No Defense Against Windows Rootkits?

An anonymous reader writes "Spyware bad guys (and also phishing people) started using rootkits technology to stay hidden in a system. The problem is that at the moment the technology to defend a Windows system from these things is very poor. In fact antivirus companies have just started adding basic anti-rootkits technology. So the problem is serious, and well outlined by this question: Is the closed source code of Windows preventing us from actively defending our systems?"

Comments

It works both ways, but it's worse for MS

[SilverspurG]

The problem is that at the moment the technology to defend a Windows system from this things is really poor.

While it's less common on our beloved Linux platform it's pretty tough to defend against here, too. If someone can make use of a Firefox hole, couple it with a root exploit, and put a kmod in /lib/modules, it's all over. With the 2.6 kernel seeing an explosion in `lsmod`, I can no longer verify each and every module Debian loads so easily as I could in the 2.4 series.

does Windows source code unavailability prevent us to actively defend our systems?

This would be a resounding YES.

And Butler and Hoglund's recent book on rootkits was pretty nice. :)

Re:It works both ways, but it's worse for MS

[Anonymous Coward]

With the source code for Linux, we can easy add signatures and verification to the module loading system. So that wouldnt be an issue.

Re:It works both ways, but it's worse for MS

[tomjen]

I was thinking, could you not just recompile the kernel without suport for loadable modules?
I mean, if i ran a server i would do that.

Re:It works both ways, but it's worse for MS

[Qzukk]

In 2.6 you use the kernel capabilites to load the appropriate modules at boot time, then strip the kernel of the ability to load any others. Adds a little more work for getting that module loaded. Throw in more stuff (verifying the module list from read-only media before loading any modules) and you can get pretty well defended against this kind of thing.

Re:It works both ways, but it's worse for MS

[jon787]

That would be why all the security manuals for linux recommend disabling module loading. Not that even this would prevent you from modifying the kernel, it just makes it harder.

Re:It works both ways, but it's worse for MS

[ScentCone]

Modded flamebait. Are the Linux fans in the audience so insecure about the fact that their favorite son is not completely un-assailable that they're willing to kill the messenger? I guess so.

Re:It works both ways, but it's worse for MS

[EvilMonkeySlayer]

Yep, all servers i've built which use Linux which are accessible from the outside do not have loadable module support enabled at all.
It prevents a large swathe if not all rootkits from running.
This is one of the areas where I think Linux (and open source software in general) has closed source software beat, you can easilly customise the kernel to your own particular situation in which the machine will be running. Being able to have your own custom built kernel with stuff like grsecurity etc is invaluable.

Re:It works both ways, but it's worse for MS

[Anonymous Coward]

Yes, you can, and it's even recommended.

Other steps you can take are :
-not having dev tools installed on your servers (quite often source root kits require them)
-keeping copies of /bin and /usr/bin on some ro media (either a CD or on a seperate server mounted ro), and checking them ageinst you're working copies regularly.
-running chkrootkit :-)
-Mount / ro. You need to set up seperate space for /tmp and /var (not to mention /home) but this will defeat 99% of the automated root kits, of course, if the attacker gets in personnally, all bets are off...

Re:It works both ways, but it's worse for MS

[Anonymous Coward]

There are examples out there of how to load modules without the need for kmod support.

Re:It works both ways, but it's worse for MS

[MindStalker]

Compile all needed device drivers into the kernel then do not include module support with that kernel. Of course any changes in your system in the future will require kernel recompile, but thats half the point.

Re:It works both ways, but it's worse for MS

[physicist]

I don't think that will work:
http://www.phrack.org/show.php?p=58&a=7
I suggest using that military grade stuff. ;-)

Re:It works both ways, but it's worse for MS

[quantum bit]

Or, if you're running BSD, set kern.securelevel to 1 or 2.

That will prevent loading new kernel modules (so you can still load them early in the boot process), cut off access to things like /dev/mem, and if you set it to 2, disable access to raw disk devices.

Re:It works both ways, but it's worse for MS

[Jeff Hornby]

So when my mother, who uses her computer for playing bridge online and printing e-mail pictures of her granchildren buys a new printer, you think she should have to recompile her kernel.

Are you going to pay for a full computer science program at a good university for her so she can even understand that idea.

The only erason Linux can do these things is because the vast majority of users are technically savvy. Any real solution needs to be usable by the average user.

Re:It works both ways, but it's worse for MS

[Malc]

I was going to post my copy of /etc/fstab with comments to follow-up your post, but the stupid /. lameness filter wouldn't let me. It complained of too many "junk" characters, even after I removed all of the comments and forward slashes. I'm sick to death of this /. crap - it's getting in the way of this being a forum where one can actively participate. The other ignorant thing getting on my nerves is the "feature" preventing posting too quickly. Yesterday it told me that it was an hour and 26 minutes since my last post and that I needed to slow down. What a load of BS - after all these years I'm beginning to think about dumping this forum as it's getting more and more crappy.

Re:It works both ways, but it's worse for MS

[mgkimsal2]

Could you post it on a server someplace and give us the URL to look at it? It would be useful to see how other people address this issue. Thanks.

Re:It works both ways, but it's worse for MS

[makomk]

So when my mother, who uses her computer for playing bridge online and printing e-mail pictures of her granchildren buys a new printer, you think she should have to recompile her kernel.

On sane operating systems *cough*Linux*cough* printer drivers aren't kernel modules - they don't need that sort of low-level OS/hardware access. Of course, it'd still be an inconvenience adding other hardware, but that's not a good example. With Linux, newbies at least will probably only want to run the kernel modules their distro supplies, so why not have a list of valid modules and their checksums loaded at startup, and refuse to insert a module that's not on the list?

Re:It works both ways, but it's worse for MS

[Anonymous Coward]

Its fairly easy to put a module in Linux using /proc/kmem even if modules are disabled.

Re:It works both ways, but it's worse for MS

[bloo9298]

The parent poster should be modded up. They have pointed out that turning off loadable kernel module support gives a false sense of security. It is still possible for an attacker, running as root, to modify kernel memory using /dev/kmem. The underlying problem is that access control is too coarse on both UNIX and Windows. SELinux is much better in this respect, but one could still wish for more.

Re:It works both ways, but it's worse for MS

[slashflood]

• Run the services chrooted
• Run pound in front of your web server / web services
• Use a file integrity checker

Re:It works both ways, but it's worse for MS

[Henry V .009]

Post it to your journal, please.

Re:It works both ways, but it's worse for MS

[ScentCone]

Further proving my point! A note pointing out that a flamebait mod was merely a kill-the-messenger bit of childishness is greeted by... a flamebait mod! Of course! Now why would anyone in the business world ever come to the conclusion that some people preaching Linux are in any way... shall we say, not ready for prime time? Ok, mod this as flamebait! You know you're obliged to.

Re:It works both ways, but it's worse for MS

[erlenic]

That's exactly what he was saying wouldn't work. Basically, here's how your conversation breaks down:

AC: You can load a module even if the kernel doesn't support them.
You: Then just make your kernel not support them.

Re:It works both ways, but it's worse for MS

[amightywind]

What a load of BS - after all these years I'm beginning to think about dumping this forum as it's getting more and more crappy.

Look at my .sig. Some cockroach, who fancies himself a site 'moderator', climbed out of his hole and shut me down for 4 weeks because he thought I got downmodded too often. My karma value, whatever the hell that is, would have you think I was in good standing. I will never metamoderate again.

Re:It works both ways, but it's worse for MS

[TheRaven64]

On OpenBSD, you can get away without very much at all running as root. My OpenBSD box has the root account disabled (if I need to do something as root, I use sudo, which provides a better audit trail). Most other things that need root privilege either start with it but then relinquish it after doing what they need to (e.g. OpenBSD's Apache fork) or use systrace's privilege escalation system to get fine-grained access to the few things they need to do as root.

Re:It works both ways, but it's worse for MS

[doublebackslash]

You could base 64 encode it.

WW91IGNvdWxkIGJhc2UgNjQgZW5jb2RlIGl0Lgo=

Even Large files get past the lameness filter like that fairly easily.

I2luY2x1ZGUgPHN0ZGlvLmg+CiNkZWZpbmUgdih4LHkseixzKS BmcHV0YygoKGE+PiggKCgoeT4+KDMteikqOCkpJjMxICkgLSgg KCh5Pj4oMy16KSo4KzUpJjcpKSApICkgJiAoMHhGRj4+KDgtKC goeT4+KDMteikqOCs1KSY3KSkpKSkrcyxzdGRvdXQpOwojZGVm aW5lIGsoeCx5LHopIGZwdXRjKCgoYT4+KCAoKCh5Pj4oMy16KS o4KSkmMzEgKSAtKCAoKHk+PigzLXopKjgrNSkmNykpICkgKSAm ICgweEZGPj4oOC0oKCh5Pj4oMy16KSo4KzUpJjcpKSkpKSsoJ2 EnLTEpLHN0ZG91dCk7CiNkZWZpbmUgbChhLGIsYyxkLGUpIGZv cihlPWM7ZTw9ZDtlKyspayhhLGIsZSk7CmludCBtYWluKCkKew ogICB1bnNpZ25lZCBpbnQgYT0weDFhZjM0NDAsYj0weDY3OTRi ODQ3LGM9MHg5MjZkNDcyNyxkPTB4NGU5NmM3NGUsZT0weDk0OT k0ZTI3LGY9MHhiMWFkY2I5MyxnPTB4NmRhZDAwMDAsaTsKICAg bChhLGIsMCwzLGkpCiAgICAgbChhLGMsMCwzLGkpCiAgICAgIC BsKGEsZCwwLDEsaSkKICAgICAgIHYoYSxkLDIsMzIpCiAgIGwo YSxkLDMsMyxpKQogICAgIGwoYSxlLDAsMyxpKQogICAgICAgbC hhLGYsMCwxLGkpCgkgdihhLGYsMiwxMikKICAgbChhLGYsMywz LGkpCiAgICAgbChhLGcsMCwxLGkpCiAgICAgICBwcmludGYoIl xuIik7CiAgIHJldHVybiAwOwp9Cg==

post your fstab please.

Re:It works both ways, but it's worse for MS

[That's Unpossible!]

I ran into the same exact problem recently. Excellent karma, heavy participation, and prevented from posting at work due to being downmodded "too many" times. I have stopped subscribing, stopped moderating, stopped metamoderating.

Re:It works both ways, but it's worse for MS

[schon]

Great advice... some other things you can do:

mount /tmp and /var with the noexec option - if you have developers who don't understand security, this can save your bacon. (someone used a hole in a PHP script to upload and execute a file to /var/tmp - the upload happened, the execute didn't. I ended up with a copy of the rootkit (fairly new at the time) as well as how he got in, which was shown to the web developer responsible in an attempt to get him to take security more seriously.)

use a separate account for each daemon (some distros I've seen run apache as 'nobody', for example - don't use 'nobody', create a separate user for each daemon) This prevents your daemons from overwriting each others data, and allows the following:

use --uid-owner and/or --gid-owner in iptables to restrict your daemons from opening *outgoing* connections, or listening on random ports. If one of your daemons is compromised, it makes it harder for an attacker to connect to take over complete control.

Never have executables or data owned by the same user that the daemon runs as. I've seen this done mostly on game servers (the docs recommend running the game as 'unreal', and have all the game files owned by 'unreal') but some others (squidGuard comes to mind) also recommend (or even require!!?!?) having data files owned by the daemon. If there was a hole in the daemon, an attacker could theoretically use it to gain higher priveleges (such as the UID of the account used to start the daemon - frequently root) the next time the daemon is started.

Re:It works both ways, but it's worse for MS

[MindStalker]

If you look at the parent you would see this is in reference to linux installations for servers. No sane person would set a kernel without module support for a non-techies desktop. Stop trolling.

Re:It works both ways, but it's worse for MS

[Transcendent]

FYI: kern.securelevel 1 is default for OpenBSD for multi-user mode.

Re:It works both ways, but it's worse for MS

[GlL]

OK, Reality check time. I am a tech with 10 years experience working with Pc's and Macs. I haven't had the neccessity or motivation to learn Linux, mainly because I don't think it will be widely used outside of technical applications, and I make my money doing user support. I don't have time to learn a whole new command structure that I won't have the opportunity to use. As of right now of the roughly 10,000 customers my company serves 0% of them are running linux.

To configure Linux you have to be comfortable in its command line, and have a basic unix background so that you know what the commands are. The advantage that both Windows and Mac have is that it is comparatively easier to install by the end-user. We can talk about the security issues, etc, but until Linux can be completely administered from a gui, it won't expand outside of the back-end server applications that it mainly runs now. So I really don't want to hear about how secure (Insert favorite *nix version here).

What I am interested in is:
Have you developed a version of linux that can be COMPLETELY installed, administered and run from a gui?

I am not a linux basher, and I sincerely hope that it becomes more developed and popular than it is now. I have no allegiance to any specific OS, I think that they all have their drawbacks, but I am going to continue avoiding linux until my customers start using it.

Re:It works both ways, but it's worse for MS

[OreoCookie]

Metamoderating is a joke. I did it about twenty times. It has no effect whatsoever on anything. I think, nowadays /. is run by a small group of control freaks. I didn't mind it when you had to wait 4 or 5 minutes between posts but now it's so long that I lose interest in the discussions.

Re:It works both ways, but it's worse for MS

[Stephen Samuel]

mount /tmp and /var with the noexec option

/dev/shm as well, if you have it mounted.

Re:It works both ways, but it's worse for MS

[Stephen Samuel]

It makes it harder, but if the attacker achieves root (well, you're toast, anyways), they can then modify the boot scripts so that their script loads before everything is locked down. This is why you lock down the Kernal from loading modules at all -- it means that they then have to replace the entire kernel. If you're lucky, they'll modify the boot scripts, not knowing that it does them no good.

Essentially security by obscurity, but every little bit helps at this point.

Re:It works both ways, but it's worse for MS

[Tibor the Hun]

Shit, can I join the club?

uh-oh, here come the troll mods! prolly the same ones who modded me troll yesterday, as opposed to offtopic.

Re:It works both ways, but it's worse for MS

[Jeff Hornby]

I re-read the parent and I can't see where he/she said anything about only doing this on a server.

In fact, I wouldn't consider a server "my system". When I talk about "my system", I'm referring to my desktop not to one of the servers in the backroom (which are really everybody's system).

Re:It works both ways, but it's worse for MS

[AviLazar]

This would be a resounding YES.

Yes my view will be unpopular, and if I don't get modded down I will be shocked...but guess what, even Open Source software has problems with code vulnerability. Look at the recent news regarding FireFox. Windows is still the mainstream OS so it is the most heavily targeted and exploited....once there is another majority shareholder in the market it will also be targeted....Again, point in case FireFox...people touted it as TEH answer, but it was only a temporary reprieve.

Re:It works both ways, but it's worse for MS

[Keruo]

> If someone can make use of a Firefox hole, couple it with a root exploit, and put a kmod in /lib/modules, it's all over.

[ ] Enable loadable module support, and build your kernel static

No-one is required to use modular kernels anyway.
Modern machines have too little memory to keep all the neccessary kernel code loaded all time?
Don't think so. Modules were great when you were running linux with 16Mb memory, honestly you won't notice the extra 10-20Mb memory in use by kernel modules if you have 1-2Gb stacked in the machine.

Re:It works both ways, but it's worse for MS

[aborchers]

I got the same thing on a post that got upmodded almost as many times as it got downmodded. I had the misfortune of posting something controversial near the top of the list and got something like 10 mods down and 9 mods up, so the net downmod on the post was about 10%, but because the total *number* of downmods was above a threshold, I got put in the penalty box. I couldn't get the penalty lifted by communicating with /.'s staff folks either.

Before that day, I always thought the people bitching about the moderation system were just whining, but now I'm convinced there are aspects of it that are completely capricious.

Re:It works both ways, but it's worse for MS

[malcomvetter]

Here's your problem with that.

Let's just say that such a tool compares kernel modules and key system files to a list of approved modules' checksums. A rootkit could easily modify the list with its own checksum, so if this was a totally automated process, it wouldn't work.

The other options include having the user sign/validate the checksum list, but that will increase the complexity of the process to the point that most OSes/distributions will not include such a tool. If the signature is performed by a key that is managed by the OS directly, once again, the root kit could automate this process as well.

On another note, the Windows Security model allows for different rights levels: guest, user, power user, admin, AND System. Administrators can elevate to system (there are tools with the appropriate API calls for this ... try psexec from SysInternals). And system is the rights context that is required for access to things like SAM password stores in the registry, etc. Administrators cannot just "navigate" or "browse" to these critical points with the standard toolsets.

I like the idea of using hardware to force read-only critical sections for high security systems, and for items like what F-Secure can offer for normal-security systems.

Re:It works both ways, but it's worse for MS

[Flamesplash]

I dunno about your YES, I'd be interested in knowing who is getting hit by these things, are they people that would ever install a 3rd party random update on their computer, or even know that they needed one? I've never been hit by a virus or anything else malicious in my 8 years using a computer and 4 years running windows on a couple systems, I however keep updated and run a firewall as well virus protector; my mom on the other hand would have never done this, I had to reload win XP for my aunt cause she installed some adware that was uninstallable, neither of them would have ever thought to go look for a fix, let alone know where to look.

Re:It works both ways, but it's worse for MS

[Anonymous Coward]

Awww...you poor thing. You want a soda? A soda will make it all better. Please please PLEASE don't go. We'll all miss you just so much!

Who are you again?

Re:It works both ways, but it's worse for MS

[amightywind]

Here my post that triggered the timeout event. Admittedly, due to the political nature of the posting you could expect have of people to support is strongly and half to oppose. I actually think that dueling moderation is good for the site. It shows a high level of interest in the posting. Isn't that the point?

Re:It works both ways, but it's worse for MS

[Lumpy]

Yes you can, espically for critical servers. Compile all needed modules into the kernel and then list every module in the blacklist.

I know some can not be loaded in any way other than a module but you certianly can make it so it's darn impossible for the rogue module to run.

Personally I have never found a functionality I needed on a serverthat could not be compiled in and then disable module support in the kernel, but then I do not use some of the more fancy functions.

Re:It works both ways, but it's worse for MS

[Mr Guy]

How completely is completely?

Don't compare advanced hardening of servers with default installations by "end users" (a worthless term that encompasses way too many different thigns to be useful).

MANY major distributions are relatively comparable to WinXP as far as ease of installation. There's probably an equal number of "What the hell is that, I'll just click OK" moments in both installs.

The big problem I have with Mandriva isn't the ease of installation, it's the difficulty of uninstallation. URPMI, especially through the SoftwareManager interface, makes getting new free software a breeze. When you decide you don't like something, though, all those dependencies are still hanging around. I haven't figured a great way to tell what of those lib packages I no longer need because I uninstalled NextBigThing0.1.rpm.

Re:It works both ways, but it's worse for MS

[StoryMan]

Look at my .sig. Some cockroach, who fancies himself a site 'moderator', climbed out of his hole and shut me down for 4 weeks because he thought I got downmodded too often.

Maybe you're just a bona fide idiot?

Re:It works both ways, but it's worse for MS

[Afrosheen]

If you see a ton of modules with your new 2.6.x kernel, the simplest solution is to compile a monolithic kernel with the modules you need built in. That way lsmod returns nothing.

