Slashdot Mirror
Microsoft's Security Report Card
Decaffeinated Jedi writes "In January 2002, Microsoft launched an initiative called 'Trustworthy Computing' aimed at building better security into its products. It's now two years later, and News.com serves up a report card evaluating Microsoft's efforts. Kevin Kean, a group manager at Microsoft's Security Response Center, points out that customers are better off now than they were before the company made the move to refocus on security issues. An analyst quoted in the article, Stephen O'Grady, agrees that he would give Microsoft 'improved marks,' but also notes that the company is not yet where it needs to be in terms of security. He goes on to suggest, however, that 'the numbers indicate that they are at least taking it seriously.' It sounds like Microsoft might have earned itself an Incomplete on this report card."
Is any software really at the point where we can install it and forget about it?
Security is a job for all of us, not just Microsoft.
As long as hackers out there have the tuits to break into systems, security is everyone's business.
I have been pwned because my
Going from an F- to an F+ isn't something to get excited about.
now that i'm an MCP (sucks huh?) i'll be trying to get as many people away from the Microsoft platform to something more secure at every opportunity i can get :)
:)
i'm calling myself a trojan horse
Don't call me back. Give me a call back. Bye. So yeah. But bye our, well, but alright we are on a shirt this chill.
I would like to see some comparisons to Red Hat version 7.2 (since O1) compared to XP (in terms of security patches, not bug fixes).
Heck Red Hat doesn't even support it anymore! 9.0 is coming up too!
Funny, it seems to imply in the news.com article that less advisories are better than more... hell, I think my ol' comp running win98 went for many months last year without a single advisory notice when I clicking into the Windows update site. Pfft. So therefore win98 is safer than Server 2003... :P
0- Eamonman Proud member of DNRC
I thought an Incomplete actually counted as an F.
I think the appropriate grade for this would be an IP (in progress).
Does anybody remember the article where old Microsoft basically said it was the end consumers responsibility to keep things secure and not the developers? I'll have to find the article, but it's only a couple months old or so. I think the "report card" should be re-evaluated knowing that Microsoft really doesn't care about security like they claim to.
That MS is actually improving security is good for all of us.
It's about time, and they still have a long way to go, but increasing security gives less room for E-mail viruses, worms and other network-hogging exploits.
Hmm... Any chance of a class-action suit from people who do NOT use Microsoft, addressing the way their lack of security has wrecked important services for non-MS users?
After all, those of us who don't use MS have never accepted their EULAs, but they've still wreaked havoc for our systems.
Could at least lead to an even further increased MS focus on security, which would help everyone...
I'm a dreamer, the world is my playpen. But hey, I'm a serious person, I can't dream all the time.
And so we have a report card that wouldn't get you accepted to a state university, by the largest, most economically endowed entity in the world.
I'm sorry, Microsoft, but you have to be held to higher standards, not lower. Open source is able to do better with infinitely less.
If a bunch of hobbiests were able to colonize the moon, would we hold back any criticism of NASA?
Or maybe we've just figured out a better way of doing things. In which case, maybe the soft spot for the dinosaurs is somewhat warranted.
Just trying to figure out what needs to be updated is a pain in itself, unless you figure out that you need the MBSE. Then you need to wade through the security bulletins, which sometimes contain the patch (in varying locations of the document and with no fewer than two pages to go through to get to the patch) and sometimes tell you to go to Windows Update. Not an option when you're trying to cut a disc for a client, or are dealing with an environment that doesn't allow Windows Update for security reasons.
Grabbing MBSE and every available patch from the website and applying said patches to a fresh Windows XP installation took about two and a half hours, and was incomplete (MBSE reported four patches that weren't applied). Windows Update isn't appropriate for a fresh install because of things like Blaster that will automatically infect the system upon connection to the Internet.
Then, there's all the defaults they've got to have their system phone home, such as sa.windows.com for searches, IE automated updates, WMP automated updates (including DRM), ntp.windows.com, Automated Windows Update. Locking down a Windows XP system is an exercise in frustration.
