Slashdot Mirror

← Back to Stories (view on slashdot.org)

XP2 Spotted In The Wild

Posted by michael on from the watch-out-or-it'll-chew-you-up dept.

LostCluster writes "WinXP SP2 has just been released to the public via Automatic Update, but eWeek and PC Magazine are together reporting that Windows XP SP2's 'Windows Security Center' is just about as insecure as it could possibly be. According to them, any program (including ActiveX controls) can access and edit the Windows Management Instrumentation database, and therefore spoof the security status of an insecure box to report that it is properly secured."

115 of 634 comments (clear)

  1. Clippy.exe is eeevvviiilll by Anonymous Coward · · Score: 5, Funny

    any program can access and edit the Windows Management Instrumentation database

    That MF'ing Clippy.exe in MS Word better stop accessing my Instrumentation database or I'll punch that SOB into the middle of next week. Really any program can access and edit the Windows Management Instrumentation database; I knew solitrae and tetris and an altier motive.

  2. No problem here! by GroovBird · · Score: 5, Funny

    My box says it's insecure! So therefor, I can't possibly have some spoofing ActiveX control thingie, can I?

    1. Re:No problem here! by joxeanpiti · · Score: 2, Informative

      My box says it's insecure! So therefor, I can't possibly have some spoofing ActiveX control thingie, can I?

      Then your system is properly configured, everything is correct.

  3. SP2 - as secure as any linux distro... by BobRooney · · Score: 5, Funny

    if every user were root.

    1. Re:SP2 - as secure as any linux distro... by Red+Alastor · · Score: 4, Insightful

      And all running the same distro. And all running Internet Explorer with crossover. ;-)

      --
      Slashdot anagrams to "Sad Sloth"
    2. Re:SP2 - as secure as any linux distro... by dotcher · · Score: 4, Informative

      Mozilla has never had a security bug, right?

      You run *any* OS as root or equivalent on a daily basis, and you're going to have problems sooner or later.

      Okay, so if you're running IE that's more likely to be "sooner" than "later" but the point still stands - the main problem is running systems with more privileges than they need.

    3. Re:SP2 - as secure as any linux distro... by dasmegabyte · · Score: 5, Interesting

      And designing new programs from a marketing impetus instead of what people want.

      Seriously, this Security Console is a good example. "What if somebody could tell if their machine was secure just by opening a control panel?" That's a very good idea -- but it will take at least a year to develop something like this that actually works well enough to be a part of windows. In the meantime, they shake and bake something so people know they're working on it.

      This is the Microsoft equivalent of Sourceforge Development Status 1. It's a dog and pony panel that will undoubtedly be replaced by something good in the future -- but by that time, most of the industry will have lost all trust in it.

      Such is the case with IIS 6. It's actually pretty good, according to a lot of web programmers I know, but I just don't trust it -- to the point that I'm considering not using C# for impending web projects despite having a massive C# codebase. MS would have to go VERY far to get that trust back, and make a security leap similar to the UI leap they made from 3.1 to 95 or the stability leap they made from 98 to 2000.

      --
      Hey freaks: now you're ju
    4. Re:SP2 - as secure as any linux distro... by SilentChris · · Score: 4, Interesting

      "have a look at the "dragging a scroll bar can be used to install and auto-run arbitrary programs" example below"

      It drops an executable into the Startup folder for the *user*. In other words, no root privledge is ever exercised, and the app would likely do nothing on a correctly-configured box (the worst malware can do running as non-root is wipe a user's directory -- same as in Linux or any other OS with similar permissions). Learn about security before you comment on it, please.

    5. Re:SP2 - as secure as any linux distro... by rokzy · · Score: 2, Insightful

      oh sorry I thought the fact that using a scrollbar could install and run a program without asking WAS A SECURITY ISSUE IN ITSELF regardless of what that program would then do.

      oh and *ONLY* wipe a user's directory? what fucking planet do you live on?

    6. Re:SP2 - as secure as any linux distro... by burns210 · · Score: 2

      That is the microsoft way. They release version 1, and it sucks, version 2, sucks less... They don't have a bid deal on 1.0! the way Apple or open source projects do. Microsoft evolves their software publicly, not in the lab...

      Office, IE, IIS, Windows... in their latest incarnations, they are varying degrees of good/decent software(configured correctly, ofcourse)... But their first 2 or 3 or 4 versions were bad/horrible/unholy. They got better, but they did so within the public sector, not an R&D lab.

    7. Re:SP2 - as secure as any linux distro... by 10101001+10101001 · · Score: 5, Interesting

      the main problem is running systems with more privileges than they need.

      First, let me assume you didn't mean what you said. What you *did* say doesn't make sense, as the only way for a system to run with less privileges would be for it to not even have a System Administrator account while leaving some other system with that authority. That sort of top-down authority over PCs seems quite out there for all sorts of reasons.

      So, lets assume you mean "the main problem is users running with more privileges than they need". The problem at core then is *why* they run at higher privilege than necessary. Part of the reason is that Run As and the like are not inconvenient and just not well known. In the process of making the system more "user friendly" Run As and ilk aren't at all discussed. In fact, users added at install are given power user (which can do all sorts of nasty things to applications) or administrator power.

      For the complete naive (or to overcome various limitations to Windows sessions, like not being able to do persistent apps in the background (dialup users on at least Win 2k (and possibly Win XP, though having not used it in that capacity I couldn't say), you know what I'm talking about)), this means having one account open either all the time or possible on auto-login. For the less naive (or users who can figure ways to overcome the limitations of Windows), you'll create multiple users, but then all users can still screw up the entire machine with *anything* they run. Yes, physical access does mean you can 0wn a box, but like you pointed out with so many buggy programs it also means very much that non-physical access can 0wn the box too.

      My point in all this is, even users who *try* to do some security are still fucked over thanks to MS opting for ease of use and "usability" over reducing privileges, finding a better way to have someone admin the box (and watch users flee when they realize they have to do work; oh, but it's better to go under the MS banner of low/no maintainance, turn a blind eye to the reality that most PC software needs maintained, then moan to all your techie friends that your computer is so slow, keeps crashing, etc), and teaching the user how to run the few necessary programs in "less-secure" mode (anything automatic short of extensive hashing will end up being spoofed and exploited all over, so it's better to rely on the user) while making sure Windows itself is actually designed to handle multiple people using a machine.

      But, all those stack protectors should slow down those hackers, hopefully (well, assuming they're done at runtime in a staggard approach to avoid a whole cluster of near-identical hardware all producing the same value; the last thing you want is something predictable), which is at least some small consolation for those who actually update their machine...

      --
      Eurohacker European paranoia, gun rights, and h
    8. Re:SP2 - as secure as any linux distro... by SilentChris · · Score: 3, Insightful

      "install and run a program without asking WAS A SECURITY ISSUE IN ITSELF regardless of what that program would then do"

      Uh, it doesn't install a program. It drops a file in a directory. Granted, this directory is sort of important (Startup) but it's only for the user, not the system. Even if it tries to access important files, like I mentioned, it'll be denied on a correctly-configured box.

      Also, the act of scrolling doesn't run the program, but restarting does. Small point, but kind of shows you know nothing about it.

      "oh and *ONLY* wipe a user's directory? what fucking planet do you live on?"

      The same planet where UNIX has had the exactly same scheme for 20+ years, Windows for 10 or so and Mac OS X for 5. As far as I know, short of a dumb terminal, there's no system in the world that can prevent users from doing dumb things to their files. It's the ones that screw up the system that need to be prevented.

    9. Re:SP2 - as secure as any linux distro... by dotcher · · Score: 5, Insightful

      You're right, I wasn't as clear as I should have been - "users running with more privileges than they need" is indeed what I meant.

      I'll grant that some of the Windows defaults are appauling, security-wise, and creating users as Administrators is part of that. Microsoft are making an effort to advertise features like Run As, though - there's a topic in XP help explaining why running as an Administrator is a bad idea, for instance.

      (That said, I've no idea how many people actually read it, of course).

      The point I'm trying to make is that any system with uneducated administrators is going to have security problems, sooner or later. Most Unix users tend to do their research and understand why running as root is a problem, as do the application developers. If your applications will run fine as a normal user, then people will run as a normal user.

      That doesn't apply as strongly in the Windows world - people are much less likely to do any security research, and application developers do have a tendency to make it harder for people to run as a user. That's beginning to change, though - the current guidelines for the "Designed for Windows" logo on software include a requirement that software runs correctly as a non-administrator.

      Hopefully, the next release (be it a SP3 or Longhorn, should it ever be released) will concentrate on the user education side of things, and make it easier to do the right thing with regards to least privilege.

    10. Re:SP2 - as secure as any linux distro... by bankman · · Score: 5, Informative
      And designing new programs from a marketing impetus instead of what people want.

      You probably don't know it, but marketing is about giving people the product they want. Unfortunately many companies (and Microsoft is one of them) talk about marketing, but what they are really talking about is advertising.