Re:It works both ways, but it's worse for MS

[doorbot.com]

It makes it harder, but if the attacker achieves root (well, you're toast, anyways), they can then modify the boot scripts so that their script loads before everything is locked down. This is why you lock down the Kernal from loading modules at all -- it means that they then have to replace the entire kernel. If you're lucky, they'll modify the boot scripts, not knowing that it does them no good.

If an attacker gains root on my system, and "attempts" to install a rootkit into my startup scripts, that means they have to reboot the system to take effect. So they do so. Now the system comes back up, but they don't have a working rootkit. The vulnerability is still there so they just exploit it again to get root, and this time recompile the kernel appropriately. You were hinting at this in your comment but I really think it is worth making clear;

I understand that rootkits are a problem but once someone has root you're out of luck either way. The issue on Windows is that so many end users run as Administrator that they are far more likely to get hit by a rootkit.

On a side note, does anyone know the command for apt-get / dpkg to verify all my installed binaries?

Re:It works both ways, but it's worse for MS

[Anonymous Coward]

I can't believe that you are claiming that because the NYT came out against Mississippi river flood control pork spending and in favor of reinforcing levees, that they are somehow being inconsistent. Are you stupid, a FoxNews kneejerk ditto-head, or just a flamebaiter like the mod said? You deserve to be banned.

Re:It works both ways, but it's worse for MS

[WraithRealm]

I often wonder if this is what Google could be trying to do behind closed doors: making a Linux-Comparable OS with Total GUI Support.

Also, in difference to all OS's, Ease-of-Use and Ease-of-Destruction tend to go hand in hand. If a user is given the ability to easily do things like add Low-Level Printer Drivers (say, like MS Win) then it will be easy for them to mess something up bad.

I've been working with PCs all my life. (Win, Mac, Li/Unix) I've become comfortable believing a certain thing: That there are two kinds of Computer Users: Techs and Non-Techs. 90% of the people Out There are of the group Non-Techs. These are the people who are afraid of the mouse up to the people who are dangerous enough to install said Printer Drivers. A system that caters to them is convenient for Monetary Gain. But it is also convenient to disreputable users. I don't see good way to combine the two Fields of Thought. There *should* be that distinction - There will never be a time where Every Single Person will know every in-and-out of a computer system. Yes, they'll be more and more educated over time, but the level of tech will continually rise, outpacing them. The goal of the next OS should be to prevent the 90% of users from needing to see *any* Techs-worthy details of a machine.

Just my $0.02.

Re:It works both ways, but it's worse for MS

[Qzukk]

On a side note, does anyone know the command for apt-get / dpkg to verify all my installed binaries?

The "debsums" package does this, you can have it check against the .md5sums file that was installed when the package was installed, or (apparently) have it check against a .deb file.

Re:It works both ways, but it's worse for MS

[Stephen Samuel]

The vulnerability is still there so they just exploit it again to get root, and this time recompile the kernel appropriately. You were hinting at this in your comment but I really think it is worth making clear;

True, but it takes more time and energy for them to accomplish. It also requires multiple boots to go through the process, which makes detection easier (( Unix admins are far less forgiving of spurious reboots than Windows admins).

The other thing is that no security is 100%. The point of a security system is to make it so hard to penetrate that an attacker gives up and goes in search of another (easier) target before (s)he succeeds -- or, in the alternative, takes so long that (s)he is detected and stopped.

Among other things, rebuilding the kernel would require, among other things, determining which modules were compiled in..... That could be some serious work, especially if the kernel is compiled with some slightly unusual options.

Re:It works both ways, but it's worse for MS

[Proteus]

>The only erason Linux can do these things is because the vast majority of users are technically savvy. Any real solution needs to be usable by the average user.

Most of this conversation has centered around protecting servers; the "average users" of servers should be competent admins, and all of these things are within their purview.

>So when my mother, who uses her computer for playing bridge online and printing e-mail pictures of her granchildren buys a new printer, you think she should have to recompile her kernel.

There is a huge difference between user-space drivers like printers and mice and kernel-space drivers like IDE chipsets and video drivers. Your mom is unlikely to need kernel-space drivers.

>Are you going to pay for a full computer science program at a good university for her so she can even understand that idea.

Oh, please. I have my mother running Linux, and it took very little time for me to explain all that she really needed to know about running and administering it. Kernel recompiles to add kernel-space drivers could be made stupid-simple:

1. HW detect & modprobe the correct modules
   
2. Test the hardware (e.g. "Print a test page")
   
3. Ask user to finalize changes, which requires the root password.
   
4. When user agrees and authenticates, compile above-loaded modules into new kernel (automatically, and behind the scenes), and reboot.
   

Of course, I'd not recommend actually doing things this way, but implementing systems to allow easy signing and kernel-level signature-checking of modules would accomplish most of the same things for the end user.

Re:It works both ways, but it's worse for MS

[molnarcs]

What about securelevels? It was a long time ago since I used it, but mandrake had something like that. I assumed that it was similar to FreeBSD's securelevels, where securelevel 1 means:

1 Secure mode - the system immutable and system append-only flags may
not be turned off; disks for mounted file systems, /dev/mem,
/dev/kmem and /dev/io (if your platform has it) may not be opened
for writing; kernel modules (see kld(4)) may not be loaded or
unloaded.

See man (8) securelevel
This way you don't need to recompile the kernel if find out later that you need a module afterall.

Re:It works both ways, but it's worse for MS

[molnarcs]

I understand that rootkits are a problem but once someone has root you're out of luck either way...

Unless you run services in jails ... of course, if there is some serious kernel level vulnerability around the jail syscall, than you are screwed - but that doesn't happen too often :)

Re:It works both ways, but it's worse for MS

[Antique Geekmeister]

You cannot use vendor provided kernel modules, such as those from NVidia or for various USB license dongles, without loadable kernel modules. You could theoretically integrate their kernel modules into your own kernel source tree, and load them statically, but that's a lot of work and not a good idea for a typical home user of a Linux desktop.

Re:It works both ways, but it's worse for MS

[Toby_Tyke]

I haven't had the neccessity or motivation to learn Linux,

To configure Linux you have to be comfortable in its command line, and have a basic unix background so that you know what the commands are.

Your fist statement at least explains why your second is so wrong. As it happens, I do know Linux, and I hate using the command line (although I do have a Unix background too). I happen to think that everything you can do on the command line should also be possible in a GUI. I run Ubuntu. Number of times I resorted to the command line while setting up the system I'm typing this on? Zero.

I am going to continue avoiding linux until my customers start using it.

I would probably do the same in your position. Still if you do ever feel like experimenting, try the Live CD of Ubuntu. Promise you won't need a command line.

Re:It works both ways, but it's worse for MS

[amightywind]

I point out that the NYT has ridiculed New Orleans levee upgrades and pork barrel spending on their opinion pages in the past. I don't think they should opine the opposite view now that the levee gave way. Just because Fox pointed out the inconsistency does not make it any less factual. You may not like my politics. From your reply I deduce you are a leftist wimp. Effective moderation will encourage serious views from the left and right. It does not currently do that. Have a nice day comrade.

Re:It works both ways, but it's worse for MS

[Anonymous Coward]

"From your reply I deduce you are a leftist wimp. "

Is that better or worse than a rightist wimp? Or are they equally bad? Where do centrist wimps fall in to the picture?

Re:It works both ways, but it's worse for MS

[Anonymous Coward]

Less common ? You should really do a little reading on rootkits before you say things like this. Do words like LARK or Adore meaning nothing to you ? Rootkits for linux are lightyears ahead of their windows counterparts, and all the idiots running around praising chkrootkit really should get a clue. Running little magic scripts doesn't make your box secure,
especially when there are publically available rootkits that aren't detected by said scripts.

Re:It works both ways, but it's worse for MS

[jelle]

Good point, but /proc/kmem can easily be disabled too.

Re:It works both ways, but it's worse for MS

[jelle]

And that is exactly what the "Security Enhanced Linux policy enhancements" are for in Linux... see the other /. story...

Re:It works both ways, but it's worse for MS

[Anonymous Coward]

Because that won't stop an attacker that has root, and wants to install a rootkit, from modifying the list, and then rebooting to have it loaded to get his module in....

I'm not saying it's not impossible, but if you add code/features to do something to that effect, you'll have to do it right.

Re:It works both ways, but it's worse for MS

[Anonymous Coward]

If someone can make use of a Firefox hole, couple it with a root exploit, and put a kmod in /lib/modules, it's all over.

That's three things you have to do.

With Windows, many people are logged in as administrative users, so all you have to do is visit a web page with a vulnerable browser--only one thing.

This is why separation of accounts is a good thing.

Re:It works both ways, but it's worse for MS

[poopdeville]

The "Testing" version of apt-get does gpg checksums automatically (as long as gpg is installed).

Re:It works both ways, but it's worse for MS

[drsmithy]

[ ] Enable loadable module support, and build your kernel static

And don't forget to say goodbye to any vendor certifications after you do...

Re:It works both ways, but it's worse for MS

[Anonymous Coward]

This seems to be signatures of the release file and the individual packages, but not the individual programs that may have been replaced sometime after the installation.

Re:It works both ways, but it's worse for MS

[Dan_Bercell]

I actually have Ubuntu on both my notebook and workstation... and I can tell you that you need the command line to install things. (LiveCD may not require the command line, but if you ever want to install applications, you will need a command line). I think he actually meant to both install and administer via the command prompt. Hell half the apps I wanted to test out I had to compile myself...lol

I can just picture it now... Yeh to install that program just make a few directories, download and extract the source files from the ftp site, compile it, download the dependacies required... compile it again, then install it... simple as that.

You gotta remember that the avg user has the IT knowledge of a 10 year old, I have 4 years of programming knowledge + have been an administrator for 3 years and I have an incredibly hard time installing applications on Linux + still struggling with some. I will stick with it as I want to learn, but he has a point, Linux needs to be much easier to administer for the average user if I ever want to support it.

Re:It works both ways, but it's worse for MS

[Phroggy]

It complained of too many "junk" characters, even after I removed all of the comments and forward slashes.

Yeah, that's annoying. Someone else suggested you can post it in your journal, then post a link here.

The other ignorant thing getting on my nerves is the "feature" preventing posting too quickly. Yesterday it told me that it was an hour and 26 minutes since my last post and that I needed to slow down.

Obviously this is a bug. It's only supposed to make you wait two minutes after a successful post (and 20 seconds after clicking the Reply button) - which is still a little annoying, but in theory it cuts down on crapfloods.

What a load of BS - after all these years I'm beginning to think about dumping this forum as it's getting more and more crappy.

No you won't. :-)

Re:It works both ways, but it's worse for MS

[Nailer]

-keeping copies of /bin and /usr/bin on some ro media (either a CD or on a seperate server mounted ro), and checking them ageinst you're working copies regularly.

Back up /var/lib/rpm to some read-only media.

Boot of your rescue CD of choice, mount your hard disk, and run

rpm --dbpath /path/to/dbbackup --root /path/to/hd -V kernel coreutils net-tools procps

Modifying that package list as appriate for your Linux distro.

This is assuming your Linux distro actually uses RPM as its native format, rather than just installing RPM packages as the LSB requires.

Re:It works both ways, but it's worse for MS

[Toby_Tyke]

Which aplications did you need the comand line to install? Seriously, I'm very curious here. You say you're still learning, maybe I can show you how to do the job in a GUI.

Any apps you want from repositories can be installed via Synaptic. Fully GUI. Now it may be that you wanted an app which is only available as source, but frankly I could write a windows app and only distribute it as source code. That wouldn't be the fault of Windows.

Re:It works both ways, but it's worse for MS

[Anonymous Coward]

On other sane operating systems, like Windows, printer drivers ALSO run in user-mode, not kernel-mode.

And like always, if you run as admin/super-user on either system, generally speaking, you have rights to install kernel-mode or user-mode OS components. User-mode rootkits are dangerous enough anyway, but it would help to get the details right about each OS before you post.

Re:It works both ways, but it's worse for MS

[Dan_Bercell]

For me, Ive been trying to get Citrix installed and emule (amule for linux.. cant remember). Now the Citrix one has gotten me totally baffled..., as for amule, I cant find it in Synaptic, probably because the lists are way too large and the names are not clear. would it be so hard to

(Nice and clear, I dont need the version, build info in the name. Perhaps have a detail button)

Internet

- Firefox

- aMule

...etc

(most peopel who have been using Linux for more then 6-12 months may not find this hard, but I am %100 sure this type of stuff turns people back to Windows) instead of

amule.44.5..sds.c.xcx description

libForm.4.5.s.d.f.s. description

I dont know, XML has gotten so useful and powerful over years, I think Synaptic shouldnt be so hard to go through.

Re:It works both ways, but it's worse for MS

[Toby_Tyke]

OK, well, if you can't find amule (and assuming you have searched for it) it might be because you might need to add a few extra repositories, but you can do this via Settings --> Repositories --> Add in Synaptic. Try adding the ones listed here.

With those repositories, typing "amule" into Synaptics search box brings up two hits. Not exactly a massively unwieldy list. The top hit is titled "amule".

I assume that whatever Citrix software you are trying to install is supplied as source for Linux. As I said, that really is'nt a problem with Ubuntu, and there is simply nothing anyone in the Linux community can do to force them to change how they supply their software.

I fear not your rootkits!

[tsalaroth]

Because Windows has no root!

Re:I fear not your rootkits!

[AKAImBatman]

Right. We should rename them, "SystemKits".

(For those who don't get it, "System" is a login with higher privleges than even Administrator. There's nothing that System can't do. Just to brighten up your day, it's also the default user for Windows Services. Feel safe yet?)

Re:I fear not your rootkits!

[Tony Hoyle]

System (more accurately LocalSystem) can't access network resources.

So there is *something* that they can't do.

Try

at (now plus a minute) /interactive cmd.exe

voila! Interactive system shell!

Re:I fear not your rootkits!

[Anonymous Coward]

So THAT's why I can't kill its processes in task manager.. Stupid norton anti-virus has taken over my com@#$##$CXXX#RASD_.. NO CARRIER

Re:I fear not your rootkits!

[El_Muerte_TDS]

Crap, I renamed the user "Administrator" to "root"

Re:I fear not your rootkits!

[spellraiser]

True enough. Unless, of course, you consider Windows itself to be The Root of All Evil ...

Re:I fear not your rootkits!

[bheer]

> it's also the default user for Windows Services

Not true of NT 5.1 and 5.2 (XP, 2003). Most services run as 'Local Service' or 'Network Service' with differently grained privileges. System is still available for services that require it (including NT's crss and lsass processes).

Re:I fear not your rootkits!

[HaydnH]

True enough, roots don't have roots, and as we all know Windows is the root of all evil =P

Re:I fear not your rootkits!

[xtracto]

maaaan that rules =op.

It works, now I can run all the programs that where blocked in my computer whoa whoa whoa!

Thank you!

Re:I fear not your rootkits!

[AKAImBatman]

Fair enough. But the majority of Windows Services still run as "Local System". :-/

Re:I fear not your rootkits!

[Anonymous Coward]

Yes we have root: %systemroot%.

Re:I fear not your rootkits!

[kiwimate]

And that's why you apply a few simple security measures, such as denying LocalSystem access to CMD.EXE and other powerful utilities via NTFS permissions. You can do this to bring LocalSystem down to a level lower than Administrator, and virtually nothing breaks if you do it with a little bit of forethought. Yes, it takes a little bit of work to do the initial planning, but once it's done you script it and bingo. And there are plenty of examples on websites of sample lockdowns plus the scripts (using XCACLS.EXE, typically). Take those examples and customize them to your environment as needed -- you've saved yourself a whole load of the initial work.

You can open up these permissions on a system-by-system basis if really necessary, or even better just set applications that support it to use named service accounts. Cuts out a huge number of vulnerabilities.

You can secure a Windows system, and it's really pretty easy to do a lot of these things. You just have to know a bit of what you're doing and be prepared to put in the work. That's the biggest flaw in most MS administration shops: people who shouldn't be admins get lulled into a false sense of security because there's a pretty GUI and they don't understand what's going on behind the scenes.

Re:I fear not your rootkits!

[Chosen Reject]

I highly disagree. If windows is the root of all evil, that would make windows the root of all women.

note: check my sig.

Re:I fear not your rootkits!

[Anonymous Coward]

No -- you're thinking of women.

Women take time and money.

WOMEN = TIME * MONEY

Time is money.

TIME = MONEY

Therefore,

WOMEN = MONEY^2

And, of course, money is the root of all evil, so:

WOMEN = (ALL EVIL)^(1/2)^2

Or, in other words:

WOMEN = ALL EVIL

Women are all evil.

Q.E.D.

Re:I fear not your rootkits!

[Anonymous Coward]

> System (more accurately LocalSystem) can't access network resources.

Hahaha, I see you have little understanding of Windows.

System can load device drivers, and access ring 0.
System can do anything it wants, including working with any and all network connections already running, and grabbing any kerberos tokens present on the machine.

I grant you, it would take writing actual code.

Maybe you meant, System cannot access network resources as long as System doesn't do anything bad.

But, of course, if we assume nobody is bad, we don't really need security anymore now do we?

Re:I fear not your rootkits!

[schon]

There's nothing that System can't do.

Oh yeah? Delete a file when there's a read-lock on it. :o)

for those who don't get it, this is a fundamental problem with Windows - a file that's locked can't be modified or deleted. It's why you have to reboot after installing a service pack, or sometimes removing a virus.

Re:I fear not your rootkits!

[Anonymous Coward]

Unless, of course, you consider Windows itself to be The Root of All Evil ...

Correction: Windows is not the root, but the Administrator of all evil.

Re:I fear not your rootkits!

[nonsequitor]

The LocalSystem user is severely restricted. I was doing embedded development and wanted a headless device (no monitor or keyboard) to be able to install a printer as instructed by the Http Server accessed from a web interface, this service would have to go find the drivers from the printer server and pull them down and install them. All my prototype code worked flawlessly, then I tried to add that to a service which ran as LocalSystem and nothing worked. I was on the phone with MS Enterprise Support and after a week of raising hell with the lower parts of the heirarchy, eventually I actually got to speak with one of the guys that wrote the GDI. He said "We designed it not to work that way." and "I think the problem has too many constraints to be solved."

Eventually we had to create a new user for our service to run as and everytime it was invoked it would have to load the registry hive from LocalSystem and switch users. You have no idea how involved that process is to automate something which just works if there's a user logged in and running the program.

Re:I fear not your rootkits!

[jez9999]

And that's why you apply a few simple security measures

Why aren't these applied by default?

Re:I fear not your rootkits!

[erroneus]

I think "ServiceKits" would be what MS would prefer to call them.

Re:I fear not your rootkits!

[Orrin Bloquy]

::Wow, good thing this couldn't be dangerous or anything.
@echo off
call :GetTime hours mins secs hsecs
at %hours%:%mins% /interactive "C:\WINNT\malware\destroyHD.exe"
goto :EOF

setlocal ENABLEEXTENSIONS
for /f "tokens=5-8 delims=:. " %%a in ('echo/^|time') do (
  set hh=%%a&set nn=%%b&set ss=%%c&set cs=%%d)
  set /a nx=nn+1
if 1%hh% LSS 20 set hh=0%hh%
endlocal&set %1=%hh%&set %2=%nx%&set %3=%ss%&set %4=%cs%&goto :EOF

Re:I fear not your rootkits!