Trustworthy computing? Methinks not. Linux/BSD/OSX may have their myriad security and design flaws (except OpenBSD, which has yet to have a remote root compromise), but Windows XP holds a special place in my heart. Microsoft has admitted they've got an issue with security, which is a good thing, but now they should really address it -- they should be doing everything possible for the user to take control of his/her system, instead of heading the other way.
It's about as big an oxymoron as Microsoft Works.
Striking fear in the authors of godawful fanfiction, I am here, appearing in darkness, Tuxedo Jack!
I am not quite sure if this is off-topic, but I'm going to take a gamble here :)
:) but I'm really bothered that this "report card" doesn't include anything from the myrad of unpatched internet explorer holes and the way microsoft relicenses PATCHES... I mean, really EULA's for PATCHES? what if I DON'T agree???
:)
:)
""There is an order of magnitude--more people using Automatic Update and downloading patches," Microsoft's Kean said."
This would be the system that gave the world the "DRM or be unpatched" situation, right? how trustworthy.... changing functionality along with a "security" patch
I know that bashing microsoft is a favorite past-time here
really HOW is this "trustworthy" ??
I am REALLY impressed by the stupidity of these "reviewers" and how easily people forget these sorts of things... cudos to microsoft PR... AGAIN
I REALLY needed to get this of off my chest
Fighting for peace is like fucking for virginity
Microsoft Security. What's it all about?
Well that's an easy answer. It's all about educating 'users'.
1. Don't open emails unless you are certain it is from a trusted source.
2. Keep your system patched
3. Ensure you have Anti Virus software installed, and up-to-date.
4. Use the firewall built into XP, or install one of the many free (for personal use) 3rd party firewalls, or even better look for an ISP that firewalls sensitive ports for you.
This is all basic stuff, but many home users don't really give a stuff if their machine is taking part in a DDoS attack, as long as they can still get to their email, view web pages, send instant messages and download pr0n (actually - forget the last one, that's us geeks)
Oh - I thought you said "at that point where we can throw it away and forget about it."
What a well worded articulation - almost Greenspan-ish like in a sense that it looks like he is saying something, but you can never hold him upto for "whatever he is saying." And I think this quote summarises the whole article well.
It is 80:20 rule or in Microsoft's case 40:60 rule. In the first year you move 40 % of the distance towards the the Security Goal-Post. So, "Customers are better off today than they were a year ago, . In the next year you move another 40 % towards the goal. So, "Customers are better off two years from today than they will be a year from today. . An so on and on ...
Now if the security Goal Post moves and you find yourself heading in the wrong direction, as it always does in Real life, you can frame your message as follows. You are now 60 % away from the old place. So, "Customers are better off today than they were a year ago, . In the next year you move another 60 % away from the old place. So, "Customers are better off two years from today than they will be a year from today. . An so on and on ...
So,
And how can you be wrong when you say it the way it is said. What a well worded articulation.
To see a world in a grain of sand, and then to step back and see the beach where the sand lies
- Tell the Air Force to secure a building, and they'll lock the doors and windows.
- tell the Army to secure the same building, and they'll post and roam guards.
- Tell the Marines to secure it, and they'll run in shooting and kill all the AF and USA guys.
Where does MS fall on that scale?Put identity in the browser.
SEMESTER 2, 2003
PRODUCTIVITY 101 3 HRS 80% C
ECONOMICS 307 3 HRS 100% A
CREATIVITY 92 3 HRS 67% D
GOV'T STUDIES 203 3 HRS 100% A
COSC 507 ADVANCED 3 HRS 78% C
MONO 302 3 HRS 100% A
BORE 405 3 HRS 100% A
THFT 305 3 HRS 100% A
LIES 205 3 HRS 100% A
SCUR 101 3 HRS 20% F
MONO 400 3 HRS 100% A
CONV 101 3 HRS 10% F
HID 205 3 HRS 70% C
OVERALL AVG. 78% C
This explains why mediocre rules the market.
