Slashdot Mirror
Hackers, Meet Microsoft
Mz6 writes "The random chatter of several hundred Microsoft engineers filled the cavernous executive briefing center recently at the company's sprawling campus outside Seattle. Within minutes after their meeting was convened, however, the hall became hushed. Hackers had successfully
lured a Windows laptop onto a malicious wireless network. 'It was just silent,' said Stephen Toulouse, a program manager in Microsoft's security unit. 'You couldn't hear anybody breathe.' The demo was part of an extraordinary two days in which outsiders were invited into the heart of the Windows empire for the express purpose of exploiting flaws in Microsoft computing systems. The event, which Microsoft has not publicized, was dubbed 'Blue Hat' -- a reference to the widely known 'Black Hat' security conference, tweaked to reflect Microsoft's corporate color."
... is the corporate color. It's just too easy.
And 3.1 was a black background, but blue graphic.
What were they thinking? "Oh, shit our OS isn't secure?"
The event, which Microsoft has not publicized, was dubbed 'Blue Hat' -- a reference to the widely known 'Black Hat' security conference, tweaked to reflect Microsoft's corporate color.
Must... not... make... obvious... BSOD comment.... aughhh!
To me, it's a far more fitting name.
I mean... what were we going to think... that it was named after the Blue Man Group? That IBM was hacking Microsoft?
But will MS actually do anything?
It seems like Microsoft is showing their own coders how vulnerable their code is, but these are probably the people who already know that best.
From TFA, "... some of the engineers were turning red, becoming obviously angry at the demo hacking incident ..."
I would think they would be looking at their shoes.
...like a Phoenix. Slowly, people are catching on. I mean, this HAD to raise some eyebrows.
It's one thing to read about this on the internet - people say all sorts of things on the internet and you learn to tune it out ater a while.
But seeing it in front of your own very eyes, watching the hack attack commence in the blink of an eye, the pulse of a heartbeat, the shiver of a twitch, the essence of a raindrop, the flash of an instant, with the click of flint before it ignites the gunpowder in a Civil War era cannon-- etc-- it's shocking.
And so, ten years later, after learning from the hackers, their once-sworn enemies, the Great Microsoft rose to became Operating System: NWO. And that, my children, is the story of how Herr Syrs Bill Gates and Al Gore created and patented the internet.
The event, which Microsoft has not publicized, was dubbed 'Blue Hat' -- a reference to the widely known 'Black Hat' security conference, tweaked to reflect Microsoft's corporate color.
Hey, IBM is Mr. Blue! Microsoft is Mr. Pink!
"It's too bad that stupidity isn't painful." - Anton LaVey
So microsoft has what like 50 billion in cash reserves? Why don't they just do a bug bounty and like $50 a bug. Like mozilla did. 50 billion/50 = 1 billion bugs they could find and fix that would hav to make some kind of dent right....................oh wait never mind.
Madre de Dios! Es El Pollo Diablo! -- Captain Blondebeard
M$'s corporate color is blue? Could have sworn it was green.
- Peace
Free as in "the Truth shall set you..."
First, at a company like Microsoft, I'd be asking about the 2 senior managers who didn't know about heap attacks. Second, this whole article is a bit of a puff piece it seems designed to put Microsoft in the best light, "Can't we just all get along?".
Good for Microsoft that they're willing to do this kind of thing... shame on them for waiting until the five years into the 21st Century. While I don't hold much hope Microsoft truly cares about security other than how it affects their public image and bottom line, maybe that kind of pressure will finally be enough to get them to clean up their mess, if only a little bit.
MirrorDot: http://mirrordot.org/stories/b00dd63c5d96524552391 9b313b38ee2/index.html + the+hackers/2009-1002_3-5747813.html?tag=nefd.lede
Coral Cache: http://news.com.com.nyud.net:8090/Microsoft+meets
for for the the first first .com.com .com.com joke! joke! ;-) ;-)
From TFA:
Funny...the Fedora install on my laptop seems fairly customizable and fairly secure all at once...
____
~ |rip/\/\aster /\/\onkey
would be more appropriate than Blue Hat conference.
-- Tigger warning: This post may contain tiggers! --
to have bugs found by hackers rather than by its own employes (that have access to the source code).
Wondering why i am doing so strange posts? I am trying to get a "+5,Flamebait" or "-1,Insightful" rating.
I bet most of the engineers were thinking.. oh cripes.. what if we discover ANOTHER FLAW?
I raise a beer to all salaried software developers who put in long crunchtime hours.
Is it just me, or is this just the usual load of slashdot wank?
From TFA: That shift began in earnest with a well-publicized memo written by Gates on the concept of "trustworthy computing" in 2002. Security had long been a concern at Microsoft, but the issue became imperative after several high-profile attacks exposed the degree of its vulnerabilities.
Sheesh! It's 2005 and there are still unpatched vulnerabilities. Damn hackers, they're always faster than us! (/sarcasm)
How many Red Hat jokes are going to be made now?
Resulted in the BLUE screen of death!
My wife doesn't listen to me either...
You know that picture is almost on-topic.
So what? Maybe they read some document informing them of what a heap overflow is. It's more important that these managers understand what goes into the code and the technical details that make the system operate, not what an "obscure" problem like a heap overflow is. Microsoft's managers can only claim technical know how if they have experience working as developers, because otherwise it's simply too hard to understand the real issues that the engineers have to face.
Black hats do black magic
Blue hats do blue screens of death
Wondering why i am doing so strange posts? I am trying to get a "+5,Flamebait" or "-1,Insightful" rating.