[pklinken]

"While root can do most things, there are certain privileges only a partner can grant."

Alan Cox said that i think hehe :)

Re:I fear not your rootkits!

[UOZaphod]

Actually, on Windows 2000 and later, services running under the local System account can access network resources, as long as the machine is a member of a Windows 2000/2003 Active Directory domain. It uses the credentials of the machine account, and authentication is via Kerberos only, so authentication will fail if the Service Principal Names are not registered correctly on both the client and server systems.

I've used this feature many times to run startup scripts (which run as the local System account) that download files or write logs to network shares.

Re:I fear not your rootkits!

[Nemith]

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\WINDOWS\system32>whoami
NT AUTHORITY\SYSTEM

Sweet

Re:I fear not your rootkits!

[mythosaz]

As you'll need administrative rights to schedule the AT job, your entire script is a useless waste of keystrokes that can simply be replaced with running the executable -- as you're already an administrator on the machine.

If you're not already an admin, asking the AT job to run in the near future isn't that impressive.

Re:I fear not your rootkits!

[jafac]

Even better, Task Schedler allows a normal user to schedule to run a Task as System.
(unless they patched that bug. . .)

Re:I fear not your rootkits!

[Dan_Bercell]

Doing that while running as a non-admin user wont do you much good.

Re:I fear not your rootkits!

[Dan_Bercell]

Same reason why Windows is more used then Linux, simplicity. Most IT people are over worked and have been dealing with this by using less security.

Re:I fear not your rootkits!

[thehesiod]

that's when you use process explorer to kill the file handle ;)

Re:I fear not your rootkits!

[Anonymous Coward]

As you'll need administrative rights to schedule the AT job

Did you try, or are you just talking out of your ass?

Re:I fear not your rootkits!

[Anonymous Coward]

Doing that while running as a non-admin user wont do you much good

Did you try, or are you just talking out of your ass?

Re:I fear not your rootkits!

[Dan_Bercell]

Yes I did try, 'Access Denied'. First I tried it has an admin, and it worked fine, created a new users, let it in the default group which is 'Users', logon on.. tried the identical command, with a different time... 'Access Denied' was given to me. By the way this was done on Windows XP Media (Basically Windows XP Pro with additional software installed). If I am doing something wrong pls let me know, as this little trick would be EXTREMELY useful to me...lol And no I am not talking outta my ass, I am typing with a keyboard, you?

Ask the UNIX folk...

[lpangelrob]

They've been dealing with rootkits seemingly forever. How did they manage?

No, seriously, I don't know the answer to this. :-)

Re:Ask the UNIX folk...

[Sam Nitzberg]

" They've been dealing with rootkits seemingly forever. How did they manage?"

tripwire - there's a commercial version available, and I've used the free version. Creates checksums to compare your system against...

A brief description here... (with download and install instructions)

http://www.cert.org/security-improvement/implement ations/i002.02.html

Sam
http:/// www . iamsam . com

Re:Ask the UNIX folk...

[Anonymous Coward]

1. By having a standalone system to boot and being
      able to set the meada to read only (via an
      electrical switch on the disk). This is the
      original method.

2. Bootable CD-ROM (equivalent to #1)

3. Volume analysis tools (similar to tripwire, with
      the program AND reference data on CD-ROM). A single
      scan could then be done carefully, if on-line; or
      better, when in single user mode.

Combine #3 and #2 gives you a very good check for a validated reference.

The important thing it to be SURE your referece is valid by building it from trusted sources (known good binaries from vendors, or inspecting and compiling the programs yourself).

Re:Ask the UNIX folk...

[tgd]

How does tripwire handle detecting something that inserts a kernel module which is working to actively hide itself?

Tripwire depends on the kernel to see the filesystem.

Re:Ask the UNIX folk...

[slavemowgli]

There's an easy answer: restrict what root can do. Other things that generally will help include:

• Use a "default deny" policy for *everything*
• Use secure OSes (OpenBSD is probably a good choice if you can't or don't want to use SElinux)
• Keep up with patches
• Ensure that evidence can't (easily) be tampered with (for example, use a remote, dedicated host for syslogging)
• Monitor your logs efficiently; in particular, employ a filter that allows you to suppress messages that are just noise (security-wise, that is) but that shows every log line it does not recognise (there are also filters which will try to do the reverse, but that means you'll risk overlooking important messages)
• Use hardware protection when available (for example, some (?) SCSI disks can be write-protected with a jumper setting - turn it on for the disks you have your /boot and / partitions on; if yours can't, boot from CD)
• Try to actively detect anomalies (for example, use Snort, tripwire and similar tools)
• Perform penetration tests yourself
• Be paranoid - none of your systems should trust any of the other just because they *your* systems

That's some general advice I can think of right now. None of it is specific to rootkits, of course, but if you do things right, then you most likely won't ever get bitten by something bad - and if you still do, you'll at least be able to keep the damage to a minimum and also find out afterwards just what led to the compromise in the first place.

Re:Ask the UNIX folk...

[DrSkwid]

The Unix folk - Ritchie, Pike et al ditched Unix and root years ago and made a new system plan9 (though Ritchie was, by his own admission, more a famous name than an architect in plan9 - though he did do the compiler)

Spending years being not-free as in beer, plan9 languished during the Linux FOSS years until belatedly being opened up for version 3

Then Lucent lost loads of $$ in the dot-com crash and wound down Bell Labs (such as taking out every other light bulb) and the staff retired or left (mostly to Google)

as Rob Pike said "Not only is UNIX dead, it's starting to smell really bad." - circa 1991

Re:Ask the UNIX folk...

[Jorkapp]

This is how rootkits are at least detected:

A rootkit has the ability to change the inputs and outputs of the overlaying OS API's. It does not however have the ability to change the I/O's of direct hardware access. Simple solution to detect rootkits is to do an API call for file directory (dir, ls, whatever), and compare it side-by-side to a direct hardware request for a file directory.

Re:Ask the UNIX folk...

[SatanicPuppy]

From my experience with windows, my mind boggles at the idea of trying to do something similar on that platform. Seems like every time I run windows update, some critical DLL ends up changed, and applications add their own specialized librarys with registry keys overriding the defaults.

Hell, half the time windows itself doesn't know what its installed. Every time I have to rollback a box from some semi-major patch, I cringe. I know something is going to break. If it's internal system doesn't keep basic track of what's installed and running (how many broken uninstall apps have you seen, which end up with you crawling through the registry trying to disable the damn software?), how the hell can you even know what to scan for?

I don't have the faintest idea of how to go about checking for a windows rootkit. What could you do? Take a drive image to compare against? That would never fly. Windows hides so many damn system jobs anyway, how the hell would you be able to spot one more?

The bulk of my windows security comes from running Snort upstream on the traffic that comes from the damn box, looking for traffic that ought not be there, and denying outbound from every port except ones I allow explicitly.

Re:Ask the UNIX folk...

[rabeldable]

How did they (the Unix folk) manage?

Do not install: P2PFreeMovies.exe and BritaneySperesNaked!!!.exe

and everything will be perfectly fine.

Re:Ask the UNIX folk...

[CaptnMArk]

"Direct Hardware Request" ???

Unless you are running a virtual machine and the root kit detector is running outside, this is not really possible.

Re:Ask the UNIX folk...

[TheRaven64]

Ensure that evidence can't (easily) be tampered with (for example, use a remote, dedicated host for syslogging)

The cheapest and simplest way of doing this is using an old line printer - that way you get a paper log, which can only be tampered with by someone with physical access.

I wrote some hints for people securing an OpenBSD install - if the default install isn't paranoid enough for you already...

Re:Ask the UNIX folk...

[andreyw]

1) That works fine within the confines of your home basement. You try telling your client that their webserver is coming because you need to crawl the filesystem looking for suspicious modifications. Electrical switch on disk? Go find me one - they don't exist. You could use a modified cable, if it's IDE. If it's SCSI or SATA, heh - no. 2) See 1. Amateurish. 3) Volume analysis is pointless. As many posters pointed out, half the time Windows doesn't know what goes on with it's core system files. Programs modify the registry left and right, programs modify/update system libraries at will. How does this help with rootkits that know better than to store themselves within files? Is your volume analysis smart enough to deal with mltiple file streams? Can it look beyond FS level and see if anything nasty is hidden in parts of the disk? If I was a rootkit developer I would put extra code within some NTFS administrative struct or in unused space. How about the MBR and the bootcode? Sure nothing is patching ntkernel.exe on the fly?

Re:Ask the UNIX folk...

[Anonymous Coward]

how about RootkitRevealer from http://www.sysinternals.com/

Re:Ask the UNIX folk...

[MPHellwig]

Ever heard of winternals or their freeware counterpart sysinternals?

Re:Ask the UNIX folk...

[Anonymous Coward]

The question was "What do UNIX people do".

Not "what do UNIX people do on Windows".

What I do on windows is ....
Nothing.

I don't use such a vulnerable system.

Re:Ask the UNIX folk...

[Loki_1929]

"Simple solution to detect rootkits is to do an API call for file directory (dir, ls, whatever), and compare it side-by-side to a direct hardware request for a file directory."

That's cute, except you're assumiung your active memory is safe. So long as I'm running in memory, I don't even need to hook the API calls to fake return data. Jamie Butler demonstrated a technique at this year's DEFCON for hiding an active in-memory rootkit using the TLBs built into modern processors. Good luck on that one.

Unless you plan to use magnetic extraction techniques in a cleanroom to look at every bit and byte of data on the drive, you're no going to detect high-end rootkits. The old format and reinstall trick is still the only sure way.

Re:Ask the UNIX folk...

[Decker-Mage]

Which is why when I doing something dangerous, like cruising the Blackhat underground, I use a virtual machine (or container) with a fresh snapshot before I set out. Handy beasts if you have the machine for it and the right level of paranoia.

You have to wonder...

[ellem]

Who has the chops to run through 800,000,000 lines of code to do the fixing of this OS?

I mean even if you find the problem can you honestly say you'd be sure you wouldn't leave Notepad.exe broken by making your changes?

Clearly Windows needs to be completely re thought with NO concern for legacy apps. See also OS X.

Re:You have to wonder...

[Anonymous Coward]

They have Virtual PC, they could pull it off probably just as well as Apple did for 'Classic', but they won't, and that's why Vista is still going to be bug riddled.

Re:You have to wonder...

[servo335]

Isnt that why vista is going to be a completly diffrent windows then it's predecessors? Wait this is Micro$oft i take that question back!

Re:You have to wonder...

[nocomment]

Clearly Windows needs to be completely re thought with NO concern for legacy apps.

They tried with Vista, and broke it more.

Re:You have to wonder...

[edwdig]

Clearly Windows needs to be completely re thought with NO concern for legacy apps. See also OS X.

But if they did that, why would you use Windows?

If you had to choose between Windows Rewrite, which isn't backwards compatible, Linux, and MacOS X, the appeal of the non Windows solutions is a lot higher than it is now.

Re:You have to wonder...

[j-cloth]

Sounds good in theory, but people are pretty brand loyal. How many Mac users jumped ship when they changed from Classic to OSX? 5?

Re:You have to wonder...

[http101]

I know it's supposed to be completely different, but I'm kinda wondering what 1337 group of h4x0r5 is going to be featured in this upcoming release - especially after seeing this article, "Windows uses pirated software?"

Re:You have to wonder...

[Luscious868]

Clearly Windows needs to be completely re thought with NO concern for legacy apps. See also OS X.

I wish Microsoft would but it will never happen. See OS X's market share.

Re:You have to wonder...

[rabeldable]

~ 40,000,000 lines of code in windows compare to the ~ 5,000,000 lines of BSD code.

Re:You have to wonder...

[Anonymous Coward]

I think the point he was driving home is "Most pre OSX users were happy with apple and that is why they followed apple to OSX, whereas most people using Windows if given the chance would jump ship."
With a non-backwards compatible Windows, I don't think there would be that much switching but it definetly would be more than currently.

On a personal note, I liked Mac OS 9 and was one of the people who did not like the transition to OSX. With that said I NEVER considered moving to Windows cause I have enough headaches of my own.

Re:You have to wonder...

[merlin_jim]

Well they rewrote it from the ground up for Windows Vista... and then did it again when they realised they were making the same old mistakes.

End result? About a 90% reduction in bugs per feature in the new Windows, despite a total rewrite.

Re:You have to wonder...

[Anonymous Coward]

...and even if they do and decide to skip all legacy stuff: Slashdot gets slashdotted due to excessive amount of "Micro£oft sucks because my pre nothing piece of junk isnt supported anymore" -posts.

Re:You have to wonder...

[Anonymous Coward]

Its really not even necessary to block out legacy apps, just put them in sandbox where they cant mess with the main system. Unix has user accounts, which when properly configured a bad program running under a non-priveleged account cannot mess with any of the system files. An installer which wants to modify the system files can be given a fake sandbox environment. Very little should be run as root. Preferably no program that takes data from no-priveleged sources, like data from other programs running under non-priveleged users or from sockets. No servers should be run as root at all, in my opinion. The only exception is ssh and sftp which needs to allow access to different users for logins, but in such case a handler server should be forked with the priveleges of the user being logged in to.

Re:You have to wonder...

[nocomment]

I got modded as troll? Microsoft even admitted this.

The Answer

[mysqlrocks]

Is the closed source code of Windows preventing us from actively defending our systems?

Yes. We are at the mercy of Microsoft to patch the systems for us. At least with Open Source you have potentially thousands of programmers looking for security holes and reporting those security problems.

Re:The Answer

[sqlrob]

Potentially != Actually.

How long was the plain text password in Firebird before it was caught? A year and a half? And that's not even something subtle as some buffer overflows, or that double free in zlib.

Re:The Answer

[insomniac8400]

But the reverse is true, you could have people going through finding exploits and using them without reporting them. Closed source is safer.

Re:The Answer

[mysqlrocks]

You make a good point. Yes, it is easier for the "bad" guys to find the security holes in open source software. This comes down to a question of trust. Do you trust that there are more "good" guys looking for security holes then "bad" guys? If so, then the "good" guys will catch the security problems before the "bad" guys the majority of the time. Speaking of trust, do you trust closed source software vendors to find and fix their security holes? If given the choice to fix a security hole that only they know about or add a feature that will help sell their software what decision do you think they will make?

Re:The Answer

[Anonymous Coward]

How so? Linux in itself doesn't provide you with any tools to check and get rid of rootkits, why should Microsoft? Checking for rootkits has nothing to do with sifting through source, it's got everything to do with monitoring processes and network connections and third party software developers know this.

Source code only comes into play when the subject is "hardening against rootkits", in which case your argument ("thousands of programmers") could be used as a sound counterargument ("thousands of [malicious] programmers")... it's a never ending debate. :)

Re:The Answer

[Anonymous Coward]

OpenBSD found the bug ages ago and patched their version. The firefox people didn't take the submission for political reasons (OpenBSD is not a supported platform).

Re:The Answer

[EggyToast]

I do wonder how much of that is simply that the users who can look at and understand the code don't have easy access to update the source.

Similarly, making the fix is different from making the fix and testing against what that changes.

I'm not saying that you're wrong, mind, as lots of people just like open source because someone else can look at the code and fix it. But I would imagine that viewing the source and using that as a basis for submitting bug reports back to the main group would be significantly more effective than "The program does this thing, go find it in the code and fix it please." And there might as well have been individuals who really cared about security who simply fixed it themselves and recompiled.

Re:The Answer

[edwdig]

At least with Open Source you have potentially thousands of programmers looking for security holes and reporting those security problems.

Open Source potentially has thousands of programmers working on the code, but also potentially as few as just the original author, or even zero if the author abandons it. Microsoft has thousands of programmers on their payroll working full time on their products.

Microsoft's problems come down to two things. One is the upper management insisting on integrating everything, hoping that once customers use one of their products they will use more of them. The other is Win32, which is horribly designed, but yet is the reason for their monopoly. The first problem won't change until you replace the executives with people content with coexisting with other companies, and the second will never change unless Windows at some point in time becomes irrelevant.

Re:The Answer

[anicca]

The logic of this statement is grating on my nerves but I can't seem to identify the fallacy. Malicious users can reverse engineer the closed source, find vulnerabilities that the company does not and just exploit them. Closed source is safer iff you can't reverse engineer it, otherwise its just an extra step. So the conclusion is false.

Denying the Antecedent

Any argument of the following form is invalid:

If A then B

Not A Therefore, Not B

Your argument:

If source is open hackers can easily find exploits. Not open implies hackers cannot easily find exploits.

So that's why there are so many linux virii and worms...whether the assertion is true or not is not supported by your argument.

Re:The Answer

[Anonymous Coward]

Neither closed source nor open source is inherently "safe". I'm no logic maestro but one could probably say "Software is unsafe by its nature". You can find exploits just by using software or guessing how it is written sometimes, without source available. Some people just spend a lot of time figuring these out (source or not).

Whether the source is available or not is not always the critical factor.

Re:The Answer

[LnxAddct]

Wow, ignorant. Closed source is not safer, anyone can still step through a program with a debugger, analyze its memory and find exploits. IE is closed source yet bugs are found all the time. ISS is closed source, yet many bugs have been found (more so in earlier versions than current versions). Closed source doesn't make anything more secure, it simply takes away your ability to easily manipulate and recompile the program. Getting the source code is like getting an architect's design of a building. You know exactly how everything is laid out, and how it works, but it doesn't mean you can get in. If the locks on the building are good, then the building is safe (metaphorically speaking). Closed or open has nothing to do with the security of a program, sure open source might allow more people to find exploits (arguably a good thing, because the faster they are found, the faster they are squashed), but closed source is not impenetrable by any means.
Regards,
Steve

Re:The Answer

[kbielefe]

You're looking at it the wrong way. Computer security by patching is analagous to physical security by gun. It's effective, but it doesn't protect you from the guy that sneaks up on you. Open source only has the advantage of a faster draw.

The power of open source in security really struck me when I read this article the other day: Securing an Unpatchable Webserver. The author's client had a mission-critical web application so tightly coupled to IIS 3.0 that IIS couldn't be upgraded without an expensive rewrite.

Microsoft refused to patch an exploitable hole in 3.0 and insisted on the client upgrading to 4.0 to fix the problem. Long story short, the author modifies open source app "snort" to filter out the exploit and the hogwash IPS is born. All along I'm thinking that if they had been using apache in the first place and ran into a similar problem where an upgrade would break their app, they could have patched just the security hole themselves without affecting any functionality.

I have done this myself when a kernel upgrade broke an application but fixed a security hole. I maintained my own linux kernel for a while with just security patches until the (closed source) app that broke released an upgrade. It took some extra work, but it was the most stable kernel I have ever had.

Open source has the additional advantage of being able to be recompiled to enable more proactive and effective security measures. It is a lot of work initially, but you can eliminate practically all exploits before anyone even knows they exist. You still want to patch because an attempted exploit can kill the server, but at least it won't let an attacker in and you'll know when there is an unpatched exploit in the wild.

Re:The Answer

[ppz003]

Do you trust that there are more "good" guys looking for security holes then "bad" guys?

Okay. What's the maximum number of good guys checking open source code? Who knows, but potentially a lot. What's the maximum number of good guys checking MS code? Just the employees.

