MS Security Chief: Windows Never Exploited Until Patch Available

BenBenBen writes "The head of Microsoft's security business and technology unit states that Windows is never vulnerable until a patch appears, and that releasing patches is what causes exploits to be developed. Good quotes: 'We have never had vulnerabilities exploited before the patch was known', and '[he] could only think of one instance when a vulnerability was exploited before a patch was available'. Erm..."

Comments

Oh really?

[ChaoticChaos]

"The Earth is flat."
"The Sky is green."
"Earth is the center of the universe."

Other ridiculous statements that have also been proven false.

So, let me get this straight, Windows will become more secure if Microsoft stops issuing patches? :-)

Sakes alive, the Microsoft spin machine has been well oiled this morning!

ChaoticChaos
"If Windows wasn't vulnerable until the patch was released, why was the patch released in the first place???"

Re:Oh really?

[Jotaigna]

the simplest method used to detect a lie is to cross question the subject until it gets confused and contradict itself. This guys have security departaments, management, developing, sales, etc. They should build a "Lie Tracking" departament, then, they'll have at least something consistent. I think this post should have been published in "its funny, laugh" category.

Re:Oh really?

[vandegraff]

Sounds like a simple belief security through obscurity. That is really sad.

Re:Oh really?

[dingbatdr]

In other news, Microsoft announce that cause and effect are reversed when it comes to their software.

"We think it is due to our patented time-traveling module," quips Steve Balmer.

Re:Oh really?

[FrostedWheat]

"We think it is due to our patented time-traveling module," quips Steve Balmer.

It's true! I was copying a file over the LAN the other day, and IE said it had -8342563246 seconds to go!

Microsoft Time (C)(R)(TM)
Where do you want to go yesterday?

Re:Oh really?

[hcetSJ]

Next big thing in computers: the then-if statement! Available only on Microsoft products, certainly.

Re:Oh really?

[Anonymous Coward]

This means that Microsoft has *NEVER*, I repeat, *NEVER*, has been subject to a 0-day exploit. Wow...this guy is smoking some serious crack. What about the recent exploit that they sat on for 6 months? Doesnt that count? How about the new one that X-Force has contacted them about and MS has 30 days to fix? Is that from a patch too?

Re:Oh really?

[Rooktoven]

The implication there is that only Microsoft finds exploits. Forgive me if I'm skeptical.

Re:Oh really?

[eweu]

Next big thing in computers: the then-if statement!

print "this already exists\n" if ($usingPerl);

Re:Oh really?

[tmasssey]

You mean like INTERCAL? How can you live without a COME FROM statement?

Re:Oh really?

[ssbljk]

in the beginning there was Windows ... and it was secure ....

then we downloaded damn patch :(

Re:Oh really?

[mpe]

Sakes alive, the Microsoft spin machine has been well oiled this morning!

They must have had a delivery of snake oil :)

Re:Oh really?

[Short Circuit]

It's called sweeping it under the rug. Until, of course, someone trips over the raised rug or sees dust puff out when the rug is stepped on.

Re:Oh really?

[zelurxunil]

Perhaps it can be reverse engineered...

Re:Oh really?

[LnxAddct]

It is blatantly false that only Microsoft finds exploits. The SAMBA team found nemerous security vulnerabilities with the way Microsoft implemented their protocol and then reported them to Microsoft. Hackers could easily have abused such cases, but instead Microsoft got lucky and they were white hats that found them. There are many other cases, most exploits are found by security firms of some sort and then Microsoft will acknowledge them for one sentence in the fine print at the bottom of the notice. Well I could go on but I'll let the other slashdotters do that for me.
Regards,
Steve

Re:Oh really?

[jocknerd]

Wouldn't Microsoft's Security Chief be a marketing guy? He obviously doesn't have anything to do with security.

Re:Oh really?

[arrogance]

"We have never had vulnerabilities exploited before the patch was known," he said.

Umm, that WAS in the article. Are you saying there's a difference between "was known" and "appears"?

In the article, it seems quite clear that what they're saying is that most exploits come after the hackers have had a chance to compare patched VS unpatched systems to see what the changes are. But it's not just Microsoft saying this:

"It's a myth that hackers find the holes," said Nigel Beighton, who runs a research project for security firm Symantec.

In other words, I can see the point of view expressed in the article. I disagree with the parent in part (I think the attribution in the Slashdot story is sufficiently accurate) but that the specific (never had vulnerabilities exploited before the patch was known) is probably hyperbole. Hackers might be lazy, but they're not non-existent. There's no way M$ could even KNOW how many exploits have been made.

Re:Oh really?

[Short Circuit]

One of the reasons I love Perl is that the following line of code works:

open ( PERLYGATES ) or die "Trying";

Re:Oh really?

[killmenow]

Umm, if there are no exploits to begin with, then why does microsoft need to issue a patch?

I'm not trying to defend the parent poster to which you replied; but, the reason *anybody* needs to issue a patch even when there are no exploits to begin with is because sooner or later, one will exist.

See, if some researcher finds a hole, he's not the only genius in the world who can find it. Someone else will eventually. If the manufacturer of the product with the newly discovered hole sits on its arse and does not issue a patch, even if no known exploits exist, said manufacturer is leaving its customers vulnerable to attack. This is a disservice to those customers...and one that will lose said customers. Especially when it comes out that the latest worm/crack/etc. exploited a vulnerability the manufacturer knew about for six months, but sat on it instead of fixing it for you.

