Slashdot Mirror
Microsoft States Full TCP/IP Too Dangerous
daria42 writes "To fully implement the TCP/IP protocol in Windows XP would make creating denial of service attacks 'entirely too trivial', Microsoft has claimed. The company was responding to claims by Nmap author and well-known security expert Fyodor that by repeatedly disabling the ability to send TCP/IP packets via the 'raw sockets' avenue, Microsoft was asking the security community to 'pick their poison': either cripple their operating system or leave it open to hackers. Admitting that a recent security patch had intentionally disabled a community-developed workaround to Microsoft's TCP/IP changes - which were first implemented in Windows XP Service Pack 2 - the company claimed it had received little negative feedback on the issue."
From the Article:
Interesting that M$ sees fit to lecture us on the dangers of raw sockets now, given their prior stand on the issue.
____
~ |rip/\/\aster /\/\onkey
To fully implement the TCP/IP protocol in Windows XP would make creating denial of service attacks 'entirely too trivial'
This is because XP is not designed right, not because the TCP/IP protocol is wrong. (just to be clear)
The quote from Fyodor is:
"Pick your poison: Install MS05-019 and cripple your OS, or ignore the hotfix and remain vulnerable to remote code execution and DoS."
It's like... we just... can't... win.
Fyodor goes on to say...
"Nmap has not supported dialup nor any other non-ethernet connections
on Windows since this silly limitation was added. The new TCP
connection limit also substantially degrades connect() scan. Nmap
users should avoid thinking that all platforms are supported equally.
If you have any choice, run Nmap on Linux, Mac OS X, Open/FreeBSD, or
Solaris rather than Windows. Nmap will run faster and more reliably.
Or you can try convincing MS to fix their TCP stack. Good luck with
that."
The answer, my friend, is to drop Microsoft.
Baby, meet bathwater.
The dangers of knowledge trigger emotional distress in human beings.
It's quite obvious that Microsoft has other motives for doing this as this really doesn't do anything to improve security. As was quoted in the article, Fyodor correctly points out that Windows (AFAIK) is the only operating system to put such restrictions on raw sockets and it certainly has not helped their dismal security.
Of course, there's always the possibility of ignorance...
Never attribute to malice that which is adequately explained by
stupidity.
but I really have to doubt that Microsoft is quite this dumb. They've got a lot of really tallented people working there so you have to think that someone would have thought about this. Then again, they have demonstrated a supreme lack of understanding when it comes to security so who knows.
No, Microsoft... none of those support raw sockets. Oh, wait... they all do. The problem is not raw sockets, the problem are the holes in the OS in the first place. If your OS doesn't run services that can be hacked, or if the applications don't allow to execute untrusted code there is no problem. Avoiding raw sockets is treating the symptoms, not the cause.
Ahhh...the great dumpster continuum. Many a free computer will be found there. -- sowth (748135)
It isn't already easy to create and launch a DDoS attack from Windows XP? So we get an almost crippled TCP stack in the name of making something a little less easy to do.
Sounds like a fair trade to me! [/sarcasm]
For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
In Redmond, this is what they call a win win.
Luck favors the prepared, darling.
This is just part of the push to get the core internet routers cut over to NetBEUI well in advance of any ipV6 rollout. If Microsoft can manage that, the internet will be theirs again, just like when they initially built it between Steve, Bill and Woz's offices back in the early seventies.
Scary thing is, from what I've been reading Oracle will go along with this. And they can tell the future!!
rewrite TCP/IP? Embrace and extend it, so that we can have a safe, trusted internet?
Wow, talk about going back on their word. Anybody remember of GRC.COM had this concern before XP came out? He did all the yelling and screaming that he could and MS just laughed at him. Guess he gets the last laugh.
Microsoft is just responding to Steve Gibson, of Gibson Research, who has hounded them for making raw sockets accessible to all programs in the past.
Steve Gibson's crusade againts Windows raw socket capabilities. Did Microsoft listen, and now is being criticised for doing that?
are they kidding?
if you are mucking with protocols by using raw sockets, are you really going to be coding it on a windows platform? i can imagine a worm or trojan doing it perhaps - in a ddos scenario - but since when has raw sockets become the red-headed stepchild implicated in this?
Maybe Microsoft is right. Protocols are dangerous.
Wouldn't it be safer if we all just had a My TCP/IP folder?
I can't believe this issue of Windows security is so difficult to understand. You read all these articles about viruses and trojans but people keep failing to mention the obvious - you must never casually run Windows with Administrator privileges.
It's because so many people are used to doing this by default, and so many third party apps demand Admin privileges, that Windows security is a nightmare.
There's more to the Windows security picture of course (insecure services as well) but you can prevent so many problems just by avoiding that Admin account. It's quite normal to have raw sockets via root/Administrator privileges. The problem is that all windows users (and any software they download) are Admins.
Failure Modes and Effects Analysis... I would love to see that done on windows. Maybe find the problem itself rather than work around it and leave the faulires in there. Bad by design.
Evolution or ID?
Raw Sockets are not disabled at the server versions.
Under Windows 2003, programs with admin privleges can use Raw sockets.
Dear MS Employees, We have started the FUD about TCP/IP. Now press forward with MS/IP. Once we release it we'll charge everyone a fee to use it because we know it will be more secure than TCP/IP. After all, it comes from Microsoft. With Love, Bill
I'm not a troll, but I play one on Slashdot.
**Me** What about OS like UNIX, Linux, Mac OSX or even OS/2 Warp? They implement TCP/IP without the gaping holes you have? And how do i connect to internet if you implement your own standard?
**Microsoft** Bah Linux ! OS/2 is dead. Mac OS X? The one with 5% market share? Are you kidding? Well, we will give a niiiceee safe, good network. Ta da !!! MSN Reborn ! You will still be able to access your favorite websites without need for the pesky Google.
Your kids will be *safe* online. After all they can't visit iTunes or for that matter any other non-Microsoft site.
You get to save money by not needing to communicate with inferior OS like UNIX.
**Me** I don;t know. I think i need interoperability more than conformation. Switch to Mac guys !
**Microsoft** Nooooo.... So near yet so far
"Doing what i can, with what i have." ~ Burt Gummer
Try it yourself - see if you can receive more than 8K in a recv() call in Windows XP SP2. You can't.
If you do the same on Linux or OS X, you can. On Windows XP SP1, you can.
Thanks, Microsoft.
Thanks to the MS05-019 patch we now have to roll out a NEW PATCH to fix the bugs the MS05-019 introduced worldwide...
..
If you get some weird problems with clients operating on your WAN you might want to contact your MS rep and ask for a patch for the bugs introduced with MS05-019s TCPIP.SYS
...since the admin can always write packets (in frames)directly to the layer 2 driver. all they are doing is breaking the BSD sockets API - security through obscurity? right....
If you can't have a secure OS, the OS should be less vulnerable to being abused. So in effect, use Linux or other OS's if you need to use raw sockets.
So now they are getting blasted for taking them out.
Sounds like MS gets to choose: make Gibson happy, or make Fyodor happy.
Microsoft decides what I may do on my computer or not?
This statement applies to any operating system -- you can only do things within the OS's limitations.
Remember when the 2.6.8 kernel suddenly broke CD/DVD burning in several prominent distros, because they implemented certain security features? That was fun...
on a desktop ? what network traffic would one really be analyzing on a desktop?
From it:
Food for thought.Avantslash - View Slashdot cleanly on your mobile phone.
The company is expecting further debate on the issue, it said, even going to the extent of forecasting typical counter-arguments to the TCP/IP changes. One example cited was "worms/viruses can just install a kernel-mode driver that would still allow denial-of-service attacks to be carried out."
