microsoft SMTPSVC(5.0.2195.3651);Mon, 11 Feb 2002 15:40:21 -0800
Reply-To:
From: "Microsoft"
Subject: Microsoft Security Bulletin MS02-005
Date: Mon, 11 Feb 2002 15:40:21 -0800
Content-Type: text/plain;charset="iso-8859-1"
Content-Transfer- Encoding: quoted-printable
X-Mailer: Microsoft CDO for Windows 2000
Thread-Index: AcGzVXNK8uj70lUuRbOB+dkJQnx/0g==
Content-Class: urn:content-classes:message
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4522.1200
Return-Path: 0_25598_711CEFBC-9E26-4B63-AF47-40632830B320_US@Ne wsletters.Microsoft.com
X-OriginalArrivalTime: 11 Feb 2002 23:40:21.0263 (UTC) FILETIME=[782901F0:01C1B355]
x-receiver: (myname)@(mydomain).com
x-sender: 0_25598_711CEFBC-9E26-4B63-AF47-40632830B320_US@Ne wsletters.Microsoft.com
MIME-Version: 1.0
Message-ID:

Morons....uh I mean OxyMorons.....

[CDWert]

'Trustworth Computing' and Microsoft in the same sentece is an oxymoron.

That said it is much easier to innovate wihtout regard to security even at a basic level, MS has been doing just this for quite sometime, and it looks like it may finally be catching up to bite em in the ass.

MS has made great strides in interface usablitiy, and some disasters, some minor security annoyance, and some bungles of a scale unseen before. Quantity, not Quality has been the MS creed for a long while, blowind the doors off their prior interface and capablities of 3.1 to win95 was a major leap, and they ran like a thief with it.

Its easy to innovate and produce LOTS of stuff fast if security isnt a concer, unfortunatley for MS that mindset became standard at MS, Bill's Memo is proof in itself,

Re:Morons....uh I mean OxyMorons.....

[wiredog]

You saying that they code the way you spell?

I remember when we said the same thing about their commitment to the web. "But IE 2 sux!, they'll never be serious about it!" When MS decides something is Important, watch out.

Re:Morons....uh I mean OxyMorons.....

[BitwizeGHC]

Knowing Microsoft, the approach they will take to "get serious" about security will mirror their previous approaches when they decide they need some new technology. It will likely play out as follows:

1) Purchase a technology leader in security. (Maybe RSA. Hey, maybe Schneier's outfit!)

2) Cannibalize their product and incorporate it into Windows.

3) Screw it up royally.

Re:Morons....uh I mean OxyMorons.....

[Tony-A]

What's the least secure part of a bank vault?
The big, heavy, impressive door to the vault.
Adding stuff won't help if the side windows are open or broken.

Re:Morons....uh I mean OxyMorons.....

[Anonymous Coward]

That said it is much easier to innovate wihtout regard to security even at a basic level, MS has been doing just this for quite sometime, and it looks like it may finally be catching up to bite em in the ass.

Oh, and "Microsoft" and "Innovation" in the same sentence isn't an oxymoron...?

Text only e-mail

[Anonymous Coward]

From the article :
"Originally, e-mail was text only, and e-mail viruses were impossible. Microsoft changed that by having its mail clients automatically execute commands embedded in e-mail. This paved the way for e-mail viruses, like Melissa and LoveBug, that automatically spread to people in the victims' address books. Microsoft must reverse the security damage by removing this functionality from its e-mail clients and many other of its products. "

Amen. Give me pine anyday and get rid of the crappy HTML formatted e-mails with pics and crud, If I want to see that send me a link to a web page and I'll look at it if I feel like it. Don't send me huge bloated e-mails that look like shite when I read em on pine.

Re:Text only e-mail

[xtstrike]

here here - im all for that, RTF is the way to go, I cant stand it when i get an e-mail and have to spend 20 seconds opening it because its SPAM and is downloading most of its advertisement from the internet. Ive not once had a piece of useful html e-mail and I doubt I ever will!!

Re:Text only e-mail

[Anonymous Coward]

and no more 1x1 gif/jpg/whetever's to let the spammers know that you read their crap before you reported them ;-)

Re:Text only e-mail

[DrSkwid]

"Originally, e-mail was text only, and e-mail viruses were impossible."

shame it's not true
Buffer overflow in MS Outlook & Outlook Express Email clients (Date parsing)

Re:Text only e-mail

[DeHar]

Actually, text email was not completely safe either. IIRC, Kibo had a text signature which would clobber many an email client...

Re:Text only e-mail

[Anonymous Coward]

What the hell does that have to do with the subject at hand? So microsoft's products have holes. We all know this. Did you know that email has been around longer than outlook? It's true! Microsoft didn't invent email!

It's shocking, I'm sure.

Re:Text only e-mail

[Telastyn]

Pine can view html natively these days... sorry to burst your bubble :[

Re:Text only e-mail

[MarkusQ]

"Originally, e-mail was text only, and e-mail viruses were impossible."... Amen. Give me pine anyday

Back in the text-only e-mail days I was quite confident in telling to my users "text e-mail can't hurt you"...until a friend at a neighboring site (uucp) showed me what they'd found: An e-mail that ended with embedded escape sequences to program a key with a long string of commands, clear the screen, and then the something like "Mail file corrupted--press (whatever the key was) to continue."

The commands, which went back to the mail reader (or would have, if the user had followed the directions) would then 1) write the body of the message to a file, 2) exit the mail reader, 3) compile the source code it just saved, and 4) run the program.

There were a few bugs in the creature, so it hadn't worked as intended, but from then on I wasn't so sure about things being safe just because I couldn't see how to exploit them.

-- MarkusQ

Re:Text only e-mail

[markmoss]

An e-mail that ended with embedded escape sequences to program a key with a long string of commands, clear the screen, and then the something like "Mail file corrupted--press (whatever the key was) to continue."

The commands, which went back to the mail reader (or would have, if the user had followed the directions) would then 1) write the body of the message to a file, 2) exit the mail reader, 3) compile the source code it just saved, and 4) run the program.

Then the e-mail reader was not treating the e-mail as plain text. If the only escape sequences it recognizes are end of message and start of attachment, the only thing that can hurt you is the attachment -- if you are dumb enough to run an executable attachment.

Re:Text only e-mail

[MarkusQ]

Then the e-mail reader was not treating the e-mail as plain text. If the only escape sequences it recognizes are end of message and start of attachment, the only thing that can hurt you is the attachment -- if you are dumb enough to run an executable attachment.

That had been roughly my thinking as well. But the point is that the e-mail reader (either pine or elm, IIRC) was just treating the body as plain text, and happily dumping it (escapes and all) to the terminal.

The terminal (VT100 or some such) was seeing the escape sequence and obligingly reprogramming the specified key to do the dastardly deed. Then it would just as obligingly clear the screen, so that all the user saw was the message telling them to hit the booby-trapped key.

The mail reader was oblivious to all of this.

-- MarkusQ

Re:Text only e-mail

[DrSkwid]

What the hell does that have to do with the subject at hand? So microsoft's products have holes. We all know this. Did you know that email has been around longer than outlook? It's true! Microsoft didn't invent email!

The point being that it's isn't just MIME mail that can carry a nasty payload and that it isn't just MUA's that purposely execute atatchments that are vulnerable. The article was trying to imply a plain text only world was a safe from harm world.

The post I replied to quotes from the article "Microsoft changed that by having its mail clients automatically execute commands embedded in e-mail. This paved the way for e-mail viruses"

and then states "Give me pine anyday"
but pine and other text only MUA's are not invulnerable to exploitation, the buffer overrun could have been in any of them, it just so happened that the one I remembered was in Outlook.

Did you know that not all comments including the word Microsoft are rants or bashing for the sake of it?

