Slashdot Mirror
Another Critical Microsoft Hole
gmuslera writes "Not was enough that recent vulnerability in IE that can run any program in an unpatched windows system. Now there is another
related to an ActiveX control that can make IE and IIS to run any code in the system. The Microsoft solution? kill the related ActiveX control and replace it with a safe one. The Microsoft problem? As this control is Microsoft signed, any site can require it, upload it and replace the "good" one with the vulnerable one. The final recomendation from Microsoft? Don't trust/run ActiveX controls signed by Microsoft." Gimble points to the appropriate locations on Microsoft's website: "Another buffer overrun (that allows arbitrary code to be run) has been admitted to by MS, and it affects IIS and IE on clients (but not on XP), and they have a patch available here Security Hotfix for Q329414. The kicker is that a patched system can be rendered vulnerable again by a hostile web site or HTML email. The 'solution' from MS in Microsoft Security Bulletin MS02-065 recommends that you remove MS from the list of Trusted Publishers."
"can make IE and IIS to run any code in the system"
Noooooo!
Minesweeper WON'T stop coming up!
--This girl at the library the other day
Why doesn't Microsoft wake up and just apply the "mozilla patch"? :^)
Slackware forever. Honestly, what else would you trust when it absolutely positively has to be stable, secure, and easy
``Don't trust Microsoft'' is just a good security principle in general. Finally they realize it. :-)
Hey, good thing that little bird told me to never check the box that says "Always trust content by Microsoft Corporation"
It's getting tiring to see all this sarcasm, like open source is so free of bugs or something...
Doesn't this just make you excited for the prospect of Palladium and a world where all code is digitally signed? I'm tingling all over.
I'm all for code signing for authenticity, but not for code signing as execution control. Code signing should be purely an audit mechanism.
The solution from the page linked is to install MDAC 2.7. There is no mention of removing MS from the trusted list.
It truly hurts me each time they put out a new patch. As I am addicted to microsoft, each patch seems to not help as much as the one before. I'm feeling like a smoker now trying to quit.
Not was enough that recent vulnerability in IE that can run any program in an unpatched windows system.
Difficult to read this post is, hmmm?
microsoft has never been a trusted partner in my mind....or on my computer
Wheres the slashdot article on the whole "leaked longhorn alpha" deal? I have 2 different releases, and it still hasnt been an article here at /.
This must be the most utterly humiliating admission I have ever read. The fact that it comes in the context of a security problem beggars belief.
Reality is defined by the maddest person in the room
Microsoft's new security initiative announced that a 100% secure Operating System Platform (tm) is possible. And it's very simple too: Don't trust Microsoft. Don't buy Microsoft Products. Don't talk about Microsoft. Don't look in any direction.
We knew that already...
The final recomendation from Microsoft? Don't trust/run ActiveX controls signed by Microsoft.
The 'solution' from MS in Microsoft Security Bulletin MS02-065 recommends that you remove MS from the list of Trusted Publishers.
Will Do!
Interestingly, that page doesn't render properly in Opera 7 Beta unless you identify as MSIE - when it works fine.
The 'solution' from MS in Microsoft Security Bulletin MS02-065 recommends that you remove MS from the list of Trusted Publishers."
...at last we can all agree about something!
Can we please stop all this MS bashing? Every piece of software has security alerts and patches issued. Why, in a week where we have alerts for Samba, php, kde (libs and network) and apache, do we have to hear about IE yet again? Yes, we know thats its not a secure bit of software. It just makes us look like insecure teenagers if we keep bashing it like this.
*flame retardent jacket on*
That is all.
They keep attaining hole records all the time. It just makes me wonder.
---
When you come to a fork in the road, take it! --Yogi Berra--
The 'solution' from MS in Microsoft Security Bulletin MS02-065 recommends that you remove MS from the list of Trusted Publishers."
Am I the only one who finds this uproariously funny...?
Micro$oft wants us not to trust it. Not that this will be a problem in many cases, but... Maybe if we applied this more generally the world would be a nicer and safer place?
"Now listen to me very closely, because I have the answer for your problems. The way to fix your troubles is to not trust me..."
Catch-22, eh? The company that's giving you the solution is also telling to that they're not to be trusted. I don't care WHAT company that comes from, it's funny...
Why can't IE run in a process with reduced privaliges? Why does IE need the privalages of the current user on NT/2000 when all it does is browse the web?
Wow. Some heads must be rolling at Microsoft over this. Recommending that Microsoft be removed from the list of trusted signees? They're certainly not pulling punches on this one. It looks to me like they're placing a higher priority (with the treatment of this bug) on user security than company image. That's a first...
The reason they're in this mess is the whole "trusted computing" paradigm which they started with this signed-ActiveX stuff and are continuing with Palladium. Perhaps this will make them reconsider. Quis custodiet ipsos custodes: Who watches the watchers?
I never though I would see Microsoft telling us NOT to check the box:
"Always trust content from Microsoft Corporation"
I guess with the next version of IE they will be changing it to:
"Never trust content from Microsoft Corporation"
Now that's the kind of checkbox I'm talking about.
-S
We Apprentice Developers and Designers
All you linux freaks should pay attention - here is Microsoft issuing some very timely and correct advice.
"Don't trust us"
Once more unto the breach, dear friends, once more, Or close the wall up with our American dead!
As this control is Microsoft signed...
Trusted computing, digital signing... I guess it all boils down to "You can trust Microsoft that this signed control will screw over your computer."
Outdoor digital photography, mostly in New Engl
"I knew we shouldn't have enabled Active X in my rocket..." --John Carmack
The final recomendation from Microsoft? Don't trust/run ActiveX controls signed by Microsoft.
Ah excellent, for years I never trusted anything from Microsoft but now I can just distrust their signed ActiveX crud.
Trolling is a art,
Reproduced for your enjoyment:
What steps could I follow to prevent the control from being silently re-introduced onto my system?
The simplest way is to make sure you have no trusted publishers, including Microsoft. If you do that, any attempt by either a web page or an HTML mail to download an ActiveX control will generate a warning message. Here's how to empty the Trusted Publishers list:
1. In Internet Explorer, choose Tools, then Internet Options.
2. Select the Content tab. In the Certificates section of the page, click on Publishers.
3. In the Certificates dialog, click on the Trusted Publishers tab.
4. For each certificate in the list, click on the certificate and then select Remove. Confirm that you want to remove the entry.
5. When you've removed all entries from the list, select Close to close the Certificates dialog, then click on OK to close the Internet Options dialog.
"The 'solution' from MS in Microsoft Security Bulletin MS02-065 recommends that you remove MS from the list of Trusted Publishers."
That is solid GOLD.
It is poetic justice that Microsoft's own measures for security are working against them.
(/local/home/curiosity)-#who -u|grep thecat|cut -c 44-49|xargs kill -9
Already done, a long long time ago........
I didn't want them running anything they happened to sign on my PC.
Ok, I don't run windows at home any more, unless I need it for reverse engineering drivers or file formats.
thank God the internet isn't a human right.
If my Linux box wasn't kept up to date, there would be quite a few remote root exploits similar to this.
Today the DOJ announced that they would no longer trust Microsoft and had removed Microsoft from the list of companies it would allow to police themselves. This was done on Microsoft's advice as they felt they could not be trusted not to screw around like they had before.
"Lets face it" said Bill Gates "asking us to police ourselves is like asking Dan Quayle to front a literacy program, its just not a good idea"
An Eye for an Eye will make the whole world blind - Gandhi
Right about now, Bill Gates is asking himself why in the world he paid millions for that "security approval" thing for Windows 2000 and wasted all of those marketing dollars in the over-hyped (and non-existent) "we make all of our programmers go to security school or something" campaign.
If Microsoft tells users not to trust it for this, when should users trust it?
