MS Cites National Security to Justify Closed Source

guacamolefoo writes: "It was recently reported in eWeek that "A senior Microsoft Corp. executive told a federal court last week that sharing information with competitors could damage national security and even threaten the U.S. war effort in Afghanistan. He later acknowledged that some Microsoft code was so flawed it could not be safely disclosed." (Emphasis added.) The follow up from Microsoft is even better: As a result of the flaws, Microsoft has asked the court to allow a "national security" carve-out from the requirement that any code or API's be made public. Microsoft has therefore taken the position that their code is so bad that it must kept secret to keep people from being killed by it. Windows - the Pinto of the 21st century."

Comments

War

[qslack]

War is always the best excuse. One of my favorite cartoons on this is Mark Fiore's, at http://markfiore.com/animation/excuse.html. :)

Nice

[jayhawk88]

When in doubt, raise concerns about terrorism, or inappropriately use 9/11 as a crutch. The new coin of Washington (both east and west it seems).

Nothing will ever be the same again indeed.

Re:Nice

[bmajik]

I agree with you (code shouldn't kill people).

I don't see how thats microsofts problem. The government decided they wanted to use off the shelf computer equipment and software. They got sick of developing a computer system and maintaining it for 30 years. You realize that in the 80s there were software engineers that were maintaining code for submarines that had ferrous-core memory systems.

The navy wanted to get away from that.

So, its nice that you're mad about the navy's choice of computing infrastructure. The fact that it happened to fail has nothing whatsoever to do with microsoft, and you're being irrational about being upset with them over this.

Not that there aren't other things to be upset with them about :)

MS sweating...

[wowbagger]

"Uhh, the judge is acting pissed. Did you see the way she looked at us when she said 'Obey the court'?"

"Yeah, how can we BS her on this?"

"Uhh, maybe we can find a link to terrorism?"

"YEA! That's it! We can't comply, because of National Security"

Harmph....

Now what are they trying to hide?

[CoolVibe]

Microsoft code and national security? Hmm... Interesting :) Also another good question is: whose national security, als lots of foreign governments use Microsoft software.

Worrying isn't it?

Re:Now what are they trying to hide?

[cybermage]

Worrying isn't it?

I figure if Microsoft code was handling anything important, we'd be dead already. The concept adds a whole new meaning to BSOD.

Hypocrits

[Telastyn]

If the code is so bad as to be dangerous, shouldn't the government make them recall the code and return a properly functioning version?

If a car was dangerous enough to possibly cause death, wouldn't the government require a recall? Wouldn't the media jump on them like rabid wolves like they did Firestone? Wouldn't people avoid the things like they did Firestone?

Re:Hypocrits

[notsoanonymouscoward]

have you thought this through? What about interoperability? Modularity? If you worked like this, pretty much all NON software companys would end up doing everything in house, which is of course, not what they are in the business of doing. There is a reason microsoft exists. There is a reason someone is on top.

Pintos should be offended...

[cansas]

The Pinto was never as dangerous as M$ products.

Re:Don't pick on me! My software sucks!

[CoolVibe]

Just count your lucky stars that Microsoft software isn't guiding ICBMs to their target...

Well, at least I hope it doesn't. A comment like this from a Microsoft bigwig doesn't sound encouraging... Mid-air GPF anyone? *ouch*

er,

[Xzzy]

From the story:

> The protocol, which is part of Message Queuing,
> contains a coding mistake that would threaten the
> security of enterprise systems using it if it were
> disclosed, Allchin said.

Then with all the billions and billions of dollars M$ has hanging out in the bank, why not hire someone and FIX THE PROBLEM. What's the problem with doing the things that make sense?!

Single best thing M$ could do to improve their product security is to adopt the 'patch often' mindset. Fix something, release a patch, everyone goes home happy.

The bi-annual (exaggeration) security patches they currently do ain't gonna do it.

Re:er,

[cperciva]

Single best thing M$ could do to improve their product security is to adopt the 'patch often' mindset. Fix something, release a patch, everyone goes home happy.

That's great in theory, but the real world doesn't work like that. In the real world, it is very hard to get everyone to apply patches, and the software vendor gets blamed even when they've made the patches available months earlier; Code Red is a perfect example of this.