What Microsoft wants to do, I'm sure, is to make distribution of patches similar to AOL's software update. You turn on your computer, boot up Windows, and it initiates an encrypted conversation with Microsoft HQ...then says to you: "Windows needs updated, please wait..." while it downloads and installs whatever it is Microsoft wants to install on your PC today without telling you what that is.

That would be Microsoft's "security" wet-dream, if you ask me.

Re:Oh really?

[Anonymous Coward]

If I remember correctly, the WebDAV exploit that was out about 5 months ago was found because a military webserver was rooted with it. Thats definately an example of a blackhat finding a hole and using it well before there was a patch available.

Re:Oh really?

[Zixia]

There has never been an expoit without a patch. Just the one.

One! One exploit without a patch, and that other one against Internet Explorer.

Okay, two exploits without a patch. Unless you count the many against Outlook Express.

AMONGST THE EXPLOITS WITHOUT A PATCH ARE... Can we start the interview again?

Re:Oh really?

[shotfeel]

The arguement is still horribly flawed though.

Its flawed alright.

First off, MS is making a statement they can't possibly know to be true. "We have never had vulnerabilities exploited before the patch was known." At best all they can say is never that they know of. Then we find out its a lie anyway because the article later says that "he could only think of one instance when a vulnerability was exploited before a patch was available".

Which is it, never or one? Or do they just not know?

Maybe I'm just paranoid, but its not the script kiddies MS is talking about that I'm worried about. Its the professional crackers who are willing to take the time to find a new exploit because they're after something more specific than bragging rights on some IRC channel. They are the ones MS isn't going to hear about because they don't go around submitting vulnerabilities or bragging about their escapades. They are the ones who are going to do real damage, and they are not the ones who are going to be stopped if MS stops issuing patches.

MS just doesn't get it.

Re:Oh really?

[fitten]

No... I think what they are trying to say is that *after* a patch is released and a description of the exploit is given, mal-ware writers then run off and use this description to write mal-ware to take advantage of folks who haven't applied the provided patches.

I don't care either way, just providing interpretation.

Re:Oh really?

[Lobo_Louie]

This reminds me of a Knowledge Base link I saw on M$'s website about 3-4 years ago. I'm paraphrasing here: Warning, your password must be 324,322,322 characters long and must not match any of your last 324,234,234 passwords. The URL made the rounds in couriels *. * excuse my french!

Re:Oh really?

[Erratio]

I may be wrong, but one thing I never hear talked about in the relationship between open source and closed source is the sharing of bugs. I'd think it would be safe to assume that when a bug is discovered in an open-source project (or anywhere else for that matter) it can be assumed that it may be present in other similar applications, just because humans think similarly and a lack of foresight on the part of one programmer could have been made by another. And so a bug fixed in one network service may still be present in others, maybe unnoticed by the maintainer. Obviously there are a lot of variables which could eliminate even the possiblity (and some like shared technologies which could support the possibility), but I'd think that if one were to look at all the past bugs that may be easily examined in other projects, sooner or later an exploit could be found which would work on other servers, maybe with a little tweaking.

Re:Oh really?

[akozakie]

I read it quite differently.

If hackers are left uninformed, a security hole is only found by few industrious hackers. Some are white hats, some are not. Some will inform Microsoft, some will exploit the code, few will propagate the knowledge. The system is not secure, but few attacks happen. The few, however, might be very dangerous, as the attacker knows, what he's doing and is probably after something.

After a patch is released, thousands of crackers can find out, what was wrong. The knowledge barrier to writing a successful exploit drops, worms are written... Suddenly everyone's computers are under attack.

He's not saying, that only Microsoftees find exploitable bugs. He's just saying what everyone knows - once a hole is well known, it's a greater danger and soon even script kiddies start using it.

The article mainly says, that in case of a target as popular, as Windows, once a patch is available, you have to get it _quickly_, because the number of attacks grows very rapidly then.

Unknown hole = exploitable by some hackers
Well known and patched = safe
Well known and unpatched = goodbye, sweet data

Re:Oh really?

[teromajusa]

If you read the article, nobody is claiming that only Microsoft finds exploits. They are saying that the people writing the viruses are not finding the exploits on their own - they are reverse engineering patches to find the exploits. They also don't say they should stop issuing patches, despite what people here seem to be assuming. The guy is issuing a caution about how patching quickly is becoming more important. There really isn't that much to get worked up about here.

Re:Oh really?

[PainKilleR-CE]

They are saying that the people writing the viruses are not finding the exploits on their own - they are reverse engineering patches to find the exploits.

They don't even have to reverse engineer the patches, since the bulletins released with the patches usually describe the problem being patched well enough for someone to figure out a way to write an exploit. When you have a description available like the following:
Multiple integer overflows in Microsoft ASN.1 library (MSASN1.DLL), as used in LSASS.EXE, CRYPT32.DLL, and other Microsoft executables and libraries on Windows NT 4.0, 2000, and XP, allow remote attackers to execute arbitrary code via ASN.1 BER encodings with (1) very large length fields that cause arbitrary heap data to be overwritten, or (2) modified bit strings.

All you really need to do is find more information about how the exploitable code is normally used, then find the limits of the buffer (in the case of a buffer overflow like this) and go to town with it.

What it all comes down to is basically that people need to update as soon as possible when patches are released, because the people writing worms and viruses tend to watch the security bulletins looking for new holes to exploit. It's certainly much easier than actively seeking out undocumented holes.