The joke is to say never. But with Microsoft controlling however many trillions of computers, it seems like something they should seriously be addressing. And more seriously than they are.
is that some kind of Leisure Suit Larry thing?
I also don't trust software i write, why should MS do different? I mean you can't say elseway " The programmer was a moron" and keep the pride
Lone Gunmen crew.
Damn, when I saw this there were no coments listed, I thought I might be able to post 'first yawn'.
I mean, how is _another_ IE flaw even news anymore...
Ironically, I probably missed is cuz I was opening my morning comics in other (mozilla) tabs...
If you have bad controls, patch it. If you have security issues, patch it. The whole of their operating system is becomeing one giant windows update...
The real pain is that people that have used Windows Update often will have checked "Always trust content from Microsoft", otherwise they will have RSI by now from clicking Yes.
Dammit, all news about security issues with microsoft products should be rated reduntant... I know I'm losing interest by now... There's just a limit to how often you can get amazed by a new security hole in the same company's products. :P
------- I fumbled my registration and I now must suffer
i don't know if it's a innocents week (days) but it's funny to hear microso~1 saying "don't trust our software and either our company"
that's what i'd like to expect from my supplier XD
hahaha
i couldn't help XD
pd: what about making a 100 things that you shouln't expect to hear from microso~1?
...who can I trust?
alias uptime="echo '5:33pm up 22342352324 days, 6:28, 2124315623 users, load average: 2432.40, 12312.31, 123123.19'"
So I guess this means they'll be discontinuing the windows updates program as it tries (or used to) load an Active X componenet signed by M$.
I didn't beleve this was true at first but this is actually what it says in the Security Bulletin:
--
What steps could I follow to prevent the control from being silently re-introduced onto my system?
The simplest way is to make sure you have no trusted publishers, including Microsoft.
--
According to the MSTECH bulletin:
Why isn't it feasible to set the Kill Bit in this case?
The ActiveX control involved in these vulnerabilities is used in many applications and web pages to access data. Many applications, including third-party applications, contain hard-coded references to it; if the patch set the Kill Bit, the web pages would no longer function at all - even with the new, corrected version. As a result, the patch updates the control to remove the vulnerabilities, but does not provide a brand-new control and set the Kill Bit on the old one.
Conclusion:
-Microsoft refuses to kill itself.
how does this relate to: the story Microsoft on Security: We'll Break Your Apps
Hey... linus refused to change the behaviour of kill -9 -1 also
but I think Microsoft is doing the right thing here. They are in a pickle and they have given a good solution (and one that is embarrasing to them). Of course what they should really do is redesign IE to not run in "root" mode but that is another story. I wish the slashdot editors did not relish so much the foibles of Microsoft in their editorial comments.
I miss the Karma Whores.
As of 10:01am EST, the microsoft update website displayes the message "SERVICE UNAVAILABLE". Oh the irony of it all...
I can no longer read Dilbert. It's too depressing, because it is too real. -- Hyperhaplo
...that the only safe place to run a Microsoft browser is on an Apple Computer operating system.
How is it that they implemented a cryptographic signature system and don't provide for revocation? Surely somebody's missed something here...
25% Funny, 25% Insightful, 25% Informative, 25% Troll
People don't move to something because, firstly it's something different and many people are happy to stick with something comfortable. Secondly many people don't see the point in downloading something that they already have installed ("it works for me, why do I need anything else?" mentality) and finally, for many people they never experience the nasty possible ill-effects of these security alerts.
Sure, plenty of people were hit by Code Red but it never really affected them. Sure it affected their computer, but as far as their documents were concerned - there was no change.
Until we see a security alert that does cause damage to personal files and does roam rampant in the wild, the average Joe Blow user doesn't give a toss whether or not there 6 or 6000 security alerts.
Avantslash - View Slashdot cleanly on your mobile phone.
/me chucks Windows Update out the window...
Insert Sig Here
microsoft announced that their public keys had been stolen?
(i cannot remember my slashdot password.. haha)
I'm no M$ fan, but I deal with it at work so I make a point at figuring out how to deal with the problems. Frankly, this isn't a suprise. The most well secured enterprises I've seen allow only internal ActiveX publishers -- ActiveX is just too hard to make safe.
.NET Framework Security -- anyway, it seems like Microsoft is at least attempting to solve this particular problem. And, their approach isn't completely idiotic. Really.
.NET common language runtime (read: M$ JVM) is controlled by a fairly sophisticated access control system. The default policy in XPsp1 from M$ allows no code from the Internet to execute, at all. Not exactly what I want as a user, but its what I want as an admin...
.NET mobile code without also enabling ActiveX controls. Not sure what the issue there is, but I suspect the CLR loader is some sort of ActiveX control. Anyone know about that?
.NET: Enforce Code Access Rights... .NET Framework
Looking forward, I recently picked up
Mobile code that runs in the
Frustratingly, you can't run
Anyway... here's some additional links to M$ references on mobile code:
Security in
Security in the
"He wrested the world's whereabouts from the heavens And locked the secret in a pocketwatch." - Dava Sobel
In the bulletin, Microsoft tells you to not trust it. But windows update, where I guess you have to go to fix the problem, says to click yes to install everything signed by microsoft. so?
Microsoft has been trying to make the same buggy code work for a few years now. When will the start over? I think the do alot right, but they do not to think a little more about security and change there code. Microsoft is so big that I bet there is not one team there that knows what all is in the kernel. That is wrong! I am no programer but I do know a few. I know they tell me they hate fallowing some ones undocumented buggy code becouse they can never figure out all the problam. This has changed in the open source comunity becouse of all the per review and support. I wonder why, with all of its vast billions, Micosoft can not come up with a better system. For now on all my systems that store stuff that is importaint I will just keep using *BSD and linux.
If you'd bothered to read the article, you'd see that the ``patch'' consists of a nonvulnerable ActiveX control. The problem is that the old control has been signed by Microsoft, so it's considered safe by default in IE. Unless you turn that off, I can create a website that uses the old control, and your browser will upload it. It would seem that either there is no fix, or Microsoft must change their signature so that all controls are void. Either way, it's another good reason to not use IE.
The solution is to upgrade to Windows XP because it doesn't have this problem. This is the best news Microsoft has had in years!
The 'solution' from MS in Microsoft Security Bulletin MS02-065 recommends that you remove MS from the list of Trusted Publishers.
Yes, I had better remove security.microsoft.com from my apt sources.list as quickly as possible.
Doesn't anyone consider this a mysterly convenient way to incourage the masses of windows users who won't drop them to move over to XP? All the news sources highlight that XP isn't vunerable.. yeah.. not with THIS flaw. I wondered how long it would be before they started admitting the really bad flaws in all the other versions to move everyone towards their .net mordern os. hmph
or maybe I'm just nervous 'cause my coffee just accidently cross bred with a poison-ivy staph-infection vaccine GE plant and was recalled after I drank it
pm
** "It's not my job to stand between the people talking to me, and the ones listening to me." -- Pego the Jerk
You gotta admit, though, that it's funny as hell that MS recommends that MS be removed from the trusted list.
Here's a URL for you, even...
MDAC 2.7 Refresh
Keeping Windows secure is hard, but it's easier if you install the recent components...
According to the MS release, the reason that they can't simply revoke the certificate for the control is that they signed other controls with the same certificate.
Wouldn't it make sense for them to just sign every control with a DIFFERENT certificate, so when one is found to be flawed they can revoke the cert and only the new version will install easily?
It's not like MS can't afford the cost of the individual certs, if they aren't a CA themselves already...
*inserting vulnerable forced activex code here*
*execute WMP, forced to update to DRM*
*blinding laser from BillBorg "from this time forward, you will service us."*
I thought we were all critical Microsoft 'holes.
