Slashdot Mirror
XP2 Spotted In The Wild
LostCluster writes "WinXP SP2 has just been released to the public via Automatic Update, but eWeek and PC Magazine are together reporting that Windows XP SP2's 'Windows Security Center' is just about as insecure as it could possibly be. According to them, any program (including ActiveX controls) can access and edit the Windows Management Instrumentation database, and therefore spoof the security status of an insecure box to report that it is properly secured."
I was told it was rolled out today (SP2), so can someone explain why my XP machines wanted to install the SP2 patch a few days ago?
why does this surprise anybody - I am sure glad I don't do windows anymore - I can get on with a lot more important things and my computers just work - don't have to defrag, virus update, or worse yet os update from microsoft. now if my dsl provider can just get more reliable life would be great.
Fact: You cannot bolt on security to something after the fact-- it has to be designed in from the ground up, or it's worthless.
Exhibit A: Windows.
Bill can announce a new security initiative every day from now until Doomsday, and it won't mean a damn thing unless they scrap Windows completely and start over. Period.
another good reason to wait a few more weeks before applying sp2
If a boxen is 0wned then we can savely assume that the 0wner/w0rm has root access. And with root access it can do anything anyway.
This is like complaining that one can shut down your computer by removing the power plug.
To spoof the Windows Security Center WMI would require system-level access to a PC. If the user downloads and runs an application that would allow for spoofing of Windows Security Center, they have already opened the door for the hacker to do what they want. In addition, if malware is already on the system, it does not need to monitor WSC to determine a vulnerable point of attack, it can simply shut down any firewall or AV service then attack - no WSC is necessary."
Sadly just about everyone runs shit as Administrator (it is the default mode for XP Home installs) to make life easier and as MSFT has noted they are opening themselves up to the attacks... For those that will mention that Linux is so much better remember that these are the same people that wouldn't like to have to change to root (sudo, su, login, whatever) to install anything and would be opening themselves up to the same vulnerability level as if they had been running Windows.
Basically the problem was in design... They should not have had an open API controlling the "WSC" and thus malware would not be able to detect the presence of the programs' status from a single location. The real problem is that MSFT isn't admitting that it is a serious problem and needs to be changed on a different level... Saying that malware writers are going to use the direct route and disable the firewall/AV outright, while true, doesn't get them off the hook for creating this hole that is more difficult even for a more advanced user to notice.
Seriously, this is just more scaremongering. The WMI system has to be accessed locally, and their examples of how this could be circumvented is pretty silly. ActiveX apps on a web page won't run unless you specifically tell them to. The only other ways are via a downloaded application. It boils down to "you have to do something on your computer that lets a malicious application run". How is that any different from any other operating system in the world? Even as a non-root linux user you can fuck up a system by running a malicious script... I don't get it.
Am I missing something?
Let's be honest. Did anyone really expect SP2 to not need a slew of new patches after release?
Personally, I'm just glad that it doesn't bomb randomly after install. Yet.
No, most user's don't need to be root most of the time. Yet:
While we are not aware of any malware exploiting this, we think it will only be a matter of time. The one mitigating factor that we found is that to change the WMI, and spoof the Security Center, the script has to be running in Administrator mode. If executed in Windows XP's Limited Mode, it will give an error, and not allow changes. Unfortunately, most home users who will be at risk, run in the default administrator mode.
How can we convince people not to run admin mode? It's easy at work, in UNIX land (most people don't get to know root pw.) But most Windows users I know don't even know the difference.
Every windows security problem I know of can be solved, or at least significanly mitigated, by users not running root.
everything in moderation
And all running the same distro. And all running Internet Explorer with crossover. ;-)
Slashdot anagrams to "Sad Sloth"
Windows XP SP2's 'Windows Security Center' is just about as insecure as it could possibly be.
and you were expecting what???
Remember Windows Management Instrumentation requires administrator credentials. If you have admin priveledges on any box, you can do much harm, regardless of the Operating System
Consensus is good, but informed dictatorship is better
According to them, any program (including ActiveX controls) can access and edit the Windows Management Instrumentation database, and therefore spoof the security status of an insecure box to report that it is properly secured.
A protection scheme that reports that it is secure while actually being totally insecure is worse than no protection at all. A lot of people will use ZoneAlarm or whatever and their own virus scanner, but if too many people believe their machines are secured, this SP may have the opposite of its intended effect: *more* unsecured PCs attached to the Net than before. MS should stick with their old policy of not introducing new features in service packs, just bundling bug fixes and security patches together.