What's the maximum number of bad guys looking at either code? Once again, probably a lot. Keep in mind many exploitable bugs are not found by looking at the code.

So I would say open source has a better chance of finding those mistakes before the bad guys do.

Re:The Answer

[evilviper]

But the reverse is true, you could have people going through finding exploits and using them without reporting them. Closed source is safer.

Source makes life a bit easier for those looking for exploits, but it's certainly not required.

However, for someone to FIX those exploits, source certainly IS required.

Closed-source is not safer.

Besides, Microsoft is open-source for anyone that has a truck-load of money at their disposal (or someone who breaks-in to a company that has licensed it).

Re:The Answer

[InsaneGeek]

Gotta say that not having access to update the source affect on finding security issues minimal. Just because once can't go and update the source, hasn't prevented the thousands of posts to the security lists out there, or emails to the source maintainer.

Windows Rootkit detection Tool

[republican gourd]

Shameless plug: I've written a script that should be able to help find any rootkits that are listening on tcp/udp on windows.

Heres the link

What it does is attempt to handshake with itself on every available tcp or udp port. If the handshake fails, that is an indicator that somebody else is already camping out on that port.

Source is GPL, feedback is always welcome.

Re:Windows Rootkit detection Tool

[Anonymous Coward]

What if the port is only opened for a brief moment by the camper? Say for only a packet or two.

Re:Windows Rootkit detection Tool

[Anonymous Coward]

These are rootkits, what if they replaced winsock?

Feedback = -1

Re:Windows Rootkit detection Tool

[Tony Hoyle]

OK so how is this different from netstat -an?

Listening on a port != rootkit. Windows listens on dozens of ports - some of which you can't switch off without crippling the system.

Mine's fairly locked down, and listens on:

TCP: 135,139,445,1025
UDP: 445,500,1026,1137,1138,1251,1900,2419,2420,3273,32 74,3275,3276,4500

And that's just the ones listening on 0.0.0.0...

Re:Windows Rootkit detection Tool

[ArsenneLupin]

OK so how is this different from netstat -an?

Netstat (and ps, and ls, ...) is often doctored by the rootkit so as to not show itself running.

The trick described would find still rootkits which hide by doctoring those common system utilities. It won't probably find kernel-module based rootkits that specifically look for that trick, but those are rare.

Listening on a port != rootkit.

But listening on a port where no currently activated legitimate service should be listening may be.

And that's just the ones listening on 0.0.0.0

Yeah, that's windows for you...

Re:Windows Rootkit detection Tool

[robogun]

What if the port is only opened for a brief moment by the camper? Say for only a packet or two.

Wouldn't a firewall (e.g. Zonealarm) pick up and/or block the outgoing traffic?

Re:Windows Rootkit detection Tool

[C0llegeSTUDent]

AFAIK, most modern trojans and rootkits avoid opening up a listening port altogether and use a reverse-connect mechanism. An open port hosted by "ignoreme.exe" is a red flag for anyone running a software firewall.

Re:Windows Rootkit detection Tool

[arkanes]

Even more importantly, a failed handshake on a port where netstat doesn't show a process is a near-certain indicator. If you combine with handshake with an actual connection attempt to a remote system, you should be able to detect any active rootkit (a rootkit in a dormant state would still be hidden).

Re:Windows Rootkit detection Tool

[Jessta]

Why would a rootkit listen for connections?
With the increase in firewalls between internal and extenal networks, NAT etc. there is hardly any point in making a rootkit to listen for connections.
Much better to make out going connections.
* rootkit'd pc makes connection to IRC server and joins #haxored
* botnet commander sends commands using IRC.
yay! etc.

The top three ways to stop a rootkit are:
* Don't web surf as Administrator.
* Don't run unexpected attachments to emails.
* Don't install software from an untrusted source(ie. don't pirate software)

These are simple rules.
They were known in 1995.
Ten years later and people still haven't learnt anything.

But I suppose good contraception has been around for 50 years and people don't seem to understand that yet either.
smoking causes cancer.
not doing exercise makes you fat.
quick fixes don't work

ok, I'm done.

- Jesse McNelis

Re:Windows Rootkit detection Tool

[makomk]

Wouldn't a firewall (e.g. Zonealarm) pick up and/or block the outgoing traffic?

Not if the rootkit binds to the network interface at a lower level than the firewall (i.e. traffic between ZoneAlarm and the interface passes through the malicious code, not the other way around). If it does that (which *is* possible IIRC - I think kernel-level/ring 0 code is required though) the firewall won't detect or block the traffic, because it won't see it.

Re:Windows Rootkit detection Tool

[Anonymous Coward]

A persistent outgoing connection (if they were lurking in IRC for instance), is still using an ephemeral port. You can't use a single port both for an incoming and outgoing connection, so that would still be picked up regardless of who initiated it.

Re:Windows Rootkit detection Tool

[ashridah]

This isn't actually as useful as it sounds. A few years back, I ran into someone who had proof of concept code for a kernel-module rootkit that analysed UDP packets that come in on the wire (don't even have to be for the right address, firewall didn't matter) that was able to force the system to do all kinds of things.

Of course, he ruined it by claiming this was a massive security hole in linux (it wasn't, it needed root privs to get in, natch, it was still just a rootkit.) It was also highly kernel specific. Running a non-stock kernel would probably screw over any would-be-kitter.

But long story short, one doesn't actually need a set of utilities listening on a random udp/tcp port in order to have a remote rootkit installed.
Using things like SELinux and friends to remove the system's ability to load modules (and deny access to root to modify /dev/kmem, etc) should help in this department tho.

ashridah

Re:Windows Rootkit detection Tool

[cant_get_a_good_nick]

Interesting, but doesn't solve the problem of port knocking. A rootkit would have kernel access, so would be able to set up a port knocking situation. You might be able to detect a certain subclass of exploits, but never be able to say you caught the full set.

Re:Windows Rootkit detection Tool

[Noaccess0]

Unless, of course the rootkit sees your app try to connect to the port and moves it's own listening port to another in it's predefined range.

Or it recognises the fact that this is trying to run, disables it, and presents correct looking output to the user.

Or it pops an appropriate looking dialog box up explaining to the user that hardscan.exe contains a virus and offers the choice of either deleting it or quarantining it.

In any case, it would capture Username and Password of the priviledged user used to access the restricted ports.

If you control the kernel or HAL, you own the box. Detection and prevention is nearly impossible without a secure, read-only point of reference that is compared in a method that doesn't use the kernel or HAL. Pretty hard to do that on Windows.

Re:Windows Rootkit detection Tool

[Jendi]

Windows listens on dozens of ports - some of which you can't switch off without crippling the system.

Very true, but it's worth noting that "crippling" your system depends strongly on which services you actually use.

You can turn off DCOM of course; if you don't need Windows file share and print then you can knock out ports 137-139 and 445. (SSH, WebDAV and HTTP works for me, pretty much).

I actually have port 135 (RPC portmapper) also not bound on my system, although the RPC service still has to be running of course ... I'm running Outlook Express, Firefox, Office and Visual Studio quite happily, and still waiting to see what I discover I've broken at some future point.

Windows can be a bit of a bugger for re-enabling port 135 if it feels like it needs it though.

And if it's so critical, why they won't let you just bind RPC only to 127.0.0.1 after all these years still bemuses me (apparently you can do this in Server 2003 but nothing else).
The answer "just add firewall" has always really unimpressed me from a security point of view.

Re:Windows Rootkit detection Tool

[speculatrix]

a failed handshake on a port where netstat doesn't show a process is a near-certain indicator. If you combine with handshake with an actual connection attempt to a remote system

This supposes that the rootkit doesn't intercept IP at a low level and only responds on stealthed ports to specific IP addresses. The rootkit doesn't even have to use TCP or UDP, it'd be possible to use a different protocol number in the IP datagram.

Basically, you need a NIDS box which passively sniffs the network to your server, and looks for any sort of traffic which doesn't look "normal" - this is hard to do.

As an example of the trickery that can be played with what looks like normal traffic, see ozymandns or nstx - tunnelling over DNS.

Re:Windows Rootkit detection Tool

[Anonymous Coward]

Most rants I usually find obnoxious or ignorant. Yours on the otherhand deserves the insightful. Why do people smoke and complain about their inadequete government not providing healthcare? Why does the drive-thru window at Taco Bell have 5+ cars all day? Can people really not get the connection???

Re:Windows Rootkit detection Tool

[Anonymous Coward]

not doing exercise makes you fat.

No. Eating more calories than you burn makes you fat.

Rootkit?

[Anonymous Coward]

*Root*kit for Windows? What an oxymoron. Baaaawhahahahaha.

It's about the money

[atgrim]

Short answer is Yes. The closed source of M$ *IS* preventing us from actively defending. AFAIK, M$ feels that they will get around to it or another company will step up to fill in the gap forcing us either way, to purchase yet another piece of software or the uber upgrade. Kinda like the insurance industry.

Joe Consumer: "Do I really need this?"

Co. Thug: "No, not at all. However, you never know when you may have an accident."

Re:It's about the money

[freshman_a]

The closed source of M$ *IS* preventing us from actively defending.

Defending against what? Rootkits? Linux is good 'ol GPL Open Source and there are rootkits for Linux. If open source is the answer, then why is that? Open Source != no rootkits.

Window's source code...

[east coast]

I have a question for the Windows developers out there...

Does Microsoft over share their code with developers?

While I am aware that MS does not legally publish their source code to Windows I do recall at one point that Microsoft did share some sections with a focus group of developers. It would only make sense that MS would share code with the big anti-virus firms in order to ensure a better product for their customers.

But I could be wrong about them sharing source with anyone.

Re:Window's source code...

[bushidocoder]

Yes, Microsoft has a Shared Source program. I'm not 100% sure of the exact requirements to join the Shared Source program (you could look it up on their website I'm sure) but the requirements are fairly hefty. You have to sign some pretty thorough NDAs, of course. To the best of my knowledge, an individual acting by themself rarely gets access, although I'm pretty sure that several book authors got access to Windows source. Companies can gain access, but they normally have to pay for the priveledge (if you recall the Win2k source code getting lose a year or so back, that was on account of a company that had purchased a liscense to the code losing it). A large number of Universities have access to the code, as do governments and government contractors.

Re:Window's source code...

[Anonymous Coward]

http://www.microsoft.com/resources/sharedsource/li censing/windows.mspx

Re:Window's source code...

[Anonymous Coward]

You got your facts mixed up. MS does *not* release windows code. Not even to developers. Their "shared source" program is basically some of their open source projects (if you can call them that), though their licence is still quite restrictive and totally incompatible with other open source licences like the GPL.

Re:Window's source code...

[bushidocoder]

I'm afraid you're incorrect - Microsoft does in fact make the code to just about every Microsoft product (including Windows back through 95 I think) available on a very limitted basis.

http://www.microsoft.com/resources/sharedsource/li censing/windows.mspx

It is NOT open source, and shouldn't be confused with that. But it does allow direct readonly access to Windows source code.

Re:Window's source code...

[Anonymous Coward]

I stand corrected. Seems they do allow reviewing and debugging of windows source to select individuals.

SysInternals'

[wumpus188]

.. RootkitRevealer is your friend.

Re:SysInternals'

[ZyBex]

I recently cleaned a machine infected with a rootkit that was NOT detected with Rootkit Revealer. The virus loaded itself via the HKLM/Soft/MS/Windows/Run key, as usual, but it didn't show on regedit nor elsewhere, and the Rootkit Revealer did not detect the "missing" key. The only way to see and remove it was to boot with a WinPE CD.

Fortunately these rootkits can usually be detected by their side-effects, like the slowness and the internet activity... but you have to be suspitious that something's going on.

Re:SysInternals'

[EvilMonkeySlayer]

I think the best way to detect a rootkit is to simply put something between it and the internet that can log net traffic, say a router or somesuch.. course, you'd have to make sure the router hasn't been exploited too... :)

Oh, here's a useful tip for people.. there is a cheaper alternative to WinPE.. BartPE, it requires Windows XP to build the bootable cd but in terms of usefulness it's a nice little life saver.
Can also be extended with Ultimate Boot CD (UBCD).

Re:SysInternals'

[Avohir]

Are you sure it wasn't just hidden by the buffer issue thats known to exist in regedit.exe?

zipzappromos does this, as well as a number of others. No rootkit, just an exploit in an OS flaw

Re:SysInternals'

[Anonymous Coward]

It could also have been put there by using the NT Registry calls directly instead of the RegOpenKeyEx ones.
There's a demo on the SysInternals website somewhere about how to do this.

Re:SysInternals'

[Anonymous Coward]

Ah yes, the favored \0 byte in key name. Works every time.
Hint: you can see the key and read it, but not write to it or delete it.

Re:SysInternals'

[ZyBex]

Yep, I'm sure. The registry entry pointed to a file in System32 that was invisible in explorer, dos boxes, or any other file browsing method, so it wasn't only the missing registry entry. Plus, the process did not appear in the task manager (neither with Sysinternal's Process Explorer). There were 4 hidden files in total, plus a few registry entries. The file names are "MrJynFlec.exe" (my caps), plus others called "mrjynflec.dat" and similar, which appear to be encrypted keylogs. The executable is also encrypted. I find no reference whatsoever in Google to this filename; it might be a random filename, I don't know. I might try to decrypt it in a VMWare box...

I have the rootkit files with me. I meant to send them to Symantec/Trend/McAfee, but last time I did that they took about 10 days to identify the [new] virus :-/ Not good.

Re:SysInternals'

[Billly Gates]

Worse I have seen rootkits hide on MBR's so even a reformat or restore won't get rid of the spyware that cripples the system.

I know about the fdisk /mbr but I work doing tech support by phone for my isp and Dell or HP always tells them to call AOL (us) to fix the problem because its our anti-spyware program that should delete it. I could lose my job if I tell a user to type fdisk /mbr for liability reasons since its not our software. Its so fustrating and a rootkit to me qualifies as evil as putting itself in mbr section of the hard drive. You can't trust anything in a rooted system since all you see is what the spyware maker wants you to see. Obviously this is getting insane.

I am waiting for smarter rootkits that hide what tcp/ip usage to stop programs like snort from detecting itself. As it is no anti-virus program can remove a rootkit if the os lies to it.

The whole situation is a mess and 80-90% of our callers are users running spyware and wondering why their connections are so slow. Its hurting our company and the whole IT industry.

Re:SysInternals'

[mythosaz]

So. Send them anyway.

If the process is running, it can always reinject itself. Especially if it's someplace hidden like AppInitDLLs that you can't actually see from regedit. Shouting "It's a rootkit! It's a rootkit!" while you have no idea how it works isn't exactly helpful.

Re:SysInternals'

[abrinton]

Does anyone know of a CD boot distro that is forensics specific? Seems like booting off a knoppix type distro with scanning tools would be a good way to find rootkits.

Re:SysInternals'

[lachlan76]

Knoppix STD sounds like what you want, although I think Knoppix would have chkrootkit on it.

Re:SysInternals'

[Avohir]

submit the files to http://virusscan.jotti.org/ they submit it to the competant anti-viruses (read: not symantec and mccaffee), and more than likely one of them will already detect it and tell you what you were dealing with

Re:SysInternals'

[Anonymous Coward]

RootKit Revealer is not the be all and end all. In fact It really only detects the HackerDefender rootkit.

UnHackMe is a nice program that will rid you of rootkits.

And now for something completely repetitive...

[menorikey]

This topic has been beaten to death a thousand and one times before but the reality still holds true: as long as a company holds the source of their software to their chest, you simply have to rely on them to provide the security for said software. By doing so you create the equivalent of a single point of failure that has to be addressed solely by the holding company, and as a result, you are subject to the "hurry up and wait" syndrome that accompanies it. That's when it comes back to "suck it up or don't use it," which carries all the arguments of "we don't have a choice" or "switching isn't an alternative for us."

Re:And now for something completely repetitive...

[Anonymous Coward]

/me splashes menorikey playfully with his tail.

MS(ux) for a few reasons, this is just one of them

[jeremy111]

Let us not forget the wonders of ActiveX controls not to mention IE's ability to install items with out authentication. As far as that is concerned ANY installer should have to be authenticated as an ADMINISTRATOR before the install can proceed. I think this small step would curb many of the issues with spyware, adware, toolbars, etc.

Sysinternals...

[traveyes]

has a "revealer" and a great write up

Sysinternals RootkitRevealer

The problem is bad design

[bluesguy_1]

Closed source is the problem? Maybe. Bad design is the problem? Definitely.

It's well known that the *nix operating system model is more secure by default, through good design. Now, having said that, any operating system (even Windows) can be made secure, but how much work does it take to overcome bad design?

Re:The problem is bad design

[Anonymous Coward]

I would have agreed with you, had you said "widely believed" instead of "well known".

Re:The problem is bad design

[LittleBigLui]

Actually Windows NT was designed to be more secure than Unix.

Somehow everything got messed up though.

Re:The problem is bad design

[RevDobbs]

It's well known that the *nix operating system model is more secure by default, through good design.

Oh, I get it... you're shooting for that +5, Funny, right?

Re:The problem is bad design

[Noaccess0]

/sarcasm on

Yeah, something like this could never happen on *nix... I wonder why they call it a root kit anyways?

Wrong question!

[Ingolfke]

Is the closed source code of Windows preventing us from actively defending our systems?

The right question is what is the vendor (Microsoft) doing about it. You purchased a product from a vendor, you should expect them to solve problems with that product or explain how to properly secure it, or just ignore the issue which says something about their product and commitment to support.

Re:Wrong question!

[Jarnis]

Purchased...?

Warez jokes aside, most common non-corporate windows are OEM copies. OEM = no support from microsoft. You get your pile of bytes that might or might not work, and you get some patches at the whim of MS. You get no support unless you pay thru the nose per incident.

Sure, you can call your OEM supplier - however, they have no access to the source, and generally just tell you to reinstall the thing and immediately tell your system is unsupported if you actually install something other than the supplied bundled software on your system.

Re:Wrong question!

[XNormal]

Is the closed source code of Windows preventing us from actively defending our systems?

Apparently it isn't an obstacle to the rootkit writers. Why should it be any more of a problem for someone writing a rootkit defense system? Most Windows system programmers are pretty used to soft-icing into windows code by now.

Re:Wrong question!

[Florian Weimer]

You purchased a product from a vendor, you should expect them to solve problems with that product or explain how to properly secure it, or just ignore the issue which says something about their product and commitment to support.

Uhm, a rootkit is third-party software. If you install it and it causes problems, you must ask the ISV from whom you obtained that software. Same as with any other type of program from ISVs.

Re:Wrong question!

[Donny Smith]

>you get some patches at the whim of MS.
Whereas you implement your Linux patches based on stuff submitted to kernel mailing lists (and you lose all support rights that you might have had from RH/SLES, your h/w vendor and you app vendor)

> tell your system is unsupported if you actually install something other than the supplied bundled software on your system.

As opposed to Red Hat EL and Novell SLES which... oh, wait!
And it's not like HP or IBM will debug RH or SLES for you just because it's open source (unless what you're buying is a zSeries box, then they'll ask their Linux partner to fix it or else they'll suggest the other Linux vendor).

No matter what OS, if you do your own thing, you're on your own.

Re:Wrong question!

