Slashdot Mirror
Windows 98, Me, NT4, 2000 and XP SSL Flawed
JoeSmack writes "In amazingly unexpected news, ComputerWorld is running an article that says the
SSL security hole found in Internet Explorer is not a flaw in the browser, but in the operating system itself." The article mentions
that Konqueror was patched against the same bug in 90 minutes.
Uh-oh. IANA Windows Developer....does anyone know how many apps use this API that microsoft might potentially break? (Fixing bugs: good, breaking stuff: bad....)
When in doubt, parenthesize. At the very least it will let some poor schmuck bounce on the % key in vi. (Larry Wall)
There's a difference? I thought they were the same thing...
is that for most consumers, this doesn't even matter. I mean, they will be effected by the security hole, but if their computer gets hacked or something, they'll end up just blaming their own lack of computer knowledge. They'll eventually install the patch from windows update (if they know how to access windows update), and then blindly keep surfing the net and playing "who wants to be a millionaire".
Glad it's only a client side issue then.
So I guess it's safe.
It's a good thing I didn't upgrade.
Je t'aime Stéphanie
This "makes sense" up until the point where you have to patch your kernel instead of upgrading a library. When OpenSSL had a bug, they fixed it and you could upgrade OpenSSL. When Konqueror had this specific bug, it could be uprgraded easily enough. Now Windows users have to patch their entire OS to fix this (or just use another browser that doesn't use the crypto-in-the-kernel routines).
This is the result of "integrating" IE into the OS. Now when there is a "browser" sesecurity problem, it's really an OS problem.
Sorry MS - kill by integration, be killed by integration. It's a circle of life kinda thing...
"As God is my witness, I thought turkeys could fly." A. Carlson
You can disable SSL in the advanced options menu. ;-)
"I have opinions of my own, strong opinions, but I don't always agree with them." -- George H. W. Bush
The article says: "SSL flaw doesn't affect any other application outside Internet Explorer and that it's a client-side issue only" But if it only affects IE, and not programs such as netscape (which also of course runs on windows), then technically it IS a problem with IE!
We only wrote bad code that made it through QA for 5 different versions of the OS dating back to the mid 90s. Of course, with Palladium, our new secure platform, things like this will never happen. Good thing we got that patch out quick!
(Oh wait, that was the Konqueror people!)
We'll I'm sure with our new secure computing focus it will be out any time now. Please don't stop doing ecommerce, just because all your personal data can be hacked, just use Passport.
(Oh wait, that happens with Passport too!)
Ummmm...
Can we stop with the "Foo blah blah DMCA foo!" jokes already? The first 600 or so were funny (ok maybe not), but it's getting old. Especially when the subject matter has nothing to do with copy control circumvention or the ??AA businesses
Seeing continued OS-level design flaws in Microsoft products is, to me, reassuring. When MS goes ahead with Palladium I'm now quite confident that it will be riddled with fundamental design flaws that will make its "security" (read: capitalist totalitarianism rule over the masses) a joke.
I am so shocked to hear Microsoft didn't follow the standards when implementing SSL.
Neither did Konqueror. Blame where blame belongs, please. It's trendy to just blame everything on the Big Evil Empire, but let's not forget they aren't the only ones who have bugs.
"Tell me doctor, with all of your defenses, are there any provisions for an attack by killer bees?"
MS TCP/IP stack is in inet.dll. That is probably where the bug is.
I was a beta tester for IE4 (so flame me, OK) and I found a bug in the HTTP1.1 keep-alive implementation. They never saw it because they tested only against IIS and I tested against Apache which implemented it correctly of course.
They didn't want to fix it until I explained that %60 (at the time) of the web runs on Apache servers.
In fact the MS product manager wanted me to call "the Apache company and have them fix Apache." Duh. Me- "There is nobody to call sir, and the problem is YOUR problem and not theirs."
They delayed IE4 for two weeks after it had gone gold to fix it. So don't flame me.
Anyway, that bug was in inet.dll, and I bet this one is too.
Use a different web browser.
;-)
(or better yet, a different OS altogether...)
Windows 98, Me, NT4, 2000 and XP SSL Flawed
Isn't this supposed to be " News For Nerds"?
Doesn't matter if everyone is qualified. If they aren't their suggestions will be ignored by those who are, who also happen to be those who integrate the suggestions/new code.
They who would give up an essential liberty for temporary security, deserve neither liberty nor security
- The bug is in the OS crypto services
- It's NOT MS's crypto api
- Only IE is affected.
Time for rhetorical questions:Anybody else not see the lack of logic here? MS has two crypto implementations? One for the OS, one for the API? Why the redundancy? Why cant the OS use the API? Or conversely, why is the API necessary when there's the services are in the OS?
How in the world is IE the only app affected? It seems more to logical to assume that any app using this crypto services are also vulnerable.
The One Rule Of Chess You'll Ever Need: Don't play someone who carries a kit in their bookbag.
