Slashdot Mirror
Microsoft Sits on Security Flaw for Six Months
pmf writes "Yet another critical vulnerability affecting Windows 2000/XP/2003 has been just announced by eEye. It is worthy to note, that it took Microsoft over 6 months to fix it. The bug affects ASN.1 library and is remotely exploitable through authentication subsystems (Kerberos, NTLMv2) and applications that make use of SSL certificates." The AP has an overview.
"ASN.1 is really an extremely deep...technology in Windows itself," he said. "This investigation required us to evaluate several different aspects. This is an instance where we really had to do our due diligence."
Name me an instance where "really doing due dilligence" vis-a-vis security is an option, like this guy makes it sound. Just one.
Please tell me Microsoft is not as inept as this. Please?
Soko
"Depression is merely anger without enthusiasm." - Anonymous
didn't The Gates himself said not so long ago that they were "as fast or faster" than opensource in fixing security flaws?
i don't have the quote on hand though...
They were only sitting on it for the time they *knew* about it! Doesn't matter when NT came out if they only discovered it 6 months ago........
"Microsoft Corp. warned customers Tuesday about unusually serious security problems with its Windows software that could let hackers quietly break into their computers to steal files, delete data or eavesdrop on sensitive information." What "usually serious"? Code Red? Nimda?
Also, Microsoft's own document on "Trustworthy Computing" (warning: MS Word format!) establishes as a goal that "[t]he company is open in its dealings with customers. Its motives are clear, it keeps its word, and customers know where they stand in a transaction or interaction with the company." I suppose that waiting six months before fixing this "unusually serious" problem somehow satisfies that criterion?
So for six months, people are left out there running software with a known security problem while Microsoft surpresses the information and spreads FUD about how Linux/Open Source security responsiveness is poorer than Microsoft's? What a crock of shit.
A very big deal is going to be made about this. Feel free to correct me (or mod me down) if I'm wrong, BUT:
From my understanding, this is a heap overflow. Given the nature of the heap, I could see this resulting in a DoS condition, but what is the likelihood that a practical exploit can be developed, given that the heap generally contains data in random locations?
akad0nric0
This sentence no verb.
Microsoft was notified 6 months ago. Either they didn't know about it before that or they didn't disclose that they did. The bug may have existed for 10 years, but they supposedly sat on it for 6 months. Actually, since it affects all versions of NT and 2000 before service pack 3 it could have existed since about 1985.
Developers: We can use your help.
OSS doesn't HAVE to fix it immediately. The community and/or developers DO fix it immediately because, unlike Microsoft, they care about writing good code and having some respect. All Microsoft as an entity gives a crap about is money. It's easier to just stick a fork in the consumer's eye than fix problems, so that's what they do. They don't care what anyone thinks of them for it because they're the status quo which keeps morons who buy a new PC ever 5 weeks buying Microsoft's tired old garbage.
That's the difference - Good OSS projects care about writing good code which is how they get recognized as good OSS projects. Microsoft doesn't care about having any respect, it just wants money.
Alito: A vote for Alito is a punch in the eye to put that bitch back in her place!
Yep. It's clear. If there's no public discussion of a flaw, the likelyhood of an exploit is lower because the would-be hacker has to discover the flaw on their own.
Some of the worst viruses have come from already-patched flaws that users have just neglected to apply said patch.
Your post seems like FUD to me. Now I'm no expert, so I could be wrong, but are there not several proprietary programs that are no longer supported? The key difference of course being that with a non-supported proprietary app you have no chance of getting support. With OSS you could get the source code and either learn programming or hire a programmer to add support for you.
Have you tried Linux yet?
I use to work at HP Ft. Collins in the early 90's. At that time, there was a major hole in the network code of the that was going to take about 6 man-months to fix. The local management decided to not fix it as it was decided that few knew about it and it would not be a problem. I would suspect that every major company does the same thinking; MS, Apple, Sun, SGI, IBM, etc.
I have no doubt that all these companies do care a bit more due to the pressure being brought, but it will still be a decision similar to what Ford did with Pinto and who it was did the tires that exploded. If it costs money to fix, but nobody will see it, who cares.
That is one of the advantages of OSS as everything is in the open. Have to fix it or will suffer big.
I prefer the "u" in honour as it seems to be missing these days.
This is going off-topic, but is MyDoom really illegal then? If I send you a legitimate program, it's legal. So shouldn't the USER be held liable for attacks this time? It's entierly their fault. (If I run while /bin/true; do wget sco.com & done; that's MY fault. How is MyDoom any different*?)
* The user doesn't know what happens. But so what. I didn't know that firing a gun at your head would kill you.
My other car is first.
It would be great if this where only so, but it seems that there is one factor in corporate IT that over rules security, and that's an "enterprise" quality office suite and desktop, two things that seem to be moving quite slowly. Very few question Linux in the server market, but the PHPs will not give up Outlook and PowerPoint untill there is a superior linux analog.