[jafac]

No. I expect Microsoft to allow a third party company to take the risk to develop the technology to fix it, establish a market and a user base, then either buy the company outright, or build the same tool (same basic functionality, barely good-enough), and bundle it with the OS, putting the third party company out of business.

I simply don't know why Microsoft has allowed SysInternals to live for so long. Distracted by Linux?

Re:Wrong question!

[Dan_Bercell]

Perhaps you should take a quick look through Microsofts technet or msdn site (a long look would take a few months) and then come back and tell us you cant find ways to secure a Windows system. This is just information from MS, there is also an abundant supply of blogs, white papers, technical articles, forums, and newsgroups out there that while also help you. Considering the relativly cheap cost of Windows, especially if gotten from an OEM, what do you expect them to do? You can purchase a truck for $50k... someone breaks your window, hot wires it and drives off. you find that truck a few days later in a ally... take it back to Ford and demand that they improve the security? What do you think is going to happen?

Re:Wrong question!

[evilviper]

Warez jokes aside, most common non-corporate windows are OEM copies. OEM = no support from microsoft. You get your pile of bytes that might or might not work, and you get some patches at the whim of MS. You get no support unless you pay thru the nose per incident.

Okay, *MOST ARE* OEM copies, but these problems apply to ALL COPIES, including those non-OEM copies that were bought for the full retail price. You can't just screw them over.

Sure, you can call your OEM supplier - however, they have no access to the source, and generally just tell you to reinstall the thing

Good, then sue them. They will, in-turn, sue Microsoft. It all works out perfectly!

The fact that your OEM sold you a product they can't really support (to save money) does not relieve them from their legal responsibility to do so. Sure, they can tell you to reinstall, and you can say "Hell no! Fix it!". Or you can reinstall, call back in an hour when it's been re-infected, and THEN tell them it isn't possible for you to re-install constantly, and they damn well better come up with a solution. ...and shortly after would be a good time to sue.

Re:Wrong question!

[Jarnis]

... at which point they dig up the mile-log EULA of Windows. And say 'tough luck'.

Strider ghostbuster...

[nweaver]

Strider Ghostbuster,, a Microsoft developed technique for detecting all persistant and stealthy rootkits .

Just convince Microsoft to make it available.

There is also SysInternal's Rootkit Revealer, which although not quite as general, is still hard to fool.

Re:Strider ghostbuster...

[Anonymous Coward]

Exactly! I was going to post this exact same thing, but you beat me to the punch. Mod this UP!

Re:Strider ghostbuster...

[Anonymous Coward]

Not to bash, but I smell a rat when anyone say's that something's foolproof. The very nature of a rootkit is that it interfeers at the loest possible level, there for if the scanner can read it, the rootkit can modify it (down to tinkering with the disk drive driver if needs be). If push comes to shove, the rootkit can just rewrite parts of the kernel memory to hide itself.

As for the process table hack, it should be pretty easy to move the process forward and back in the process stack (in a critical execution zone to prevent process switching) which would fool even the MS process scanner.

Re:Strider ghostbuster...

[Anonymous Coward]

Sure, they'll make it available 3/4 of the way thru the software cycle, and for only $999.

Re:Strider ghostbuster...

[Anonymous Coward]

This is exactly what Ghostbuster was designed to catch. It is a two step process that runs on a bootable CD. The first step runs within the OS and performs a full scan of the system. This is recorded. Then the system is rebooted and the OS on the CD is loaded which performs a second scan. While the scan performed within the OS can easily be faked by the rootkit, even to the point of faking what drivers tell you, since the OS booted from the CD is clean it will find discrepancies and report them.

You're absolutely right about one point. There is no 100% way to detect that the system was compromised from within the system. That's why Ghostbuster also scans from outside of the system. Very simple design, brilliant idea.

Re:Strider ghostbuster...

[Anonymous Coward]

While the scan performed within the OS can easily be faked by the rootkit, even to the point of faking what drivers tell you, since the OS booted from the CD is clean it will find discrepancies and report them.

While true, the boot environment isn't a sanitized version of the original. Lots of differences. You'll still have to know how to analyze the data and what are false positives vs. real issues.

Re:Strider ghostbuster...

[Raxxon]

It's a load of crap. The first page tells you this.

They're doing something that has been done manually by others (which automation of this would be helpful) which is to compare a dump of the drive's contents (dir /a /s /p > lie.txt or ls -laR > lie) with a dump of the same filesystem when the system is booted from secure media. If things (other than the expected "Known Microsoft Hidden Files") pop up, we can then examine those on a case-by-case basis and bingo, instant Rootkit on a pike.

The ONLY thing I'll give them credit for in this case is working on a way to automate the search. I've done this before by hand and it is QUITE a pain in the ass.

Re:Strider ghostbuster...

[evilviper]

UBCD4WIN now comes with RootKitty (freeware).
http://www.ubcd4win.com/forum/index.php?showtopic= 2424

As for shareware rootkit removers, it took about 30 seconds for me to find these:
http://www.diamondcs.com.au/processguard/
http://www.greatis.com/unhackme/
http://www.wenpoint.com/product/product.html (HiddenFinder)

The big problem with MS-ware is the closed API

[Baldrson]

The problem with MS-ware isn't so much that its closed-source as it is that it's closed-API. The Federal Trade Commission should have acted in the early 1980s to force MS to open up the API it used and rigorously check that no application level software was written to any new calls in advance of the public disclosure of those calls. Monkeying around with things like the packaging of things like the web browser as though that was dealing with the heart of the MS monopoly issue is just stupid.

If the API were opened up not only would it have made it possible for someone to do a work-alike competitor to Gates's natural horizontal and vertical monopoly, it would have made open analysis of the potential security holes practical so that insurance companies could get into the business of software quality assurance -- which would have dramatically raised the quality of software professinals and computer security.

Re:The big problem with MS-ware is the closed API

[bill_mcgonigle]

rigorously check that no application level software was written to any new calls in advance of the public disclosure of those calls

Yeah, but that still wouldn't help in this case as the administrative tools probably wouldn't count.

Re:The big problem with MS-ware is the closed API

[RAMMS EIN]

That sounds just like what I said in my essay The Importance of Interoperability. Maybe you have some insightful comments to add to it?

Why hasn't Microsoft addressed this earlier?

[haruchai]

After all, they launched their much-touted Secure Computing almost 4 years ago.
I guess that a complete redesign would be needed but that might break backward compatibility.
Of course, some of this might be addressed in Vista but that will leave a lot of older computers out in the cold.

Re:Why hasn't Microsoft addressed this earlier?

[sqlrob]

They're already leaving older computers in the cold by requiring TPM (assuming that doesn't change by release)

under attack

[andrewzx1]

I administer a network with about 50 workstations. We run Windows2000 with Symantec Anti-Virus Corporate (aka Norton). Symantec registered an internal attack by a root kit only two weeks ago. This stuff is in the wild now!

Re:under attack

[HermanAB]

Uhmmm, actually you are only aware of it since two weeks ago. How long the attacks have been going on, or whether or not you are already infected with a rootkit, is unknown. A rootkit that isn't used much, except to find and download the CEO's email once a month, may go undetected for a long time.

Re:under attack

[andrewzx1]

That's not correct. Symantec has the realtime file protection which monitors filesystem access and profiles against its list of known "pathogens". Symantec successfully diagnosed and prevented a rootkit installation. It prevented the installation.

Re:under attack

[HermanAB]

You said it: "known pathogens".

Now think about "unknown pathogens" for a minute.

Only the paranoid will survive...

Unacceptable for national defense

[keraneuology]

Since Bill Gates became the 2nd largest stockholder in Newport News Shipbuilding and guaranteed that the Ronald Reagan class of aircraft carrier will be Windows 2000 based, how does the Navy deal with this issue? Or have they addressed it at all? The last thing we need is for just one person in that population 5,000 floating city with malicious intentions to pop a rootkit into the mess that is navigation, fire control or general operations.

So we are left with two options:

a) Windows 2000 is impervious to rootkits, either off the shelf or through modifications unavailable to the general public

b) The US Navy is running an unsecurable OS for the most advanced surface ships in the world - with nuclear reactors to boot.

Re:Unacceptable for national defense

[mat1t]

They just don't plug it into the network! If it's not network accessible, the only method is local interaction.

If you're already in the Fighter Jet, whether there's a rootkit or not will be the last concern on the military's mind.

Re:Unacceptable for national defense

[m50d]

a) Windows 2000 is impervious to rootkits, either off the shelf or through modifications unavailable to the general public

I'd imagine they'll be running it with the TCP stack removed, like it was for security classification.

Re:Unacceptable for national defense

[drsmithy]

c) They are neither with us, nor against us, but looking after their own interests.

Re:Unacceptable for national defense

[Anonymous Coward]

Nice +5 Interesting FUD, but in truth none of the systems you listed is (or will be) Windows based.

Windows *will* be used for the Office and Administrative (OA) LAN.

I'm consistantly disappointed how little respect slashdot gives the military.

Re:Unacceptable for national defense

[Bastian]

For the absolutely critical stuff, this may be an option, but I would be amazed if I were to learn that the military designs their large ships such that few to none of their computers are able to talk to each other electronically. And I'm simply not willing to believe that, in the year 2005, 36 years after the initial deployment of ARPANET, the US Navy still hasn't discovered how incredibly useful it can be to network computers together.

Nor have I ever heard of anything like "schlepping TCP packets stored on removable media back and forth across the boat detail."

Re:Unacceptable for national defense

[Anonymous Coward]

And I'm simply not willing to believe that, in the year 2005, 36 years after the initial deployment of ARPANET, the US Navy still hasn't discovered how incredibly useful it can be to network computers together

If you're not willing to believe that, perhaps you'll believe that not everyone in the Navy is a flipping idiot. Or perhaps you'd believe that the Navy has already dealt with issues like this before and has decided that it might not be such a bad idea to segregate networks. Last I heard that's how it was in Cheyenne Mountain -- there's a general office LAN that's connected to the internet and then there's a completely separate network for the machines that store all the ultra secret stuff. I've never seen a rootkit that can walk across the floor, break into a safe, and install itself onto a hard drive that's been pulled from a machine for the night. Have you?

Re:Unacceptable for national defense

[Bastian]

I'm not saying that there isn't some crazy good security architecture, including separate networks for separate systems. And I do believe I mentioned keeping absolutely critical stuff cut off from the world in the first two clauses of the first sentence of the flipping grandparent post.

But a rootkit taking down even some piddly general-purpose office LAN but not being able to touch anything else is still a serious problem. Last I heard, there is very little that goes on on a battleship or carrier that you can readily dismiss as unimportant.

These guys need to be using a real secure envrionment for their computing - not Windows, not Linux, and I have my doubts about the likes of OpenBSD.

Re:Unacceptable for national defense

[Fujisawa Sensei]

The software on the HD in the safe isn't running the ship.

With modern day millitary messaging systems, It wouldn't surprise me if every system on the modern aircraft carrier were networked. And all you have to do is breach one system. Once you do that your secret/secure network is just another flipping network. Except the people maintaining the systems are expecting someone else to keep their systems secure.

Re:Unacceptable for national defense

[Andrewkov]

It's also conceivable that there are uses for computers on a warship besides desktop workstations. Many such uses wouldn't require any network connectivity..

Re:Unacceptable for national defense

[Anonymous Coward]

Don't be surprised. /.ers are mostly very young, self indulgent, spoiled brats without enough life experience to have formed a usefull opinion of anything.

Re:Unacceptable for national defense

[chooks]

- with nuclear reactors to boot.

Damn! Why weren't these part of the 34 PSU's that Hexus reviewed???

Re:Unacceptable for national defense

[Anonymous Coward]

I'm suggesting that they're not all networked to the same network. And the ones that are on the really important network (read: The one that controls the ship, not the one that lets the sailors check their GMail accounts) have been locked down to the point that the people that log into those machines can't even change the f'ing desktop background. And they don't include any removeable media drives. And the system policy has been edited to prevent loading files from USB mass storage devices.

You can lock down Windows. The reason it doesn't happen on home and general office machines is that it's then a pain in the ass to use for stuff like installing software, listening to your iTunes music collection, etc. That is not an issue with what is essentially an embedded system.

Re:Unacceptable for national defense

[Anonymous Coward]

I don't know how it was implemented, in this case, but you could, easily, make the OS immune to root-kits [that weren't there to begin with] by making the installed OS image Read Only (e.g. OS image burned onto a DVD, swap files hosted on HD).

For the exceptionally paranoid, use multiple redundancy:: use **2** DVDs to store the image files for the complex OS, and run a byte-by-byte comparison between the boot image and the backup... through a trusted system.

Re:Unacceptable for national defense

[Anonymous Coward]

The grandparent is just ignorant; the Navy certainly networks together computers on carriers (and on many other types of ships). The combat control center is the heart -- or mind? -- of many networks, internetworking.

There are automatic fire control systems networked into it, so the danger is hardly just to propulsion and life support -- the danger also involves weapon control.

Re:Unacceptable for national defense

[codepunk]

I don't know what navy you where in but in the one I was in (US) there are no mission critical windows systems unless you are talking about word processing or email being a critical function. All mission critical systems are either some sort of unix and or custom stuff.

Re:Unacceptable for national defense

[PeterBrett]

I don't know how it was implemented, in this case, but you could, easily, make the OS immune to root-kits [that weren't there to begin with] by making the installed OS image Read Only (e.g. OS image burned onto a DVD, swap files hosted on HD).

It's not the OS image on the hard disk that counts, it's the OS image that's currently loaded into memory. Now think about how that applies to systems that are rebooted less than once a year.

Re:Unacceptable for national defense

[Bastian]

You can lock down Windows well enough for business networks. But I would suggest that anyone who thinks that you can lock the unmanageable combinatorial explosion that is Windows down enough to make it suitable for anything on a Reagan-class aircraft carrier that might be considered "important" needs to read up on Windows a bit more.

Eight levels of TCSEC computer system security specifications, and nobody has succeeded in making a Windows-based system that met the minimum level except for Microsoft, who did it by making heavy modificatoins to NT4, and could still only make it by not having the thing networked, if I remember right.

Re:Unacceptable for national defense

[Anonymous Coward]

The last thing we need is for just one person in that population 5,000 floating city with malicious intentions to pop a rootkit into the mess that is navigation, fire control or general operations.

I saw a documentary on how to deal with this. It featured some guy named Adama. Quite instructive.

Re:Unacceptable for national defense

[keraneuology]

Time to dust off the clue by four - remember theYorktown?

Don't want to learn from history? Let's go straight to the source:

"The software will run the bulk of the command and control systems in the three "decision centers" being designed into the CVN-77s architecture" - Brian Roach, Lockheed Alliance manager for Microsoft Federal.

Re:Unacceptable for national defense

[Anonymous Coward]

This is an easy problem to solve: just put up a big sign that says "DO NOT USE INTERNET EXPLORER ON THE SHIP'S NAVIGATION AND TARGETING COMPUTERS".

Oh, you were serious? Well, in that case I recommend you show me an OS that is impervious to rootkits so that I can tell the Navy about it immediately. You are aware that they are called ROOTkits because they originated in Unix where "root" is something meaningful to acquire, right?

This is an embedded system, and does not have to worry about midshipmen running BritneySpearsNaked.exe on it. Most embedded system OSes (like VxWorks or QNX) have very little or no memory protection at all. Why? Because they're closed systems where all software is debugged before it's shipped. Why should the OS that runs the navigation computer be any different?

dom

Re:Unacceptable for national defense

[Decker-Mage]

I can't talk about it much as the NDA they had me sign involves a prison term ;-). However, those Win'2K boxen aren't connected to the fire-control systems nor navigation, nor much of anything else and even if they were, they wouldn't get anywhere. That Windows Rootkit would have to be able to grok something like a Sperry/Univac or a custom embedded processor system (which is what all the nav systems use btw). You'd have to quite literally be proficient not only at the engineering level with the various systems as well as Win'2K and establish a cross-connection between the two. If you are that good it'd be far easier to just RootKit that Sperry/Univac itself. And yes, even the new ships are using systems that old. They take them out of older, decomissioning ships and install them in the new ones. The US Navy hardly ever throws anything away and most all of it is proprietary to a fare-thee-well and unless you are a hard-core engineer (moi), you won't know how it really works, or how to reprogram it anyway.

Now that isn't to say you couldn't play havoc with other subsystems on the ships since the supply and stores inventories, electronic copies of service and health records, even the 3M (Maintenance Management, i.e. preventive maintenance) system are kept on those boxen but that isn't the same thing as crippling the war-fighting capability of the ship. We do have paper copies for everything if the computers go tits up or give us odd results. Heck, for the most part, everything is done on paper anyway then it is entered into the computer. I tilted against that windmill many a year with no success.

The US Navy is one of the most conservative, i.e. old-fashioned sense not political but somewhat there too, institutions on the planet. Change is positively glacial unless you can convince your superiors that it will make them look really, really good. That's the only way I got anything done.

Re:Unacceptable for national defense

[Decker-Mage]

While I was in the US Navy and onboard a ship I worked on every system on the ship except the pumps in pump alley and the sewage plant due to my background prior to joining and extensive engineering training. Except for the main computer, every one of the systems used a custom embedded processor and operating system, if you could call what they had an OS. The main computer used a custom OS as well, not even a form of Unix. Heck, one of the computers was still programmed using paper tape! It was only when you got to the administrative computer(s) that you encountered more pedestrian operating systems that a mortal might be familiar with.

But can antivirus companies be too good at it?

[pasword ***]

I mean, if by some wonder rootkit detection became too good (like some av products that can list virus/variants not in some sort of db) some goverments/agencies/bofh can be serious mad about it, after all those sort of detection can prevent "wiretapping" a computer. (In a short range when you know were the computer are there are always other ways...)

Re:But can antivirus companies be too good at it?

[caffeinemessiah]

Perhaps you should put the bong down now....

Wow, what a dumb question...

[NIN1385]

So the problem is serious, and well outlined by this question: Is the closed source code of Windows preventing us from actively defending our systems?

YES!!!!!!! that is all...

Re:Wow, what a dumb question...

[IbeUID0]

Yes, it's a dumb question, but not because the answer is wrong.

It is a dumb question because:
1. It treats an assumption as a fact (the problem is serious)
2. It assumes that open source is any better for rootkits
3. It assumes the only active defense is related to rootkits

All wrong, or not proven facts. The problem may or may not be serious. Most Windows rootkits aren't rootkits. They don't patch the kernel, but simply hide processes from the process list and netstat. That's analogous to patching ps/ls/netstat on a *nix box. Like *nix, there are plenty of other tools out there to get this information. The ability of *nix rookits to modify the kernel itself is much more of a danger.

Windows being closed source code has nothing to do with rootkits. It's simply a lack of information for both the good guys and the bad guys. Hence, it's a lose/lose. The ability to build a kernel that CAN'T support loaded modules is a big advantage to *nix, but that has nothing to do with *nix being open source.

One can actively defend their windows systems against rootkits. Use file integrity checkers like tripwire. Use distributed log consolidation servers - they had to get in somehow before the kit got installed, and a rootkit won't wipe log entries on another server. Use other tools from sysinternals and other places to look for hidden processes and files. Heck, install cygwin for crying out loud and use ls/lsof!