In the context of system administrators who forget to patch their boxes, you actually end up with better security if you release a large patch every month than if you release small patches every few days.

Re:er,

[bobdehnhardt]

Never will happen. Releasing patches often would give the average users the idea that "this software is crap, they keep finding problems with it, that little Updates thingie keeps popping up and annoying me, why didn't they get it right the first time?" Far better to release one mega-patch every 6-9 months, label it a "Service Pack", and stress the "enhancements" over "bug fixes". At least, that's how Microsoft seems to view it.

Microsoft is all about perception. They learned long ago that they can release pure shite as long as the general public perceives it as good. And that can be accomplished through Marketing, which is much easier to craft and control than Coding....

*Yawn* I think someone from Peru said it best ...

[smoondog]

(From a story posted here)

Peruvian Congressman David Villanueva Nuñez made exactly this argument:

To guarantee national security or the security of the State, it is indispensable to be able to rely on systems without elements which allow control from a distance or the undesired transmission of information to third parties. Systems with source code freely accessible to the public are required to allow their inspection by the State itself, by the citizens, and by a large number of independent experts throughout the world. Our proposal brings further security, since the knowledge of the source code will eliminate the growing number of programs with *spy code*.

In the same way, our proposal strengthens the security of the citizens, both in their role as legitimate owners of information managed by the state, and in their role as consumers. In this second case, by allowing the growth of a widespread availability of free software not containing *spy code* able to put at risk privacy and individual freedoms.

The flaw here is that for windows code to posess the powers they imply, it would need to be a state secret. Perhaps it should be illegal to distribute mission critical osc across us boundaries? Windows code a state secret? I think not, anyone can reverse compile machine code.

Micro$oft should realize that governments do not like security threats they are not able to evaluate themselves. The NSA, for example, cannot sit and tinker with windoze's security holes the way they can with OSC (open source code)...

-Sean

National Security means...

[cperciva]

I think that "National Security" here means "the NSA asked us to put xyz into our code, and they'd be unhappy if it had to be removed or became public".

Remember: Cryptanalysis has, and will, always come in fourth place after burglary, blackmail, and bribery.

Fear the future...

[Dr. Bent]

Three things need to happen in order for people to start getting serious about software security and reliability:

1) A software system with 1 or more serious _known_ flaws must be used on a worldwide scale by a government agency or large company.

2) That software must then fail.

3) The failure must cause thousands of deaths or hundreds of billions of dollars in loss or damage.

The result will be like the 9/11 of software...when the world wakes up and realizes that we have become so dependent on software systems for our daily lives that we actually have to start caring whether or not they work correctly. We need to start taking an engineering approach to software and KNOW (not think) that it will operate as advertised.

I'm actually hoping that this will occur sooner than later. The later it happens, the more catastrophic the result will be and the less time we'll have to rectify the problem before it happens again.

They must be getting desperate...

[gweihir]

At least that is the only explanation I can think of. Their systems are architecturally unsound and plagued by stupid design decisions, unstable interfaces and unsound implementation. It is quite obvious if you look at all the security, stability and usability (ever reinstalled Windoes?) problems they have. In addition they are still adding features like mad, thereby making the problem more serious all the time.

My point is that they did not say anything new by admitting the problem. However by admiting it they also admit that they don't really care about security, as they certainly could have done significantly better! This casts a very bad light on other ventures like .NET and the motivations and real goals behind them.

So why are they admitting it anyway? In my opinion MS is scared to death that open APIs would also mean stable APIs (i.e. APIs that don't change all the time) and would enable others to make Windows compatible execution environments with relative ease. The sources are also important, because the API documentation MS would give (could?) away is not complete and correct enough. So while it takes a huge effort, competitiors would be able to really find out the complete API functionality and implement it in a way so that things that run on Windows would usually run on competing products without retesting or modifications.

As MS is not really having a good product, just an effective monopoly (by making cloning their API difficult), reasonable documentation of their APIs could kill them. At least that is what I think they believe.

