Slashdot Mirror
Reliance On MS A Danger To National Security
An anonymous reader writes "A panel of leading security experts Wednesday blasted Microsoft for vulnerabilities in its software, and warned that reliance on the Redmond, Wash.-based developer's software is a danger to both enterprises and national security." (Even OpenBSD might be bad if it was the only game in town.) M : The report (pdf) makes good reading.
I hope the government, in the interest of national security, can clean up MS. All the anti-trust cases don't help the problem, rather they just help companies with posturing.
Now, putting this kind of pressure on MS may really make them work harder. Imagine the government turning its back on MS, in the interest of national security. Wake up, Microsoft, before it's too late.
Urantian -- and proud of it!
I see no mention that it is the administrators who must share responsibility for the compromises and exploits.
Feed the need: Digitaladdiction.net
And the Navy is going to Microsoft in a wholesale way. The new mega contract NMCI is locking the Navy into a MS solution for _all_ IT. Non conforming (ie non-microsoft) are labeled as a legacy systems and all new development will be required to use MS products in order to be on the network. Also, all network storage will be stored in a single facility !.
This is I believe a very dangerous approach for the reasons discussed in the article.
In addition to inefficiency of restricting a solution to a small set of tools. How many large organization standard on a single environment for all computing and IT needs?
Not that I like MS, but this situation would pertain to any other OS if 90% of machines were using the same OS. Even it it was an OS you liked or felt was secure it is a big issue.
"Enjoy what you're doing! If it becomes drudgery, you're doing it wrong!" - Jim Butterfield
We rely upon half-baked right wing Dr. Strangeloves to choose the foreign countries that will welcome our invasions...
We rely upon deregulated billionaires to keep our stock market and investment firms honest...
We rely upon greedy employers not to send our jobs overseas in order to ratchet up the stock value and buy themselves extra homes and diamonds...
So why shouldn't we rely on a convicted monopolist with a track record of utter failure behind it to keep our national computer infrastructure secure, too?
Is relying on one vendor even that bad of an idea? The really bad idea is relying on computers for national security.
Think of the locks that are used for locking the doors of government buildings. Are they all from one vendor? What happens when it is discovered that locks form that vendor are more vulnerable to being kicked in? I don't imagine a bunch of engineers get together to design better locks in their spare time, however there is the chance that might happen if the most popular lock company was constantly making locks that were more vulnerable than neccessary.
However there is still a key difference between locks and computer security that must be considered: location. A locked building in Washington, DC isn't going to be compromised by someone in China. Anything that is so important that obtaining it can be considered compromising national security should not be stored on a computer accessible to the internet.
The government should realise this (they probably do) because this isn't the first time this has been an issue. Long distance communications during wars before the internet used various means of encryption to keep national secrets secure. Why can't they do the same for electronic communications? Create the electronic message on a machine that isn't connected to the internet, encrypt it, and burn it to a CD. Either mail the CD or send it using a computer connected to the internet. Then destroy the CD.
The government likely knows this and almost certainly has national secrets under more heavy protection than a sneakernet. When they complain about insecurity, whether it be from terrorists flying planes or chinese youths, what they really want is money and laws. They're not actually so clueless as to leave valuable lying around, but it's useful to let citizens think they do.
No system is 100% safe. There are some things one can do, like making sure everything is patched and another is to use odd systems. I worked for an architecture firm that used several ALPHA server for rendering projects. Several of these boxes had True64 Unix. When a couple were retired from rendering duty, we reconfigured those boxes as our router and firewall in the office. Why? Well, True64Unix is an odd platform and not many know much about the system. Its an added measure against script kiddies. Is it fool proof, no I am sure, but as one admin put it, "If they know the exploits of True64 Unix, they're a pro and proably not much we can do to stop those types". One of our boxes was attacked with the OpenSSH bug. If the attack would have been about 6 hours later, it proably would have been patched. Our other 17 boxes were patched without a problem and someone has tried to attack our OpenBSD boxes several times (hell I try once a month just to see how they react) with no luck. But hey, some bug with an FTP daemon or some PHP code and we're SOL. Bottom line: Keep patches up to date, use odd and unusual systems on the in/outbound traffic if you can, and keep lots of backups...
"The problem with socialism is eventually you run out of other people's money" - Thatcher.
"I don't really see how to undo the monoculture,"
Force MS to pay for their crimes. If they had played fairly, they could never have grown like they did. We should hit MS with fines equivalent to about 2/3 of their market cap. Most of the money should be used pay back people who were forced to pay too much for sw and stockholders of companies that were illegaly eaten by the beast. The rest of it should be given as grants to develop free sw.
Alas, this could only happen over dubya's dead body.
How would you define a false property right? In your view, are there any property rights that are not false? If some property rights are false, and others true (or legitimate) what criteria are we to use to distinguish between the two? Clearly, there is no right to have slaves, so any claim of that as a right is a false claim; but what is it about copyright that is similar to slavery that makes it also a false property right -- especially if there is such thing as a true property right?
Yeah, I read the stories about that also. And, since most web and e-mail servers and most small ISPs are running Linux, it could stand to reason.