I'm sorry, but after such large-scale security issues like Blaster and Klez, I don't think it's appropriate to give them any sort of improved marks. Sure, the patch might have been out.. But security is also about education.
[sig]www.masterslate.org[/sig]
Re-writing Windows from the ground up seems to me to be the best remedy. Forcibly breaking backwards compatibility should be a design goal.
Microsoft BS7799 certified?
|/________
|\A|ALYS|
It says here, Mr Gates, that you released 32 security advisories and 21 vulnerability fixes for Windoze 2000 Server in the first six months, yet for Windoze 2003 server you 14 flaw fixes and 6 critical issues...
Would this be because W2K3 server is based on Windoze XP code and that the majority of bugs had been ironed out already in the months between the releases?
hmmmm....
I've never shoed a horse, but I once told a donkey to piss off!
1. Don't open emails unless you are certain it is from a trusted source.
That's the big problem here. When your email client, by default, displays HTML and executes macros and scripts, you're extra vulnerable. Even if it's from your pal Bob that you've known for 40 years, his computer may have been owned by a worm and just emailed all his friends seeking to propagate. You say 'hey it's from Bob, I trust him' and open it. Boom, you're owned too, and may never know it.
Bad design is bad design, there's no two ways about it.
Outlook 2003 does none of those things by default. MS has learned.
that they've discovered their security problem is much bigger than they thought it was.
Sure they've progressed in terms of there's more known security holes fixed now than there was 1-2 years back, but there's also far more security holes that have been identified and at (seemingly) a much faster rate than 1-2 years ago.
In other words, 2 years ago, they rated a 4/10 in terms of security. Today, I'd say they probably rate 20/50. Overall, my impression is that they've essentially stayed in place in terms of removing security holes from their products.
If you think that I'm being unfair, consider how long it's taking new security holes to get fixed now versus 2 years ago - it seems to be generally longer.
Also, consider that MS has now taken the step of bundling security updates into big bunches, to ease the pain of applying them - that they've had to resort to this is a reasonable indication (IMHO) that the quantity of security holes being *fixed* has gone up significantly.
Finally, consider the rate at which security holes are being uncovered - it would have to start dropping off dramatically if MS was being successful in fixing their problems. That certainly doesn't seem to have happened.
O'Grady, agrees that he would give Microsoft 'improved marks,'
Have to agree there. Two years ago, it would have been a solid F (us) or 6 (de). Today it's an E (us) or 5 (de).
Assorted stuff I do sometimes: Lemuria.org
It's an oxymoron.
Seriously though, it's good to see that Windows 98 support has been extended. I shudder to think how many compromised Windows 98 systems there are out there now, let alone imagine how many there would be in 6-12 months time once vulnerabilities that hadn't been patched before support was dropped began to be exploited in earnest.
"Accept that some days you are the pigeon, and some days you are the statue." - David Brent, Wernham Hogg
Although Microsoft is knowen for its security problem the individual microsoft programmist is a good one . Microsoft don't make secure products because the programmers are directed from the menegment to prefer nice Shiny GUI instead on security.
For an indication of just how seriously Microsoft is taking security, rather than quickly fixing the bug, Microsoft is advising users to manually type URLs rather than click on hyperlinks. Well, of course, only malicious hyperlinks... but because of this bug, a scammer's link appears to be to the genuine website. Of course, they offer other gems, such as a chuck of javascript you can run to tell you the URL of the website you're actually viewing, since their software can't be bothered with giving you a correct indication. Or you can launch notepad and copy a shortcut. Yeah, everyone should have to go to the trouble of doing these steps, because they couldn't manage to get a fix out quickly (within the 1 week between the disclosure and scam artists starting to use it to trick end users to disclose sensitive indo). Microsoft also suggest viewing email at text-only... effectively reading all the html source, and changing to the high security profile )turning off all the dangerous technologies they have "innovated" over the years: ActiveX, scripting, etc...) not because they will help you avoid being tricked, but because it will limit the damage.
All because they couldn't fix this simple problem quickly.
