Slashdot Mirror
Yet Another Critical Windows Flaw
Dynamoo writes "Microsoft released yesterday a whole bunch of critical security updates. Out of these, MS03-043 is a flaw in the Windows Messenger Service (not MSN Messenger) with the possibility of a remote attacker gaining complete control of a Windows NT/2000/XP/2003 based PC remotely. If this sounds like another possible vector for a worm to spread, you'd probably be right. Microsoft's recommendation is to 'disable the Messenger Service immediately and evaluate their need to deploy the patch'. Of course a firewall will offer some protection but shouldn't be relied on. At least administrators can disable the Messenger Service remotely. Of course this is another headache for admins still patching for last month's RPC flaw."
...to uninstall Windows Messaging for the average user. 9/10th of them just assume that it IS MSN Messenger and don't have to worry about it.
-jls
Techno-pagan
is going oh so well.
Then again, considering the installed user base; I think they are doing ok. I know it's the cool thing to be anti-MS. But lets face it - sometimes:
"war is peace"
This time, please do something really useful, not only doing such silly thing as DOS'ing windowsupdate
You can for instance, delete necessary files for Internet connection... in this case Microsoft will be in a *real* shit if nobody can connect the internet to download patches!
They'll maybe have to send MILLIONS of CD by mail!
Therefore, people will be *really* annoyed and may think it's time to switch to another more reliable OS.
Isn't the case for a complete rewriting of the fundamental components of Windows rested already ? Microsoft even seems to be willing to use them for Longhorn in 2006 ! How many fatal flaws will it take until something is done about this ? Talk about "trusted computing"...
Posting a Microsoft vulnerability AFTER they have released a patch? Either this news is really old, or you people who say that Microsoft doesn't react quickly to vulnerabilities are full of shit.
"Ask not what your country can do for you." --John F. Kennedy
"Already patched... But I pity the victims of a forthcoming worm"
Already patched... with Mandrake 9.1
It's useful.
-- Bird in the Bush: The Renewable Energy Blog http://www.birdinthebush.org
This is hardly news in a sense. Its not the first, last or only time that windows has a flaw. There is probably a thousand of these exploits hidden in the closed source.
On top of that, there is the prevailing attitude at microsoft that a quick sale for ease of use is better than a later sale with security. Until now that approach has always left them in the money.
I'm hoping that the level of attacks that we have seen in the last few months will finally produce the uprising against this "quick release" security through obscurity model that microsoft has done so well with.
My 2c worth
Michael
There is no cryptographic solution to the problem where the intended receiver and the attacker are the same entity.
Hey what's the deal with slashdot moderation? I used to read at +5 but now there're barely any comments there. I know this is offtopic, but did I miss a story about major changes or something?
-Rob Ewaschuk
Win98 is not affected. Or is it just that they don't bother to check it anymore?
I checked my Windows XP installation and it has had the patch applied since July 8, 2003. Why is this a news item just now?
ARRRGH, all these dang security updates, and patches, and holes, and everything... It's not fair. And Linux is no better, I'm stuck on 56K, so getting the thing in the first place is hard enough... not to mention isn't a fulltime job in itself.
I think I'll just go back to Windows 3.1 on all my machines, that will solve all these problems I'm having with new operating systems.
Karma: \Kar"ma\, n. [Skr.] (Buddhism) One's acts considered as fixing one's lot in the future existence.
At least they found them. I wonder if they are patching for the manner in which Valve's source code was pumped out?
Maybe paranoid game developers will start writing games for GNU/Linux...
joo R 0wn3d
:)
Makes me glad I have a firewall between me and the internet (even at home for my LAN). I didn't even know about all the Popup spam until an article came around talking about it. It just hadn't been an issue. Yes, its better to be informed than clueless, but a decent firewall is still a help
This space for rent. All reasonable inquiries will be entertained at proprietors discretion.
I just installed the patch on my laptop and now it BSOD's immediately on boot. It's quick, but I caught something that looked like "basesrv." Quite the pain, really. Is anyone else having a similar problem, and if they are, how do you fix it?
I've figured it out! My company sends around an update CD every time one of these flaws is announced. They're trying to drive us bankrupt through the cost of update CDs and lost productivity of every employee in the company having to spend half an hour to an hour applying them! I'm on to their evil plan now!
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
Or maybe I've just been watching too many Matrix movies.
"Even OpenBSD has had 1 security hole in the default install, and thats ONE TOO MANY"
Damn right. But with Debian and OpenBSD, irate consumers can fix the source code themselves if they choose. Ultimately, this *can* lead to better code, but the majority of computer users have problems installing patches and updates - so how can we expect them to actually do something positive about security?
People who don't patch - please disconnect from the internet after reading this, and burn all phone cords and network cables between you and the internet.
who needs that service? o.k, its usefull to receive messages from olga from moscow providing you p0rn (if youre not firewalled) - but is there really anyone out there who takes advantage of this service? Hasnt it already been disabled? and if not - why didnt they do that?
After all, how many people out there have turned on the default Windows XP firewall since Blaster?
I know every machine I fixed during the blaster worm's reign had its default firewall turned on.
Marbles - yeah, that sure sounds like a remote root exploit waiting to happen. And freesweep (curses-based minesweeper clone) - sounds like another dangerous vulnerability to the unpatched machine. kdebase is a local vulnerability, and as for ipmasq, webfs, openssl and tomcat - I don't recall these even being installed on a typical debian workstation, let alone being started up at boot time. The only vulnerabilities in your list that might matter are the ssh ones.
Slashdot - the place where you can look like a genius by restating the obvious
So I installed W2k for a friend a few days ago - Connected to the internet to get the RPC patch, and got infected with this work in under a minute - Not even time to get the update!...