      "What if somebody could tell if their machine was secure just by opening a control panel?"

      This statement would be a really bad example of marketing: The company and/or its developers and "marketing" experts sit together and brainstorm without ever actually asking the customer. If they were to ask me this exact question, my answer would be:

      "Are you really this insane? I don't want a control panel to tell me whether my machine is secure. I want the machine to be secure, plain and simple. Given MS Windows' (whatever incarnation) security track record, I neither would nor could ever trust any application that tells me the security status of the machine from within. It's probably already cracked, infested or whatever anyway by the time I check it. If history tells us anything, it's that any application can be made to tell me that it is secure."

      ...but it will take at least a year to develop something like this that actually works well enough to be a part of windows.

      I couldn't agree less with you. According to developers who are far more experienced with Windows than I am (IANAP), Windows is insecure by design, no fix or additional security layer on top of the current product will ever make it more secure. The only way to fix it, is to dump it and start from scratch.

      This is the Microsoft equivalent of Sourceforge Development Status 1. It's a dog and pony panel that will undoubtedly be replaced by something good in the future -- but by that time, most of the industry will have lost all trust in it.

      Many people argue that XP is, while more stable than all previous versions, with the notable exception of W2K, is still in development status and many of its design features are so braindead, that many knowledgable people have already lost trust in it.

      IMHO, this is yet another stupid toy to make the casual home user and the boss feel more secure without actually delivering on the promises. If you were to ask them, they would all answer that they want a machine that is actually more secure rather than a having a MS tool that tells them they are. Once they told you, you design a product that is actually secure and does what the customer wants. This is marketing from an academic's point of view.

      --
      I feel so sig.
    11. Re:SP2 - as secure as any linux distro... by 10101001+10101001 · · Score: 4, Interesting

      It's actually a problem for both. It's a developer problem because most software really doesn't have a justifiable reason to be run as admin. At the same time, it's a MS problem to bow down to this problem by just making every admins instead of trying to teach users how to run those few programs as admin while *warning* them that said program doesn't really need to be run as admin and to go bug the developer over it or download a new version (the former assuming the developer hasn't released an update yet, the latter if they did).

      Heck, for all those cases when a program doesn't need to really be run as admin, Windows could sandbox the program in a pseudo-root and continue to let the program run in such a limited state (which developers might end up trying to work around instead of fixing the inherent problem, but that's a whole other point). There's also the possibility of making up "roles" for users and programs either by default (to further limit, not expand privilege) or easily accessible.

      The fact is, Microsoft hadn't until XP SP2 made any measurable attempt to mitigate the security risk to users. And even now, XP SP2 still is more reliant on filtering out possibly bad content and auto updating than educating the user and giving them options to help to secure their setup (auto update and filtering can be good things, don't get me wrong, but they're not end-all solutions and are only stop gaps to a bigger problem). Something like email viruses probably won't stop until a heavy dose of educating the user enough to not run viruses and some degree of lobotomize the system enough to never run a virus.

      So, a lot of the problem is still MS's (it's their email client for the most part and their OS which has to be lobotomized to support not running viruses). I'd also say they're pretty well required to teach the user security, given this is a new computer and security is really a key concept an internet connected user needs to understand. But, as part of MS's quest for a stable system for the home user, MS really slacked off over the issue of telling the user they'd have to be admin and they really do need to learn a lot of things if they want their system to continue running smoothly; and it can't be that MS was unaware that security was at all an issue because there actually *are* user accounts and lower privileges in NT/2K/XP; MS just decided to ignore the issue in favor of making it easier on the user who was adding programs. Making it more complex by forcing users to learn security in the short term was less marketable than progressively dealing with security flaws later as well as just crappy design decisions such as leaving various services on and exposed to what would almost certainly be the internet.

      Whew..that was a lot to write. And with all my bitching about Windows, I can't say I've personally used any other OS which does a good job of educating the user on what *not* to do while providing them ways to mitigate the possible damage on questionable programs that demand more privilege than they probably deserve (I haven't used OS X, so I can't speak for it; I used be a Windows user but now am a Linux user (except when I admin my mom's machine)). The issue of how to make administrating understandable and easy enough that all home users (or a few, given how much of a pain it is to have to get off every N minutes so someone else can properly install an app or whatever) are both willing and able to do the task is no small order. The fact that MS has for years pushed MS as "great" at administrating when it's only at best marginally better (it's a lot easier to do the granular ACL than doing various crazy groupings) really shows what's true of most companies: they're run more by marketers than engineers. The amount of work necessary to make administrating something anyone is *willing* to do is pretty mind boggling (just look up various research, or contemplate the issue of hundreds of programs, a few users, and how to make sure each program can't do harm to anything even if it *wants* to without pissing off said few users). Windows really isn't the right tool for the job; sadly no tool I know of is yet nor do I think ever will be ready. So, shall Microsoft rent out really cheap admins to everyone to improve security?

      --
      Eurohacker European paranoia, gun rights, and h
    12. Re:SP2 - as secure as any linux distro... by AcornWeb · · Score: 2, Interesting

      You probably don't know it, but marketing is about giving people the product they want. Unfortunately many companies (and Microsoft is one of them) talk about marketing, but what they are really talking about is advertising.

      <marketing drone>Actually, marketing is all about "adding customer value". So of course, we (Microsoft) are adding value by allowing our customers to more easily see whether their computer has been compromised yet."</marketing drone>

      And yes, if you can't tell, I just took a marketing class, yes it was a waste of time, and yes I'll be poking fun at it for years. :-)

      --
      Your Windows PC is my other computer.
    13. Re:SP2 - as secure as any linux distro... by cookd · · Score: 3, Interesting

      The problem is that Microsoft can't make Windows secure, and it isn't Microsoft's fault. If Microsoft added a full-featured firewall and virus scanner to XP, they'd be in a heap-o-trouble. If they get sued half a billion bucks for bundling Media Player, think how fast they'd be in trouble for new features. And if they made it even remotely difficult for any ole' program to claim to be a virus scanner or a firewall, the same thing would happen.

      Essentially, Microsoft has done the best they can in their position. And it is a very good step forward. Yes, any ActiveX control can mess with the firewall settings, but heck, any ActiveX control can do whatever it wants, including damage far beyond messing with your firewall settings. Once any attack has succeeded on your system, you are 0wn3d, whether or not the attack can mess with your security panel.

      As far as IIS goes -- please examine the exploit records. Both Apache and IIS have had exploits against them. The IIS exploits get more press because there is a finger to point, but Apache, PHP, etc. certainly don't have a clean record either. IIS versions prior to 6 have had several notable problems, but IIS 6 has an excellent track record for the time it has been available, even better than Apache in the same time period. Go with what will get your project done best in the least amount of time, then stay up to date on the patches.

      --
      Time flies like an arrow. Fruit flies like a banana.
  4. Can someone answer this question? by forgotten_my_nick · · Score: 3, Insightful

    I was told it was rolled out today (SP2), so can someone explain why my XP machines wanted to install the SP2 patch a few days ago?

    1. Re:Can someone answer this question? by hardreset · · Score: 5, Informative

      Microsoft released SP2 in a staggered fashion. First to MSDN subscribers, OEM's, Enterprise customers, etc. Second, SP2 was unleashed to XP Home Edition via Windows Update. Today, they're finally allowing XP Pro users to get the patch. It was intended to allow corporate customers the ability to disable the update to their clients.

  5. I'm sorry, were you expecting better? by Anonymous Coward · · Score: 2, Insightful

    Fact: You cannot bolt on security to something after the fact-- it has to be designed in from the ground up, or it's worthless.

    Exhibit A: Windows.

    Bill can announce a new security initiative every day from now until Doomsday, and it won't mean a damn thing unless they scrap Windows completely and start over. Period.

    1. Re:I'm sorry, were you expecting better? by ccharles · · Score: 2, Interesting

      I could be wrong, but aren't they already starting from the ground up with Longhorn?

    2. Re:I'm sorry, were you expecting better? by Serapth · · Score: 2, Insightful

      UM... have you taken a look at the size of SP2 yet? I used the MSDN install about a week back, and it was 400 megs in size. Thats as big or bigger then the initial install of XP.

      They arent bolting it on to XP, they are essentially rolling out Windows XP version 2. Sofar I havent had too many issues with the service pack, which is amazing considering how much it does. Frankly, I dont think Linux could come close to releasing a patch of this magnitude with as little side effects. Microsoft should truly be applauded for their recent actions... although, granted this is slashdot... aint gonna happen.

    3. Re:I'm sorry, were you expecting better? by chewmanfoo · · Score: 2, Funny

      Good Job Microsoft!

      I really appreciate you letting script kiddies hack my box with an ActiveX control to make it look like I'm "secure" when I'm really being ass-raped and turned into a SPAM server!

      Another excellent release. Kudos!