Open source and security - some references

[dwheeler]

Ah yes, the "our APIs and code must be secret or the U.S. will crumble" defense. This is a particularly absurd claim for application programmer interfaces (APIs) - by definition, APIs are disclosed to other developers, so the only reason to "hide" them is to prevent competition. Oddly enough, the products where source code (not just the APIs) is visible have lots of quantitative evidence that they're more secure.

It's already been revealed that some attacker got into Microsoft's network. Also, CD's with Microsoft's source have been released for various reasons over time. I have no trouble believing that some "bad guys" already have the source code. So, how do the rest of us protect ourselves from these bad guys with the source code? And from the bad guys to come who don't have it yet... but will?

As noted in Secure Programming for Linux and Unix HOWTO, section 2.4.2, closing off source code doesn't actually halt attacks anyway. Here's the quote:

It's been argued that a system without source code is more secure because, since there's less information available for an attacker, it should be harder for an attacker to find the vulnerabilities. This argument has a number of weaknesses, however, because although source code is extremely important when trying to add new capabilities to a program, attackers generally don't need source code to find a vulnerability.

First, it's important to distinguish between ``destructive'' acts and ``constructive'' acts. In the real world, it is much easier to destroy a car than to build one. In the software world, it is much easier to find and exploit a vulnerability than to add new significant new functionality to that software. Attackers have many advantages against defenders because of this difference. Software developers must try to have no security-relevant mistakes anywhere in their code, while attackers only need to find one. Developers are primarily paid to get their programs to work... attackers don't need to make the program work, they only need to find a single weakness. And as I'll describe in a moment, it takes less information to attack a program than to modify one.

Generally attackers (against both open and closed programs) start by knowing about the general kinds of security problems programs have. There's no point in hiding this information; it's already out, and in any case, defenders need that kind of information to defend themselves. Attackers then use techniques to try to find those problems; I'll group the techniques into ``dynamic'' techniques (where you run the program) and ``static'' techniques (where you examine the program's code - be it source code or machine code).

In ``dynamic'' approaches, an attacker runs the program, sending it data (often problematic data), and sees if the programs' response indicates a common vulnerability. Open and closed programs have no difference here, since the attacker isn't looking at code. Attackers may also look at the code, the ``static'' approach. For open source software, they'll probably look at the source code and search it for patterns. For closed source software, they might search the machine code (usually presented in assembly language format to simplify the task) for essentially the same patterns. They might also use tools called ``decompilers'' that turn the machine code back into source code and then search the source code for the vulnerable patterns (the same way they would search for vulnerabilities in open source software). See Flake [2001] for one discussion of how closed code can still be examined for security vulnerabilities (e.g., using disassemblers). This point is important: even if an attacker wanted to use source code to find a vulnerability, a closed source program has no advantage, because the attacker can use a disassembler to re-create the source code of the product.

Non-developers might ask ``if decompilers can create source code from machine code, then why do developers say they need source code instead of just machine code?'' The problem is that although developers don't need source code to find security problems, developers do need source code to make substantial improvements to the program. Although decompilers can turn machine code back into a ``source code'' of sorts, the resulting source code is extremely hard to modify. Typically most understandable names are lost, so instead of variables like ``grand_total'' you get ``x123123'', instead of methods like ``display_warning'' you get ``f123124'', and the code itself may have spatterings of assembly in it. Also, _ALL_ comments and design information are lost. This isn't a serious problem for finding security problems, because generally you're searching for patterns indicating vulnerabilities, not for internal variable or method names. Thus, decompilers can be useful for finding ways to attack programs, but aren't helpful for updating programs.

Thus, developers will say ``source code is vital'' (when they intend to add functionality), but the fact that the source code for closed source programs is hidden doesn't protect the program very much.

Re:Open source and security - some references

[gnovos]

This is a particularly absurd claim for application programmer interfaces (APIs) - by definition, APIs are disclosed to other developers, so the only reason to "hide" them is to prevent competition.

