Slashdot Mirror
Honeymonkeys Discover Undisclosed Vulnerability
spafbnerf writes "Securityfocus is running an article on Microsoft's honeymonkey project, previously covered on Slashdot. In early July 2005, this project discovered its first exploit for a vulnerability that had not been publicly disclosed, the JView profiler vulnerability which Microsoft announced later that month. "
I have no idea what Honeymonkey is, what Windows is, or even who Microsoft are.
BUT....Damn "Honeymonkey" is such a cool codename. I'm going to name my firstborn after it!
Aha, the new MS OS development team has been revealed: an infinite number of honeymonkeys at an infinite number of typewriters...
Explains a lot...
Microsoft has identified 752 specific addresses owned by 287 Web sites that contain programs able to install themselves on a completely unpatched Windows XP system.
I don't think I have a stronger word than DUH!
Don't you want people to find and fix the vulnerabilities in the OS before it goes public? Or will this just turn into another Slashdot anti-MS circle jerk?
Anonymous Coward: "This is slashdot. Accuracy is second class citizen here, unlike King Bias."
The researchers determine whether each monkey's system has been compromised by using another ongoing project, the Strider Flight Data Recorder, which detects changes to system files and registries.
Why not build a virtual machine into the browser itself?
Sort of a special purpose virtual machine that has
just enough of an OS to run the browser.
If Microsoft refuses to remove IE from Windows, at least IE could be isolated from the rest of the operating system.
So what they did, was perhaps not in your best interest.
or are Microsoft's buzzwords getting way too 'weird'?
Obviously Microsoft copied the idea from the aptly named Honeypot.
Honeypot makes sense.
Why ever would anybody in their right mind come up with something as lame as 'Honeymonkey'?
Is it because Microsoft is 'getting old'? It's like the old guy saying "In my day, we used to say 'Whizzo!' when something was really neat", and the teenager laughs, and comments that it doesn't sound half as good as 'cool'.
Linux/Open Source/Anti Microsoft News
Breaking news: Microsoft has found a security hole all by itself :P
It strikes me odd, that this important security patch arrived *after* the genuine advantage update. After the genuine advantage update all our windows computers stopped making automatic updates and therefore the genuine advantage was not patched as quickly as possible. Manual interaction was required to accept the 'genuine advantage' update. I wonder how many users out there stopped watching their automatic update function to work correctly. What is the advantage of having automatic updates if you have to monitor them? What is advantage is meant in 'genuine advantage'? And why do they now publish this information, when many people out there will not have applied the patch simply because they believe they still have automatic updates running?
Right, i was already thinking it's a slow news day when they put up this 2 day old story.
Sample this!
"The honeymonkey client goes (to malicious Web sites) and gets exploited rather than waiting to get attacked,".
This is just CmdrTaco's way of giving some credit to MS for actually showing some initiative...
From what I can tell is that Honey, is how they pay the one thousand monkeys working for one thousand years to create their operating system. Well I for one welcome our new Ape Overlords.
"I'm going to f***ing bury that guy, I have done it before, and I will do it again. I'm going to f***ing kill Google"
I guess this puts one more hole in the "security researchers should keep security holes to themselves" coffin. Obviously there's some fairly smart people out there in the black-hat community - if there's a flaw such as the recent issue with Cisco routers, they're gonna discover it eventually.
For the love of God, please learn to spell "ridiculous"!!!
Nice'n'crunchy.
So Microsoft has a room full of computers that do nothing but automatically surf the "questionable" parts of the web? Anybody wanna guess how many hours a day that room is packed with employees just sitting in front of a computer "doing nothing"?
I can't believe that people are lapping this up.
The so-called vulnerability that Microsoft claim to have found a 0-day for in the second week of July was actually discovered by SEC-Consult, and first published on June 29, having discovered it, and notified Microsoft on June 17. There was effectively nil response from Microsoft (they claimed to have not been able to reproduce the issue...).
While many people believe that the sample object used, the javaprxy.dll, was the flaw itself, the first paragraph of the advisory (the background) indicates that it is a COM level issue, and they identified at least 20 vulnerable objects on a standard XP installation.
It was this issue that Microsoft ignored until the recent Black Tuesday updates, and then claimed ownership of via the honey monkey project.
Sorry, guys, you can't claim something that has already been published openly, and ignored when notified.
InfoSec that matters, when it counts.
Even a monkey can find a flaw in Windows.
This is good. This should have been done by MS a long time ago and this should be an ongoing process. Everyone knows no OS is bullet proof on security terms. Better late than never.
