Slashdot Mirror
WindowsUpdate.com Secured, Permanently
Precisely nineteen months ago, Bill Gates sent out a
memo
to employees (and the press) announcing that security was Microsoft's
number-one priority.
Today, about a hundred readers have submitted the
news that Microsoft.com
went down last night.
And now, the company has
"extinguished" WindowsUpdate.com
(future updates will come from a
different domain).
All this because of some Microsoft worm that triggers at midnight. Related news:
Windows Update
says you're protected, but maybe you're not;
WU.com
briefly ran Linux, heh;
worm variant with clever "anatomical term."
Don't worry next week there will be another memo with the URL for the new update
It seems the power in one of the most populated areas of North America was out around the same time Micrsoft was making these fixes? Coincidence? I think not. For those of you in the power outage area, expect it to happen again tomorrow as the DoS is about to begin.
Microsoft should take a clue from User Friendly!
We (a 30,000 student Midwest University) are currently thinking about making our DNS servers authoritive for windowsupdate.com and and pointing the A record bac k to loopback.
Did they point windowsupdate.com to 127.0.0.1 ? I hope not, there was a mail on FD explaining that such an action would cause it to DOS the local network.. Also, wtf is up with the site running lunix?
always took you to http://windowsupdate.microsoft.com so whats the big deal about cancelling windowsupdate.com? do you think anyone will notice, or care for that matter?
Does the name Pavlov ring a bell?
but Microsoft was seen on Linux today also http://uptime.netcraft.com/up/graph/?host=www.micr osoft.com.
Quoth Billy G: "Linux sucks, it's worthless, not usable for real . . . What? A worm? Aaaiiiieee! Tux Save Me!!!"
---
Jedimom.com, that not-so-fresh feeling.
StrategyTalk.com, PC Game Forums
This is kind of interesting: Microsoft's insecure Windows platforms is the breeding ground of massively distributed worms, which are designed to attack Microsoft's own servers (karma?)
While Microsoft thinks the "solution" is to move the target server, the real solution is to fix those gaping holes in their products.
Change the update machines, new names, etc etc. MS is resorting to smoke and mirror tricks. It will only fool the current worms, not future ones that will have the new machine names in them.
Trolling is a art,
...all HTTP requests to WindowsUpdate.com will be directed to goatse.cx.
Some speculate that this will considerably improve Microsoft's customer service.
3D Printing Tips and Tricks at Zheng3.com
netcraft goes by IP, so if the MS servers went down, someone else running Linux got the IP, then it could show up on Netcraft. it's happened to me, where my dns would point to some ip, but then I move apartments, and my net is down for a week, and during that week, netcraft says that my system was running Win2K... but I haven't had Windows in my home at all for about a year.
but with MS, they probably were running Linux, and their IPs likely don't change like that. but you never know.
Take NetCraft stats with a Big Grain of Salt (big grains of salt, heh). If a site is "Akamized", as this one was, or is otherwise distributed, you'll see the OS of the front end, not what the site actually runs. You'll note that NetCraft lists "linux" for the Akamai site.
I like music
[rimshot]
Thanks folks, I'll be here all week!
Breathing is more important to us than any other activity. If we don't breathe, we will die.
An Indian-American Hindu committed to non-violent thought/speech/action alarmed by the global explosion of radical Islam
1) Disconnect box from all external cords
2) Encase box in several hundred cubic meters of concrete
3) Surround concrete with meter thick lead lining
4) Bury under radioactive waste in a geologically stable region
5) Saturate the surface with nuclear land mines
6) Curse MicrSoft, becase you still get hacked!
-- The morphemes of your disquisition are ascertainable, but they have eschewed an ambit of transpicuous exposition.
Went to check for updates today, just for the hell of it and the speed was a huge improvement over the old URL.
They're obviously worried that something is in the wild that is hard-coded to attack WindowsUpdate.com, else there would be no point in abandoning that domain and moving to another.
Where in any of those articles does it say that MS is taking down windowsupdate.com? It's always redirected me to windowsupdate.microsoft.com.
"...always new atoms but always doing the same dance, remembering what the dance was yesterday." -Richard Feynman
Not a huge deal, since the official URL is windowsupdate.microsoft.com . The start menu, Tools in IE, and Windows Help all have that address. The worm author was kinda stupid, he should have pointed it to microsoft.com or windowsupdate.microsoft.com.
Username taken, please choose another one.
that gotta teach a lesson to those lousy worm writters. Changing domain name, who whold have thunk , microsoft would come up with such an ingeneous solution.
Take that you microsoft hackers, bet you are scratching your head now.
for the last time people, I am "frodo from middle eaRTH", not "middle eaST".
So "Permanently Secured" now basically means "Permanently Offline"? Why didn't they just let the worm eat the domain? What's the difference, really? Whether they pull the plug, or the worm does it for them, it still means windowsupdate.com won't work...
"It's better to have a gun and not need it than need a gun and not have it." ~ Christian Slater, True Romance
Oh, you mean this?
Precisely nineteen months ago, Bill Gates sent out a memo to employees (and the press) announcing that security was Microsoft's number-one priority.
It's the first line of the fucking story! For cryin' out loud, we know you're not going to read the fucking article, we don't really expect you to even read the whole story, but can't you at least fucking read the first line?!?!
They've given the windowsupdate.com site to Akamai to serve for them. Not a bad idea, actually, since Akamai has something like 15,000 webservers distributed around the world, to share the load.