Well, they may have a point though. Thier "hidden" APIs can be a big security risk, such as:

BecomeRootUserWithoutNeedingPassword()
Secretly TakeOverMachineinInvisibleMode()
DecryptAllFilesA ndSendPlaintextViaWirelessCard()

and, of course the one Outlook and Word uses:

MakeProgramsRun90PercentFasterButTurnOffAllSecur it yAndGenerateVirusesWithGeneticAlgorithm()

Forgot to Mention

[guttentag]

...sharing information with competitors could damage national security and even threaten the U.S. war effort in Afghanistan...

They forgot to mention it would:

1. reverse gravity
2. send the tightly-controlled, stable market into a state of chaos
3. put thousands of people out of work (how could MS pay its employees if they gave their products away?)
4. bring back Elvis (in the form of MP3s distributed by the masses who were previously restricted by MS DRM)
5. cause the judge's personal computer to automatically download pornography every day

Didn't we see this in Ghostbusters?

"He wants to shut down the protection grid, Peter."
"You shut that thing down and we are not going to be held responsible."

Microsoft source code is already available...

[RyanFenton]

Austria already has it.

Any U.S. University can apply for it now if they don't already have it.

Many of Microsoft's larger customers have it

I don't see why it would be difficult for any terrorist organization to get it. How can they legitimately argue that it may possible be keep it secret at this point? If it's a national security risk to make the code available, the damage can no longer be avoided.

Ryan Fenton

Best Quote from Story

[danmil]

In case you thought that Microsoft was serious about trying to make their products more secure, check this baby out:

'When pressed for further details, Allchin said he did not want to offer specifics because Microsoft is trying to work on its reputation regarding security. "The fact that I even mentioned the Message Queuing thing bothers me," he said.'

I love that! 'It pains me to admit that our software is dangerously broken, because we're trying really, really hard to convince people that the reputation we have for foisting dangerously broken software on them is totally unfounded.'

I guess if there were trying to work on their actual security, rather than just the reputation, they might act a bit differently (like, by publishing their API's and then working with the security community to get them safe).

-Dan

In other news

[MongooseCN]

After supporting MS's statements that all source should be closed and hidden in order to maintain national security, the US government has agreed to hide all tall buildings. All tall buildings will now be covered with large black clothes. In order to maintain national security, anyone caught talking about these buildings will be arresting. Since terrorists will be unable to clearly see and hear about these buildings, they will no longer be able to attack them. Thank you and good night.

Second Best Quote

[Lumpish Scholar]

"Sun's strategy of promoting '100 percent pure' Java applications discourages interoperability."

That's right; if you write a program that runs on all computers out there, you'll have problems with all those computers being able to communicate with each other.

Just have to say it...

[Flower]

They need to make a movie with Samuel L. Jackson as a Microsoft programmer just so I can hear the line.

Send me that service pack. It's the one named, 'Dumbass Motherfucker.'

They can name it something like 'Patch Lola Patch.'

Re:Just have to say it...

[blakestah]

\

Jules: Send me that service pack. It's the one named, 'Dumbass Motherfucker.'

Vincent: You know what the funniest thing about Microsoft is?

Jules: What ?

Vincent: Its the little differences. Its got a lotta the same shit as other operating systems, but with those guys it is a little different.

Jules: How so ?

Vincent: For example. Another company has a bug. They fix it in like two days, and then they annouce the bug and the fix.

Jules: Ok. And at Microsoft ?

Vincent: At Microsoft, when someone points out a security hole, the first thing they do is threaten a lawsuit against the guy who found the hole if he says anything.

Jules: You mean they threaten the guy who is helping them ?

Vincent: Yup - exactly what I mean. As long as there is not a big media splash, they never gotta fix nuthin.

Jules: So what happens if the guy opens his mouth.

Vincent: Generally he don't. But, some 15 year old kid in Asia finds the same bug, and then releases a worm, and it chews apart all the Microsoft systems worldwide in like two days.

Jules: No shit !

Vincent: Yeah, and then Microsoft tells everyone about the bug, and provides a patch, but no one fixes it.

Jules: No one !?

Vincent: Well, smart people do, but most people just miss the message. They gotta go to Microsoft, get the patch, and half the time the fix will break something else on their system.

Jules: So if this shit is so bad, why are so many people using it ?

Vincent: It used to be everything on personal computers were that bad. Then, Microsoft controlled the market. Everyone else started making good shit, but it didn't matter. Microsoft made people buy their new shit so they could continue to read their own old shit. Can you believe it ?