Now, getting rid of the worm is annoying, but is easily done. Can you imagine however, the chaos if the author of the worm also put nasty bios flashing code into it... Millions of PC would be heading for the dumpsta! Shops/busnesses/transport/universitys would all end up grinding to a halt, The economy would be up shit creak, and for a few weeks anyhow there would be a huge shortage of PC's through people panic buying new units - hardware prices would sore.... (good time to buy Dell stock maybe?)
Tony.
Since when is "Messenger Service" at the core of Windows? Even the RPC services are not at the core of Windows. At least not anymore than sendmail or OpenSSH is to *nix. They're just services, or in the 'nix world, daemons.
Insert offensive troll-style sig here. Please mod or respond appropriately.
Are you sure about that? From a 9.1 install you most likely have openssl updates to perform....
oops.
j0 zuckz
Someday, I'll have a real sig.
To think that there are so many flaws in windows, and so many critical updates that they have to release them in batches because system admins are over worked constantly patching MS boxes..
This cnet article makes entertaining reading
Microsoft released its first monthly security update on Wednesday, following a new schedule that attempts to ease the load on overburdened system administrators.
"All of the five critical (vulnerabilities) are, of course, critical, so that means they are wormable," said Jeff Jones, senior director of Microsoft's security business unit.
Why? Because I'll be one of the poor soles fixing the problem for friends. I already have a friends computer to fix tomorrow, which has fallen victim to a virus attack, and despite the number of times I may tell him to keep his OS/Virus Scanner up-to-date, I know it's just a matter of time before I'm back there again...
---
Any man who can drive safely while kissing a pretty girl is simply not giving the kiss the attention it deserves. -- AE
Messenger is such a valuable service to me... how can I live without it?
They say the first thing to go is your penis. Well, it's either that or your brain. I forget which...
Could I get your IP address please?
Insert offensive troll-style sig here. Please mod or respond appropriately.
Unfortunately our sysadmin seems to have blocked microsoft.com (including Windows Update) at the proxy. I kid you not.
:-)
Fortunately I'm in Development, not IT Support
Of course this is another headache for admins still patching for last month's RPC flaw."
That RPC flaw, patched twice so far, is actually still vulnerable. That's right the RPC service will require a third patch.
Security experts have discovered that a vulnerability still exists in the Microsoft RPC service. Furthermore, an exploit has been developed as a proof of concept. The results have been reported to Microsoft but, as yet they have not responded publicly. So, be on the look out for yet another RPC security bulletin from Microsoft. Hopefully, coming soon.
Guantamano Bay awaits you... You've just encouraged someone to commit a terrorist act against the United States, and I'm not sure if that's not an act of terrorism all by itself. Yes... they might just come for YOU, dear borgdows (#599861) and throw the book at you. That's the same thing as publicly asking Osama Bin Laden to blow up the Statue of Liberty. The next number you will be known by, dear #599861 will not be your slashdot number.
Microsoft discovered a MAJOR flaw in their naming convention. It seems it's far too easy to confuse MSN Messenger with Windows Messenger do in part they are both called Messenger, also due to the fact that Windows Messenger isn't widly used, except by sys/net admins telling their users the system is going down.
Getting users to actually peform updates when they don't have the ability to tell the diffrence between the diffrent products has proven to be most troublesome to Microsoft.
This flaw was noticed by technical support when users asked for assistance with "outlook" not knowing that "express" was a diffrent product. Not to speak of the diffrences between Windows Explorer, Microsoft Explorer, and the new hardly ever works MSN explorer.
"The idea that users know the diffrence between Windows, Microsoft, and MSN is ridiculous" --- typical power user.
A new convention is required based on the following facts
Windows - the operating system side of things
Microsoft - the software side of things, stuff you actually use
MSN - the ISP side of things, fluffy click shit that causes your computer to crash and burn.
Renaming should be as follows
Dont touch me crap - reserved for operating system level software
Play with me crap - the software you typicaly get to do stuff
Can't do crap - the stuff internet related that never works right
Now saying that there are patches for the "don't touch me crap messenger" has some meaning to the average user, vs their "Can't do crap Messenger" product.
This message was brought to you by Microsoft Crap, where did your document go today?
There is no sanctuary. There is no sanctuary. SHUT UP! There is no shut up. There is no shut up.
disable the Messenger Service immediately
Good advice. This service has been abused for many years now by spammers, and now the posibility of a worm using it.
I wonder who/where at Microsoft considered it a good idea to enable this service by default and to allow connections from everywhere. Has anyone out there actually used it?
In my previous job, there were 4 guys administrating over 1500 Unix Workstations and servers, and 150 techies taking care of 3000 WIndows PC.
Now I'm in a small University department, we're two over-worked techies with about 50/50 Linux/Windows machines and let me tell you, this Windows crap is taking up all of my effin' time.
We're firewalled, we've got NAV Server and clients running on all workstations, and were almost up to date until some student brought in an infectected notebook (I call 'em whores now) on the internal network.
By the time arpwatch bleeped it was too late.
Now you're telling me I've gotta go back to all those stupid workstations and patch each individually again?
ARRRRGH!!!! I HATE WINDOWS!
This is such a waste of my time, I could be coding instead.
--
Pfff.
why noit allow user sto disable MSN completely with uninstall?
oh that is right Bil lgates doesn;t trust us lowly users..
Don't Tread on OpenSource
Just to let everyone know, this morning after late-night patching my company's Exchange 2003 box it isn't sending/recieving internet emails (*cue Exchange jokes...now*).
I'm currently paying $250 so Microsoft can tell us if this is the correct behavior (oh, the humor), after asking them last night if all patches were approved for a Windows Server 2003/Exchange 2003 environment, and them telling me yes.
I know I'm in the minority for not using sendmail, but I am of the opinion that these patches may damage your system. Admins beware.