It also pointed out that "writing and installing kernel-mode code is vastly more complicated" than using an existing raw socket feature, and that if malware did make it into the kernel of a Windows machine, the user would have more serious concerns than just SYN attacks launched from their machines.
i guess the MS position on this is that installing a kernel-mode virus will require a reboot to load properly, and since longhorn will be ultra-super-stable (TM) this will not be an issue, since their new virus scanning/spam hunting "solutions" will catch such wild code before a pc is rebooted. in other words, move along folks, nothing to see here...
I am actually going to side with Microsoft on this one. It is not as if they removed raw sockets, but rather restricted access to them. Let's consider who needs raw sockets, mostly advanced users. Advanced users are going to have an Administrator or root account on the Windows machine and therefore should have access to raw sockets, no? There is almost no reason for the average user to have raw sockets. They do create a real risk of bad network behavior and I imagine if someone were to create TCP/IP today instead of 30 years ago when the Internet was a much smaller, nicer place, raw sockets would not be part of the spec.
As an aside, I think I'm going to take the rest of the day off, agreeing with Microsoft is mentally jarring. It has to make you question existence just a little and also make you a touch ill.
According to the related MS KB article:
:P
http://support.microsoft.com/kb/897656/
*snip*
CAUSE
This behavior occurs because security update MS05-019 changes the way raw sockets work when Internet Connection Firewall (ICF) is disabled. By default, ICF is disabled in Microsoft Windows XP with SP1.
WORKAROUND
To work around this behavior, enable ICF. After you start ICF, you can send TCP packets and UDP packets over raw sockets. To enable ICF in Windows XP with SP1, follow these steps:
*snip*
Sure sounds like a new monopoly in the firewall market is forming... now you need a Microsoft firewall before you can even send data
We have been saying for years that running all programs and services at the administrator level is a nightmare and they didn't listen to us. Now they just figured out that it's a problem? I just hope the new Longhorn security model is better.
I believe this is a case of choosing the lesser evil, from my prespective I do believe that the full stack should be implemented but then again I do prefer a safer enviroment, remember most of windows users dont even know what TCP IP is, as long as it browses ...
Jorge Canelhas
Are you a Retro computing fan ???
http://www.retroreview.com/
http://www.retroreview.com/
They're making it easy to choose a Mac and OS X for my next computer.
You were mistaken. Which is odd, since memory shouldn't be a problem for you
Microsoft has announced today that breathing oxygen can be dangerous for... ah what the hell. I need some sleep.
This is my sig. There are thousands more, but this one is mine.
Why embrace and extend? All they really need to do is support the evil bit.
But of course, being Microsoft, you're probably right. They'll make their own implementation of the evil bit, patent it, and charge royalties to others who want to support their new "EDDP" protocol (Evil Data Detection Protocol).
Not to mention that IIS, Exchange, IE, and Outlook will grow to require use of EDDP during transfers of data, locking Mozilla, Apple, Linux, and others from accessing much of the internet.
Finally, John C. Dvorak will boldly claim that EDDP is the wave of the future, and Apple, Linux, and Mozilla are clearly inferior for not supporting what is clearly a web standard, because if Microsoft says it is, it MUST be.
Thousands of people gripe about Windows having this "awful security hole" thanks to misinformation on GRC, and are generally so uptight about information they find on there that they'll cripple their internet connections, wreck the data on their harddrives, and so on...all in the name of being secure! (his entry on http://attrition.org/errata/charlatan.html links to http://www.grcsucks.com/ which describes some of the mania people will go through at Gibson's prompting)
So what happens if MS doesn't pander to them? They constantly get bad press from people who constantly spout off about "security" that they gleaned from the Gibber's site. What happens if MS does pander to them? A few people are upset, but most of the bad press on this issue goes away.
So what should they have done? Wait it out, and take the high road? They've tried that. Educate the users? We've tried that. What else?
Seriously, this is the all-too-common fatal flaw that I have seen in *almost* every tech organization I have ever worked for, or with. It is always easier to throw crap together with no reguard for how it actually works. If it limps along, that is enough for some people (maybe because they were all raised on Windows?).
At this point, if M$ had any respect for itself or the tech industry they would liquidate their company and give all their capital to a more helpful and pertinent organization... dare I say, the OSDL?
microsoft decides what you can or can not do with a microsoft OS. Don't like it? switch to something else.
Microsoft is right, I'm glad they have so much insight on the situation.
You nailed it.
Microsoft is clearly trying to shift the blame from their dain-bramaged design to TCP/IP. How many other operating systems are there that do (more or less) fully implement TCP/IP, including raw sockets? It's almost universal.
Oh well. I guess Microsoft knows the neighborhood is safer with a crippled lunatic than healthy one.
Raise your children as if you were teaching them to raise your grandchildren, because you are.
I run Windows 2000 with my "secure" limited TCP/IP stack. My Windows machine has an IP address, subnet mask, gateway, etc. etc. This machine would get virii if I didn't run a virus checker, firewall, etc.
There is one difference between the two scenarios above - the operating system!
Yes, my UNIX-y boxes are subject to attacks from the Internet but not random attacks like viri and worms.
An attack on my UNIX-y boxes comes from a single, person or script trying to get into my box and trying to (probably) buffer overflow a specific application daemon like FTP, Telnet, etc (not that I run either of these on the Internet anyway!)
So let's not blame it on the "TCP/IP" stack because all attacks are as a result of attacking applications that use the stack, not the stack itself.
We'll also remind ourselves here that UNIX was built around TCP/IP 25 years ago whereas MS refused to believe TCP/IP existed until 15 years ago after Windows 3.11 came out and they had to write a limited stack to install into Windows.
Gentoo Linux - another day, another USE flag.
Umm, while I'm not siding with Microsoft on the issue, I also think that yours is a ridiculous statement.
Microsoft is not deciding what you can do on your computer. They are deciding what you can do with a product they sell. It's a free market - if their product doesn't do what you want, buy (or download for free in many cases) a product that does.
Translation: Our OS is a dog and we need to neuter it to keep it under control.
Not that this will solve anything, no raw sockets? I don't need no raw sockets, I have 48 billion bogus dns lookups!
--Nuintari
slashdot : where an opinion can be wrong.
Okay, the company with a baffling amount of security holes is giving advice on computer security. That is about as absurd as, say, the company with worst software quality giving us advice on how to develop quality software.
To quote Ted Kennedy, "Hello? Hello?!!"
Some days, life is just a little too weird to take.
You forgot a link to a place where somebody can do that. I'll take care of that one for ya.
Don't worry, we know what we're doing remember? We're Microsoft and you're not, yes we told you back in the 90s that TCP/IP was a doomed protocol, we told you that NETBIOS and NETBUI were the wave of the future. We know what we're doing and we got here without your help. So, be good little kids and move along, nothing to see here.
As long as we keep buying into this bullshit the community is going to be treated like kids. Enough already, vote with your wallet.
Harrison's Postulate - "For every action there is an equal and opposite criticism"
...because they've disabled port 110.
Ba dump bump! Thanks, I'll be here all week.
Weaselmancer
rediculous.
of companies and the government trying to control what they think we should or shouldn't have/or do.
somewhere, somehow our society got this attitude that because we think the public shouldn't have or need this we can disable it. never mind open standard open protocols - we know what is best for you.
or is it their software is so crappy they have to start to disable open standards open protocols to make it at least somewhat usable and secure.
Microsoft says a lot of things. In a related development 99.9% of the population of the planet think everything Microsoft says is twaddle.
Film at 11.
