Slashdot Mirror
Microsoft States Full TCP/IP Too Dangerous
daria42 writes "To fully implement the TCP/IP protocol in Windows XP would make creating denial of service attacks 'entirely too trivial', Microsoft has claimed. The company was responding to claims by Nmap author and well-known security expert Fyodor that by repeatedly disabling the ability to send TCP/IP packets via the 'raw sockets' avenue, Microsoft was asking the security community to 'pick their poison': either cripple their operating system or leave it open to hackers. Admitting that a recent security patch had intentionally disabled a community-developed workaround to Microsoft's TCP/IP changes - which were first implemented in Windows XP Service Pack 2 - the company claimed it had received little negative feedback on the issue."
From the Article:
Interesting that M$ sees fit to lecture us on the dangers of raw sockets now, given their prior stand on the issue.
____
~ |rip/\/\aster /\/\onkey
To fully implement the TCP/IP protocol in Windows XP would make creating denial of service attacks 'entirely too trivial'
This is because XP is not designed right, not because the TCP/IP protocol is wrong. (just to be clear)
The quote from Fyodor is:
"Pick your poison: Install MS05-019 and cripple your OS, or ignore the hotfix and remain vulnerable to remote code execution and DoS."
It's like... we just... can't... win.
Fyodor goes on to say...
"Nmap has not supported dialup nor any other non-ethernet connections
on Windows since this silly limitation was added. The new TCP
connection limit also substantially degrades connect() scan. Nmap
users should avoid thinking that all platforms are supported equally.
If you have any choice, run Nmap on Linux, Mac OS X, Open/FreeBSD, or
Solaris rather than Windows. Nmap will run faster and more reliably.
Or you can try convincing MS to fix their TCP stack. Good luck with
that."
The answer, my friend, is to drop Microsoft.
Baby, meet bathwater.
The dangers of knowledge trigger emotional distress in human beings.
It's quite obvious that Microsoft has other motives for doing this as this really doesn't do anything to improve security. As was quoted in the article, Fyodor correctly points out that Windows (AFAIK) is the only operating system to put such restrictions on raw sockets and it certainly has not helped their dismal security.
Of course, there's always the possibility of ignorance...
Never attribute to malice that which is adequately explained by
stupidity.
but I really have to doubt that Microsoft is quite this dumb. They've got a lot of really tallented people working there so you have to think that someone would have thought about this. Then again, they have demonstrated a supreme lack of understanding when it comes to security so who knows.
No, Microsoft... none of those support raw sockets. Oh, wait... they all do. The problem is not raw sockets, the problem are the holes in the OS in the first place. If your OS doesn't run services that can be hacked, or if the applications don't allow to execute untrusted code there is no problem. Avoiding raw sockets is treating the symptoms, not the cause.
Ahhh...the great dumpster continuum. Many a free computer will be found there. -- sowth (748135)
In Redmond, this is what they call a win win.
Luck favors the prepared, darling.
This is just part of the push to get the core internet routers cut over to NetBEUI well in advance of any ipV6 rollout. If Microsoft can manage that, the internet will be theirs again, just like when they initially built it between Steve, Bill and Woz's offices back in the early seventies.
Scary thing is, from what I've been reading Oracle will go along with this. And they can tell the future!!
rewrite TCP/IP? Embrace and extend it, so that we can have a safe, trusted internet?
Wow, talk about going back on their word. Anybody remember of GRC.COM had this concern before XP came out? He did all the yelling and screaming that he could and MS just laughed at him. Guess he gets the last laugh.
Microsoft is just responding to Steve Gibson, of Gibson Research, who has hounded them for making raw sockets accessible to all programs in the past.
Steve Gibson's crusade againts Windows raw socket capabilities. Did Microsoft listen, and now is being criticised for doing that?
are they kidding?
if you are mucking with protocols by using raw sockets, are you really going to be coding it on a windows platform? i can imagine a worm or trojan doing it perhaps - in a ddos scenario - but since when has raw sockets become the red-headed stepchild implicated in this?