The next thing to be said is usually: "But most home users run as admins." (The article also mentions this.) Well, that's not a Windows problem; that's a user problem. Even if Windows forced users to run in "limited mode" (which would cause an outcry in itself - "eek, Microsoft is trying to take away control over our own computers from us"), it also doesn't help that most third-party software for Windows requires admin rights either to install or *gasp* to run. Of course, this is ancient news to everyone with a clue
Of course, even when running as admin, protecting yourself against malicious code is fairly trivial; simply use a firewall (SP2 incidentally includes one), don't run binaries from untrusted sources, surf the web and check your email using something other than IE/Outlook, use a virus scanner/shield, and keep your apps and OS updated. Again, no news to anyone with a clue.
Quality, performance, value; you get only two, and you don't always get to pick.
I love my Linux box but I expend far more effort keeping it locked down with constant updates than I do my Windows boxes.
I'll say it again, OSS will never suceed with end users as long as so many in this community take an "Anything But Microsoft" stance.
What Microsoft is doing is analogous to me trying to turn my apartment into a bank:
Initially I just put up a sign that says "Bank" and leave the money lying on my sofa. Then when I get tired of people walking in and taking the money I lock my door. Then they kick in my door, so I get a thicker door. So now they climb in through a window, so I close and lock the windows. They break a window, I put up shutters. They cut through the floor, I lay down cement; ceiling, I add an alarm; they cut the electricity, I buy a generator. Maybe at some point I buy a safe, which works until they pick the safe up and roll it out of a hole cut into my wooden walls. This goes on for years, until eventually I get fed up and move out, and have a building built to purpose that's secure as a bank should be.
Where this analogy breaks down is at some point pretty early on customers would stop giving me their money until I got my act together, where they've shown no intention of doing the same to Microsoft.
Uhm... yeah. Easy to fake by a program already running as admin on your box. Why would such a program even bother?
The point of the security center is so you dont get that malicious code running on your system in the first place. If it does, your systrem is already compromised, and nothing can be trusted anyway.
No OS can protect against malicious code running as root/admin.
I.O.U One Sig.
oh sorry I thought the fact that using a scrollbar could install and run a program without asking WAS A SECURITY ISSUE IN ITSELF regardless of what that program would then do.
oh and *ONLY* wipe a user's directory? what fucking planet do you live on?
The only way to make joe user NOT want to use an Administrator account is to make it anoying to use. IE: -Display a NAG window everytime the user launches an application. (Maybe only if the user spends more than 30 minutes in the account) Maybe even make it easy to do some admin tasks easily as a Limited user by prompting for the administrator pw when required like Linux distros do today.
Obama's legacy: (N)othing (S)ecure (A)nywhere and (T)error (S)imulation (A)dministration
Hey Do you know any of these people? They sound like they have the same (or very similar) problem
One,
Two,
Three,
Four,
Five,
Six,
The historic problem with all variants of 'nix is that the (sensible, smart, aware) user who does operate a computer without elevated priveledges is very much in the minority... most home 'nix users just run as root (must be the type who like rebuilding their systems every week!) - hence all this great 'nix security is just a puff of wind... they blow it out the door every time they log on.
Yet for the (smart, aware etc.) minority who do care about system securities... an inherent drawback of 'nix (with the exception of Hurd) is that programs cannot elevate themselves to su and drop access rights again whilst running - software often needs elevated rights for any of a million reasons... yet instead we have to run the whole program with su rights (dangerous, silly, insecure).
The workaround has always been to use scripts because a script can elevate itself to su rights... hence the propensity for 'nix users to promote scripts and the command line (and you thought the 'nix community don't like GUI's because it is a "Microsoft or Mac type thing")... the reason GUI's are avoided in 'nix is because you really can't do anything with them (a GUI app cannot elevate itself to su while running) - it's not because we just like the look of plain old text characters
"install and run a program without asking WAS A SECURITY ISSUE IN ITSELF regardless of what that program would then do"
Uh, it doesn't install a program. It drops a file in a directory. Granted, this directory is sort of important (Startup) but it's only for the user, not the system. Even if it tries to access important files, like I mentioned, it'll be denied on a correctly-configured box.
Also, the act of scrolling doesn't run the program, but restarting does. Small point, but kind of shows you know nothing about it.