A few months ago, my sister-in-law and her husband bought a new computer (loaded with XP as most are). They are average users: they browse the www, send email, write letters, and play games. The know how to use their box, but they don't know how to administer it. So everything that was shipped as default was still default -including the messanger service. They are on cable modem and were getting constant popups (and I mean constant, like one every 30 seconds) over the messanger service. Now multiply that by millions of people and you have millions of potential DDOS zombie machines, or spam spewers, or any other nasty (or illegal) thing you can imagine.
It is time for MS to immediately change the default shipping configuration of XP to turn every service off by default because no desktop should be listening on any tcp by default. If that means they need to recall and replace all the master disks that they license to OEMs, then they need to do it. They need to have every major retail outlet yank all the shrink-wrap boxes and replace them with new one with secure default configurations. MS is sitting on $46 million in cash, so they can easily afford this expense as chump change. It just a question of whether they are willing to admit fault and buck up for failing their customers or if they are too greedy to spend some of their hoarded wealth.
Updates are coming out at the regularity of snot from a sick kids nose, yet people seem shocked when a new batch come out. If you can't afford the specs to run SUS then why not just set automatic updates to install in the background on each machine?
--
Sorry.. I think that should be $46 billion in the MS cashbox.
[1] your corporate firewall should keep any exploiting worm out but there are still floppy drives, possible unauthorised modems and third party connections that *may* allow the thing in, so you'll have to patch to be on the safe side.
When I am king, you will be first against the wall.
"Welcome to the Win2k KB828035 Setup Wizard...
Before you install this update, we reccomend that you:
- Update your system repair disk
_ Back up your system
- Close all open programs"
Now, I can see closing all open progams, but backing up my system before installing an update? Microsoft, quality is job one.
Mod me down and I will become more powerful than you can possibly imagine...
I haven't confirmed this on all my machines, but when I installed the updates on one yesterday (I always update one machine, and if nothing important breaks I do the other one) Synergy no longer starts automaticly on boot, it works just fine starting when I log in. (I normally log into one comptuer, and then from there log into the other)
Everyhing you listed are *application* flaws with the possible exception of ipmasq and even that is optional. Nothing you listed is a core OS flaw or a "default" configuration issue, unlike the many many problems with windows.
funny nothing you listed was a LINUX FLAW.
please come back when one of the kernel services has a flaw..
By this argument, none of these vulnerabilities should be held against Microsoft since none of them affect the Windows kernel (kernel32.dll).
Please, at least apply the same criteria to both systems. Linux is just as worthless with just the kernel as Windows would be.
Not to mention, I haven't seen Microsoft include a WEBSERVER in the kernel space yet.
Isn't this enough reason for people to migrate to Linux? (or a Mac at least?) I mean seriously.. their RAD (Rapid Applications Development) program is the cause of all this trouble. Putting out software that has more holes in swiss cheese really doesn't help the public.
!@#$% whole-grain cereal. When I want fiber, I eat some wicker furniture. - G. Carlin
It is an undocumented remote administration capability :)
... but doesn't *everyone* disable/uninstall messenger service? Even tho I'm a huge fan of Linux, it doesn't mean I don't know my way around windows. Whenever I setup a new XP machine (for anyone), or advise someone on setting up a new machine, I have 3 requirements: no spying(adaware, xp anti-spy), no viruses (virus software like avg, mcaffee or norton), and a firewall (either hardware or software, like black ice, tiny personal firewall, which they used to give out ver 2 of for free.) I also don't trust the firewall that comes with XP, looks like a tiny stateful firewall, which doesn't block outbound connections, so someone with a virus can still spread it.
I just went looking for XP Anti-Spy and the german site looks like its down or changed, but this looks like it might be the newest version. These are all options which should be standard with Windows, or at least steer the customers in the right direction (using other companies' products, instead of something recommended/influenced by MS).
Everyone knows there's a bit of hardening that needs to be done to Linux/Unix systems... what about hardening for Windows systems? Many folks will argue "it's not for normal joes" but I'm sure sooner or later it will become part of standard practice. Do you think seatbelts were a major concern with the first automobiles? How many people jump in their car now and fasten it without even thinking of it?
FLR
1. Regarding MS03-041: I have a simple XP professional (32Bit) running on my computer. This OS is neither listed in "Affected Software" nor in "Non Affected Software". So is it semi affected or what? And where can I get the download?
2. I am running a German version of XP, so all services have German names. What is the "Messaging Service" called in the German version? The closest I could find is "Nachrichtendienst".
Signature deleted by lameness filter.
That I've not been able to get Windows Update to work for over a month. Has anyone else experienced this problem?
'And all the monkeys aren't in the zoo Every day you meet quite a few...'
And quite frankly, I'd be surprised if anyone really does anymore.
Once spammers learned how easy it was to use the Messaging service to send almost anonymous spam a couple of years back, me and damn near anyone I know not behind a firewall turned it off.
Or did spammers stop sending dozens of nice popups a day to random IP addresses sometime between now and then?
Endless arguments over trivial contradictions in books written by ignorant savages to explain thunder in the dark.
Already patched... with Mandrake 9.1
No fair! I have auto update and that's not applied on my systems
The flaws aren't good, but it's good that Microsoft found them. The pace of MS finding bugs seems to be picking up lately; maybe MS's trustworthy computing shtick is finally doing some good? Perhaps MS will finally get on the ball about security!
using namespace slashdot;
troll::post();
Of course a firewall will offer some protection but shouldn't be relied on.
Check.
Unfinished poetry composition from RPC...
"Provided by the management for your protection."
This link tells how to disable the service on various Windows platforms.
Not being a Windows expert, what does Windows Messenger really do in a system? When you go to disable it, all Windows tells you is that you shouldn't because other service might depend on it. Other than that, there very little information. Anybody know? Obviously if MS says to disable it until further notice, it can't be very important, but then again it might break something that they are not considering.
Well, there's spam egg sausage and spam, that's not got much spam in it.