Re:Oh really?

[Dare nMc]

Is my recent experience prudent here?

Every version of windows, as shipped, now has security holes that will be exploited imediatly upon going on-line. I tried to go online with a new ms install, and was infected with a virus, before I could download a single patch.

The correct way, according to ms is to patch the OS is through the windows update site (it's hard to find the individual files for download, only going to windowsupdate.com with a non IExplore browser directs me to the patches for download otherwise.)

To my knowledge ms doesn't ship a single os that is secure enough to go online to patch it's self. maybe 98sp2, but to my knowledge their is no way to get a patched windows XP box without going online first (any patch CD's shipped from MS????)

Re:Oh really?

[andrew_0812]

Not yet, it hasn't been patched...

Re:Oh really?

[Oyvind Eik]

[cheapo] haha, this screen appeared on my windows that said "time before shutdown: 60 seconds"
[cheapo] so i turned the windows clock 2 years backwards and now it says "time before shutdown: 729 days" :D:D
[cheapo] i just love windows :D

[#227455]

Windows has a great sense of humor. :-)

Re:Oh really?

[qcomp]

No... I think what they are trying to say is that *after* a patch is released and a description of the exploit is given, mal-ware writers then run off and use this description to write mal-ware to take advantage of folks who haven't applied the provided patches.

exactly, so MS shouldn't patch any holes in the first place, then no malware would be written and everyone would live happily ever after

Re:Oh really?

[Anonymous Coward]

.well patterns-thought my reflect t'don theY .language other any to used got never I !language programming first my was ITERCAL ?funny modded this was whY

Re:Oh really?

[dwave]

You mean this article, right? http://support.microsoft.com:80/support/kb/article s/q276/3/04.asp This is my all time favorite: http://support.microsoft.com/?kbid=161129 ("Kitchen: Known Content Errors"). What were they thinking?

Re:Oh really?

[mino]

Running screamingly offtopic, but when it comes to all-time best KB article headlines, here's yer winner:

Earth Rotates in Wrong Direction

Logic???

[BWJones]

Meh.......The last statement in the article: "If you want more secure software, upgrade." pretty much sums up Microsoft's position. With this kind of logic, it's a wonder that any coding gets done at all there. So, by extension, if everybody were to leave their doors open and unlocked at night, there would be no crime? :-) Seriously though, if you actually read the article, what it says describes reverse engineering of patches to explore and exploit vulnerabilities. So, the statement if confused might be technically correct, but that does not mean that the security vulnerabilities are not there in the first place. What happens mostly is that the lazy are exploiting the patches, whereas the more experienced (perhaps more dangerous) hackers will do their own work. Furthermore, the more experienced hacker might not be as likely to release their attack into the wild promiscuously. Rather they are doing what they do for a likely monetary payoff.

The real question though is: If the patch can be exploited, is it a patch? Yes, I know that they are analyzing the patch to attack unpatched machines, but to claim that vulnerabilities are not present before patches are released is circular logic.

Post hoc, ergo propter hoc

[Waab]

At best, the notion that patches are the source of all exploits is a logical fallacy. However, I'm sure I'd not be in the minority of /. readers if I opined that Mr. Aucsmith is either lying outright or simply delusional.

I say that since Microsoft has a policy of "eating their own dog food", they should be forced to stand by this ridiculous proclamation and henceforth cease and desist all efforts to patch their code. Thus, all exploitations of buggy MS code will also halt.

Re:Post hoc, ergo propter hoc

[jruschme]

Actually, I think it has a sort of perverse logic (albeit a nearsighted one). If I understand it correctly, the idea is that when a patch is released, it opens up knowledge of a hole. This is similar to the whole argument about when to release info on a security hole.

The problem with this reasoning is that it assumes the only people writing exploits are lazy/clueless enough to wait for someone to tell them what to exploit. It ignores the fact that there is a community of hackers out there actively looking for the holes.

Re:Post hoc, ergo propter hoc

[frankthechicken]

Indeed, if this was Microsofts thinking, then they wouldn't release patches at all, creating the most secure Operating System available.

I somehow think the quote might have been taking out of context, especially when he states that:-

"Many people reverse engineer the patch and then build the exploit code,"

I have a feeling that the main point of his statement, was that the majority of attacks are on unpatched systems. Certainly when you consider Symantec's Mr Beighton's statement:-

"It's a myth that hackers find the holes,"

He said in many cases the appearance of a patch was the spur that kicked off activity around a particular vulnerability.

Which would probably be true, once the problem is widely known, then there is more likliehood for an exploit to be devised. Hence the more devasting attacks such as Code Red were centred around a previously patched exploit.

Simple solution

[shystershep]

If crackers never find exploits except for by comparing patched and unpatched versions, why the hell do they release security patches then? Seems like they've got their security problems licked -- no patches, no exploits. What could be simpler.

Also liked this quote, from the end of the article:
"Almost all attacks against our software are against the legacy systems," he said.
"If you want more secure software, upgrade."
Hmmm.

Criminal tools like "diff"?

[RobertB-DC]

He said tools were available that compared patched and unpatched versions of Windows to help vandals and criminals work out what was different.

"The guys who write the tools would not consider themselves to be criminals by any measure," he said, "but the tools are also being picked up by people with criminal intent."

I guess that explains why Windows doesn't include a "diff" function...

Re:Criminal tools like "diff"?