In my best Nelson voice
Blue is the color you get when your depressed, If I had to work there as security programmer, I would be blue too... knowing that the next scriptkiddie would cost me my job..
:)
Also remember, it's not Blue Screen O Death, it's Blue Screen Of Job Security for people who have to support it
Programmers actually thought that their code could not be exploited. I don't know if this is collective arrogance or part of the MS culture, but it seems most of the world outside of MS knows how easily code in general can be exploited. With as many security problems MS has had and Bill Gates many public proclaims about security, you would think that they would know there may still be issues in their code.
Well, there's spam egg sausage and spam, that's not got much spam in it.
Matt Thomlinson, whose job it is to help make Microsoft engineers create more secure code, noticed that some of the engineers were turning red, becoming obviously angry at the demo hacking incident.
To me, this is very telling about those engineers' beliefs and attitudes about their own code. It also speaks volumes about their skill (and their personal belief about their own skill levels).
Real engineers fix problems, they don't get emotional.
Microsoft has managed to link itself with bad code to a degree that, recently, I spent over 40 minutes convincing a programming team that Code Complete was actually a good book and did not reflect the bad quality of Microsoft software.
Broken Hearts are for Assholes. - Frank Zappa
Green Hat
Rock that crushes, Paper & Scissors that don't matter.
From TFA...
The unusual March gathering, a summit of sorts between delegates of the hacking community and their primary corporate target...
We're in what, mid June now? Slashdot: "olds" and recycled duplicate articles for nerds, I guess...
Still it's nice to know that Microsoft at least acknowledges that there is a problem they aren't addressing properly.
Seven puppies were harmed during the making of this post.
fta: Nevertheless, he understands why not all Microsoft developers were satisfied with the explanation.
"I'm also sure Ford wasn't too happy with (Ralph) Nader's reports in the late '60s," he said. "What do you mean you are telling people our cars can blow up?"
I wonder if Bill actually laughed the first time he read the microsoft car joke?
liqbase
fail fail it it.
"We have conversations where we say an attacker might do this or an attacker might do that. Now there is a face to some of those guys," Anderson said. "They were just as much geeks as we were."
So you mean to tell me, that Microsoft employs *no* hackers of any hat or has ever known one? They make it seem like it was the first Thanksgiving all over again. Puh-leaase.
Today's lesson is: Hire hackers if you want to build a secure OS.
I remember when Windows 95 came out, with its weak, obviously-an-afterthought "web browser" (IE 3.0). It was painfully obvious that Microsoft had missed the Internet boat, and shortly thereafter, Bill Gates sent his historic all-hands memo pointing the company in the direction of the Internet.
It took them some time to get it right, but eventually IE took over. Now, you'd have a hard time finding a Microsoft product more complex than Minesweeper or calc.exe that doesn't connect to the Net somehow. And let's not forget that Netscape provided Microsoft with some much-appreciated help in taking over the Web, by screwing up their own release schedule so badly that there never was a Netscape 5.0.
Flash-forward to a couple of years ago, when Bill sent out yet another all-hands memo, pointing the company in the direction of security. At first, we all laughed. But now it's becoming more and more obvious that they're taking security every bit as seriously as they once took the Internet. They are aiming to be the top of the heap in security, and they've got drive, ambition and aggression.
Make no mistake, this kind of event is exactly what a company that wants to get secure should be doing. Thomlinson's comments about how seeing their code exploited "hits people in the gut", and the fact that "he was glad to see the crowd of engineers taking things personally" -- these things are right on the money. These things say to me that, within a few years, we're going to see some really damn secure stuff coming out of Microsoft.
In the meantime, Firefox exploits are cropping up at a seemingly greater pace. This worries me. It looks like a repeat of 1997, when Netscape lost huge amounts of ground to IE by producing a product that wasn't as good as the competition. SP2 wa s huge leap forward in security for Windows and for IE, and Blue Hat makes it obvious that Microsoft is just going to get better at it. In the meantime, Firefox appears to be standing still on the security front, or maybe even losing a little ground. Sure, it's still miles ahead of IE's security, but if IE keeps up the pace, it will overtake Firefox sooner or later -- probably sooner.
Is there any way the Firefox development team (and the OO.o team, and anyone else who's working on high-profile F/OSS projects) can take a lesson from Blue hat? Can we get together events like this of our own?
If we don't, I can already see that by 2009 or so, at the latest, I'll be telling clients to go with Microsoft products, because they're more secure than F/OSS. And I don't want to see that happen.
Kai MacTane: Web developer for hire in San Francisco
First they show that (shock!) Windows is insecure, and then after much "deliberation" they will throw their hands up in the air, declare "computers" and "The Internet" to be insecure, and use that as a ploy to get Trusted Computing made mandatory by government.
I firmly believe they allow the virus and spyware problem to happen for this very reason.
In my previous company I tried to communicate with engineers. I was an engineer, but it's still damned hard. Programmers just don't "get it" without hard work. In the end, this kind of smack-in-the-face-by-the-real-world approach is what is needed.
I reckon it's because so many programmers have at least a touch of Asperger's. The number of times I'd try to explain that customers behave like monkeys, focusing on the wrong things, buying products for the wrong reasons. But these reasons aren't "wrong" if it means the difference between selling a product and not selling a product. That yes, it's "wrong" to buy a product because we've used Times Roman screenfonts but the competitor used Tahoma, but just change the goddamn font, OK?
Reminds me of the story about 1-Click from Amazon. After patiently explaining what he wanted, the developers all nodded and said, yes, they can do 1-click. A few weeks later the prototype is ready and Bezos tries it out. He clicks on a book. And up pops a dialog box that says "Are you sure?"..