Oh.... I misread it....
J.
This space for rent.
Because without passive-aggressive complaining about Microsoft we'd have nothing to talk about. The whole approach that Slashdot takes on Microsoft with is not helping the common cause.
Like the story about X-Box mods being banned. Blizzard does the same thing with Diablo and Warcraft hackers as it is a very good idea, so no need to heap on the accusatory tone.
This reminds me of two things: the criticism of Dilbert that it makes workers more content to whine than change the system, and the lament by CmdrTaco about childish anti-Microsoft tactics, framed nicely against the Slashdot topic icon for Microsoft.
So Microsoft says to not trust them. Ok, I will not trust. But then I don't believe in this request. So I should trust MS. Ok, I'll trust'em. But then the request is true, and I should not trust...
Prescriptive grammar:linguistics
While researching the article linked below, I developed the impression that Microsoft has for years allowed its programmers to submit sloppy code. Now bugs are not easily found or fixed because everything is a mess.
Windows XP Shows the Direction Microsoft is Going.
Here's a theory I've long held regarding the excessive number of buffer overrun security holes in MS software:
The lack of an snprintf method in the DevStudio standard C lib causes MS developers to use the unbounded sprintf instead, potentially resulting in buffer overruns.
What do you think?
I'm interested in seeing any other browser that can provide robust, arbitrary plug-in support without a security compromise.
Security and utility are two contestants in a zero-sum game.
Which is not to say that <insert browser here> isn't a technically superior product...
Get thee glass eyes, and, like a scurvy politician, seem to see things thou dost not.--King Lear
From MS02-065:
So, who want to bet that the e-mails we will soon see circulating will have something like:
From: billg@microsoft.com
Subject: You can safely trust me
<html><body> Please read this e-mail carefully and make sure you download the provided control.
Asking people to decide whether or not they trust somebody based on, uh, well, whatever, that's asking for disaster. People will do that based on what they see in the From-field, most likely...
Well, admittedly, I haven't touched a windows machine in a long time, so I might be totally off here... :-)
Employee of Inrupt, Project Release Manager and Community Manager for Solid
...you could run it on Solaris too.
Somewhere in the heavens... they are waiting.
I don't know if I'm karma whoring, but this last security hole gives me the creeps. In all honestly, I kinda ignored them up until now -- I don't know why, but I think it was because "they" could not delete my data (nothing scares me more than losing my documents (read: not "My Documents"). This security hole that allows people to "format my hard disk" (quote from the original /. article that I cannot be bothered to find) has me burning My Documents to CD-RW which I'm going to (finally) migrate to my Linux laptop which I previously used only for programming.
I know we've seen a million security problems from MS before, but this one (for me at least) is the last straw.
best... article... ever
Intelligent Life on Earth
Microsoft was never on my list of trusted publishers!
(Actually, that list would have 0 entries, thankyouverymuch...)
What if I deactivate ActiveX controls to avoid this one to be operated ?
Trolling using another account since 2005.
Microsoft has just said "Don't Trust Signed Code from Microsoft".. what about all those poor saps who clicked "Always trust code from Microsoft"?
-- All That's Evil in the Geek Space
it's ?easy to see? why the billybuks weNT up 2 buks at the opening tick. or is it? does the payper liesense FraUD eXtend to the pourtolls of wall street of deceit?
will J.'s impending knowledge that the evile m$bugwear is worthless, cause fuddles to have to manipulate the "news"/markups, even more? then, will J. BUY into the same old billonlyUS scams? i DOWt it.
looks LIEk fud is dead/on the run. long live the hobbyist whiner dogooders.
Microsoft Security Bulletin MS-666: it is recommended that you remove microsoft windows in order to prevent the above mentioned vulnerability from accessing your server. there is no security hotfix available at this time.
I must finally be way ahead of the curve on not trusting M$ as I have not trusted them since the beta release of WinNT 3.51 and the first release of Visual C++. I went completely over to UNIX at that point and eventually included FreeBSD, and now Linux because of Billy's lame assed products. Any M$ box I have is company provided and is used strictly for email, not productivity or development.
This isn't nearly as bad as the poster is trying to make it look. Microsoft is not by default in the list of "Trusted Publishers". The default configuration is that no one is trusted, and a dialog box pops up to warn that something is being installed.
These kinds of dialogs pop up all the time when surfing questionable sites (warez, cracks, pr0n, etc.) and most users know to click No on these. Just because it says "Signed by Microsoft" on the pop up at the cracks site, are you going to go ahead and click Yes? I sure wouldn't...
Carpe Cerevisi - Seize the Beer
The folks that are out there converting people to free software are the people that read slashdot. Keeping the slashdot crowd informed of the latest security holes in Windows, Microsoft's most recent snafu, and the best new open source project allows Slashdot readers to spead the word more effectivly. New information and new arguments are key.
Perhaps it's the same exploits mentioned in the linked Slashdot article, and in that case pardon my ignorance. If not, I haven't seen these nine security holes talked about at too many places. Why I don't know. They are certainly vicious.
However, I am getting a little tired at all the MS bashing on Slashdot. It has been said before, but do we really need to have a story posted each time an Outlook/Explorer security breach, no matter how insignificant, is made public?
"If you think education is expensive, try ignorance" - Derek Bok
Slackware forever. Honestly, what else would you trust when it absolutely positively has to be stable, secure, and easy
BSD?
Your credit card information wants to be free.
If this doesn't affect XP, why can't Microsoft just issue a patch that installs the Windows XP components which aren't vulnerable? And also... why the hell isn't XP vulnerable? maybe they knew about this for a long time...
I've acually thought that MS would buy out Connectix just as a bargaining chip against Jobs (apple).
OT - Why would Connectix *not* make a Virtual PC for Linux? Do they have a deal with MS? It seems to me that they could rake in the dough, hand over fist.
Virtual PC is great for 'trying out' untrusted software. It's too bad that Windows itself now fits that catagory. Run with it Bill!
Since probably a million people submitted this, maybe we could pick the post that actually doesn't read like an entry from the Yoda diaries?
brain hurt make!
Apologies if the poster suffers from dysphasia.
I am not a number! I am a man! And don't you
"The simplest way is to make sure you have no trusted publishers, including Microsoft."
So OK. If this signed certificates thing was a good idea to begin with, why are they suggesting people remove ALL trusted publishers?
It's only Microsoft's own certificate that can reintroduce the problem. Why would they advise removing all certificates?
Is it because they think their users are too stupid to remove Microsoft only? Are they trying to look less bad by making it look like the problem effects all publishers? Or are they simply admitting that this signed certificate thing isn't working?
Oh, if we can't run anything we want on your system, nobody else should either. pfft.
oktay
---------------
Founder of the The Free Linux CD Project
Hello, today when browsing the site, I found an error (probably typographical) on the site. I would appreciate it if you could correct this: The story "Another Critical Microsoft Hole" should be reposted under the "It's Funny. Laugh." category. Thank you for your time.
make sure that when you are prompted to accept a certificate from Microsoft, make sure you don't have a check in the box "always trust content from Microsoft".
ahh yes, another flaw in the ointment that every day users will never hear about, bring on tcpa, then you can wipe machines even easier.
as shitty as paladium would be, do you even think it will be programmed??? M$ is starting to look like IBM of days gone bye.
bring on the blackcomb warp server.
"You never want a serious crisis to go to waste." - Rahm Emanuel
Honestly, folks: M$ is buggy closed source in wide usage - making it somewhat of a security risk. OSS is buggy open source with less risk.
M$ IE has backdoors, the sky is blue and water is wet. Picking at it won't make you look so much cooler. Trust me.
I sure am glad I use linux.
I kinda feel sorry for the uninitiatied masses who will never find out about all this till someone malicous person reformats their hard drive from half-way around the world.