FGD 135
Should firewalls/filtering at the access layer or upstream providers be mandatory for all networks? It is costly, but in comparison how much does result of the attack cost?
Somehow they need to determine how to detect a spoofed packet/phony TCPIP headers, maybe they need to hire some of these hackers to work for MS?
Also, reduce the amount of information stored for each in-progress connection? Or use something like RealSecure to reset queues when they are overloaded?
He who knows best knows how little he knows. - Thomas Jefferson
Well, I guess this is in line with Microsoft's approach to and attitude towards the users. For decades now, Windows products, in great majority of their incarnations, are perhaps quite 'dummy user friendly' but certainly not very 'power user friendly' - your average MSWin doesn't give you all that many choices and options - especially compared to AppleOSes, 'Nixes etc. MS wanted an OS that can be deployed out of box by a 12 year old, and that's what we got. What's vastly amusing in the whole idea is that a) MS then tries to market 12-y-o-safe OS as 'Professional' and b) MS doesn't even try to set up tiered configuration sets which would allow the user to either configure their OS on a lvl of 12-y-o by choosing wallpapers, mouse pointers and event sounds, or on a level of a computer-savy professional who, for reasons of his own, might or might not need raw sockets. The whole incident is not completely without resemblance to (fictional) situation where Home Depot takes saws and carpet knives out of their inventory because customers might injure themselves while using those tools.
'...computers in the future may have only 1000 vacuum tubes and perhaps weigh 1.5 tons...' Popular Mechanics, 03/49'
All our sockets are going to feel a bit raw after MS gets done with 'em...
I believe that the elders of redmond are not foolish. If they allow cracking, virii, worming, and root kitting; then it is because it is not in their interest to consider it. They are driven by ego, greed and a desire to consume all; not for helping you.
Be weary of the tiger that builds tiger traps.
He's like the third person here to post *that exact link*, and there's even more who've linked to grc.com. Like the first post, for example.
I wrote an article about a very serious problem related to Windows Server 2003 TCP/IP.
Here's a quote : "Trying to set up a Windows Media streaming server to stream high-quality videos, I came across what I can now call a TCP/IP bug in Windows Server 2003 (Standard Edition). In some (not unusual) situations, the server simply cannot use all available bandwidth between itself and the client.
[...]
Eventually, I came to accept the idea that Windows Server 2003, an OS designed for server tasks, is not able to fill a 2Mbit/s ADSL connection. Yes I know it sounds incredible but I've been looking without success for another conclusion for the past 3 months."
Read the full technical explanation and see what Microsoft has to say about it : Microsoft Windows Server 2003 Buggy TCP/IP ?
I have a big problem with this solution. They shut off these features that have good and legitimate use - but if somebody were to really spend the time they could get around it. So now all we're doing is asking for the virus writers of the world to buckle down and make better code. We didn't really secure the OS against DOS attacks because we limited the functionality to create them - but now that somebody hacked the OS at a lower level we have bigger problems than ever. Keep applying those bandaids!
I went to eat some animal crackers and the box said, "Do not eat if seal is broken." I opened the box and sure enough..
So, why do regular old programs in Windows need access to raw sockets? Why not use the syscalls that make Unix TCP/IP systems so famously capable and reasonably secure?
Security, in Microsoft culture actually means "Security of Future Revenue" in the same way the US Income Tax is vital to "National Security."
I'll tell you why: Microsoft wants to put out a new (don't laugh) secure socket API that is incompatible with non-microsoft products. First they get developer lock-in by charging beaucoup dollars for the next version of MS Visual SecureNet development licenses, and then they force the end users to choose between accepting the company mandated security product and all of the other services they get from non Microsoft servers. Compatibility with that stuff will be sold as another overpriced Microsoft based proxy server that MS can use as leverage against their competition.
--- Nothing clever here: move along now...
Microsoft Windows isn't the operating system of choice for security consultants and tinkerers. It is used by millions of users who have no training in security issues whatsoever. It has to be designed to protect these people from harm and other people from being harmed by them. Gun and ammunition should not be handed to people who don't know how to deal with them safely.
Now, Microsoft does get it wrong, but not because they disable raw sockets. They fail to ensure that users cannot work around that limitation by installing kernel level code. Windows users have too much control, not too little.
Why the hell are you trying to run low-level software on Windows anyway? That seems to be a clear-cut case of everything looking like a nail when the only tool you have is a hammer.
That is the geek equivalent of crushing a beer can on your head!
I used to be impressed by this, until I felt how paper-thin an American beer can is. In my country, beverage cans were similar to soup cans until a few years ago. (Mind you, I don't know what American soup cans are like. They may be as flimsy as their beer cans.)
"I'm not impatient. I just hate waiting." - My Dad
I'm all for standards compliance and the ability for an OS (Windows) to offer full functionality in this area...
But, until you've been hit with a 4GBit DDOS attack coming from 20,000 unsecured Windows boxes who are spoofing their IP's, you truly don't know how bad this is.
This functionality should be available in an update the user must manually download. Anyone who needs nmap will be have to download it.
On a side note, there's a better solution to the DDoS problem - ISP's should prevent spoofed packets from leaving their networks.
Full TCP/IP is dangerous?
If Microsoft is taking this stance, why not just disable Internet connectivity completely with the next Windows update?
Windows could then become the most secure operating system out. Linux wouldn't stand a chance.
Linux/Open Source/Anti Microsoft News
Wrong. For tabbed browsing, javascript control, intelligent cookie management, and popup blocking.
That being said, you'll note that Firefox/Mozilla patches are available immediately when vulnerabilities are discovered, instead of 10 months after an exploit hits the street.
If MS could provide patches in a timely fashion, they would have far fewer problems.
If they weren't shopping their OS to a demographic that is too clueless to install the patches when they are available, they would have no problem at all!
But let's face it, somebody will always try to provide an OS for uneducated, incompetent and mentally defective computer users - since there are so many of them, eager to spend their hard-earned cash of a device they don't need or understand.
Damn, somebody must have hit my "cynicism" button today.
both small, tight, impossible to read assembly, and well commented, reusable, understandable code have uses in computing.
there was a time, video memory was thought of in terms of LPT- less than a K
you don't need HEAVILY built up code for every single thing..
every day http://en.wikipedia.org/wiki/Special:Random
MS disabling outgoing raw sockets is a safety feature for the rest of us. Who cares if a couple hundred people legitimately using raw sockets under Windows can't if they patch. The important fact is it got harder for the other trillion windows boxes to flood useful websites.
Yes, yes, I realize that last time it wasn't a useful site ;) but it could be Google next time!
Microsoft originally created the Windows interface, not for computer-savvy users, but for managers...people who decided, for whatever reason, they needed a certain amount of computer power to do their jobs but didn't want to have to go through learning all the arcane CLI incantations to get the machine to do what they want. The computer-savvy users (a comparatively small population at the time) were happily typing in commands and writing .bat files to take care of all their needs, but got force-fed the GUI because -- wait for it -- Microsoft made lots of money by selling to the aforementioned managers, more than they did to the computer-savvy users.
Now we're at the logical outcome of that marketing exercise...much of the business-computing world uses a Windows variant as its primary {GUI | OS}, with all the arcana buried deep within .dlls where most of us don't bother digging around. To even access a command-line in anything after Win98 requires that the user know exactly what they're looking for. Again, this is a logical "feature" meant to keep managers from doing damage to their systems. (Think what happens if you don't have a user chrooted and they do something really n00bishly inane like the infamous "rm -rf". Sometimes security through obscurity does work.)
