Slashdot Mirror
XP2 Spotted In The Wild
LostCluster writes "WinXP SP2 has just been released to the public via Automatic Update, but eWeek and PC Magazine are together reporting that Windows XP SP2's 'Windows Security Center' is just about as insecure as it could possibly be. According to them, any program (including ActiveX controls) can access and edit the Windows Management Instrumentation database, and therefore spoof the security status of an insecure box to report that it is properly secured."
Microsoft released SP2 in a staggered fashion. First to MSDN subscribers, OEM's, Enterprise customers, etc. Second, SP2 was unleashed to XP Home Edition via Windows Update. Today, they're finally allowing XP Pro users to get the patch. It was intended to allow corporate customers the ability to disable the update to their clients.
Administrator is the default context for XP Pro, too, if you create users at install time. I run as administrator, but I use Firefox to browse everything but windows update, and I have Norton installed and auto-updating itself every day. Hence I am operating in an insecure fashion, but with little risk.
(Watch me get owned tomorrow or something, but nonetheless, I stand by my statements.)
On Linux I do typically do everything as me, and sudo when I can, but some programs don't work right when you sudo, they need a full root environment. On windows, using run as often doesn't work right because spawned programs revert to your user context (though not always? I'm not sure what's going on there), and many processes spawn new processes to do their dirty work. Even a lot of installs work this way, unfortunately.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
I noticed it was up last night to I installed it.
It's 94.50 mb which takes a while to download. Upon installation and restart the new windows security center pops up and trys to get you to turn on your firewall, automatic updates and antivirus software. By default if any of these are off, there's an obnoxious red shield in the system tray. Turning off alerts for these makes it go away.
Otherwise there doesn't seem to be any major changes.
So far nothing's borked.
Step 0: Open IE
Couldn't even drag the scrollbar in Firefox :-/
Then I opened IE and tried it - jackpot. Nice little booom.exe in my startup folder. I have SP2 installed. Good grief.
I hear there's rumors on the Slashdots
My box says it's insecure! So therefor, I can't possibly have some spoofing ActiveX control thingie, can I?
Then your system is properly configured, everything is correct.
I guess that depends on what you mean by "have to". An out of the box Fedora Core 2 system will work and play just nicely with your email, office, internet, graphics, video, etc. An OOB Windows XP install will only last 20 minutes once connected to the internet.
LilMikey.com... I'll stop doing it when you sto
That's because you got the network admin version, which has every little bit for every possible system so that admins can customise it for the systems running on their networks. The version designed for single computers is between 50 and 80MB according to how well patched your pc is to start off with. You're right that they're, effectively, rolling out XPv2, but your reasoning's off.
That's the network install, which includes every update since XP was released plus code to figure out what version of Windows you're actually running. If you download it from Windows Update it does all that before-hand and only sends you the stuff you need, which makes for a much smaller download.
Great work Microsoft! After all the beta-testing, SP2 is still broken. Here's what I've found so far that's messed up badly:
What I find funny is that ZoneAlarm's AntiVirus monitor feature detects AVG and Norton properly.:P
My Systems
Of course, you can "update" them also with mod chips, but I don't think that that is what you had in mind :)
What a moron.
First of all, the update was NOT anywhere near 400mb.
Secondly, it contains every update, every fix, etc since XP was released.
Thirdly, it contains these fixes for every version of XP--home, corporate, pro.
thanks for playing!
Yes it does
Mozilla has never had a security bug, right?
You run *any* OS as root or equivalent on a daily basis, and you're going to have problems sooner or later.
Okay, so if you're running IE that's more likely to be "sooner" than "later" but the point still stands - the main problem is running systems with more privileges than they need.
XML-based file system? I think I'd rather superglue my hands to a rhino's ass - I'd be less likely to get a Darwin award.
You might also want to do some research into ACL support in Linux. It's there, and it sounds a lot less complicated than "XML driven agent based security infrastructure". Ever heard of the adage "Perfection in design is not achieved when there is nothing left to add, but when there is nothing left to take away"? Simpler designs are generally better, so long as they get the job.
The way I understand it, SP2 is 400 MB because it replaces the entire core of the operating system with executables and libraries compiled with a newer version of the compiler.