"oh and *ONLY* wipe a user's directory? what fucking planet do you live on?"
The same planet where UNIX has had the exactly same scheme for 20+ years, Windows for 10 or so and Mac OS X for 5. As far as I know, short of a dumb terminal, there's no system in the world that can prevent users from doing dumb things to their files. It's the ones that screw up the system that need to be prevented.
People, get a clue: a "malicious site" can't do anything to your computer, unless your box has already been compromised.
PC Mag, here's an idea: tell the users what the real problem is. You damn well know what it is. But you're afraid, because they spend a shitload of money on ads.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
You're right, I wasn't as clear as I should have been - "users running with more privileges than they need" is indeed what I meant.
I'll grant that some of the Windows defaults are appauling, security-wise, and creating users as Administrators is part of that. Microsoft are making an effort to advertise features like Run As, though - there's a topic in XP help explaining why running as an Administrator is a bad idea, for instance.
(That said, I've no idea how many people actually read it, of course).
The point I'm trying to make is that any system with uneducated administrators is going to have security problems, sooner or later. Most Unix users tend to do their research and understand why running as root is a problem, as do the application developers. If your applications will run fine as a normal user, then people will run as a normal user.
That doesn't apply as strongly in the Windows world - people are much less likely to do any security research, and application developers do have a tendency to make it harder for people to run as a user. That's beginning to change, though - the current guidelines for the "Designed for Windows" logo on software include a requirement that software runs correctly as a non-administrator.
Hopefully, the next release (be it a SP3 or Longhorn, should it ever be released) will concentrate on the user education side of things, and make it easier to do the right thing with regards to least privilege.
Maybe you've seen the old motto. MS: "The whole world is our beta test site."
Why is MS software so insecure, and just plain sloppy? Maybe their management model just does not allow a programmer to finish his work. Later some poor guy is assigned to fix a terrible bug that is getting publicity, but it is difficult, boring work trying to understand what someone else did, and he makes mistakes.
Either that, or you are doing something wrong. Here at work we have, oh about 500 Windows machines and maybe 200 Solaris machines and some Linux machines too. Of the Windows machines, I'd say 200 or so are already on SP2. They don't crash on bootup and SMB traffic is ALWAYS flying over our building (it's a single large subnet too).
As for AVG, well, you screwed something up. It detects fine on every system I've put it on. As for Norton, it is a documented Norton problem, and they (Norton) are working on it.
As for security centre, yes, this is by design. They know users ignore the update installation requests, so they want it automatic. Just tell it to quit bothering you, and it will.
What I find really funny is that this user, who appears quite clueless, is modded informative when all the replies are not. Look folks, anti-MS != informative.
What would happen if Microsoft limited the administrator account to 16 colors and maybe a low resolution. Would people learn quickly to use a user account to play games? Would administrators still be able to get their work done with said limitations?
This is just one of those off-the-top-of-the-head-and-not-thought-out type ideas, but i'm curious.
Why do I have this? I don't smoke.
IE is actually usable for the first time since, err, ever. The extra nag dialogs and the pop-up blocker go a long way towards keeping spyware off your machine. Lets face facts, most people will never stop using IE. They will go to their deathbeds using bundled software. They will never switch to Firefox or Opera. This is the service pack for them.
The nag "Where if your anti-virus" box is a reminder that windows needs an AV program to run properly. I can't stress how important a built-in firewall is, even if it is "weak" its still going to introduce people to the concept of a firewall much more than the old version did. Personally, I dont think ports over 1025 should be blocked by default, but that's just me.
I've been running SP2 since MS released the final version and am pretty pleased with it. XP even feels snappier. It passes the "grandma" test fairly well and like you wrote is a good first step towards securing windows. If it only helps fight spyware installs its worth its bytes in grams of gold. Especially for us techies who get called, bothered, etc for stuff that is completely preventable.
This is really the first step to securing windows for the everyman, if such a thing is truly possible. Soon enough current machines will be replaced with machines with processors which understand NX, thus making the feared buffer overflow much less fearsome.
Even though SP2 is going to cause all sorts of headaches with clients, friends, and family, I'm very optimistic about what it can do to help stop spyware and to a lesser extent worms and viruses. Its a real shame there isn't an equivalant SP for the HUGE win2k user base out there. Seems like the script kiddies will now be focusing on win2k machines from now on.