Re:Text only e-mail

[Reziac]

This was known as an "ANSI bomb". It could only happen if the user had ANSI loaded in DOS, and IIRC then only a version of ANSI that allowed itself to be reset by such sequences (such as the default ANSI.SYS that shipped with M$DOS). Which is why a lot of people used 3rd party versions of ANSI.COM/.SYS, such as ZANSI, NANSI, etc. which were not vulnerable to this trick.

I still use a textmode email program that dates back to the BBS-messaging era, and it's immune because it doesn't do ANSI at all. (It says it does, but it doesn't.) It sees ESC sequences as raw text, so does nothing.

Telnet apps that grok ANSI may still be vulnerable to this trick -- dunno for sure, but it's a thought.

Re:Text only e-mail

[markmoss]

Ummm... So Microsoft built vulnerabilities into DOS too...

Re:Text only e-mail

[Reziac]

Actually, from a comment in the ASM source code (yes it's out there :) it may have come in with some patches from Compaq!

Re:Text only e-mail

[Dyolf Knip]

Certainly, no program is ever completely secure. But Outlook set new records when it came to disseminating virii using 'bugs' that were purposely put in as features. Outlook wasn't screwed over by some arcane gap in its security. Everything it did as a result of those those email scripts it did because that was exactly what it was supposed to do. The ability to write and send emails, to peruse through caches and address books; these are things that were not done on accident.

Things are bad enough with mere oversights on MS' part. When they deliberately build poor security, it all goes straight to hell.

Ummmm, No

[wiredog]

Couldn't have been covered last week. It was posted today.

It sounds like

[JonWan]

he's asking Microsoft to undo most of their desktop / system intergration. Isn't all that intergration what the general public likes about Windows(tm)? I don't see this happening, they will just patch around or disable by default all / most of the problem areas.

childish

[abelikoff]

This "research" is way too unrealistic. Security doesn't necessarily play along with getting an edge over competitors, which is (and will always be) a primary goal of any company. Yet the authors are so detached - they seem to want all of it short of making Microsoft opening the Windows and Office source code and handing it over to Richard Stallman.

Re:childish

[RembrandtX]

not really childish ..
they are asking them to make good on the promises they have been telling the general public (and Wall street btw)

I mean .. would YOU want your bank running a windows server to keep track of your $$ ? how about one hooked up to the internet so they can communicate with their other branches ?

well .. just a cold shock of reality here .. but you should be very worried, not only does microsoft WANT this to happen, they have been agressivly trying to GET it to happen for the last 2-3 years.

imagine how quickly ONE security flaw in a bank server could render you broke.

Re:childish

[maddman75]

Security doesn't necessarily play along with getting an edge over competitors, which is (and will always be) a primary goal of any company.

You just outlined the primary reason that Open Source is the superior method of software design. A programmer crafting software because it scratches his personal itch will ensure that it is stable, secure, and reliable. A company will put lots of flashy glitz on it and get security/reliability up to "good enough" and ship.

Re:childish

[abelikoff]

To begin with, a security flaw in a bank server will not render me broke - I'm still under the FDIC umbrella. :-)

Now, I'd be equally unhappy if my bank used either MS software or Open Source stuff. I'd much rather see them using something proprietary and not available to general public, like mainframes.

However, if there is a security flaw in the bank, I'll primarily blame the bank itself, not Microsoft, Linux, or whatnot. Software will never be perfectly secure (errare humanum est) and in my opinion primary blame is always upon the implementor.

Finally, in all of the above I'm neither blaming nor advocating Microsoft. I'm just saying that they are doing exactly what they are supposed to do as a public company and to blame them in this or to ask them to radically change themselves is in my opinion childish.

Re:childish

[RembrandtX]

now ..i totally agree with you on your point of expecting microsoft to do a 180 on marketing.

EXCEPT (big except) they are the ones touting the 'we're gonna be more secure' stick. I wouldn't mind so much, if they haven't been hypocritical about it in the past. Any other supplier who made similar clames, has been held responsible.

Back to the bank analogy:
first .. FDIC only covers 100,000 :P after that the rest is history. [just incase you didn't know]
second: if your bank was running a system that was represented to them as the most secure [how are they to know how to sort propaganda from cold hard facts .. easy for us geeks to see .. but not so easy for a 65 year old vested bank owner who finished college with an old IBM typewriter.]

lets assume only for the sake of this argument, that somehow the 32 billion (or whatever its at today) propaganda machine of M$ managed to convince a bank owner that not only is windows BankXP more secure than anything out there .. but it will automagically patch itself to fix any discovered bugs.

lets say the bank owner buys in .. and then .. 3 weeks later .. is destroyed through an exploit in the system. Do you hold the bank responsible ? [for using the most popular operating system which 1/2 its employees probally grew up with ?]
or do you hold the company who made the software, and was 'creativly' avoiding mentioning thats its not REALLY as secure as you can make it.

and who does the bank blame ?
how about the supreme court ?
(which is where it would wind up eventually)

*sigh* its all a mess .. isnt it ?

I totally agree that MS isnt going to change any time soon .. no matter how much they hold up a plaquard saying 'more secure, less code'.
It only irks me that the odds of them announcing their 'safer' frame of mind is probally more lip service than anything :( And even more so that they can get AWAY with it.

[and just for the record .. most banks -as of about 5 years ago - use a combination of Digital/Unisys systems .. programmed with Batch COBOL. I spent 5 years as a COBOL programmer for a branch of the FED .. *shudder* still causes me night tremmers.]

I hav my own theory...

[solistus]

It's been pointed out to Microsoft so many times now, maybe they're just leaving security loopholes in their code so you have to pay them to upgrade? I mean, c'mon, they can't garuantee new ideas and innovations for the next version, they can't risk making one perfect! Security flaws are a marketing strategy!

Re:I hav my own theory...

[McSpew]

Look, as much as I hate Microsoft, it's not easy to write secure code, and it's impossible to write bug-free code. Because they're not currently generating revenue with bugfixes, I have a hard time believing they're intentionally writing crappy code just to reap the bugfix revenues. Yes, they always claim every new version of Windows is more stable and secure than the last, but almost nobody ever believes them anymore..

Their business model requires them to get people like us to upgrade our existing products to the latest versions every couple of years. Since you're not really getting a more stable product when you upgrade, and since features aren't the upgrade-enforcers they used to be, MS is trying to find a way to force you to upgrade. Witness their newest licensing/protection racket: Upgrade to the current version, or when the next version comes out, you'll pay full price to upgrade to it.

Until they change their business model to allow them to generate revenue for producing secure, stable code, they will never succeed in generating secure, stable, well-architected products.

Re:I hav my own theory...

[Spoing]

I'm largely in agreement. I don't think that MS will change unless there's a business reason to do so.

My main gripe is that they really don't seem to be trying to offer even moderately secure systems. Here's one recient nasty example;

1. Login as a valid user.
2. Try and go to another user's file area using Explorer. This fails.
3. Open up a command prompt.
4. Use cd to change to the same directory. Succeeds.

This level of security is implicit in Unix-style systems and has been for decades. I can't even imagine how they missed this. What other things did they miss that are infinately more obscure?

Re:I hav my own theory...

[Shiny Metal S.]

Until they change their business model to allow them to generate revenue for producing secure, stable code, they will never succeed in generating secure, stable, well-architected products.

I think it's the other way around. Unless people will stop buying insecure products, nothing will ever change. Voting with our wallets, we can change the corporations any way we want. If all people decide to buy only cars with built in CB radio, we would see every car producent making only cars with CB radios built in. It's really that simple.

Re:I hav my own theory...

[markmoss]

Can anyone explain to an old hardware engineer why "it's impossible to write bug-free code", but we design bug-free hardware all the time. And don't tell me "complexity". Is an OS more complex than a car, which includes several embedded controllers and thousands of mechanical parts? But quite often, the manufacturer's get the cars right the first time -- or they get to pay for fixing every single one. It's pretty unusual to get two recall notices on the same car, and I don't think any car since the 1950's has had design defects counted in more than one digit. Most software packages ship with known defects in the 100's, or even 10,000's.