My username does not make me Apathetic. It's irony, get it?
I was going to mod you down, but just in case you really are ill-informed and not just a troll, in the interest of enlightenment I'll reply instead.
I don't know what Unix you're using (perhaps Version 7 on the Interdata 7/32 or some other forgotten vintage system), but modern Unix-like operating systems, such as *BSD, Linux and Solaris, by default create user's home directories with permissions user: read/write, group: no permissions at all, world: no permissions at all, and no special ACLs. Filesystems for these operating systems support ACLs (much like NTFS ACLs. Personally, I've found the user/group/world permissions have covered every case I've encountered, but that may not be true for everyone hence POSIX ACLs were created).
Certainly in the Linux world, major distributions turn the firewall on by default (RedHat since at least 7.x, and continuing into Fedora Core) during the install process. It's been a proper stateful inspection filter since before XP was even out. Also in a Redhat or Fedora install, you are asked to create a non-root user. The Windows XP install also asks you about what users you want to create, but by default creates them all with root privileges.
Oolite: Elite-like game. For Mac, Linux and Windows
Home, Pro, Corporate, Media Center Edition and Tablet PC Edition.
Who gives a rip if the operating system survives but the data doesn't?
That is true if you are the only user on the system, however if you are not, then I'm sure the others take comfort in knowing you cannot hose their data or the OS it resides on.
Finkployd
"Someone please explain to me how this is different than Linux?"
Most programs on Linux run happily as a non-root user. So many programs on Windows force you to run as an admin user that most people who even think about trying to run as a non-root user quickly give up...
If you could both install and run software in limited mode, how is it limited??? I'll probably get flamed for this, but limited users under XP are more trouble than they're worth. A lot of older software refuses to run. As long as you run a firewall, Antivirus software, spyware detection software, know what software you install and why, and don't casually click past warning messages on the web (or better yet use Firefox), you're fine as an Administrator. Granted that's a lot of shit, but hey, that's what it takes. The *nix approach of only having access to your account's data is great for a multiuser box, and can probably stop your machine from being turned into a drone, but for most desktop users, your data is the most important stuff on the box!! Screw the OS internals, you can always reinstall. . .
"The problem with internet quotations is that many are not genuine" -Abraham Lincoln
I installed the official release of SP2 and installed it on my mom's laptop last night, only to be greeted with a nice informative blue screen upon reboot.
n ews.jhtml?articleId=23905071
http://www.crn.com/sections/breakingnews/breaking
I had to boot into recovery mode and run a batch script to uninstall SP2, just like the article outlines. Then I had to go into the registry and change some keys, then do an uninstall via the add/remove programs wizard. Man, thanks Microsoft for a full night.
I'm not sure if I'm going to try again, we'll see how I feel after stewing about it all day...
META REFRESH is not a good way to redirect people, and furthermore, it's not standards compliant. Allowing META REFRESH to direct users around the web without their consent is deceptive, and a major usability problem for users.
One of the big goals of SP2 was to improve the web browsing experience for users tired of getting hijacked by bad nasty web pages that intentionally use seemingly harmless methods to corral, trap, and frustrate users.
A lot of people use the META REFRESH directive to move them to a new URL once an old one has expired. Even on FireFox/Mozilla this can be used to trap users, enable phishing, and the like.
Better methods when you can addresses is to:
Use server side URL rewriting, like in mod_rewrite or like available in IIS
Display a simple page with a large clear hyperlink and message to update the original link
Display a simple page like above and use a simple Javascript to move the user (unlike META commands, the Javascript can be disabled).
Use the appropriate 3xx HTTP status code and let the client handle the change appropriately
I fail to see what the fuzz is about. That a program running with admin priviliges on a compromised box can do whatever it wants to?
.m
Come on, this is just nonsense. XP SP2 has a slew of security enhancements to make it harder to compromise a box, but it doesn't change the fact that once a box is compromised it can never be trusted again. Game over, reinstall!
First of all, the update was NOT anywhere near 400mb.
Erm - the version that I downloaded from MSDN is 498,436,096 bytes. This is the ISO image version (which was the only one that was available at that time).
"Linux is an OS"
Linux is a kernel not an OS.