    4. Re:I'm sorry, were you expecting better? by Hungry+Student · · Score: 4, Informative

      That's because you got the network admin version, which has every little bit for every possible system so that admins can customise it for the systems running on their networks. The version designed for single computers is between 50 and 80MB according to how well patched your pc is to start off with. You're right that they're, effectively, rolling out XPv2, but your reasoning's off.

    5. Re:I'm sorry, were you expecting better? by Vann_v2 · · Score: 5, Informative

      That's the network install, which includes every update since XP was released plus code to figure out what version of Windows you're actually running. If you download it from Windows Update it does all that before-hand and only sends you the stuff you need, which makes for a much smaller download.

    6. Re:I'm sorry, were you expecting better? by Moridineas · · Score: 2, Informative

      What a moron.

      First of all, the update was NOT anywhere near 400mb.

      Secondly, it contains every update, every fix, etc since XP was released.

      Thirdly, it contains these fixes for every version of XP--home, corporate, pro.

      thanks for playing!

    7. Re:I'm sorry, were you expecting better? by SilentChris · · Score: 4, Insightful

      This has nothing to do with the base security of Windows. The base nuts of NTFS and the security scheme has been solid ever since it was ripped from VMS. The problem IS the bolts that have been added since then: easily-foiled APIs that have full access to some of the underpinnings when they shouldn't.

      Quite frankly, if MS never "innovated", it would be a fairly secure product. NT 3 was practically bulletproof. It's when they started grafting on Win32 junk from 9x, things started to get screwed up. Take off that top layer and everything would be kosher (but a lot less user-friendly)... just like Linux.

    8. Re:I'm sorry, were you expecting better? by AKAImBatman · · Score: 4, Insightful

      Personally, I would applaud more if their idea of security wasn't so damned screwy. For example, XP SP2 now modifies IE to reject redirects. i.e. If you have a redirect page to forward someone to your new website, IE will pop up an error message and tell you that it won't redirect. To make the redirect work, you have to add the site to your list of trusted sites. Apparently, there is no way to turn off this behavior.

      If Microsoft would focus on *real* security like that found in FireFox, OS X, etc., they wouldn't have to put these stupid "security" enhancements in. On the bright side, Microsoft is making Macs veeerrrry attractive to end users.

      --
      Javascript + Nintendo DSi = DSiCade
    9. Re:I'm sorry, were you expecting better? by Jeff+DeMaagd · · Score: 4, Interesting

      Wasn't security for UNIX and UNIX-like systems an afterthought? The difference being that it has had decades of work to get where it is now, by companies and organizations that had to make it good, and not just a few years on a product that only has to be "good enough" for consumers.

    10. Re:I'm sorry, were you expecting better? by Serapth · · Score: 3, Insightful

      Actually, I hold to my origional comment... but I want to add one thing, which MANY people commented on, and thankfully, not you! ;)

      First off... im not bashing linux, and im not saying Linux needs a 400 meg patch, because frankly it doesn't. Nor, am I saying that Linux is a worse or better operating system. Actually, now that I think about it more, although my wording was poor, what I meant to say is I dont think the Linux Community, could have pulled off a patch like this with as minimal impact as what Microsoft has done.

      Not an attack... just an observation... here is my reasoning...

      Microsoft has control over all aspects of the OS, one of the positives I suppose of closed source. They know for example that a change here in the kernal, will break feature x in the web browser. Additionally, one company controls basically all of the API's that 3rd party companies would have to use to write software.

      Now, contrast that to the linux world, whereas you have on entity basically in control of the kernal development and direction. Then you have another group that controls Apache, another for GCC, another for X, another for KDE, etc, etc... You make massive changes in the kernal, and you are going to have a trickle out effect, that all other teams are going to have to deal with. Thing is, there is nobody there with a big stick that would force people to comply. Additionally, Linux is all about choice and freedom. But with that, perhaps my biggest beef with linux, and IMHO the thing holding linux back the most is the labrinth of dependancies between various libraries and subsystems. In a situation like this, where you need to make sweeping changes across the board, the team based, decentralized aspect... not to mention the multiple distributions, would make it all but impossible to do a rollout like this, with less impact then what MS has experienced.

      Once again, to keep the fanboy zealots ( not you Hundalz ) quite... im not saying Linux sucks, or that open source sucks, or any of these things. And yes, im well aware that Linux does not need a patch like this, unlike windows... so please stop beating that poor dead horse.

      What im saying is, that in this case, MS did good. For once they actually deserve some kudos. Also, this is one of those rarer examples, where a closed source single controller development system, is actually superior to open source. ( In regards to the ability to make sweeping changes with minimal impact, fairly quickly. ).

    11. Re:I'm sorry, were you expecting better? by danheskett · · Score: 4, Informative
      For example, XP SP2 now modifies IE to reject redirects. i.e. If you have a redirect page to forward someone to your new website

      META REFRESH is not a good way to redirect people, and furthermore, it's not standards compliant. Allowing META REFRESH to direct users around the web without their consent is deceptive, and a major usability problem for users.

      One of the big goals of SP2 was to improve the web browsing experience for users tired of getting hijacked by bad nasty web pages that intentionally use seemingly harmless methods to corral, trap, and frustrate users.

      A lot of people use the META REFRESH directive to move them to a new URL once an old one has expired. Even on FireFox/Mozilla this can be used to trap users, enable phishing, and the like.

      Better methods when you can addresses is to:

      Use server side URL rewriting, like in mod_rewrite or like available in IIS

      Display a simple page with a large clear hyperlink and message to update the original link

      Display a simple page like above and use a simple Javascript to move the user (unlike META commands, the Javascript can be disabled).

      Use the appropriate 3xx HTTP status code and let the client handle the change appropriately

    12. Re:I'm sorry, were you expecting better? by SilkBD · · Score: 2, Insightful
      If Microsoft would focus on *real* security like that found in FireFox,
      Ok, then use Firefox... you don't need to use IE. I don't.
      --
      00101010
    13. Re:I'm sorry, were you expecting better? by AKAImBatman · · Score: 2, Insightful

      The meta tag appeared to begin with, because HTML authors often don't have access to the web server. This is a very valid reason, and I can guarantee you that authors would just start writing "window.location = 'xyz.html'" to get around it. Thus Microsoft has saved us from nothing, and made everyone's lives more difficult.

      --
      Javascript + Nintendo DSi = DSiCade
    14. Re:I'm sorry, were you expecting better? by Anonymous Coward · · Score: 2, Informative

      "Linux is an OS"

      Linux is a kernel not an OS.

    15. Re:I'm sorry, were you expecting better? by jridley · · Score: 3, Informative

      Hmm, I just tried it, and the meta redirect is working for me on XP/SP2.

      I just looked, and in Internet Options/Security settings, there's an "Allow META REFRESH" checkbox, which for me is enabled. I don't know if I've set it in the past, but I didn't do it recently. I am running a "custom" security level, not a prepackaged one.

      But the grandparent's assertion that there's no way to change it appears to be wrong. I've tried both 302 and meta refresh redirects and both work for me on XP/SP2

    16. Re:I'm sorry, were you expecting better? by _Sprocket_ · · Score: 3, Insightful


      Wasn't security for UNIX and UNIX-like systems an afterthought? The difference being that it has had decades of work to get where it is now, by companies and organizations that had to make it good, and not just a few years on a product that only has to be "good enough" for consumers.

      Great point. I would suggest a few other things to consider.

      One of the things I find interesting about Unix is its modular nature. For the most part, various components are fairly well insulated from each other. One is able to rip out or drop in pieces as one wants. This allows for major changes of the system's operation. This can be applied to anything from hardening the system to implementing new functionality. Security may have been an afterthought for Unix. But it's foundation allowed for it.

      Keep in mind that "security" hadn't always been a buzzword for Unix. A very visible example is the Morris Worm. But exposure to the public via the Wild Internet caused the Unix community to start picking up all its dirty laundry. It learned lessons. And those lessons are often the basic tenants of Infosec.

      One of my criticisms of Microsoft is that they ignore history. The Unix crowd has already run its gauntlet early on and made its findings and lessons learned widely available. Yet Microsoft continually repeats not only Unix's mistakes, but also their own.

      Sure - a mature code base implies a greater degree of bug fixing, etc. But that solves implementation mistakes. It doesn't help fundamental design flaws. Those can be very difficult to deal with. Especially if your system isn't very modular.

      One final point - how mature IS the relative codebases? How much of the original *nix code still exists vs. being entirely new? And how much of WinXP is pedigree WinNT from a previous decade?
    17. Re:I'm sorry, were you expecting better? by darkwhite · · Score: 2, Insightful

      Of the four methods you listed, only #3 does not require admin control over httpd and is automatic (which was kind of the point, DOH). I don't quite see how javascript is better than META REFRESH, especially since the latter is part of (D?)HTML while the former is an extension available in fewer browsers and turned off by some users.