Re:I hav my own theory...

[ansible]

Can anyone explain to an old hardware engineer why "it's impossible to write bug-free code", but we design bug-free hardware all the time.

I wouldn't be so sure.

A) Take a look at the errata list for any microprocessor sold in the last 20 years. It's quite an eye-opener. However, most/all the problems are worked around by the compiler writers and kernel developers, so you never hear about them.

B) With cars, they only issue recall notices for show-stopping, car-catches-on-fire design bugs. There's lots of minor bugs with cars all over the place. Things like the front suspension design on my '92 Mazda. I've had the mounting plates on top of the struts replaced 3 times now. You can stop by your dealership to look at all the notices that have been issued for your car model over the years.

very good read

[RembrandtX]

The trick is, as the author points out ... how honest are they being ? Is this a dog & pony show ? or do they REALLY mean to change the way they work.

Almost all the concepts presented were ones I learned in college [I graduated a few years before windows 95 came out .. and almost all my programming experience was on a mainframe.] It was considered a basic concept of design to keep your data abstract from your code ..

of course .. it wasn't as simple as clicking 'view source' back then either *grin*

As much as I love *NIX for a server environmet, I have to say .. M$ is still got everyone [cept apple .. but i dont have one] beat in the 'average american' user market.

I always use the "My Mom" theory when determining if something is easy to use. My mom is almost 80 years old .. and cant program her VCR .. but if she can figure out how to use AOLIM for instance, then its probally safe to say its easy.

Windows passes the My Mom test .. and that would be great .. if it wasn't so easy to break. every time it breaks .. the 3rd tier tech support guru's at microsoft tell her to re-install the software. Not exactly instilling confidence that they know what the hell they are talking about.

If M$ can get actually accomplish even these seven steps, they honestly ..will become a much better product.

The real telling point would be , if they had to evolve far enough to MAKE these changes, would they grow up as a company ?

Re:very good read

[grassy_knoll]

Therein is the rub: I want end user software to pass the Mom test (got mine an imac) but I also don't want her to get a note from the FBI asking why her machine was involved in a DoS attack.

Ease of use is very important, but without security and reliability it's worthless.

I hope that Microsoft is serious about security this time... but seeing the same things over and over (M$ claims they care about security) and expecting different results (THIS time they're not lying?) is a form of insanity...

Re:very good read

[Anonymous Coward]

> As much as I love *NIX for a server environmet, I have to say .. M$ is still got everyone [cept apple .. but i dont have one] beat in the 'average american' user market.

..and how many x86-centered companies were allowed to compete in that market? Apple was a PC, sure, but it was higher priced and its OS didn't run on Intel systems. The OSs that did were deliberately shut out by a series of questionable OEM agreements, product designs ("DOS isn't done 'til Lotus won't run"), etc.

There was never a fair test of that market to make your assertion.

Re:very good read

[Anonymous Coward]

Yes, but RedHat Linux passes the My Mom test.

I really don't think we should be using your mom, or mine, for deciding what software is acceptable for the 'average American'.

Your momma uses Windows. :)

Microsoft hasn't changed

[JoeBuck]

See this story in the San Jose Mercury. Even now, Microsoft is still treating security as a public relations problem. Their response to the discovery of security holes in their products is still, in too many cases, to deny it.

Re:Microsoft hasn't changed

[Ent]

Probably get modded down for this but..

This is getting out of control. Microsoft never claimed that the compiler feature would do what Cigital is blabbing about in that article. Check out the Microsoft Response or better yet go read the documentation.

Re:Microsoft hasn't changed

[SerpentMage]

That is the core of the problem. If Microsoft was serious about security then they would separate IE from the OS. Separate services so that people can control then individually. But do they do that? No because they want to control the monopoly. So how do they handle security? As was mentioned already a public relations problem!!!

But that is ok since that will be their undoing. And twenty years down the road we will say "Microsoft who?". Just like Unisys, Wang and most likely XEROX. Companies that do not address the real issues die off. IBM learned those lessons!

Re:Microsoft hasn't changed

[Anonymous Coward]

Companies that do not address the real issues die off. IBM learned those lessons!

Yeah, God knows IBM hasn't made any money for a long time!

Re:Microsoft hasn't changed

[Tony-A]

"We must lead the industry to a whole new level of Trustworthiness in computing." --Bill Gates internal memo, 15 January 2002.
Well, he didn't say it would be a better level.
Since there are already such as OpenBSD, TrustedSolaris(sp?), VMS, MVS, you have to wonder just what this whole new level really is. Scary.

what we're forgetting...

[Hooya]

is that MS is a corporation. in the business for making money. and anything that doesn't make money is a loss. for the longest time security was something behind the scenes and never a 'feature' that would generate any money. that hasn't changed. what has changed is that with more and more bad press MS has been getting for insecure software, 'security' has started to cost them money. people use MS software but rarely trust it. that's the only reason why they're interested in 'security'. for people to buy into .NET in all it's different interpretations people need to be able to trust it with their personal info (passport comes to mind.) without this trust, .NET would == .NOT. notice the careful use of the word 'trustworthy computing' by mister gates -- not 'secure software' or 'bulletproof agains all eveldoers' but 'trustworthy computing'. what he is doing is lining up a PR campaign to promote .NET. nothing more nothing less. it has nothing to do with a secure operating system. it has to do with a 'trustworthy computing' ala .NET.

Re:what we're forgetting...

[Dyolf Knip]

is that MS is a corporation. in the business for making money

I think most of us do realize this. But really, M$ is a very greedy and childish entity that has, to this date, followed through on only a very few of their promises, no matter how bad it may be for them. The Cryptogram article outlines a few things they'll have to do to become more 'Trustworthy', points out that many of them are fundamentally against the grain of M$'s behavior thus far, and then proceeds to ask, "Will they actually do this?". Placing release dates ahead of product completion, creeping featuritis, claiming that their bugs are their own concern and the world had better shut up about them. These are all things that they have continually done in the past and are well known to be extremely naughty, yet despite the multitude of spotlights on their actions and the sheer dependence of so many people on their software, they ignored all suggestions to do otherwise. Will they start using some well proven secure programming techniques or instead try to 'Embrace and Extend' them, blazing a bold new Public Relations trail into the world of security, in the process dooming themselves and the precious data of millions before they are given up as a bad job?

Stay tuned, updates at eleven...

Yes, it was discussed!

[JoeBuck]

Yes, Counterpane just came out, but this article previously appeared in SecurityFocus.

Analysis Is Good

[EXTomar]

Everything in the article is sounds advice for security minded software and not just for Microsoft. Seperation of "data" and "code". Seperation of "package" and "protocol". Extra software is bad. Etc.etc.etc.etc.

The overwhelming point is that this stuff is often contrary to what MS has in mind for its future software development. If they are really serious about putting security 1st in .Net then they have the embrace the possibility they'll have to delay releasing it. How many are willing to believe MS will do this?

When it comes to business vs design decisions, MS has always gone for biz.

Re:Analysis Is Good

[makapuf]

except that Code is SOME form of data : either through a security hole or a kindof scripting function.

API access from untrusted code is maybe a more useful thing to be taken care about (read : animated gifs ARE code, but limited to ... uh ... displaying images at a certain time)

Re:Analysis Is Good

[astrashe]

"When it comes to business vs design decisions, MS has always gone for biz."

That's true, and I think that a lot of these security holes are a direct result of MS making bad design decisions for technical reasons.

They're not stupid -- they know that "leveraging" one product by including hooks for another creates security problems, but they know it also creates business opportunities. That's they they did it.

But I also think we're seeing a realization from MS that they're going to take some hits on the business side if they don't address security concerns.

The question that Schnier rasies, implicitly, is this:

How much disruption of their current business strategies is MS willing to tolerate for the sake of security?