Wow, I could say something on Microsoft's shody workmenship or their testing and debugging strategies, but I think the best have already been said. It's almost as if they aren't even trying anymore. *sigh*
Love and Peace,
Valen
"The best compliment a girl ever gave me was 'Your hair smells nice.' I hate being the platonic friend." -Valen
I've got a tool to fill in holes. Is Microsoft hiring?
How ya like dat?
really, really, hate to be the poor sap who is lead of IE software development. I mean talk about bad publicity - IE has really taken a beating of late, and I am willing to bet that probably none of it was stuff he was responsible for.
He was probably told "go make activeX on the browser tie in seamlessly with our applications", did what they asked, and boom, all these vulnerabilities.
As far as I know, Microsoft doesn't have a policy of hiring bad programmers - in fact there are many web pages out there discussing Microsoft interview questions and how tough they are.
For some reason these stories seem extremely popular on slashdot, becuase it seems that everyone here hates microsoft.
For years Microsoft has ignored consumers/bug reports, customer service, etc. because they were invulnerable. Unfortunately, what goes around comes around.
Lets not go overboard on this stuff, lest the same thing happen to us - remember - open source does NOT mean bug free.
1. Open Control Panel.
2. Select Add/Remove programs.
3. Select Microsoft Internet Explorer.
4. Select Add/Remove...
5. Download Mozilla.
6. Run the mozilla installer.
Ascalante: Your bride is over 3,000 years old.
Kull: She told me she was 19!
what can ActiveX do that JAVA can't, besides being tied down to the windows platform?
'nuff said
It's all Eolas' fault :)
If you can't trust Microsoft, then who can you trust?
I bet that they'll have to update their Windows Update page Knowledge Base Article to reflect their new Trust issues.
---- The geek shall inherit the Earth.
If its a bug in MS code....
... u are doing Bill and company big favors.
I would NOT go to
1. www.symantec.com
2. www.cert.org
3. itsecurity.com
not even www.microsoft.com
Coz slashdot.org has become the leading provider of MS windows security info.
thx guyz
In my office it is just recommended the Microsoft is removed.
Service Unavailable.
Interesting indeed. Did Windows Update get Slashdotted?
"Alcohol, Tobacco, & Firearms" should be a convenience store, not a government agency.
http://www.mozilla.org
hahahahahahahahh this is so funny. "Microsoft's solution is to remove Microsoft from the list of trusted vendors on your system." HAHAHAHAHAH
What we have here is a clear case of people letting their ideology interfere with their business sense. Ideology / religion seems to be the only reason anyone would not go right over to better products like Opera or Mozilla. The only value MSIE can add, beside keeping the AV and security consultants in gravy, is vendor lock in.
Microsoft is falling further behind in technology every month. Rather than trying to catch up, they've been trying to hold everyone else back. It's time for them to get out of the way and stop hindering economic growth in the IT sector.
Beta is broken and the link to classic doesn't work. Stop wasting our time or there won't be anybody left here.
Interesting- seems like they're telling you to remove all certificates, not just those from Microsoft.
-- If god wanted me to have a sig, he'd have given me a sense of humor.
I don't think the question revolves around whether open-source or closed-source is better or worse. Honestly, they both have their pros and cons. As for this issue, ActiveX Controls were a good way (way back when) to get a rich feature set onto a web-browser. But eventually it was realized you needed some security around this, so they started to digitally sign them, now it seems this might have a hiccup in this logic as well. So what's the real answer? How do I get a rich feature set to the web without running anything local (the most secure way)? When you really start to understand the challenge you understand how difficult the problem is. Think about it: people who don't download ActiveX controls also are the same people who download MODs to their favorite games and those dlls don't have to play in a small sandbox! I think people are accustomed to lots of snazzle with their web pages and we, as technical folks, should find a way to do that securely. Good luck.
"This isn't a study in computer science, its a study in human behavior"
Yes.
Don't trust/run ActiveX controls signed by Microsoft.
... been there, done that, got the t-shirt! :)
recommends that you remove MS from the list of Trusted Publishers.
Beware of Programmers who carry screwdrivers. -- Leonard Brandwein
I removed MS from my list of trusted publishers a long, long time ago. (Translation: I switched to Linux a long, long time ago.)
The probability that someone is watching you is directly proportional to the stupidity of your actions.
Oops, that one was "Favorite Past Slashdot Headline", not "Funniest Slashdot Headline".
Why all the focus on microsoft products, I submitted an exploit for opera a month or so ago, and it was rejected.
autopr0n is like, down and stuff.
Aberdeen Research Group has this to say about open source and Linux security:
Open Source and Linux: 2002 Poster Children for Security Problems
November 12, 2002
Open source software is now the major source of elevated security vulnerabilities for IT buyers. Security advisories from Cert for the first 10 months of 2002 show that open source and Linux software accounted for more than half of all advisories. The poster child for security glitches is no longer Microsoft; this label now belongs to open source and Linux software suppliers.
Read more here
windows update wouldn't work if the browser ran in a sandbox, it needs full access to the computer to patch the kernel, etc.
josh
so, is there a translation from broken/bad English to English
I second that emotion. But many people that see that pop-up will go ahead and say yes.
but I think Microsoft is doing the right thing here. They are in a pickle and they have given a good solution
I've seen this said several times now, how Microsoft's solution is a good one, but I can't accept that claim.
A good solution is one I can apply to my Mother's home PC and feel confident that the problem will stay solved. If I have to explain to her that she should never "trust Microsoft", the Windows UI is broken.
Yes, she can remember this rule, but she shouldn't have to. As other people occasionally use her computer, she would also have to explain the rule to them, or learn to go through the process of regularly checking that nobody has added any trusted certificates to her computer.
Is that reasonable? For a home computer?
If you say, "now I'll be modded down because of X", I'll happily oblige.
ok, so Microsoft says "You can't trust us".
Anybody see that this resembles the following situation:
"I am a pathological liar,
Everything I say is a lie,
you can trust me on this."
Now what are ya gonna believe??
About as 'amazed' as I get when I read about a train accident or a tornado ripping through a mobile home park. But still I read. Morbid curiousity???
Change the IE "Internet" zone security settings so that ActiveX and Java and everything else is disabled. Then add to the "Trusted sites" the few sites that you go to that require it. When you find a site that isnt functioning (or you get that damn ActiveX warning) and you think its a commercial reputable site, add it to trusted. This will stop 90% of all of these kinds of bugs WITHOUT a patch.
Re enable the runas service (it's on by default). Now try right clicking an exe with the shift button held down. See that "Run As..." menu item? Click it, now the program will run with alternate use privledge. Welcome to NT... What I want to know is why 99% of the fscking setup programs need to run as admin to install simple little applets into my user context..
What better way for the US Gov to get some spyware into all M$ installations, than to have M$ issue a major warning like this. I'm sure they're considering using M$'s monopoly to exploit eavesdropping on some of Al Qaeda's employees.
--note to self--
Consider buying stock in proposed Hades Ski and Ice Skating resort... it must be getting real cold down there about now, somewhere between slushy and completely frozen over.
...Open Source isn't the only answer -- but it's almost always a better value than the alternatives...
:P
So, to fix this particular little problem needs a hardware replacement "upgrade" :-(
I use a firewall at home to filter those active content thingy. Pretty much safe, and not that many sites require you to have ActiveX / Java / you-name-it enabled.
Of course sometimes i hafta change the settings to allow some sites (like windows update)...
At work it's even more safe, all active content turned off & regular users can't change the settings ! (though i'm using good ol' IE4, having all those active content things turn off makes it less unsecure...)
Tsuyoikoto ha taisetsu da ne, dakedo namida mo hitsuyousa (Strength is an important thing, but tears too are necessary)
Microsoft has warned about a security hole in Notepad. While Microsoft prepares a fix, it advises that we all use EDLIN in the mean time.