I was referring to the concept of testing such applications BEFORE releasing them to the public. How many years have there been updates for Windows? If I remember correctly Windows 2000 went through 5 service packs, totalling hundreds of patches. (I should know, I had to download them constantly.)
As part of the software development lifecycle, there is a part normally called something like Testing/Debugging. I'm suggesting that maybe they should spend some more time in that stage, rather than using the majority of their paying users as beta testers. Most other companies release beta products for free, then charge for the actual "finished" product. Microsoft releases these applications/operating systems to the public (for a cost) and has them beta test.
Flamebait the original comment all you want, but the point still stands. Microsoft has repeatedly charged for a "new product" (new OS version) when it seems that if they did it right for once, they wouldn't need to come up with another version every 2-3 years, charging everyone each time. (And don't even get me started on the subject of not allowing an OS "upgrade" from a 'Full version' CD. I ran into this with Windows 98SE and ended up having to scrub my installation because my more expensive Full Version cd wouldn't upgrade my old Windows version.)
And they said zombies weren't real!
Honeymonkey? That's almost as bad as "Microsoft Certified Systems Engineer". Probably just as worthless too.
Not necessarily. You could say there are fewer flaws to find in Windows.
On the other hand, most remote exploits for Linux depend on SSH. Want a secure desktop Linux? Turn off SSH. And remove sudo.
Besides, those flaws are in specific applications, not the OS itself, in many cases.
Also, most flaws found in Linux are patched within days of discovery, announced upon verification, and less serious than the Windows counterparts. Given those facts, I'd say that less work goes into finding Windows exploits. Perhaps more goes into patching them, though--you have to ensure compatability with a very wide range of programs from 1995 to the present. And when I find a bug, I can't submit a patch to Microsoft.
Ummm...
So let's say that Microsoft tests Windows Vista in this way.
What information do they learn? Remember - the bad guys don't have access to Windows Vista, so they can't know about exploits in the new code in Windows Vista.
It's a chicken and egg problem - the bad guys can't know about 0day Windows Vista exploits because they don't have access to Windows Vista to exploit it.
If they find exploits in Windows Vista, it's because they're also in XP. If they're in XP, they can simply test with XP.
A honeymonkey does absolutely no good BEFORE the OS is released.
... are reader responses to an article like this. Some people just refuse to see the trees I guess.
If an indepedent, third party security company were performing these web site audits, the company wouldn't be admonished, but readers would still attack the "unfinished product" which was Windows XP unpatched. However, how can you fault a company that is trying to correct tens of years of security ignorance with new pro-active efforts?
MSFT is basically performing external penetration testing of their software while security teams are writing vulnerability scanners and focusing on individual aspects of an application's design. In fact, one could argue that this is one of the more effective ways of performing security testing since exploits in the wild can exist in the wild for months before any security company diagnoses the vulnerability and this method will identify areas of the Internet that seem to disseminate these exploits between web sites.
If you want to comment on the lack of security focus in the past, definitely. Are they playing a major game of catch up? Definitely. Should IE be so tightly meshed with the OS? Of course not. But can some of you just grow up and get past the MSFT bias and stop doing childish crap like making fun of the "honeymonkey" term or accusing workers of just sitting in the room not doing anything?
Hagrin.com
How can you call it a zero-day exploit with a straight face when you found it in the wild??
sigs are for fools and trolls. no signature is *always* appropriate. you should turn them off in your preferences.
I assume that they are combining web-monkey with Honeypot. (not that they are somking anything.)
Seriously, MS has set up a bunch of machines that actively surf the web trolling for vulnerabilities. I guess it's the "If we can't code securely, at least we can find the holes to plug." theory. Considering IE, it's not a bad idea.
It would be nice if they shared the exploits with everyone, at least once a patch exists, though.
OK, good job Microsoft: Now if you could implement a "least privileges" model by default....
Why do they need a whole own setup for this? Should think analyzing what must be constant attacks on their own servers would give plenty of clue of what's going on.
Perhaps more extensive research into own source-code and a rethink of the security model in Windows would have yielded better results, blocking these attacks at the doorstep. After all, a more secure Windows would put these attackers out of business faster and more efficient, and be far easier to manage than such a hunt on the net where the attacker most likely is out of reach and jurisdiction.
One observation Microsoft makes in the report is that "Several recent reports suggest that some companies may actually be building a business model around such attacks." (Microsoft itself springs to mind; sell vulnerable system, create malware removal tools, charge customers for removal tools, PROFIT!)
The future is in beta
Regardless what you think about Microsoft, what they are doing is a good thing and something the Linux communit should consider.
Install a the newest beta of your distro of choice on whatever old hardware you have laying around and join it to a distributed network. Someone put together a list of "questionable sites". Monitor the file systems with tripwire or AIDE or something similar. Post the logs and such to the distributed network for review.