In the end, I suspect it will come down to a cost benefit analysis. Let's hope the numbers come down on the side of security.

Sincerity != Security

[Anonymous Coward]

So which is it? Microsoft's Security, or Microsoft's Sincerity?!?

--
Gargle me blass

Where to start.

[Matey-O]

Hoo boy, this is a good article, but these guys are spending waaay too much time in a vacuum.

Microsoft is already moving towards signing code files. While we recommend that Microsoft continue this practice, we also recommend that Microsoft not rely on code signing for security. Signed code does not equal trustworthy code, something the security community graphically demonstrated through the many ActiveX vulnerabilities. Microsoft should drop the code-signing security paradigm in favor of the sandbox paradigm.

While that's nice and all, it's hard for an operating system to do operating system things from within a sandbox, and with the single exception of a guy getting a Verisign key with the name Microsoft on it (nominally a Verisign problem, not a Microsoft Problem) I haven't seen a problem lately with microsoft signed code.

All other Microsoft features should be evaluated for resilience. Those that are too risky should be removed until they can be rewritten and secured.

The NonM$ loving folks will LOVE that soundbite, unfortunately, it's got all the likelihood of happening as having everybody shift from IIS to Apache. In any production environment, security is balanced havily with cost of implementation. NO company with any amount of entrenched custom code is going to pitch it because a security guy say they oughta. The fact that you cannot overwrite a system DLL in XP seems to be ignored. (There's a Key library, a backup directory of DLL's and the DLL in the system folder, if any of those are mucked with, the OS reacts trying to restore a safe version of the DLL, if a safe version isn't available, it prompts for a CD.)

We recommend that Microsoft add strong auditing capabilities to all products, both operating systems and applications software. We recommend that Microsoft provide configuration tools along with its operating system, as well as tools for an IT department to manage the configurations of its computers.

Granular auditing exists now! The problem with enhanced auditing is the storage requirements for that auditing. I get 'the application log is full' messages NOW, what happens when every bit written generates five bits of log? Are YOU going to have a Terabyte server to store 200 mb of data and 800 mb of granular logs?

We recommend that all protocols and interfaces used in Microsoft software be immediately published, and a one-year moratorium be placed on all non-security modifications to those protocols. We also recommend that Microsoft publish any new protocols or interfaces at least one year before implementing them in products.

Microsoft's been in bed for YEARS with the W3C. The protocols are generated there, and Microsoft is often the first to market to implement them. Asking them to hold off a year before using a new protocol is business suicide and not something they'll be willing to do.

Re:Where to start.

[alecto]

And do we really want our operating systems to refuse to run code not signed by Microsoft or an "approved" vendor?

How could this train not eventually lead to that?

Re:Where to start.

[Rydia]

You forget that MS is saying they want to up security. The author is just providing a list of what they need to do. "Oh no, they won't like that because it would cost money!" is stupid, because if they're serious about making security top priority, they're should expect to take the profit cuts associated with making secure software. And MS in bed with W3C, MS came in and told them that they were going to do things MS's way, and made thier own standard. W3C got fucked over by MS.

Re:Where to start.

[Matey-O]

Ah, but the standard was Documented.

In retrospect, I also don't think the big issue is with the OS...it's pretty secure. When needs to be changed are the things that software is allowed to do with the OS. (Like inserting itself in the RunOnce and OnStart registry keys.)

Re:Where to start.

[ILikeRed]

Matey-O:
I haven't seen a problem lately with microsoft signed code.

Lately is a poor excuse to keep a bad idea....

The NonM$ loving folks will LOVE that soundbite, unfortunately, it's got all the likelihood of happening as having everybody shift from IIS to Apache. In any production environment, security is balanced havily with cost of implementation. NO company with any amount of entrenched custom code is going to pitch it because a security guy say they oughta.

No, but with Gartner telling them to pitch IIS also, it seems MicroSoft was worried enough to at least make a press release....

Granular auditing exists now! The problem with enhanced auditing is the storage requirements for that auditing. I get 'the application log is full' messages NOW, what happens when every bit written generates five bits of log? Are YOU going to have a Terabyte server to store 200 mb of data and 800 mb of granular logs?

You REALLY don't understand granular auditing do you? You only turn it on when investigating a problem, or preforming an audit... it seems to work really well in *NIX systems. And since when does 200mb + 800mb equal a Terabyte. What kind of systems do you think people put Linux on????

Microsoft's been in bed for YEARS with the W3C. The protocols are generated there, and Microsoft is often the first to market to implement them. Asking them to hold off a year before using a new protocol is business suicide and not something they'll be willing to do.

The author was speaking of more than just internet protocols, but you did sum up the article pretty well in your last sentence. MicroSoft has made a public commitment for security. To follow thru will take more of a financial commitment then just offering employee bonuses, and it seems that both you and the author agree that it is highly unlikely that MicroSoft will follow thru on their pledge.

Re:Where to start.

[Tony-A]

Steel security door on a tar paper shack.
Can't add your own chicken wire even if you know how.
Beginning to smell like a disaster brewing.

Public nuisance

[coyote-san]

If your application gets labeled a "public nuisance," it doesn't matter how much the users like those features. Not if they want to interoperate with others.

This may seem like a harsh judgement, but the cost of Outlook and IIS bugs is rapidly getting to the point where a lot of admins are ready to take drastic measures to protect their own networks. That's why many sites are stripping executable attachments - and the crap like that "begin" bug discussed a few weeks ago are pushing some sites to outright Outlook bans because it's proving too costly to try to work around Microsoft's ongoing indifference to security.

I can sum it up with...

[Anonymous Coward]

"In addition to making its protocols and interfaces public, we suggest that Microsoft consider making its entire source code public. We're not advocating that Microsoft make its products open source, but if they really want to impress everyone about their newfound security religion, they will make their code available for inspection."

The whole article was easily summed up with this statement near the end.

I'm sorry, but MS releasing the code for anything just ain't gonna happen. They'll lose too much of their business.

peon out..

Be careful what you ask for

[sulli]

Also give credit to the increasingly loud calls for software liability. More and more experts and industry groups and advisory panels are supporting the notion that software be held to the same liability rules as any other consumer product. It makes no sense that Firestone can produce a tire with a systemic flaw and be liable, while Microsoft can produce an operating system with a new systemic flaw discovered every week and not be liable. I think Gates sees this liability juggernaut on the horizon, and is doing his best to dodge it.

Software liability would be a disaster for free software, right? Okay, everyone wants Microsoft to have to pay for Nimda/CodeRed/Melissa/ILOVEYOU, but I don't suspect that the authors of Sourceforge (for example) would want to be liable for someone losing his code due to a buffer overflow. Schneier is right on many things, but he is 100% wrong on this one.

Re:Be careful what you ask for

[prockcore]

If it'll make you feel better, everyone on sourceforge can offer a money-back guarrantee. :)

I think that's the most you'll ever see in terms of liability. "If this software doesn't do what it's supposed to, can I return it and get a full refund?"

You think that the makers of space heaters are getting sued? After all, place a space heater near some curtains and you'll burn down your house.

Of course not.. they slap a warning sticker on the box and they've covered their ass. Slap a warning sticker on software... "This software is presented AS-IS", and you're fine (yes, even Microsoft)

But money-back guarrantees if the software fails to perform as advertised could be a more common occurrance (even if the company doesn't provide a money back guarrantee, you may be entitled to one in the future).

Re:Be careful what you ask for

[Anonymous Coward]

I agree with you, and I think that the quote the original author used was flawed.

It makes no sense that Firestone can produce a tire with a systemic flaw and be liable...

What never made it on to the news was that ford explorers came with their tires partially deflated. So to counter with another analogy...