I'm not trying to play favorites here...I like the raw power I get on my home "play" box using a term window, or just plain booting to runlevel 3, and I can accomplish 90% of all the tasks that I employ a computer for using just that. But I'm the rare one in the house; everyone else would be completely lost without their GUI, and whether anyone likes the idea or not, MSFT successfully markets the prevalent GUI in use. Combined with what has become "commodity" hardware, it outsells the nearest rival by a goodly amount, whether or not that rival is actually a better platform.
Just my two cents' worth...save up the change for a root beer or something...
All the world's an analog stage, and digital circuits play only bit parts.
why moving all my security apps to my iBook was a good idea. (It's got its own portmapper in the OS fer chrissakes!)
So, Debian for the IDS boxes, and OS X for the analysis. Sounds good to me!
"Draco dormiens nunquam titillandus."
Since you link to Steve Gibson Research, I'll have to link to grcsucks. His (Steve's) views were wrong then, and they're still wrong today. The "raw socket == ddos" argument was thoroughly discredited:
Dissecting Steve Gibson GRC DoS Page
Raw Sockets are not a Security Risk
Bloody, I know about too many old flamewars.
"another overpriced Microsoft based proxy server"
And don't forget - Microsoft recommends you run EVERY server on a DIFFERENT machine. So you'll need another license...
Richard Steven Hack - This sig is TOO GODDAMN SHORT TO DO ANYTHING USEFUL WITH! MORONS!
Nope, You should read
Microsoft States a crapy Windows is Too Dangerous.
No offenses included. This has been written on a secure OS without full TCP/IP support
Yes, the path becomes clear...
Abandon the industry standard for VMs (Java) and roll your own (.Net).
Abandon the industry standard for portable documents (PDF) and roll your own (Metro).
Abandon the industry standard for networking (TCP/IP) and roll your own (???).
Each sounds more improbable than the last. Yet the first one has happened, the second is going to happen, and thus the third seems much less improbable than it would have otherwise.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
People who are saying the "average" user doesn't "need" raw sockets while saying that the hacker who does will use another OS ANYWAY are obviously missing the point.
Why bother disabling something that's part of a standard when it will have no effect on either the average user or the hacker?
MS is saying here that if the "average" user had raw sockets, they could program DoS code? I don't think that's gonna happen.
All disabling sockets has done is inconvenience nmap users - who just happen to be sys admins running security scans on their networks from their workstations.
Maybe MS doesn't want them to be able to run nmap? Like maybe they might find out how insecure their systems are?
Richard Steven Hack - This sig is TOO GODDAMN SHORT TO DO ANYTHING USEFUL WITH! MORONS!
Of course...
Now if you were running a REAL operating system, it would be entirely appropriate to have a full TCP/IP stack.
I have to agree with Microsoft on this one.
I don't know the meaning of the word 'don't' - J
Ok, so cripple all future zombie machines, and make an option to explicitly enable "full TCP/IP support". But make the option hardwired into the kernel (like the Ctrl-Alt-Del hook) so that it MUST PROMPT THE USER AND CANNOT BE DONE AUTOMATICALLY (or can be enabled automatically with an install image but ONLY AT INSTALL TIME).
Everybody who actually NEEDS raw socket support can opt-in, and breath a sigh of relief because there will be less haxxors out there.
I'm all for crippling people who are going to attack the network. Hell, give em etcha sketches, I don't care.
It's 10 PM. Do you know if you're un-American?
The various BSD flavours support raw sockets. So does Solaris, and even Linux for that matter.
.....
The difference with the Unix-like systems is that ordinary users don't get to poke about with dangerous stuff.
The real point is that Windows software has for too long depended on the assumption that the user has full unfettered access to every resource on the computer -- an assumption which had to cease to be true when Windows became network-aware, because in a networked environment some things are properly restricted. Yet for the best part of ten years, Windows continued to run without privilege separation; and application programmers took advantage of that, creating code which turned out to be fundamentally broken.
Face it, the bathwater is minging and the baby is dead -- there is nothing worth saving in the whole sorry mess. Whether bad water killed the baby, the dead baby made the water worse, or the two are unconnected, isn't really important right now. What is important is to get rid of them both, scrub out the bathtub and start again.
Of course, if you're going to switch to a new version of Windows -- which would have to be totally incompatible with all that sloppily-written software needing root access for no good reason -- then that would be about as big a change as switching to some other operating system. That must worry Microsoft
Je fume. Tu fumes. Nous fûmes!
Hey, I know that I'd enjoy the hell out of a motorcycle--for about 32 seconds of pure acceleration prior to the fiery crash to follow. If they are honestly saying that TCP/IP is too much for them, then I'm happy to take them at their word and use a better OS.
Microsoft acknowledges the suckiness of their operating system, but chooses to cover up the issue by implying it is the fault of the open-source software underneath.
If Microsoft throws out Windows functionality until all that is left are the parts that they can make secure then what will be left ? A big ugly door stop ?
If M$ can't win in this situation, maybe there is a fundamental design flaw in their product?
After all, damn near all other OS's do allow raw socket access, and such OS's probably make up well over 20% of the individual machines connected to the Internet (someone else can go look up the numbers, I'm lazy).
Yet damn near all compromised boxes are running M$ code. Yet there certainly are enough non-M$ boxed on the Internet to make them a worthwhile target for hackers and crackers based on numbers alone.
What's the fuss? So RAW sockets aren't available in user mode. That will keep infected PC's from DDoS'ing the universe (temporarily), until the virus/spyware writers exploit holes in the O/S to escalate their priveledges.
MS is just temporarily making exploiting a machine harder, but it will ultimately be futile and lead to even more nefarious and hostile virus/worm/spyware applications. This is a bandaid at best.
Windows is architected so poorly from a security standpoint, that it's probably time to just start over. Security in Windows has always been a "bolt-on" hack. And just remember, no matter what you do, Security is an Illusion.
Is it time for developers at SlashDot provide an interface similar to GMAIL so that I don't have to put HTML tags in my comments?
My translation is "The current design and implementation of Windows is not compatible with the IP protocol" not sure if that's an accurate description of this article, but it's a statement I've considered true for years :)
AB HOC POSSUM VIDERE DOMUM TUUM
I remember "Steve Gibson" was bashed and debunked for talking about raw sockets in 2000 or 2001.
g eek_developing_winxp_raw/
There is a short audio file from Rob Rosenberg from where he repeadingly laughs at his claims.
By the way, wasn't Gibsons site defaced today by Fluffy Bunny?
http://www.farook.org/arc20010701.htm
http://www.vmyths.com/rant.cfm?id=335&page=4
http://www.theregister.co.uk/2001/06/12/security_
and so on. Is there anything new that has happened in the last 4 years?
Needs to be discussed.
It's just the normal noises in here.
For the truth about Mr Gibson, look here
So, to summarize: "Our OS is so insecure, we know it will be compromised and under control of hackers, so we cannot fully implement TCP/IP."
Got it.
FLR
So your justification is that because other Operating Systems support this service, Microsoft should also support raw sockets? I don't even need to remind the readers of /. that the market share of MS for the desktop is at least 8 times greater than all other platforms combined.
The reason why these other platforms can continue without removing/restricting this service is because the people developing the tools that abuse the raw socket functionality aren't going to waste their time building variations for systems with a marginal penetration share.
The average joe smith home user is running windows, and joe smith is the target for people who develop infectations that abuse the raw socket services; as such, no virii writer is going to waste his time building his tools to infect these other systems.
As such, microsoft windows is overwhelmingly the primary target for these virii writers. They haev a responsibility to their customers to do they best they can to protect the services used and developed by their paying customers, and this means restricting a service that is used almost soley for infectious behavior.