Of course, it's extremely amusing that they're paying to have their content served by a flock of 15,000 penguins. I'm a bit concerned for our own site this weekend, as we use akamai for our static content. It'll be interesting to see how my pageloadtimes are affected (if they are).
Akamai is a great resource for dealing with huge spikes in webserver load - I guess you could say this qualifies as that.
Last night I finally went to go upgrade from Windows Media Player 6.4 to 9.0 so I can test out those high definition WMP9 videos for once. I couldn't figure out why microsoft.com wasn't loading but now I find out it was because of a DOS attack.
Now I'm thinking, was this intervention from a higher force to protect me from installing WMP9 or just odd luck?
----------
Check out my blackbox styles
OS: Linux
o m.edgesuite.net is an alias for a562.cd.akamai.net.
Server: Microsoft-IIS/6.0
Last changed: 15-Aug-2003
IP address: 213.161.82.33
Netblock Owner: Akamai
they did not switch their servers to linux, they used akamai's caching services to handle their massive bandwidth requirements. notice the server is still iis. this is an akamai box (linux) serving a cached copy of microsoft.com (windows/iis)
$ host www.microsoft.com
www.microsoft.com is an alias for www.microsoft.com.edgesuite.net.
www.microsoft.c
a562.cd.akamai.net has address 63.236.1.163
a562.cd.akamai.net has address 63.236.1.160
a562.cd.akamai.net has address 63.236.1.153
a562.cd.akamai.net has address 63.236.1.139
a562.cd.akamai.net has address 63.236.1.168
a562.cd.akamai.net has address 63.236.1.147
a562.cd.akamai.net has address 63.236.1.138
governments of the world should heavily fine ms each time a serious bug is found and/or exploited. and people should examine, and demand, better alternatives
Would you prepared to submit the open source community to this same program? Every time a governmental Linux server is cracked, RedHat, SuSe or fundamentally FSF will have to pay.
BOO! TERRO
To see how much microsoft sues the person who wrote that worm, or if it's someone from a third world country, they might just take a nod to the US government and post a 25 million dollar dead or alive bounty.
Whoever it is is in A LOT of trouble now.
GoatPigSheep, the 3 most important food groups
You have to give it to the guy; his timing is impeccable...
Just because netcraft is reporting www.microsoft.com running on Linux, it's unlikely that they ported IIS to it. What you're seeing is a Linux proxy; The webserver itself is still an IIS6 box running on Win32 behind Akamai's Ghost proxy/cache.
We all know that when Microsoft run UNIX, they run FreeBSD.
-- Jared Earle | "There is no spork"
the Army, or any large organization with a large install base of MS boxes, does not use SUS?
I started using it here about 6 months ago, it is the only way to go. I cannot imagine using Windows Update as an enterprise solution. One or two PCs at home sure, but SUS is free dammit.
Funny, it looks to me like Microsoft's security is #2... ;)
At least we know where the DDOS attack didn't come from: New York, Detroit, Cleveland, Toronto, et al.
Stop by my site where I write about ERP systems & more
A question ..
Assuming that all old windows systems are unsecure or badly written..
Would it not make sense to take 75% fo $45 billion and offere to replace hardware and update to winXp or longhorn to every MS custoemr worldwide?
It would be the PR stunt of the century..
Don't Tread on OpenSource
I predict (maybe this post will help a little :-( ) that the next iteration of the worm (or another one) will google up "windows update" and will attack the 3-5 bests results.
;-)
Let's see what happen then... Microsoft is going to pressure Google to remove www.google.com from their DNS Servers
That is the coolest job title. I'd have to negotiate a gold plated machette as a hiring bonus for a title like that. And anyone working for me would be officially titled a Hacking Minion!
Today, in the developed world, we do not worry about electricity and water services being available.
Maybe he didn't get the memo?
Check out my sysadmin blog!
So now, when we face a choice between adding features and resolving security issues, we need to choose security.
Apparently he changed his mind.
Our products should emphasize security right out of the box, and we must constantly refine and improve that security as threats evolve.
After it's too late, that is.
A good example of this is the changes we made in Outlook to avoid email borne viruses.
I must've been absent when that came true.
If we discover a risk that a feature could compromise someone's privacy, that problem gets solved first.
Since when are bugs called "features"?
If there is any way we can better protect important data and minimize downtime, we should focus on this.
Lip + service = $$$
Unix is more secure for (at least) two reasons:
1. Users don't run Unix as root. Viruses have a very hard time attacking programs they have no write permissions on.
2. Unix has a much longer history than Windows NT+. It's had more time for the holes and buffer problems and other stuff to be fixed. Linux essentially "lengthens" its short history because it has so many eyes looking at it.
3. The killer Unix programs (Apache, SSH, PostgreSQL, etc.) don't run as root either. So even if they get exploited, worms can't do much with their rights anyway.
Unix is just built better. It has a longer history. I'll ceed that perhaps with a larger user base (pretend Unix has 90% market share) it would be a bigger target, but it is *not* as susceptible as Windows is. Not by a large margin.
Marc Maiffret, chief hacking officer for security software maker eEye Digital Security, said the amount of data sent from each infected computer would be small....
Man, how would you like to put THAT on your resume? :-)
I don't know, PISS POOR seems to describe it pretty well - and that would be #1 - unless you were going for shitty, which it is and is, therefore, indeed #2. :->
Acts of massive stupidity are almost never covered by warranty. --me.
