Slashdot Mirror
HomeSec Warns Again About Microsoft's Insecurity
cbrandtbuffalo writes "The Department of Homeland Security has posted this advisory about an impending attack on MS systems. This RPC attack has already been seen in some localized systems, but may spread as unpatched computers are exploited. Some of the national news like CNN are running stories too."
The security people at my office were talking about this vulnerability yesterday in our monthly meeting, they were saying it is likely going to be worse than slammer/code red/etc (which the article seems to back up)... Do you guys think this is that serious of a threat? A lot of what they were saying sounded like worst case scenario kind of stuff, hopefully it will not be that large of an issue. One interesting thing that the security people mentioned, that the article doesn't, is that windows 98/windows 98se is vulnerable but Microsoft has not released a patch because they no longer support the product.
Visualize the world of wine
This is turning out to be a huge problem, we got the exploit a bit *cough*early*cough* and by simply joining a channel on IRC you get a handful of IPs, of which at least a few are exploitable. And then they wonder why there are a thousands of ddos zombie machines running windows!
But there's another problem, a lot of people are starting to distrust microsoft and are turning off the automatic update / not getting service packs instead of switching to another operating system.
And what's the OS Vendor of choice for the Department of Homeland Security? I seem to recall a story or something about it.
Anyone want to talk to their representative or senators about that decision?
You never know...
i could have sworn that 2 weeks ago, here on this very same slashdot....there was a story about HomeLand Security securing a very large purchase from Microsoft....aka 100 million, or some outrageous number like that..
isn't this a bit irresponsible of them, now that they are declaring Windows a vulnerability?
We're like rats, in some experiment! -- George Costanza
*boggle*
would every geek please walk over to their nearest 4 non-geek's MS boxes and flick 'autoupdate' on? maybe we can spare a few routers in the future?
i mean, if they insist on having those boxes, the least we can do is make sure they're patched up.
say what you will about MS - but these big exploits don't usually hit until weeks after the patch has been available.
and if you're relaxed enough with control over your box to run MS in the first place, autoupdate ain't any worse.
// "Can't clowns and pirates just -try- to get along?"
I wonder what kind of odds John Poindexter would offer on "MS-based systems will be the subject of a successful cyberattack resulting in significant economic impact in lost data, functionality, uptime and manhours." Any bets? Anyone? C'mon, no body wants to take this bet?
Seriously, if they wanted to take bets on which national leader would get hit, couldn't they do the same for which OS will fail first/most? Or bet on how much the next big expolit will cost, to the nearest $10M?
The man who does not read good books has no advantage over the man who cannot read them. - Mark Twain
The sad part is that the NSA itself already was far ahead developing a secure OS that would do just fine for the dept of HS. Instead tax monies go to bill gates and his dancing monkeys.
Of those to whom much is given, much is required.
Yeah, I like the idea of changing DLLs on a system back to insecure versions and (of course) keeping the Add/Remove Programs list saying they patches have been applied. Needless to say this would be other worms/viruses would get in further making diagnosing more difficult.
If we want to see what nasty viruses do we need only look at nature. For example, AIDS (or the HIV virus if you want to be exact) attacks the immune system -- the part of the body that fights viruses. People with AIDS then die with opportunistic viruses, like pneumonia, take advantage of the situation. If you wrote a computer virus that only attacked the immune system of the net it would be quite a sight to see.
Concidence or not? google news' primary link to this story points to the register's article about this vulnerability. In their best sour Brit register tradition theyre none too congratulatory about "free patches". Does bandwidth cost money?
Of those to whom much is given, much is required.
1. They made patches for this covering all the way back to NT 4.0
2. They don't charge for these patches.
3. The bloody patch doesn't work.
You know guys, not everybody in the government is fawking off and trying to screw you out of your legitimate right to freely download copyrighted music.
There are thousands of hardworking men and women serving in Coast Guard ships off our coasts, monitoring land border crossings, inspecting imported cargo containers, and serving as airport security inspectors and skymarshals, all to keep your bloody arses safe behind your monitors as you make fun of them.
Sorry for the rant, but reality check, there ARE bad people in the world that are intent upon harming the United States and a good number of Americans working at the Department of Homeland Security are intent upon preventing that from happening.
Instead of easily making fun of these institutions, how about sitting down and thinking about better ways to reduce risks cost effectively. Propose it, then make your criticisms.
"We're sorry, but the website you're trying to reach has been disconnected."
Now why should I trust MicroSoft? They led me down the primrose path to endless updates that either show no noticeable effect, or cause my computer to act flakey.
Why should I trust HomeSec? I'm never going to feel secure so long as they keep throwing terror alerts in my face as an excuse to keep whittling away what's left of my civil rights.
And why should I trust the Linux community who's mainstay advice is "RTFM". I'm stuck using Lycoris until I can figure out how to get Wine to work under a better distro. (I'm sorry but some programs designed to run under MS Windows are just too cool to ignore.)
As far as I can tell, these so called updates could be trojans to give backdoor access to HomeSec so they can determine the efficacy of their scare tactics, and Linux is a twisted plot to make borderline-geeks like myself waste their time reading endless man pages trying to figure out how the damn thing works.
OK, so maybe I'm sounding a little frustrated, but all I really want is a nice little computer that does only what I tell it to do. Is that too much to ask?
--
Next stop: Insanity
I've just had a kid. When he starts asking what the HSAS is, what do I tell him? "We're at War, junior. We've always been at War. Terrorists, drug barons, organized criminals, religious extremists, crackers, hackers, commies, arabs, they're all out to get us, and it's important to know just how scared the government wants us to be that we're going to die today."
Nice world he's going to grow up in.
I don't know why this is modded "Funny". Yeah, the world turning into shit is so funny I'm in pain from laughing.
Healthcare article at Kuro5hin
Actually, destroying the whole OS isn't as bad as you can get. Imagine if there were a worm packed with a payload like CPUburn! Or if it had drivers which hosed hardware. Especially if it was set to go off in the middle of the night, you could actually have a virus which inflicted hardware damage.
Engineering and the Ultimate
Maybe I'm ignoring the severity of this new Microsoft flaw, but why the Dept. of Homeland Security issuing ANY statement about security flaws in any operating system?
Maybe because their PR department was scheduled to prodce some proof for their right to exists,but they didn't have any terrorists handy ATM.
Seriously, this shouldn't be their job, in the end they will be just echoing CERT or bugtraq, while wasting a lot of money into "network security research".