Blaming firestone 100% for the flaw is like saying:
"I'm suing the authors of software package X because it let a hacker control my system"
even though remote exploit in OS Y let them exploit the bug in software package X.

yeah, just thought I'd add that to the con^H^H^Hdiscussion

Re:Be careful what you ask for

[Tony-A]

if the software fails to perform as advertised
Most OSS performs better than advertised. Even without recourse to the sources.
Typing redhat.com/errata in my browser (IE on NT) takes me where I want to go. I'm sure a bunch of other guesses would also work. Other than something willful and malicious, which would be rather hard to escape notice and a very fast fix, I'd say they were off the hook for whatever the system would do. The've done more than just take reasonable precautions. Anything that surfaces later is readily accessable to someone who doesn't really even know where to start.

Re:Be careful what you ask for

[mboedick]

Software liability would be a disaster for free software, right? Okay, everyone wants Microsoft to have to pay for Nimda/CodeRed/Melissa/ILOVEYOU, but I don't suspect that the authors of Sourceforge (for example) would want to be liable for someone losing his code due to a buffer overflow. Schneier is right on many things, but he is 100% wrong on this one.

Wouldn't something like parts 11 and 12 of the GPL prevent liability?

12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM ...

Wouldn't all software producers, both open source and proprietary just put verbage in the EULA that would absolve them of all liability? Don't they already put such verbage in most software licenses?

Re:Be careful what you ask for

[markmoss]

Firestone and Ford also put language like that in their warranties. It doesn't do a bit of good for them -- the law says that manufacturers do have to take a certain responsibility for their products, and this overrides any non-negotiated "contracts" that say otherwise. If the same standard was applied to Microsoft, the company would have been sued into bankruptcy long ago by all the people who suffered data and productivity losses to the BSOD.

But used car sellers don't have such responsibility. And it would seem rather nuts to try to make non-commercial coders or distributors responsible for defects in a free product. IANAL, but I don't think that's a problem.

However, what I really want to see, is not government restrictions on a company's right to write sales contracts as it pleases, but rather fraud prosecutions when fine print in the contract, warranty, or EULA contradicts specific promises in the advertisements. E.g., MS's ads about the servers running unattended. It's not that it's impossible to have an OS stable enough for that -- Novell and Unix servers have become physically lost for years, but kept right on doing their job over the network. It's just that MS's software is not that stable -- and if they publicly claim it is, you should be able to sue for all losses due to downtime, no matter what disclaimers are in the EULA.

Re:Be careful what you ask for

[bucephalis]

>Software liability would be a disaster for free software, right?

Wrong. 2 points.
1. If you PAY for a product, you have a higher *legitimate* expectation that it lives up to it's advertising from the vendor. That's why you...paid...for it. In a very real sense, there is no vendor for free (beer)software. Nobody is selling you anything. Nobody is making a profit.

2. The fact that free (speech) software comes with the ...source...would act to greatly mitigate any potential liability (IANAL, etc). "The software doesn't behave as you think it should? OK make it do so"

>Schneier is right on many things, but he is 100% wrong on this one.

For values of wrong where wrong = right.

Do they have no pride

[sockmonkeybob]

One would think that wanted to put solid security into a product would not be an act of "marketing spin" or " profit ", but as an act of "pride". It make me wonder if M$ has lost that important development value... Maybe that is what keeps opensource alive...the ideal of creating something truly useful and something of a high quality...

just some thoughts..

--rpr

Re:Do they have no pride

[Anonymous Coward]

> One would think that wanted to put solid security into a product would not be an act of "marketing spin" or " profit ", but as an act of "pride". It make me wonder if M$ has lost that important development value... Maybe that is what keeps opensource alive...the ideal of creating something truly useful and something of a high quality...

Large companies don't have pride, they have investors, such as LARGE mutual funds, and those investors call the shots. Do something they don't like, they start selling, the stock price slides, execs get fired, everyone at the top has a Bad Day.

Welcome to the world of large companies with A LOT to lose by mistaking customers for investors.

Re:Do they have no pride

[Tony-A]

"pride" ???
Microsoft makes mediocrity an aspiration.

Wait a minute....

[pos]

Microsoft is going to have to say things like: "We're going to put the entire .NET initiative on hold, probably for years, while we work the security problems out."

First of all.... Microsoft said they were going to prioritize security. That doesn't necessarily mean put all new features on hold until they are 100% secure. You can make security a priority without doing the OpenBSD nothing but security route.

Analysts like Gartner have recommended that enterprises switch away from Microsoft IIS and delay installing Windows XP, both because of security concerns.

I would like to point out that the precipitating reason they changed their recommendation was due to MS's new licensing policy. Security problems are just more fuel to the fire.

MS's security policies annoys the hell out of me but lets at least hold our points to realistic ones.

-pos

Security through Monopoly

[stevenj]

A point that doesn't seem to be raised much, but which I think requires the vigilance of consumers, is that Microsoft may use "security" as an excuse to further entrench its monopoly.

• Want to install a non-Microsoft program?
• Send an attachment in an open format (as opposed to MS Office)?
• Buy something from a website that doesn't use Passport?

You'll get:

Warning: this program/file/site is INSECURE and may contain a virus. We recommend consulting two programmers, a lawyer, and a priest before opening it.

Of course, Microsoft won't make it too hard to have third-party software (as long as it doesn't compete with Office). You'll just have to pay a small fee for a MS-certified crypto signature. (Oops, free software can't pay the fee? Gee.)

Re:Security through Monopoly

[joh3n]

Dang, you beat me to it. Your point also reminds me of Cringley's article predicting the MS version of TCP/IP.

This, to me, may be the Achilles heal to a variety of the MS 'services' in the future. They trump the security for a while, everyone jumps onto Passport, and when the dang thing gets crakced big-time, heads may not roll, but they'll certainly wobble a bit.

To throw in a rampantly naive question from my end: Since I don't actually know much about security platform to platform, just how much emphasis on security goes into say BSD or Linux? Do the bulk of open source developers out there start with the frame of mind "How do I make a secure 'Program X'?" or is it "How do I make 'Program X' secure?"

Re:Security through Monopoly

[Shiny Metal S.]

That one who modded this post down as flamebait, obviously doesn't know the history.

Re:Security through Monopoly

[innocent_white_lamb]

While interesting, your question is somewhat off-side when discussing Linux and BSD.

It is my considered opinion that Linux and BSD have a different basic mind-set (for want of a better term) than Windows. This mind-set is best exemplified by stating that the answer to your question is, Linux and BSD developers don't have to make a conscious choice as to whether they wish to write secure program, or whether security is an after-thought. The operating system itself tends to enforce a particular security model and, therefore, applications tend to be secure by default rather than insecure by default. In other words, given no particular attention, a given Linux/BSD application will generally tend to be more secure than a given Windows application. Simply due to the design of the operating system underlying the whole thing.

My opinion only, as I said.

Microsoft's best product to date

[Anonymous Coward]

Windows NT 4.0
It crashes less than anything else Microsoft.
Internet Explorer doesn't have install on demand turned on by default, doesn't have default searching through MSN (Shyeah! like I trust Microsoft to give me information back if I do a search that isn't skewed towards them or their affiliates) and it doesn't have MSN as the default web page or check for new frigging updates every time you run it by default. Microsoft must know exactly when certain company's employees log in and out. Useful stuff! Your average AOL graduate with a new PeeSee isn't going to turn this crap off! Hell are Joe Regular and his workmates even going to. Hell! Does IT even know that these are the defaults ?

XP is just a joke. I can't wait for somebody to get past the driver signing auto-update nonsense and auto-update everyone running XP with Sub7 or "echo y | format c: /q"

*sigh*

Re:Microsoft's best product to date

[Anonymous Coward]

Hi do you speak english?
I tried to understand your post, but was unable.

Please direct me to a translation dictionary.

Also, could you be any more condescending towards normal people?

AOL graduate?
PeeSee?(Which you probably use one, unless you own an Apple, or UNIX workstation).
Joe Regular?

One last point, could you use the word hell several more times? I don't think I have heard it enough to-day.

Thank you!