Maybe Microsoft is right. Protocols are dangerous.
Wouldn't it be safer if we all just had a My TCP/IP folder?
I can't believe this issue of Windows security is so difficult to understand. You read all these articles about viruses and trojans but people keep failing to mention the obvious - you must never casually run Windows with Administrator privileges.
It's because so many people are used to doing this by default, and so many third party apps demand Admin privileges, that Windows security is a nightmare.
There's more to the Windows security picture of course (insecure services as well) but you can prevent so many problems just by avoiding that Admin account. It's quite normal to have raw sockets via root/Administrator privileges. The problem is that all windows users (and any software they download) are Admins.
Failure Modes and Effects Analysis... I would love to see that done on windows. Maybe find the problem itself rather than work around it and leave the faulires in there. Bad by design.
Evolution or ID?
Raw Sockets are not disabled at the server versions.
Under Windows 2003, programs with admin privleges can use Raw sockets.
Dear MS Employees, We have started the FUD about TCP/IP. Now press forward with MS/IP. Once we release it we'll charge everyone a fee to use it because we know it will be more secure than TCP/IP. After all, it comes from Microsoft. With Love, Bill
I'm not a troll, but I play one on Slashdot.
Try it yourself - see if you can receive more than 8K in a recv() call in Windows XP SP2. You can't.
If you do the same on Linux or OS X, you can. On Windows XP SP1, you can.
Thanks, Microsoft.
...since the admin can always write packets (in frames)directly to the layer 2 driver. all they are doing is breaking the BSD sockets API - security through obscurity? right....
If you can't have a secure OS, the OS should be less vulnerable to being abused. So in effect, use Linux or other OS's if you need to use raw sockets.
It isn't "almost crippled."
Ordinary users on Unix are subject to even worse limitations (which is, in fact, why ping among other utilities runs setuid root).
Has anyone found that this makes Unix unusable for them? For that matter, outside of DDoS, connection hijacking, and abusing smtp servers to cover your tracks when spamming, is there ever any need for an application programmer to falsify a source address? Doing so means you won't get a reply from whatever you're trying to do.
All that said, I imagine if MS actually put some effort into fixing the security issues with their flagship product in the first place, so it didn't get hacked (hint: disable activex by default, along with integrated vb scripting in outlook), then there'd be no hacked machines to be used in attacks.
From it:
Food for thought.Avantslash - View Slashdot cleanly on your mobile phone.
I am actually going to side with Microsoft on this one. It is not as if they removed raw sockets, but rather restricted access to them. Let's consider who needs raw sockets, mostly advanced users. Advanced users are going to have an Administrator or root account on the Windows machine and therefore should have access to raw sockets, no? There is almost no reason for the average user to have raw sockets. They do create a real risk of bad network behavior and I imagine if someone were to create TCP/IP today instead of 30 years ago when the Internet was a much smaller, nicer place, raw sockets would not be part of the spec.
As an aside, I think I'm going to take the rest of the day off, agreeing with Microsoft is mentally jarring. It has to make you question existence just a little and also make you a touch ill.
Why embrace and extend? All they really need to do is support the evil bit.
But of course, being Microsoft, you're probably right. They'll make their own implementation of the evil bit, patent it, and charge royalties to others who want to support their new "EDDP" protocol (Evil Data Detection Protocol).
Not to mention that IIS, Exchange, IE, and Outlook will grow to require use of EDDP during transfers of data, locking Mozilla, Apple, Linux, and others from accessing much of the internet.
Finally, John C. Dvorak will boldly claim that EDDP is the wave of the future, and Apple, Linux, and Mozilla are clearly inferior for not supporting what is clearly a web standard, because if Microsoft says it is, it MUST be.