So yes, it is a dumb question. And the answer is - "ask the right question - why can't we customize our windows kernel to prevent any possible rootkit from messing with it?"

Re:Wow, what a dumb question...

[NIN1385]

Very good point, opened my eyes a little. Thanks for the feedback.

Closed-Source?

[courtarro]

This is pretty clearly just a jab at Windows being closed-source. Rootkits are tough to detect on any OS, it's just that the tools to defend against and detect them are more mature on other operating systems. The reason that systems like TripWire for Linux exist while Windows is just starting to see such programs is because Windows has so many other security problems. It's so common for random programs to alter configuration settings all over the place in Windows, but in Linux programs are less intrusive, making it possible to monitor the system more closely without getting millions of false positives. Then we could go into the more cautious user base, the behavior of being Administrator all the time, etc. etc.

It's also really hard to detect, inform users about, and/or remove rootkits without the user knowing a bit about the inner workings of the system. In a "root/administrator" world, there's no guarantee that a rootkit can be detected anyway, because there's nothing a detection app can look at that a rootkit can't obscure, if it knows what the detection app will be looking for.

Windows has problems that make rootkits easier, but it's not because it's closed-source.

Re:Closed-Source?

[GecKo213]

Windows has problems that make rootkits easier, but it's not because it's closed-source.

The biggest problem with the "closed source" approach is that there is only really one person that can fix the problem. If it were opened up, then there would be many many programmers world wide that could fix the problem.

Re:Closed-Source?

[Anonymous Coward]

> Windows has problems that make rootkits easier, but it's not because it's closed-source.

I think Windows being closed source would make rootkits hard to create, and much harder to detect.

What rootkits?

[foQ]

I work with spyware infected systems every day, and I have never found a "rootkit" on one. But there is some really nasty stuff out there. Lots of spyware installs itsself as a service, but that is easy enough to get rid of, just use "msconfig". The trickier ones, however, install themselves as drivers. These require manual regedit hacking which is a major PITA.

The most effective method that I have found to get rid of spyware on an infected system, by the way, is to boot from a live Windows bootable CD to delete all the crappy spyware directories from c:\Program Files, then go into c:\windows and c:\windows\system32, sort the files by date, and delete the newest ones that look suspicious. Write these filenames down and remove them from the registry when you reboot.

Re:What rootkits?

[ThaFooz]

I work with spyware infected systems every day, and I have never found a "rootkit" on one

The issuse is that they're extremely difficult to detect. What heuristics do you use that that the major AV companies are not aware of?

The most effective method that I have found to get rid of spyware on an infected system, by the way, is to boot from a live Windows bootable CD to delete all the crappy spyware directories...

I'm sure that works reasonably well, but once a system is comprimised, you never really know for sure. I find that the only surefire method, which incidentally often takes less time, is to wipe the drive and start fresh. The type of user that is going to get spyware probably doesn't have a complicated setup or do more than write documents and use iTunes, and backing up is as simple as looking for *.doc, *.xls, *.ppt, *.mp*, *.mov, *.wmv, and *.avi.

Re:What rootkits?

[Hosiah]

live Windows bootable CD

Good advice, but note, folks, that that means "a CD that boots on a Windows machine", not made or endorsed by MS in any way...

Yet another solution is just about any Linux live CD, which can be used to mount the hd and then you have some fantastic Linux tools to use to clean your Windows. Dual-booting is even better, with scriptable clean-up utilities you can craft out of Bash, sed, awk, and Python to auto-clean the Windows partition every time you start Linux. Feel free to edit Windows system files like .bat and .ini while you're at it in your handy dandy vi or emacs editor.

I swear, if Microsoft knew what was good for them, they'd *push* Linux. "The best of both worlds!"

Re:What rootkits?

[foQ]

The easiest thing to do would be to use a standardized image to rebuild the computer. In a perfect world, that would be the first step to fix almost any problem. However, our underfunded IT department supports over 300 apps, not to mention the several dozen that different departments might use which are not supported. It isn't the backing up of the data that is the trouble, it's the reinstalling of the applications. For example, one department has software that requires Windows 95! All of this makes wiping and starting over a much more challenging task than removing the spyware.

Re:What rootkits?

[Anonymous Coward]

The type of user that is going to get spyware probably doesn't have a complicated setup or do more than write documents and use iTunes, and backing up is as simple as looking for *.doc, *.xls, *.ppt, *.mp*, *.mov, *.wmv, and *.avi.

ugh. i shudder at what a search for *.mov's, *.wmv's, and *.avi's would turn up on a computer for that 'type of user' i mean, i like pr0n as much as the next guy, but the flood of goatse on video would be horrifying :P

Re:What rootkits?

[Creepy]

I can vouch that they're out there - my Brother-in-law had his internet connection shut off because of a rootkit that was spamming. No run command in regedit, no visible service. I've since blocked the port it was contacting the spamming service through and since it's no longer sending, they have Internet back, but have yet to find a way to clean off the rootkit (yes, I've tried about a dozen rootkit removers, none successfully). I'm reading this thread for ideas, honestly, 'cause I'm out of them. I have not tried a bootable CD yet, but if that's unsuccessful, I'll probably just reformat their drive.

Re:What rootkits?

[ignavus]

"backing up is as simple as looking for *.doc, *.xls, *.ppt, *.mp*, *.mov, *.wmv, and *.avi."

You left out *.doc.exe, *.xls.exe, *.ppt.exe, *.mp*.exe, *.mov.exe, *.wmv.exe, and *.avi.exe

You should back those up too.

Re:What rootkits?

[Raxxon]

I'm sure that works reasonably well, but once a system is comprimised, you never really know for sure. I find that the only surefire method, which incidentally often takes less time, is to wipe the drive and start fresh. The type of user that is going to get spyware probably doesn't have a complicated setup or do more than write documents and use iTunes, and backing up is as simple as looking for *.doc, *.xls, *.ppt, *.mp*, *.mov, *.wmv, and *.avi.

That works well till there's a sploit for Word or Excel or another one for WMP that allows you to embed a virus/spyware/rootkit in what appears to be an innocent Doc/Spreadsheet/pr0n vid.

Re:What rootkits?

[myov]

Home users who can't find cd's and/or keys are the real problem.

Re:What rootkits?

[Decker-Mage]

I think they are getting better about this. For instance, my machine here is schizoid. Sitting on top of the kernel are two OS's: Windows Server 2003 Enterprise and the POSIX based Interix/X11R6 courtesy of Windows Services For Unix (SFU) 3.5. Before I was using Cygwin, this beats the stuffing out of that approach and I have all the tools I could ask for right down to GCC. It's actually quite slick to hit Ctrl-Alt-C (my selection) and up pops C-Shell, my old friend.

On the Linux front, expect to see Virtual Server 2005 Release 2 (was Service Pack 1 but they changed it) to support it. Right now I'm trying to get Solaris up and running on it as well. It's quite different in approach than VMWare's Workstation 5.5 (testing here as well), GSX or ESX, but it does work and they are trying to break it out of the Windows only mode. I don't know if they will make it. We shall see.

That's not to say it will all be roses and candlelight. I don't think that will ever be the case so long as Linux is perceived as a threat to their monopoly on the desktop and the corporate office suite but I'm seeing some flexibility and I do know that they are talking to the partners more about newer and different ways to reach SMBs. [They called me today ;-) ]. Again, we shall see.

The big picture

[Anonymous Coward]

The root of the problem may be the organizational structure of Microsoft. We have the mess that is/was longhorn/vista and the comments that it had to be re-written from the ground up.

The point made in the 'Cathedral and the Bazaar' may be coming to pass. It is impossible to manage very complex systems effectively. It is a question of distributed control vs. top down management. My favorite example is the Soviet Union vs. the US of A. A bureaucracy can't manage something as complex as a whole economy; maybe it can't manage something as complex as Windows.

The bottom line would seem to be that we will see a never-ending stream of problems like the one at hand.

www.catb.org/~esr/writings/cathedral-bazaar/cathed ral-bazaar/
www.uq.edu.au/news/index.html?article=6618

Re:The big picture

[RAMMS EIN]

``A bureaucracy can't manage something as complex as a whole economy; maybe it can't manage something as complex as Windows.''

But than a system hacked on by volunteers would be a mess, too. And ostensibly, that's true.

What makes the difference is that a closed source system is developed by an essentially finite (and for cost reasons, usually minimal) pool of developers, whereas open source systems can draw from an essentially infinite pool. This translates to more bugs being found and fixed faster, which is another ostensible truth.

Simple defense against rootkits

[RAMMS EIN]

Isn't a rootkit easily detected by checksumming the system software against known-good sums? Put checks on normally unconnected (or read-only) medium, run checks periodically, done?

Re:Simple defense against rootkits

[andreyw]

Okay class, let's review.

When you perform any operation on a file system object - getting the contents of a file, size, modification date, etc - you're, after all the layers of indirection, making a system call to the executive. Most real rootkits on Windows NT derivatives are kernel rootkits - that is they modify core system calls to hide themselves and perform nefarious activies - you can't really detect them with something as naive as a file content check.

Re:Simple defense against rootkits

[Anonymous Coward]

This is why run checksumming from bootable CD or backup hotswap RAID and do on locked down host.

I take next class!

Re:Simple defense against rootkits

[ArsenneLupin]

When you perform any operation on a file system object - getting the contents of a file, size, modification date, etc - you're, after all the layers of indirection, making a system call to the executive. Most real rootkits on Windows NT derivatives are kernel rootkits - that is they modify core system calls to hide themselves and perform nefarious activies - you can't really detect them with something as naive as a file content check.

He did mention "normally unconnected read-only media". So you not only put your checksums on these, but also a minimal rescue system, which you boot whenever you want to check integrity of your main system (on Linux, such a system might be a Knoppix CD, for instance...).

Granted, on Windows, this might be a tad more difficult, as the Windows rescue CD's may not be usable enough to run checksumming utilities...

Ok, but Knoppix does support NTFS so just use a Knoppix CD to check your windows checksums. But then another problem on windows is that lots of files do change even during normal operations, so it's difficult to distinguish those changes performed by a rootkit from the innocent changes performed by the system itself because "the mouse has moved"...

Re:Simple defense against rootkits

[Anonymous Coward]

Most real rootkits on Windows NT derivatives are kernel rootkits - that is they modify core system calls to hide themselves and perform nefarious activies - you can't really detect them with something as naive as a file content check.

Just like a rootkit on unix. You have to boot from other media and run checksums from there. It's the only way to be sure, on any operating system.

Re:Simple defense against rootkits

[MoralHazard]

Yes, taking the system offline with a "rescue disk" and comparing cryptographically-secure checksums against known good values does work. That's the standard for rootkit detection.

However, it's hella inconvenient, on many servers, to boot to a "rescue disk". Do you have any:
        - servers that cannot tolerate the downtime required to scan?
        - servers at remote locations where you can't insert bootable media easily (CDROM, floppy, etc.)?
        - servers or workstations that just don't have bootable media capabilities (headless/PXE boot systems, anything w/o CDROM and floppy drives)?

So while it's a theoretical solution, it's also a shitty solution in practice. How many administrators are going to take the time to take ALL of their servers offline for this kind of review? None, that's right. Because none of their managers are going to be willing to tolerate that kind of expense, effort, man time, and downtime in order to check for something that they can't even understand.

Re:Simple defense against rootkits

[andreyw]

He did not say anything about physically removing the drives for offline testing elsewhere, or about booting a different OS to take checksums. Even then, that's pretty much impossible in practice - kind of hard to take down say, an exchange server or and important DB server for a client in the middle of the day because you need to run some checks.

To see what's out there and to get some idea of detecting these things, I highly recommend the fine articles over at http://www.phrack.org/

Re:Simple defense against rootkits

[Noaccess0]

The difficulty comes from where to store the known-good sums where they can't be altered and how to run the checks without the system calls being hijacked/redirected.

Re:Simple defense against rootkits

[Decker-Mage]

Actually it's not so theoretical as it is part of my monthly plan for all computers. Each month every computer, server or no, gets cleaned out, connection seating checked, internals inspected for things like singns of overheating, and generally given the once over. They also get a full virus scan, trojan scan, registry verification/validation, and yes those MD5 checksums are compared. Security is a process and if you don't engage the full process, you might as well not bother engaging in any if your data is that important.

As for the managers at the various sites they know they don't understand what the rat frag I'm doing even though I do explain it very politely and in very simple terms with talking down to them. What they do understand is that if I can commune with each machine for an 8-10 hour period each month, they rarely if ever see any downtime. I've been doing this for twenty-five years now and not just with computers. I do it with all electronic devices from TACANs (VORTAC is the civilian countnerpart), radar systems, satcom, firecontrol, whatever. I've had systems with a MTBF of 108 days go four years with zero on-demand downtime simply by following this routine. I catch the problems before they become a problem and replace/repair/reprogram appropriately. I do the same thing with my home machines as well and I have machines that have been chirping along into their second decade and in one case third.

BTW, if your site is running on only one server with no backup, you already have a severe risk management problem. What will you do when that power-supply or other critical component (cpu anyone) craps out? Hmmm...? Sheesh. Mission critical my ass if you don't have a backup.

Bastille Windows?

[Fiver-]

Is there any product for Windows like Bastille Linux that would help a user lock down any vulnerabilities in their system like file shares, unnecessary accounts, open ports, unnecessary services, IE settings, etc?

If not, there should be.

Re:Bastille Windows?

[E-Rock]

I'm not familiar with Bastille but the Security Configuration Wizard included with W2k3 SP1 does a lot of this. It will help you by identifying services that you can disable, modify the registry to secure the machine and will help build your firewall rules for the things you want to have runnning.

It's not perfect, but it provides a good starting point and can roll back the changes you make. It also creates an XML file with the changes it recommends if you want to simply review it and make any changes yourself.

Re:Bastille Windows?

[Anonymous Coward]

I have a few programs that atleast help a little to secure windows.

I run them when I install windows, or when I clean other people's computers.

UnPlug n' Pray
http://www.grc.com.nyud.net:8090/unpnp/unpnp.htm
DCOMbobulator
http://www.grc.com.nyud.net:8090/dcom/
Shoot The Messenger
http://www.grc.com.nyud.net:8090/stm/shootthemesse nger.htm
XP Antispy
http://www.xp-antispy.org.nyud.net:8090/
SafeXP
http://www.theorica.net.nyud.net:8090/safexp.htm
Xpy
http://xpy.whyeye.org.nyud.net:8090/
BugOFF
http://www.spywareinfo.com.nyud.net:8090/~merijn/

The above help clean up several things I find to be disconcerting in XP. Things I'd rather not be enabled.
And with the above, I have had few problems. I have actually been better off. Hence, why I recommend them.
Still, I doubt I'd want the un pc savvy or the mentally retarded using teh above and muckign with their PC so much it won't boot. So, user beware.

And to harden the IP stack, there's Harden-IT
http://www.sniff-em.com.nyud.net:8090/hardenit.sht ml

Windows Configurator can also enable/disable certain things, as above. Have not used it yet, but just found out I had it installed.
http://home.autocom.pl.nyud.net:8090/mrowka/freewa re/wd.html
And then there's also TuneXP
http://www.driverheaven.net.nyud.net:8090/dforce/
It has several other options that may make your windows experience more enjoyable, and/or safe.
And of course there's FreshUI, which you can change how windows looks and reacts.
I guess its much like TweakUI.

And because IE is a real bitch, and even opera and firefox can get bitchy at times, I always use...
The Proxomitron
The best damned thing to happen to web browsing, EVAR!
Block popups, banners, browser hijacks, flash, javascript, web bugs, tons of things. Highly configurable, great for most anything.
Never knew how I got by without it before. I never browse without it now.
http://www.proxomitron.info.nyud.net:8090/
I also have it patched to make it look nicer. Little things can do so much.
http://www.xs4all.nl.nyud.net:8090/~vsetten/prox/
And I also religiously use The Gryphen's filter pack. Haven't found a better set yet. :D
http://www.users.on.net.nyud.net:8090/~grypen/Down loads/?M=D (look for "proxofilterset####" where #### is the newest date. A self extracting file, which overwrites the config files, and sets proxomitron to start on boot.

Also first up when I install windows is a thorough Spybot Search & Destroy and Adaware cleaning.
http://www.safer-networking.org/en/index.html
http://www.lavasoftusa.com/software/adaware/
Not that there'd be anything there, already. But a good once through is nice.
Then, within Spybot I go to Immunize and help lock down my system.
I then get SpywareBlaster and do the same.
http://www.javacoolsoftware.com/spywareblaster.htm l

With the above programs (Adaware

Easy fixes!!

[AnonymousYellowBelly]

1. Buy a Mac! and be a little bit paranoid about security.
2. Use Linux and be paranoid about security.
3. Buy a tinfoil hat.
4. Build a beowulf cluster of Linux enabled devices: an iPod, two toasters, one 'smart' fridge, and one spoon -anything runs Linux these days-.
5. Build your own OS!

Or you can keep on using Windows and trusting AV companies and its flawed model of "ok, we'll release the fix AFTER enough people have been screwed".

I don't think that the design of Windows, where changing an int to a float in the library that displays Clippy can crash MSN Messenger, would allow for easy fixes, regardless of closed or open source code.

You can actively defend your system anyway. It takes time and money (e.g. self-made hardware firewall with parts bought from the tinfoil-hat store, if you want to be /. grade paranoid), but is doable.

Re:Easy fixes!!

[xtracto]

I got an easier fix for you and 100% reliable.

Fast maximum security against rootkits/malware/spam!

give it a try, You will se it is quite useful!
(oh! and on top of that it tends to increase your productivity!)

Re:Easy fixes!!

[Anonymous Coward]

geeze - another mac fanboy who thinks his/her system is a gift from the Gods... geeze man, BSD can be rooted as well, you idiot.

I'm not sure admin is such a big deal

[Dink Paisy]

The problem is that a lot of this stuff is installed voluntarily. If P2PFreeMovies.exe and BritaneySperesNaked!!!.exe say they need admin access to install, people will just type the password in. Better use of capabilities and code signing would help, and, unlike mainstream Linux, Windows actually has an advanced security model that would allow this.

But the fundamental problem is that if someone wants to install this garbage, the only way you can really stop them is by taking control of their computer away from them. I'm not sure that even Microsoft is willing to go that far yet, and I'm not sure I would want them to, anyway.

Re:I'm not sure admin is such a big deal

[bluffcityjk]

You mean BritaneySperesNaked!!!.exe had an embedded rootkit!? Shit!

Re:I'm not sure admin is such a big deal

[mrchaotica]

the only way you can really stop them is by taking control of their computer away from them. I'm not sure that even Microsoft is willing to go that far yet, and I'm not sure I would want them to, anyway.

Are you kidding? Microsoft is the single entity that's pushing hardest for exactly that! That's what their whole "Trusted Computing" thing is for, you know.

Re:I'm not sure admin is such a big deal

[AviLazar]

Here is another potential problem. MS might come out with an add-on to their OS where it prevents unauthorized (or authorized) installation of these malwares....it will do this because they are not digitally signed, and authenticated to the user...the only problem: My friend does not want to use a program (i.e. photoshop) so he deletes it from his computer and gives me the disk. The disk is registered to his windows...now I can't install it....or what if I want to rip my DvD movie to my computer (backup)...it won't let me play it.