The "KillBit" problem is already solved with MS-0266 patch (Q328970): http://www.microsoft.com/technet/treeview/default. asp?url=/technet/security/bulletin/MS02-066.asp
How normal of SlashDot to "forget" this piece of information. .
I think Doctor Who tried this once. Tried to confuse an intelligent computer with the statement "The next thing I say is the truth, but the last thing I said was a lie."
Don't think it worked.
It is tempting, if the only tool you have is a hammer, to treat everything as if it were a nail. - Abraham Maslow
Reasonable for a home computer is to do nothing, actually. I'll probably get railed for saying this, but for most people, security isn't really that big of a deal. They pick shitty passwords, leave tons of security holes open, don't bother patching, and don't even know what they're doing is unsafe.
Granted, this vulnerability is considered critical, but few people will ever encounter it. Someone has to hit upon one of these malicious sites with IE after having trusted Microsoft by default and must have MDAC 2.7 (comes with Windows XP, I believe). The chances of this are very low.
You asked what you would do for your mother's PC and I would say do nothing. My dad browses all the time, but he pretty much sticks to the same big-name sites, reads the news, keeps up on a few messageboards, and sends email. I'm not going to give him a confusing list of things to worry about -- I'd be calling him every day for things to watch out for, trojans to be wary of, and websites to avoid. Most people won't encounter the problem, so I'm fairly comfortable with not having to panic about it and call everyone I know.
(...)
"The simplest way is to make sure you have no
trusted publishers, including Microsoft. If you do
that, any attempt by either a web page or an HTML
mail to download an ActiveX control will generate a warning message."
(...)
We could use this idea also with SPAM. Why use Bayesian filters (that aren't still 100% safe)? We could open every single message and decide if it is SPAM or not. If it is SPAM we can then delete it... it's easy!!
This message doesn't need a signature
This message doesn't need a sig
I imagine someone in the microsoft camp came up with something along the lines of "lock the settings then chop off their fingeres" but marketing couldn't find a way to package it as an "update"
From the MS Technet article:
Q: Why would an attacker be able to silently re-introduce the old version of the control? Shouldn't there be a warning message?
A: A warning message is generated anytime there's an error associated with a digital signature (e.g., a bad signature or expired certificate) or the signer isn't trusted. But in this case, the digital signature on the old version of the control is still valid, and the signer is Microsoft - which is a trusted publisher in many cases. Because of this, most users would not see a warning message of any kind if the old control was re-introduced.
Ha! Microsoft is now providing very well written ammunition to the Anti-DRM movement; this makes me very happy.
$8.95/mo web hosting
Maybe if MS just read the book, "Writing Secure Code" (published by Microsoft Press) they could fix all these security issues.
did you read the EULA?
...."
You just sold your soul! 1 d (e)"indemnify, hold harmless, and defend Microsoft from and against any claims or lawsuits, including attorneys' fees, that arise or result from
..and Linux bugs not?
Why MS bugs so publicised and ridiculed on slashdot, when there is just as many in Linux, and the readership is mostly Linux users here?
you linux geeks (this means you, slashdot "editors"), take every opportunity to crow about Windows security holes, but conveniently fail to mention the number and frequency of patches issued for linux, which is at least as many as for Windows.
Microsoft has admitted that it has a poor security track record. The frequency (& ease of update) is evidence that Microsoft is making good on its promise of taking security seriously.
Compare ease of patching Windows with that of Linux, please.
*buried amid the hype*
--"ma dont bother me, i'm attempting identity spoofing using certificates"
Hmm...
I just got a prompt to update to Windows Update V4, signed by Microsoft. Should I trust this???
There is really no need to have Microsoft be a trusted publisher of ActiveX controls. The "complete fix" for this problem, removing Microsoft from the trusted publisher list, is a standard part of securing IE.
Left shift 1 for e-mail...
It's funny that right as I was reading the post, my taskbar flashed that there was a new critical update ready for download.
I was just at a friends house attempting to secure their WinME machine (laugh its funny) and I was unable to download ANY *.exe files from the net. Zone Alarm, MDAC.exe ,,.
Windows update did work but I hate having to use that service.
ISP in question is Wal-mart(aol).
..glibc was 'fixed' again, causing another 25 mb download for Linux users across the planet.
"This is the third time this freaking month!" one user exclaimed. "I feel like I'm running Windows!"
Yes, I know, troll, flamebait, because people don't want to hear about how you have to patch Linux distributions more than you have to patch Windows.
So this is news because it blows the doors off the signed executable philosphy and makes the sandbox philosohy of the java VM look like the only viable approach. Notice that the JAVA approach would have avoided both problems. first it would have avoided the buffer overrun problem in the first place since that would be caught by the VM when it examined the code, and second there would be no signed app trustworthyness issue.
Some drink at the fountain of knowledge. Others just gargle.
According to their bulletin, you can't trust MS. But the bulletin came from MS, so you can't trust the bulletin.
The way out of this joke: According to their bulletin, you can't trust Microsoft's key. Microsoft Corporation and Microsoft's key are two different entities; thus, the liar's paradox no longer applies.
Will I retire or break 10K?
Yeah, I know, you shouldn't be using JET anymore, but sometimes it's the hand (or product) you're dealt.
What a pain...
whereas almost all windows boxes have IE installed
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
wheeeeeeeep
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
so it's a huge piece of news
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
I don't see anywhere that it's possible to reverse the patch on the Web Servers, the news story seems to indicate that.
:-)
Unless you browse "certain" web sites from the web server.. As any NT/2000 Admin could tell you we only connect to windowsupdate.com (twice a day
. . I think we all need to deny our Brains the authority to run the Circulatory, Neural and Endocrine system services . . cuz then we'll all be dead and crappy MS software will be a non-issue . . . ;) . .
Yup...it doesn't apply to XP.
"It takes considerable knowledge just to realize the extent of your own ignorance." - Thomas Sowell
All your trust aren't belong to us;
all your anti-trust are belong to us!
... it is just so lame. Matter of factly, maybe the only thing that is lamer than leetspeak.
Oh yes, forgot. You wanted some cheap karma. Scriptkiddie scoring cheap points. Turns my stomach.
...because there's a really simple fix.
The real problem is that so many internet pages are dependent on proprietary M$ extentions. The correct fix has nothing to do with M$, its to fix all the broken websites so no-one needs to enable dangerous M$ code.
Then there'll be a real choice of browser and more protection from these regular designed in screw-ups.
They pick shitty passwords, leave tons of security holes open, don't bother patching, and don't even know what they're doing is unsafe.
Right, in which case they are placing themselves at risk. My mother's computer is running Norton AV with regularly updated definitions, and it has Windows Critical Update Notification enabled. I believe that these measures, plus reasonable caution on the part of the user, ought to be enough to keep someone safe from all but persistent, directed attacks. I mean, if someone really wants in, they can always break in and steal the hardware.
I just don't think that Microsoft has put together a full solution here, suitable for use on a home computer, if known-bad code signed by Microsoft can still be accepted by a fully patched machine.
If you say, "now I'll be modded down because of X", I'll happily oblige.
it doesn't affect XP. is this m$'s plan all along. you have office people saying that win9x is impossible to make secure, and office 11 will only run on 2000 SP3 or higher. in the end, this is a good thing for m$. all the more reason to upgrade. it is a greaet sales pitch. in fact, wasn't m$ using no more BSODs as a selling point for XP? as if BSODs were somehow from some mysterious OS.
My problem? I was perfectly gruntled, until some numbnuts came by and dissed me.
