Slashdot Mirror
Hackers, Meet Microsoft
Mz6 writes "The random chatter of several hundred Microsoft engineers filled the cavernous executive briefing center recently at the company's sprawling campus outside Seattle. Within minutes after their meeting was convened, however, the hall became hushed. Hackers had successfully
lured a Windows laptop onto a malicious wireless network. 'It was just silent,' said Stephen Toulouse, a program manager in Microsoft's security unit. 'You couldn't hear anybody breathe.' The demo was part of an extraordinary two days in which outsiders were invited into the heart of the Windows empire for the express purpose of exploiting flaws in Microsoft computing systems. The event, which Microsoft has not publicized, was dubbed 'Blue Hat' -- a reference to the widely known 'Black Hat' security conference, tweaked to reflect Microsoft's corporate color."
But will MS actually do anything?
It seems like Microsoft is showing their own coders how vulnerable their code is, but these are probably the people who already know that best.
So microsoft has what like 50 billion in cash reserves? Why don't they just do a bug bounty and like $50 a bug. Like mozilla did. 50 billion/50 = 1 billion bugs they could find and fix that would hav to make some kind of dent right....................oh wait never mind.
Madre de Dios! Es El Pollo Diablo! -- Captain Blondebeard
First, at a company like Microsoft, I'd be asking about the 2 senior managers who didn't know about heap attacks. Second, this whole article is a bit of a puff piece it seems designed to put Microsoft in the best light, "Can't we just all get along?".
Good for Microsoft that they're willing to do this kind of thing... shame on them for waiting until the five years into the 21st Century. While I don't hold much hope Microsoft truly cares about security other than how it affects their public image and bottom line, maybe that kind of pressure will finally be enough to get them to clean up their mess, if only a little bit.
So what? Maybe they read some document informing them of what a heap overflow is. It's more important that these managers understand what goes into the code and the technical details that make the system operate, not what an "obscure" problem like a heap overflow is. Microsoft's managers can only claim technical know how if they have experience working as developers, because otherwise it's simply too hard to understand the real issues that the engineers have to face.
Contrary to popular belief, most of these developers aren't intentionally releaseing what they know to be insecure code. They test it beforehand, and sign their work. They are making what they believe to be a good effort at security.
Imagine if you made a product, and were fairly proud of the work you had put into it, and then someone grabs it, and publicly demonstrates that it's terribly flawed, making you appear to be a fool. It's natural to be angry, and hopefully it will only inspire them to greater vigilance in an attempt to save face.
Microsoft has managed to link itself with bad code to a degree that, recently, I spent over 40 minutes convincing a programming team that Code Complete was actually a good book and did not reflect the bad quality of Microsoft software.
Broken Hearts are for Assholes. - Frank Zappa
Is that so entirely unusual? Would you trust yourself to edit a manuscript that you wrote? When you review your own work, you naturally see your intentions instead of your results. That can be true at a personal, team or corporate level so it's not necessarily just a matter of easier.
~Someday, I hope to be an aspiring author.
I remember when Windows 95 came out, with its weak, obviously-an-afterthought "web browser" (IE 3.0). It was painfully obvious that Microsoft had missed the Internet boat, and shortly thereafter, Bill Gates sent his historic all-hands memo pointing the company in the direction of the Internet.
It took them some time to get it right, but eventually IE took over. Now, you'd have a hard time finding a Microsoft product more complex than Minesweeper or calc.exe that doesn't connect to the Net somehow. And let's not forget that Netscape provided Microsoft with some much-appreciated help in taking over the Web, by screwing up their own release schedule so badly that there never was a Netscape 5.0.
Flash-forward to a couple of years ago, when Bill sent out yet another all-hands memo, pointing the company in the direction of security. At first, we all laughed. But now it's becoming more and more obvious that they're taking security every bit as seriously as they once took the Internet. They are aiming to be the top of the heap in security, and they've got drive, ambition and aggression.
Make no mistake, this kind of event is exactly what a company that wants to get secure should be doing. Thomlinson's comments about how seeing their code exploited "hits people in the gut", and the fact that "he was glad to see the crowd of engineers taking things personally" -- these things are right on the money. These things say to me that, within a few years, we're going to see some really damn secure stuff coming out of Microsoft.
In the meantime, Firefox exploits are cropping up at a seemingly greater pace. This worries me. It looks like a repeat of 1997, when Netscape lost huge amounts of ground to IE by producing a product that wasn't as good as the competition. SP2 wa s huge leap forward in security for Windows and for IE, and Blue Hat makes it obvious that Microsoft is just going to get better at it. In the meantime, Firefox appears to be standing still on the security front, or maybe even losing a little ground. Sure, it's still miles ahead of IE's security, but if IE keeps up the pace, it will overtake Firefox sooner or later -- probably sooner.
Is there any way the Firefox development team (and the OO.o team, and anyone else who's working on high-profile F/OSS projects) can take a lesson from Blue hat? Can we get together events like this of our own?