Vapul's Razor ditched my Crypto-Gram!

[.havoc]

Ack! Vapul's Razor "caught" and redirected my Feb Crypto-Gram! This is NOT funny. I was really happy with Razor until this happened.... now what do I do?

Re:Vapul's Razor ditched my Crypto-Gram!

[Anonymous Coward]

> Ack! Vapul's Razor "caught" and redirected my Feb Crypto-Gram! This is NOT funny. I was really happy with Razor until this happened.... now what do I do?

Reprogram your Razor ruleset, NOW. Have it redirect mail to a "Razor dump" folder, not to the trash folder.

New OS

[whovian]

REDMOND, WA - Today in a press conference Microsoft Corp. unveiled the
latest version of its Windows operating system, Windows(R)
XPSecure(TM) "It is the easiest to use and most secure version of
Windows ever to be released," touted the former chairman Bill Gates.
At the press conference the company performed a live installation of
XPSecure(TM) to demonstrate the simplicity of installation. "Our
customers have let us know that security is a foremost concern," said
Gates. "We have listened to their concerns, and we have designed our
software to fully and securely reinstall their favorite operating
system." Windows(R) XPSecure(TM) also features a Secure Live
Update(TM) option that will automatically connect customers' computers
to the internet to download late-breaking security updates. "We
realize there is much confusion out there about which security
features are truly secure. We have taken care of that with our
customers in mind," Gates continued. Windows(R) XPSecure(TM) is
scheduled to retail at $249.99 and is expected to begin to ship to
vendors in North America as early as next week. "We highly recommend
that customers of any previous version of Microsoft(R) Windows(R)
install this version to obtain an unprecedented level of user
experience in performance and reliability."

Oracle's "Unbreakable" Database

[Punchinello]

Semi-off-topic?

An equally interesting article in Mr. Schneier's newsletter this month concerns Oracle's "Unbreakable" Database.

It seems Oracle put forth a good faith (albeit flawed) effort to secure Oracle9i. They enlisted the services of TCSEC, ITSEC, Common Criteria, Russian Criteria, and FIPS
140-1 to test for security holes. None of them detected a simple buffer overflow problem.

These security companies are a sham (or at least should be ashamed).

Re:Oracle's "Unbreakable" Database

[sulli]

And don't forget the famous Oracle Breakable After All article on slashdot, famous for a certain offtopic post...

Re:Oracle's "Unbreakable" Database

[iiii]

These security companies are a sham (or at least should be ashamed).

Well, I can't speak for the others, but Common Criteria is not a company. It is a body of international standards intended to give everyone a common language for definition of security requirements, testing, and evaluating results. You can find more info about it here:
http://www.commoncriteria.org/
or more specifically the docs describing the Common Criteria here:
http://www.commoncriteria.org/cc/cc.html

A quote from the intro to the docs might help clarify:
"This multipart standard, the Common Criteria (CC), is meant to be used as the basis for evaluation of security properties of IT products and systems. By establishing such a common criteria base, the results of an IT security evaluation will be meaningful to a wider audience. 2 The CC will permit comparability between the results of independent security evaluations. It does so by providing a common set of requirements for the security functions of IT products and systems and for assurance measures applied to them during a security evaluation."

Re:oops

[maxpublic]

Who cares how well she acts? It's the "endless stamina" part that has my attention....

Max

Security is awful hard to make a profit from...

[GSloop]

MS is in a very hard position.

They've already gotten a reputation for putting security and stability last. New features, fluff always come first. Virtually everyone knows that MS lives by marketing, marketing, marketing.

Now MS realizes that Security is becoming "the issue." "It's the security stupid."

Now consider the difficulites.

MS has an enormous codebase to now fix - after the fact. Adding in security is WAY hard after the fact. Things break, testing must be redone etc. It's a whole lot easier to put in anything if it was part of the origional design. Super costly and painful afterward.

MS has "integrated" all of its' products. So, now they have to not only test the separate products, but also in every combination. Ouch!

From Firewalls and Internet Security (the God book of security IMHO)
- All programs are bugy
- Large programs are even buggier than their size would indicate.
- If you do not run a program, it does not matter whether or not it is buggy.
- Exposed machines should run as few programs as possible; the ones that are run should be as small as possible.

Now MS has what most would consider code bloat, and not only that integration. That's going to be an ugly task (securing the code)

MS has always fudged the truth before. Marketing before substance. So people will be very skeptical about MS's claims about anything.

MS's stance about security was always lax. Combine this with the prior point, and we have skeptical^2.

MS can't really use this as a marketing tool - or at least not until they can prove they've done something significant. This will be hampered by points 1 + 2, and continuing security lapses, when trying to secure that code and missing things.

MS can't really make money off security - again, at least not until it has serious results to show. Thus this will become a massive cost center without any revenue. Ouch^2. That will have the bean-counters breathing down the throats of the development/QA people to keep costs down. You're not producing new products, and thus revenue - salary will suffer etc.

Lastly, it will be a unglamorous job, and project. It will be hard work. You'll be unappreciated. You'll be expected to be a miricle worker, and double quick too. When you miss something, you'll get lots of heat, and few kudo's (Provided this _really_ _is_ somthing MS is _really_ serious about - if not the heat won't be there, but that's the point.)

Thus, to summarize.

- MS has a MASSIVE task to fix - both in size and complexity.

- MS has integrated all these things together. I would bet that the mutual distrust model between different modules/products hasn't been used, adding to the difficulty/complexity.

- MS has a reputation for producing fluffy software with lots of features, but not much security - it's always an afterthought. Ship early fix bugs later.

- MS has never been known for its' honesty and plain talk, thus making the credibiltiy of its' proclaimation that much more doubtful.

- This strategy won't be done quick, or cheap. The task will be difficult both technically and politically.

- MS won't be able to milk this decision for extra revenue anytime soon.

- The very fact that this effort exists, tends to point out a problem in the first place.

My conclusions are these.
MS may really intend to do this. I don't really believe it, but I'll give them the benefit of the doubt. But even if they are committed, how long will they remain committed. They won't be able to show results for some time. They will certainly have failures. These will undermine the confidence of both internal staff, and the public they're "selling" it to. It will cost a massive amount. It won't generate revenue.

It's going to be really easy to just splash it out there, and crow about it. Later, when the trench warfare sets in, it's going to be tempting to forget about it. It's out of the limelight, and we can just let it go quietly into the night.

We'll see - I don't doubt that MS _could_ do it. I just don't think they will for many reasons. And there will be _so many reasons_ no to.

Cheers!

Sorry. What a joke.

[fire-eyes]

I'm not knocking the author. However, when I read this, I was litrally chuckling. Why? MicroSoft has, and always will, put getting the next version out in stores so they can get their money before anything else. Including security, I'd even go as far as to say ESPECIALLY security, when you think about SOAP.

If after all these years of their dancing and releasing of memos/initiatives that sound good but are never acted on, you still think this is, or WILL be, a secure environment at work... Boy, you've been had. You almost deserve what you've got coming at you.

Cheers.

Don't we all read this anyway?

[mattsouthworth]

I mean, I could set up a procmail rule to send the cryptogram to /. on the 15th of the month when I receive if it would get my name in lights.....

Re:Don't we all read this anyway?

[Anonymous Coward]

I don't read cryptogram, in fact I've never heard of it(why do you think I'm posting AC)

Re:Don't we all read this anyway?

[Anonymous Coward]

Good point. I was floored by the number of people at Blackhat Vegas last year who looked puzzled when Bruce asked how many people had heard of Crypto-Gram (25-30% raised their hands). If ~75% of people who do this for a living haven't heard of it, how many Slashdotters would you expect to know about it?

No matter what, it'll take a long time

[47PHA60]

When I worked at Lotus Development, it took weeks to get the small team I worked on to change directions. This initiative from Microsoft is the equivalent of steering the aircraft carrier in the middle of a battle at full speed.