One of the first things I do when I install Windows on a computer in my office is disable Messenger outright. It's simply not worth the aggrivation of dealing with it.
Ever since spammers started using it a few years back, it just wasn't worth the nuisance of dealing with it.
I also received a notice on Exchange server, MS03-046 and MS03-047.
Kernel32.dll is not the Windows kernel - that would be ntoskrnl.exe. Kernel32.dll contains the Win32 functions.
--
Reverse outsourcing: it's the future
Not that I am trying to jump on the MS-bashing bandwagon, but these vulnerabilities take on new light when you consider MS is trying to get into the BIOS level ( http://www.geek.com/news/geeknews/2003Oct/gee20031 008022103.htm ) Soon we can expect even our hardware to be vulnerable.
What gets ms, is the dismissive attitude MS takes when announcing these flaws. True, these are out "before any known attacks", but if you look at the nature of them, they should all have been patched years ago. this is not the first time these services have had such vulnerabilities. The problem is that Ms patches the symptom, but doesn't address the nature of the vulnerability. Thus, every once in a while, someone figures out a way around the last patch and the cycle starts over. How long did the last RPC patch last?
Security should be about reinforcing the OS, not placing a sheet of playwood over the offending hole and hoping that no one notices the one next to it.
Microsoft released yesterday a whole bunch of critical security updates.
... Of course a firewall will offer some protection but shouldn't be relied on
Their new policy is to release monthly updates unless an exploit already exists, in which case a patch is immediately released.
Out of these, MS03-043 is a flaw in the Windows Messenger Service
You don't know what you're talking about, submitter Dynamoo. Please, tell us why one shouldn't rely on a firewall? If you read the technical documentation about the flaw you see "If users have blocked the NetBIOS ports (ports 137-139) - and UDP broadcast packets using a firewall, others will not be able to send messages to them on those ports." (under "Technical Descriptions"). I think I'll ignore your advice and keep a firewall in place, no matter what OS I'm using.
I want to shoot the Messenger, but it's hard to tell which one!
But not to worry, visiting the MS link in the post and following the directions cleared up the issue.
For over a year now, Leo Laporte from TechTV's The Screensavers has been saying that Messenger Service is a security hole but Microsoft kept saying, "It's not a hole; it's a feature." Guess now Microsoft will turn off Messenger Service by default. Or, maybe not.
It's all fun and games until someone loses the key to the handcuffs.
Your problem is that you did not follow Microsoft's best practices. If you had, you would have done as Ballmer has been preaching, and Secured the Perimeter! Which really is just PHB speak for never putting a windows box on the internet without a Linux firewall to protect it. Why do you think microsoft has started using Linux as a proxy service for their website???
I have come to a conclusion that one useless man is a shame, two is a law firm, and three or more is a congress -J Adams
ad 1 - XP Professional would be the XP "Gold" listed under "affected software". I haven't seen it called "Gold" before, but once you follow the link, their naming scheme reverts to the familiar "Home" and "Professional" editions.
. aspx?di splaylang=de&FamilyID=F02DA309-4B0A-4438-A0B9-5B67 414C3833
You can download it here:
http://www.microsoft.com/downloads/details
(mind the gap!)
ad 2 - "Nachrichtendienst" is the one, yes.
By this argument, none of these vulnerabilities should be held against Microsoft since none of them affect the Windows kernel (kernel32.dll).
But those haven't been claimed IN A COURT OF LAW to be part of the OS. If there's a flaw in something MS claims is part of the OS, then, they take the bad with the good and get it docked against the OS.
Not to mention, I haven't seen Microsoft include a WEBSERVER in the kernel space yet.
And, yes, IIS runs partly in kernel with IIS 6.0 on Win 2003
This comment stands at "+2 Insightful" (hah), with no negative moderation, thereby confirming this site's reputation as the online capital of anti-social, thoughtless free-software zealotry.
As much as the Micros~1 community likes acronyms, throw that one on the fire. Hell I bet it becomes one of the most widely used acronyms around!
Back to KDE(Desktop)/OpenOffice(Office Suite)/xmms(winamp)/Acrobat Reader(duh!)/NFS("File share")/Gimp(Photoshop).... Ahhh what a beautiful day. Isn't it?
Glad I'm not a Windows Operator (no such thing as a Windows Sys Admin)...
At least administrators can disable the Messenger Service remotely.
:-)
If you haven't patched yet, I'm guessing anyone can disable your services remotely.
kernel32.dll is more like glibc than vmlinuz. The "dll" bit should have tipped you off.
All's true that is mistrusted
> Microsoft released yesterday a whole bunch of critical security updates.
Their new policy is to release monthly updates unless an exploit already exists, in which case a patch is immediately released.
How, exactly, are you contradicting the author?
> Of course a firewall will offer some protection but shouldn't be relied on
You don't know what you're talking about, submitter Dynamoo. Please, tell us why one shouldn't rely on a firewall? If you read the technical documentation about the flaw you see "If users have blocked the NetBIOS ports (ports 137-139) - and UDP broadcast packets using a firewall, others will not be able to send messages to them on those ports." (under "Technical Descriptions"). I think I'll ignore your advice and keep a firewall in place, no matter what OS I'm using.
I don't believe the author is telling you to remove your firewall. The author is saying that it shouldn't be relied upon. There is a significant difference. Because some other machine behind the same firewall might become infected, a firewall is not a perfect measure for protecting against this attack. There's a well worn phrase for this problem - "crunchy on the outside, chewey on the inside."
So, again, please explain how Another rabid submitter gets it wrong?
I forget what 8 was for.
> Of course a firewall will offer some protection but shouldn't be relied on
;-)
What kind of crack are you smoking, and where can I get some? A firewall will offer complete protection, and should be relied on to protect you from exactly this kind of situation (and more!). I'm sure your point is that using a firewall is no excuse to not apply security patches and while I agree, this anti-firewall propaganda has to stop!