      --

      [an error occurred while processing this directive]
  6. Leave it to microsoft by Nos. · · Score: 5, Interesting

    To build in a security overview system and leave it wide open so that its easy to fake the current status of things like your firewall and anti-virus.

    1. Re:Leave it to microsoft by shird · · Score: 3, Insightful

      Uhm... yeah. Easy to fake by a program already running as admin on your box. Why would such a program even bother?

      The point of the security center is so you dont get that malicious code running on your system in the first place. If it does, your systrem is already compromised, and nothing can be trusted anyway.

      No OS can protect against malicious code running as root/admin.

      --
      I.O.U One Sig.
    2. Re:Leave it to microsoft by Just+Some+Guy · · Score: 2, Informative
      No OS can protect against malicious code running as root/admin.

      If the OS has the concept of a superuser, then you're correct. However, that's ignoring other OSes that are built on capabilities or mandatory access controls. Those do away with "root users" altogether, and replace them with users with sufficient access to grant necessary rights to other users. These aren't hypothetical creations, but real systems in use, today, in high-security installations.

      --
      Dewey, what part of this looks like authorities should be involved?
  7. Internet Meltdown Predicted for Today by Cocodude · · Score: 5, Funny

    So this is what the Internet Meltdown Predicted for Tomorrow article was referring to!

    1. Re:Internet Meltdown Predicted for Today by funkdid · · Score: 2, Interesting
      hahahaha

      You know what I got from the article was:

      It will now be easy for people/code to exploit a new vulnerability in Windows allowing (insert favorite action taken after an exploit is found HERE).

      Umm, I saw this coming, I mean it's 10am where I am right now and I haven't heard about today's exploit yet.

      In all seriousness Joe Computer needs to stop trusting Microsoft to do everything in his computer. Their idea of shouting "HEY STUPID get an anti-virus program" isn't a bad idea. The implementation was, but the idea isn't. From what I've read SP2 is a slight improvement security wise, so for Joe User all security updates are worth installing. (Joe User just normally doesn't ever run Windows Update. Think of the last time some relative called you with a computer problem!

      "You: Did you try doing the 'Windows Update'?" - Relative: "Where's that?" -I rest my case.)

      I'd rather the 14 million drone machines out there in the wild had XP2, then not.

      --

      I boycott signatures

  8. That's ok by Bricklets · · Score: 5, Funny

    According to them, any program (including ActiveX controls) can access and edit the Windows Management Instrumentation database, and therefore spoof the security status of an insecure box to report that it is properly secured."

    That's ok. MS probably wants it to be easy to use so that everyone can use it. ;)

    --
    Little Bricklets
  9. Pseudo Problem. by vi+(editor) · · Score: 5, Insightful

    If a boxen is 0wned then we can savely assume that the 0wner/w0rm has root access. And with root access it can do anything anyway.
    This is like complaining that one can shut down your computer by removing the power plug.

  10. Scary stuff. by sploo22 · · Score: 5, Interesting

    Step 1: Go to http://www.mikx.de/scrollbar/
    Step 2: Drag the scrollbar down a bit and let go
    Step 3: Start -> Programs -> Startup

    That's just spooky.

    --
    Karma: Segmentation fault (tried to dereference a null post)
    1. Re:Scary stuff. by iainl · · Score: 2, Funny

      Cool! Now I can justify buying a replacement mouse on the grounds that a working wheel is a "Security Feature".

      --
      "I Know You Are But What Am I?"
    2. Re:Scary stuff. by alphax45 · · Score: 2, Interesting

      Doesn't appear to work correctly with Mozilla... but that could also be zone alarm stopping it.

      --
      K Man
    3. Re:Scary stuff. by spellraiser · · Score: 5, Informative
      You forgot ...

      Step 0: Open IE

      Couldn't even drag the scrollbar in Firefox :-/

      Then I opened IE and tried it - jackpot. Nice little booom.exe in my startup folder. I have SP2 installed. Good grief.

      --
      I hear there's rumors on the Slashdots
    4. Re:Scary stuff. by NtroP · · Score: 4, Funny
      Crap! One more site that doesn't work right in Safari or Firefox!

      I guess I'll have to switch back to IE.

      --
      "terrorism" and "pedophilia" are the root passwords to the Constitution
  11. Incorrectly report, but change? by iainl · · Score: 4, Interesting

    I'm seeing reports all over the shop that its easy to spoof the security centre into claiming that (for example) the firewall is turned on when it isn't.

    What I've yet to see is any indication that its possible to actually do the turning off of things, which would be rather more serious.

    As it is, surely the only problem is if you forget that you turned something off? I've no big plans to make my box insecure now I've done configuring it on installation.

    --
    "I Know You Are But What Am I?"
  12. Close it anyway MSFT or stop the default Admins! by garcia · · Score: 5, Insightful

    To spoof the Windows Security Center WMI would require system-level access to a PC. If the user downloads and runs an application that would allow for spoofing of Windows Security Center, they have already opened the door for the hacker to do what they want. In addition, if malware is already on the system, it does not need to monitor WSC to determine a vulnerable point of attack, it can simply shut down any firewall or AV service then attack - no WSC is necessary."

    Sadly just about everyone runs shit as Administrator (it is the default mode for XP Home installs) to make life easier and as MSFT has noted they are opening themselves up to the attacks... For those that will mention that Linux is so much better remember that these are the same people that wouldn't like to have to change to root (sudo, su, login, whatever) to install anything and would be opening themselves up to the same vulnerability level as if they had been running Windows.

    Basically the problem was in design... They should not have had an open API controlling the "WSC" and thus malware would not be able to detect the presence of the programs' status from a single location. The real problem is that MSFT isn't admitting that it is a serious problem and needs to be changed on a different level... Saying that malware writers are going to use the direct route and disable the firewall/AV outright, while true, doesn't get them off the hook for creating this hole that is more difficult even for a more advanced user to notice.

  13. UA String any different? by Anonymous Coward · · Score: 4, Interesting

    Is there a way to distinguish Windows XP with SP2 from older versions through the User Agent String?

    1. Re:UA String any different? by mr_z_beeblebrox · · Score: 2, Interesting

      I don't work with the UA string but here is something nobody likes to see on /.
      VB CODE IN YOUR FACE
      Wscript.echo "Service Pack: " & objOperatingSystem.ServicePackMajorVersion _ & "." & objOperatingSystem.ServicePackMinorVersion
      I almost used the BLINK tags for that one :-) The above VB put into a script will echo the SP level and I think you can do it remotely on VB I have only the MSNSK certification (Microsoft novice script kiddie :-)

  14. Oh my god! by dave420 · · Score: 3, Insightful
    You mean it's possible to edit configuration scripts from within the operating system? Oh no!

    Seriously, this is just more scaremongering. The WMI system has to be accessed locally, and their examples of how this could be circumvented is pretty silly. ActiveX apps on a web page won't run unless you specifically tell them to. The only other ways are via a downloaded application. It boils down to "you have to do something on your computer that lets a malicious application run". How is that any different from any other operating system in the world? Even as a non-root linux user you can fuck up a system by running a malicious script... I don't get it.

    Am I missing something?

    1. Re:Oh my god! by $rtbl_this · · Score: 2, Insightful

      Even as a non-root linux user you can fuck up a system by running a malicious script...

      I'm intrigued. While I've only given it a few minutes' thought, I haven't managed to come up with a way that an unprivileged Linux user can hose an entire system (well, outside of their own data) with a malicious script. Could you let me know what I'm missing here? Thanks.

      --
      "Are you being weird, or sarcastic?" said Emma. I said I didn't know because I get the two feelings mixed up.
    2. Re:Oh my god! by finkployd · · Score: 2, Informative

      Who gives a rip if the operating system survives but the data doesn't?

      That is true if you are the only user on the system, however if you are not, then I'm sure the others take comfort in knowing you cannot hose their data or the OS it resides on.

      Finkployd

  15. No real surprise by Arclite · · Score: 4, Insightful

    Let's be honest. Did anyone really expect SP2 to not need a slew of new patches after release?

    Personally, I'm just glad that it doesn't bomb randomly after install. Yet.

  16. Need root? by randyest · · Score: 5, Insightful

    No, most user's don't need to be root most of the time. Yet:

    While we are not aware of any malware exploiting this, we think it will only be a matter of time. The one mitigating factor that we found is that to change the WMI, and spoof the Security Center, the script has to be running in Administrator mode. If executed in Windows XP's Limited Mode, it will give an error, and not allow changes. Unfortunately, most home users who will be at risk, run in the default administrator mode.

    How can we convince people not to run admin mode? It's easy at work, in UNIX land (most people don't get to know root pw.) But most Windows users I know don't even know the difference.

    Every windows security problem I know of can be solved, or at least significanly mitigated, by users not running root.

    --
    everything in moderation
    1. Re:Need root? by MobyDisk · · Score: 2, Insightful
      How can we convince people not to run admin mode?
      Two steps are required:
      1) Make apps that work without admin mode. Most stuff on the shelf today still doesn't. I have yet to see a game that does.
      2) Make apps that need admin access prompt you for it. - *nix has done this for a long long time.