By the way, recall that Linus himself predicted the corporate desktop is still 10 years off.
"Who are in control, they are not in control of anything - they don't even control themselves!" - Glen Beck
This item updates the Bookshelf Symbol 7 font included in some Microsoft products. The font has been found to contain unacceptable symbols.
Looks like someone slipped something through on Microsoft (certain to lose his/her job over this one) and put it just far enough in that it doesn't show when you double click the Bssym7.tt font file to preview its style. Leaves me wondering only two things:
1: Is there more than 1 symbol in there that is considered "unacceptable"?
2: Just why is this considered critical?
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
You people that insist on bashing *nix users for "faux-superiority" remind me of crazy people that bang their heads agaisnt the wall over and over even though it hurts. I mean, give me a fucking break. I'm not the one staring down the barrel of a vendor that takes 6 months to fix a critical vulnerability or has a standing history of just ignoring such things when possible.
There's no "faux" superiority. There's nothing significant that Windows can do better than Linux in the back office anymore. Only a complete idiot would continue to use Windows systems for any mainstream services. With a few custom exceptions, there's just no room for Windows on a smart admin's server anymore, and Windows on the desktop will drop dead when vendors decide that Linux has reached critical mass and it's time to start porting commercial apps. We know it works. We know it works better than windows. It's not faux superiority. Windows just sucks and now people have a choice not to use it. Get over it. If you're dumb enough to keep exposing data and users through Microsoft's well-known, well-documented, ongoing negligence, that's YOUR problem. However, just because I don't have that problem, don't come getting all pissy with me.
Alito: A vote for Alito is a punch in the eye to put that bitch back in her place!
Would you continue holding an account with a bank, whose ATM machines were infact totally neglecting PINs , even though no one actually tired it ?
I don't think, the microsoft bashers are saying that microsoft makes crappy s/w and open source makes great s/w. But what they are saying is, dispite making mistakes after mistakes, microsoft is not accountable to any of its mistakes. Neither are large corporations or end users bothering to try alternatives merely because of intertia
So what is the incentive for Microsoft to improve its security track record ?
for the last time people, I am "frodo from middle eaRTH", not "middle eaST".
So, you're happy that eeye - a company you don't have any relationship with - has had access to your computer for the last six months? And that's fine with your customers, too?
Ok, what about someone else who found the hole independently? Or, what if someone has broken into eeye's systems and has been monitoring their email for a "heads up" on unreleased flaws. (or the home computer of a microsoft security person). Or someone at their ISP or on their cablemodem monitoring their email. You're happy to give all these people access to your computer, too, right? Compartimentilization is very hard to do outside a rigorous structure (like the NSA) which has very strict rules, procedures, and punishments to allow enforcement.
A virus or worm that takes advantage of this flaw is only one indicator - people using the flaw for other purposes are probably not going to tell the world about it. The point is that it's impossible to tell if no harm has been done.
HIV Crosses Species Barrier... into Muppets
Now wait a minute here.
Don't lump the actual developers at Microsoft in with management's decisions. You're implying that the developers do not want to do a good job or write good code. This is simply untrue, and I know that from personal experience.
Just because management decided not to allow a developer to fix this bug six months ago, does not mean the developer does not want to! Blame management, don't blame the developers.
Let's go over the facts here...Just a couple of bits from the article...(quoting AP)
1. Researchers at eEye discovered the problems last July and agreed to keep quiet about them until Microsoft could fix them
2. Microsoft took months because it wanted to ensure that a single repairing patch solved any related problems "We really took the steps to make sure our investigation was as broad and deep as possible," Stephen Toulouse, said.
So far it sounds pretty bad, doesn't it?
Maybe you can enlighten all of us as to how this delay has helped Micrsoft's bottom line?
Do you think people would have stopped buying their products had this been announced last July?
Do you think people will stop buying their products now?
Isn't it feasible, albeit a bit too long, that they actually took the time to correct the issue? Rather than throwing a 'fix' together to appease the shareholders, one might think the amount of time taken increases the chances that they did it right.
Error encountered in IAWebSig.clsSig.Create: Last Procedure: sPrc_Ins_tblSig
- Blame the developer for creating the bug.
- Blame QA for inadequate testing.
- Blame management for not accepting responsibility and getting it fixed ASAP.
- Blame marketing and account reps who don't recognize this will hurt sales.
- Then, when you're almost done, blame the developers again for their lack of pride to not demand the right to fix their code.
Just because you find someone to blame does not make everyone else on the team blameless.Bít, zabít, jen proto, ze su liska!
Amazing. This firm makes money from the fact that IIS is so insecure, that's why they went to so much effort to look for these security holes in the first place. It's a good incitive for customers to buy their products when they see all those security holes out their just waiting for exploitation.
It is not an issue of not wanting to do a good job. It is an issue of not being able to do a good job...either through lack of skill, lack of responsibility and ownership of the code, or lack of the intestinal fortitude to fight the good fight when management decides to do the slimy thing.