[tomhudson]

I guess that explains why Windows doesn't include a "diff" function...

fc - from your old DOS days - stands for file compare

I'd check to see if it still exists in Windows, but there aren't any Winboxen around here :-)

In other news...

[daeley]

In related news, the Mayo Clinic has announced that if we eliminated cancer treatments, we would eliminate cancer.

So...

[Niles_Stonne]

So, instead of poor programming it's incompetent management?

Must have a good source for that stuff...

[ackthpt]

Malicious hackers and vandals are lazy and wait for Microsoft to issue patches before they produce tools to work out how to exploit loopholes in Windows, say experts.

I love how people with vested interests are called 'experts'

thhhhhhhhhtttt *choke* *gag* "ahhhhhhh" So as I was saying, hackers haven't found any of these flaws and exploited them before they were patched. Man, this is some strong crack, I almost believe what I said, myself"

And how do these fine experts actually know there aren't, at this moment, flaws being exploited left and right? Ah, they're experts, of course!

Security is in the eye of the beholder

[chaoskitty]

MS' problem is clearly that they have too many managers and businesspeople, and not enough technical people (or perhaps their technical people have no voice). That a MS employee can say such things that everyone else in the world clearly knows is wrong says something about their concern for real security...

Assume for me...

[lacrymology.com]

... just assume for a moment that what he says IS true (for argument's sake). Would you feel better as an M$ customer having heard it? That is, do you feel better knowing that there are many holes in the system that no one outside of M$ knows about? Does security through obscurity make you feel better?
-m

Re:Piffle

[sputnikid]

"If you want more secure software, upgrade."

That quote goes for Linux as well as MS. How many people do you know that are still running 2.0.34

On the same logic

[EulerX07]

An unlocked door is safe until someone sees you lock it. Therefore everybody just leave all your door unlocked, since we do not know that they're unlocked there is no danger.

Reply to this post with your street adress and your usual work hours, thanks!

Partly right

[Anonymous Coward]

I must admit that they are partly right on this statement. As long as they don't publish a patch, most the world doesn't even know there is a hole. A few security specialist firms know, but they are not dangerous.

As soon as they release the patch, every hacker knows 99% of the systems won't be patched for a while, and Microsoft just about gave out what is the problem and how to exploit it.

So I say yes, it is dangerous to say out loud "hey, there is a hole in our system, but we have a patch". I would prefer if they just shut up, and release a "cumulative patch" once in a while.

Just my opinion.

Re:Partly right

[m0rph3us0]

How about
24 unpatched IE exploits. No patches. Still exploited.

QED.

What the Fuck? What the Fucking Fuck Fuck?

[Tackhead]

> 'We have never had vulnerabilities exploited before the patch was known'

"Bullshit" doesn't begin to do justice of the level of falsehood present here. We're talking about taking the very essence of falsity, distilling it over the flames of ignorance, condensing it within intestinal walls of monumentally bovine intellectual apathy and sponsoring a college kegger with the elixir-excremento obtained therefrom.

Just one?? Really?!

[thesolo]

I think he might be wrong.

XP = Legacy?

[La Camiseta]

"Almost all attacks against our software are against the legacy systems," he said.

So is that what they're calling WindowsXP now?

They don't get the point...

[chill]

Who is it that finds all the exploits and reports them to Microsoft in the first place? It sure as hell isn't Microsoft employees!

This means, known holes and exploits are available to certain people BEFORE patches exist. Are you willing to bet your business that those "certain people" are ALWAYS good, ethical and honest? There are no intelligent "bad guys" who can do this?

Where are all the "hackers" and "black hats" the media is always screaming about! Please, don't tell me they are ALL script kiddies.

-Charles

P.S. -- How can I ever get "first post" if the damn artitle quotes make me laugh so hard I can't type?

Re:Piffle

[darkjedi521]

Linux 2.0.40 - release 2/8/04 Linux 2.2.26 - release 2/25/04 Linux 2.4.25 - release 2/18/04 Linux 2.6.3 - release 2/18/04 The older versions of the Linux kernel seem to be alive, well, and still being patched for security flaws. In fact, the most recent kernel release is 2.2.26.

Iraqi Information Minister working for MS?

[ageoffri]

Wow looks like Microsoft has hired the Former Iraqi Informaiton Minister.

"The infidels packets are slaughtering themselves at the ports to our OS"

"There are no exploits against windows, they are all lies from the so called Open Source community"

"We removed the Windows Update site to better serve our loyal followers."

Re:Piffle

[Erratio]

Yeah...I hate paying for those damn Linux upgrades.

Re:Piffle

[xeaxes]

If Linux 2.2.XX had security holes they would say upgrade. There aren't new fixes being written.

But, you are wrong about this. In fact, a new Kernel update to 2.2 was released. Version 2.2.26. It's been a year, but they were still released.

Here's a quote from the release: "Marc-Christian Petersen announced the release of the 2.2.26 Linux kernel. This release includes several security fixes, including a fix for the latest mremap() bug." See the Linux 2.2.26 Release Notes

So, really, MS is forcing users to upgrade by not releasing patches to old version.

MSFT mentioned!! Slashbot tantrum time!!!

[stratjakt]

The guy does have a point. The description of the patches gives malicious coders a good detail of what to exploit.

There are no doubt circumstances where the super-1337 h4x0r finds an exploit all on his own, I'd imagine through trial and error, but for the most part, they look at windows update and see "This patch resolves a vulnerability in WMP which could allow arbitrary code execution", and they write an exploit for the unpatched boxes.