Yeah, that's taking security seriously!
PJRC: Electronic Projects, 8051 Microcontroller Tools
umm how about switching to a more secure OS so you don't have to put up with all that BS.
.net crap >:[
In the past 3 years I have only used linux at home. Never had to worry about viruses, nor spam (yeah, that's right, I averaged 2-3 peices a year), nor spyware (spam maker), nor adware (spam maker), nor web browsing issues (IE security flaws). Now I spend more time cleaning up all this crap then anything cause I have to have a winblows box at home so i can do
Granted I kept the system patched, and used the built in firewall (switched no to yes, how hard is that? Thanks to SuSE for the easy prebuilt firewall). But at least I never had to reinstall my entire OS because a windows update failed (which just happened to my brother yesterday, and I have seen it several other times, too!)
So, no, it is not just about educating users, it is about makeing a more secure system! Windows is crap,when will the world realize this? (I'm not saying linux is the best, just better...every OS has it's problems, but windows just has the most...by far)
I am reading a lot of MS-bashing here. But let's take a look at some facts here:
/. crowds--me included--can be an arrogant and blinded bunch. Sure, we can sit around bashing MS and fool ourselves on how insecure Windows is, but that doesn't accomplish anything. MS is catching up /fast/; that's fact. If we remain complacent, we can fall behind sooner than you think.
Consider a pretty standard setup--the OS, plus ftpd and httpd--here's the count of errata advisory between M$ Win2k Server and RedHat 9:
Microsoft: 1, for the botched FrontPage Extension patch released in November.
RedHat: 4, for the following:
1. Dec 2nd: Updated 2.4 kernel fixes privilege escalation security vulnerability RHSA-2003:392-05
2. Dec 16th: Updated lftp packages fix security vulnerability RHSA-2003:403-07
3. Dec 17th: Updated httpd packages fix Apache security vulnerabilities RHSA-2003:320-09
4. Dec 24th: Updated 2.4 kernel fixes various bugs RHBA-2003:394-08
Not to mention I will need to think about what to do when RH9 becomes EOL in April.
Interesting.
I am by no means by pro-MS here. If I have my way it'd be all qmail and publicfile. In fact, I don't have the balls to put my company's Exchange server directly on the 'net; I put it behind a RedHat box running perdition, and have qmail as the MX, behind an IOS IDS/FW.
Trust needs to be earned, and MS is slowly earning mine in the security front. I don't trust MS software enough to stick them directly on the Internet yet, but they did earn my trust to let Windows Update automatically sort things out: Not a glitch in the last 18 months.
The fact of a matter is, with a little clue as a admin, Windows can be made pretty secure. Being clueless, Linux can be made to be a big wad of swiss cheese.
We Linux and
Now that you have the facts... Go ahead, mod me down.
An incomplete after a while becomes an F at most colleges....and since it's been going on for more than two years.
umm how about switching to a more secure OS so you don't have to put up with all that BS.
.net crap
Your choice of OS doesn't make your system secure. What makes a system secure is a user that has a clue.
In the past 3 years I have only used linux at home. Never had to worry about viruses, nor spam (yeah, that's right, I averaged 2-3 peices a year), nor spyware (spam maker), nor adware (spam maker), nor web browsing issues (IE security flaws). Now I spend more time cleaning up all this crap then anything cause I have to have a winblows box at home so i can do
Like you, I've not had a Virus in countless years. I don't get spam, My system has no spyware, or adware or web browsing issues (Firebird rules!), and I run a Windows box (Prerequisite of being a Windows Sysadmin). Had I have been an uneducated user, I'm sure I would have fallen fowl of most (if not all) of the issues you have listed.
But at least I never had to reinstall my entire OS because a windows update failed (which just happened to my brother yesterday, and I have seen it several other times, too!)
There are aproximately 3000 Windows PC's on the university network that I admin, and I don't see Windows Update issues that you see. Occasionaly a patch will fail, but if you know what you doing it is quite simple to fix, without having to resort to a complete re-install. Reinstalls are for failed disks and compromised machines.