From the memo:
"Today, in the developed world, we do not worry about electricity and water services being available"
Well, at least some people don't have to worry about electricity...
-eric
host www.microsoft.como m.edgesuite.net is an alias for a562.cd.akamai.net.
www.microsoft.com is an alias for www.microsoft.com.edgesuite.net.
www.microsoft.c
a562.cd.akamai.net has address 206.112.112.69
a562.cd.akamai.net has address 206.112.112.71
a562.cd.akamai.net has address 206.112.112.63
a562.cd.akamai.net has address 206.112.112.64
.sig
From: Bill Gates
To: Microsoft staff
Last month I sent out a memo. Well here is another one. It has come to my attention that people on the website www.slashdot.org make fun of me and how I run my business.
On another note there is another Windows Update available at the url www.windowsupdate2.com please download this due to the fact there were major holes in the last update.
-Bill
For example, if someone hijacks or otherwise poisons some DNS servers, then all the traffic to windowsupdate.com will make it through to windowsupdate.microsoft.com anyway.
Or, a future worm could be written to target & attack a variety of Microsoft servers.
Or a future fowm could be written in such a way that the target is not part of the worm's code, but rather can be directed remotely somehow. This way, even if Microsoft tries to switch addresses, the person[s] directing the attack can just change the target.
The real solution isn't to keep trying to dodge the bullet.
The solution to become bulletproof.
Even after all this time, Microsoft still doesn't seem to get that.
Part of the reason Microsoft is such a prominent target is of course because it is so, well, prominent. Taking down (say) an FSF server doesn't raise nearly as many headlines (as this week's headlines will attest to). But I don't think that all of the problem here can be traced to how widespread Windows is -- while the Internet's clients are nearly all running Windows, a large fraction of the server architecture is running some Unix variant, and while there is of course some malware that targets *nix (Linux, Solaris, MacOSX, BSD, etc), the results never seem to be as catastrophic as the typical Windows outbreak
To rip of Bruce Schneier's analogy from his security article in Atlantic Monthly a year ago, it seems to me that the what security mechanisms Windows has tend to be brittle, while those that the *nix etc world have tend to be pliable. That is to say, when a problem comes up with (say) Apache, the damage tends to be isolated. This is partly because each installation will be configured differently, with different features enabled or disabled, and partly because the server runs on a variety of systems, each of which may have different mechanisms for providing underlying security protections. On the other hand, IIS installations tend to be pretty homogeneous, and a flaw with one very well could be a flaw with all.
That's not to say that IIS couldn't be just as secure as Apache, if not much more so. But part of Apache (etc)'s strength is it's heterogeneous nature -- people are able to tinker, adapt, mix & match components to suit their needs, and in the process this will also tend to protect them from catastrophic failure. Microsoft has actively resisted this kind of diversity -- witness their howls about having to come up with "thousands of versions of Windows" if some of the firmer antitrust penalties were put into force. Those thousands of permutations are, arguably, exactly what is needed: this will give their users greater choice, and it will make emergencies like this more rare.
I don't get why they're so opposed to the idea.
Maybe they've got cleverer plans than anything I can think of. I certainly wouldn't claim to be any kind of security expert. But if the best they can come up with is a change of address card, I can't help but wonder if they're fumbling in the dark here...
DO NOT LEAVE IT IS NOT REAL
This strikes me as being a really bad thing:
They're missing a really big flaw, here, which is that this is horribly vulnerable to malicious behavior. There are already plenty of viruses and worms out there that make registry entries for one purpose or another. It seems to me that if you were exploiting a vulnerability for which a patch already existed it would be very easy to automatically modify the registry to make it appear that the patch had already been applied. This would make tracking which systems were vulnerable much, much more difficult. This would work particularly well if you were trying to make a stealth worm.
There's no point in questioning authority if you aren't going to listen to the answers.
The solution is easy, limit the fine to a maximum of the full amount paid for the software. ;-)
And really that is the case, many billions of dollars were paid to Microsoft for defective software. When auto makers have a recall, they are required to fix the problem for you. With software you have to do it yourself, and if you don't its your fault. Then again if you do install the patch yourself and your machine breaks, its still your fault!
Basically, expect to see no real improvement in Microsoft's software until someone has the guts to sue them or the government gets involved (ala auto recalls). Otherwise there is absolutely zero incentive for them to work any harder than they have to to sell you software.
I installed and ran the Microsoft BSA utility that scans your computer for updates (windowsupdate looks in registry only) per the link above. It found 4 problems that WindowsUpdate can't find, so I followed the links, to read about them.
Problem is, when you click on the link to DOWNLOAD the actual patch for XP, it just redirects you to www.microsoft.com, so even their security tool is useless if you cant get to the files to manually install them. Fucking rediculous.
Tequila: It's not just for breakfast anymore!
Going to 'tools, windows update' in internet explorer takes you to a redir site on microsoft.com, which attempts to forward you to windowsupdate.com NOT windowsupdate.microsoft.com .. even still (~3PM EST). you'd think they'd at least fix that if they were fuckin with the dns..