The MSDN knowledge base is a great source for folks looking for exploits, they very often have step-by-step directions to reproduce the problems.

That's how you get root on linux boxes too, you find people still running an older kernel version, or an old sendmail, ssh, whatever, and hit the known exploits for that version.

And if you want a more secure system, yeah, upgrade. It works that way no matter what your personal philosopy behind your OS choice.

Re:Piffle

[onyxruby]

I agree not all old software should be upgraded. Windows 3.1 may rest in hell as far as I'm concerned. But it wasn't that long ago they tried to kill of Windows 98, that's what 25% or so of the home user base? I recognize that the 9.x kernel is inherintly insecure and outdated, but that's no excuse not to patch known exploits when their is a substantial user base out there.

I am not, by the way, saying that users should nut patch their systems, only that they should not be forced to upgrade working systems under auspices of security just because MS want's more revenue. They can pull that crap on the business market and get away with it, but joe sixpack can always go try that linux thingie he heard about.

Bug Free == More Secure

[dre23]

Any bug is a potential security hole. And Windows has a lot of bugs. Fix the bugs, not the security holes, and your code will be more secure.

Patching is great. Patch Management is great. But it doesn't keep the bad guys out, it just stops some worms. But then variants of worms come out.

Clearly worms are a security threat. But there are many other security threats.

Windows is not secure. NT NULL session, NetBIOS attacks (SAM and AD come to mind quickly), and even simple buffer overflows, format string attacks, etc ... these are POPULAR attacks against Windows that attackers are utilizing right now. Even when patched, some of these attacks still work. Why? Inherent network protocol design is part of it. But bugs are a huge part also.

Reverse engineering patches... who needs to even go that far? Any engineer at Microsoft can just query their internal bug tracking system. An attacker could have a friend inside Microsoft who sends her/him a bug report. That friend could also be the target of social engineering. You saw the movie "Sneakers", right?

Others can simply "grep" or "slint" the code. By reading the code, anyone can find a bug and make an exploit out of it. This has been widely done for a long time. It's not an uncommon practice, and it's not difficult.

If coders want to fix security holes in their code, the only real place to start is by fixing the bugs. When Windows runs so smoothly and never app fails or hangs on me, When I no longer hear or see a BSOD, When hell freezes over -- Then Windows will be truly secure.

I can't agree with this statement...

[u-235-sentinel]

"We have never had vulnerabilities exploited before the patch was known', and '[he] could only think of one instance when a vulnerability was exploited before a patch was available'. "

I've had my Windows XP system comprimised a couple of times in the most interesting way. Fully patched and running SP1. I've even tightened up IE security to high and restricted what sites can do and firewalled. Despite my best efforts, somehow I must have hit a web site which they downloaded spyware onto my system. I couldn't see it running in the task bar but it was there.

I found it by accident. From download.com I pulled several programs to scan for running processes. I noticed some weird stuff that Bill didn't put there. I didn't put it there also. Took a bit of work but it was eventually killed and I remove the programs from the system.

Microsoft has no explaination for this other than "practice safe browsing". Great. So how is that accomplished using IE?

BTW, Netscape in the same environment and same web sites hasn't given me the same headaches. Oh I"m sure there are problems. At least they are not as blatant as what Microsoft has been shelling out.

Re:Piffle

[jone1941]

That quote goes for Linux as well as MS. How many people do you know that are still running 2.0.34

Probably not many who have security concerns, since 2.0.40 is now the current release. I'm not sure what you are insinuating, but there are still maintainers for these releases because people still want to use them and still want any bugs/security issues to be fixed.

This in my opinion is one of the greatest benefits of the open source community. You see with both Windows and OS X, if you want all the security patches you need to pay for the latest version of the software. The linux community (note I didn't say RedHat but community) will continue to support prior software so long as there are enough users out there. Just look to the linux kernel or apache for examples. Just my $0.02.

Re:Piffle

[yakovlev]

Actually, linux 2.2.XX and even 2.0.XX are still supported and still receive security fixes.

This isn't to say that it's reasonable to expect a commercial company to support software indefinitely, but one of the benefits of open source is that you CAN find/hire someone to support your old software and backport bugfixes as appropriate.

One of the nice things about MS is that they DO backport bugfixes to old software. Patches are almost always provided for free for all supported versions of Windows. Windows is supported for an established number of years (5, I believe) and at that point the user is reasonably expected to upgrade.

The Linux kernel has a better reputation than MS, but there are plenty of companies that have worse reputations. Even Redhat only supports its products for about 3 years before expecting an upgrade.

Mockery aside, how about the counterexamples?

[djh101010]

It's lots of fun to bash an asinine statement from Microsoft such as this. However, how about we come up with a list of actual counterexamples? Which specific patches did they release in response to a real security problem that existed before the patch?

I'll start. KB832894 "fixed" the exploits which used the user:password in the URL to authenticate to websites. It was there long, long before the patch (years, in fact).

What other counterexamples do we have to show precisely how wrong Microsoft's statements are?

Re:Mockery aside, how about the counterexamples?

[freeweed]

Windows file sharing.

