Slashdot Mirror
Windows Security Holes Go Mostly Unexploited
murky.waters writes "Wired News has an article with a decidedly different take on security holes in Microsoft Windows: Despite the thousands of known exploits and virii, most MS users aren't target of much harm, and the big guns such as Klez have had almost no effect on home users. An interesting read that, if true, challenges some common arguments."
of these holes are exploited by adults who are quiet about it instead of big-mouth children?
It's Christmas everyday with BitTorrent.
Thousands of people are in dark alleys every day and rarely are any shot, raped, mugged or sodomized.
Banaaaana!
because they don't notice these viruses.
Saying that unprotected windows machines go un-hacked is rediculous. Just look at your server logs (if you run a web server). How many automated hack attemps do you see? quite a few.
Tons of people are infected with viruses and spyware (now that shit should be illigal, god damn) but they never notice or care, as long as their computers keep working.
autopr0n is like, down and stuff.
That's because there are SO many exploits to choose from. Nobody has the time (or need) to exploit all of them :-)
That's not the point. The point is that these flaws are not necessarily practical to exploit, or can't be because of a firewall/NAT.
This doesn't mean that Windows' security doesn't need a LOT of work - it does. It's just that practically speaking many exploits are not "the end of the world" as many news sites (*cough*) would like to make it seem.
There is no longer anything that can be done with computers that is nontrivial and clearly legal. -- Paul Phillips
As a contractor doing technical support for an ISP, I will attest to the fact that home users are hit very hard by problems such as Klez.
It's an epidemic.
On the other hand, we know of surprisingly few cases where machines were exploited on the network for other types of obvious security holes.
"We know of" being the key phrase.
The article mentioned does not specifically discuss Windows security holes (as the title of this thread suggests), but rather security holes in general, and goes on to mention the Linux Slapper worm in particular.
I find this typical of the slanted, Microsoft-bashing nature of posts here on Slashdot!
Experts who discover and report security holes seem to be far more industrious than the malicious hackers willing or able to exploit those holes.
The problem is that the article fails to mention that if the holes are not fixed, sooner or later the so called malicious hacker will find it and exploit it *quietly*. This is dangerous thing.
IMHO, better to expose it and then *quickly* fix it rather than do nothing.
The problem is now that Microsoft knows (or being told) about the holes but often takes a very long time to fix it and sometimes ditch the bugs as "unimportant". This is even worse as this *will* give a plenty opportunity for the hackers to implement the exploit.
--
Error 500: Internal sig error
You know for being a virus, I'd think the authors would want to give it a cool name, like Infectita or Shadowbyte, I dunno SOMETHING cool. Instead, it's Klez, which sounds like a freeware puzzle game that sucks ass but has a lot of bright colors.
Cloud City Digital: DVD Production at its cheapest/finest
My girlfriend's Windows 2000 machine was hacked about a month ago by script kiddies exploiting one of the recent exploits in a Microsoft product. They then installed 2 apps, a ghosting app that hides any application from the Taskbar and Tasklist, and mIRC with hacked up startup scripts to allow remote control when connected. They used the ghost app to hide itself and mIRC. Whenever she turned on her computer, it would load mIRC, hide it, then connect to EFNet. Then shortly after someone who would see it connect, would use it to mass-ping hosts in an attempt to DoS someone.
Needless to say, for the week this was going on, I noticed serious network problems at home. And pinpointed them to every time she turned on her computer, the network would lag to a stop. Finally after researching it I discovered what was going on.. I found the channel these guys hung out in, and she wasn't the only victim. They had a few hundred hacked users they could control.
So when I see reports like this, I suddenly get a whiff of steaming horse shit.
..There's a-dooin's a-transpirin'
why does this headline sound like an invitation?
In SOVIET RUSSIA... erm...NSA AMERICA, the Internet logs onto YOU!
Most Chevy Geo's are not broken into or stolen, so it would be OK for GM to just use the same key on them all, giving the owners the illusion of security.
I'm an American. I love this country and the freedoms that we used to have.
- Steal the HS research paper on crop circles
- Grab secret financial information
- Use as a proxy to hide the hackers identity*
- Part of a DDOS attack*
Now, lets think of all the benefits of hacking a server/websiteAlso note the last 2 reasons for hacking a home computer are really for working with servers. The truth is, not too many people really care about hacking your computer, unless its a means to an end.