However, even though Linux servers are the most attacked/breached or whatever, when mom and pop ISP #1231 gets '0WNZORD', it doesn't cause the gigantic ripple effect of every server on the 'net falling over, unlike a Windows box. When a Windows box gets '0WNZORD', entire countries get swamped off the 'net. You know, ala the Slammer worm, which knocked South Korea off the 'net, and swamped damn near everyone, no matter what their box was running.
This is what true computer security personnel take into consideration. Not just how many systems are attacked, but what the effects of those attacks are. You know, if one Linux box gets taken over, does it automatically take over more? Very unlikely. Each box usually needs the individual attention of the cracker, and then, when successful, it is usually only with the permissions of the logged in user, i.e. not root. Compare this with most Windows boxes, which, when one is cracked, it automatically turns and attacks more, and way more Windows boxes run as Administrator, either by default, or because some shit-ass program requires it.
So, yes, more Linux boxes are attacked, but the overall effect of these attacks are orders of magnitude less than the overall effects of the attacks on Windows boxes.
For those who describe their systems as 'boxen', do you order multiple 'boxen' of corn flakes also?
Granted, Outlook is not Windows - but Windows has Outlook and the outlook engine deeply integrated into the core of the OS. You may be able to hide it from yourself, but not from a virus.
But we are talking about the computer that your Aunt Tilly buys to chat on the interweb-thingie!
And Guess what?
Your Aunt Tilly uses the default login from the OEM, which has full admin rights!
Your Aunt Tilly does not know what ports to close!
Your Aunt Tilly does not want to be bothered with firewall rules, IDS or security patches - She just wants to play Swedish Bingo at www.slingo.com!
Your Aunt Tilly can't de-install or permantly disable Active X, Outlook, or Internet Explorer, or the VBS scripting in MS Office 9x through XP-Pro!
I doubt that you can either.
But if you hack at it long enough, maybe you can disable all the OLE that makes Windows insecure, but then you would just have a crippled GUI on an OS that is not able to connect to a network.
And Aunt Tilly would not like that!
I know this for a fact, I have an Aunt Tilly!
With properly placed firewalls there shouldn't be a problem
not true. it's not uncommon for a mobile user to get infected through their (unfirewalled) internet connection at home, and unknowingy bring something bad into the corporate network.
Gyrate Dot Org - "Where high-tech meets low-life"
This is old news. In May 2000, infowarrior.org carried an article "Microsoft - A Proven Danger to National Security". I can't find the article on infowarrior but it was very popular and controversial for a while -- even here on /. The sad thing is this article, was a warning that nobody in the government ever listened to. Microsoft sure didn't read this document. If they did, they've spent 3 years doing absolutely nothing.
Banjo - The more I know about Windoze, the more I love *nix
Perhaps his would, but mine certainly wouldn't be, as I'm sure you've figured out since I pointed out the exact argument he is using with some numbers at the time (actually I think it was you I pointed it out to). It's called bias when you ignore one side of the issue in favor of another. Considering all the facts and comparing ALL the numbers is not bias. Even if you only mention it when it suits your overall conclusions it's not bias so long as you HAVE considered all the facts.
There is a difference between being biased and shooting yourself in the foot. The truth is that when you look at the numbers from real web reporting engines and any firm that is not funded by microsoft (pretty sure apache funds NONE how about you?), the numbers show microsoft is something on par to apache in web servers what apple is to microsoft in the desktop market, I'm refering to share gap of course.
not true. it's not uncommon for a mobile user to get infected through their (unfirewalled) internet connection at home, and unknowingy bring something bad into the corporate network.
You notice how they said "properly placed". I dont think having a machine go between work and home, and meanwhile not having a firewall at home be considered "proper". Although parent made a very obvious statement, it is very true.
So why not a license for computer programmers ? You know, the only guys who know how to write and distribute a virus, hack into an on-line game, etc. Keep them off the roads until they grow up.
You say that the key is competition, however if you have a monopoly there is no competition. That's the definition of a monopoly.
In the case of a monopoly of a national or international scale there's no way for a true competitor to appear. The monopolist has the ability to crush a competitor through means that have nothing to do with the relative merits of the products in question. Any company with the instincts to successfully become a monopolist on a national or international scale has to have done so by being willing to squash the competition by any means it thinks it can get away with.
If a company can squash the competition by leveraging an existing monopoly, why would they compete on the merits? There's no incentive. Competition is inherently risky. It's a surer road to profit to make sure that the competition cannot reach a level playing field.
Not many companies can reach the place where they have the ability to leverage a monopoly to quash their competition. When a company reaches that position and begins to do so, we *DO* need the intervention along the lines of the Sherman Antitrust Act.
To quote your message, Can anyone think of any monopolies that have *NOT* tried to "use their market leadership to maintain their monopoly"?
Quoth he
"It's all academic anyway..."
Back when MS was actually in court and actually in danger, I suggested a simple solution to the whole monopoly problem:
1. The government is the biggest single consumer of computers.
2. The government mostly runs on Windows, which is only exacerbating the problem.
3. We recognise that there are many situations where Windows is, in fact, the best choice for a particular computer or task (no, really! Like solitaire! You played solitaire on Linux? It sucks.
4. The government (meaning the US gov't, though any other can do the same) should do a complete audit of all computers in use and the OS they run.
5. They should also audit exactly what these computers are used FOR.
6. The results of these two audits should be cross-referenced, and every gov't computer that CAN use an alternative OS to do it's business should be FORCED to do so.
7. Problem solved.