Back in the original 95 release, MS had a neat little bug. If you shared a folder, it was shared to the outside world by default (as it still is today, but I digress). The only security offered from within Windows was to password-protect the share. Now, the exploit:

Windows 95, and also at least the original 98, both contained a bug in which only the first character of the password had to be guessed. So, if your password was "Slashdot", I could get into your share by simply using "s". Yup, 26 tries and I'm in (iirc windows passwords have to start with a letter, but even if not, the ascii character set isn't that big). Forget dictionary attacks on the password, you were basically in within a second - and of course denied logins didn't count against you.

The patch for this wasn't released until well after 98 was on the market, which meant it sat for at least 3 years unpatched. I know damn well that it was known and being exploited before then, because I used to play jokes on my friends by getting into their supposedly protected folders. This was back in 1996.

Opaserv, among other worms, used this hole to spread through a lot of systems, but I can't find the first date any of these were noticed. So I can't prove large-scale explotation of this hole, but I do know that at least I was using it well before it was patched.

Re:Piffle

[Bombcar]

How many people do you know that are still running 2.0.34?

Those people are Amateurs.

The latest kernel is 2.0.40, as everyone should know.

[/sillyness]

Why read the BBC anymore?

[richardbowers]

A few weeks ago, we were treated to the BBC claiming that the Linux community was behind MyDoom, even after it had become clear to everyone else in the world that it was written by Spammers. This article isn't any better/worse - its another thinly-disguised and apparently unresearched document, with no supporting statistics. Is there a reason to read this trash anymore, or should we switch to something more reliable, like the tabloids?

Re:Piffle

[rholliday]

"Almost all attacks against our software are against the legacy systems ..."

Am I the only one who remembers a few exploits that 95/8 were immune to because of innovations in new OSs? I mean, just a little thing like MS.Blaster. Probably didn't make the news ...

Wrong

[ShecoDu]

Their point is that when they patch they announce they HAD a problem and the hackers can see what the patch fixed and try to exploit UNpatched machines... its security through obscurity, if I don't release a patch... hopefully the hackers won't notice the hole.

But now that the patch is out, you can expect hackers to know about the vulnerability and attack you if you don't have the patch.

They are dumb, dont try to play dumber. :)

Re:Piffle

[Kombat]

Why do you speak as though this "conundrum" were unique to Microsoft, or even closed-source software in general? If I buy a '57 Chevy Bel-Air convertible, and the top has a tear in it, should GM be obligated to provide me with a replacement part, if I'm willing to pay for it? Does the fact that they won't indicate that GM is a bad company for not supporting its "legacy" products?

Just how long should a company be obligated to support its older products? And why are you coming down so hard on Microsoft while ignoring the fact that this is simply standard practice, in every industry?

Let's start a list of counterexamples

[Mr. Underbridge]

OK, so let's get a list going of examples to the contrary of what this dipshit says.

I'll give 2:

1) The original Melissa email virus (enabled by idiotic default settings in OE)

2) The one recently where remote web sites could hijack your address bar while redirecting you and doing nasty shit - that MS didn't patch for 6 months.

Someone might say those weren't strictly "Windows," but both OE and IE come installed by default, so it counts for me.

Others?

Re:Piffle

[kfg]

Quite a few people use various flavors of the 2.0 kernel for various reasons. The 2.2 installed base is huge, and not going anyplace fast. Larger minor version number (or even major version number) does not even vaguely imply greater security. You are buying the myth.

In fact, quite the opposite is often the case if older versions remain maintained, because they are more thoroughly debugged and locked down. And they are maintained because there is no profit motive to not do so.

KFG

In related stories

[AtariAmarok]

In related stories, it has been revealed that firemen cause fires, policeman cause crime, and the good folks at Symantec have written all the viruses.

Film at 11:00 (just after the anchorman tells us about all of the muggings he committed).

This vuln wasn't found in a patch!

[SysKoll]

This is marketing BS in the purest form. Here is a nice juicy MS vulnerabilitythat wasn't found by reverse engineering a patch.

As for real security experts, they routinely find vulnerabilities in Windows beforesending a description to MS which would then, a few months later, issue a patch. Maybe.

There is a fine line between marketing and outrageous lying. I'm glad to see that MS gleefully steps over it every single time. Any other conduct would actually be unsettling. You see, we geeks revel in a binary vision of the world, and we cannot thank MS enough for consistently being a caricature of evil villain. It makes working against them so much more rewarding.

Re:An article disproving this...

[Daniel_Staal]

It's almost like they are "above the law" and what thsy say happens. Kind of like when God speaks.

Nah... God gets questioned more.

(You can even double check me: I can't remember a single instance in the Bible where God's command wasn't questioned...)

Re:Piffle

[ComradeX13]

You could fabricate a new top/machine parts/etc for a car. Not so for a closed source software product (or at least, it would be much harder.)

well i can tell you for a fact...

[ophix]

i can tell you for a fact that the RPC hole was being exploited for at least 9 months before a patch was out. I know a few script kiddies in RL who were pissed off when the patch came out as they lost their doorway. I watched them do it a couple of times as proof. I pretty much will not put a windows box directly touching the outside world in any way shape or form now.

Could this mean...

[jellomizer]

Could the mean that Microsoft as a Business exists moving in time backward. This explains Microsoft quick profits and good business decisions back in the 80's and over now in the 2000's a younger and less experience Microsoft is making more mistakes. and having a little more competition to deal with.

I don't know about you but I confused myself.

only Microsoft finds exploits

[da5idnetlimit.com]

Or is it the other way around ?

say [pun]"Only Microsoft exploits exploits"[/pun]...

from the article :

"Almost all attacks against our software are against the legacy systems," he said.