"The only applications that care deeply about the ability to send over raw sockets are enterprise security applications that use 'fingerprinting' techniques to characterise a host on the network based on its response to carefully crafted packets."
From what I can tell, this guy is upset because his claim to fame rides on the same train as a vast number of tools that use windows to abuse other systems around the world. We are told to urge Microsoft to change their services for his convenience, so he can continue to provide his popular tool to the people who like to discover where they don't belong, and who doesn't lock their virtual doors.
Of course, I have to expect /. to side against MS in all things, even if MS's actions are meant to protect their customers and protect the people who are often targetted by DDOS attacks.
Thanks for reading, ttfn
From your link:
:
Important Message
We value your help and like it when you refer other poeple to this site, but please do not link to this site and brand Mr. Gibson as a scam, he is not (per se). This site questions the motives of Mr. Gibson, criticizes him and his works by trying to demystifying what he is doing. What you are going to find on this site are researched facts and opinions. The opinions however are refered to as what they are : opinions not facts.
--To fully implement the TCP/IP protocol in Windows XP would make creating denial of service attacks 'entirely too trivial'--
Entirely too trivial? Where have you been the last couple of years. Did I just wake up in bizarro world or something?
Then why is it that OS X and Linux Implement this properly and don't have this problem???
So Long and Thanks for all the Fish.
In a system which grants admin priviledges to every user of course raw sockets can be dangerous. But the problem is less raw sockets, the problem is more the system itself which uses it.
Ya know, it seems a lot of slashdotters harbor a deep resentment to almost everything Microsoft does, says, or provides. It's ironic when you thing about it: /. posts A LOT of MS stories on a regular (almost daily) basis. The threads are fairly predictable and everyone gets all heated-up over the latest outrageous activities of the evil Gates empire.
If MS sucks and you don't use 'em for anything, why do so many of us invest so much time following them, complaining about them, and posting stories about them?
BTW: We all engage in this behavior with different topics: The guy who hates his ex-girlfriend* but is still talking about her years later. The crapp service experience you had at Best Buy, but are still re-telling and re-living months later. Etc... We humans are an odd bunch huh?
*Please see http://en.wikipedia.org/wiki/Girlfriend for detailsThis one gang kept wanting me to join cause I'm pretty good with a bo staff.
I know I'm weary of waiting for OSX Tiger... :-)
I'm just posting here to try and get this more visible, this is rather shocking and informative. I'll have to remember to read Cringely more often :).
Isn't this against some sort of anti-trust law?
don't 90% of Windows users run as an Administrator anyway because there are a lot of programs require adminstrator access?
I think what we need is a proper rewrite of some common apps so they don't need you to run with Administrator privledges. That would most likely solve a lot of vunerabilities and make securing a computer easier. How one would go about forcing the developers of the software to rewrite them properly, I don't know.
I think MS has dug themselves into a bit of a hole by having Windows start off as a single user OS.
"To fully implement the TCP/IP protocol in Windows XP would make creating denial of service attacks 'entirely too trivial'..."
/obvious
As if creating a denial of service using hijacked Windows XP machines isn't trivial already.
The suggestion in this statement is that the other operating systems are rock solid and cannot be broken into. But in reality, they are certainly harder to break into, but it can be done in large numbers due to either some bugs in some applications, or poor administrative practice, or some combination of both. But we also don't see so many infiltrations of these other operating systems because the Windows machines make the larger target (h4q0r g3tz 2 0wn m0r3), and are (mis)used by the least security conscious and naive of the population. If it were a certain distribution of Linux being used in place of Windows everywhere, perhaps there might not be as big of a problem, but there will definitely be a big problem.
OTOH, I believe Microsoft's action is only going to reduce the problem for a short while. Someone will find a way.
now we need to go OSS in diesel cars
Just blame the sysadmins. ~shakes head~
I work for a company that sells a high-end network security scanning product. We have been dealing with this XP issue now for almost 2 years, and we are not the only ones who have complained to Microsoft. We have pushed our complaints as far through the channels as we can. Microsoft isn't listening.
Their response is: buy Windows Server 2003 if you want raw sockets. We asked them if there was any guarantee that they would not break the raw sockets feature in 2003, and they would not give us that guarantee. Besides, Windows Server 2003 ships with a lot of stuff we would have to disable to make the box even remotely secure.
Our CEO even registered a complaint with Microsoft, saying "We pay to use your software and you are hurting our business and hurting our customers and costing us money with this change. And you have heard our complaints and you are ignoring them." Microsoft responded that they would pass our criticism up the chain, and that's the last we heard.
That's why it irritates me to read in the article that Microsoft has had "little negative feedback" on this issue. I'm sure we're not the only paying customer of Microsoft that has been affected. And they are not telling the truth when they say that "the only thing affected by this change is fingerprinting software": port scanning is affected too.
So we have started recommending that our customers use the Linux version of our product. Now Microsoft is losing hundreds of thousands of dollars of revenue per quarter just from our company.
In Soviet Russia full TCP/IP States Microsoft Too Dangerous
I don't see a problem here. I would think that very few security professionals or large scale network admins would be using Windows as their primary machine. Given that Windows machines often become bots, I'd rather it be harder for people to write DDOS software for them. And if you do need low level access, there are plenty of OSs available to get the job done.
...that eventually hands it's packets to a Windows service makes denial of service attacks entirely too trivial.
This _does_ benefit the average user, infact, it benefits everyone except people wanting to run raw packet construction tools on the windows platform, who now have to install libpcap or something.
The reality of the situation is that botnets make use of SOCK_RAW (or whatever it is in winsock) to spoof source addresses and all kinds of other stuff. Botnet drones are normal people's windows machines. The "normal" customer will never have a legitimate use for raw sockets, but if they get an RK or some other malware on their machine that wants to enlist in a botnet or be used for remote scanning, now those attacks are more difficult, becuse the malware payload now also has to get libpcap installed.
the point here is to raise the bar for what malware has to do to turn a given windows machine into an effective botnet/ddos client member.
Note that the raw socket support _is_ in the server skus. Fyodor and others assert that its because microsoft wants to bilk money out of people. (which is a pretty lame scheme since you'd just install libpcacp to run any good capture tool _anyway_, and you can do that on xp without trouble). The difference is that the majority of botnet members out there aren't server 2003 boxes - they're XP Home.
fwiw, the issue of pulling raw sockets out of the home user sku's has been violently debated internally at MS. It does not _fix_ the issue of machines sending spoofed packets, since if you've got admin rights on the box it's yours. However, it makes it _harder_. We're at the point with Windows XP that we're willing to consider low-hanging fruit that raise the bar for an attack to be successful even if they dont completely eliminate it. With basically all home users running as admin, "fixing it right" isn't possible with the 200+ million machines _already out there_.
We've got enough problems that a multi-pronged approach is the only thing feasible. Yes, we've got people working on making people run as non-admin. That was one of the original goals in Windows XP and it wasn't until reasonably late in the cycle that the call was made that the non-admin story just wasn't there yet for the home user scenarios (too many appcompat problems).
Until the run-as-non-admin story gets worked out, we're in a situation where we have to deploy fixes that are still defeatable, but address the currently existing problem and make future attacks of the same type more difficult to pull off, even though we cant make them impossible.
Microsoft isn't acting unilaterally to screw customers on this issue. As pointed out elsewhere, Gibson and others have been slamming us for a long time for leaving raw sockets turned on. Opinions are divided on the outside just like they are on the inside. Ultimately, i think we've made the right choice. The people that actually want to run nmap or other tools will be smart enough to figure out how to get them working and get the burden of work. The people that aren't smart enough to keep their machines from turning into zombies don't have to do anything - they get a better experience with no effort.... And the entire internet is better off if we can keep more machines from becoming zombies.