Read about this in Cooper's book "The Inmates Are Running The Asylum."
K.
I find it is interesting that a company with record cash in hand and well documented employee benefits would not have their own 'blue hat team' on staff. I mean, why invite outsiders in to reveal the exploits? Surely MS can afford an elite team of their own...especially when 1/3 of the R&D budget is going to security matters.
HOW did they 'lure'?
popping bug?
spinner?
midge?
golden antenna?
it's a radio for crying out loud.
" Dan Kaminsky: Dan Kaminsky's recent research includes looking at the limitations of hashing algorithms, as well as the potential for sending large files via the Internet's Domain Name System. He is currently doing work for Avaya. "
what's this DNS large files business?
been tunneling port 53 for ages. because the port 53 is open prior to subscribing with many cable companies it'll get you a link for free
I'm glad your parents decided to fuck without birth control. Truly you are one of humanity's greatest accomplishments.
PS: You're a fag.
Sheesh! It's 2005 and there are still unpatched vulnerabilities. Damn hackers, they're always faster than us! (/sarcasm)
... today.
... right?
Heck, they just released a bug fix for an IE bug that was already fixed, put back in by mistake (since it was still in IE), and refixed in Firefox
Wow, it's like watching paint dry.
Luckily for them hackers just go away on vacation in the intervening years between bug fixes
-- Tigger warning: This post may contain tiggers! --
I'm banking that I'm the first one to say this, and that there are at least a few reasonable moderators out there.
This represents a step in the right direction for Microsoft. Perhaps as a community we need to face the possibility that they may be changing. I read the entire article, and it seemed as if Microsoft genuinely wanted to change. I run Linux, and so do a lot of you, so it is understandable when a lot of you will deride Windows no matter what because it represents a competitor. I just don't buy into that philosophy, it doesn't hold much room for fair.
Giant Anti-Spyware, IE 7, and the anti-vrus acquisitions are all good indications. Let us just hope, for the internet and personal computing's sake, that Microsoft doesn't blow it and charge for them. Either that, or blows it so hard their customers (corporate and power user home) all look for more stable operating systems (hint: all other consumer desktops of any note run a Unix derivative of one sort or another).
That technique is
a) old news
b) not Microsoft specific.
Linux and OSX can also be tricked into connecting to a rogue access point.
Whichever access point is most powerful, or higher priority will be connected to.
The only shocking thing about the article is that the engineers havent seen/heard/tried this before.
"It was just silent," said Stephen Toulouse, a program manager in Microsoft's security unit. "You couldn't hear anybody breathe."
And then some guy in the back stands up and starts yelling "Developers! Developers! Developers..."
As maturity is sorely lacking in the poster.
Makes me think of that scene in The Killing Fields when you would confess your sins to the uncle they would put that colored plastic bag over your head and dump you the second they were through with you. Those that help the enemy secure their product are traitors and should be the first against the wall when the inevitable Linux desktop revolution occurs. We should think now, long and hard as to what technology we will be using to maintain our traitor's list or MS might just get the jump on us. It will be ironic if we are forced to use a feature-rich MS product to maintain our MS traitors list.
The second day drew about 400 rank-and-file Windows engineers, including people who don't necessarily focus on security features in their day-to-day work.
"Don't necessarily focus on security features"? If this is just the reporter making up his own description it's not so bad. But if he's just echoing what he was told by Microsoft or whoever his source was, then they're looking at this backward and probably have been for a long time.
Anyone who touches that code for any reason at all has to keep security in mind every time he does it. It doesn't matter if he's responsible for authentication or whatever else they're including under the rubric of "security features". Any bit of code is a potential vulnerability. It only takes one buffer overflow, one set of bounds that's not checked, one line of code that doesn't validate the terminator on an input text string, to create one. And then it's a security problem for everybody. If making non "security feature" programmers aware of these issues is a new thing at MS, they've been doing this all wrong for years. (As many have suspected, but seeing it possibly confirmed is still a bit of a shock.)
And the brethren went away edified.
Can people write, or the editors make sure that article summaries are just that, not cut and pasted paragraphs from the article? The posting makes it look like Mz6 wrote those paragraphs which is only true if she's Ina Fried .
Unless Microsoft uses NO wireless on its campus or unless the walls were RF shielded, this was a very dangerous stunt. If a hacker can gain access to a Windows machine via wireless (and they can according to this account), then they would be able to (and might have) accessed wireless networks outside the meeting room but inside the corporate firewall. Range is no protection as it would be not hard to build a high-gain antenna into the lid of a hacker's laptop and orient it to pickup WiFi elsewhere on the Microsoft campus. If a hacker can gain access to an inside machine, they could plant a backdoor for later exploits including attacks on the the company's codebase.
I'm not a shareholder or a user of their products (except to the extent that the vast majority of the companies I do business with use Microsoft) but I find this an extremely irresponsible act on the company's part. If they want to try this sort of security testing, and they should, it should be done off-site or in a shielded room.
Two wrongs don't make a right, but three lefts do.
1. When the "in" tray has more paper in it than the "out" tray.
2. When you have to get up and clean out your pants because:
A. It's bothering your hemmoroids.
B. Your fellow employees are making odor
comparisons to themselves.
C. The head honcho of the IT department wants date you, and asks you if you are int "felching".
Open Source software is not bulletproof. It suffers from security defects as well. The big difference, however, is we're up front and honest about it. Microsoft can't afford to be that way, as they rely on customer confidence and their monopoly to stay in business.