      But neither of these things will happen until the mentality changes. The mentality won't change until the apps are there. I've tried to get user's to do it when possible, but then they go download some spyware app that makes a jiggly peanut dance across the screen (or some such nonsense), and it needs admin rights, so they would rather lose all security and pay me $100 later on to fix their system, than to stop downloading the pointless spyware.
    2. Re:Need root? by SilentChris · · Score: 2, Interesting

      "How can we convince people not to run admin mode?"

      Simple. Force them not to. When my family got a new PC, I immediately dumped XP Home and put on XP Pro. I set up myself with the Admin account and gave everyone else Limited User accounts.

      If they want to install software, tough. They have to go though me first. Just like at work.

    3. Re:Need root? by 0123456 · · Score: 4, Informative

      "Someone please explain to me how this is different than Linux?"

      Most programs on Linux run happily as a non-root user. So many programs on Windows force you to run as an admin user that most people who even think about trying to run as a non-root user quickly give up...

    4. Re:Need root? by twbecker · · Score: 2, Informative

      If you could both install and run software in limited mode, how is it limited??? I'll probably get flamed for this, but limited users under XP are more trouble than they're worth. A lot of older software refuses to run. As long as you run a firewall, Antivirus software, spyware detection software, know what software you install and why, and don't casually click past warning messages on the web (or better yet use Firefox), you're fine as an Administrator. Granted that's a lot of shit, but hey, that's what it takes. The *nix approach of only having access to your account's data is great for a multiuser box, and can probably stop your machine from being turned into a drone, but for most desktop users, your data is the most important stuff on the box!! Screw the OS internals, you can always reinstall. . .

      --
      "The problem with internet quotations is that many are not genuine" -Abraham Lincoln
    5. Re:Need root? by Junks+Jerzey · · Score: 2, Informative

      I'll probably get flamed for this, but limited users under XP are more trouble than they're worth.

      No, you've hit the nail on the head. "Administrator" under Windows XP is not like "root" under UNIX. The former is something that came along fairly recently and put down a few arbitrary restrictions on applications. Problem is, most Windows software was written prior to XP, and at one time the restricted items--like writing to your own application folder--were the accepted ways of doing things. There are even developers running older versions of Windows who don't know about the issues involved.

      Furthermore, when you install a new application you have no way of knowing if it will work in a restricted account. So first you install it the proper way. Then you have to load it up and experiment with it for a while to find out if it is clean. Sometimes this is hard. Maybe it only gets caught when you try to save a document template or a window layout or some other less common activity. When this happens you have to uninstall and reinstall to a folder outside of "Program Files." This is generally not worth it. If you're running a firewall, anti-virus program, and not using IE, then running as administrator isn't a bad thing. Remember, even in administrator mode programs can do all sorts of bad things to your system, like emailing or deleting your files. It's only the "Windows" and "Program Files" folders that have any protection on them. To repeat: this is not like running as root under UNIX.

  17. and you were expecting what??? by stonebeat.org · · Score: 2, Insightful


    Windows XP SP2's 'Windows Security Center' is just about as insecure as it could possibly be.

    and you were expecting what???

    Remember Windows Management Instrumentation requires administrator credentials. If you have admin priveledges on any box, you can do much harm, regardless of the Operating System

    --


    Consensus is good, but informed dictatorship is better
    1. Re:and you were expecting what??? by black+mariah · · Score: 2, Insightful

      I have a script here that hoses your entire Linux system. All you have to do is run it as root.

      rm -rf *

      Please explain how this is different than any other program on any operating system being run as root.

      --
      'Standards' in computing only impress those who are impressed by things like 'standards'.
  18. Re:Leopard? by lucabrasi999 · · Score: 5, Funny
    Sounds like some sort of leopard in the jungle, if you ask me.

    Cue Marlin Perkins (of the old Mutual of Omaha Wild Kingdom shows):

    MP: "Today, we are going to find and capture the elusive XP2 Leopard. My associate, Jim, is armed with a toe-nail clipper and a badminton raquet. Jim, why don't you start marching down that trail over there? I'll be back at the truck with the cameraman and a bottle of scotch."

  19. Re:Close it anyway MSFT or stop the default Admins by drinkypoo · · Score: 2, Informative

    Administrator is the default context for XP Pro, too, if you create users at install time. I run as administrator, but I use Firefox to browse everything but windows update, and I have Norton installed and auto-updating itself every day. Hence I am operating in an insecure fashion, but with little risk.

    (Watch me get owned tomorrow or something, but nonetheless, I stand by my statements.)

    On Linux I do typically do everything as me, and sudo when I can, but some programs don't work right when you sudo, they need a full root environment. On windows, using run as often doesn't work right because spawned programs revert to your user context (though not always? I'm not sure what's going on there), and many processes spawn new processes to do their dirty work. Even a lot of installs work this way, unfortunately.

    --
    "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
  20. I installed it last night by mrgreenfur · · Score: 5, Informative

    I noticed it was up last night to I installed it.

    It's 94.50 mb which takes a while to download. Upon installation and restart the new windows security center pops up and trys to get you to turn on your firewall, automatic updates and antivirus software. By default if any of these are off, there's an obnoxious red shield in the system tray. Turning off alerts for these makes it go away.

    Otherwise there doesn't seem to be any major changes.

    So far nothing's borked.

  21. Send in the Rovers by MikeMacK · · Score: 5, Funny
    Based on an anonymous tip, PC Magazine looked into the WMI and the Windows Security Center's use of it, and found that it may not only be a security hole, but a crater.

    Maybe MS could get NASA to send a few rovers in there to see what they can find out.

  22. Re:Close it anyway MSFT or stop the default Admins by grasshoppa · · Score: 5, Interesting

    There is one subtle difference between linux and window admins: There is a lot of window software that is written to be run as administrator. Finding all the files to give permissions to causes quite a headache.

    Linux, I feel, has a better system at the moment. However, as this is the developers fault, I see no reason why linux would be immune from this problem.

    --
    Mod me down with all of your hatred and your journey towards the dark side will be complete!
  23. Actually, no... by Svartalf · · Score: 2, Interesting

    They're claiming that it's much more secure that Unix/Linux with this service patch. In terms of being 0wned, it's hard to totally cover your tracks in a Unix box- you leave a trail of breadcrumbs somewhere that typically can be seen (most tools simply automate the process...). In the case of an SP2 XP box, it'a apparently rather easy to cover one's tracks and you have to rely on signature scanning (i.e. Virus/Trojan scanning...) to hope you can find the intruder.

    I don't consider that to be a non-problem, nor do I consider it to be more secure. It's definitely not secure enough to be allowed exposure to critical infrastructure of any kind.

    --
    I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
    1. Re:Actually, no... by BabyDave · · Score: 5, Informative

      The reason they say its safer is because they took advantage of the new processor features that allow you to mark a block of memory as "non-executable" thus stopping buffer overrun 'sploits and similar problems. Linux doesn't have this feature.

      Yes it does

  24. I don't think anything can be done. by London+Bus · · Score: 5, Interesting

    To make Windows secure, that is. I know lately that Microsoft-bashing has gone from being the in thing to being "trolling", but it's true. Just because it's become less fashionable to say so doesn't change the fact. I don't understand how Windows users can continue to use these machines. I live in a relatively remote area of Japan, and yet somehow within 4 minutes after hooking up my brand-spanking new machine to the Internet, I started getting Code Red connection attempts and repeated assaults on various four-digit ports. I guess they don't respect geographic boundaries either. By the way, this all happened while I was downloading XP2/SP2. It's not going to help when we don't even have time to install it before getting our machines "owned".

    I've always criticised Linux users for being sloppy and the like, but the operating system itself is at least rock solid. It rarely crashes, it has a decent windowing system, and I don't see advisories for it on Bugtraq every 8 hours. Windows is easy to install, but it's all too easy for someone else to compromise. Ease of use is nice, but I think I'll take peace of mind with GNOME on Fedora Core.

  25. Re:this is surprising? by Errtu76 · · Score: 5, Insightful

    Right. I can only assume you're using Linux now, and I apologize if i'm wrong. So you probably never have to: upgrade your kernel, upgrade applications or do an fsck. If this is the reason why you abandoned windows, it's a silly one. As far as i know, only consoles (Nintendo, PS1/2 & Co.) don't require updates. Everything else does.

  26. Running as admin? by W2k · · Score: 5, Insightful
    According to them, any program (including ActiveX controls) can access and edit the Windows Management Instrumentation database, and therefore spoof the security status of an insecure box to report that it is properly secured.
    Um .. you sure that's not supposed to be any program that's already running as admin on the box in question? Sorry, but if I was a malicious app running as admin, I would do much more interesting things than tamper with the security center. Not even Linux/OSX/*BSD are secure if you manage to get malicious code running with admin rights. The article got it right (it mentions that the attacking script/app/whatever must be running as admin) but whoever submitted this to Slashdot seems to have missed this tiny, unimportant detail.