-Nick
http://ars.userfriendly.org/cartoons/?id=19990911 for every time Windows crashed...
Check out this User Friendly strip...
I was just over at the beast reading about the new security bulletin service and came across this under the 'What customers tell us' section:
Customers are concerned that Microsoft releases security patches too frequently
Wha?!? So, customers are saying that even if some critical flaw is found, M$ should wait awhile before releasing it because Joe Admin is concerned there are too many patches??
Come on, if they know something is broke I want a patch ASAP (after proper testing of course). I don't care if they release a patch an hour, if something is broke -- Fix it now, don't wait until next week because you've already released your quota of patches for this week. This sounds like BS to me, maybe M$ just stuck that in as an excuse to not release patches.
Later they say an exception will be made if they determine the customers are at immediate risk. I'm glad they know my system so well, but really, please just release the patch now and I will decide if MY system is at immediate risk.
you're all figments of my deranged imagination
Was there a "Yet Another Ssh Flaw?" Does michael follow the link in my sig and post about all the flaws that come out monthly (compared to these new four)?
Of course not. And you won't see it reported, either. Because Slashdot is biased against Microsoft and wants your page hits.
I dare you to argue otherwise, because it's just too obvious.
"Sufferin' succotash."
The last worm, I was only 2 hours off of when I thought it would come.
I am saying this worm will probably come early November around midnight EST. (Nov 13th)
Official bid: Nov 13th 0000 hours.
Any other bidders?
~ kjrose
Lets be perfectly honest. With all news, if a story becomes repetitive it is no longer news. I think the "Windows Bug" thing has slipped into this chasm. Its no longer "new" and no longer interesting. Use windows at your own risk.
I installed the patch on several machines yesterday. One of them demanded a supplemental EULA. I have not been able to reproduce it on the other machines, so I paraphrase from memory. It said, among other things:
.net benchmarks"
.net framework but judging from the EULA I wonder if that happened and that's why this EULA popped up.
"I will not publish the results of
I have never (intentionally) installed the update that installs the
In any event, this clause casts a chill over me.
After I busted the guy on IRC, he had the nerve to ask me for a shell account. Told him to fuck off, while I did a full reinstall from scratch. Even though he promised he only added an account for himself and didn't compromise any other binaries, it's not worth the risk (esp. since the install was less than an hour old).
Opportunity knocks. Karma hunts you down.
Every time I do tech work for my friends *sigh* I usually end up haveing to reinstall windows xp. God forbid they move to a different OS, but I digress... The first thing I do when the machine is on is turn off MS Messenger. I have met people that have no idea what it is and how to turn it off, including high level CS students here at university
This is how you turn off MS Messenger:
- Go to your main directory
- Then WinNT
- system32
- then find the file called services.msc
- you will have a list, find messenger on it
- disable it
While there, take a close look at what else microsoft has running, and see if you need all of it - perhaps remote PC access?
This is the first thing I do when turning on a cmoputer for almost anyone running XP; there is never any need for it. I've done it for families with kids, and have had the parents genuinely thank me for getting rid of the lewd popups their children are bombarded with.
There are actually three similarly named components: Windows Messenger Service, Windows Messenger and MSN Messenger. I found this article via Google which does a pretty good job of explaining the difference.
I actually turned this service off back when I first installed...what exactly is it good for? I see tons of "services" running, that I'm assuming don't necessarily need to be (though I've learned through trial-and-error that turning some off, breaks things).
As much as I like slashdot, as a critical thinker, I have to entirely disregard its claim to be "news" when it is so obviously biased. This is not news, this is propaganda, worse than FOX news at times. Showing MS as a Borg Gates is hardly objective, which ought to be the goal of any self respecting news organization. How about we change the Linux penguin to him molesting small animals or children? That would be just as ludricous as this purported "news" about MS.
Oh, BTW, I *do* use and run Linux (dyneBolic CD), so all you haters can shove it up you know where. One other thing -- I am a programmer, so I know what open source and that is all about, I like it, but I can see its flaws as well, unlike all you other zealots.
I used to like this site more. Too bad its bias ruins its integrity in my eyes, just like FOX news "Fair and Balanced" BS.
I'd post more, but I have to save my bandwidth for downloading half a gig of patches for one of Win2K's lunix contemporaries.
Is the cognitive dissonance kicking in yet? Are you feeling compelled to slap this as a troll, rather than actually looking into how many patches there are for lunix systems? Do we care about the lunixatics that got rooted by ssh or sendmail vulnerabilities down the years? Can we even acknowledge their existence? Do we remember the FSF's ftp server getting hax0red out from under them?
Hello? Hello?
If you were blocking sigs, you wouldn't have to read this.
I guess MS coming out with patches is a good thing. Is this part of a new MS initative to seriously make Windows secure?
EvilCON - Made Famous by
I just installed the patches on the Trial version of Windows Server 2003 I have at work and it locked the machine "hard". Power cycle was the only remedy. And this is the OS they want me to replace my Linux servers with??? Long live OPEN SOURCE!!!!!!!!!!!!!!
Because they get that proxy service from another company and have no power over how it's implemented.
It's not like they wouldn't use windows version if there was someone offering it (after all, even if it's worse or more expensive there's the PR win over FUD-spreaders like you).
Of course this is another headache for admins still patching for last month's RPC flaw." Kudos to admin's still patching one month old holes.
I thought this might be relevant in that we're discussing patching related to this (giant gaping) hole. Has anyone figured out why this 043 patch modifies the Workstation DLL? I can understand its interaction with the messanger service DLL, but why Workstation?
I wouldn't worry about rapidly patching a large number of workstations with just a modification of the Messenger service, but now that it's changing a major DLL--and knowing the reliability of some MS Patches--I'm concerned at this point. Also with changes like this, Is it possible this hole is deeper than what was originally stated?