Jules: Man, that is some weird-ass shit. Like some idiot can't take a step back and see himself being played like that.

Vincent: Yeah, it's kinda sad. But it makes a great market for guys to run around spending all their time patching holes after they are exploited. If Microsoft made good shit, we wouldn't have jobs.

Jules: Good point.

Logical Contrapositive

[whovian]

Microsoft's view:
If the software has security flaws, then the code and APIs cannot be made public.

Open source view:
If the code and APIs are made public, then the software does not have security flaws.

So, Microsoft, we are finally in agreement, yes?

One standard to rule them all

[WEFUNK]

"Microsoft has invested substantial time and resources in providing great interoperability between .Net and older technologies," Allchin said. "Sun's strategy of promoting '100 percent pure' Java applications discourages interoperability."

So, according to Microsoft, it is better to have one company provide (ie control) the degree of interoperability between systems than to have another company promote a single standard for the whole industry to use and share.

I can't imagine that line of thinking going over very well with military officials used to building redundancy into everything.

You might also paraphase the above statements as follows:

"Microsoft has choosen to ignore freely available and already established standards and instead has wasted substantial time and resources needlessly reinventing the wheel by developing our own internal standards (that we won't share and that we admit are not really very good) so that we can control the degree of interoperability between our proprietary new product, and our former (and soon to be former) competitor's technologies"

"Sun's strategy of creating and sharing a standard that encourages 100% interoperability between all systems discourages interoperability (but only in respect to our systems, because ours are made to be incompatible with the accepted standard that everyone else uses)."

Oh boy, can I please buy your systems for my Army?

Security

[surfcow]

Your Honor, we at Microsoft believe that if we ever revealed the source code for MS Windows, more children would immediately start taking drugs. Husbands would start to beat their wives. Small animals would become uncontrollable, staining many expensive carpets. Certain food-groups would become more perishable. 2nd law of thermodynamics would be repealled. Finally, a giant hole would open up in space time, causing the end of the universe.

Your honor, it is a matter or national security, no international security, no galactic security, that we be allowed to continue our profitable monopoly.

Think she'll buy it?

=brian

Seems to me

[angst_ridden_hipster]

Seems to me that either Allchin suffered some stroke or brain damage while in court, or this is all a big red herring.

You just don't get to Allchin's level and "accidentally" let slip something like a fundamental vulnerability in a protocol. M$ officials may make mistakes, but not like this. Not in a public forum. Not in front of a judge. Not where every news medium in the world will be covering the story.

My feeling is that this is all a distraction from something else. Every black hat on the planet is now probably checking out the Messaging protocol. My guess is that there's no smoking gun there. But maybe another protocol has problems.

Furthermore, it just doesn't make sense. An API exposes only what you want it to. It doesn't show you the vulnerabilities that exist "under the covers" unless they're titanically, apocalyptically stupid.

I'd like to know what it was that he's distracting us from ...

Whose Your God Daddy?

[djmoore]

Microsoft is resorting to desperation tactics... they know they've lost.

Actually, this is entirely consistent with MS's strategy all along: it has been arguing that it and its products are so profoundly important to the American economy and security that any remedy which interferes with its ability to act as it pleases should be struck down by the court. Otherwise, everyone will suffer at least as much as MS will.

It's the exact equivalent of a mob boss saying that he shouldn't be imprisoned for running a protection racket, because then he wouldn't be able to protect his customers. Moreover, he wouldn't be able to provide for his innocent wife and children (even though it's been shown he abuses them as well).

Microsoft isn't at all desperate; they're just so arrogant, and so blind to basic security principles, that they don't really see a problem with what they're saying.

Staggering

[johnos]

Let me get this straight. The product that Microsoft's monopoly rests upon, the monopoly that they illegally maintained and expanded, is so flawed that it threatens US national security. Did someone from Microsoft REALLY say this? If so, it is clear they have gone mad in Redmond. What do they expect the millions of companies and government agencies to do? Wait until Longhorn, or whatever is ready? And hope all the holes are fixed by then?