Karma: SELECT `karma` FROM `users` WHERE `userid`=138474;
As we speak, someone is changing the news options on the RIAA website. However, they don't seem to be stopping them from doing it. I did grab a shot of a particularly amusing one though.
Oh, and just so everyone knows.
Gonzo Granzeau
"Nothing the god of biomechanics wouldn't let you into heaven for.." -Roy Batty
I am then subjected to dozens of e-mail scanning auto-responders telling me I have a virus, auto replies from people I've never heard of, and the occasional jerk who thinks they know everything screaming at me in e-mail telling me I am stupid for letting myself get infected.
The fact I am also the postmaster admin to 13,000 users means I get users contacting me in a panic thinking they have a virus because one of the three above things happens to them. This, despite a faq and notices on intranet etc etc that this thing is out there.
Klez is probably the primary reason I am starting to hate Microsoft. It doesn't matter if my computer and all computers I am responsible for are completely patched and that my mail gateway blocks it, I still get to be a victim indirectly, and I doubt we'll ever see the entire planet fully patched.
Despite the thousands of known exploits and virii...
Public Memo:
Its "viruses", not "virii". Repeating, "viruses".
Did you also get the memo about the TPS report cover sheets?
Skiers and Riders -- http://www.snowjournal.com
http://www.riaa.org/admin/press_and_news.html You can modify or post ANY news on the site now, the front page has GOATSE on it. http://www.riaa.org/ Do your worst :P
One thing that bugs me a bit about this article is that it defines an exploit as a security hole. While this is true, the tone of the article makes it sound worse than it really is.
I mean, think about what an exploit really is: Somebody has taken a feature of Windows and turned it against the user or the user's machine. The problem I see here is that you can't have a totally secure machine and have all those fancy features you like.
I'll give you an example: I use Outlooks's to do list to keep track of my tasks. There's a feature where you can attach shortcuts to each task. I've found this handy, whenever I need to do my time sheet I just pull up the task and double click the shortcut inside of it. Now, in order to 'crack down' on security on my computer, I turned off a bunch of those handy-dandy features and found myself unable to launch that shortcut anymore!
Now, before you start saying "Oh, MS could easily fix that...", instead think about the real problem here. Either I don't use that feature at all, or MS has to think of every single malicious use of a feature and only allow the non-dangerous ones. Sorry, that's not a good solution. You're holding MS (or anybody else) responsible for other people's creativity.
I'm not saying that MS is unfairly given a bad rap for this whole topic. I think their default choices are ill-thought and have caused serious damage. However, it needs to be considered that there is always an inherent risk with any piece of software you use. It's not a matter of security holes, it's a matter of deciding whether or not it's worth the risk.
I, for one, would never underestimate people's creativity. I read about an insurance scam once where this guy got fire insurance for each of his cigars, over $1,000 a piece. Then he smoked them. He took the insurance company to court, and the judge reluctantly ruled that the insurance company had to pay the guy $12,000. Fortunately for the insurance company, though, they were able to charge him with arson. Heh he got a hefty fine ($10,000 ish? I don't remember..) and served jail time.
Now, if you think about this insurance company, you probably wonder why they didn't a policy about cigars or items that were meant to work with fire? Well, it's simple: They never imagined that somebody'd do that. The only way they could be fraud proof is if they were to clearly define the rules for every ridiculous outcome they can think of. Know what'd happen then? There would be people unable to redeem fair claims because their unusual case strayed outside the boundaries that are clearly defined. There would also be that one guy who figures out a creative way to buck the system anyway. The insurance company is far better off coming up with ways to deal with the eventual fraud instead of over-relying on their policies and laws to protect them.
So where does that leave us computer people? Well, it's simple: Using a computer is risky. Take a few risks but protect yourself. Worried about people stealing your credit card info on-line? My answer is not: "well don't use one then!" Instead, my answer is: "Get a credit card with a company that'll protect you in that event." Worried about data loss? Make backups once in a while. Worried about hackers breaking in on your always on connection? Use a firewall, but use common sense too. A firewall is the equivalent of shutting a few windows, it's not a structural reinforcement.
Total security is a pipe dream. Instead of blaming Microsoft, take some sensible precautions to minimize the damage done. The benefit here is that you protect yourself from damage that can happen outside of the exploit world. (Lightning strikes, hardware failure, children...)