It's amazing how everyone plays up a MS vunelability. However, when a KDC type exploit is published. Nothing. ::sigh::
this one
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
you missed the point
yes, you can set/change/modify the privileges of an app.
the question was, however, why the hell does an app that's only supposed to download and display content have _any_ privileges at all to the system?
Opera isn't running on 90% of all computers out there. I'm not even sure that Opera is running on 10% of all computers out there.
Opera could have a big gaping security hole, but the impact is still going to be marginal because of the (relatively) small size of the installed base.
Install 2.7, and install the JET tools separately. Yes, Microsoft is trying to move people away from Jet, and yes, Microsoft doesn't include Jet components in MDAC > 2.5 by default. But, scrolling down the Universal Data Access page gives you a download link.
Why is this an issue, again?
Wasn't that the rationale for the existence of "certification authorities"? If one must make one's decision about trusting a software or not based upon the site where it seems to be, then there is no need at all for security certificates. Speaking for myself, if it says "Signed by Microsoft", I don't trust it at all, no matter if it was in a cracks site or not.
Id reallly like to see all of these laid out on a time line. Seems everday there is a new M$ "critical" issue. :)
Watcha gonna do when something like this happens, and the airtight MS security system is burned into your hardware?
Comforting thought, huh?
I'm sorry, but it doesn't appear that anyone read the freaking article.
From the MS TechNet article:
* Customers using Windows XP, or who have installed MDAC 2.7 on their systems are at no risk and do not need to take any action.
* Web server administrators who are running an affected version of MDAC should either install the patch, disable MDAC and/or RDS, or upgrade to MDAC 2.7, which is not affected by the vulnerability.
The "fix" to this vulnerability is installing MDAC 2.7 which is available on all versions of Windows back to 98.
Other than the fact that this is the 50,000th security patch that I have to install on all my machines, what's the big deal?
"Anyway, long story short... is a phrase whose origins are complicated and rambling...." - Abraham Simpson
So whos scanners should we avoid? (my money is on UMAX as the culprit).
Fascism starts when the efficiency of the government becomes more important than the rights of the people.
Why doesn't Microsoft wake up and just apply the "mozilla patch"?
Seriously? Because this would work against the goal of creating a seperate Microsoft Internet that requires Microsoft platforms to run on. The enticement to lock yourself in is the additional features. Like a narcotic. It's the easy solution. No more pain. Surprise, you're addicted. Installing Mozilla takes you a step in the wrong direction. The direction of being more platform neutral and standards compliant. From this standpoint it would be better to keep you off of Mozilla and just do whatever embarrasing thing is necessary to fix IE.
I'll see your senator, and I'll raise you two judges.
I really like that the mainstream press is using "yet another" here. Think about your neighborhood: if somebody down the street gets burglarized, it's a terrible thing, but it's an isolated incident, and in a couple of days, you'll unload the shotgun and soundly again. But when two houses a week get broken into, well, you're gonna start acting like there's a pattern here.
What will happen when people start treating Microsoft's security lapses like the epidemic they are?
This is not my sandwich.
If you can be sure that someone always lies, then it's very easy dealing with that person: just turn 180 degrees everything he says. Not being able to trust someone is different, it means he lies or not according to a random pattern, so you can never be sure.
So why does this surprise anyone? I thought Mundie admitted that their products were not designed for security.
OK, that's a cheap shot. But seriously, folks...I do agree that this particular string of vulnerabilities is big news. They are ugly, to be sure, but the big deal is in the strongly-worded description of the bugs and the recommendations they've issued in the bulletin. I've read those bulletins for years, and I can't get over the things this one said. Don't trust Microsoft? Don't use ActiveX? These recommendations are nothing new to us, but I'm interested to find out what impact they may have on Joe and Jane User. When the media packages it for them, maybe a few of them will actually have a better understanding of why "Microsoft" and "security" just don't go together. And even if the only thing that some people take away is "don't trust Microsoft," well, that may make people think twice about the whole concept of Microsoft's "Trusted Computing" initiative.
That having been said, this story is just plain funny. It's not funny to think of all the patching that's going to have to take place or the hacks that are going to come out based on this stuff, but I just couldn't help laughing. This is a good Slashdot day. Also, speaking of funny, I couldn't help but post a link I found on the BBC concerning Microsoft's attempt to develop an "online life archive" of your memories
Here's a taste from the first paragraph:
"Microsoft researchers are working on ways to create a 'back-up brain' that will do a much better job of containing and cataloguing every picture you take, document you write or conversation you record."
Trust Microsoft with your freakin' memories?! Ha ha ha ha!!! It alomost deserves a whole other post. "Security vulnerabilities? I don't remember any security vulnerabilities."
have you not noticed that virtually _all_ of the Mac exploits ever published involve IE and/or Outlook?
I refuse to put Office X on my system, and only use IE to verify why a poorly coded page won't display in Mozilla or OmniWeb
Then we'll just have java viruses instead. Hooray.
The problem is not that Slashdot is picking and choosing bug reports in an attempt to make M$FT look bad. They're reporting bugs from all the "major" OSs. The problem is the bias in the reporting and by the upwards modded comentators. Take this example from the article (and the note which it closes on):
The 'solution' from MS in Microsoft Security Bulletin MS02-065 recommends that you remove MS from the list of Trusted Publishers."
NO! The 'solution' from Microsoft is that you just patch your MDAC to include the component from 2.7 or that you just update your MDAC to 2.7
For Christ's sake people, if this were a *nix bug, you'd all be beating your "we know how to update our machines" drum complaining that only stupid Windows users don't use updates.
Or perhaps it would be the "at least fixes are available immediately for *nix" argument. MDAC 2.7 isn't new, kids.
Just report the bug, and report the CORRECT fix.
You disagree with me. Mod me down.
but I think I'll remove Microsoft from my life!
Does Windows Update require signed ActiveX controls?
If so, I presume the default action would be to trust Microsoft controls? Will this mean that the majority of users will be exposed to this problem?
In July, I bought a totally bitchin' little Vaio R505-EL. It runs Linux *VERY* well..
It has been a couple of months since I booted into XP. But I have yet to allow XP onto the internet.
I have router with NAT and a squid add-blocking proxy that I send all of my HTTP through. I don't even feel safe letting it browse through Squid..
I don't have anything of value on the XP partition, but I worry that the box could be used to compromise my Linux servers, etc.
It just blows me away *how far* away Microsoft is from being reasonably secure. They aren't even close. What a sad joke.
if I may paraphrase, lying may make you untrustworthy, but being untrustworthy doesn't necessarily make you a liar.
...so you can never be sure.
however, if I don't trust you, why should I believe anything you say?
If you can be sure that someone always lies, then it's very easy dealing with that person: just turn 180 degrees everything he says.
and what if he says, "don't believe what I'm saying - I'm lying?" If that itself was a lie, then it would be truth...which would make it a lie...
when someone says, "don't trust anything we say - trust us on that," how can that not be paradoxical (at least)?
Not being able to trust someone...means he lies or not according to a random pattern...
and when the lion says, "I won't eat you," in truth he may not. but what is the cost of not trusting him when he's truthful, versus the cost of trusting him when he's not?
exactly
Evil Space Scientist: You win this time, Kirk. But I'll be back. Mua ha ha ha ha!
It is getting to the point that with any of microsofts products installing them is putting your computer at dire risk to intrusion. when will the public figure out that quality of product is more important then general trends?
I've not seen anyone actually state it here, but I can confirm that the most recent IE cumulative patch that came out this morning does indeed patch that rather nasty hole reported earlier this week. I now get a lovely "Permission Denied" Javascript error...
:)
Now.. Seeing that Microsoft got off their butt and fixed the hole in just a few days, what does this have to say about releasing the exploit publicly?
Actually, nix that... the flame war was way too long last time..