In the end, the best answer is for people to start using their noodle...protection software can also hinder us.

Re:I'm not sure admin is such a big deal

[Anonymous Coward]

My friend does not want to use a program (i.e. photoshop) so he deletes it from his computer and gives me the disk. The disk is registered to his windows...now I can't install it....

And the software companies think "where's the problem?". We'll just get another sale.

Re:I'm not sure admin is such a big deal

[Durandal64]

The problem is that a lot of this stuff is installed voluntarily. If P2PFreeMovies.exe and BritaneySperesNaked!!!.exe say they need admin access to install, people will just type the password in. Better use of capabilities and code signing would help, and, unlike mainstream Linux, Windows actually has an advanced security model that would allow this.

This is true, but there is only so much the operating system can do for the user. Windows, Mac OS X, Linux et al are not psychic. All they can do is warn users of the potential hazards of running untrusted software and create certain reasonable barriers to entry for installation programs. On the former, Windows, when configured properly, does a pretty good job of it. On the latter, it's abysmal. Windows Vista is embracing the idea of lesser privileges and a `sudo'-like authentication model, so things are looking better for it. An XP administrator is completely at the mercy of any malicious executable if he double-clicks it.

At the end of the day, operating systems can only identify suspicious behavior. It will always be up to the user to make the final call. If your users can't make good decisions, nothing short of a total system lock-down will help.

Re:I'm not sure admin is such a big deal

[Antique Geekmeister]

This is already in development. It's the Trusted Computing initiative, formerly known as Palladium, and it's a very big security effort. The benefit of its features are high: on-board high-speed encryption and authentication, easily available to users. The danger is also high: this is supposed to integrate with Dirital Rights Management and provide hardware level control of access to DVD writers, hard drives, boot loaders, system kernels, and secure operations called from withing software. That means that unless you can get the autohrization and the money to buy a highly authorized key from, say, the Microsoft key provisioning service, you will have difficulty writing and especially publishing open source tools that access those features.

Re:I'm not sure admin is such a big deal

[matria]

This has always been the case. I spent a good deal of time re-formating and re-installing Windows95 on client's computers, with Norton Anti-Virus, repeatedly, because their child overrode the antivirus warnings because they wanted to play the games they got on burnt CDs from their friends, CDs loaded with Chernobyl and other viruses. Even though I charged full non-waranty rates for such work if Norton was installed, I still got the same machines back every few months. Every time the parents were angry with ME, as if somehow I could stop the child from hitting the "C" key when the warning came up. Usually the CD was still in the drive. If the kid was there, the parents would glare or yell at the kid, and the kid would be more upset that I would break their CD and trash it. They couldn't understand that the Norton wouldn't keep the computer from getting infected if it warned them and they click "Continue".

Re:I'm not sure admin is such a big deal

[istrebitjel]

The problem is that a lot of this stuff is installed voluntarily. If P2PFreeMovies.exe and BritaneySperesNaked!!!.exe say they need admin access to install, people will just type the password in.

Why do you need a password to install stuff on windows? I though everyone was an admin by default...
Seriously, the people that went to the lengths of not surfing with an admin user, will most likely not be the ones affected by what you described above.

Re:I'm not sure admin is such a big deal

[eyeball]

Here is another potential problem. MS might come out with an add-on to their OS where it prevents unauthorized (or authorized) installation of these malwares....it will do this because they are not digitally signed, and authenticated to the user...the only problem: My friend does not want to use a program (i.e. photoshop) so he deletes it from his computer and gives me the disk. The disk is registered to his windows...now I can't install it....or what if I want to rip my DvD movie to my computer (backup)...it won't let me play it.

From everything I've read, it seems MS is working on the goal of windows eventually running only applications signed by them, the same way XBox is supposed to only run games they sign. There are so many things wrong with that besides the examples you mentioned:

- Who signs the apps? Microsoft?
- How do they determine which are legit and which arent?
- Who is held responsible if a legit company
- How much will they charge?
- Will the costs of signing push shareware & freeware programmers out of the market?
- Will the signed applications expire?
- What happens if I sell my computer? Are the licenses still tied to it?
- Will they also keep compeditors out of the market too
- What happens when everyone's guard is down, and someone figures out a way to code-sign a worm.

Just to scratch the surface. Worst case scenario, future PCs will cease to run Linux or any other alternative OS.

My real fear is that MS and/or Intel lobbyists convince the government to pass a law mandating that computers only run signed code. As a matter of fact, I'm surprised they've waited this long.

Re:I'm not sure admin is such a big deal

[Tim C]

Windows Vista is embracing the idea of lesser privileges and a `sudo'-like authentication model

I'm not familiar with Vista, but the "Run as..." service has existed since at least Win2k. It is perfectly possible to run as a limited user account and only run those things that absolutely require admin access as an admin account. Some recent installers even make use of the facility to have Windows prompt you for details of an account with admin access.

If your users can't make good decisions, nothing short of a total system lock-down will help.

Which is the point I think the OP was trying to make, and the point that I often try to make - no OS is secure from a rogue user with administrative access. As long as a user can install software system-wide, they can compromise or trash the system. No system is immune from that; yet still we hear Linux and OS X fans describe their system of choice as though it were. They raise the bar, that's all. As and when the more naive computer users make the switch, so will all the problems. Sure, those of us in the know won't fall for them - but then, those of us in the know who use Windows don't fall for them now.

Re:I'm not sure admin is such a big deal

[DaveJay]

Heh -- a few days ago while looking for an mpeg2 encoder, I found a freeware windows product that (a) said "warning: some antivirus software inaccurately reports this program as a trojan, but this is FALSE" and (b) said that it required the user to have admin rights for the installation. Both of these items were on the download page, for heaven's sake -- yet I have no doubt that tons of people download and install that software each day. Lord knows what it does.

Re:I'm not sure admin is such a big deal

[ThaReetLad]

I simply don't believe that's their goal. When the executives were asked at PDC this year about apple and iPods they talked about how they were different to apple because microsoft just wanted to create a software ecosystem in which third party developers could thrive, wheras apple want to retain total control of their platform and client software. Look at the amount of effort microsoft put into supporting and encouraging third party software developers. They produce the best (or at least most) IDEs, reference material, training courses and certification for software development all targeted at third party developers. They know that the easiest way to keep sales of windows high is to make sure that if you want to do anything on a PC there will be more choice in Windows based software than anything else.

Re:I'm not sure admin is such a big deal

[tehcrazybob]

You do make some interesting points. However, you also pointed out a move that'll never happen:

Worst case scenario, future PCs will cease to run Linux or any other alternative OS.

This won't happen, for several reasons:
1) Microsoft has escaped serious monopoly charges in the past simply because these alternatives exist. I assume Apple will still be around in the future, but with everything else completely gone, I expect Microsoft would have a lot harder time avoiding a monopoly charge.
2) Linux may not have a massive chunk of the market, but it does have quite a few users, especially once you start looking at servers. If hardware manufacturers start building things that prevent all non-Microsoft programs from running, there will be an uprising, and it'll be bad for the hardware makers.
3) Consider how much of the internet is served by Linux/UNIX systems. If these were all replaced by Windows Server , do you think the internet would function as well as it does?

However, your comment isn't entirely impossible. I see it working, with just a small modification:
In the future, you will be able to assemble computers to run Linux, and even a small number of systems will come with Linux preinstalled, just like today. There will be a big change, however: Any system that is sold with Windows will be incapable of running anything else. While all the suppliers who cater to the DIY crowd will continue to make plenty of usable, unlocked products, the companies that supply Dell, HP, and similar will have products heavy with DRM. These products will only run Windows. Perhaps only the version and copy of Windows that came with the computer.

Re:I'm not sure admin is such a big deal

[tehcrazybob]

While it's true that Run As... has been around for some time, the functionality has never worked all that well. You can run your Windows computer as a limited account, but it doesn't provide the same level of functionality as running a limited Linux account. Under Linux, a limited account is allowed to do basically anything but modify system settings. Windows perhaps does the same thing, but this breaks as soon as your program tries to save a setting to the registry. And programs do this. A lot. As a result, a limited account under Windows doesn't only keep you from changing system settings, it prevents a great many programs from running.

Under Windows XP, trying to run as a limited user, I have had everything from games to wireless networking completely fail to work. The Run As doesn't work for some of these things, and you're left with a crippled computer. So, when I work with Windows, I choose to play as Administrator and be very careful with what I do. That's not ideal for most users, however. Windows will be much better when priveledges work properly, and I hope they really have pulled it off in Vista.

Re:I'm not sure admin is such a big deal

[sumdumass]

Well, You might be able to get a digitaly signed program that runs other programs and then share that to some extent. I mean more to somthign like an X-box exploit rather then a java virtual machine or something. Basicaly you would have base program that could use any data, anyway it wanted and just structure the base to be able to vouche for regular programs.

It would be simular to installshield or the windows installer. The only problem would be you might need to have "opensource-Palladium-validator" running in the system tray for your programs to function.

I guess in a way this might be just like a rootkit or virus but should be somewhat effective. As long as the signed program can pass the controls to the other programs and give them access to the neccesary parts of windows you should be fine. It shouldn't need to execute the program itself just vouche for the intended programs actions when loaded thru it.

Then again i might not be understanding the problem to the extent it is going ot be.

Re:I'm not sure admin is such a big deal

[Durandal64]

I'm not familiar with Vista, but the "Run as..." service has existed since at least Win2k. It is perfectly possible to run as a limited user account and only run those things that absolutely require admin access as an admin account. Some recent installers even make use of the facility to have Windows prompt you for details of an account with admin access.

Yes but that is not the case by default in XP. If you are logged in as an admin, you are never once prompted for your password for an installation. On Mac OS X, for example, administrators run with least-required privileges and are required to enter a password if they want to perform an action which requires elevated privileges. It is, of course, possible to set up a normal user in XP and enter your administrator password whenever you want to do something which requires elevated privileges, but most people simply are not going to do that.

When discussing the security of operating systems, the default configuration is the most important one. Sure, Windows can be made as secure as Linux or OS X, but it's not by default, and hence it will not be secure in the hands of most users.

Sysinternals rulez

[Anonymous Coward]

http://www.sysinternals.com/Utilities/RootkitRevea ler.html

source code

[merdark]

The availablitiy of the source code has nothing to do with it. Joe Beerbelly is not going to be looking at the source code of his operating system. You'd be lucky if he understands that a thing called an operating system exists and has something called source code associated with it.

If your solution is to fix it yourself, you've already lost. It needs to be fixed by the *official* software vendor so that the changes can be pushed automatically to all the Beerbellies and Flabbyasses out there.

And besides, even for those who can understand the source code, it's not like the changes required are simple. If you DO manage to understand the system enough to make some usefull changes, a vendor will not just blindly accept them. They will themselves have to review the changes and completely understand them anyways. So why not do it themselves the first time? And to the person spending all that time doing the vendors work for them, do you not have a life or a job or something?

Re:source code

[Gta-Klue]

The availablitiy of the source code has nothing to do with it. Joe Beerbelly is not going to be looking at the source code of his operating system. You'd be lucky if he understands that a thing called an operating system exists and has something called source code associated with it. If your solution is to fix it yourself, you've already lost. It needs to be fixed by the *official* software vendor so that the changes can be pushed automatically to all the Beerbellies and Flabbyasses out there.

I think what they are saying, (not having RTFA), is that if an independant company had access to the source code, they could affectivly(sp?) write a program that would keep a rootkit from happening. NOT that Joe Beerbelly needs the source.

Re:source code

[tjstork]

And you think programmers don't have beerbellies? Just wait till you hit that big 35 with a wife and kids and see how those calories stack up!

Re:source code

[merdark]

There are independant companies that have access to the source code actually. And it's unlikely that they will be able to easily prevent them. This is not a matter of source availability. Rootkits plauge Linux as well, and the source being available has not made them go away.

Re:source code

[merdark]

I never suggested anything of the sort, but the Joe Sixpack term is even more stupid. Not only does the 'average joe' have no sixpack, but these days they are also fatasses. Plus, having a sixpack does not make one stupid and unable to operate a computer. So I think my description hits the 'average' person quite well, saying nothing about computer geeks.

Re:source code

[Cro Magnon]

The "average joe" doesn't have a sixpack? Then where did he get his beerbelly?

Re:source code

[merdark]

From the 24 pack obviously!

Re:source code

[TClevenger]

Not only does the 'average joe' have no sixpack, but these days they are also fatasses. Plus, having a sixpack does not make one stupid and unable to operate a computer.

Think of "six-pack" as "six-pack of beer next to the Barcalounger" and you'll see that it fits better. :-)

What does source code have to do with it?

[RAMMS EIN]

``Is the closed source code of Windows preventing us from actively defending our systems?"''

Huh? How does availability of source affect being able to check for root kits?

Re:What does source code have to do with it?

[Anonymous Coward]

You have to ask that question? This is slashdot: Any problem found with anything is caused by not having the source code available.

Linux is better than windows since it's been plagued by root kits since the beginning. Windows is vastly inferior since it took this long to implement it.

Sorry for the troll, but so far the comments I've read on this article have left me thoroughly disgusted. Just the thought of blaming the root kit problem on windows being closed source is ridiculous to me. The procedure is the same on linux as is on windows, and so is detection method. The only factor that makes windows worse is the fact that most people run as admin at all times, which is a design flaw to windows. If you made windows open source right now, the design flaw won't go away. If you change that design, you break the #1 goal of microsoft: backward compatibility.

Re:What does source code have to do with it?

[sqlrob]

Because you can determine the mechanisms used.

Without RE'ing the windows system, you can't determine the mechanisms, you have to trust MS if they say they told you all available ways.

1000's Of Programmers

[nurb432]

Microsoft has this too. While i agree with the argument that 'openness' is better for security patches, thats not a good argument..

Re:1000's Of Programmers

[Foofoobar]

Well you neglect to see the point that open source applications (especially popular ones) has 10x the number of eyeballs on the code that Microsoft has. Microsoft can only have it's developers looking at their code and then only developers who are ASSIGNED to work on the code.

In an open source application, EVERYONE can be looking at the source code (and alot do). So effectively, it can easily be argued that Linux has more people working on securing it than Microsoft at any given time.

I think that's the point that the original author was trying to make.

Re:1000's Of Programmers

[nurb432]

No, i did not 'neglect' to see any point.

I just happen to disagree on his statement.

I also think that having a thousand trained professionals familiar with the code is preferable to 10 thousand clueless amatures any day. ( the original poster eluded to a situation where there were not thousands of 'eyes' in a corporation as huge as microsoft.. which prompted my post )

Now, that being said, open code *is* better then closed as you increase the chances of something being noticed. But just talking pure numbers with out some qualifying factors is silly and is not a fair comparison of anything.

Re:1000's Of Programmers

[Foofoobar]

Clueless amateurs eh? Wasn't Bill Gates an amateur when he created Basic? Wasn't the world wide web created by an amateur? While you try to debase them, they continually show up Microsoft and now Microsoft has taken to COPYING these so called 'clueless amateurs'.

Aside from that, these so called clueless amateurs as you call them are actually professionals who do this in the spare time or are being sponsored by corporations to generate open source code.

So I have yet to see how these people are either clueless or amateurs. But I do see how you yourself fit that mold for so blindly denegrating others without factual basis to backup up your clueless theories.

Re:1000's Of Programmers

[nurb432]

Whatever. I think i hear your mother calling you.

99% of the people that donate time to OSS are amateurs. Its a matter of precentages. 1% does not make the *group* a bunch of professionals.

The people hat are working for these large coporations are *by definition* trained professionals.

That doesnt mean that the armatures that are doing work 'for' OSS arent doing something good, its just a statement of what they are and their skill level.

Its reality, not a theory. ( and Im done with this pointless discussion, so dont bother )

Re:1000's Of Programmers

[Foofoobar]

Nice dodge. Avoid valid points by demeaning the poster. Of course, they don't make the points less valid, just you.

And I like the point that you love to throw stats into the air but neglect to point out where you pull them from; I suspect it's your ass? Show us where 99% of the Apache Foundation are amateurs. Show me where 99% of Linux developers are amateurs. I would LOVE to see what you base these stats on.

Until then, you are still blowing hot air. Show us where you are pulling those figures from. I can easily show you a list of names of people who contribute to the Linux kernel and then look up each and every one of them and tell you their job. Anyone can. It's made openly available by the Open Source Development Labs and most often it's even listed in development docs, on blogs, wikis and several other places. And all of them have full time jobs doing what they do.

So please, indulge the rest of us who call you on your bullshit. List your sources for this 99% figure... we could all use a laugh at your expense. :)

Re:1000's Of Programmers

[Anonymous Coward]

You're stupid. He said 99% of all open source programmers, not 99% of Linux developers. Get a clue.

Re:1000's Of Programmers

[Foofoobar]

Gee ya think? Must be why I specified the Apache foundation as well because I was well aware of that. Think next time before attempting a flame. It makes you look like less of a moron :)

Re:1000's Of Programmers

[Anonymous Coward]

You're stupid. He said 99% of all open source developers, not 99% of Apache foundation members. Get a clue. Next time before flaming the OP, consider what he actually said. Then you might become less stupid.

Re:1000's Of Programmers

[Foofoobar]

Do you know nothing? Apache, PHP and several other projects under the Apache foundation are ALL open source. God you are an imbecile. But then again, you are an 'anonymous coward' so I should expect as much.

Still waiting to see where that 99% comes from. Though it is ever so clear that it was made-up as FUD.

Re:1000's Of Programmers

[Anonymous Coward]

You're stupid. First of all, PHP is not under the Apache foundation. Getting back to the argument: the Jakarta projects plus the Apache webserver plus Derby, Lucene, etc. do not have 99% of all open source programmers. Most open source programmers are amateurs working on junk like Drupal and the Jakarta Commons libraries.

Re:1000's Of Programmers

[Foofoobar]

So when do we get to see where that 99% stat came from? Or should we all just assume you made it up? Naturally, we already do but I just wanted to point it out yet again. :)

can't see why closed source should be allowed...

[fak3r]

This may be slighty OT, but I don't see ANY reason why a closed source system that's this vulnurable should be allowed in any Medical/Govermental or Military implementation. Sure, lot's of Apps are written ABOVE the OS and thus in control of the branch maintaining them, but damnit, the OS is at the root of the problem here! Makes you understand why trains all across Europe are still kept track of (punny, eh?) by old Digital DEC's running VMS or OpenVMS. The whole idea that mindshare of the mainframe is growing old and retiring is going to be an issue, Windows 2000 server is not a replacement for something like VMS.

What if we just stopped fixing their shitty code?

[gelfling]

What if we as a community just put a 12 month moratorium on backfilling MS crappy code and the crappy job they do designing and then maintaining it. What if we simply let it go to shit and let MS deal with the consequences. Sometimes I feel like an ennabler for a crazy codependent cranked out asshole. What if we just said NO -it's your fundamental problem, you fix it. Maybe MS stock would go down, maybe not. Maybe some really important systems would fizzle up in flames. Who fucking cares? I say call them on their bluff and stop pretending that they're not sucking off OUR work and OUR integrity.

Securing Windows

[bahwi]

1. Get pair of scissors
2. Cut Ethernet Cable
3. Windows is now secure from attacks via the internet!

Re:Securing Windows

[Anonymous Coward]

> 2. Cut Ethernet Cable

That won't secure a computer that's already been rooted. Just because it can't contact its master doesn't mean it's safe.