So, no, it is not just about educating users, it is about makeing a more secure system!
But who makes the system secure? Why _educated_ users do. - If a user is clueless, the odds are that they will be compromised, regardless of what OS they choose.
Windows is crap,when will the world realize this?
I'm beginning to think you are a troll.
The first rule of MCP club is you do not talk about MCP club.
Now go set up franchises all over the country.
>Microsoft don't make secure products because the programmers are directed from the menegment to prefer nice Shiny GUI instead on security.
Apple has some good programmers
Apple management has a GUI focus
Still Apple doesn't make conceptual security flaws like requiring root privilege for any user to perform even the most basic tasks.
--
Every program has two purposes -- one for which it was written and another for which it wasn't.
Microsoft Security. What's it all about? Is it good, or it is whack?
I'd have to say whack. As is this report. Crowing about the lack of reported vulnerabilities means nothing when you have paid security firms not to report vulnerabilities! Of COURSE the vulnerabilities reported have decreased. But have the real vulnerabilities decreased? Thanks to Microsoft, we will never know.
Without subjecting themselves to the same review other operating systems undergo, they have no cause to crow about a perceived dearth of vulnerabilities, especially since many previously reported vulnerabilities persist and will not be patched (but are not included in this report since they are not newly reported).
The way I see it, the argument that programs "need not be fast" is saying that most things we do with our computers (web browsing, listening to music, writing email and word processing) aren't terribly processor intensive. The bottlenecks are usually storage speed and user response. Even the newest and greatest DDR3000 memory can't send data anywhere nearly as fast as a 500mhz PIII can execute it. Same thing with hard drives and network. It's also true that most user interaction is the slowest part of most operations. If you're typing in MS Word (or OpenOffice.org ;), your processor is sitting there going "OK, type another letter!" about 2 billion times a second.
That said, our requirements (I assume you're with me, cause you're compiling stuff...) are a little different than the average user. I manage to hit 100% CPU utilization pretty regularly due to compiling, POV-Ray, starting Mozilla, etc.
Just the fact that it doesn't have to be fast doesn't mean it can't be, but I figure the less time the developers spend making Windows 0.0000001 second faster at popping up the start menu the more time they spend fixing bugs and security holes.
Karma: Contrapositive
All of that being said, no technology area is devoid of security flaws. Look at the recent attention given to H.323 standard vulnerabilities due to default ASN.1 parsing. That affects many vendors and product lines. Today I read an ISC diary entry detailing a couple of exploits that affect non-Windows environments. Apache, OpenSSH, QMail, Sendmail, etc. have all had their share of recently announced flaws.
Of course Open Source Software *should* be more secure since many eyes can review the code as it is maintained and updated. But the fact that nevertheless there are significant flaws and exploits in this area further proves my point. Microsoft is the largest software company on the planet so of course they have a target on their back. There are no doubt many third party organizations dedicated to doing nothing but trying to break Windows in order to submit security reports. Of course there are anonymous black hats doing the same but for other obvious reasons.
If the same manpower and effort was dedicated to breaking Linux and OSS applications (which currently have much less exposure and market share) I am sure that even more holes would be poked into what most folks on this board defend as being the silver bullet against corporate greed, monopolistic tyranny, and gaping security holes.
We're not going to hold a software company responsible for selling a product that risks the data on your system by leaving itself vulnerable to normal user actions? What next, advisories that you shouldn't drive north because cold weather might make the wheels fall off your car at speeds in excess of 40 mph?
If I surf to a site, or open a random attachment in a viewer, and my system dies as a result, that software is defective by design. Any company that tells me I can't do either of these things with their products is admitting that they are knowingly selling defective software.
Really, though, it's the users who shell out significant coin buying products that are known to be defective that needs to change. If users won't hold a vendor accountable for their miserably defective garbage by not buying it, I guess the user community deserves all the pain that bad decisions cause. At least they could be rephrasing their complaints as "I bought a piece of crap and it exploded when I used it. I made a stupid decision." rather than "I surfed this site and my PC blew up. Bad site! Bad, bad site!"