    The next thing to be said is usually: "But most home users run as admins." (The article also mentions this.) Well, that's not a Windows problem; that's a user problem. Even if Windows forced users to run in "limited mode" (which would cause an outcry in itself - "eek, Microsoft is trying to take away control over our own computers from us"), it also doesn't help that most third-party software for Windows requires admin rights either to install or *gasp* to run. Of course, this is ancient news to everyone with a clue .. nothing to see here, move along.

    Of course, even when running as admin, protecting yourself against malicious code is fairly trivial; simply use a firewall (SP2 incidentally includes one), don't run binaries from untrusted sources, surf the web and check your email using something other than IE/Outlook, use a virus scanner/shield, and keep your apps and OS updated. Again, no news to anyone with a clue.
    --
    Quality, performance, value; you get only two, and you don't always get to pick.
    1. Re:Running as admin? by Tom · · Score: 4, Insightful

      "But most home users run as admins." [...] Well, that's not a Windows problem; that's a user problem.

      You are oversimplifying. Ask yourself why most home users run as admins. May it be because that's the default? Because XP doesn't even offer another setup option, but hides it well? Or maybe because tons of things simply don't work if you run as a normal user?

      Driving reckless is a user fault, yes. But driving reckless when that's how the manual told you to do it and that's what the car was designed for makes it a bit more tricky to properly place the blame.

      --
      Assorted stuff I do sometimes: Lemuria.org
    2. Re:Running as admin? by W2k · · Score: 2, Insightful

      It's the default because the users want it that way (see previous posting). Windows users have been running as admin since it was just a glossy shell over DOS (hell, pre-NT, Windows didn't have a non-admin access mode as such). If Microsoft changed it now, there would be an outcry (see grandparent) and people would just figure out how to make themselves admins, and do so. It's a lose-lose situation for Microsoft - and again, the fact that many pieces of third-party software expect or demand admin access to run does not help matters.

      In the end, no operating system is luser-proof. User education is the only viable solution, not built-in lockdown of the OS.

      --
      Quality, performance, value; you get only two, and you don't always get to pick.
  27. Re:this is surprising? by LilMikey · · Score: 2, Informative

    I guess that depends on what you mean by "have to". An out of the box Fedora Core 2 system will work and play just nicely with your email, office, internet, graphics, video, etc. An OOB Windows XP install will only last 20 minutes once connected to the internet.

    --
    LilMikey.com... I'll stop doing it when you sto
  28. STILL Broken by Roguelazer · · Score: 3, Informative

    Great work Microsoft! After all the beta-testing, SP2 is still broken. Here's what I've found so far that's messed up badly:

    • FarCry Demo fails to install
    • Unreal2 won't run
    • Norton Antivirus status is not detected by Security Center
    • AVG Antivirus is not detected by Security Center
    • Windows crashes on startup if any non-MS OS is doing a SMB network scan while it is starting up
    • Security Center considers having Automatic Updates set to "Ask Before Installing" a security risk

    What I find funny is that ZoneAlarm's AntiVirus monitor feature detects AVG and Norton properly.:P

    --
    My Systems
    1. Re:STILL Broken by delus10n0 · · Score: 3, Informative

      # FarCry Demo fails to install
      # Unreal2 won't run

      Both working fine here..

      # Norton Antivirus status is not detected by Security Center

      Norton's problem, they've said repeatedly they're working on a patch.

      # AVG Antivirus is not detected by Security Center

      This should be working. It's works for a lot of other people correctly.

      Windows crashes on startup if any non-MS OS is doing a SMB network scan while it is starting up

      Huh? Did you pull this one out of the air? We haven't had a problem with this on our network here (300+ PCs, 10+ Macs)

      Security Center considers having Automatic Updates set to "Ask Before Installing" a security risk

      And I agree that it should. Users are totally retarded, and should be treated like a child.

      --
      Not All Who Wander Are Lost
  29. Re:this is surprising? by halowolf · · Score: 4, Informative
    Oh XBOXs can be updated. Its the first thing that happens to them when you connect to XBOX Live, and there are more updates after that.

    Of course, you can "update" them also with mod chips, but I don't think that that is what you had in mind :)

  30. This sounds like a typical... by bob670 · · Score: 2, Insightful
    bullshit headline grab from PC Mag/Ziff Davis/Cnet that Slashdotters love to sieze on. If Windows is so damn insecure why haven't I had any issues professionally or personally in the last 10 years? Patch it when called for, keep your anti virus software up to date (come to think of it, I only scan incoming mail on my personal workstations), get a decent router with (an even marginal) built in firewall/NAT and don't click on every pop up you see at www.pussy-u-will-never-get.com and you are pretty much safe.

    I love my Linux box but I expend far more effort keeping it locked down with constant updates than I do my Windows boxes.

    I'll say it again, OSS will never suceed with end users as long as so many in this community take an "Anything But Microsoft" stance.

    1. Re:This sounds like a typical... by praxis · · Score: 4, Insightful

      I would also like to tell my story. I've been a Windows user since 1990, a Linux user since 1995, a SunOS/Solaris user since 1995, an Irix user since 1995, an OpenVMS user since 1997, and an AIX user since 1997. I don't run all of these concurrently anymore but I've administered each of them for quite some time. I keep abreast of security issues in each OS I'm running, even if it's only getting the latest patches. On Windows, I run an up-to-date virus scanner. I had to do a lot more work to secure Linux than I did to secure Windows XP. I have *never*, not *once* had a serious issue with any of my machines running any OS unless it was a hardware fault. By serious I mean anything beyond a virus caught by the scanner or an application crash due to a bug. I may, or may not, help that I don't run any software beyond the business apps I need, a few games, and some IM client. I don't download much software, beyond perhaps putty, Java run-time, and well, perhaps something else. I did, in college witness many people have problems with Windows, and they did not run AVS, used Kazaa liberally, and liked to install little apps that web pages offered. There is no technological solution today that trumps educating users. I'm rambling, so I'll stop.

  31. Re:this is surprising? by bmj · · Score: 4, Insightful

    I guess that depends on what you mean by "have to". An out of the box Fedora Core 2 system will work and play just nicely with your email, office, internet, graphics, video, etc. An OOB Windows XP install will only last 20 minutes once connected to the internet.

    Out of the box Fedora may work with everything, but at some point in time, security vulnerabilities will be found in some piece of open source software, and a patch will (quickly) be made available. An unpathed *nix machine can be just as dangerous as a Windoze box.

    --
    Whereof we cannot speak, thereof we must be silent. --Ludwig Wittgenstein
  32. Re:You would think.. by Anaphiel · · Score: 5, Insightful
    A poster further up the thread has it right: it's nearly impossible to make a software product, especially one as large and complex (and insecure) as XP, secure after the fact by patching it. Security is best designed into a product at every level from the very start.

    What Microsoft is doing is analogous to me trying to turn my apartment into a bank:

    Initially I just put up a sign that says "Bank" and leave the money lying on my sofa. Then when I get tired of people walking in and taking the money I lock my door. Then they kick in my door, so I get a thicker door. So now they climb in through a window, so I close and lock the windows. They break a window, I put up shutters. They cut through the floor, I lay down cement; ceiling, I add an alarm; they cut the electricity, I buy a generator. Maybe at some point I buy a safe, which works until they pick the safe up and roll it out of a hole cut into my wooden walls. This goes on for years, until eventually I get fed up and move out, and have a building built to purpose that's secure as a bank should be.

    Where this analogy breaks down is at some point pretty early on customers would stop giving me their money until I got my act together, where they've shown no intention of doing the same to Microsoft.

  33. Re:Still better than Unix. by Basalisk · · Score: 2, Funny

    Which again points out just how much of a joke Unix is. If the OS makes no distinction between folders (that's what directories are called in an Object Oriented operating system like Windows) and files, then how can you explore the C: drive? I mean, having to open a file called 'paths.dir' in notepad.exe just to find your files? I'm beginning to suspect that someone is taking the mickey.

  34. Re:this is surprising? by essreenim · · Score: 2, Insightful

    and I apologize if i'm wrong.
    That was the smartest thing you said. You don't need to upgrade your kernel. In favt many choose to use the older more stable kernels instead of the newer unstable ones - i.i 2.6.8.1
    Hackers just dont pay the same attention to Linux, and when they do, they are not able to have the same penetration. Linux security is a public work in progress so exploits can be spotted long before they are with Windows. Windows is a good OS - good enough to warrant a small piece of the pie - not the huge amount it actually does. Windows offers: a good GUI, decent plug'n'play, a half-decent office suite, amongst a couple of other things. It deserves credit for that, but thats it. But its not free - like a bird.

  35. I fail to see... by TaintedPastry · · Score: 2, Interesting
    I fail to see where the 'huge security problem' lies.