I wonder if this "DOS" they claim to be suffering is really too many users actually trying to get updates for once. After all, the code in this virus is not set to DOS MS until the 16th so they can not blame it on that. I doubt they would ever admit to not being able to handle the load. I use MS update at least a few times a day and have been for the last year on various client machines. Sometimes I need 10's of updates from a fresh install, sometimes just a few driver updates or the recently released. I don;t have any specific stats but I have noticed a definate slowing of the update site when the blaster worm was announced and it is getting slower as the days go on, today it took over 5 minutes to get a sound card update that for the previous year, only took 10 seconds. Another time today it took about 60 seconds. DOS causing this? Maybe, but I would guess they are having a hard time providing the update service for everyone and do not want to admit it. I bet hundreds of thousands of people are running the update service for the first time ever and they need a lot of updates. This move of names and connectivity is probably a hidden attempt to get the stuff hosted somewhere else or split up the load more then what they are currently doing and make it appear it is for security reasons. Reading bewteen the lines here but the amount of work involved with name change of this nature is massive compared to the relative ease a virus writer can simply point to the new site. Does MS honestly think a name change will stop a DOS? I doubt it, but it fits into thier FUD compaign of increased security and that they are under attack.
Bad boys rape our young girls but Violet gives willingly.
I could be wrong, but I'm pretty sure that PostgreSQL complains very loudly when run as root, and instead prefers to be run in a separate account named "postgres". Likewise, my Apache was by default set to run in an account named "httpd". As for sshd, I dunno, you may well be right about that one.
This is on RH 7.1, so it may have changed.
More importantly when will MS abid by their settlement and allow alternative browsers to be used with WindowsUpdate?(In my eyes that should be implied)
Doesn't seem right that they are allowed to throw up a button for "Program Access and Defaults" while at the same time making sure you actually can't live without the products your trying not to use.
btw, waiting and hoping that the automatics updates works is NOT an alternative. Except for those who never use non-critical updates(IE WMovMaker, WMP9 etc) or love being alpha testers for a company known to CONSTANTLY screw up their patches.
If you wanna get rich, you know that payback is a bitch
The obvious thing you are missing at this point is that most people have unix installed know what they're doing. Even with all it's recent GUI advances, unix is still a pain to setup and configure.
Disagree? Give a brand new machine to your parents, or grandparents and get them to install unix. See what happens, and if you have any hair left after walking them through.
Now, granted, a good unix installation can be very secure indeed. So can a good windows installation. I know how to configure my webserver (running on apache under windows), and it's never been hacked, and never will. I keep on top of security issues, watch bugtraq, regularly check for updates and patches, etc.
The problem is regular users - just wait until "joe average" who wants to surf the web, look at Pr0n, and read his email installs unix. Maybe he'll be running as root "because it's easier". I'm sure lots of security problems will spring up.
At the moment, I'd argue Unix has the old "security through obscurity" to some extent. As soon as everyone has a Unix/Linux desktop, the exploits will come out in full-force.
N.
"Nothing strengthens authority so much as silence." - Charles de Gaulle
Adding more salt to the wound I guess. I have also noticed that if their servers are not properly operating, they will say there are no updates available, even when there are. I have confirmed this twice when I KNEW there was an update that was not installed on the laptop (sometimes i go two weeks without using).
That is a pretty shitty way to handle a down server, by convincing your customers they are safe when they are not.
Tequila: It's not just for breakfast anymore!
I think given Microsoft's position on Linux that they shoud / would have researched the market to see if the service could be provided by a windows shop before signing a deal with akamai. It looks bad ... almost like saying windows isn't up to the task.
the Linux community needs to concentrate on not becoming the next big security joke. Okay, it's fun to laugh at Microsoft's pathetic record.... Just a second... Muhahahahahah. I feel better now. But as Linux becomes more and more popular blackhats will put more and more attention into breaking our OS.
We need to all make good design and operational decisions. Bad decisions like the one made by Lindows to run as root be default can lead to Linux having as bad a reputation as Microsoft.
The Linux community is positioned to demonstrate to the world that Linux, not Windows, should be used anywhere that security is an issue. Let's not blow it.
The race isn't always to the swift... but that's the way to bet!
Two thoughts here. First, package management
Operating system version control has been a problem for Microsoft Windows for a long time. Especially with runtime software bundled with third-party applications (think DirectX), you need a clear way to identify what is installed on a machine, upgrade it while tracking dependencies, and easily remove it. InstallShield does this sort of thing -- why isn't it built into the operating system?
Furthermore, most package managers provide a facility to verify the files that are running on the machine. While it isn't as conclusive as something like Tripwire, a simple "rpm --verify --all" will give you some insight into whether a system file has been replaced.
Package management on AIX (and probably other UN*Xes, but I haven't used them) gives you the ability to roll back out of a patch that went wrong, too. While that is possible to some extent in Windows, a package management solution could make that very easy.
And while we're at it, why isn't there a framework built into Windows to centralize patching of ALL products, not just Microsoft ones? Certainly the "Microsoft Update" that they are proposing is a good step, but why not build something that can check other vendors' web sites for patches? Couldn't such a framework be built so that when an application is installed it registers with the OS, and tells the OS where to look for updates for that specific product? Then when you run this "update console" or whatever, your local machine goes out to Microsoft, Symantec, Adobe, whoever, and checks to see if there are updates for EVERYTHING that is installed?
The system could also be similar to Red Hat's update mirrors/satellite up2date server, where a corporate customer could set up a central update server, tell it where to get updates for all the products in use in their company, and then that server mirrors it. Then updating the client workstations (and servers) is something that happens in-house. Maybe it could even be smart enough to tell if a client machine hasn't been updated yet, and then when that machine is powered on it could update itself and reboot if necessary, all before the user is able to log in.
These two things together could really put a dent in management for Windows machines. Sorry if this is sort of a ramble, I've been thinking about it for a while and it all just spilled out.