Look to the past to see the future: when radio first began it was completely unregulated because no one knew exactly how it even worked. Even after radio receivers had become affordable enough to enter "middle class" homes radio was still largely unregulated - until it came to the point you had neighboring transmitter stations engaging in kilowatt battles for the same frequency space because "that's where people were listening." The bands became increasingly crowded because ANYONE could rig up a transmitter and have at it.
What you and I have come to expect from the PC has been shaped by our participation in the "invention" of it. But a vast majority of users - even users who witnessed that invention process - have no ethical relationship to that community. They no more expect to have to defend their personal computers from attack in their own homes than they expect to have to defend themselves from personal attack in that same space. Even when it comes to "attack" from communications mediums like TV and radio and telephones.
THAT'S why the modern PC is still not what it needs to be. not for grandma who just wants to check her email and surf the net. If grandma wants to play games there's nothing at all wrong with being able to download free games from a website - but there absolutely SHOULD be mechanisms in place to prevent grandma's computer from requiring a repairman's attention simply because the game didn't "like" her computer. Yes, it would take a lot of clock cycles to have this kind of protection. And yes, it would impact performance. But clock cycles are ever increasingly cheap, and there's nothing to prevent grandma from learning HOW that box works and then delving deeper.
The solution IS technological. the internet is not "broken" but it still needs a way to be "fixed" at least as perceived by the majority of inexperienced home users. And it better come quick, because the lawyers and lobbyists are lining up their constituents.
You should not have to know how to build a radio just to be able to listen to music. And you should not have to know how to "install a program" and "configure user identities" just to be able to surf public spaces, correspond via email and chat, play games and watch movies and listen to music without being accosted or verbally abused in your own home.
If we don't fix it, the politicians will... or they'll bleed us to death trying.
Many of the problems have been embedded in their corporate culture from Day 1. It's gonna take a long time to train *everybody* to think first about how some new whizzy feature might work against the security of the system as a whole, especially in a place where (apparently) whizzy features are the medium of exchange, and the more you can coin the richer you are.
as much as its a good thing to see someone who doesnt blithly follow the "if i install linux the box will magically become secure" myth, there are a few reasons that OSS isnt getting this kind of attention. first off, theres the process. someone reports the problem to ms, ms denies it, someone else reports it, ms denys it, but starts looking at it. it gets validated and the maintenance guys start looking at it. eventually they find the bug and make the patch. the patch goes to qa. the qa people make sure nothing gets broken by the patch, and then it makes its way to ms update. as opposed to (worst case) someone posting the problem to the mailing list of the app, (best case) someone posts the problem and a fix to the mailing list of the app. the turnaround in OSS is much faster, patches are issued all the time, usually within hours of the vulnerability being found. compare that with the microsoft turnaround.... the second thing is that, as much as people here hate to admit it, linux related stuff doesnt matter as much. when the overwhelming majority of computers on the internet can be harnesed for DDoS attacks, the scruteny falls on the people who allow this to happen. last point, do a comparison between the number of microsoft CERT warnings compared to those of other operating systems and tell me that the scruteny is unwarrented
That's not a bug, that's our business plan!
dude, windows has EASY security updates.
I use Gentoo Linux.. and had my box rooted right out in front of me.
and more often the linux security updates cause the computer not to boot!
(I updated some stuff on Suse with their updater... and blam, my boss was pissed at me, cause he told me NOT to update the boxes, and I was being paranoid about outsiders... but the suse update (kernel update) caused the computer not to boot even!
anyway, my gentoo was rooted, and I've had viruses on my windows... er.. dos on my 286 from a floppy... and from letting other people use my windows with infected floppies...
IMNSHO Linux is more difficult/mystic to keep secure... however it is getting better, and it's free... and I don't have to keep track of stupid serial numbers or pay for it.
Please use [ informative / summarizing ] SUBJECT LINES
Flame me here