My opinions are my own, and do not necessarily represent those of my employer.
this was done for one reason only:
to make it harder for 0wned PC's to effectively mount DDoS / scanning attacks against the inernet.
You cannot argue that this does not make it more difficult - at a minimum existing payloads need to be re-engineered to somehow re-enable sock_raw.. perhaps by dragging along libpcap or something.
When any of the UNIX's mentioned have over 200 million machines connected to the internet, _and_ some sizeable percentage of those are participating in botnets as 0wned machines, we'll see what the UNIX vendors do.
You're right - the best answer is to make windows impervious to being remotely 0wned. That is being worked on. Another good idea would be to keep home users from running as admin. That is being worked on as well.
Until Windows reaches the happy panacea of no security problems, measures that raise the bar but cant eliminate the problem will need to be deployed to help curb widely exploited issues.
That's what's going on here.
My opinions are my own, and do not necessarily represent those of my employer.
I would be happy with halfway in between. No sending of packets with forged source addresses, but allowing raw sockets to modify everything else, including TCP.
OK, let's get something straight here. Sockets, both raw and, uh, non-raw, are NOT part of a TCP/IP stack, nor are they part of any protocol.
They are an API.
Removal, or modification, of parts of the API do not mean the underlying stack/protocol is incomplete or broken.
Got it?
Its all well and good M$ locking the front door, but they left all the windows open.
Power users and worm writers can just install Windows PCAP libraries.
Is that the Microsoft States of America?
Get your own free personal location tracker
It also pointed out that "writing and installing kernel-mode code is vastly more complicated" than using an existing raw socket feature,
Yeh, that's why the majority of people doing this use an widely available rootkit or equivalent to do it for them.
and that if malware did make it into the kernel of a Windows machine, the user would have more serious concerns than just SYN attacks launched from their machines.
"If malware can execute code on a Windows machine, the user has more serious concerns than just SYN attacks launched from their machines. That's why Windows doesn't bother trying to close local exploits."
They've finally officially stated that the only way to effectively secure a Windows box is to unplug it from any network.
malware has traditionally attacked whatever had a large installed base and provided some benefit to the attacker.
long before the internet was dominated by windows machines on residential broadband, there were still hacks and 0wned machines.
Surely you're familiar with the Morris worm. There were no windows payloads or transmission vectors. It still, as they say, "got around".
The last time UNIX derivatives made up the majority of internet connected hosts, unix machines were the ones getting remotely 0wned.
If unix derivatives someday make up the majority of internet connected hosts in the future, why do you assume that this wont be the case again?
My opinions are my own, and do not necessarily represent those of my employer.
Yes, it's screwy. And yes, they're effectively saying "We can't make a secure OS." But at least they ARE admitting that, and mitigating the extent of the damage that can be done...
It's like an alcoholic finally admitting that he has a problem, and telling the guy at the liquor store not to sell him anything again. In an odd sort of way...
Oh, you're not stuck, you're just unable to let go of the onion rings.
Microsoft is not deciding what you can do on your computer. They are deciding what you can do with a product they sell. It's a free market - if their product doesn't do what you want, buy (or download for free in many cases) a product that does.
You seem to forget something. MS doesn't want you to use anything else, just think back on the last 1-2 years on MS's PR and marketing campaigns, think on the truly crippled - as I call it - 3rd world windows version, the price reduced version for Brasil, and I could go on. The point is, they don't want anyone to leave them and want everyone to hug them. Still... read back.
I am putting myself to the fullest possible use, which is all I can think that any conscious entity can ever hope to do.
So every router on the Internet has to divide the entire internet into "UP" and "DOWN"?
That must get interesting when a router is hooked up to 40 peers. Is UUNET up and Broadwing down? Time-Warner sounds like an "UP" to me.
What the fuck are you talking about?
Most ISPs do put ACLs on routers that are the last hop to customers.
You realize that just because packets are coming to you from Time Warner, that doesnt tell how they got to TW from Russia or South Korea. Plus, get this one, BGP and all, the paths they take dont stay the same.
So much for your UP/DOWN theory.
With any TCP/IP, I've found that by just unplugging the ethernet cable, a windows desktop can be just as secure as an OpenBSD Server.
Mod this as a troll if you will, but I'm really just pointing out how absurd these wannabe security "experts" are.
In order to install software you need to at least be a "power user." Being a power user, security-wise, means that all the virus/worms/trojans/whatever will just as effective as they would be as administrator.
The only alternative is using a severely limited account most of the time that will frequently require switching to the power user/admin account to do any real work.
And considering that most used exploits work by using privileges that the user would NEED to have, it's pointless. What I'm saying is that the person would switch to the power user/admin account to run some executable in the first place. The user says "oh there's this executable I want to run, so I'll switch to power user mode." The exploit is a social/wetware one, not a computer/privilege one MOST OF THE TIME. Take it a step further and note that exploits in e-mail software will work regardless, since even regular users can run e-mail software.
Also, this severely limited account isn't even configured by default. Creating a specially locked down account takes considerable time, even on the "server" versions of windows. Even then, there are intrinstic limits to what you can do. Windows doesn't have good sandboxing abilities.
What are you going to do exactly? Have your regular users screen every single outgoing connection made by any and all software? Or perhaps you're going to forbid all software that's not preapproved to connect from making outgoing connections. That's REALLY going to go over well from a practical standpoint.
Nice of you to embarrass yourself in front of the 133t slashdot crowd and show that you don't understand how to program properly. Go back to junior high, bitch.
Well, indirectly. The article says that Microsoft has been "repeatedly disabling the ability to send TCP/IP packets via "raw sockets"" but that "Security professionals rely heavily on raw sockets".
The conclusion seems obvious to me...Either that or they're saying that Microsoft doesn't want security professionals using Windows. Either way, the way the story is written here amuses me.
Hacker Public Radio is our Friend
It also makes sense for the ISPs, these zombies are already loading up their internal networks, why would you want to pay for them loading up your external connection, the one that you have to pay for to others?
Or Microsoft could ensure that you do not need to run in Administrator mode in order to get things done.
Why do you need to run everyday operations as administrator? Why was this practice allowed to continue for so long? Microsoft was aware that this was bad practice before XP even launched. But they chose to do nothing about it.
So now MS says, "We could either continue to strangle our desktop users by further crippling them, or we can piss off serious network developers by forcing them to spend much more money on "Pro" products." They choose further stangulation, of course.
I'm glad that MS has decided that they know best what I should and should not do with my comptuer. Otherwise, who knows what manner of interesting things I might do.
Slashdot. It's Not For Common Sense
You ENTIRELY missed the point.
Simple example. Say I am an ISP. I assign customer A a class C network 192.168.100.0. I assign customer B 192.168.200.0.
I set an ACL that says only packets with a SOURCE address of 192.168.100.x are allowed to come FROM customer A, and only 192.168.200.x are allowed to come FROM customer B.
If customer A, PC1 gets a trojan that starts happily spoofing from customer B's IP block, the packets are dropped by the ACL, and the problem is short-circuited at the SOURCE.
It's something that we were discussing doing when I worked at a large ISP back in 1998. It amazes me that ISP's don't do this now. It's so amazingly simple to do, and modern hardware can handle that kind of ACL with little load.
Even better, for ISP's that offer managed routers, set the ACL on the inbound Ethernet port.
The guy who hates his ex-girlfriend but is still talking about her years later.