Likewise, every remote root exploit makes it technically possible for this to happen. Even if relatively few people are being hacked by script kiddies today, that says nothing about the odds of a highly skilled attacker pulling off a single massively devestating attack.
This report is no reason for complacency.
Sounds like you've gotten so 0wn3zd your're not even getting the logs anymore. Probably fairly soon after those first portscans you saw. Or maybe your ISP is running a firewall for you? But if I was suddenly seeing less than a dozen attacks per day, frankly, I'd be pretty sure I wasnt seeing the real picture.
Yeah, the guy's obviously making it up.
And since it doesn't exist, there's no reason for MS to release a patch to fix the vulnerability, right?
Obviously, you're intelligent and checked Google before flaming away.
This is the sort of crappy reasoning that states that since most people don't get wacked by the Mob, the Mob doesn't mean much. In NYC for years everyone payed a 1 percent Mob tax. That was the amount prices were inflated to cover corprate losses to the Mob. If you wanted to build a building the cement was controlled by the Mob. Then you had, and have, labor rackettes.
If a company is hacked and blackmailed they often don't report it. But the cost is passed along to the consumer.
The biggest hole is the end user. Tight network security means nothing if the end user can run a trojanized screensaver sent to him by email or downloaded from Joe Blow's Web Emporium and infect his own machine.
And I have heard claims that as many as 90% of security breaches go undetected. Think about it. How many of even you Linux users actually run tripwire on your personal system? What percentage of people do you think even check the md5sum against their downloads before compiling as root? It is small I guarantee. I once posted the wrong md5sum for a release of an open source project and it was downloaded hundreds of times without anyone saying anything.
Another reason they go undetected is that many trojans are customized. If you were going to plant a keystroke logger on a target's computer would you use one that is found by McAfee antivirus? No. You'd compile your own; changing the signature, different size, different port, different protocol, and only use that particular version in that one instance.
Of the breaches that are detected, many are not reported. What bank or online retailer wants people to know that their personal data was stolen? So just because there hasn't been a Code Red lately doesn't mean all is well.
They pointed out the real problems, like KLEZ. But that wasn't the point. The point was that out of the thousands and thousands of supposed security holes very few are ever exploited. They said nothing of the destructive power of the holes that were exploited.
Boobies never hurt anyone. - Sherry Glaser.
My lab used to have an unprotected DSL with out-of-the-box RedHat 6.x and unprotected Win95 boxes on it that we used for testing things. As far as I could tell, nobody ever successfully hacked the Windows box, and when I was running ZoneAlarm, it'd detect a lot of doorknockers but no real attack - No surprise, because we had file-system sharing turned off, a relatively obscure freeware web server, no Napster/Kazaa/Gnutella/Morpheus/etc., and not much else useful on it except clients so not much to crack.
But the main Linux box got broken into all the time - I eventually changed its name to "Kenny" because it was getting brutally killed every week. As far as I could tell, nobody seriously bothered it once I upgraded to RH 7.1 in a medium-secure mode (I didn't install FTP servers, for instance, and Apache didn't have any web pages complex enough to be exploited), but by then I wasn't doing much complex, and I'd replaced the highly reliable Pentium-66 with an faster el-cheapo machine that often died on its own so it wasn't available to crackers.
The most common attacks I was aware of were some rootkit followed by installing Staecheldraht DDOS and some IRC bots. (And after I'd wiped out Staecheldraht a couple of times, the loser got annoyed and wiped out my disk drive once.) I noticed the initial attack because one of Kenny's P66 cousins was used to run a tcpdump sniffer to monitor the LAN and it kept doing ICMP to machines at universities. At least one of the rootkits "fixed" ls and ps to not report on its directories and processes, but forgot about some other utilities like /proc, and forgot about semantics problems like
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Despite the thousands of known exploits and virii, most MS users aren't target of much harm
3 words... no shit sherlock. Despitesthe incredible stupidity of claims that klez is ineffective, I'd have to say the reason that thousands of different virii/exploits/etc aren't being used is because the existing ones work very well to nail a large range of people. If 2% of the exploits hit such a large audience of say 100000+ people, why bother trying to hack up new methods.
Once a given method begins to be less effective, then the hackers/etc can move onto something more effective.
It's like having a changeroom with 1000 peepholes. Why do you need 998 of them when the one or two in the corner are showing you all you need to see?