Saying that users don't run as administrator on windows is a fallacy. At every office I've ever worked in the first thing the IT department does when setting up a new user's machine is add them to the administrator group. On top of that, the service run as privileged users by default. It's possible to run windows without admin rights, but very rarely happens in practice. It's possible to run services as unprivileged users, but again it rare in practice. You also don't need to be administrator to open privileged ports on Windows like you do on *nix. Unix and Linux have the advantage that users and services run unprivileged by default.
1) M$ (and the media) hyped this security patch to the hilt, IMHO, because WU was the target. Other worm exploits that have been cited in the news can be prevented by patches that come out a year or two ago. It would be nice to have the other 30 or so patches released this year equally hyped.
2) Re: WU says you're patched but you're not... I'm sorry, but nothing impresses me more than Shavlik's HFNetChkLT for Win2K, NT, and XP. SCan with this and then download the patch from the M$ Security Bulletins through Technet and install manually.
Mod Karma -1: I sed bad wurds. If I cep my mouf shut, I wud be at riyses.
Because they've endgendered a "computing" culture where users are either: 1)ignorant about the need for patching, or 2) have been burned by fucked up M$ patches in the past and hence, don't keep up to date.
"Fool me once, shame on you ...
...
Fool me twice
won't get fooled again"
This country is overrun with idiots. I hope you reap the consequences of your actions. I spit on you all!
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
You're new here, aren't you?
!#@%*)anks for hanging up the phone, dear.
Going to 'tools, windows update' in internet explorer takes you to a redir site on microsoft.com, which attempts to forward you to windowsupdate.com NOT windowsupdate.microsoft.com .. even still (~3PM EST). you'd think they'd at least fix that if they were fuckin with the dns..
You may not know this, but when you change an entry in DNS, it is not available to everyone for a while. This is due to caching (all ISP DNS servers are caching servers, of course). For instance, the AOL servers may have gotten the ip for the domain at 8am, and if it doesnt expire for 24 hours, their server will assume it is still at the same ip, so when an AOLer tries to go there (using AOL's DNS server) it will simply give that IP address, even tho it has changed. It wont go back to the SOA and check the serial number of the DNS entry to see if it is still valid until after it expires and someone requests it. So, it depends on the expiry of the DNS record before the change. My experience is that it takes 1 to 2 days for all the changes to fully propegate, and sometimes longer on some DNS servers if they override expiry.
Tequila: It's not just for breakfast anymore!
The button on the taskbar is targeted to
a sp
%SystemRoot%\system32\wupdmgr.exe
which sends me to http://v4.windowsupdate.microsoft.com/en/default.
which appears to work just file. Didn't try it from IE tools menu, tho
There is much cruelty in the universe, John.
Yeah, we seem to have the tour map.
Microsoft is about to get into the AV business yet again. Keep in mind, MS does NOT consider those companies friends, rather they are competitors, so I can see MS letting them look bad with old links. That is not new for them.
Tequila: It's not just for breakfast anymore!
Unix is more secure for (at least) two reasons:
I'd like to add:
- UNIX is simple (yes, UNIX is simple).
- UNIX is transparent (post-kernel bootstrapping is via shell scripts for god's sake--it don't get better than that).
- UNIX is documented, bugs and all (thirty years of history plus POSIX ain't too shabby).
- UNIX is modular (I can guarantee not everyone runs the same mail server, DNS server, or even window manager).
- As a result, fixing UNIX is easy (all the system administrator has to do is admit "Oops, I was a real dumbass there" and either fix it or replace it (again, UNIX is modular, transparent, and documented)).
A cracker could attack certain subsets of the UNIX realm, but diversity is on the side of the users, in this case. It isn't like 95% of UNIX users happened to leave RPC open to the Internet, or something like that.
Healthcare article at Kuro5hin
Apparently the US National power grid uses "OPC"
OPC stands for "OLE for Process Control"... (if you did some COM/DCOM windows programm you will be familiar with this).
It's the same technology targeted by the W32.Blaster worm that is crawling around the web.
It won't suprise me if some of those computers responsible for failover/grid isolation actually hung themselves on the worm.
In case you don't know what the worm does, not much, but a side effect (because of sloppy coding) it causes the machine to restart very frequently (it also attempts to attack microsoft.com in a DoS attack, I guess that's why microsoft shut down windowsupdate).
what do you think?
they obviously don't trust their own users to keep their systems patched and/or behing firewalls
/.ers , hehehe.
I'm an XP user (among other os's) and I don't trust the average Windows user either. Not ragging, just a fact. My mom is one of them.
My brother and I were joking around because mom asked him what she should do about "that new virus" (blaster). She asked him if unplugging the computer was enough, or if she needed to do more. I told him he should have told her to put the box in the refrigerator because everyone knows that viruses and germs won't grow when they are kept that cold. Yea, I know, slightly cruel, but I'm telling ya, she just MIGHT have done it if we could have kept from laughing.
So its not an insult to Windows users, its just a fact: Most are interested in doing stuff with their computers and expect them to be like a toaster, just plug it in and never think about it again.
Ironically, I bought my 67 year old mom the computer last christmas, she uses it every day, and she WAS smart enough to ask someone about it, more than I can say about a few
Tequila: It's not just for breakfast anymore!
If those rumors are true, then the worm didn't cause the power failures, it just disabled the systems that would have prevented them. That this happened at around the same time is just a coincidence, - or maybe minor power failures happen frequently and were just prevented from spreading?