The article tells the hard-ass truth, that it may mean halting the .NET rollout for years if "security over features" is a sincere goal.

Microsoft's products strive to be "highly visible," so they tout features the way People Magazine puts cleavage on their covers. For example, the strange advertising notion that WindowsXP users can fly, even though the multimedia features shown in those ads have been easy to obtain on Macs and Windows for, literally, years.

So, I think that this is a good article because it asks the big question: "How serious are you, Microsoft? Serious enough to stop shipping for a while?"

I mean, if anyone can take the revenue hit that would involve, its Microsoft with its huge cash reserves. But with the continuing allegations that they use reserve cash to illegally pad their financial results (and please shareholders), I just don't know if they can stomach the fact that they might take a Wall Street beating for a while.

The Mom test

[Weasel Boy]

My Mom's windows installation has been broken for over 3 years (but not so badly that the PC is unusable). She doesn't lack the expertise to reinstall the OS; rather, she lacks the expertise to (1) systematically back up all of her documents; (2) reinstall the OS; (3) then reinstall all of the apps into the new Registry; then (4) reinstall all of her documents into the new folders.

In any OS other than Windows, only (2) is necessary.

Windows IS NOT EASY.

no need to rewrite everything

[AdamBa]

Schneier writes:

"Security works best when it's designed into the system from the beginning, so a lot of what they've already done is going to have to be rewritten."

This is false. XP, based on NT, has security built in. The vulnerabilities discovered so far basically seem to be in two camps:

1) Buffer overflows left in the code -- rewriting won't help these, it will likely just introduce more. They just need to be found and fixed. Microsoft is in fact going over all its code line-by-line, but I can't imagine that glassy-eyed developers spending a month doing that is actually going to find all the overflows.

2) Bad design, in particular allowing foreign code to execute. I.e. the various Outlook email viruses. These need to be removed, which is a basic change in how Microsoft thinks (security over nifty features) but again you don't need to rewrite Outlook to stop if from executing scripts by default.

Methinks Schneier might be fantasizing a bit about Microsoft *having* to do this, of saying, as he puts it, "We're going to put the entire .NET initiative on hold, probably for years, while we work the security problems out." It seems like he would like to see Microsoft fall behind in the market because they have to throw all their current code away. Plus he hates SOAP (since it sneaks past firewalls inside HTTP), which is one of the technologies .NET is based on.

Personally I think this is basically more marketing hype from Microsoft. Because they are still not going to penalize developers who write insecure code (something that was bandied about but not adopted) -- it will still be, "Oops, we did it again". So with no real connection between good code and stock options, developers at Microsoft won't change.

- adam

Re:no need to rewrite everything

[ansible]

This is false. XP, based on NT, has security built in.

Eh, not quite. Did you read all of the article?

One of the big issues I have with Windoze is that it's not easy to disable and remove the parts I don't want, which is what Bruce talks about.

On a server connected to the Internet, I'd want to remove anything that's not strictly needed for running the application, like the web browser. Microsoft's attitude is: "Opps, sorry, that's part of the OS now, live with it." However, with other operating systems, I do have a choice.

Sure, you can argue that I'm being paranoid, and what possible harm could come from having some extra software installed. Maybe you're right. And maybe some dumbass junior admin (that I didn't get a chance to interview) needs to surf the web to look up an answer while he's putzing with the server. Maybe because there's a browser (which can't be gotten rid of) on the red-zone server, and he uses that, rather than the one on his desktop computer. Maybe the security permissions are still the default (lax), and he downloads a virus or worm. Maybe it infects the system, because he was logged in as Administrator.

And if there's no browser on the red-zone server, he'd haul his lazy ass back to his desk to look up the answer, thus preventing, or at least containing, a whole host of problems.

As for SOAP, from a network administrator's point of view, it's easy to hate it, seeing as how it was expressly designed to evade the firewall. If someone's got a new RMI protocol, I should damn well be able to easily block it, if that's the policy.

Now with SOAP, instead of simply blocking a port, which just about any stupid firewall can do, you need a firewall that can look inside HTTP requests to see which ones are from browsers, and which ones are SOAP requests. More processing power, and therefore less throughput on the firewall. And probably a more expensive firewall to boot.

Wearing my enterprise application developer hat, I think SOAP is pretty cool. Wearing my network administrator hat, I would like to kick in the nuts of whoever thought it up.

Yes, I realize that I'm paranoid, it comes with the job. If you don't believe me now, check back with me in 5 years. If you last that long.

Re:no need to rewrite everything

[jo42]

Don't forget wide open default file system permissions (Everyone full on \), or poorly thought out default file system permissions (Everyone full on \Inetpub).

Re:no need to rewrite everything

[jo42]

Wearing my network administrator hat, I would like to kick in the nuts of whoever thought it up.

Ditto. And all the other protocols being shoved over port 80 (HTTP).

Re:no need to rewrite everything

[Anonymous Coward]

If SOAP is evil for riding on HTTP, then what about SSH port-forwarding, where you "fake out" your firewall by using SSH to run your request thru port 80?

Spot on!

[Anonymous Coward]

The lone beneficiary of software liability will be Microsoft.

Are you SURE there are zero bugs in Linux? No. Could Linus afford Micrsoft's legal team for even 5 minutes? No. Could VA Software afford the malpractice insurance premiums for even one month? No.

The scenarios are endless. Bill Gates PRAYS for software liability every day.

that would be the browser wouldn't it ?

[Archfeld]

and they do dominate the market.I'm with ya, the only thing stopping M$ from owning the world is their products have some severe problems. If they actually get up and do some credible coding, put out a good product what then will we have to BIATCH about ?

I really dislike their business practices but if they make a good product...someday they might...

www.trustworthycomputing.com

[frank249]

Propally mentioned before but this site is still up. Go to www.trustworthycomputing.com and you get redirected to a google search results listing the thousands of articles on Microsft's history of security breaches.

Mean while, Microsoft has started a public marketing campagn and even plans to have .net set to secure by default but it will be an uphill battle for them. Today at the same time as secure by default came out there was another story about another vulnerability in Outlook Express

Trustworthiness requires more than security

[lostboy2]

If Microsoft truly means what they say, and that they really are going to try to develop products and services that are "available, reliable, and secure", then this is a Good Thing. But, in order for them to achieve "Trustworthy Computing" (something that various other people already do, IMHO), it seems to me that Microsoft needs to do two things:
*) develop trustworthy products and services
*) become a trustworthy company

And that will be no easy task. I agree that security in their products is something that they need to improve, but I think becoming trustworthy will require much more than that. If I were to describe all of the things that I think Microsoft needs to do to accomplish these things, I'd be here all day. So, I'll describe only a few examples not related to security.

1) Improve the quality of their products. In my current job, I have the singular pleasure of developing applications in MS Access 2000. Unfortunately, the documentation provided with the software is poorly indexed, incomplete and (in some cases) inaccurate. For example, in one place in the documentation, it claims that the maximum number of levels of nested forms allowed is 3. Elsewhere it claims the limit is 10. Both are wrong. It's difficult to trust software when its own documentation is incorrect. This doesn't mean that their products have to be perfect. But right now, it often feels like they're not even trying.

2) Abandon the new licensing strategy, which essentially dictates when companies need to upgrade their software. Having to go through a massive upgrade because of licensing is no different than having to go through a massive upgrade because of a bug or security vulnerability. The end result is the same, and I do not consider such software to be "available" or "reliable".

3) Adopt more ethical business practices. A number of the comments posted here speculate on what Microsoft true motives are. Given MS's history of Machiavellian business practices, it's not surprising that people don't believe Microsoft, even if they are telling the truth. And I'm one of those people. I tend to believe the adage that you can't build a straight house with crooked boards. So, if Microsoft really wants to promote trustworthy computing, then they must become a trustworthy company first.