Microsoft seems to be understanding that their real problem in improving security is people, not so much the technology. By letting the "bad guys" knock the bricks down in front of the programmers who build the stuff, it ouggta sink in pretty deep.
Fix the attitude among the developers and the technical stuff will probably follow. Too bad a lot of slashdotters aren't able to experience the same thing.
Ruby on Rails Screencast
Time for the security guys to SMACK some sense into those MS Engineers! Go Man Go! Your system is like Swiss Cheese and you really really need to freaking fix it! This BlueHat event is literally a smackdown to wake the MS engineers and management up to just how bad it really is. It is critical for the MS Engineers to get shaken out of their MS Corporate boots and have their eyes opened to the truth. Seeing you most recent work getting compromised in seconds must have driven some of these guys completely bonkers!
The invited security experts are familiar with all kinds of expliots even at the latest patch release. However, the really smart ones are not working security for a living they are doing International Corporate Espionage where you don't publish what you find, you use it over and over and guard it as secret so you can get paid as you steal IP from one company and sell to another.
Personally, I don't believe that MS will be able to fix Windows unless they go through a complete rewrite, that means beyond Longhorn before they get it right. They can continue to bandaid it or they can start over and design the way OpenBSD designs. Include security regression testing into their milestone workflow. While they are re-doing things they can also fix all the other broken crap that needs fixin!
It's one thing to be passionate about your work and another to get angry at someone who criticizes your work. A professional cares more about doing a good job than about protecting their egos. And if you want to do a good job you need to seek out ways to find errors in your work... getting angry is counterproductive to such an endeavor.
There are 10 types of people in this world, those who can count in binary and those who can't.
...on "security"
uh huh
think about what that sort of cash would do to help out open software in general terms, all the various neato projects done with a few dollars and a lot of skull sweat. Think about if only a fraction of that went to linux kernel development, say something small, like 100 million dollars, 1/20th of what MS spends on "security research"
I am just amazed at this,it is just a staggering sum for those products and their "security features".
It's good to see this. Credit to Microsoft for really trying. Not to be too kind to Microsoft, however, I think it is a lost cause to try and make Windows reasonably secure. Security is tough enough when you design for it from the start. Tacking security on never works. You reach a point where a fix in one place just creates a security hole somewhere else. But I guess it's better than doing nothing at all.
The NSA: The only part of the US government that actually listens.
I did security work for Microsoft several years ago. They had an internal hacking team that was pretty good. We had people in my group that were pretty good. The head of security for MSN was very good. People knew security.
However, every time I tried to push through a security fix or privacy issue, it was an uphill battle. I had to convince a PM that there was a problem, research had to be done about it, pre-production testing would have to happen, and finally a production release. Lots of the time, if there wasn't a remote execution class vulnerability, I couldn't get a fix pushed through.
The problem really became that the number of products were so diverse that any security fix at the OS level would stop some other application from working. For instance, completely turning off the null-session vulnerability in Windows 2000 SP1 by setting RestrictAnonymous to 2 on the domain controller would make Pre-SP1 Exchange stop working. Things like that made it impossible to get a good grip on the security stance.
And of course, that was just the tip of the iceberg. Add in that the security people in Windows didn't talk to the Exchange team didn't talk to the IE team didn't talk to the IIS team, and you got a nightmare. Between no cohesive communications and the general apathy/resistance to fixing things due to the political and resource minefield, I was usually unable to do my job and finally gave up.
WTF is up with calling programmers engineers now? The term 'engineer' is regulated in all 50 states, and calling yourself an engineer without being licensed is worthy of a fine. There are some exceptions, but these vary from state to state, making it best to completely drop the title 'engineer' unless you're actually licensed in the state you're advertising in.
The best way to accelerate a windows box is at 9.8 meters per second square.
Actually that's helpful: show how something is flawed = show how it can be improved (constructive criticism). Fix that flaw, and you have a better product than before.
As opposed to "hey it sucks, because it's <xyz>", which provides no hints on how things could be improved (well, other than removing <xyz> from the equation, if that is what makes it suck).
It's just how you look at it. Any good coder (or vendor) shouldn't be afraid to take constructive criticism. In case you see me fuck up: tell me, and be sure to include details, so I can do a better job next time.
--He who asks is a fool for five minutes, but he who does not ask remains a fool forever.Yeah...M$ MEANT for that to happen. Here's the real story:
M$ Exec 1: "Oh sh*t!!! We've got a security problem. One of our computers has been lured to a baaaaad network"
M$ Exec 2: "Crap. Wait, I know. Get MarComm on the phone. We'll tell the world we were running a test. We're finding flaws so we can fix them. Yeah, that's the ticket."
M$ Exec 1: "Good thinking! Maybe we should tell them to also release a statement that the BSOD is actually Microsoft's commitment to employee health. A soothing blue screen comes up, gently reminding employees to get up, stretch their legs, refocus their eyes..."
"He uses statistics as a drunken man uses lampposts...for support rather than illumination." - Andrew Lang
About your sig: Wondering why i am doing so strange posts? I am trying to get a "+5,Flamebait" or "-1,Insightful" rating.
How about (Score: 1, Troll)?
It must be Windows. It needs half a gig of RAM and a hardware-accelerated graphics card just to run Solitaire.
+5, Overrated is much more funny.
Sig
It's not about creating a customer base anymore, that was the old company mission. Now they have all the customers, and they need to keep them. Aggressive business tactics only get you so far. Now Microsoft has to do what the customers want or they'll lose them to some new "Microsoft" up-start (like Google).