Who the fuck runs mission-critical systems on Windows?!! HOMER SIMPSON?!!!
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
...hackers will just point at http://windowsupdate.microsoft.com instead. Right?
-- http://frobnosticate.com
Given the same marketshare as Windows, Linux would be just as much targetted by the black hats and script kiddies alike as Windows is these days.
I'm getting sick of hearing this particular bit of FUD.
First of all, when a vulnerability of this calibre is found in Linux or in common Linux utilities (e.g. the ssh vulnerability) it _does_ get attacked, despite Linux's smaller marketshare. RedHat lpd anyone?
Second, didn't the last big Windows worm only affect people running MS SQL? What is that, 1% of all Windows installs? So despite the small number of computers which would be affected by this worm, it was still written. Note that it also did a fair amount of damage (took down some root nameservers, I think), which is exactly why worm writers are targetting systems with smaller marketshare -- because "smaller" still means something in the realm of a million or so computers, which is more than enough to do some serious damage!
Thus the argument that Linux's marketshare is the reason why it doesn't get attacked does not make sense. Systems with limited marketshare (like Linux) _do_ get attacked by worms, presumably because they can still do lots of damage.
So why so few Linux worms? I suspect the reason why there have been fewer Linux worms is in the past few years is that there have been fewer vulnerabilities in Linux and common Linux utilities which were severe enough to allow a worm to spread. Linux has its share of security vulnerabilities, but there's a big difference between a bug which allows a user to, say, overwrite arbitrary files on a system, and one which allows them to execute code on the system without even logging in!
Will someone please patent something like this before micro$oft:
;-)
"Method to prevent worm attacks by changing site hosting locations as many times as needed".
This way they'll either have to fix the damn holes or pay up.
I'm joking... but if someone wants to try and the USPO actually accepts it (not totally unlikely) just give me some credit, and some 10% of the profits will do.
/* TAANSTAFL */
WindowsUpdate.com did not, I REPEAT: DID NOT EVER Run Linux. The scan from Netcraft only shows that during a particular scan the DNS resolved to Akamai's web caching servers. So Puh-LEASE don't try to start misinformed rumors.
Linux AkamaiGHost 15-Aug-2003 213.161.82.37 Akamai
Reminds me of the old military joke,
The Army will post guards around the place.
The Navy will turn out the lights and lock the doors.
The Marines will kill everybody inside and set up a headquarters
The Air Force will take out a 5 year lease with an option to buy.
[
Put a locked-down box on windows-update.com that logs all the IP addresses it gets DOSed from, then trace them back to the actual users whose machines were compromised. Then revoke all of those users' XP licenses for being bloody stupid morons who don't know how to apply a patch.
Make me a friend and I'll mod you up
While Windows was getting all the attention from their common creator Microsoft, DOS has secretly been waiting for its opportunity to strike at both.
From the infoworld article:
The company is cooperating with federal law enforcement officials to investigate the attack, which is the second successful DOS attack against Microsoft.com this month.
Two successful DOS attacks this month. And what a sense of irony: revolt against the creator by manipulating "the favorite" to do its bidding.
What's so hard about using a lower-case 'o'?
This is not my sig.
This is a garden-variety buffer-overflow exploit of the sort that could just as easily still exist somewhere in Linux.
m e kind of talk should be left at score 1 or so, where it belongs, regardless of wether it praises or bashes M$ or *nix.
Active Directory also provides a way to block this type of worm that *ix doesn't. There wasn't time to patch all of our servers during the outbreak, so one of the guys here implemented a group policy that prevents execution of msblast.exe and teekids.exe on any machine on our network. Once they're all patched, the policy can be removed really easily.
Is this guy for real?
This kind of am-an-admin-expert-because-i-have-two-boxes-at-ho
That kind of "block" should not be suggested to other clueless admins! This is exactly why the worm got the 2nd generation where the filename had changed.
(I'm trying real hard not to mention also the fact that you shouldn't make false claims like about *nix systems. You really think *nix systems, employed for thousands of users all over the world in thousands of universities don't have elaborate user policies that can be administered swiftly and efficiently? Thenagain you're probably just flaming/trolling...)
(and even you forgot the penis32.exe, which btw is indeed a genius naming stunt! I do loathe the black hats, but every now and then I can't help myself admiring the simplistic beauty in some of their tricks. Thinking how many warning mails that never reached their target because mail filters grabbed them...)
1 Earth is warming, 2 It's us, 3 it's royally bad, 4 we need to take action NOW
Because they've endgendered a "computing" culture where users are ... ignorant about the need for patching
Yeah, curse those bastards for making computers that are usable by people other than us techno-elite snobs.
Many people simply have other things they care about more than patching their computer. If 95% of people used *NIX, would it have a reputation for being mostly secure? No, because people who don't care would still be the vast majority. Most people should know the importance of basic car maintenence: checking oil, tire pressure, anti-freeze, etc. Many, many people don't bother to do so. When they have problems, is it Ford's fault?
Get a clue.
Interesting article. But did you have to be such an asshole about it?
Yours truly,
Keith
P.S.: If your power is still out tonight, I hope this burning karma lights your path.
This sig intentionally left blank.
Notably, Microsoft refused to give permission to ISPs to burn CD's or make floppies with the Blaster patch on them. I heard of one outfit that had their lawyer contact MSFT to make sure that they were kosher before giving them to customers. Microsoft refused. As it turns out, stating that the users could easily download the patches directly, even if they had the shutdown bug and were dialing in to download a 1.2 MB patch.