"God is dead!" - Nietzsche
"Nietzsche is dead!" - God
$a = int(rand(5));
if ($a==0) { print "Security flaw in Windows discovered!\n" }
elsif ($a==1) { print "IBM invents new higher density storage.\n" }
elsif ($a==2) { print "Intel announces faster CPU.\n" }
elsif ($a==3) { print "G5 fastest CPU on desktop.\n" }
elsif ($a==4) { print "G5 not fastest CPU on desktop.\n" }
Doesn't it make you feel good to know that our freedoms are protected by politicans, lawyers and journalists.
This begs the question, what would happen if several thousand users decided to "go on strike" as it were and simply withhold moderation points. Seems to me that if enough users did this, we would see a similar moderation point shortage.
On the other hand we have nearly 800,000 slashdot accounts theses days, and the possibility of any of them agreeing to anything to accomplish this would be about zero.
You want to creative, be unique? Create a worm that patches people systems with the lastest patches!
I guess we would do, but I doubt it would be a huge problem, since mod points expire anyway.
A friend and I wrote an app to handle that, users have to take a 'free' machine from the screen in the counter or get into the virtual wait line if there was none. The app did a 'net send' to alert users when their time was up and there was another user waiting, we had to update the messaging services on the win95 machines so they were able to get along the 'brand new' NT 4 machines
The application was enhanced later, by me and others, to handle stadistics and others alerts like annoying library dues and 'not enough sheets in your credit for your print work'. It was still running (although very modified) last time I was there (spring). I think that 'net send' was a very helpful admin tool for windows networks. ( I know unix has it since the down onf times)16,777,216 comments ought to be enough for any forum!
Context and Guilt by Association. This is Slashdot. Slashdot is very much engrossed with Linux, the Linux community and Open Source.
tasks(723) drafts(105) languages(484) examples(29106)
I just patched with Redhat 9. I have a whole list of microsoft bugs I don't need to worry about.
You'll never be locked out with Microsoft. We make windows that anyone can open from the outside.
Terrycloth Lobster
Not being a Windows expert either, but our standard setup has been to disable the messenger service to kill annoying messages from print servers that were so proud of actually printing a job that they just had to tell somebody (everybody?) about it. I think Windows Messenger and net send can be used to annoy people. If for some reason you depend on these annoyances, you probably need it.
What would happen if microsoft wrote its own worm to patch the holes that allowed the worm onto the computer in the first place?
Then computers that are most suseptable to the security hole would be first to get the worm that patches the hole.
I know this would never happen as this would leave microsoft liable for anything the patch might brake.
You mean all those emails I get about there being a new Microsoft Critical Update weren't lying? I've just been deleting them....
Seriously though, I wish Microsoft would put out as many patches as those stupid emails I get say. After a few months at that rate they might have a stable OS for a change.
Punctanym: alternate spelling of words using punctuation or numerals in place of some or all of its letters; see 'leet'
I have been forced into the c# world and VS.Net. After applying thier damned patches my development environment is all screwed up (links to web projects). I want to kill, see dead burnt bodies...kill.
I haven't seen an easy way to disable a service for a few hundred/thousand systems at once, so I cobbled together a quick hack with psservice to turn them off while I looked, since my corporate network has a TON of boxes I don't control which will likely remain unpatched for ages...
/F "usebackq delims==" %i IN (`cat messengerActive.txt`) do psservice \\%i stop messenger
r vi ce.shtml
My hack follows, but if there's anyone here who knows the proper windows way to disable services on lotsa machines remotely (my hack just stops them) please respond...
my hack - 3 steps:
1) psservice find messenger| > messengerActive.txt
2) munge file so it's just a list of machine names - a programmable editor like gvim makes this trivial
3) FOR
http://www.sysinternals.com/ntw2k/freeware/psse
It won't stop me from patching, but the only "use" I've found for the Messenger service is for spammers to send me annoying popups. At least browser popups require some action on my part (viewing a web page), but these Messenger popups come out of nowhere. So I say disable Messenger and forget about it if you haven't already.
have no power over how it's implemented.
They have POWER. They have $40 billion dollars of liquid power.
It's a free market. Microsoft(tm) should be able to either pay Akamai to use Windows(r) servers, or go to another company that does.
And if there's no company that does, it tells us a salient fact about the suitability of Windows for critical, high-capacity servers.
Upgrade! Don't you love how you are forced to use the latest-and-greatest? 98 is retired, get XP or 2k
Hello.
Why do people find it necessary to making linux/windows comparisons everytime there is a security issue out, instead of a more productive discussion about the vulnerability itself ?
Do we remember or care about those incidents and vulnerabilities ? Of course. Does any serious admin recognize the security history of any OS that he runs ? Of course. I'm well aware of the amount of patches there are for the many OSs I run.
Will there always be people on slashdot such as yourself posting irrelevant sidenotes designed to start an argument with an obviously biased audience ? Apparently, *you* are proof of that.
Getting the slashdot crowd to argue with you about the security of Linux and Windows is about as challenging as guessing the color of the sky.
You must feel so proud of yourself.
Next time, try posting a comment that is productive.
p.s. the number of posted patches for OSs mean nothing when used in any arguing the security of an OS, because the severity of each has implications depending on too many variables. (application, use, adoption, vendor, etc.)
On Tuesday, I got two new servers in. Both came pre-loaded with Win2K3 Server. Naturally, I decided to update them before putting them in production... I hit MS Update, left all of the default Critical patches and let it install them. On bootup, BSOD; reboot, BSOD; reboot, BSOD etc etc....
Had to re-install the damn thing...
I manage a small IT staff with limited resources and keeping up to date with all of these security fixes is getting costly. Instead of working on projects to improve my systems. I really have to switch over to linux.
All that is necessary for the triumph of evil is that good men do nothing. --Edmund Burke
Well it looks like you're screwed if you do and screwed if you don't!