Here's one of the most insightful, yet scariest quotes from the article:
MS has seen that it's possible for there to be a secure and customizable end-user OS (MacOS X, Linux, etc), so much as they might like to, they can't attack the problem by taking customizability away from the user. Hence workshops like these.
I think that some other posters have it right when they compare the current security effort with the rise of IE in the late 90's. Sleeping giants and all that.
Causation can cause correlation
Wher thrs musc, thrs ppl.
Free Hans!
1) The right way
2) The wrong way
3) The Max Power way*
* same as the wrong way, only faster
Homer J. Simpson
Remember Microsoft declaring Bug Month?
http://slashdot.org/article.pl?sid=02/02/02/20122
"We are not coding new code as of today for the next month." Richard Purcell, director of the Microsoft's corporate computing office. That was February 2002.
The big shock for me was actually getting contacted by a Microsoft engineer requesting more information on a particularly bad CSS issue in IE6. I hadn't believed Bug Month was anything but PR till that point.
Then nothing got fixed. It's three years later and zero IE6 CSS flaws have been fixed. Zero.
There's no reason to expect better this time.
I'll bet their wireless network is outside their firewall and they use a (I bet MS) VPN client to connect back in to their corporate LAN.
-ac
(a) they probably had names and address of everyone who showed up. any weird post-demo problems -> send FBI.
Perhaps. But if someone gets Longhorn's source code and creates exploits for its launch in late 2006, will anyone remember to check the list of March 2005 attendees. Also a suitably documented attendee could easily pass information to an undocumented outside hacker.
(b) you don't need to be on-site to attack a wifi installation. a top-quality directional antenna will work from a few miles away.
Very true (what a very unpleasant thought). Yet attacking from the outside is harder because of the longer distance, metal in the buildings, and clutter of WiFi cells in a large campus. In contrast, being in an executive conference room probably puts the hacker in close proximity to wireless networks for top executives at the company. A keyboard logger on Allchin's or Gates' laptop would be far more damaging.
(c) what's wrong with you, don't you *want* microsoft to fail?!?
Absolutely. I'm just concerned with the failure mode. If people just stop buying Microsoft products, that's great. But if hackers find a way to pull data out my bank's databases then i will not be so happy. Loss of market-share is fine, a catastrophic breach of commercial and government systems would be very very bad.
Two wrongs don't make a right, but three lefts do.
Microsoft is Mr. Shit :)
"We have conversations where we say an attacker might do this or an attacker might do that. Now there is a face to some of those guys," Anderson said. "They were just as much geeks as we were."
Maybe its just me, but I would assume these guys would actually have spent time securing their own computers, dealing with spyware and warms, etc. Maybe even attempting to hack their own computers to test it. More so, do they not keep up on the latest techie news given that they are geeks?
Maybe if all MS programmers signed up to receive slashdot digests every day and took the time to read the articles and comments, they would learn from others' experiences with MS products and use those critiques to improve their products.
Do these people live in a hole or something?
that most hackers had already met microsoft.
maybe i missed something, but what does connecting to a malicious network have to do with an operating system? could os x have connected to the same wireless network? how about linux? this is as much an os flaw as 'click yes to install spyware'
user idiocy is not an os flaw. end of story.
Wave upon wave of demented avengers March cheerfully out of obscurity into the dream
Why? Because it took them sooo long to break it?
A few minutes?
Must have been a slow laptop...
Allchin's name has become largely synonymous with the Windows operating system he oversees.
The fallguy has a name!
I had the problem of the network connection regularly disabling itself and re-enabling itself. Turns out this is well documented on the internet but denied as an issue at Microsoft. Disable the zero wireless configuration service and it stops doing that.
However, occasionally it refuses to connect to the preferred network after a reboot. It will show that the network is not connected. I tell it to connect and it will try connecting to the network. It gives the "repairing your network connection" while it looks. I have a normal connection while it's looking, but when it gives up I have no more connection.
Other times, especially after a power flash, I'll notice that I'm connected to my neighbor's open wireless connection. Windows loves to connect to any random connection it can find.
I'll reconnect to my wireless network and it will show "NOT CONNECTED - You are connected to this network." Well... which is it?
I haven't found a way to stop Windows XP to connecting to any random network connection it finds. I swear I dated a girl like that once.
78% got bored and quit on 1st day. Do you have enough coffee?
:-)
(A bit like Ford only recalling models of car where the cruise control causes it to explode, whether or not it is faulty in other models. This is an actual story running on CNN at the moment, believe it or not.)
The correct way to fix security holes is to identify them first. Waiting until afterwards is a bit like a bank waiting until it gets robbed to see if the security system works. By that time, it's a little late, as everything stealable has gone.
Of course, it should not be assumed that the "correct" way is easy, or even practical for something the size of MS Windows. However, the engineers should be aiming for as close to that solution as they can.
When Windows 2000 was released, there were 65,535 known bugs in their database, according to statements made at the time. These bugs had been identified, classified and filed. It is impossible to tell, outside of Microsoft, how many of these were security issues. However, I think it goes without saying that any that were should damn well have been fixed before release. Here, we are not talking about unknown, unidentified flaws - all of the really hard work had already been done. Fixing the bugs would have been easy, at that point.
You can't fix what you don't know, but when you DO know and don't fix anyway, then it is not unreasonable for people to get upset.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
fuck the dumb shits!
I know I do when mr. big-wig CIO at my work asks me to do security audits, although he usually fails to address the issues I raise, mainly to cover his own dumb ass for integrating a windows server environment in the 1st place. .NET? .NOT!
the only permanence in existence, is the impermanence of existence.