"If you want more secure software, upgrade."

Here you are. They said it, officially.

I seem to remember that my debian stable is composed of 1-2 years old software, and, regularly patched, will say secure without even have to reboot...

PEOPLE !!! "If you want more secure software, upgrade." ... to Debian 8)

Re:only Microsoft finds exploits

[Necrobruiser]

**"Only Microsoft finds exploits"**

Or is it the other way around ?

say [pun]"Only Microsoft exploits exploits"[/pun]...

I think the other way around would read "Only exploits find Microsoft."
Seems more probable that way...

Symantec partly agrees...

[rmpotter]

From the article:

"It's a myth that hackers find the holes," said Nigel Beighton, who runs a research project for security firm Symantec that attempts to predict which vulnerabilities will be exploited next.
He said in many cases the appearance of a patch was the spur that kicked off activity around a particular vulnerability.

For the most part, I think this is true. Most Windows exploits DO "magically" appear a few days or weeks after a patch is available. Of course, hundreds of thousands of users never patch, or never patch in time. The "magic" lies in the symbiotic relationship between anti-virus software producers and malware creators.

None of this excuses MS from releasing Swiss cheese code, but it looks like a lot of malware gets created after a "proof of concept" has been released by "security researchers".

Re:Piffle

[buysse]

Linus doesn't, weaselnuts, but the 2.0.x kernel is alive and well, maintained by David Weinehall, the 2.2.x kernel is alive and well, being maintained by Marc-Christian Petersen, and the 2.4.x kernels are being maintained by Marcelo Tosatti. The only kernels that Linus maintains are the development kernels. He hasn't handed off 2.6.x yet, AFAIK, since it's not fully cooked and 2.7 hasn't forked. As soon as 2.7 branches, expect to see someone else issuing the 2.6 kernels. I'm not going to touch the Redhat commentary, but I know there are people still maintaining their own copies by patching and creating new packages. In the open source realm, you don't need a vendor to do it for you. In Win 9x, you do. 'Nuff said.

Re:Piffle

[the_mad_poster]

It depends if you run updates through regression testing on a series of "standard" machines in the office and all goes well until you actually try to patch the systems. Then, some obscure third party app that you completely forgot even existed clashes with the freshly updated machine and fucks the whole thing but good because of some bizarre bug that prevents the machine from even getting to first stage boot. On 350 desktops. In the middle of the night. On the weekend.

As compared to the boxes that kernel-upgraded flawlessly even though we didn't list out half the stuff being used on said boxes.

Windows update for home use? (Usually) painless. Windows update for wide deployments. Potentially, the most painful fucking nightmare you will ever experience unless you have a completely homogenous environment.

Re:Piffle

[edgezone]

I realize that you are trying to make a joke, but seriously, how painful is a Linux upgrade compared to a WindowsUpdate(R)(C)TM? Cause that's about the price you pay almost daily to get up-to-date.

Let's see...with debian stable (possibly testing, but I don't recommend with unstable)

crontab -e

* 1 * * * /usr/bin/apt-get update
* 2 * * * /usr/bin/apt-get upgrade

Done.

Or, if you want a daily email of any packages requiring an update....

#!/bin/bash
# ~/bin/getAptList.sh

apt-get -us upgrade | grep ^Conf > ~/.dist-upgrade-list
mail -s AptList mymail@myaddress < ~/.dist-upgrade-list

Change your second crontab to run the shell script, and done. (yes, I don't use variables in 2 line scripts)

Oh, to upgrade to the next release...

apt-get update && apt-get dist-upgrade

for kernels, there's make oldconfig, but I realize there can be complications and a little more technical stuff, but upgrading a debian system for me is very straight forward. Set it and forget it. (I used to do automatic updates with WindowsUpdate, but there is still a patch out there that makes my Athlon laptop freeze up randomly).

Things that need to be pointed out.

[zerocool^]

Few quick observations...

1.) Microsoft end of lifed windows98 on Jan 16th of 2004. That's 6 years of supporting an operating system, folks. That's impressive. $100, and you got downloadable updates for 6 years? RHN subscriptions or enterprise linux don't touch that. So, if they don't provide security updates for it anymore, it's only because, in terms of software, it's ancient and it should be phased out. Upgrading to get security sux, but who'd buy a new computer and willingly want to use their old win98 on it (i know slashdotters can always come up with whatever reasons for anything, but in the general public).

Yes the Linux kernel, even back to 2.2, is still being updated. And yes, linux updates don't cost money. But, what if I have just downloaded kernel 2.4.11, and it works great, and oops, we found a problem in 2.4.11. The solution is to upgrade. Not patch. What if going to the new kernel breaks stuff that used to work, while in the process patching an old hole?
This is different, but similar to MS. "You have a problem with 2.2.7? You should try to upgrade to 2.2.26 or 2.4.24." "You have a problem with windows98? You should upgrade to ME or XP."

2.) The article claims windows has not had security holes that were exploited before a patch was available. I don't think this was true, but keep in mind, the VAST VAST majority of Microsoft problems are with outlook, internet explorer, office, IIS, exchange, etc. Technically, these are not windows problems. It's like saying that wu-ftpd has an exploit that gives a user root access (which is almost always true), and then blaiming that on the kernel dev team.