Just applied them to one of our w2k DCs and it's FUBAR!
gonna try and revert one at a time and see what went wrong... meanwhile I have too many lusers screaming...
Well, it makes sense, after getting all those pop up ads to visit porn sites through the messenger service, that it finally catches up with me and i get a virus.
If they're spending all their time patching, they don't have any time to fix the underlying problem.
Clear, Dark Skies
I have friends who run XP, and I want to help them secure their systems. I'd like to know what software firewalls people recommend for XP.
Every time Zone Alarm gets mentioned, someone says "don't use that, it sucks." So I guess not Zone Alarm.
How about the software firewall that is included with XP? Is that any good? (I hope so, because I don't want to make my friends spend money. Free-as-in-beer is a good thing.)
How about Norton Internet Security? BlackIce Defender?
steveha
lf(1): it's like ls(1) but sorts filenames by extension, tersely
" Sure, like everyone is going to get out the source code, go through it to understand it and then code up the fix. Not !!"
It's that sort of response that reflects the inherent cultural problem with regard to computer security. If you don't want to fix it when you can - well, shucks. Pay someone else to do it. Or sit around and wait for patches. Your choice.
"What's the point of having these news articles warning about MS exploits ? And don't tell me that it's so you can protect your own systems. If you want people to protect the *nix systems then put those warnings up instead. In the previous two weekly CERT warnings there was something like nine Linux warnings and virtualy no MS ones"
Good question. Ask CERT why they stopped bothering with Microsoft warnings.
"You just get that warm feeling kidding yourself that Linux is better but you'd get that same feeling pissing your pants."
Though I didn't say GNU/Linux was better, your retort shows a prejudice for anyone who speaks a similar opinion. Perhaps you're not reading very well. That may explain your potty humor as well.
However, can you say that one company being responsible for patching the majority of software in the world is a good thing? Maybe YOU think so, but there are a lot of people that disagree. I just sounded off. You did too. I decided that your ideas, propped up with a urine fetish, were thoughtful reflections without substantial understanding.
"You'd all be better off spending the time cross-training to Microsoft platforms for when people get wise to the Linux 'benefits' rather than repeating the same old crap about how bad MS code is."
I write and edit articles related to IT certifications, and was heavily into Microsoft coding for about 12 years. Not VB either. Perhaps you're a disgruntled VB 6 developer who doesn't have a target for his angst because you still have candles lit at your altar of Gates?
So I respond: Get to know GNU/Linux. Get to know BSD. Get to know who to call when you need things fixed.
You come to Slashdot, which deals with thousands of trolls a day - and can handle such posts as your own with disdain. LAMP, kiddo. LAMP.
Have a nice day. I'd advise taking a nap.
a NEW "security initiative"!
It's deja vu time!
It's January 2001!
I'm so disoriented!
Microsoft plans Windows overhaul to fight hackers
Richard Steven Hack - This sig is TOO GODDAMN SHORT TO DO ANYTHING USEFUL WITH! MORONS!
Here's a thought for ya. Culled mostly from other posts here on Slashdot, with a little bit of glue code to really make it hurt.
Take, say, Nachi. Exploits a remote roothole to infect without any interaction from the user. Now, write it so that it doesn't crash the system (which it doesn't; Nachi applies the patch to close the hole behind itself, then starts blast-casting itself). You now have a system that will run arbitrary code for an indefinite period of time. So far, nothing new. Here's the scary part:
The arbitrary code wipes your drive. As pointed out in this post (I don't vouch for its veracity; I'm not a programmer, 'specially not in ASM), the code to wipe a drive is about 12 lines of ASM. You could also mess with the BIOS.
Now, put that code on a delay of random(1-5) days from date of infection, so it doesn't get caught immediately. Also, add a two or three days from the time of initial release to give it some spreading time before anything starts getting deleted. This way, it propagates thoroughly before people really know what's going on. All this time, it should be blast-casting itself to infect as many hosts as possible.
Now, the really fun part: when it infects a host, it should open a port (possibly random) and run a daemon to listen for incoming connections. As the infected system broadcasts itself, it should modify the code with its own IP address. The new client will then call home, back to the machine that infected it, to check on its status. If the host is unreachable for, say, two hours, it should assume that its parent has been discovered, and that efforts are underway to clean it. (It should try to contact the server upon initial infection to ensure there's a path back, to prevent premature triggering as a result of NAT, firewalls, etc.) It should also look for attempts to find its directory, run virus scanners, patch the original hole, disconnect it from the network (have it ping its router or somesuch), etc. If it detects a threat to itself, it will run its payload immediately, destroying the data on the machine, preferably in a manner such that recovering the virus code will be impossible (to slow reverse-engineering); possibly combine with encrypted code and cryptographic wiping. You could also pass data to it through this connection, to change the code or give immediate execution instructions. This would have to be done carefully, lest a bad host or a dialup user trigger premature execution.
For bonus points, have the virus silently make minor changes to files, instead of simply wiping the drive. Maybe some of those changes can make it to the backup snapshots before things are discovered. Depends on which is more damaging. Alternatively, write a client that will run for an hour, change a few files and infect the world, then securely delete itself (but leave the hole open), so that the damage, and even the infection, goes unnoticed.
This is a hardcore malicious attack. So far, everything's been skript kiddiez, just playing around. Anybody who's going to write something like this is going for the jugular, so assume he'll do the same thing for the initial infection. Give him about three dozen people (hrm, where could we possibly find three dozen people who'd like to bring the USA to an economic standstill?) armed with laptops with ethernet and 802.11b connections. Send a half-dozen to Washington, DC; New York; Dallas; LA; and Seattle with a list of wireless hotspots (go through the airports: business travellers with laptops. Score!) and public access areas (libraries, universities (the student union and libraries are popular places to have open access), Starbucks, and cybercafes). Send the rest out roaming; universities are great (University of Oklahoma has publicly-avialable connections in the union, both wired and wireless). Have them all start operating at about the same time, and infecting every available host. Hitting laptops and suc
Moderate drunk! It's more fun that way!