I have no sympathy for the developers at Microsoft.
Lodragan Draoidh
The more you explain it, the more I don't understand it. - Mark Twain
Stop the Slashdot effect! Don't read the articles!
the way of Business that you are talking about does not further the cause of the culture or industry. it is incestuous and unproductive. They just steal good ideas and overlap the functionality over what they previously had. Where is the innovation? Where is the adaptation? It is not like several species working to survive, they are more like a cancer devouring a body, taking over systems and spreading influence.
Now why do you presume it's kids....
I'm far from a kid and use Linux in a work environment. We also use OS/390, VMS, and yes Win9/2k/XP.
The "M$" has little to do with Linux. It has everything to do with M$ and it's defacto monopoly, it's penchant for sucking the cash cow, and showing that ogranization the respect it 'deserves'.
And when will you windoze kiddies learn it's Linux and not Lunix and that the gpl isn't viral (or we'd have windows on gpl - see MS services for Unix and in particular it's gpl components), that proprietary (and paid for!) software can be purchased for it. And that it supports most hardware. We actually did better with linux than with Win2K, driver wise, back when they were both new.
On the issue... A six monthg turnaround? You must be kidding me! It was only a week ago Bill was, falsely, claiming a one day turnaround versus weeks for Linux (typically it's less than a day).
Any windows setup, mine included, was a potential target for abuse due to this. You have to trust M$ employees not to leak it, the finding company's employees not to leak it, and the black hats community to not find it.
That is a ridiculous situation for any company to be in and it's unsatisfactory performance for any software supplier let alone one who tries to claim they're the best... M$ showed zero respect for the operations of your organization and zero respect to each and every individual customer by allowing them to face that risk without warning.
I would never trust our critical business operations to Microsoft. They have repeatedly violated that trust.
However, the programmer do often have the choice of writing good code or bad code. Since writing bad code is often easier than good code, and since few people know the difference, many will take the lazy way out and do a crummy job for the paycheck. Even in this case, since it is human nature to be lazy, one can only blame the proccess for not make such behavior undesirable.
"She's a scientist and a lesbian. She's not going to let it slide." Orphan Black
Well, apparently OSS developers can fix these things in a day or two. Or have designed it properly the first time. I don't want to sound like an ass, but I wouldn't have made this mistake (using an unsigned variable for a pointer!) if I were coding it.
Anyway, if it takes M$ this long to fix things, then their products suck. And you shouldn't buy them. If this were exploited 4 months ago, there would be 300 MILLION spam zombies/SCO DOSers/etc. Sorry if it's hard to fix. It's your problem, and you need to be accountable for the damage that your idiocy/cost-cutting/brainfart causes, M$.
My other car is first.
However, the fact that most Linux users insist on software being free (as in beer) is a major deterrent. Why would Adobe port Photoshop to people who actually believe Gimp is as good, but free?
I don't know what kind of crack I was on, but I suspect it was decaf.
i'm not insisting that my professional software must be free on Linux. why Maya, Houdini, Softimage is ported to Linux if Blender is there? ;-) maybe because people use software that they know exclusively and that helps them to do specific task on the best available platform? professionals don't believe that Gimp is as good as Photoshop. not yet.
There is enough blame to go around in these situations:
* Blame management for forcing tight deadlines on the developer who writes shoddy code, creating the bug.
* Blame management for limiting the time and resources for QA to develop and execute test cases which results in inadequate testing.
* Blame management for prioritizing new sales to support, thereby not accepting responsibility and getting it fixed ASAP.
* Blame management for structuring sales compensation so that marketing and account reps don't care about what happens after the sale, and so don't recognize this will hurt sales.
* Then, when you're almost done, blame the developers for needing food, clothing and shelter, and getting beat down when they say anything, which gives them lack of pride to not demand the right to fix their code.
I'm sure this is what you meant to say, right?
Well, they may say 'can't trust this', but their web site run IIS on Windows 2000. Actions speak louder than words...
Think global, act loco
I'll tell you why because I work at such a company. The decision to use Microsoft products was made years ago (around 1997), and since then there has been so much ASP written, so much time put into MS-SQL stored procedures and infrastructure, so many internal processes and scripts that are custom-tailored to the Windows installations, that trying to take it all out and replace it with *nix would cost more time and money than the company can afford.
If you are still in school, or if you work in a small lab, or if you do ANYTHING except work in the real world, you probably think idiocy and stubbornness are the only things preventing the world from running *nix. At this company, and at many others I presume, at this point it makes more sense to pay a little more for the extra TCO of running and upgrading Windows than to try and rewrite the entire e-commerce website and change all internal processes. The bosses here aren't stupid - they know *nix is better, but if you even suggested the place should switch wholesale off Microsoft you'd get eye-rolling galore. It's a pipe dream.
The transition doesn't make business sense, even if the end result would.
Intercarve Networks, LLC
I think that developers who issue statements that management is always doing the wrong thing, should remember that they too manage, a software development project for example.
I feel so sig.