See a wireless networking antenna.....
Turn off Laptop for safety!!!
I've seen a few posts already that are saying Microsoft is getting better. They fail to see the pattern here. Microsoft makes a product, consumers cry and whine, Microsoft fixes it in 5 or so years, happy-happy-joy-joy until...OH another problem. It was the same then, and it'll be the same now and onward with Microsoft. They don't actively work to solve problems before an outcry, they wait for the outcry. This is responsive thinking, and I don't like it one bit. I want a forward thinking company behind the software I use. A company that doesn't just wait until everyone hates their software before fixing it. Let me quote the article "'It kind of hits people up here,' Thomlinson said, pointing to his head. 'Things are different when a group of programmers watches their actual code exploited. It kind of hits people in the gut.'" Wait...where are you? A Microsoft run event? WOW! Maybe just MICROSOFT programmers are doing this... I don't want someone who acts like this making the software I use/buy. Someone who refuses to believe thier software is broken until they see it. HELLO!! The millions of people being infected as a result of unpatched issues in your software should have been clue enough. "Oh hey, our software really can be exploited! Man...that sucks...think we should do something about it?"
The one thing we do know from the Netscape vs IE war is that when Microsoft puts it mind to it, they are capable of working miracles. The same story goes for the WinCE vs Palm OS war. So I am quite confident that Microsoft will evenually be able to deliver it promise of "secure computing environment".
Maybe Microsoft will have to take some drastic changes to the OS to get there, but then Apple had to do the same to get where they are today with OSX.
In the spirit of full disclosure, I run both WinXP and MAC OSX at home, and own MSFT stock :)
Denial is not a river in Egypt
"Hackers, Meet Microsoft"
Oh, I see you're already well-aquanited!
"There is more worth loving than we have strength to love." - Brian Jay Stanley
She also wrote the article from the Apple Making a Spreadsheet? story just three entries down from this one on the /. main page -- congrats!
TFA:"That shift began in earnest with a well-publicized memo written by Gates on the concept of "trustworthy computing" in 2002. Security had long been a concern at Microsoft, but the issue became imperative after several high-profile attacks exposed the degree of its vulnerabilities." If getting a more secure "out of the box" system means getting trusted computing along with it I would rather secure Windows myself.
OK, so how come we think of IBM as being "Big Blue" and not Microsoft if blue is Microsoft's corporate color? Come to think of it, the only blue that I know of that associated with Microsoft occurs when the OS takes a dump..........
It's really sad that they had several hundred engineers sitting around, getting taught lessons like this. 99% of the so-called hackers out there really aren't that great. And it's unlikely anything earthshattering here was used.
I find it truly surprising that not one single Microsoft Engineer could take it upon himself to discover these flaws beforehand. And that they were surprised by these results.
That tells me a lot about the Engineering talent. Hopefully some small change has been made in the mindset there. It would at least be a good small start; because one key thing about improving security is the mindset.
The best way to predict the future is to create it. - Peter Drucker.
Is that like Blue Hat of Death?
Heroscape, it's like legos combined with anachronistic wargames.
Same as with default admin rights arguments:
It is designed with ease of use in mind."Wireless has always been such a pain, but now even a child can compromise...err connect to your laptop and extort...err ummm allow you to surf the web with little to no patching...errr uh, configuration."
Sure, Microsoft is moving in the right direction; however, I would call it more of a shove than a move. Microsoft's not doing the pushing in this case, which makes it so hard to understand without some context.
Microsoft has become synonymous with bad software. Why else would a company as powerful as Microsoft become so desparate as pull off this latest stunt?
This story includes:
1. Uncooperative Black Hats that somehow manage to cooperate with Microsoft to assist in securing the OS, yet remain blacker than india ink.
2. Wiley engineers that manage to out-think the black hat by applying a token of common sense (the off switch).
3. Engineers that become one with the enemy to make a better product for us.
4. Flat out admittance that Microsoft makes a security challenged product, but will do much better because they've been shown that it can be compromised.
5. Direct quotes from Microsoft insiders, implying that press was standing by.
6. A specific agenda of diffusing the security issue by admitting it, then appealing to Microsoft's software genius as having the solution in hand (now that they know what the problem is).
Basically, the article can be summarized:
Microsoft didn't know that Windows XP has problems, but now that someone has shown them, they'll get right on fixing those issues.
Which is nearly the same spin we've been hearing since they first added networking to Win98.
Excerpted for your amusement; pay careful attention and watch to see what deep technical know-how Allchin actually demonstrates beyond "nodding knowingly" (honestly, the guy probably knows what MD5 is, but he comes across as pretty silly here in spite of the praise he's getting).
As we used to say in the Army: Good training!
Ronald said nothing. He flung himself from the room, flung himself upon his horse, and rode madly off in all directions.
I don't believe this, it is 3yrs since XP the all holy mother comes out after thousands, ney 10s of thousands, ney hundreds of thousands of exploits have passed there doors as "to do" lists. And now they are finally "taking this thing seriously"
:)
It's damn good they don't build spaceships... everyone would have a Shuttle in their back yard, or at least a big hunk of metal that use-ta be one
I'm not saying that they are not trying, it's that they take their own sweet time, but expect other to respond immediately. "Firefox is broke, na na na nya" Fix your shit Bitch, then come and beg us to test it.
Inovation - doesn't look worth a damn, but when it does it'll do this, and this, and this... and look how shiny it is!!!