Thousands of people gripe about Windows having this "awful security hole" thanks to misinformation on GRC, and are generally so uptight about information they find on there that they'll cripple their internet connections, wreck the data on their harddrives, and so on...all in the name of being secure! (his entry on http://attrition.org/errata/charlatan.html links to http://www.grcsucks.com/ which describes some of the mania people will go through at Gibson's prompting)
So what happens if MS doesn't pander to them? They constantly get bad press from people who constantly spout off about "security" that they gleaned from the Gibber's site. What happens if MS does pander to them? A few people are upset, but most of the bad press on this issue goes away.
So what should they have done? Wait it out, and take the high road? They've tried that. Educate the users? We've tried that. What else?
Seriously, this is the all-too-common fatal flaw that I have seen in *almost* every tech organization I have ever worked for, or with. It is always easier to throw crap together with no reguard for how it actually works. If it limps along, that is enough for some people (maybe because they were all raised on Windows?).
At this point, if M$ had any respect for itself or the tech industry they would liquidate their company and give all their capital to a more helpful and pertinent organization... dare I say, the OSDL?
You nailed it.
Microsoft is clearly trying to shift the blame from their dain-bramaged design to TCP/IP. How many other operating systems are there that do (more or less) fully implement TCP/IP, including raw sockets? It's almost universal.
Oh well. I guess Microsoft knows the neighborhood is safer with a crippled lunatic than healthy one.
Raise your children as if you were teaching them to raise your grandchildren, because you are.
I run Windows 2000 with my "secure" limited TCP/IP stack. My Windows machine has an IP address, subnet mask, gateway, etc. etc. This machine would get virii if I didn't run a virus checker, firewall, etc.
There is one difference between the two scenarios above - the operating system!
Yes, my UNIX-y boxes are subject to attacks from the Internet but not random attacks like viri and worms.
An attack on my UNIX-y boxes comes from a single, person or script trying to get into my box and trying to (probably) buffer overflow a specific application daemon like FTP, Telnet, etc (not that I run either of these on the Internet anyway!)
So let's not blame it on the "TCP/IP" stack because all attacks are as a result of attacking applications that use the stack, not the stack itself.
We'll also remind ourselves here that UNIX was built around TCP/IP 25 years ago whereas MS refused to believe TCP/IP existed until 15 years ago after Windows 3.11 came out and they had to write a limited stack to install into Windows.
Gentoo Linux - another day, another USE flag.
Umm, while I'm not siding with Microsoft on the issue, I also think that yours is a ridiculous statement.
Microsoft is not deciding what you can do on your computer. They are deciding what you can do with a product they sell. It's a free market - if their product doesn't do what you want, buy (or download for free in many cases) a product that does.
Translation: Our OS is a dog and we need to neuter it to keep it under control.
Not that this will solve anything, no raw sockets? I don't need no raw sockets, I have 48 billion bogus dns lookups!
--Nuintari
slashdot : where an opinion can be wrong.
Okay, the company with a baffling amount of security holes is giving advice on computer security. That is about as absurd as, say, the company with worst software quality giving us advice on how to develop quality software.
To quote Ted Kennedy, "Hello? Hello?!!"
Some days, life is just a little too weird to take.
I wrote an article about a very serious problem related to Windows Server 2003 TCP/IP.
Here's a quote : "Trying to set up a Windows Media streaming server to stream high-quality videos, I came across what I can now call a TCP/IP bug in Windows Server 2003 (Standard Edition). In some (not unusual) situations, the server simply cannot use all available bandwidth between itself and the client.
[...]
Eventually, I came to accept the idea that Windows Server 2003, an OS designed for server tasks, is not able to fill a 2Mbit/s ADSL connection. Yes I know it sounds incredible but I've been looking without success for another conclusion for the past 3 months."
Read the full technical explanation and see what Microsoft has to say about it : Microsoft Windows Server 2003 Buggy TCP/IP ?