That's because this "ex-girlfriend" is inescapable. We can't turn around but she's there, hammering on our firewalls, following us to work, annoying our friends and relatives and even living in their houses... and talking them into trying to get us back together again "just this once, she really needs your help, I think she has a virus."
the company claimed it had received little negative feedback on the issue.
In other news, a noted chemical manufacturer was found to have been dumping toxic waste products into a nearby water supply for years. In their defense, company spokesmen claims they had received little negative on the issue.
Local police have been caught on camera beating up suspected felons. When cornered on the issue, they responded by saying that there had been little negative feedback on the issue -- at least, from anyone who mattered.
In a press conference today, Bush defended his administration's handling of the war on terrorism by saying that they had little negative feedback on the issue. (Possibly because they had suppressed their own report on the issue; outside sources indicate that terrorist activity around the world is four times worse than in the previous year.)
There, three possible responses to the negative feedback defense. Pick your favorite, I need a drink after this.
Sure. Average home users do nothing but write their own protocols using raw sockets.
If i suggested or said that nobody has a use for raw sockets, i misspoke or you misunderstood. The _average_ user only suffers from raw socket support, because it makes thier machine a more desirable target for 0wnage.
for the people that legimately need raw sockets, they're smart enough to figure out how to get them.
"we don't want to admit we were wrong because then those 200 million people would know what really crappy software we sell". If Microsoft made a mistake then fix it.
Well, pick your argument. Should raw sockets be in or out? Was it a mistake to ship it with them in or not?
Our "mistake" was shipping an operating system that suffered from remote root exploits. This mistake, compounded with the need to keep home users running as admin, and also with us shipping a fully functional TCP/IP stack, allows for an unpatched xp machine to easily be turned into a botnet member. That was a big problem for us, our customers, and the internet at large. We can't ship an operating system that does what it needs to do yet has _zero_ security bugs ever discovered over its lifecycle. We don't know how. If you do, or you know somebody that does, we'll hire them. For whatever money they want.
One of the core tenets of security is defense in depth. We know that eventually someone will break into a windows machine. When they get there, we want it to be harder for them to turn it into a botnet drone/zombie. In the future we'll hopefully get away from running-as-admin which will further raise the bar.
Put some of that ill gotten gain to use and fix the problem the "Right Way"
I said we were working on doing just that, and that running as non-admin almost made it into WinXP. Unfortuneately, all those people out there with badly written software (some of it by us, probably) running on windows expect it to still work. We couldn't get everything sorted out in the Windows XP time frame. It's been a source of non-stop work and the story for longhorn will be better but i dont know to what degree (i.e. it may not be all the way fixed).
A kernel that can be patched and have its own hooks intercepted by malicious software is the problem.
Show me a kernel in use on home computers that doesn't suffer from this.
Which department are you in, Public Relations or Marketing?
Testing, actually :) As many defects as you find in MS software, beleive me, there are plenty that never make it to you.
My opinions are my own, and do not necessarily represent those of my employer.
I mean, on other occasions you hear them blather about Windows' totally stellar, fine-grained security architecture, and now they want to prevent Joe Average user from accidentally using raw sockets by, uh, removing the feature altogether?
here here!
I have no idea why ISPs don't do this; of course, I'm also not a CCIE. Can anyone explain?
--
lds
Does this mean that instead TCP/IP MS is just giving us TP?
Nope,
Raw sockets are NOT an API, but you do deserve a prize for trying to sound profound when you obviously have no clue. I'll let others decide which prize you should receive.
Raw sockets are an option when you create a socket, using the exact same API you would use to create a normal socket.
Changing the privilege level required for such a request to succeed is where the action is.
I don't know the meaning of the word 'don't' - J
Steve Gibson is a networking GOD.
I've read lots of articles he's written, and he's sharp as a tack.
Please mods, mod the parent down. Steve Gibson IS an honourable man, and it's sickening to read slander like the grandparent.
I don't know the meaning of the word 'don't' - J
When you set up proper egress filtering on your network, you make it harder for your network to be used to attack other networks -- at the very least, they can't forge their addresses to appear to come from other ISPs anymore. But it doesn't make your network any less vulnerable to attacks.
Yes, everybody should do it. But since there's no real benefit to doing it beyond knowing that you're doing `the right thing', many ISPs don't do it. Also, doing egress filtering can break a few legitimate applications such as dual homing, requiring some further configuration.
I'm not saying this is right or wrong -- just saying why everybody doesn't do it.
M$ sushi anyone?
Try these to get rid of all that Internet exploder crud:
/user:Administrator@domain "RUNDLL32.EXE SHELL32.DLL,Control_RunDLL MAIN.CPL @2"
/user:Administrator@domain "RUNDLL32.EXE SHELL32.DLL,SHHelpShortcuts_RunDLL PrintersFolder"
runas
Windows 2000:
runas
Rundll is excellent, anyone know something similar like runso for Linux? I know I could toss one together with forth, but it should already be there somewhere.
Where is the link to the community-developed workaround? I know of http://www.lvllord.de/ but that is just a workaround to the connection limit issue - which is really less of an issue
Uhm, No.
Berkeley added TCP/IP to Unix as part of their distribution of Unix add ons (i.e. BSD). The Berkeley TCP/IP stack went on to become the reference implementaion.
Unix was built at Bell Labs and did not include TCP/IP at first. I believe their later inclusion of the Berkeley code is what got them in trouble when they went after Berkeley in court.
Actually, TCP/IP is broken.
Actually, it does what is was designed to do. Thus everyone who wants it to do anything else and then labels it 'broken' because it doesn't work is a moron.
Is your car broken because it can't fly? Is your brain broken, because it obviously can't think?
Go and build your own network stack; then we'll talk again.
I would do only it turns out all my programs only run on windows. why is that. oh yes cos they have a MONOPOLY.
i forgot that for a second.
The tired, old reason was that back in the day, packets subject to ACLs were process-switched instead of being hardware-switched, and process switching on routing platforms with 8 or 16Mhz 68000s was painful.
This was amplified by the fact that, in the mid to late 1990s, most ISPs pipes & hardware were nearly obsolete and running at high utilization by the time they got the hardware from back order and the circuits from the carriers. Putting even simple ACLs on their links meant high queues, dropped packets, retransmits and trashed their upstream worse than it already was being trashed.
I guess that reason made sense then, but it seems that now that we have better packet processing, smarter ASICs and much more CPU horsepower, I don't see why this can't be done by ISPs.
One name? BWHAHAHAHHA! Who is this guy "Madonna" now? The "Cher" of people who facilitate others commiting computer crimes?
Hillary: "We're going to take things away from you on behalf of the common good." (aye Comrade!)
Microsoft: "We're going to take raw sockets away from you on behalf of the common good."
WTF, they're equally detestable...
Is Capitalism Good for the Poor?
there's nothing to suggest that Linus et al would be able to improve the security of windows while ensuring that it meets its requirements. Linus has enough problem with is own operating system (but can conveniently choose to say all of userland isn't his fault when thats where the vulns are)
In any case, it's funny that you chose linux - arguably the least secure of the modern unixes. I'd have entertained a suggestion of Theo, but he'd fail because im sure his approach would be "the requirements don't matter, this is how i think it should be done", and then half of the crap customers expect would be broken.
I'm not sure how you read my statement about raw socket support being a bad thing for home users, but the point i was making is that they're not using it, so it doesn't help them, and because of the other factors i outlined, it makes thier machines more attractive and more potent for botnet membership.
If its not helping them, and its a risk, then removing it is a good thing, right ?