"Uhh, sorry Mr. President, the NSA can no longer monitor international communications. Our systems are just too vunerable to hacking to be used. Jim Allchin assured us that a comprehensive fix would be available within 18 months."

"In other news, the US Navy has ordered all AGEIS cruisers into port indefinatley. The AGEIS computer systems were deemed too risky for combat use. The Pentagon would not comment on reports the entire US fleet would require software overhauls before any offensive combat operations could be contemplated."

"World stock markets are today in freefall as most major international corporations raced to secure information systems based on Microsoft's Windows operating system. Some experts estimate that the expense of fixing or replacing mission critical software to provide an adequate level of security would dampen the World economy for a decade."

This goes so far beyond a computer industry issue. Its a staggering admission of guilt. What CIO would be caught dead installing an MS system unless they have absolutly no alternative?

There is also the legal issue. If someone has sustained an economic loss due to "flawed code", that they are using because MS illegally supressed competitive alternatives, then they have a really good case for compensation. And the hardest part, proving that MS illegally manipulated the market, is already done. And they have some tens of billions just sitting around, waiting for the right lawyer to just take away.

Microsoft _can't_ fix it?

[Ride-My-Rocket]

He later acknowledged that some Microsoft code was so flawed it could not be safely disclosed.

Somehow, I think that if the US government forbade the use of any Microsoft applications within federal facilities, pending a code review by a neutral 3rd party to identify and fix potential security holes, you'd see Microsoft scramble to get their shyte in gear pretty damn quickly.

As somebody already stated in this thread, Peru has the right idea: open source allows people to public review code for potential security flaws, which is how most bugs are caught anyway -- a fresh pair of eyes takes a peek. Ultimately, there's no way that Microsoft can compete with this code development paradigm -- since there's so much Open Source code "out there", it might spread people's attention out a bit too thinly in places, but over time one would hope that Linux apps will only more secure / stable.

The way I see it, It's like choosing a woman.

[uofa1993engrmath]

One is sort of chunky and ugly, and she won't let you see her naked, and you pretty much know already that you wouldn't really enjoy it if she did. The other has a slim, beautiful body, and when she takes off her clothes and parades it around, all the men ooh and ahh over it. That's the analogy I like to use. Maybe it isn't 100% correct, but that's the impression I get when you've got MS saying "No, no, you don't want to see our source code!" and meanwhile, you've got these open source softwares that are taking it all off, and saying "hey, baby, look at THESE!" Microsoft is NOT sexy. Linux, apache, and all of those wonderful open source projects ARE. But this is just how I see it. I mean, if I was to go on a date with a woman, and she proudly told me that she has an MCSA certification, I'd probably politely nod, but secretly be planning on my escape (maybe run away after telling her I had to use the restroom). On the other hand, if she told me that she had her own php based website, and that her text editor of choice was vim, then I'd be all weak-kneed and googly-eyed, and I'd want her to have my children. But again, that's just me. I don't know how it is for other people. I mean, I may not really UNDERSTAND beautiful women, but I sure like to look at them. So, I don't think there's any action required, as in "let's get rid of Microsoft." I think that it's really just a matter of educating the masses that there's an alternative, and it looks good naked. Or as you might say, it's a lot safer because the code can be (and is) made public without compromising national security.

They don't know what they're getting into here

[CaptainCarrot]

National security, huh? Does Gates understand that anything that must remain undisclosed for national security reasons is classified? Does he really want to have to deal with everything that entails: Security clearances and background investigations for every one of his employees, periodic audits, regulations that control how every single piece of paper and magnetic media is handled, filed, and disposed of?

I work for a defense contractor and have had to put up with this for years. I suppose MS can go this route if they really want to. They're already bloated enough; add government security procedures to the mix and they'll become every bit as agile and responsive as any other constituent of the Military-Industrial Complex.

Boy, that'd be a hoot.

Re:True, and...

[EnderWiggnz]

>The basic fact of religion is that God has
>stated many times that He doesn't want to be
>easily found--hence, no fact should be hard to
>accept for anyone of a religious mind.

prove that "god" "said" this.

i'll accept *.wav's or *.mp3's or *.ogg's ... 1st person evidence please.