MS is not advising users "to completely eliminate downloadable ActiveX controls." Rather, it is advising users to disable the trusted-publisher status, which simply suppresses the warning prompt before downloading an ActiveX control.
They say:
"What steps could I follow to prevent the control from being silently re-introduced onto my system?
The simplest way is to make sure you have no trusted publishers, including Microsoft."
Sounds like they're saying: You can't trust us, and if you can't trust us, who can you trust?
Why should I remove the certificate of some other vendor from my trusted certs list, unless I expect they're likely to go and sign Microsoft's buggy control?
If someone tells you you should not trust them, would you trust them? I mean.. isn't that like saying "This is a lie."?
/ Per
Bear in mind that the Internet is a global medium and not eveyone speaks English as a first language. Most native English speakers posting on Slashdot can't even get their own language right, as it appears that very few of them understand the difference between its and it's, who and whom or less and fewer, just to mention a few of the most common mistakes. (I mention these only in the misguided hope that at least a couple people will take this opportunity to figure it out.)
Hold on, if I keep laughing any more, I think I am going to choke. MAN IS THIS FUCKING HILLARIOUS. This is almost like the time my freind poured lighter fluid on his pants and lit himself on fire. When his balls started heating up, he screamed for someone to kick him in the nuts to put it out. They did, and after three or four stomps it went out.
Moral of the story(intented to microsoft), DO NOT LIGHT YOUR OWN NUTS ON FIRE. IT GOES DOWNHILL FROM THERE
This exploit should be known if they have fixed it in XP as another reader stated. Are Microsoft hiding vulns until they are found by others to keep the numbers on bygtraq etc. down? Heck, i understand them if they have a hard time getting less vulnerabilities than the biggest linux dists, together and with some vulns counted multiple times. Not to mention that a typical linux dist includes a couple of thousand applications more than windows.
I have a hunch that Microsoft is actively trying to downplay vulnerabilities. They probably knows about many more than they tell just to keep their numbers down.
The audit that took place at the launch of their Trusted Computer initiative hasnt made any impact. It hasnt resulted in new bugs found in any significant number. I would think that it points towards:
a) They did a crappy job and didnt find any new bugs.
b) Windows hasn't got any more vulns left (not bloody likely)
c) They found a bunch but to release them would show that windows is a schwiss cheese of code so they only aknowledge the ones found by outsiders. They hope they go unoticed until Net is ready.
Personally i vote for c since they should have found a bunch if they really did audit the code.
HTTP/1.1 400
At least as of Win2K, so many things break when you try to run as non-administrator, it's just not worth it for most people.
Such as? I've been running as a standard user on my own personal laptop (W2K) for nearly two years and have had no major problems. The problems I did have were due to so-called "Windows 2000 Compatible" apps that were not. Simply finding the files which I needed write access to was usually enough to fix things -- use SysInternals' FileMon for this.
I've heard you argument many times, though... how difficult it is to run things as a regular user. There are some arguments that can be made, but without specifics, it's just FUD.
These last few MS security holes have stated that XP isn't vulnerable. Per chance did MS in their infinite wisdom/corruption plan this? Seems like a good strategy if you're into that sorta thing.
The 'solution' from MS in Microsoft Security Bulletin MS02-065 recommends that you remove MS from the list of Trusted Publishers."
Trustworthy Computing!
Yeah, sure... And then they recommend to be removed from the trustworthy list...
Telling your computer not to trust MS is all fine and dandy, but what about the legions of point-and-clickers who are conditioned to mindlessly click 'OK' buttons without even reading the dialog box? Even those who glance at the box will most likely see 'Microsoft' and click 'OK' anyway.
The problem isn't the technology, it's the users who slavishly obey all the 'Eat This' signs they see in Wonderland.
no shit. (spacing out and going offtopic here)
Windows is the most depressing OS i have ever used.
Just booting it up and watching my poor machine struggle with all that, that - badly written and inefficient code, plastered with the strobing lights of a user interface designed for tripping playschool children.
And there is no escape. I don't want to bash Microsoft. I just wish I could develop software for another platform or that I'd taken on a decent profession altogether, become a joiner or plumber or whatever. Something you put your hands and your mind to and it works and works exactly the same again when you go through the same movements.
You even know why it works and the things you touch don't just do something of their own accord, even though I've heard of nasty chainsaw accidents.
God, it might be the november weather, but sometimes I hate the IT business so much, I can taste it in my balls.
-- yes, i know it hurz...
Why does Java not qualify for that?
Every time a new vulnerability comes out, people'll have to go buy new hardware (or take it into a MS certified repair shop) to physically upgrade the software.
There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
I suppose you can define robust and arbitrary in a way that makes Java an answer. Furthermore, I've seen demos of teleconferencing/whiteboard software under Java with a 56K dial-up pipe, given righteous data compression.
Yet, Java applets are not overtaking all browsers in sight. Begs the potentially trollish question: is Java the new Betamax?, or is it just Mr. Softy playing monopoly?, or is it something else?
Get thee glass eyes, and, like a scurvy politician, seem to see things thou dost not.--King Lear
Opera.com
There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
Well, gang, we did it: we slashdotted Microsoft! Windows Update is reporting "Service Unavailable" when I try to update my boxen here at work. Yay, Slashdot!
Moderate drunk! It's more fun that way!
Uh, ok, stupid question.. but can't MS just revoke the signature on the compromised applet? If not, why not? Does that mean that anything MS signs, is signed for life? What about 3rd party software/drivers? What if there is a backdoor or some other hidden malicious code?
"Hot lesbian witches! It's fucking genius!"
BwaHaHa!!!
That's funny.
I've gone cross-eyed. "If I go back to the past and interfere with my birth, that would mean that I was never born and so I couldn't have gone back to the past to interfere with my birth which would mean that I actually HAD been born so I could grow up and go back to the past and interfere with my birth and........."
"I'm just here to regulate funkiness."
I do run Windows 2000 Professional - great desktop/gaming OS and stable!
This is not a problem for me, because I have removed most of the MS cruft. I run litestep as a shell, I use openoffice for wordprocessing, and I use Mozilla for web browsing.
I could care less. Just confirms what I already knew even more.
~ Detonating a nuclear device within the city limits will result in a 500 dollar fine.
I guess some of you out there don't realize that Microsoft is on a totally different playing field out there. Security issues on Microsoft products are a big deal because those products are suppose to be trusted. Although Microsoft may not go out of there way to deserve this trust it is still assumed. The difference between a Microsoft Exploit and a Linux exploit is huge. Linux was founded in very unique way. The internet is its home...It is still a system under development. You have tons of distro's out there...did anyone ever notice that with most applications in those distro's the software is either considered "stable" or "development". I have been using Linux for over 12 years, and personally I am okay with using applications that are considered just "stable"... Microsoft Windows was not founded on the net... It is almost completly closed source. Microsoft tells us that we don't need there source code because there system is there problem... Im not a CEO of any company, not even management...but if I was, in order for my entire company to be using Windows I would want complete trust from the company that makes it. This post may not even be seen by the slashdot people. I just wanted to add my 2 cents.
From the recommendation page:
...
Who could exploit the vulnerability?
* Web client. A user could exploit the vulnerability against a web client if he or she were able to construct a web page that would send an appropriate HTTP command, and then convince a user to open it. Typically, this would be done by either hosting the page on a web site that the attacker controlled or sending it directly to users as an HTML mail.
Also:
A warning message is generated anytime there's an error associated with a digital signature (e.g., a bad signature or expired certificate) or the signer isn't trusted. But in this case, the digital signature on the old version of the control is still valid, and the signer is Microsoft - which is a trusted publisher in many cases. Because of this, most users would not see a warning message of any kind if the old control was re-introduced.
HTTP commands are the method for exploiting this vulnerability. By default, IE trusts MS. I must use HTTP commands to visit the MS site and thereby learn not to trust MS (as advised). But in doing so, I accepted anything that may be malicious, before I knew exactly how not to.