Would this be the same Bush from the Bush family that were VERY friendly with the Bin Laden family all those years ago?
They still are. In fact Bush Sr. works as a consultant to the Bin Ladens. Bush Jr. has declared the Bin Laden family and their connections to the Bush family off limits to all investigation as well.
...to the recent crap-flood of viral/Trojan e-mails bearing Microsoft's logo and purporting to be network security updates?
I'm not suggesting that the e-mails are legitimate security updates (they're not), only that maybe this recent official security update is somehow a response to this latest rash of opportunistic virii/Trojans.
The flood of bogus viral e-mail is bad enough, and thankfully my Mac is immune to Wintel viruses, but the sheer volume is affecting me by displacing legitimate e-mail in my inbox. It's put me over quota once already.
"From a 9.1 install you most likely have openssl updates to perform....oops."
Right. As opposed to a Windows install, where you have a few upgrades of your own to perform.
The people running university computing labs have noticed that if you leave a default Windows2000 installation connected to the internet for long enough to download the upgrades, you're likely to have already been infected by one of several Win2K worms which can install without user interaction using the messenger service. Some people had so much trouble keeping new Windows PCs working for long enough to update (during the peak of these viruses) that they had to download the upgrades from other peoples' computers.
(The people who knew how to switch Windows Messenger off and install the firewall or already had the update CDs, these people are probably administering other peoples' Windows computers, not using their own)
In comparaison, somebody using an old version of Mandrake could get a denial-of-service if they use SSL connections and the server they connect to specifically attacks them. So I can probably just about manage to upgrade the packages without having to worry about the system rebooting.
Looks like OpenSSL upgrades it is then...
phew, took me a couple minutes to pick my self off the floor after that fit of laughter...
This update has a serious problem. I had the *exact* same symptoms as this guy.. be warned!
In other news, the sun came up this morning. The sky is blue, and Microsoft bashers flocked to Slashdot all day.
Microsoft releases security patches nearly every damn week. When are we going to stop reporting non-news from companies just because we like to bitch about them in public?
"Gold" is a older industry term. It has been replaced with "RTM".
"Final (after beta) retail release" is what it means.... in the context you describe, I would say they mean "prior to SP1"?
Just speculation.
Your search - Domino Administrator wanted - did not find any openings.
--Monster.com
Monster.com has 26 jobs listed.
Dice.com has 20 jobs listed.
JustNotesJobs.com has 16 jobs in the U.S.
If you are going to troll, at least do it correctly.
---
The problem with finding Domino Administrator jobs is:
1. The people in those jobs are rather highly paid for an computer administration position. In 2000, Certified Lotus Professional System Administrators averaged $89,000.
2. They do not need to worry about viruses beyond choosing and installing a mail filter/virus protection, since no viruses have hurt Lotus Notes yet. The virus protection checks those virus-prone Word files, and helps if users are using MSOutlook as the mail client.
3. The number of administrators needed for a company running Notes and Domino is much less than the same company running Exchange. This is anecdotal from personal experience. I know a 500 person company that grew from one person doing Notes Admin work part-time in a computer department of 2 people to 2 full-time Exchange Admins with 10 people in the computer department, at a time when the company was shrinking. A 30,000+ employees company went from 10 Notes administrators maintaining their own servers to 60 Exchange administrators with the servers maintained by a different group. This is only the Administration side, application development costs skyrocketed while application rollouts almost disappeared after the switch.
Domino Administrators are happy, and companies of any size do not need very many of them. There is little turnover, and so there are few jobs to be filled. (Besides, who is going to quit with today's job market?)
---
To be on-topic, Lotus/IBM releases updates at least quarterly. The updates usually add functionality, and fix crashes due to very unique circumstances. I only remember 2 that were for security issues. One was only an issue if the option to use MSIE as the browser was selected. The other was only an issue if Notes Designer was run in a certain configuration without a firewall. None of the updates are "critical". I just upgraded one large company's server from Domino 5.0.2 because the hardware was being replaced.
To be fair, while Domino is a platform, it is not an OS. It relies on Unix, Linux, or MSWindows for its file protection. If you are running MSWindows, you may need some of these patches. Then again, if Domino is only running mail, web applications, and Notes client applications, you can turn off most of the vulnerable MS services.
I spend my life entertaining my brain.
Namaste
Joe User doesn't complain about the frequency of patches. IT pros are the ones who bitch about the frequency of patches. In this case, Microsoft is absolutely responding to pressure from its large customers.
When the CTO of a Fortune 50 company calls up Steve Ballmer and says, "How are you going to compensate us for all this time we're wasting deploying patches from you every other week?" you can bet that MS is going to come up with a way to ease that burden, or lose another customer to Linux.
They're trying to ease the IT burden by aggregating the patches into monthly releases (whenever exploits aren't already present) so that Admins have adequate time in between releases for testing, deployment, and preparation for the next batch of updates. It's a queueing mechanism, essentially.
My college computer labs had the same sort of thing hooked into the print spool. When you printed a document, it went into the spool. When it was finished printing, a "net send" type of message got sent to your workstation saying that your document was now in the printer tray.
It has it's uses, but it should never have been bound to the IP connection by default, without some kind of safeties.
- Give a man a fire and he's warm for a day, but set him on fire and he's warm for the rest of his life.
I totally agree that in that respect windows is flawed. It should have came out of the box with it's services disabled. But that isn't good marketing...
That being said I've installed windowsa a-many times and have yet to get infected with anything. Sole reason....firewall. I don't let every yahoo and nutjob from the web send my machine packets which means I'm fairly invulnerable to these lame attacks. I still patch my box but I don't worry about it as much.
Tom
Someday, I'll have a real sig.