Since you link to Steve Gibson Research, I'll have to link to grcsucks. His (Steve's) views were wrong then, and they're still wrong today. The "raw socket == ddos" argument was thoroughly discredited:
Dissecting Steve Gibson GRC DoS Page
Raw Sockets are not a Security Risk
Bloody, I know about too many old flamewars.
Yes, the path becomes clear...
Abandon the industry standard for VMs (Java) and roll your own (.Net).
Abandon the industry standard for portable documents (PDF) and roll your own (Metro).
Abandon the industry standard for networking (TCP/IP) and roll your own (???).
Each sounds more improbable than the last. Yet the first one has happened, the second is going to happen, and thus the third seems much less improbable than it would have otherwise.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
People who are saying the "average" user doesn't "need" raw sockets while saying that the hacker who does will use another OS ANYWAY are obviously missing the point.
Why bother disabling something that's part of a standard when it will have no effect on either the average user or the hacker?
MS is saying here that if the "average" user had raw sockets, they could program DoS code? I don't think that's gonna happen.
All disabling sockets has done is inconvenience nmap users - who just happen to be sys admins running security scans on their networks from their workstations.
Maybe MS doesn't want them to be able to run nmap? Like maybe they might find out how insecure their systems are?
Richard Steven Hack - This sig is TOO GODDAMN SHORT TO DO ANYTHING USEFUL WITH! MORONS!
The various BSD flavours support raw sockets. So does Solaris, and even Linux for that matter.
.....
The difference with the Unix-like systems is that ordinary users don't get to poke about with dangerous stuff.
The real point is that Windows software has for too long depended on the assumption that the user has full unfettered access to every resource on the computer -- an assumption which had to cease to be true when Windows became network-aware, because in a networked environment some things are properly restricted. Yet for the best part of ten years, Windows continued to run without privilege separation; and application programmers took advantage of that, creating code which turned out to be fundamentally broken.
Face it, the bathwater is minging and the baby is dead -- there is nothing worth saving in the whole sorry mess. Whether bad water killed the baby, the dead baby made the water worse, or the two are unconnected, isn't really important right now. What is important is to get rid of them both, scrub out the bathtub and start again.
Of course, if you're going to switch to a new version of Windows -- which would have to be totally incompatible with all that sloppily-written software needing root access for no good reason -- then that would be about as big a change as switching to some other operating system. That must worry Microsoft
Je fume. Tu fumes. Nous fûmes!
What's the fuss? So RAW sockets aren't available in user mode. That will keep infected PC's from DDoS'ing the universe (temporarily), until the virus/spyware writers exploit holes in the O/S to escalate their priveledges.
MS is just temporarily making exploiting a machine harder, but it will ultimately be futile and lead to even more nefarious and hostile virus/worm/spyware applications. This is a bandaid at best.
Windows is architected so poorly from a security standpoint, that it's probably time to just start over. Security in Windows has always been a "bolt-on" hack. And just remember, no matter what you do, Security is an Illusion.
Is it time for developers at SlashDot provide an interface similar to GMAIL so that I don't have to put HTML tags in my comments?
I remember "Steve Gibson" was bashed and debunked for talking about raw sockets in 2000 or 2001.
g eek_developing_winxp_raw/
There is a short audio file from Rob Rosenberg from where he repeadingly laughs at his claims.
By the way, wasn't Gibsons site defaced today by Fluffy Bunny?
http://www.farook.org/arc20010701.htm
http://www.vmyths.com/rant.cfm?id=335&page=4
http://www.theregister.co.uk/2001/06/12/security_
and so on. Is there anything new that has happened in the last 4 years?
For the truth about Mr Gibson, look here
As long as the account has "Load Driver" privilege, you don't need to reboot to install kernel level code. Unloading it takes a reboot though...
It's also not "vastly more complicated", it's a different interface and *gasp* requires correct code to not blue screen.
Recap, almost all Win users run as Admin. Mostly because that is the default, everything they use works, and some things that shouldn't require admin privledges do.
Microsoft's solution then is to cripple Admin so that "bad things" can't be done in that mode.