    So it tells you the firewall is up when it 'may' be down. If you can't remember wether you put it up or not, PUT IT UP ANYWAYS DUMBASSES!! (Not that I'd trust a Windows Personal Firewall anyways - wasn't UPnP supposed to revolutionize something?)

    This is a training issue. Just as anyone who hasn't used Linux before would need help setting it up, anyone using Windows will need to know how to not be a dumbass; 99% of all security issues I've come across could've been prevented with liberal application of common sense.

  36. Re:Still better than Unix. by Alioth · · Score: 3, Informative

    I was going to mod you down, but just in case you really are ill-informed and not just a troll, in the interest of enlightenment I'll reply instead.

    I don't know what Unix you're using (perhaps Version 7 on the Interdata 7/32 or some other forgotten vintage system), but modern Unix-like operating systems, such as *BSD, Linux and Solaris, by default create user's home directories with permissions user: read/write, group: no permissions at all, world: no permissions at all, and no special ACLs. Filesystems for these operating systems support ACLs (much like NTFS ACLs. Personally, I've found the user/group/world permissions have covered every case I've encountered, but that may not be true for everyone hence POSIX ACLs were created).

    Certainly in the Linux world, major distributions turn the firewall on by default (RedHat since at least 7.x, and continuing into Fedora Core) during the install process. It's been a proper stateful inspection filter since before XP was even out. Also in a Redhat or Fedora install, you are asked to create a non-root user. The Windows XP install also asks you about what users you want to create, but by default creates them all with root privileges.

    --
    Oolite: Elite-like game. For Mac, Linux and Windows
  37. Re:this is surprising? by Errtu76 · · Score: 2

    I didn't mean you should uprade your kernel every time a new version comes out. The same goes for windows. You don't upgrade to a newer version every time either, right? For my firewall i still use 2.2.x series and don't bother to upgrade because it's of no use. Only times i upgraded the kernel was when a root exploit was fixed in a later version. I'm saying that if you switch from windows to because then you don't need to upgrade, is nonsense.

  38. Windows? by mrselfdestrukt · · Score: 3, Funny

    What is this Windows XP thing I keep hearing about?

    --
    "I used to have that really cool,funny sig ,but it got stolen."
  39. Not running as admin is all that matters? Not so. by fmachado · · Score: 4, Interesting

    People just conveniently forgot that running as a common user does NOT guarantee that a malicious app does not runs as admin (or SYSTEM, more precisely). IIS, RPC, Messenger, lots of others run as a service with SYSTEM privileges. If you do attack it and find any vulnerability then you can run your malicious code as SYSTEM as well.

    Sure, running as ADMIN is almost stupid and multiplies your chances of being 0wned by large. But its not the only source of being 0wned as people said above. As long as I remember, IIS (along with Sendmail, Bind, IE and some others) where considered the worst software in terms of security in the SANS Institute list. Break-ins are common in these softwares and would grant you good priviledges for doing some nasty things.

    Just to be fair the same can happen in Linux/Unix but it's a bit less easy to do it. And you can always run an UserMode Linux, for example, and host the application inside it which would turn the host system almost invunerable and this is quite difficult to do in Windows (I can only think of VMWARE). Normally people are a little better educated to not use root in daily use and every installation program of recent distros explicit says it.

  40. M$ should make the Admin account anoying to use by denis-The-menace · · Score: 5, Insightful

    The only way to make joe user NOT want to use an Administrator account is to make it anoying to use. IE: -Display a NAG window everytime the user launches an application. (Maybe only if the user spends more than 30 minutes in the account) Maybe even make it easy to do some admin tasks easily as a Limited user by prompting for the administrator pw when required like Linux distros do today.

    --
    Obama's legacy: (N)othing (S)ecure (A)nywhere and (T)error (S)imulation (A)dministration
  41. Calling Dr. Freud by SavoWood · · Score: 2, Funny

    I find it amazing and certainly think someone should alert the NIMH. Software and hardware are each capable of EMOTIONS! Not just that, but complex ones at that. Who knew my little hunk of plastic, silicon, and metal would be so insecure? Is it because of my incessant banging away on the keyboard? Am I touching the mouse inappropriately? How do you tell?

    I'd bet it's when I'm taping out the BPM for the music loaded on the drive. It has to be like the Chinese water torture. Poor little computer.

    Please, let us make amends. I'm offering a sincere apology and promise to do what I can in the future to keep you from feeling battered and furthering your feelings of insecurity.

    Good thing I've got all your patches up to date, or you might find strangers abusing you from far away locations. I'd never let you have such unsecured access. It' would only lead to more insecurity.

    --
    Plant a tree in a developing country.
  42. Bad Logic From Microsoft by catwh0re · · Score: 4, Interesting
    Judging from Microsoft's response to this issue. (and many similar issues in the past)

    They bypass this obvious lack of security as a feature, and that the application is rather to serve as an extra barrier of obscurity to hackers, and not as a solution to the problem (which it will ultimately be marketed as.)

    This unfortunately isn't an adequate mentality. Microsoft appear to make the mistake to think that hackers are as technically challenged as their regular home user base.
    Yes! certainly a home user wouldn't be able to craft some accidental software that rips a hole through the new security centre features. However, hackers which discover holes in Windows (Without ever seeing the source code.) have the competency to add the extra layers of dodging to their worms. This it at Microsoft's peril, as now worms can fool a system into reporting that everything is fine, in turn fooling the technically challenged home user into also thinking, that their new DDoS server is also functioning without a hitch.

    Microsoft needs to understand that hackers are significantly "gifted" in comparison to their regular user base (many of which who'd think Mac OS X is another version of Windows.) They must craft their security devices such that they can not be trivially undermined, and put an end to the assumption that more easily bypassed road blocks lead to greater security.

  43. XP SP2 is awesome - leads to blue screen by kronin · · Score: 3, Informative

    I installed the official release of SP2 and installed it on my mom's laptop last night, only to be greeted with a nice informative blue screen upon reboot.

    http://www.crn.com/sections/breakingnews/breakingn ews.jhtml?articleId=23905071

    I had to boot into recovery mode and run a batch script to uninstall SP2, just like the article outlines. Then I had to go into the registry and change some keys, then do an uninstall via the add/remove programs wizard. Man, thanks Microsoft for a full night.

    I'm not sure if I'm going to try again, we'll see how I feel after stewing about it all day...

  44. Re:Not running as admin is all that matters? Not s by praxis · · Score: 2, Informative

    Actually, under XP, many programs take advantage of NETWORK SERVICE and LOCAL SERVICE accounts, which are not quite the same as SYSTEM. I believe IIS is one of these programs.

  45. Programs in the wild by paranode · · Score: 5, Funny


    We're out 'ere lookin for signs of the elusive XP2 that's been said to be lurkin' in the wild...

    Crikey, I've just spotted a wild paypah-clip in it's natural 'abitat! Look at those big ole eyes an'.. oh!.. there he goes trying to ask me if he can 'elp me!! You see, this creature is what's known as a parasite, 'ee leeches off o' your Windows Management Instrumentation databases. It's 'ard to satisfy one o' these buggers, they'll never leave ya alone until they've done your work for ya.

    </steve irwin>

    1. Re:Programs in the wild by FlopEJoe · · Score: 2, Funny
      and ala Southpark

      Watch as I stick my thumb up its ass!

  46. Thank god it's just IT by orzetto · · Score: 2, Funny
    'Windows Security Center' is just about as insecure as it could possibly be.
    Just imagine if Microsoft were an army instead, and decided to promote world peace...
    They would invade a country run by a dictator, continue the dictator's tortures even in the same places, inflame the world and make the world an insanely dangerous place to live.
    Oh, wait...
    --
    Victims of 9/11: <3000. Traffic in the US: >30,000/y
  47. Re:this is surprising? by DashEvil · · Score: 4, Informative

    Hey. I hate Windows as much as the next guy, but if you want to make a compelling argument you should at least be fair.

    Windows XP came out in 2001. Do you really need me to tell you that running a RedHat distribution from 2001 would be suicide right now?

    --
    -If God wanted people to be better than me, he would have made them that way.
  48. Cowards at PC Mag by Sloppy · · Score: 4, Insightful
    This open door to the security status of a system can be exploited several ways. First, a malicious site could download a file (possibly with the drag and drop exploit discussed in our Windows updates and vulnerabilities section), which could run and access the WMI, monitoring the status of the firewall and antivirus protection.
    Holy crap, you're already executing hostile code, and you're worried that MS has added yet another library that it can call? You fucking idiot! It can already write to your disk's partition table, what more are you worried about? A psychotic killer is holding a loaded gun to your head, and you're worrying about the second-hand-smoke cancer-risk from his cigarette. ;-)

    People, get a clue: a "malicious site" can't do anything to your computer, unless your box has already been compromised.