You know what? I bet the 'soft could do this too. I mean have a guy, or team of guys available 24/7 to patch bugs. And you know what else? They'd still get flack for it, as Microsoft don't release patches straight away - for better or for worse, they do actually test them first (usually), make sure they don't kill wierd and exotic installs etc. I know they've released dodgy patches, but my point is that Microsoft isn't an overnight operation.
And more to the point, how does this patch get to people? Via autoupdate of course. The patch may have been written in 40 minutes, but it's still not available on SuSE auto update (as far as I can tell) despite the fact that Waldo works for SuSE! We really need to stop patting ourselves on the back simply because we can see the progress of the patch and Microsofters can't, otherwise this bullheaded arrogance WILL bite us on the ass.
90 minutes????? What are the KDE boys doing, sleeping???
This is just unacceptable. I cannot believe and refuse to accept that it could take 90 minutes to get a major security fix out for a browser. This is completely unacceptable. It's no wonder everyone uses IE.
I guess the Microsofties were right after all. Support for open source software is nearly impossible to find.
-- Before you post, are you sure you got it?
...indeed.
Thank's for those memos, Bill.
Howard Dean for president
Sweet time? Indeed, saying that the Konquerer team fixed it in 90 minutes makes them sound very irresponsible, not proactive : Every change like that can have hundreds of ramifications, and I assure you that there is a programmer at Microsoft who could point to a particular segment of code and say "There, we just need to change that line right there". But after several high profile incidents where someone did a change and it broke a dozen large applications, they seem to be a lot more weary about that nowadays. Working in software development, I've seen many situations in large systems where someone wanted to rush out an incompletely thought out feature or fix and the net result was disaster.
Microsoft officials said it makes sense for the operating system to provide cryptographic services to any application that needs it, instead of each application having to include its own cryptographic technology
Yes, indeed, it does make sense for the OS to provide such a service to any program that wants to use it, so long as that's a GOOD service.
In general, it makes sense to provide everything from outside the program, and just have the program call on outside services. However, that means you need to make the outside services good, and it means that those writing programs don't just string together a bunch of requests (i.e., draw this, check that calls) but also work on looking for fixes to the common outside service, which would be shared by many programs.
In other words, this approach only makes sense when the outside services are OSS / FS / public domain, which means that developers of programs can check their integrity and submit improvements. Otherwise, its just a big black hole for developers: should I trust this cryptographic routine, or shouldn't I? One never knows with proprietary routines. One can check, and improve such routines provided OSS / FS.
social sciences can never use experience to verify their statemen
The BugTraq post describes the nature of a MOTM exploit using this vulnerability.
A BugTraq reader was able to successfully demonstrate this using dsniff and OpenSSL as his tool kit. Screenshots on his site illustrate this, with his own bank account!
"Flyin' in just a sweet place,
Never been known to fail..."
This is a pretty important point. Just because the KDE people fixed it doesn't mean everyone will have it. Instead of asking, "How long did it take for it to get fixed", we should be asking, "How long until it is widely enough deployed such that exploit writing becomes unprofitable?" It seems to me that even if Microsoft is a little slower getting a bug fixed, the universal "Windows Update" probably gets the patch on a greater percentage of machines more quickly.
;-)
Of course, the number of Windows desktops dwarfs the number of KDE desktops so if even a small percentage of Windows installations don't get patched, it would probably be about the same as if KDE never got patched at all.
In Soviet Russia, hot grits put YOU down THEIR pants.
From the article:
They're perfectly right. Everybody can have a bug like this. But there are two problems that puzzle me:
I really fear the time where users have to choose to either install a patch so fix a severe security hole and sell their (OS and computer data) souls to somebody else or just not fix their OS at all and be open to these man-in-the-middle attacks. This could become a very new quality of unsecured machines from a security point on the 'net: Users that don't want to install patches because they don't want Microsoft to own their machines - and trade this with security. (I can fully understand this.)
With Open Source OSes, if the vendor won't fix a bug like this, somebody else would (maybe even you). With Windows, you have to rely on Microsoft even recognizing something as a bug. And if they do, there's nothing you can do but wait.
Yes, I know, we all know this. But this problem hasn't gone away yet.
42. Easy. What is 32 + 8 + 2?
Anybody else not see the lack of logic here? MS has two crypto implementations? One for the OS, one for the API? Why the redundancy?
The logic is so obviously simple:
increased redundancy == increased failsafety
So, if one of the crypto API's has a security hole, the OS can rely on the backup API, just like how a bike with one flat tire can be ridden home on the remaining good tire.
I tell you, those MS guys really got some effective circumetry in their noggins!
pi = 3.141592653589793helpimtrappedinauniversefactory7
Yeah, but it makes it harder to write portable applications.
Surprise, surprise...
(In this case, the article mentions that Internet Explorer is nearly the only application to use these OS functions at all. But the concept is clear - Put more convenient functions into an OS so that vendors won't write them on their own. The resulting product is then bound to this single OS - if the vendor doesn't want to pay more to his programmers to re-program all this code. Most won't, after they've start selling the product. And: This will artifically make porting a product to another OS seem more expensive.)