If we don't, I can already see that by 2009 or so, at the latest, I'll be telling clients to go with Microsoft products, because they're more secure than F/OSS. And I don't want to see that happen.
Kai MacTane: Web developer for hire in San Francisco
Saving face is exactly the wrong motivation to fix security problems.
If it takes public embarassment to get these engineers to take problems seriously, then they're totally fucked.
That's right, real engineers aren't human beings who would be upset to have their work publicly shown to be lacking. They're supremely efficient human beings who engineered their own feelings out.
Real engineers are human beings and it's quite acceptable for someone to get mad before they tackle a problem they helped create.
You want to know who isn't running Firefox 2.x? They spell it "definately" and "rediculous".
Unless Microsoft uses NO wireless on its campus or unless the walls were RF shielded, this was a very dangerous stunt. If a hacker can gain access to a Windows machine via wireless (and they can according to this account), then they would be able to (and might have) accessed wireless networks outside the meeting room but inside the corporate firewall. Range is no protection as it would be not hard to build a high-gain antenna into the lid of a hacker's laptop and orient it to pickup WiFi elsewhere on the Microsoft campus. If a hacker can gain access to an inside machine, they could plant a backdoor for later exploits including attacks on the the company's codebase.
I'm not a shareholder or a user of their products (except to the extent that the vast majority of the companies I do business with use Microsoft) but I find this an extremely irresponsible act on the company's part. If they want to try this sort of security testing, and they should, it should be done off-site or in a shielded room.
Two wrongs don't make a right, but three lefts do.
...on "security"
uh huh
think about what that sort of cash would do to help out open software in general terms, all the various neato projects done with a few dollars and a lot of skull sweat. Think about if only a fraction of that went to linux kernel development, say something small, like 100 million dollars, 1/20th of what MS spends on "security research"
I am just amazed at this,it is just a staggering sum for those products and their "security features".
Real engineers fix problems, they don't get emotional.
This is so true. I've worked with many people in IT and communications over the past 17 years, in financial, military and educational institutions from desktop support to reverse engineering. People who get emotional when challenged or proven wrong are putting their ego before the problem. Their ego becomes the biggest problem and the real problem they're getting paid to fix tends to get fixed in a way that makes them look good, which might not actually be the technically better way.
The most exceptional people I have worked with, shrugged failure off and carried on with fixing things or making them better. The loudest people don't know shit and cover it up with fast talking. It seems the quiet, well educated people who are comfortable with themselves are the ones who make the biggest differences.
Unfortunately, in the past 17 years, only two people in my mind stand out to be the exceptional people, the rest are all competing in a bullshit competition with each other or are otherwise mediocre.
War crimes, torture, lies, illegal spying... Would someone give Bush a blowjob, already, so he can be impeached?
Yes, we are human, but then again, not all engineers are equal.
I once worked for a company that hired an outside consultant to ask how they could get their product into a "better place". It was nasty code that contained snippets of Fortran, C, C++, and three other scripting languages. Some of the newer portions were being developed in JAVA with a database as the "inter-system" communication protocol. It compiled on one specific version of UNIX and threw memory alignment errors.
The consultant did an excellent job, and he really should be commended for identifying key weaknesses in the product; however, when he presented his findings, most of the managers grew visibly upset, and a few raised their voices (but I wouldn't call it yelling). People defend their collections of bad ideas, and rationalize that it's much more costly to fix problems than to just live with them a little longer.
I enjoyed my time there, but I moved on because I couldn't stand to see good ideas replaced with bad.
More like: It is because of the amazing popularity of Windows that we are targets of these attacks.
A slashdotter who didn't build his own computer is like a Jedi who didn't build his own lightsaber.
Why, exactly? If saving face motivates people to solve the problem, then I'm all for it. Frankly, I don't care if they fix the problem because they want to save face, impress their girlfriend or because little green men from the planet Weebo have told them to. I care about results. If the problem is fixed, the problem is fixed. Their motivation doesn't even enter my mind.
People who get emotional when challenged or proven wrong are putting their ego before the problem.
I have to disagree. I've fixed/solved some majorly complicated problems in the past 20 years. In many cases, I've gone through periods of frustration that got vented as 'anger.' Once vented, I settled down to the task at hand.
The most exceptional people I have worked with, shrugged failure off
It seems the quiet, well educated people who are comfortable with themselves are the ones who make the biggest differences.
Perhaps. But that itself does not prove (or even suggest) that some exceptional people are not also 'passionate.'
You probably should not make such sweeping generalizations. There are many personality types among people who are very effective at very complex tasks.
Computational Chemistry products and services.
Why, exactly? If saving face motivates people to solve the problem, then I'm all for it.
The problem is that saving face can be accomplished by only hiding the problem, or squelching discussion of it, or pretending it isn't there.
Saving face generally seems to take the path of least resistance, and implies a desire to not face the issue.
September 2011: Looking for Cocoa/iOS work in Boston area Cocoa Programmer Quincy, MA