I have no sympathy for MSFT getting DOS-ed. The fuckers deserve it, and they were hoist by their own petard. Sure, there is some nitwit out there that acted on as explout that was known for at least a month, but WTF? What is the problem with letting ISPs distribute the patch to fix this thing?
The ISPs are burning time and support lines over it, bandwidth is getting hosed by the packets on the affected ports, filtering ports helps (but doesn't eliminate the problem). Essentially, third-party companies (ISPs) asked for permission to help put out this fire, and Microsoft gave them a big "fuck you" and I am somewhat gratified by the whole thing.
Fuck you, Microsoft. Here's hoping you get more of the same.
I might post the emails discussing the attempt to get authority to help spread the patches somewhere, but I'm not anxious to cause a slashdotting of my own weenie ISP's servers.
And, if you read further about how Netcraft actually works, you will notice that they state that firewalls and other sorts of software can make it appear that a server's software is actually running on an OS that it would otherwise be impossible to run on. This is why you will find IIS running on Solaris, FreeBSD and Linux. Read first.
www.sitetronics.com/wordpress
The impending DDoS attack on Microsoft scheduled in the MSBlast worm was drastically mitigated by Microsoft's DNS shuffing, the diligent patching by systems administrators around the world, and the lack of electricity in several population centers. However, it was replaced by a much more potent DDoS attack by people checking to see if Microsoft's site was dead yet...
"Never put off for tomorrow what can be avoided altogether"
The SUS server is supposed to synchronize itself (manually or automatically) with Microsoft's servers to get the latest updates, and you get a chance to approve them for distribution to clients. Not a bad idea, and it seems to work OK.
However, the URL that's coded into SUS to synchronize with updates is -- wait for it -- a windowsupdate.com URL!
Error Message:l og1.cab'. (Error 0x80072EFD: Unable to connect to the server.)"
"Failed to download from URL 'http://www.msus.windowsupdate.com/msus/v1/aucata
Anyone using SUS to update their client machines is now stuck with their current update set until Microsoft sets up a new site to sync with and documents how to change the URL that SUS uses to whatever one they come up with.
Lame.
Well they bought a Romanian AV company called RAV. They used to have anti virus products for Linux and FreeBSD (to scan for wind0ze viruses of course), but no more now.
"[Unix] is *not* as susceptible as Windows is. Not by a large margin."
Oh really? I'd just like to point out that while this bug is *attacking* one of MS's sites, it won't successfully *break in*. It was a mere 2 days ago that a hacker successfully broke into GNU.org and compromised the crown jewel of the Linux community.
So who's more secure again? Don't be so quick to jump to Unix's defense. A lot more exploits are publicised for Linux than for Windows.
Like woodworking? Build your own picture frames.
With Microsoft getting DOS attacks and viruses all the time one might begin to think that someone doesn't like them. Hrmm. Wonder who that could be..
I don't know why this became a big deal. Ok, I lied. It became a big deal because of users who did not patch their systems (for whatever reason). But it isn't like this patch is new. It was originally posted on July 16, 2003. They just revised the bulletin because of the outbreak.
From MS's site:
Why have you revised this bulletin?
Subsequent to the release of this bulletin Microsoft has been made aware that additional ports involving RPC can be used to exploit this vulnerability. Information regarding these additional ports has been added to the mitigating factors and the Workaround section of the bulletin.
If I have installed the patch provided with the original bulletin, am I still protected?
Yes. There has been no update to the patch itself, and the patch will still correct the vulnerability. This additional information is being provided to those customers who may require a temporary workaround until they can apply the patch.
I wish I could make my friends, family, people I know read these security reports on their own, but they never do.
-Valiss
However, even more important than any of these new capabilities is the fact that it is designed from the ground up to deliver Trustworthy Computing. What I mean by this is that customers will always be able to rely on these systems to be available and to secure their information. Trustworthy Computing is computing that is as available, reliable and secure as electricity, water services and telephony.
Today, in the developed world, we do not worry about electricity and water services being available. "
I guess Bill hasn't seen the news in the last 24-48 hours. I haven't seen a virus yet that can take down all systems in less than nine seconds. If the reliability of power is what Bill aims to achieve we (MS) admins will always have a paycheck...
Last time I checked, most everybody, on average, beats microsoft in terms of speed of security fixes. So I suppose unmatched, because Microsoft has been completelysurpassed.
Here in CA you have to fund the switch which allows you to feed from your supply to the lines, even if you don't EVER want to feed back, PG&E got some help in the legislation, this run s around 10K minimal. The CA government in its infinite wisdom also institutied a Farking tax on power feedback, in order to offset the cost of people leaving the system while it is so deep in financial trouble, so now even if you DON'T USE the power grid, you are required to pay a tax on the approx. amount you would use....Our rural neighborhood association just went through the governmental hoops to get this working...what a friggin nightmare.... Unless you have several hundred potential users, there is no way this is financially feasible thanks to our friends in government, always out to protect corporate interests at the expense of taxpayers freedom and choice.....
errr....umm...*whooosh* *whoosh* Is this thing on ?
It's definately something we've considered. Based on where our house is and living in the Pacific NW wind seems like may be our best option, fortunately windmills are getting more efficient all the time.