42. Easy. What is 32 + 8 + 2?
"Then can you explain why Microsoft releases bugfixes that uhhm break stuff?"
Despite your glaring lack of maturity in the above sentence, I figured I would respond.
Microsoft software (Windows/Office/Internet Explorer or any combination of the above) runs on approximately 95 out of every 100 client computers on the Internet. Now, on those computers, you have every piece of weird x86 hardware ever invented, from crappy $5 ISA modems to $5,000 SCSI RAID arrays. You also have Microsoft software that runs on Macintosh, Solaris, HP-UX and FreeBSD computers.
Now, figure that Linux runs on approximately 1 out of every 100 client computers on the Internet. (This is a high guess -- I'm giving Linux the benefit of the doubt here.) Now assume that KDE runs on 100% of those computers (also an extremely high guess.) So for every 1 person who receives the KDE fix, there will be about 92 (I'm taking out the non-Windows, non-Linux users) people who receive the Microsoft fix.
Considering that there are hundreds of millions of people on the Internet, and hundreds of BILLIONS of different hardware configurations, the chance that a Microsoft fix will break something is much higher than the chance that a KDE fix will break something.
"Ever heard of Debian's apt-get, Mandrake's urpmi, RedHat's up2date, etc.? It's up to each vendor to make the fix available to the users."
Oh, I love these arguments. It's funny how most people who run Linux don't trust their vendor enough to release patches in a timely manner, and actually whine about fixes being easy to get. "But I run Linux so I can do everything myself!"
I run about 12 Linux servers. I trust my vendors (Red Hat and Sun Cobalt in this instance) to provide me with timely updates. But the funny thing is that whenever I recommend that people trust their vendor for services like Apache or PHP and use up2date, I get laughed at. In fact, when I say that I use Red Hat and Sun Cobalt, I get laughed at. "Why not just compile everything yourself? Why not just use Debian?" Well, guess what, ladies and gentlemen -- I run a profitable business off of my servers and I don't have time to sit on SecurityFocus all day and make sure I'm not affected by the myriad set of would-be bugs on my servers. I trust my vendor to test the updates on their set of supported hardware and release them to me in a timely manner. I will then run the vendor-supported update tool and download them.
The people I see who are the most rabid advocates of open source are also the most rabid advocates of doing everything themselves -- the epitome of the "trust no one" saying. These are the SAME people, much like yourself, who also say that it's up to the vendor to release patches. I have news for you. You either need to trust your vendor to provide patches, or you need to realize that in the real world, not everyone has time to make a test bed and test that every CVS patch works the way it is claimed to. You can't bash Microsoft for taking time to release tested updates and then claim that Linux is better because you can install a fix that is untested instead of "waiting for the vendor to catch up".
Yeah, it was for a problem in the Network Manager. Of course, since this was the big 'sploit of the week, you and 2short seem to have mistaken the patch for something that it's not. This morning's patch description
ALL HAIL BRAK!!!
It's sad to say, but given all those unpatched bugs in Internet Explorer, this flaw is a minor issue. Why bother with DNS Spoofing etc., when you just can install and start any executable you want on your victim's computer?
It's funny that Microsoft always comments publicly on the minor bugs, but ignores the serious ones, just until they release a patch.
How many people out there are REAL Windows Admins? Seriously? I bet not that many are true windows admins. Using windows does not qualify you as an admin. I'll admit I'm very weak on my nix admin but that's because I don't bother learning about it. In my mind Windows 2k can be just as good an OS. I bet many of you don't know that Microsoft's knowledge base acutally keeps track of all it's bugs and patches for them before they stick it on Windows Update for the rest of the masses. I bet many of you don't know that microsoft has a tool called hfnetchk ... what does it do?.. It'll download the LATEST patches that microsoft has available for you to use. It'll check your system to see what patches are installed and what aren't and give you a report telling you which article # in MS knowledge base you can find the patch for you problem. More tools you want?... How about Qchain... (which i know many of you don't know about either) that lets the user install multiple patches WITHOUT rebooting your system multiple times. For IIS Windows has IISlockd .. which many wanna-be admins didn't bother finding out during the time when nimda worms were going crazy. And the list goes on I can easily list pages worth of other tools that windows has that most people don't know about because they're ignorant. If anything I'd say windows has done a wonderful job by making people lazy.
But let's take a step back. I bet many of you are saying pfft the Nix machines have this and that tool. Think about that for a moment.. why would a multibillion dollar corporation, who have a million times more resources then the average linux programmer, not bother to make a similar tool for windows if it's so useful? Kinda defies logic doesn't it especially since nowadays with IBM's backing of linux MS needs to compete performance and feature wise even more (or are you going to tell me that MS has a stranglehold on IBM?).
So before anyone else goes on with the typical. . "wat you expect form MS"
read up about what MS really has and acutally maintain an intellectual conversation