From this point of view, it seems to be more of a Catch-22. But then, in that scenario, MS would host the malicious server, which would be horrible PR and therefore improbable.
One last thing, AFAIK it's the "Paradox of the Lie" and not the "Liar's Paradox", since the classic example is a statement (Like: "This statement is false" or my sig: "This is not my sig."), and does not refer to a person or liar. I lost points on a philosophy paper for just that reason. Pissed me off enough that I still remember it today.
This is not my sig.
Its people whom are grammer police that I have fewer respect for.
I don't get it. If there is a bug in this ActiveX control by Microsoft, why do you have remove certificates of all other Trusted Publishers?
-------
Warning: Slashdot may contain traces of nuts.
use windows in most cases shouldn't care so much about postings like this... Microsoft vulnerabilities are almost all in the explicitly internet related microsoft tools. If you don't use IE or outlook, you shouldn't have to worry much. I really think that even if 43% of slashdotters use windows as their main OS, only 5%-10% of them would use IE as their main browser. At least I hope so. Has there been a survey lately?
So I think that IE and outlook vulnerability stories could be said to be needless and redundant... but then, I'm reading them out of curiousity.
-------
Incite and flee.
How did it got there? This list is empty on clean install. To be able to remove something from "trusted publishers", you have to add it to this list first.
So you clicked "trust Microsoft" link to be able to remove it later. Are you sadomasochist? ;)
MSDOS: 20+ years without remote hole in the default install
Actually, I think more realistically, this would mean that Windows Mozilla would become the next hot bugtraq item. Mozilla running on Windows is not the same as Mozilla running on any other OS. Mozilla is guilty of using Windows-specific stuff too (like the JavaScript interpreter).
While that would be better for Mozilla (more bugs would be found faster, and there would be more incentive to become as homogenous across platforms as possible), I'm not sure it if would help Windows users all that much because by default Windows users are at or near the equivalent of root users. Windows is a security-week OS. Granted, integrating something like a web browser so tightly with the OS doesn't help, but the problem is still that regular Joe user is still allowed to do a lot of damage on his own with little or no checks and balances. Don't get me wrong. I don't like Windows, and I choose to run Linux on my desktop, but Microsoft-related security problems go a lot deaper than just IE.
Personally, I'm not sure there's a way around this problem. Attackers are smart and well-informed. Not being fooled into running bad stuff requires knowledge, a healthy dose of skepticism, and vigilance. The problem with Microsoft software in general is that it makes it trivial for the ignorant user to run bad stuff. If all the buffer overflow and security wholes were fixed tomorrow, it still wouldn't stop companies from developing spyware, nor would it stop attackers from using social engineering to find ways into systems. This plagues even the non-MS world (look at the recent compromises in OpenSSL and sendmail).
Here's an anology: Imagine that I was a "car cracker", and I devised a way to sneak into gas stations and replace their fuel with sugar water. NO ONE would notice until their cars stopped running and their engines siezed. Why? Who smells or tastes or tests gasoline from the pump before it goes into their car? The only real thing stopping someone from actually doing something like this is the logistics of cracking a gas station's fuel supply. As a result, people have a reasonable (and yes, in this case it is reasonable) amount of trust in what's coming out of the pump (even if it is gas-ohol).
However, it's much easier in the world of easily-reproducable flying bits to do something very similar. There's a much smaller barrier there. Now users really should smell/taste/test their gasoline before they put it into their car. The only problem is, just like with the car analogy, there's little to no tools available to make that process available to the common consumer. What's worse is that even if they were, the common consumer is so lazy, they probably wouldn't take advantage of them unless they were forced to.
No, I am not an advocate of DRM. I hate the stuff. If anyone ever tells me I can't use my computer the way I want, I'll kill 'em (metaphorically...I don't wish actual physical harm to befall anyone...it's not my place to judge and dispense punishment). My point is that Windows has a very long way to go before these types of problems will become manageable again, with or without Internet Explorer.
In a lot of situations, installing software is less like putting gas in your car and more like buying 50 kilos of cocaine. In that scenario the buyer doesn't trust that the seller hasn't cut the dope. As a result he has the tools (guns and methods of determining drug purity) to help ensure the transaction goes smoothly.
Okay, maybe that analogy doesn't work either, but I think you get my point.
moto411.com
http://www.microsoft.com/linux/goatse/hax/warez/fu ll version windows xp download/cock/porn/bill gates fuck fest
I have a serious question for anyone who cares to answer. I never use IE anymore now that I have Opera. I've set the "security" settings on IE to high and I never use it for anything anymore. If I have to use another browser for some reson, I use Netscape.
OK, my questions is this: Can I simply ignore all security problems with IE now, or do I still need to keep installing the endless patches and fixes for IE vulnerabilities? In other words, is my system still vulnerable simply because I have IE on my comp, or is it safe from IE vulnerabilites since I don't use IE anymore?
First of all, in their comparison of the number of critical bugs in Linux vs. Windows, they counted application bugs in the Linux totals, but not in the Windows totals. If they had included all the bugs in IE, IIS, Office, etc., the Microsoft numbers would have been MICH higher.
Their other deceitful manipulation of the statistics was that they counted every bug in every Linux package once for every distro they evaluated. So even barring the other deception, you have to divide their Linux bug count by 15 or something to get a meaningful comparison.
A grain of salt ain't gonna cut it with this so-called "study". It's not just bad methodology; it's an outrageous pile of shit. You'd have to be a pointy-haired boss not to smell it.
If you feel up to it, go to SysInternals, and download FileMonitor, ProcessExplorer and WinObj. These three tools are hardcore.
Run your app in normal mode, and watch what it's doing with FileMonitor (if you see ACCESS_DENIED entries, you can fix that pretty easily).
Now, if for example, you have a CDROM burner, open WinObj (as an administrator), and go to /device/Cdrom1... check the properties, and select the security tab. You will have an ACL editor a-la file system. There you can allow others than just Administrator burn (write) permissions.
That's a very cool tool. And as you can notice, burn rights are ACL entries, not user token priviledges. BIG difference.
I'm sure there's the same thing for scanners.
All Zealots: please notice how winobj actually shows the real NT namespace. And just like any other system, it starts at /. Also notice /Device/Null, and /Device/PhysicalMemory...
Yes. Just like in NIX.
Read the whole page from Microsoft. Its right there. Microsoft advises users to not only update MDac but also to STOP trusting microsoft.
FUDpucker
Oh yeah take a lookat number 66. Its great.
What Javascript interpreter? It sounds like the same one that runs on every other Mozilla platform. Sure, Mozilla does have some Windows-specific features, particularly Quick Start, but I don't think Javascript is one of them. Maybe you were thinking of Java.
Here is a simple experiment that will teach you an important electrical
lesson: On a cool, dry day, scuff your feet along a carpet, then reach your
hand into a friend's mouth and touch one of his dental fillings. Did you
notice how your friend twitched violently and cried out in pain? This
teaches us that electricity can be a very powerful force, but we must never
use it to hurt others unless we need to learn an important electrical lesson.
It also teaches us how an electrical circuit works. When you scuffed
your feet, you picked up batches of "electrons", which are very small objects
that carpet manufacturers weave into carpets so they will attract dirt.
The electrons travel through your bloodstream and collect in your finger,
where they form a spark that leaps to your friend's filling, then travels
down to his feet and back into the carpet, thus completing the circuit.
Amazing Electronic Fact: If you scuffed your feet long enough without
touching anything, you would build up so many electrons that your finger
would explode! But this is nothing to worry about unless you have
carpeting.
-- Dave Barry, "What is Electricity?"
- this post brought to you by the Automated Last Post Generator...