    PC Mag, here's an idea: tell the users what the real problem is. You damn well know what it is. But you're afraid, because they spend a shitload of money on ads.

    --
    As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
  49. Ask Slashdot... by flibuste · · Score: 2, Interesting

    I was about to Ask Slashdot about wherever it is relevant to upgrade XP to SP2 given the fact that:

    • I have 3 machines running XP
    • I have no problem whatesover with my current XP installations.
    • I am security conscious (I should say paranoid actually...) and all my machies are behind a router which is set to disallow about everything in, aside from port 80 which goes to a Linux machine
    • I am not one of those less knowledgeable end-user since I work like most of you in the computer industry and have been there for the last 15 years

    Seeing all the potential problems XP SP2 can bring in, is it worth the update?

    What do you guys think?

  50. Re:Close it anyway MSFT or stop the default Admins by bersl2 · · Score: 2, Interesting

    Despite what you say, they are trainable.

    I got my sister (15, and understands precisely nothing technical about computers), after much yelling, screaming, and misunderstanding (this one mostly on my part), to use an unprivledged user for normal work and to make changes and install as Administrator.

    That said, not only are default accounts admins, but you cannot only have unprivledged accounts; you must have a named admin in addition to Administrator. Very dumb.

  51. It's an option and NOT a hole by kc_cyrus · · Score: 2
    "We see the WMI and WSC as an indirect security risk, or hole, or whatever you want to call it.[pc mag]"

    Then disable both WMI and WSC Services and get yourself another personal firewall here or here.

    MS opened the WMI to third-party sources and that is why we may mistakenly call it a hole, while in the reality it's an option.

  52. Re:Please help a Linux Newbie by Teun · · Score: 4, Funny
    They sound like they have the same (or very similar) problem

    What do you mean *They*?
    It's the same guy Anonymous Coward every time!

    --
    "The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
  53. Re:this is surprising? by Zak3056 · · Score: 2, Informative

    Windows XP came out in 2001. Do you really need me to tell you that running a RedHat distribution from 2001 would be suicide right now?

    Assuming you never patch the system, I agree. However, assuming that you're the slightest bit proactive about maintaining the box, I strongly disagree.

    I use RH7.3 as a baseline for my systems (because RHEL costs too damn much, and because I'm not particularly fond of 8, 9, or FC) and while it's not quite that old (early 2002 as opposed to 2001) it's stable and secure. Of course, I do make use of Fedora Legacy via yum for most of my updates, but presuming such are not available it's not exactly a dificult task these days to, say, rebuild OpenSSH from source if security issues are found.

    --
    What part of "shall not be infringed" is so hard to understand?
  54. Why so sloppy? by Futurepower(R) · · Score: 2, Insightful


    Maybe you've seen the old motto. MS: "The whole world is our beta test site."

    Why is MS software so insecure, and just plain sloppy? Maybe their management model just does not allow a programmer to finish his work. Later some poor guy is assigned to fix a terrible bug that is getting publicity, but it is difficult, boring work trying to understand what someone else did, and he makes mistakes.

  55. Wouldn't matter by Sycraft-fu · · Score: 2, Informative

    Even if you could get a user to dot run as admin all the time, it's not going to help. Why? Because users WANT to run the stupid shit that infects their comptuer. They go to install Kaazaa, it says "I need root to install", you think they are NOT going to enter the root password? Of COURSE they will, they want Kaazaa on their computer, they'll do whatever it asks them to do.

    As a receant example later variants of one of the receant worms was zipping itself and encrypting the zip to try and evade virus scanners (successfully, for a little while). That means you had to get the password from the e-mail, and use it to unzip the executable, then run it.

    Guess what? People did. They went through all that trouble, because they believed the program to be something they wanted.

    There is really no defense against stupid users, when they own the box. They can get admin, and will whenever they want it, even if it's not the default.

  56. I'm gonna have to call BS by Sycraft-fu · · Score: 2, Insightful

    Either that, or you are doing something wrong. Here at work we have, oh about 500 Windows machines and maybe 200 Solaris machines and some Linux machines too. Of the Windows machines, I'd say 200 or so are already on SP2. They don't crash on bootup and SMB traffic is ALWAYS flying over our building (it's a single large subnet too).

    As for AVG, well, you screwed something up. It detects fine on every system I've put it on. As for Norton, it is a documented Norton problem, and they (Norton) are working on it.

    As for security centre, yes, this is by design. They know users ignore the update installation requests, so they want it automatic. Just tell it to quit bothering you, and it will.

    What I find really funny is that this user, who appears quite clueless, is modded informative when all the replies are not. Look folks, anti-MS != informative.

  57. Animated dog... by zxflash · · Score: 5, Funny

    If the animated dog says my machine is secure who am I to argue with it...

    --

    All the torrents you could want.
  58. Re:Post-install SP2 thoughts / experiences so far? by Milhouse_ph · · Score: 2, Informative

    As far as I've managed to tell it has only "broken" one thing for me. The outbound TCP connections were limited to 10/sec. But then I went here:

    http://www.lvllord.de/?url=tools#4226patch

    And found a fix for it. All of the FUD that I've seen about SP2 breaking things mainly focuses around which apps aren't automagically detected by the built in firewall as "allowed". Considering that having to add rules to a firewall config is pretty standard amongst all firewalls, I'm pretty lost as to why this is considered "breaking" an app. I'll admit the TCP thing was frustrating, but that's the only problem I've encountered.

    So for what it's worth, I've been running SP2 in beta and release form for about 1 month now on my primary system. And I've had only the one TCP issue. I've also had it running on 5 other "test" boxes (read: other family member's computers). And so far no one has reported a problem. Although obviously YMMV.

    I'll admit I haven't formally been running the XP firewall (I turned it on to check it out, but I have my own firewall solution that I prefer). But turning it off was easy enough and I checked into configuring it and that seemed easy enough as well (you go into the control panel icon and select the programs you want to allow incoming access on).

    Now lets not continue down the road complaining that it's broken because it's too difficult for "Joe Blow" to configure his firewall and as a result we should consider it "broken". Realize that at the same time "Joe Blow" probably can't properly configure ANY firewall. User ignorance doesn't mean something is broken. If I put power steering fluid in my brake lines because I don't know better, and my brakes lock up, that's not the car's fault.

  59. Dumb, slightly OT question/proposition by chadjg · · Score: 2, Insightful

    What would happen if Microsoft limited the administrator account to 16 colors and maybe a low resolution. Would people learn quickly to use a user account to play games? Would administrators still be able to get their work done with said limitations?

    This is just one of those off-the-top-of-the-head-and-not-thought-out type ideas, but i'm curious.

    --
    Why do I have this? I don't smoke.
  60. Its not that bad by gad_zuki! · · Score: 4, Insightful

    IE is actually usable for the first time since, err, ever. The extra nag dialogs and the pop-up blocker go a long way towards keeping spyware off your machine. Lets face facts, most people will never stop using IE. They will go to their deathbeds using bundled software. They will never switch to Firefox or Opera. This is the service pack for them.

    The nag "Where if your anti-virus" box is a reminder that windows needs an AV program to run properly. I can't stress how important a built-in firewall is, even if it is "weak" its still going to introduce people to the concept of a firewall much more than the old version did. Personally, I dont think ports over 1025 should be blocked by default, but that's just me.

    I've been running SP2 since MS released the final version and am pretty pleased with it. XP even feels snappier. It passes the "grandma" test fairly well and like you wrote is a good first step towards securing windows. If it only helps fight spyware installs its worth its bytes in grams of gold. Especially for us techies who get called, bothered, etc for stuff that is completely preventable.

    This is really the first step to securing windows for the everyman, if such a thing is truly possible. Soon enough current machines will be replaced with machines with processors which understand NX, thus making the feared buffer overflow much less fearsome.

    Even though SP2 is going to cause all sorts of headaches with clients, friends, and family, I'm very optimistic about what it can do to help stop spyware and to a lesser extent worms and viruses. Its a real shame there isn't an equivalant SP for the HUGE win2k user base out there. Seems like the script kiddies will now be focusing on win2k machines from now on.

  61. Add To This... by EXTomar · · Score: 2, Informative

    Add to this that Windows doesn't give the user a facility to promote (and demote!) themselves easily its really hopeless. This problem has been around since NT 3.1 and has been compounded by the integration of IE into the kernel. And yes I know about "runas" but it doesn't work correctly for many apps (even ones provided by MS).

    So Windows offers you as an IT manager two options:

    - Remove admin rights from users but anytime an application requires a minor elevation in rights you will get pestered.

    - Give everyone admin rights but watch installations like hawk because they might accidently misclick some link at some googled web site that wasn't what was said.

    Either path is expensive. I curse MS every day for creating a flexible permission system, access control lists that are well integrated across the enterprise and then promptly not use them in any of the right places.

    I'm stumped and have given up all hope of figure out what to do beyond pray. As long as MS clings to this system this Windows will be an expensive PITA system to maintain on the enterprise.