This will inevitably lead to Admin on Win being reduced to an equivalent of user mode in *nix. Eventually we will see a new Super Admin that can be entered to do the things that MS takes away from Admin. As long as we can keep developers from writing programs requiring super admin privleges, Win might actually eventually get to where it should have started out at.
"Unheard of means only it's undreamed of yet,
Impossible means not yet done." ~~ Julia Ecklar
In a system which grants admin priviledges to every user of course raw sockets can be dangerous. But the problem is less raw sockets, the problem is more the system itself which uses it.
Microsoft has a monopoloy in a lot of different areas, so regardless of whether or not a Slashdot reader personally uses their software it still permeates everyday computer life - like it or not. If someone does have strong feelings against the software giant then they would be guilty of complacency for not following it's actions.
I don't care particularily about the guy complaining about his ex-girlfriend, but when companies such as Best Buy screw consumers I'd rather hear about it than not.
I work for a company that sells a high-end network security scanning product. We have been dealing with this XP issue now for almost 2 years, and we are not the only ones who have complained to Microsoft. We have pushed our complaints as far through the channels as we can. Microsoft isn't listening.
Their response is: buy Windows Server 2003 if you want raw sockets. We asked them if there was any guarantee that they would not break the raw sockets feature in 2003, and they would not give us that guarantee. Besides, Windows Server 2003 ships with a lot of stuff we would have to disable to make the box even remotely secure.
Our CEO even registered a complaint with Microsoft, saying "We pay to use your software and you are hurting our business and hurting our customers and costing us money with this change. And you have heard our complaints and you are ignoring them." Microsoft responded that they would pass our criticism up the chain, and that's the last we heard.
That's why it irritates me to read in the article that Microsoft has had "little negative feedback" on this issue. I'm sure we're not the only paying customer of Microsoft that has been affected. And they are not telling the truth when they say that "the only thing affected by this change is fingerprinting software": port scanning is affected too.
So we have started recommending that our customers use the Linux version of our product. Now Microsoft is losing hundreds of thousands of dollars of revenue per quarter just from our company.
It also pointed out that "writing and installing kernel-mode code is vastly more complicated" than using an existing raw socket feature,
Yeh, that's why the majority of people doing this use an widely available rootkit or equivalent to do it for them.
and that if malware did make it into the kernel of a Windows machine, the user would have more serious concerns than just SYN attacks launched from their machines.
"If malware can execute code on a Windows machine, the user has more serious concerns than just SYN attacks launched from their machines. That's why Windows doesn't bother trying to close local exploits."
With any TCP/IP, I've found that by just unplugging the ethernet cable, a windows desktop can be just as secure as an OpenBSD Server.
the company claimed it had received little negative feedback on the issue.
In other news, a noted chemical manufacturer was found to have been dumping toxic waste products into a nearby water supply for years. In their defense, company spokesmen claims they had received little negative on the issue.
Local police have been caught on camera beating up suspected felons. When cornered on the issue, they responded by saying that there had been little negative feedback on the issue -- at least, from anyone who mattered.
In a press conference today, Bush defended his administration's handling of the war on terrorism by saying that they had little negative feedback on the issue. (Possibly because they had suppressed their own report on the issue; outside sources indicate that terrorist activity around the world is four times worse than in the previous year.)
There, three possible responses to the negative feedback defense. Pick your favorite, I need a drink after this.
Sure. Average home users do nothing but write their own protocols using raw sockets.
If i suggested or said that nobody has a use for raw sockets, i misspoke or you misunderstood. The _average_ user only suffers from raw socket support, because it makes thier machine a more desirable target for 0wnage.
for the people that legimately need raw sockets, they're smart enough to figure out how to get them.
"we don't want to admit we were wrong because then those 200 million people would know what really crappy software we sell". If Microsoft made a mistake then fix it.
Well, pick your argument. Should raw sockets be in or out? Was it a mistake to ship it with them in or not?