Actually, under XP, many programs take advantage of NETWORK SERVICE and LOCAL SERVICE accounts, which are not quite the same as SYSTEM. I believe IIS is one of these programs.
Root? Unfortunately privilege escalation seems to very big problem which does not get as much attention as it deserves.
Its critical that you know and trust your users and take care of what applications you decide to run especially as plenty of exploits are readily available.
As for the spoofing "Security Center" it ignores the fact that evil.exe required a prerequisite compromise to have taken place.
Hey. I hate Windows as much as the next guy, but if you want to make a compelling argument you should at least be fair.
Windows XP came out in 2001. Do you really need me to tell you that running a RedHat distribution from 2001 would be suicide right now?
-If God wanted people to be better than me, he would have made them that way.
Hmm, I just tried it, and the meta redirect is working for me on XP/SP2.
I just looked, and in Internet Options/Security settings, there's an "Allow META REFRESH" checkbox, which for me is enabled. I don't know if I've set it in the past, but I didn't do it recently. I am running a "custom" security level, not a prepackaged one.
But the grandparent's assertion that there's no way to change it appears to be wrong. I've tried both 302 and meta refresh redirects and both work for me on XP/SP2
You probably don't know it, but marketing is about giving people the product they want. Unfortunately many companies (and Microsoft is one of them) talk about marketing, but what they are really talking about is advertising.
"What if somebody could tell if their machine was secure just by opening a control panel?"
This statement would be a really bad example of marketing: The company and/or its developers and "marketing" experts sit together and brainstorm without ever actually asking the customer. If they were to ask me this exact question, my answer would be:
"Are you really this insane? I don't want a control panel to tell me whether my machine is secure. I want the machine to be secure, plain and simple. Given MS Windows' (whatever incarnation) security track record, I neither would nor could ever trust any application that tells me the security status of the machine from within. It's probably already cracked, infested or whatever anyway by the time I check it. If history tells us anything, it's that any application can be made to tell me that it is secure."
I couldn't agree less with you. According to developers who are far more experienced with Windows than I am (IANAP), Windows is insecure by design, no fix or additional security layer on top of the current product will ever make it more secure. The only way to fix it, is to dump it and start from scratch.
This is the Microsoft equivalent of Sourceforge Development Status 1. It's a dog and pony panel that will undoubtedly be replaced by something good in the future -- but by that time, most of the industry will have lost all trust in it.
Many people argue that XP is, while more stable than all previous versions, with the notable exception of W2K, is still in development status and many of its design features are so braindead, that many knowledgable people have already lost trust in it.
IMHO, this is yet another stupid toy to make the casual home user and the boss feel more secure without actually delivering on the promises. If you were to ask them, they would all answer that they want a machine that is actually more secure rather than a having a MS tool that tells them they are. Once they told you, you design a product that is actually secure and does what the customer wants. This is marketing from an academic's point of view.
I feel so sig.
I *think* that exploit is XP only.
Windows XP came out in 2001. Do you really need me to tell you that running a RedHat distribution from 2001 would be suicide right now?
Assuming you never patch the system, I agree. However, assuming that you're the slightest bit proactive about maintaining the box, I strongly disagree.
I use RH7.3 as a baseline for my systems (because RHEL costs too damn much, and because I'm not particularly fond of 8, 9, or FC) and while it's not quite that old (early 2002 as opposed to 2001) it's stable and secure. Of course, I do make use of Fedora Legacy via yum for most of my updates, but presuming such are not available it's not exactly a dificult task these days to, say, rebuild OpenSSH from source if security issues are found.
What part of "shall not be infringed" is so hard to understand?
The ~280MB "Network Installation Package" is targeted primarily at network administrators who'll want to update multiple computers. It contains files for updating all versions of XP, including Home, Professional and Media Center Edition. It can also be distributed through SMS, GPO etc. or "slipstreamed" into XP installation sources so that new installations have SP2 from start.
The smaller package that is distributed through Windows Update contain only the files necessary for the platform it's downloaded to.
Mattias
Even if you could get a user to dot run as admin all the time, it's not going to help. Why? Because users WANT to run the stupid shit that infects their comptuer. They go to install Kaazaa, it says "I need root to install", you think they are NOT going to enter the root password? Of COURSE they will, they want Kaazaa on their computer, they'll do whatever it asks them to do.