A computer once beat me at chess, but it was no match for me at kick boxing. Emo Philips
How long do you think it took Windows to reach the state its in now? If you looking at just the major changes there have been a LOT compared to other software. (Windows 95, 98, 2000, XP, not counting updates, ME, or versions older than 95 and the unreleased Longhorn). Has there EVER been a major serious of software changes in history on this scale? The answer is a simple, no way.
Throw in the fact that nearly 90-something% of all computer software is designed to fit into a Windows environment, the billions of users who have accustomed themselves to Windows' own quirks and the ever present threat of losing marketshare to Apple or Linux and what you're asking is impossible. There is no magical development wand that can be waved and all of Microsoft's problems would be solved. This isn't a Linux project where every user personally works on and personally customizes their OS either. The most obvious solution for Windows to take is simple, 'if it isn't broken (enough), don't fix it (yet)'
Okay, so now we've got black hat crackers, white hat and grey hat security people, a Blue Hat security conference, a Red Hat distro, and of course the Man in the Yellow Hat. What next?
Oh, and I thought IBM was Big Blue. Microsoft's logos have the four colors (red, green, yellow, and blue), last I checked. Does that mean we're going to have Green Hats next?
Cut that out, or I will ship you to Norilsk in a box.
The funny thing is that the underlying motivation for most of the snide, derrogatory comments made to this thread is, "Please, please, don't let Microsoft improve its security!"
You guys are scared too death that Microsoft will kill off your security argument just like they did the stability argument. All of the negative posts regarding Blue Hat, the comments that it'll do no good, the assertions that only a complete rewrite from scratch will work, blah blah blah, are nothing more than wishful thinking. Many here hope, wish, and even pray for Windows to remain vulnerable, and it's clouding your thinking. Blue Hat (and other measures taken by Microsoft) is a good thing, and many of you just can't stand it. LOL
-- "I never gave these stories much credence." - HAL 9000
Comment removed based on user account deletion
Pixar recruited Brad Bird because they were "worried about becoming complacent".
We have made all the money we could out of PC market, so there is no reason to keep the market alive. Let's move to something new that be can exploited".
"The ability to customize our computers is under attack from those who are customizing it against our will."
We will never be able to enforce content-protection measures if people expect to be able to tweak their computers as they please. So better start teaching everybody that a computer is just a sealed box to perform specific tasks, an electronic appliance not differen from VCR, cellphones and playstations. The more people accept that, the more easy will be for us to use their computers for our own purposes.
Ciao
----
FB
"During a recent talk in Redmond, security researcher Dan Kaminsky wasn't sure how geeky to get. After all, he was talking to a bunch of executives on the first day of Blue Hat, not Microsoft's rank-and-file engineers. So he kept his comments brief when it came to a flaw in something called MD5--a "hashing" algorithm, or a kind of fingerprint used to authenticate documents. He figured it was probably too esoteric for his audience. The rest of his presentation was focused on a different security topic. But when it came time for questions, "this one guy with a shock of white hair looks straight at me and just says, 'MD5.'" Kaminsky, who said the comment seemed more like an order than a request for information, complied by demonstrating how two Web pages could have the same "hash," as the man listened and nodded knowingly. A week later, Kaminsky learned that his interrogator was Jim Allchin--one of the highest-ranking executives at Microsoft and, as the person in charge of the Windows operating system, one of the leaders in the technology industry as a whole. Allchin's questions made clear just how deep the technical knowledge runs among the most senior ranks of the world's biggest software company. The brief encounter made a lasting impression on Kaminsky. "I was like, 'Who was that guy?'" he said. --Ina Fried "
Knowing about MD5 means...
"Allchin's questions made clear just how deep the technical knowledge runs among the most senior ranks of the world's biggest software company."
WTF ?
Read "Competing on Internet Time: Lessons from Netscape and Its Battle with Microsoft"
You'll find Netscape managed to screw it up by themselves (OK so perhaps the pressure from MS didn't help)
Why do you think the Mozilla team threw the Netscape codebase in the trash can - because it was good?
"the company now spends $2 billion a year--more than a third of its research budget--on security-related issues."
Richard Steven Hack - This sig is TOO GODDAMN SHORT TO DO ANYTHING USEFUL WITH! MORONS!
Back in the early eighties, I used to work on Prestel software (a sort of proprietary forerunner of the web). The software worked by having a large number of processes running on the system, each of which handled one function of the service - i.e. process per function rather than process per user. Each logged-on user was allocated a chunk of memory (about 1k) which was then passed from process to process to handle the user's requests. If one process had a bug and failed to hand on the memory chunk then the user saw the system enter a state where it just failed to respond and the symptom was known as a "stuck port".
The trouble was, just about *any* code error would result in this symptom. My immediate manager had latched on to the term and every time it was reported would say, "Ah! We've had this before haven't we? So you know how to fix it.", or "I thought you said you'd fixed this one?" He didn't seem able to comprehend that it was a common symptom of dozens of totally different bugs.
A little knowledge can be a dangerous thing.
John
"easy remote administration!"
-- it's ridiculous how many people misspell ridiculous... (damn, damn, damn...)
If you haven't played Magic: The Gathering, here's an explanation of colours:
:)
- White. The magic of the Light and all good-hearted beings. Obviously has a "dark" side: fanatism, zealots, etc.
- Green. The magic of Life. You know, druids, nature powers and beasts... but Nature can go "out of control" too. Tsunamis, earthquakes...
- Black. The magic of Death. No further explanation needed here
- Red. The magic of War. Associated with fire too. Fireballs, powerful warriors, blood everywhere...
- Blue. The magic of Mind. You know: telepathy, telekinesis, mind control... oh wait! did I say MIND CONTROL? Run!!!!