"We can't solve problems by using the same kind of thinking we used when we created them."
I do not deny that the Honeymonkey project is useful, and will be in the future (although the figures listed for number of sites with malware seems low).
Because there was a lot of contrary reporting and postings which appeared around the start of July, it is difficult to sort the wheat from the chaff in order to obtain accurate information, but I do remember reading that proof of concept code definitely existed, and was published, at the start of July, with one example being reported on the ISC Diary. I also recall a post on a mailing list that suggested that exploits were already circulating, but I can not track down a citation for that. I really would not call it a 0-day (which is probably semantics), but at least their project picked it up within two weeks of the POC being published.
To Microsoft's credit, they do publicly acknowledge SEC-Consult as being responsible for discovery of the initial flaws, on the patch information page.
Sticking with M05-38, the image handling errors which were fixed are another example where Microsoft ignored public disclosure, especially when the disclosure sparked a level of interest on the Full-Disclosure mailing list.
With respect to pen-testing, my approach has always been to obtain a copy of the target software, and to test locally, before heading out for the client systems. Although not automated like the Honeymonkeys, it achieves a similar purpose. I also think that the monkey component of the honeymonkey might refer to the crazed monkey(?) testing tool in the original Macs, which performed random input (mouse movement, clicks, keys (I think)) as part of testing for unexpected application behaviour.
InfoSec that matters, when it counts.
The approach we took was to collect an initial list of 5000+ potentially malicious URLs by doing a Web search for Windows "hosts" files [HF] that are used to block advertisements and bad sites, and lists of known-bad Web sites that host some of the most malicious spyware programs
Kinda like testing condoms with hookers.. only your condom is made by MS...
How many courses would I have to take to become a
Microsoft Certified HoneyMonkey
You can't talk about Wikipedia's flaws on Wikipedia
Yupp. They rejected my submitting this story 2 days ago. But then this place was boiling with hotter news :-))
The future is in beta
Wouldn't these sites eventually get smart enough to know the honeymonkey IP's and block them?
Agreed.
Microsoft has a not-so-reputable past, perhaps, but at least they are making clear efforts to bring about change.
Like you said, no company is perfect. This goes for OS's, too. Anyone who claims Linux is perfect, is a damn fool and knows it. Trouble is, due to MS's wide user base, and the fact that most places downplay anything negative about Linux, has lead to MS's problems being continually headlined. It's like a world full of idiots turning minor problems into 9/11-style ordeals.
And honestly, anyone who spends their life causing damage to others (regardless of the existance of the ability to do so), deserves to get a beating.
In his book "In the beginning was the command line", Neal Stephenson wrote that some newspaper articles would be indecipherable to someone who had lived in a cave for the past 50 years, because it talks about "software", "operating systems", and "windows vs. apples".
Now I am trying to figure out what someone who has lived in a cave since the Eisenhower era would make of this headline, "Honeymonkeys Discover Undisclosed Vulnerability".
"Honey... monkey? Vulnerability? Undisclosed? uuuuh?" *HEAD EXPLODES*
(Full text of In the Beginning... is on Stephenson's site)
Yeah, it happens. My Wikipedia-DVD story got rejected five minutes before a pretty much identical story got accepted.
I was bitching about it on the phone to a friend of mine, and he made a very good point, along the lines of "Slashdot is lame, anyway".
Assume I was drunk when I posted this.
Did anyone else see the dup article about honeymonkeys from CmdrTaco that was here around 5:15pm eastern time? I guess he just deleted it to prevent humiliation.
I made a post there but it seems to be lost at this point.
Do you really think no hackers are in on the beta testing? Can you really be that naive? All you need to get a beta copy is an MSDN license which is only $699. This may be out of reach of many script kiddies, but is easily obtainable by those hackers able to do actual vulnerability research and reverse engineering. The hackers, if they are smart, won't put the vulnerabilites up on the web before the OS goes mainstream though. The point is though that MS is, or at least should be, more than capable of checking their own source code and letting their partners and beta testers do so as well. If a bunch of hackers can find all these problems why can't MS with their billions? Answer spending money on reviewing source would cut into profit and it's easier and cheaper to patch later once someone else finds the problem.
chown -R us
if i RTFA correctly, their honeymonkeynet found a new 0day that was previously unknown? a vulnerability that has been out there for who knows how long and has been used to exploit an unknown # of surfers? i do recall a while back some MS spokesperson saying something about how patching is bad because their patches are reverse engineered into exploits and how if MS didnt release patches, then no one would be able to write exploits... i guess that argument has been thrown out the window (again).