Some folk have noted that the General Public's view of MS is much different than the average /.er, and possibly the average techie in general. However, I don't believe that this changes what MS needs to do to be trustworthy. On the other hand, if MS is only interested in looking trustworthy (rather than being trustworthy), then that's a different story.

Anyway, if MS is serious about this new directive, then good for them (and it's about time!). But I'll believe it when I see it (and maybe not even then).

</soapbox>

-- D

His hidden point,

[novastyli]

I think, is that Microsoft has made a promise almost impossible, or as you say, unrealistic to say the least, to fulfill. Thus, it is nothing more than another PR "flim-flam".

According to him, Windows is almost hopeless from the security viewpoint. That's what he wants to say.

FIPS 140-1

[SecurityGuy]

I don't think any of them are companies.

FIPS 140-1 is Federal Information Processing Standard 140-1. It's a document describing how the U.S. Government requires itself to do things. Read it here You can be certified compliant, but the process is done by independent labs, not NIST (home of FIPS).

TCSEC is also not a company. TCSEC, or Trusted Computer System Evaluation Criteria, is a book. "The Orange Book", to be specific. It can be found here as well.

The orignal poster's point is well taken, though. Whichever companies provided the certification might consider examining their process.

Examination Process

[TFloore]

The orignal poster's point is well taken, though. Whichever companies provided the certification might consider examining their process.

I haven't read these books/standards, so feel free to ignore me.

But, before you complain about how these companies should examine their processes, consider that they might be doing exactly what is required by the standards.

Schneier was mostly complaining about buffer overflows in 9i. Before you go complaining about the security review process, check if these standards actually say "code should have no buffer overflows." If they do say that, check how they say it. No use no "known-insecure" functions? Bounds checking on all inputs? Only on user inputs? (Is there such a thing as a trusted input?)

I suspect you can pass these 5 standards completely, and still be insecure.

Re:Examination Process

[doug363]

TFloore said: I suspect you can pass these 5 standards completely, and still be insecure.

Your suspicions are certainly accurate. Programs which are "excessively" vulnerable to denial of service attacks are considered to have security flaws (see the Microsoft advisory on the UPnP problems for a recent example of this). Also, there are many, many other routine security flaws which can arise in programs, and in particular, programs which require root/System/Administrator privilages to run.

As an example here, suppose program XYZ wants to modify the file .xyz in the user's home directory if it exists. Suppose also that program XYZ needs to be run SUID root. If the program gets the user's home directory from the HOME environment variable. This opens up a security problem, because the user could have set the HOME environment variable to anything. It is also possible that a malicious user could make .xyz a symlink to another file that they normally would not have permission to modify. Both these things allow a user to modify a file that they shouldn't be allowed to touch, and hence are security flaws.

There's a good FAQ on this (the Secure UNIX Programming FAQ) at http://www.whitefang.com/sup/, if you're interested.

Business as Usual

[wahini]

The only reason Microsoft is focusing on security is because of the wording of the DOJ settlement. Microsoft can keep secret all OS programming API's which have to do with security. By adding extra parameters having to do with security to their currently secret API's, they can keep them private for their own use. This is why MS is focusing on security all of a sudden. Every API they want to keep exclusively for their own use will get tied in with security features. It's not like someone will be allowed to audit their code for compliance anyway. Just MS business as usual!

ANSI.SYS?

[MarkusQ]

This was known as an "ANSI bomb". It could only happen if the user had ANSI loaded in DOS, and IIRC then only a version of ANSI that allowed itself to be reset by such sequences (such as the default ANSI.SYS that shipped with M$DOS).

How odd. *smile* Given all her talk about VT-xxx terminals, pine/elm, and scads of users on each box, I would never have guessed that my friend's site was running MsDos.

-- MarkusQ

Re:ANSI.SYS?

[Reziac]

[laughing]

[Walter Brennan] You young'uns just ain't old enough to remember BBSing. Terminal apps emulating VT-xxx, textmode mail, and scads of users on every box. [/Walter Brennan]

But AFAIK there's no rule that the same basic principle couldn't be applied to ANY vulnerable system that speaks ESC sequences, which I gather come from way back in prehistoric times when we carved our PCs out of wood. :)

Re:ANSI.SYS?

[MarkusQ]

MQR: How odd. *smile* Given all her talk about VT-xxx terminals, pine/elm, and scads of users on each box, I would never have guessed that my friend's site was running MsDos.

Reziac::ARealMcCoy: You young'uns just ain't old enough to remember BBSing. Terminal apps emulating VT-xxx, textmode mail, and scads of users on every box.

*laugh* Ah, now you'd be talking about my site. But I don't think I ever had more than a half dozen or so users on a PC at once (dial up that is--on site we had about thirty, but each had their own PC & pooled "connections" for file transfer).

BTW, thanks; I haven't been called a "young'un" for...well let's just say it's been quite some time. Our first dial-up box was a NorthStar Advantage that could only support two remote users at a time (plus one sitting at it).

-- MarkusQ

Re:ANSI.SYS?

[Reziac]

Funny you should mention that -- I'd swear I saw a Northstar manual go by when I was reshelving the media-and-paper part of The Infamous Computer Closet (where old computer stuff goes to die :)

[goes to look] I did, I did, I DID see a NorthStar System Software Manual, revision 2.1, copyright 1979, 1980. Calls the OS "Northstar DOS v2" tho it looks more like interpreted BASIC to me. Used a whopping 3.25kb of RAM. Such bloat!

Now where did I stash the punch cards from my high school's IBM-1620? :)

Is it just me...

[koh]

And somebody has surely mentioned it before, but doesn't the whole article sum up to "we recommend that Microsoft starts making Linux operating systems" ? ;)

Not that it would be a bad thing, of course...

Merchantability, Fitness for Purpose, etc.

[rjh]

There's a sort of implicit warranty whenever you sell something: namely, you're warranting that it's useful for a particular purpose (said purpose being one that you, the seller, reasonably believe the buyer intends). If I sell you a car and I neglect to tell you that it'll blow up spectacularly if you happen to turn the engine over before fastening your seatbelt, well, that car's not fit to drive--hence, I (the seller) am in a whole stewpot full of trouble.

When you purchase software, there's an automatic warranty involved. Namely, that the software doesn't suck. That it's not going to be an open invitation to haX0rs. That using it isn't going to expose you to enormous risk, unless the seller has first advised you of specific enormous risk and you choose to buy it anyway.

When you license software... well, that's not a sale, is it? And hence, the legal protections that you get when you buy things don't apply to you. I can count on one hand and have fingers leftover all the times I've seen shoddy software be held accountable in court.

So this push to software-liability law is more of a push to make software a sold good, not a licensed one. The theory being, if I plunk down $200 for Windows XP, it shouldn't have a UPnP back-door in it. Software-liability laws would permit affected users to sue manufacturers to recover lost damages.

However, common law says that if you pay a nickel for something and it breaks, you can't make twenty million bucks off a lawsuit over it. Twenty bucks, maybe, twenty million, no way. There is an implicit limitation on the assumption of risk, and this implicit limitation is related to the price paid.

If I pay Red Hat $50 for Red Hat Linux and there's a horrible bug that makes my Linux box an inviting target for 1337 haX0rz, then Red Hat's liability is a factor of the $50 I paid them.

If I pay you $0 for a piece of GPLed software you wrote, and there's a horrible bug, your liability is a factor of the $0 I paid you.

Err... wait. I didn't pay you. I got something for nothing--I literally received a good at no price whatsoever above the price of media. The courts would not look favorably upon me suing you for $20 million because you gave me something, for free, out of the goodness of your heart, and made it clear to me that it was a work in progress and might not work as I expect it to.

Boring

[radsoft]

Personally I find this stuff immensely boring. There's a suspicion of a needed symbiosis here. And there is no way in heaven anyone with a brain can expect Microsoft to ever get better or want to get better. All this pussy-footing around that this guy and others do is just such a waste of time and space.

Rickster/