Our "mistake" was shipping an operating system that suffered from remote root exploits. This mistake, compounded with the need to keep home users running as admin, and also with us shipping a fully functional TCP/IP stack, allows for an unpatched xp machine to easily be turned into a botnet member. That was a big problem for us, our customers, and the internet at large. We can't ship an operating system that does what it needs to do yet has _zero_ security bugs ever discovered over its lifecycle. We don't know how. If you do, or you know somebody that does, we'll hire them. For whatever money they want.
One of the core tenets of security is defense in depth. We know that eventually someone will break into a windows machine. When they get there, we want it to be harder for them to turn it into a botnet drone/zombie. In the future we'll hopefully get away from running-as-admin which will further raise the bar.
Put some of that ill gotten gain to use and fix the problem the "Right Way"
I said we were working on doing just that, and that running as non-admin almost made it into WinXP. Unfortuneately, all those people out there with badly written software (some of it by us, probably) running on windows expect it to still work. We couldn't get everything sorted out in the Windows XP time frame. It's been a source of non-stop work and the story for longhorn will be better but i dont know to what degree (i.e. it may not be all the way fixed).
A kernel that can be patched and have its own hooks intercepted by malicious software is the problem.
Show me a kernel in use on home computers that doesn't suffer from this.
Which department are you in, Public Relations or Marketing?
Testing, actually :) As many defects as you find in MS software, beleive me, there are plenty that never make it to you.
My opinions are my own, and do not necessarily represent those of my employer.
I mean, on other occasions you hear them blather about Windows' totally stellar, fine-grained security architecture, and now they want to prevent Joe Average user from accidentally using raw sockets by, uh, removing the feature altogether?
When you set up proper egress filtering on your network, you make it harder for your network to be used to attack other networks -- at the very least, they can't forge their addresses to appear to come from other ISPs anymore. But it doesn't make your network any less vulnerable to attacks.
Yes, everybody should do it. But since there's no real benefit to doing it beyond knowing that you're doing `the right thing', many ISPs don't do it. Also, doing egress filtering can break a few legitimate applications such as dual homing, requiring some further configuration.
I'm not saying this is right or wrong -- just saying why everybody doesn't do it.
there's nothing to suggest that Linus et al would be able to improve the security of windows while ensuring that it meets its requirements. Linus has enough problem with is own operating system (but can conveniently choose to say all of userland isn't his fault when thats where the vulns are)
In any case, it's funny that you chose linux - arguably the least secure of the modern unixes. I'd have entertained a suggestion of Theo, but he'd fail because im sure his approach would be "the requirements don't matter, this is how i think it should be done", and then half of the crap customers expect would be broken.
I'm not sure how you read my statement about raw socket support being a bad thing for home users, but the point i was making is that they're not using it, so it doesn't help them, and because of the other factors i outlined, it makes thier machines more attractive and more potent for botnet membership.
If its not helping them, and its a risk, then removing it is a good thing, right ?
I don't understand some of your accusations as "bullshit". Are you telling me i'm lying to you? Do you have informatoin that I don't?
I remember the announcement internally that XP home would run with users= admin and being irate about it. Lot's of us were hoping that we'd get it right for xp but the people upstairs couldn't stomach the amount of appcompat breakage it would cause. As it is the amount of custom code in the various versions of windows for 3rd party app support is pretty outlandish. Read raymond chen's blog for a glmipse of what he was doing back in the windows 95 days to help appcompat. Things like this matter when you have 1) an installed base 2) a bunch of 3rd parties making money off your platform 3) binary compat as a requirement. Note that linux has none of these 3 aggrivating factors to deal with. (not anywhere within an order of magnitude of where MS is, at least)
For what it's worth, I agree that our testing, design, and management are all inadequate. We're just human. As an aside, we're hiring. Are you qualified to help, or just to bitch?
My opinions are my own, and do not necessarily represent those of my employer.
Linux is looking better and better everyday, even to our management.