Or, it's like OpenBSD. "Only one remote hole in the default install, in 7 years". My ass. The default install is unusable as an OS. How do they accomplish their security claim? Partially through well-written systems. Partially through turning off every freaking useful service known to man that you would want to run on a server. And yet, people hold them up as a paragon of security. The holes in OpenBSD are from other programs, the masses cry. But no one thinks about the same thing in terms of microsoft.

3.) The time warp thing is confusing me. Everyone is saying that it's a logical fallacy that Microsoft could have released patches for security bugs that are not yet discovered? Or, what, i'm not following. The have the code, they test it, they find a bug, they try to release a patch before it gets exploited. This involves, as has been discussed, not mentioning that there is a bug, but i suppose security through obscurity is still security.

How many times have we seen a story on slashdot that exclaims how microsoft has yet another hole (!!!!1!) and then, 40 minutes after the bashers have played their part, someone comes on and says "people should have applied this patch (link) which is discussed in MS Knowledge base 7498923298232"? I see it all the time.

The average linux user is smarter than the average windows user. Therefore, we tend to keep our shit up to date. Microsoft tries to make it as easy as they can, but there's no such thing as idiot proof (i mean, in windows XP, the windows update service pops up on the first run of the OS and asks you if it can run in the background, checking for updates, and downloading / installing them automatically for you!).

I'm not trying to defend microsoft here, all I'm saying is that, before you bash them, think.

~Will

Re:Kernel upgrade...

[dougmc]

I don't remember ever applying a MS patch that messed up another piece of software.

You must not have applied many MS patches then.

Here is the big example that I can think of -- SP6 broke all kinds of stuff. So much stuff that MS released SP6a shortly after. And that's hardly the only example.

Poor analogies

[ratpick]

The analogies in previous posts (locked doors/crime, cancer/treatment, etc) are entirely inaccurate. A more proper analogy might be the fixing of a defective door/window in an apartment building, where the fix is observed and the problem exploited before all units are updated.

Why is this phenomenon so hard to accept? When I first played around with Linux, I put up a server on multiple T1's of bandwidth to experiment. After pointing a domain to the system, it was attacked and compromised regularly, but only after a patch was released. Yes, that's right, Linux suffers the same problem. Now, I'm certainly not advocating the cessation of security patch development. The people reverse-engineering patches for exploits are small potatoes--the real threat is the person capable of ascertaining and exploiting holes on their own. However, releasing patches does facilitate the development of exploits by those who would otherwise be unable.

I hate Microsloth as much as the next geek, but the issue here is not whether patches facilitate attacks (of course they do). Exploits will occur regardless, and I for one would rather have the opportunity to pro-actively patch my systems instead of hiding in a Saddam summer home. The issue is half-assed buggy software that requires so many patches, and security holes that totally compromise systems.

Oh, and I don't buy the 'logical fallacy' BS either--I've seen it happen, so obviously their argument is invalid, or the premises false, or both.

"Even logic must give way to physics."

Post leaves out most important quote

[geekee]

" Instead of working it out for themselves, malicious hackers are reverse engineering the patches to better understand the vulnerabilities, said David Aucsmith, who is in charge of technology at Microsoft's security business and technology unit."

Of course I wouldn't expect a biaed site like /. to bother even considering MS's arguement. The post doesn't even bother to explain the MS position, but instead just continues with the mindless MS bashing that I've come to expect here to insure that no meaningful disscussion ensues and nothing is learned from MS, since of course they can't possibly have anything usefull to teach us about computer use and misuse.

Gross misquotes there

[Temporal]

The head of Microsoft's security business and technology unit states that Windows is never vulnerable until a patch appears

He said no such thing. Not only does he say no such thing, but you (Michael) are clearly aware of it. To claim that the vulnerability doesn't exist until a patch appears would certainly be absurd, which is probably why no one made that claim.

The article is simply making an observation: That most vulnerabilities are not actually exploited until after a patch is released. This is an observation, not an assertion. It seems like a very reasonable one, too, since most evil crackers are not smart or patient enough to go though Windows binaries instruction-by-instruction looking for bugs. Instead, they just wait until a patch is released, and see what was patched. That way, they know where to look.

No one is claiming that a bug can't be exploited before the patch is released. They are simply pointing out that they usually aren't.

Michael, you can't just misquote people like that. It is obvious from looking at the comments here than most people did not read the article. Most people believe what you write, and don't realize that it is a gross exaggeration of what was acutally said. Even if it is Microsoft (and mind you I'm no fan of Microsoft), it's still not ok. Don't stoop to Microsoft's level; lying about your enemy is not the right way to win any battle.

It's posts like this that made me give up on Slashdot as a source of anything other than humor long ago (see the sig).

Windows updates

[King_TJ]

I hardly call Windows updates for home use "painless", for many people out there.

Just this morning, for example, I helped a guy get his older PC updated from Windows '98 to 2000 Professional. Problem is, he's using AOL dial-up with a 56K modem. Ever try downloading the latest Win2K service pack over a 56K modem? Now, how about the IE 6 service pack 1, not to mention the other misc. update patches MS has out as "critical updates", and then the handful of "recommended updates" which you probably want, also. Did you install MS Office on that machine afterwards? If so, guess what? More critical updates to download (MSDAC objects need a patch after they get added by Office)!

As far as I'm concerned, the average "home user" has the most painful upgrade experience of all. It can take close to an entire day to download everything needed via modem. (You can't even do it all at once, in a big batch, either, because a number of the patches have to be installed individually, followed by a reboot! So that means pretty much babysitting the machine all day, if you want to get everything updated without spreading it over days and days.)