I don't understand some of your accusations as "bullshit". Are you telling me i'm lying to you? Do you have informatoin that I don't?
I remember the announcement internally that XP home would run with users= admin and being irate about it. Lot's of us were hoping that we'd get it right for xp but the people upstairs couldn't stomach the amount of appcompat breakage it would cause. As it is the amount of custom code in the various versions of windows for 3rd party app support is pretty outlandish. Read raymond chen's blog for a glmipse of what he was doing back in the windows 95 days to help appcompat. Things like this matter when you have 1) an installed base 2) a bunch of 3rd parties making money off your platform 3) binary compat as a requirement. Note that linux has none of these 3 aggrivating factors to deal with. (not anywhere within an order of magnitude of where MS is, at least)
For what it's worth, I agree that our testing, design, and management are all inadequate. We're just human. As an aside, we're hiring. Are you qualified to help, or just to bitch?
My opinions are my own, and do not necessarily represent those of my employer.
How many programs does this affect besides nmap? I think the cost/benefit tradeoff is pretty obvious here.
My god, I thought we had heard the last of tsarkon reports. You're still a dipshit, I see. If the ISPs of the world employ ACLs at the last hop, explain how forged packet DDoSes thrive on zombie subscriber PCs. Fucktard, still taking above your education and your genetic ability.
From http://www.grcsucks.com/.
Steve Gibson often is referred to as being a "Security Expert", yet one has to see his appearances on *real* security boards/interviews/gatherings. Where was Steve Gibson at Defcon/BlackHat Conference ? Why doesn't he comment/ on Bugtraq or other Security Focus mailing lists ?
The answer is quite simple: he would get nailed down by arguments and facts from real security experts in less then a minute. These persons tend not to be very impressed by self-proclaimed Security Experts and his obfuscation of the real issues and intentions.
As you can read on his resume page, Gibson worked for years as a marketer "Gibson founded a proprietorship specializing in media advertising and public relations" , and that's what he is really good at.
There is usually always an amount of truth behind stories in tabloid newspapers. However, everybody knows that the tabloid newspaper will sensationalise the story to make it sound worse than it already is. Of course they do this to sell more newspapers.
Steve does the same thing, and while he does have a few things to sell, it appears that the main reason he does it is to stroke his inflated ego.
His technique is the same as tabloids - use loaded words to spread Fear, Uncertainly and Doubt among his readers, such that they tend to think that only he knows and understands the whole truth, and only he is the one that will "save them". Notice how he liberally also uses HTML features, such as colour, font sizing and emphasis to highlight some of the loaded words. His DoS attack description could be a canonical example of this technique.
You may be interested in my first attempt at doing it, in regards to the possiblity that your house could be burgled - GRC.com has a new Sheilds UP Test .... It's not that hard to do, and for somebody who lived in a house, yet wasn't aware that they could be burgled, it would be quite scary to find out, particularly in the way I've presented this information.
The Internet's nature is peer to peer - 20050301_cs_profs.pdf
Network:
- Secure.
- Insecure.
The idea is to allow system administrators very good control over the security of their systems. When the network is placed in secure mode, a solenoid will actuate, physically disconnecting the ethernet wire from the network card. When the network is placed in insecure mode, the solenoid will reconnect the ethernet wire. There is currently no option to control any wireless devices the computer might have, so the above is meaningless from a security standpoint.This will have the following advantages:
- System administrators will be able to lock down their systems, preventing viruses, hackers, spyware, and other Microsoft applications from getting into the system.
- If system administrators require maximum convenience, they will be able to enable network connectivity. Since there will be no other controls available within the Windows operating system to control connections more finely, the software will automatically seek out and connect to as many systems as it can find, leaving all ports open, all protocols working, and all permissions set so that any user with a connection to the machine can have complete access to the machine.
In contrast to remote users, who under "insecure" mode will have complete access to the machine, the Windows GUI will be designed in such a way that the user who owns the machine, or any authorized user, will be unable to copy his own files, since they are automatically copyrighted by law. However, unauthorized remote users will be able to copy, and even replace or delete, the user's files.By selecting the "insecure" option, users will be given widespread control over all the details they need be concerned about when it comes to network security.
Microsoft. Where do you want to go today?
From the Fine Article, attributed to Microsoft: "...writing and installing kernel-mode code is vastly more complicated..."
Was the person who said this trying to discourage would-be attackers?
This person doesn't have much insight into the psychology of the adversary.
Linux is looking better and better everyday, even to our management.
An operation was attempted on something that is not a socket
Anyone else think Redmond and RIAA/MPAA conspiring to limit the bittorrent traffic?
I highly doubt this has anything to do with microsoft not being capable of fixing XP. Really this patch breaks the work-around which hackers have been using for months on the net since SP2 came out.
Anonymous Cocaine Auction Protocol
Imagine P2P/bittorent with forged headers for outbound data. Boy that would slow the RIAA down.
Next point:
Wouldn't it be better if I got some patsy in Germany in trouble instead of my neighbor in Japan? I mean, after all, all you're really going to force me to do is forge packets latterally.
If y'all want the commons, y'all got to pay the price of being responsible citizens. All of you!
"[I]t is a wise man who admits the limits of his knowledge or skill, and that pretending either causes harm." --Terry Go
Holy cow, I think I accidentally wandered off of slashdot and onto the website of some obscure hobby site frequented by cranky 80-year-olds reminiscing about a time that never actually existed.
Let's have a poll:
1) I want to run my email program and have it be secure.
2) All software vendors shall be required by federal law to comply with all RFCs and programming standards, whether or not those standards are important to the users of the software, beneficial to the public, or even relevant to anyone.
It's amazing watching someone post on Monday that windows users are too stupid to use the firewall properly. And on friday they post that MS is bad for making the firewall more difficult for virus writers to use as a spam relay.
A standard is what every uses. Yes Windows is a desktop standard, as are Word documents. Pretty easy to see.
.Net (although both have VMs) have two completely different goals. The primary goal of Java VM is to be "write once, run anywhere." This is not part of .Net's goals. .Net's CLR was made 1) to implement code security 2) to increase productivity by taking care of plumming issues such as garbage collection 3) to reconcile the disparities between languages
.Net).
.Net was built to be cross language. As it turns out more people however actually run programs than write them, so platform portability is in fact more useful.
Second,
Java and
The goals are the same. Goals one and two are identical for Java (it was also built to address security issues and still does so better than
As for languages, that's the only arguable difference as indeed Java was built to be cross-platform and
How many people are areally using something like Eiffel#? Come on.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
As it turns out more people however actually run programs than write them, so platform portability is in fact more useful. As it turns out, Java apps are so slow and ugly that hardley anyone uses them.
Man that's brilliant. Did you just make that up? It's not like I've not heard that fro ten years or so now.
Some examples of Java programs you might not (might not? Ha!) be aware of:
Cell phone games? Mostly Java.
Limewire, one of the more popular P2P apps? Java again.
JBuilder and Eclipse (the most popular IDE on the planet next to Visual Studio, in fact by now it may even surpass it) - all Java.
You just keep living back in 1999 and enjoy your stay.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Just Released! New Secure version of TCP/IP! (Please note this requires all users to UNPLUG any network cables and DISABLE all wireless networking before continuing!) Once you have successfully installed this new version, you will be able to communicate with your local network by smoke signal only! Thus ABSOLUTE network security can be guaranteed! Your security cannot be penetrated remotely!
M$ Software has always been hobbled, this just continues the trend from broken to brokenerer.
Even the blindest can see, given enough time and enough verbage. Next time try to be a little quicker on the uptake.
"There is more worth loving than we have strength to love." - Brian Jay Stanley