I think I'll just leave PSE's wires in the ground and disconnect them at the box though. If they came to dig them up they'd sever my cable, phone and water lines for sure. :)
http://www.matrikon.com/drivers/opc/whatisopc.asp
OLE for Process Control (OPC) is a new technology designed to bridge Windows based applications and process control hardware. It is an open standard that permits a consistent method of accessing field data from plant floor devices. This method remains the same regardless of the type and source of data. Therefore, end users are free to choose the software and hardware that meets their primary production needs, without having to consider the availability of proprietary drivers.
OPC components fit into two categories: OPC clients and OPC servers. A client is typically a data sink -- an application that uses data in some way, such as an MMI or SCADA package. A server is a data source -a device specific program that collects data from a field device, and then makes it available to an OPC client.
and DCOM definately appears to be in the mix as well:
http://www.opcfoundation.org/Downloads/White%20Pap ers/OPC,%20DCOM%20and%20Security.pdf
Perhaps the lusers who are uneducatedly blaming the blaster virus aren't entirely wrong.
-1 Overrated for that on a +5 post
That line of reasoning is hogwash, and part of the self-apologizing crap us Software Developers keep throwing out.
It used to be that we could blame the users for running executables they receive via emails. We demanded common sense, and said that it was user error, not Software Developer error. This time, the mere act of being plugged into a network or the Internet is enough to get the computer infected. So what do we do? We say Damn those lusers because they didn't install their latest security patches!.
That's a big, smelly load of shit. Systems administrators should be required to read bugtraq and keep their systems patched. Users should only show common sense. We can't ask them to do these things. There are people working with computers that actually use them as tools to do work, rather than as objects of worship, as we geeks do. They don't want to know about driver install woes or our petty flavour of the month.
We should be bounds-checking our mallocs rather than demanding users take the time to fix the faulty products we put out.
Overcaffeinated. Angry geeks.
"why would i want to help allievate the situation? hell, i get to have all my computers attack microsoft for free! and legally! wohoo! sick 'em!"
I know (think) you're joking, but while we can moan all we want about how Microsoft should design software that's more secure, we can't do anything about existing systems. And windowsupdate was the fastest, easiest way for the non-tech public to protect and repair themselves. Those of you out there that view this impending attack and the shutting down of windowsupdate as a good thing are very shortsighted.
Maybe you don't give a shit about all of those other users out there that use Windows. Maybe you're happy this is happening. Fine. But rest assured, it's not going to cause people to rebel against Microsoft, like many of you are hoping. There will be no enlightenment and mass exodus to Linux or BSD or OSX. This is going to get blaimed on "hackers". And we all know hackers hate God, hate America, root for Saddam, get pentagram tattoos on their foreheads....and use Linux. Pretty soon it'll be "yeah, I saw those Linux guys bragging on slashdot.org that they took windowsupdate down!"
IBM's reps will be going "yeah, thanks heaps for the positive image, slashdotters.........fuckers".
Make fun of people that run Windows all you want, but don't assist in, or support the disabling of one of their few effective means of defense.
Life is hard, and the world is cruel
And now, the company has "extinguished" WindowsUpdate.com (future updates will come from a different domain). All this because of some Microsoft worm that triggers at midnight.
If you're going to submit a biased article, at least get the facts straight. WindowsUpdate.com was never the primary WU domain, windowsupdate.microsoft.com was. They're just disabling the extra one that was never linked from the Windows OS.
Beware: In C++, your friends can see your privates!
:)
A few of the german microsoft sites used to run Linux. Oh, and their "Switch to Windows" campaign server used to run Linux as well until everyone started picking on them. You don't have to get all huffy because Microsoft had to rely on the awesome power of Linux to save their bacon. They went with Akamai to load balance a site, and Akamai uses industrial strength Linux. So yes, inadvertently WindowsUpdate.com IS running on Linux. The scan from Netcraft was correct. So Sorry. Thank You For Playing. No rumors here. It's the honest to God's truth.
For every annoying gentoo user, are three even more annoying anti-gentoo crybabies. Take Yosh from #Gimp for example.
car in roadworthy condition, huh?
I mean, what business is it of anyone else's if your brakes are bad, you have bald tires, and huge chunks of the car falling off as you drive down the street.
I think everybody is missing the point on this whole issue. Fact :- Blaster is a worm, who's payload was intended to dos windowsupdate.com, rendering it unavailable to the folks using it.
Fact :- windowsupdate.com is 100% unavailable.
Conclusion :- Blaster is the most successful virus/trojan to date. It didn't just cause a few hours of unavailability, it wiped the domain from existence. Not just any domain, but a prominent microsoft domain (high profile, big budget website) totally obliterated off the internet.
Folks can say what they want, and argue about the politics of it all, bicker about who is responsible to update what, and whatever, but you cannot deny the facts.
Blaster is head and shoulders above the crowd as a denial of service worm, the first to achieve a 100% success even prior to actually triggering.
Say what you want folks, but this has got to go down in history as the most successful worm ever.
It's C2; there's no such thing as C4. C2 isn't terribly hard to get (lot's of auditing and doco requirements). However, since C2 isn't a particularly interesting or useful security classification except for marketing (DAC systems are strictly for unclassified environments), most vendors don't bother with it until they start selling lots of stuff into the gov/mil/intel areas.
B-level secure systems are another story entirely.
I dunno. I just saw someone else's signature line say it's a guaranteed +5 Funny, so I figured I'd do a one-shot experiment to see for myself. 'Course, it only got to +3, so I guess the guy wasn't right after all. :)
!#@%*)anks for hanging up the phone, dear.