(And yep, blue and red are natural enemy colours there, like black and white)
"At first, we all laughed."2 /
Sorry, I'm still laughing. Security still has less priority than marketing at MS. That's why you see all those services still switched on by default in SP2:
http://www.theregister.co.uk/2004/09/17/xphome_sp
"Firefox exploits are cropping up at a seemingly greater pace."
Maybe you ment to say security hole rather than exploit?
Firefox get's much more press when a minor security hole is discovered (something that is very hard to actually exploit), because there is an expectaion that Firefox is flawless.
Meanwhile, IE averages about a dozen critical security holes every year and no one says anything.
At one point, researcher Matt Conover was talking about a fairly obscure type of problem called a "heap overflow." When he asked the crowd, made up mostly of vice presidents, whether they knew about this type of issue, 18 of 20 hands went up.
It would have been interesting to have had those 18 write a brief explanation on what a heap overflow was.
"We are all geniuses when we dream"
- E.M. Cioran
I met a MS mid level manager on a flight around '01 and we got to talking. I said "I think the biggest challenge MS will have in the coming years is security" He looked at me like I had two heads. Oh I would love to talk to him now, and see what he has to say.
"Hackers had successfully lured a Windows laptop onto a malicious wireless network."
You mean they just turned the laptop on?
Was the whole thing staged?
The article mentions that it was a demo of sorts, so it wasn't like this was a surprise. Well, maybe not to the organizers.
clearly there is probably little way that any of the "real" black hatter's were there. So if a bunch of GreyHat types were able to do it, what would one have to assume about the "real bad guys" , as M$ would describe them , and how fast they could do it?
"God of Rock, thank you for this chance to kick ass. "
Currently Dividends paid are taxed at a maximum of 15% no matter how much money you make. Regular income can be taxed at anywhere from 10% - 35% depending on the amount of taxable income you generate each year. That doesn't mention state income tax if your state charges it.
Generation Trance: What generation are you?
Remember this?
More details here.
And here.
And is it still a viable attack even for WinXP? (I hear they're replacing the Win32 API for Longhorn, so maybe it won't be a problem there...)
I figured after I finished up my Engineering degree that I'd jump through the hoops so I could call myself a Professional Engineer, but it was pretty silly. I took the first test, and passed, which I think makes me an EIT (it's been a while). But there simply wasn't a test at the time for software engineers. You could take your choice of test from any of the other engineering disciplines, but does it really help certify you as a Computer Engineer to take a Chemical Engineering or Mechanical Engineering test? I think I took ME. Does anybody know if this has actually changed? I'm not about to take the second half of the exam without some sort of reasonable test that is actually applicable to software engineering.
It seems like the single most prevalent fallacy in online debate today is calling "fallacy" when there isn't one. Ad hominem is a fallacy of irrelevance; it is only a fallacy when it is irrelevant.
If a person is claiming to be an expert, and it can be shown that they are not, that person's "expert" testimony is invalidated. Calling a debator on the appeal to false authority fallacy is a perfectly valid tactic, and in fact extremely important for the proliferation of well-vetted ideas. That is what was done here; K. said, essentially, "a majority of engineers are not qualified to make marketing-related design decisions." Debate this if you will. Don't call it an attack, because it isn't; and if you can't see the difference, then you're not qualified to debate anything in the first place (note the conditional on this statement, and apply it to itself).
Even if the false authority and the debator happen to be the same person, by the way, this does not make the statement "you haven't got the foggiest clue what you're talking about" an ad hominem fallacy if it is based on demonstrable grounds.
I haven't felt the need to be this anal with terminology since college. Clearly I should read Slashdot more often: it keeps me on my toes.
I saw that once on some Star Trek spinoff.
"The security faults we are seeing could end up bringing an end to the era of personal computing," Kaminsky said.
... the era of computing isn't going to die. Windows might ... but only if they never fix any of these issues. And it seems like they're trying hard to.
Probably not. If it gets to the point where personal computing might just die, people will just move to something else that doesn't have the problems. Be that Solaris, Linux, BSD, OS X, BeOS, whatever
Lack of eloquence does not denote lack of intelligence, though they often coincide.
"Are you familiar with memory overflow exploitation?"
O_O SHIT Bob, you'd better raise your goddamn hand. You're the chief security developer on over fifteen projects.
"but I don't..... " DAMMIT Bob, just pretend there's a taco floating over your head!
"mmm yo quiero taco bell"
That's too little, too late. It's treating security as a feature that if broken causes the product to be delayed or scrapped.
Yes, I'm aware of code reviews, and the open-within-Microsoft source code for the OS. That's all good, but it's not enough.If you think pushing back a broken product for security flaws is long-term thinking, then you're part of the problem. That's just anticipating what the market will do with a product that doesn't work.
Microsoft is doomed to write insecure software because they're trying to keep their source code a secret. Yeah, they might make more money that way. But the only way to make sure your software is secure is to let people with no interest in its success see its code.
Raise your children as if you were teaching them to raise your grandchildren, because you are.
...but have zero urge to swap semen with them, muddy my dipstick, fence with pork swords or stick my tongue down their, er, throat.
After seeing what deRaadt had to say about Linux, and reading a bit about OpenBSD and security, they'll probably base Shorthorn's successor on that and code name it Mammoth (ie the longest horns ever).
Little realising, of course, that the least secure pieces of ShortHorn weren't the ones they replaced with OpenBSD code.
Got time? Spend some of it coding or testing
For fuck's sake.
C-R-A-C-K-E-R-S.
Not hackers.