As a receant example later variants of one of the receant worms was zipping itself and encrypting the zip to try and evade virus scanners (successfully, for a little while). That means you had to get the password from the e-mail, and use it to unzip the executable, then run it.
Guess what? People did. They went through all that trouble, because they believed the program to be something they wanted.
There is really no defense against stupid users, when they own the box. They can get admin, and will whenever they want it, even if it's not the default.
I'll probably get flamed for this, but limited users under XP are more trouble than they're worth.
No, you've hit the nail on the head. "Administrator" under Windows XP is not like "root" under UNIX. The former is something that came along fairly recently and put down a few arbitrary restrictions on applications. Problem is, most Windows software was written prior to XP, and at one time the restricted items--like writing to your own application folder--were the accepted ways of doing things. There are even developers running older versions of Windows who don't know about the issues involved.
Furthermore, when you install a new application you have no way of knowing if it will work in a restricted account. So first you install it the proper way. Then you have to load it up and experiment with it for a while to find out if it is clean. Sometimes this is hard. Maybe it only gets caught when you try to save a document template or a window layout or some other less common activity. When this happens you have to uninstall and reinstall to a folder outside of "Program Files." This is generally not worth it. If you're running a firewall, anti-virus program, and not using IE, then running as administrator isn't a bad thing. Remember, even in administrator mode programs can do all sorts of bad things to your system, like emailing or deleting your files. It's only the "Windows" and "Program Files" folders that have any protection on them. To repeat: this is not like running as root under UNIX.
As far as I've managed to tell it has only "broken" one thing for me. The outbound TCP connections were limited to 10/sec. But then I went here:
http://www.lvllord.de/?url=tools#4226patch
And found a fix for it. All of the FUD that I've seen about SP2 breaking things mainly focuses around which apps aren't automagically detected by the built in firewall as "allowed". Considering that having to add rules to a firewall config is pretty standard amongst all firewalls, I'm pretty lost as to why this is considered "breaking" an app. I'll admit the TCP thing was frustrating, but that's the only problem I've encountered.
So for what it's worth, I've been running SP2 in beta and release form for about 1 month now on my primary system. And I've had only the one TCP issue. I've also had it running on 5 other "test" boxes (read: other family member's computers). And so far no one has reported a problem. Although obviously YMMV.
I'll admit I haven't formally been running the XP firewall (I turned it on to check it out, but I have my own firewall solution that I prefer). But turning it off was easy enough and I checked into configuring it and that seemed easy enough as well (you go into the control panel icon and select the programs you want to allow incoming access on).
Now lets not continue down the road complaining that it's broken because it's too difficult for "Joe Blow" to configure his firewall and as a result we should consider it "broken". Realize that at the same time "Joe Blow" probably can't properly configure ANY firewall. User ignorance doesn't mean something is broken. If I put power steering fluid in my brake lines because I don't know better, and my brakes lock up, that's not the car's fault.
If the OS has the concept of a superuser, then you're correct. However, that's ignoring other OSes that are built on capabilities or mandatory access controls. Those do away with "root users" altogether, and replace them with users with sufficient access to grant necessary rights to other users. These aren't hypothetical creations, but real systems in use, today, in high-security installations.
Dewey, what part of this looks like authorities should be involved?
Add to this that Windows doesn't give the user a facility to promote (and demote!) themselves easily its really hopeless. This problem has been around since NT 3.1 and has been compounded by the integration of IE into the kernel. And yes I know about "runas" but it doesn't work correctly for many apps (even ones provided by MS).
So Windows offers you as an IT manager two options:
- Remove admin rights from users but anytime an application requires a minor elevation in rights you will get pestered.
- Give everyone admin rights but watch installations like hawk because they might accidently misclick some link at some googled web site that wasn't what was said.
Either path is expensive. I curse MS every day for creating a flexible permission system, access control lists that are well integrated across the enterprise and then promptly not use them in any of the right places.
I'm stumped and have given up all hope of figure out what to do beyond pray. As long as MS clings to this system this Windows will be an expensive PITA system to maintain on the enterprise.