Knoppix CD

[ArsenneLupin]

... tripwire ...

Oh, and don't forget to mention that you should run tripwire from a known-secure system (a Knoppix CD, for instance) at least once in a while. Indeed, if your system is infested by a good rootkit, it could itself so well that it would play back a phony, made to look innocent contents of any files that it had infected.

Same goes for lsmod, ps and other tools (it is however very rare that a rootkit is so thorough as to hide itself from all tools. Most often an rpm -q --verify -a finds the nasties). But if you're really paranoid, run your tripwire and rpm --verify from an external system, not from within the one you want to examine.

Re:Knoppix CD

[Anonymous Coward]

A Knoppix CD will work until the rooktits start moving into the BIOS, or the video card, or the hard/cd/dvd/tape drive firmware, or any other piece of hardware that runs code on boot before the OS is loaded. Fortunately, rootkits that infect firmware are very hard to write and must be targeted to specific hardware so you won't see it used outside of attacks targeted to a specific machine or company.

Re:Knoppix CD

[steve_l]

good point.

I've done keyboard controller hacking before now; the core in a laptop is a little 16 bit RISC engine that shares the bios flash. With a hacked KBC you can intercept keystrokes and the entire main memory image looks 100% normal, because it is. Your friend the keyboard has been 0wned instead...

Re:Knoppix CD

[myov]

And, it should go without saying that the tripwire hashes/database should be on write-once media. If the hashes can be changed, you never know if they're right.

Rootkit Responsibility

[acvh]

"the FU rootkit, which I wrote, is intended to demonstrate. It is not malicious but more proof of a premise."

"I do know that FU is one of the most widely deployed rootkits in the world. [It] seems to be the rootkit of choice for spyware and bot networks right now"

He wrote and distributed a rootkit for windows; for educational purposes only (!). It becomes one of the most widely used tools to propagate spyware and trojans. Does he bear any moral responsibilty for this?

I would answer positively. If I leave a loaded gun lying on the sidewalk and someone picks it up and shoots someone else, I think I may get some bad karma.

Re:Rootkit Responsibility

[Anonymous Coward]

What if you invented the computer? Should you be held liable for viruses, etc..?

You're an idiot.

Re:Rootkit Responsibility

[hackstraw]

He wrote and distributed a rootkit for windows; for educational purposes only (!). It becomes one of the most widely used tools to propagate spyware and trojans. Does he bear any moral responsibilty for this?

Its open source and freely available.

You can't knock that here.

Re:Rootkit Responsibility

[dreamchaser]

You're obviously a troll, but your logic is so flawed that you should probably turn your last statement around to point at yourself.

If I invent the automobile I'm not responsible for people stealing other people's cars. If I invent a tool that circumvents the lock and ignition system, even if it's just a 'proof of concept', then I bear some moral responsibility for it's misuse. Not the sole blame, mind you, but a certain level of responsibility.

Re:Rootkit Responsibility

[marcosdumay]

If he didn't write this rootkit and made it available, someone elase would. And worse, someone else could not publish the rootkit, so the good guys have a chance of improvening the system*, they could just sell it on the black market.

Blamming him because people use the rootkit is advocating security trhought obscurity.

* Not that MS will do that, but this is MS problem.

Re:Rootkit Responsibility

[wembley]

Does he bear any moral responsibilty for this? I would answer positively. If I leave a loaded gun lying on the sidewalk and someone picks it up and shoots someone else, I think I may get some bad karma.

karma != responsibility

Re:Rootkit Responsibility

[Cyno]

Yeah, burn him! BURRRRN HIIIIM!!!

If only you could feel so vengeful against Microsoft for designing an insecure system and then not using their billions to fix it when everyone tells them its insecure. Intead, they're using their billions to make billions, for educational purposes?

Why doesn't Microsoft bear any responsibility for the mess they've unleashed on the 'net?

As for your gun analogy, its more like EVERYONE wears a bullet proof jacket except Joe Microsoft, someone finds your loaded gun and shoots him. He dies. Who's to blame? If he wore his bullet proof jacket like everyone told him, maybe he wouldn't have died. But since you left your gun on the sidewalk we should just execute you and call it even.

Unfortunately this does nothing to clean up the bloody mess on the sidewalk.

Re:Rootkit Responsibility

[drew]

If I leave a loaded gun lying on the sidewalk and someone picks it up and shoots someone else, I think I may get some bad karma.

It sounds to me to be more equivalent to leaving an unloaded gun laying out, and then somebody else picked it up and loaded it before using it to shoot somebody. It sounds like it needed to be modified by somebody for it to be used for malicious purposes.

Re:Rootkit Responsibility

[YaRness]

the only real world analogy would be if he left a design for a gun out and someone else went and manufactured the gun, loaded it, and start killing babies with it or something.

it just happens to be a LOT easier to copy and use someone's design in the digital world.

Re:Rootkit Responsibility

[Senzei]

"If I leave a loaded gun lying on the sidewalk and someone picks it up and shoots someone else, I think I may get some bad karma."

Nah, just slap a google logo on it, or put an OSX sticker somewhere in there. Both of those are sacred on slashdot right now.

Re:What if we just stopped fixing their shitty cod

[Anonymous Coward]

While this is an interesting proposal, my company (and many others) would come to a halt, so no paycheck for me since payroll won't run!

NO!!!!

[The Spoonman]

Is the closed source code of Windows preventing us from actively defending our systems?

No, it has nothing to do with source code, it has everything to do with people being morons who can't secure a Windows system. It's really not that hard, folks, pick up a book. Do you know how to secure a *nix box? You're halfway there! You use the same damn methodologies. God, why is this so hard for people to get? And people wonder why they're shipping IT jobs overseas. Let's see, we can get incompetent people for $30/hour, or incompetent people for $30/day. Hmmmmm...touch decision.

Re:NO!!!!

[amcdiarmid]

To reiterate: The name of the game is reduced user permissions. The biggest problem with windows security (second biggest?) is that non doman users are Administrator by default. This means that any vulnerability can be exploited to install files where they should not be.

Reduced user permissions (aka: creating a user account with permissions of "User") means that the user cannot install files to /windows or /program files, or write global registry keys.

Lets review: Administrator/root accounts have good authentication measures and are not used for everyday use. User accounts have limited ability to foobar your system, and ARE used for everyday work.

Unless you run Knoppix/ubuntu from CD/DVD, in which case just reboot.

Re:NO!!!!

[g0hare]

Right. I mean you guys spend DAYS tinkering with your darn Linix systems, but can't be bothered to skim through any of the articles Microsoft and a million other people publish, all of which come down to the same stuff: 1) Use a non-administrator account unless absolutely necessary 2) Patch 3) Firewall 4) Stay off porn/warez/etc sites But that's not leet enuff I guess.

They keep flogging this outdated line of reasoning

[haruchai]

From http://www.viruslist.com/en/analysis?pubid=1687408 59

Currently, malicious code for Windows is more common than for UNIX because Windows is the most widely used operating system. However, if UNIX starts to gain popularity, then the situation will naturally change; new rootkits for UNIX will be written, and new methods of combating them will be developed.

This has been refuted time and again yet the various Windows-friendly analyst continually trot this one out as a rationale for the ( admittedly much improved but still ) relatively weak security design of M$ Windows.

Newsflash for those who didn't get the memo: Windows leads by a huge margin ON THE DESKTOP. On the server side the disparity, if one exists is a completely different story. Also, since there are many open source versions of Unix, such as Linux, *BSD, and Solaris, some of which have been available for more than a decade, it should have been relatively easy for Windows-loving, Unix-hating programmers to have designed the Unix-slaying, self-propagating daemon years ago. To date, the only thing that has come close was the Morris worm way back in the late '80s.

So guys, nice try - your explanation ( or rationale ) is leaking badly. If Windows represent a bigger target, it SUPPOSEDLY has the "advantage" of being closed-source but the open source Unices, which are fewer in number SHOULD be an easier target.

It's time to focus on what the true flaws of each platform are - their relative prevalence is no longer relevant to the discussion ( aka flamefest ).

Nah

[Aumaden]

Is the closed source code of Windows preventing us from actively defending our systems?

Windows being closed source in no way prevents me from defending my system. I just insert my Gentoo install disk and reboot.

Re:Nah

[WilliamSChips]

In other words: "I use Gentoo, how does this affect me?"

Design vs. Implementation

[RAMMS EIN]

``It's well known that the *nix operating system model is more secure by default, through good design.''

Is it the Windows design that is insecure, or the implementations? Of course, that begs the question if there actually _is_ a Windows design to speak of. Well, what is there in the APIs that Microsoft publishes that is necessarily insecure, and what is there in the Unix APIs that is necessarily insecure?

I can answer parts of the Unix side; the fact that software needs to be all-powerful to do a single privileged operation (such an binding to a port below 1024). Functions like tmpnam(3), which generate predictable filenames.

Things like the general lack of bounds checking (leading to buffer overflows) are implementation issues, and could be overcome by using better programming languages.

Re:Design vs. Implementation

[sedyn]

The term "better" in the way the author of that article uses it is not very good. "More Idiot-Proof" or "Less fault tolerant" are terms I'd use in that context.

The comparison term "better" in languages is limited to qualities. For example, if resources are very limited then C is better to use than Java.

Of course, it all boils down to "the right tool for the job".

Re:Design vs. Implementation

[arkanes]

Predictable filenames from tmpnam is an implementation issue, not a design one. The lack of fine-grained permissions *is* a design flaw with UNIX, however. NT has a superior design in that regard, although a combination of flawed implementations, legacy support, and culture work heavily to defeat it.

There are, however, several other major design based issues in Windows. For example, there is no (very little) concept of security past the interactive desktop. Any application that is allowed to interact with the desktop can gain the permissions of the signed-on user, even if run with lower permissions (thats why services shouldn't have interactive access turned on).

Re:Design vs. Implementation

[RAMMS EIN]

``The term "better" in the way the author of that article uses it is not very good. "More Idiot-Proof" or "Less fault tolerant" are terms I'd use in that context.''

First, thanks for reading the essay, and thanks for the comment.

I (I am the author, BTW) argued that Common Lisp both makes it easier (compared to C) to write correct code and makes it impossible to write code that contains the type of bug I address. Wouldn't that make Common Lisp a better language, at least on those counts?

At any rate, the qualifications you propose would be worse; I think Common Lisp is neither more Idiot-Proof, nor more fault-tolerant than C. And it wouldn't have quite the same ring to it. (-:

``Of course, it all boils down to "the right tool for the job".''

Of course. "It depends" is always a correct answer in CS, and often the only one.

Re:Design vs. Implementation

[RAMMS EIN]

``Predictable filenames from tmpnam is an implementation issue, not a design one.''

Alright, the fact that they are too predictable is an implementation issue. But the fact that this predictability can be exploited is because of design. The problem is that the filename generated by tmpnam may be created before you open that file. That's why mkstemp was introduced, which atomically creates the file for you.

But on another note...

[Pichu0102]

...Closed source also means that people have to take more time to find exploits. Closed source is good in that it takes longer to find exploits that people can use maliciously, but bad in that it takes longer for the exploits to be fixed. There's also the matter of updating everyone. You'll normally have at least one stubborn person that refuses to update their software, and then there's the people that expect auto-updates because they don't know how to do so manually.

Re:MS(ux) for a few reasons, this is just one of t

[rjshields]

As far as that is concerned ANY installer should have to be authenticated as an ADMINISTRATOR before the install can proceed. I think this small step would curb many of the issues with spyware, adware, toolbars, etc.

Yes, apart from the facts that many windows users log in as administrator and that ActiveX has no security model, but it would surely help the problem.

Difficulty without source

[dtfinch]

Hackers seem to have little trouble creating rootkits without access to the source. Maybe they do have access. I'm not sure. But people seem to have little trouble writing rootkit detectors either, once they've reverse engineered a rootkit to see how it works. But if one of Vista's DRM goals is to hinder reverse engineering, things could get a little more difficult, I don't know.

There is a solution

[gambit]

SecureWave which uses a small kernel agent that uses a whitelist approach. Anything not allowed by the admin is dropped and considered deadware.

It's the only thing out there like that!

http://www.securewave.com/home.jsp

Re:There is a solution

[foQ]

au contraire

I had a bittorrent open when I loaded Slashdot

[Anonymous Coward]

My browser was obscured perfectly, so that the headline for this story read No defense against Windows. I very nearly shit myself. I thought slashdot had been hacked, you know, by one of those Windows things.

Hacker Defender Rootkit

[Anonymous Coward]

http://hxdef.czweb.org/about.php

Not well-outlined

[eander315]

So the problem is serious, and well outlined by this question: Is the closed source code of Windows preventing us from actively defending our systems?"

The problem is not well-outlined by that question. In fact, the addition of the idea of closed or open source has nothing to do with it. Is the lack of attention paid to rootkits the source of the problem? Is this just the problem of the month that will be solved soon and replaced by another, bigger problem? The open/closed source question is important, but really doesn't have anything to do with the issue at hand.

Answer

[Caine]

Is the closed source code of Windows preventing us from actively defending our systems?

No.

Re:Answer

[shdragon]

Is the closed source code of Windows preventing us from actively defending our systems?
No.

Best. Answer. Ever.

Ever get the feeling /. turned into that "Cofee Talk" skit from SNL?

I use 802.11...

[xtracto]

you insensitive clod!

Re:I use 802.11...

[xMilkmanDanx]

Then... 1. Get tin foil hat 2. Put on wireless antenna 3. Internet secured

No

[Anonymous Coward]

Is the closed source code of Windows preventing us from actively defending our systems?

No, I don't have time to deal with the source code for any OS, let alone figure out how to defend it against attacks. I suspect the vast majority of “us” don't have time for it either.

Open Sauce zealots can look elsewhere for emotional support.

Thanks!

[Grendel Drago]

Thanks! I wonder if there's any good guide to fighting rootkits out there. (Apart from, of course, the above suggestions.) The idea seemed particularly scary to me, since it's not just a malicious program being installed---you can't even trust your own system. Brrr.

Re:Thanks!

[Izago909]

I'm not sure about programs that actively prevent rootkits, but a copy of Barts PE with the Registry Editor PE plugin is a simple way to remove them.

Re:They keep flogging this outdated line of reason

[drsmithy]

This has been refuted time and again yet the various Windows-friendly analyst continually trot this one out as a rationale for the ( admittedly much improved but still ) relatively weak security design of M$ Windows.

That design being ?

Windows leads by a huge margin ON THE DESKTOP. On the server side the disparity, if one exists is a completely different story.

On the server-side - and particularly the non-Windows server side - the single biggest vulnerability and attack vector - the user(s) - have a substantially different profile.

Also, since there are many open source versions of Unix, such as Linux, *BSD, and Solaris, some of which have been available for more than a decade, it should have been relatively easy for Windows-loving, Unix-hating programmers to have designed the Unix-slaying, self-propagating daemon years ago. To date, the only thing that has come close was the Morris worm way back in the late '80s.

Sure, if you ignore the long, glorious history of unix exploits (BIND, Sendmail ? I'm looking at you), that's true.

Not to mention the significant factor the user demographic plays in the equation. A seasoned unix user is inherently less vulnerable than the average desktop Windows PC user.

This is before even getting to the simple fact that unix has had 20 years more to harden itself from attackers.

If Windows represent a bigger target, it SUPPOSEDLY has the "advantage" of being closed-source but the open source Unices, which are fewer in number SHOULD be an easier target.

Targets are not only chosen because they're easy, but also because they're useful.

It's time to focus on what the true flaws of each platform are - their relative prevalence is no longer relevant to the discussion ( aka flamefest ).

Their relative prevalence is fundamental to the discussion - not only from a simple statistical perspective, but also because of the other factors that correlate with prevalence. To say platform prevalance is irrelevant ignores not only common sense, but mathematical fact.

Maybe This Will Have to be the Solution

[Nom du Keyboard]

Maybe the solution, in addition to current active virus scanning, will be a bootable CD to scan your entire hard drive while it's passive. Find the rootkit before it can load and hide itself.

Either that, or start publically executing the rootkit authors when you find them. I'm good for either of these ideas.

Re:Maybe This Will Have to be the Solution

[Omg Kthxbye]

Either that, or start publically executing the rootkit authors when you find them

So I assume you are in favor of persecuting gun manufacturers for every murder committed with a gun as well?

Re:Maybe This Will Have to be the Solution

[Nom du Keyboard]

So I assume you are in favor of persecuting gun manufacturers for every murder committed with a gun as well?

No, I never said that. Can't you read and understand simple English?

Let me try to explain it in small words and simple terms. A gun manufacturer does not build and sell a product with the intent that all their purchasers will murder innocent victims. And when that does happen in a very small percent of overall guns in circulation, the murderer is the one to be punished.

OTOH, a Rootkit author intends from the beginning for his product to cause harm. There are no benign uses for Rootkits.

I put Rootkit writers in the same catagory as I do the actual bombmakers who provide the suicide bombers with their bomb vests. There are no benign uses for suicide bomb vests -- or a Rootkits.

Have you got it now?

"Windows for Warships": old old news

[toby]

Is the closed source code of Windows preventing us from actively defending our systems?

Does this question really need to be asked any longer?

Has this story teleported us all back to the year 2000? Hit the reset button? Is Slashdot's new motto "No hugging, no learning"?

b) The US Navy is running an unsecurable OS for the most advanced surface ships in the world - with nuclear reactors to boot.

I thought this was common knowledge. I didn't really expect a "pro-business" administration to do anything about it, did you? It's actually one of the few things that makes the rest of us feel safer.

Britain has the same problem, by the way:

The Royal Navy's new, state-of-the-art destroyer has been fitted with combat management software that can be hacked into, crashes easily and is vulnerable to viruses, according to one of the system's designers who was fired after raising his concerns. ... he told Channel 4 news that "the use of Windows For Warships puts the ship and her crew at risk, and the defence of the realm".

There are also plans to install a similar Microsoft Windows-based computerised command system on Britain's nuclear submarines. Wilson said: "It is inconceivable that we could allow the possible accidental release of nuclear missiles. The people who survived such an exchange, if any, would certainly regard such a thing as a crime against humanity. And I can't help feeling that even planning to deploy such systems on Windows, with its unreliability and lack of security, is itself some sort of crime in international law."

Also see The Register which quotes an upbeat Armed Forces Minister:

Fabricant had asked if there had been an external review of the Type 45 decision, and from Ingram's answer we can perhaps infer 'No'. He then asked for a cost comparison between Unix and Windows 2000 as the CMS OS, and Ingram simply said: "The cost of implementing an operating system for the Combat Management System in the Type 45 is a matter for the prime contractor, BAE Systems, and their sub-contractor. The Department does not have, or require, visibility of costs at that level of detail."

Fabricant also asked what systems had been put in place to cope with a failure, and what steps had been taken to ensure the Win2k CMS in the Type 45 was reliable. Aside from affirming that Win2k was "the lowest risk choice" and that BAE was on top of "residual risks" (Are these cookies? Spyware?), Ingram said: "The system design has built-in redundancy, with automatic, and transparent, switch-over to a back-up system if the primary system has a problem. This would provide continuity of operation and ensure that no data was lost. The system design also ensures that comprehensive hardware mechanisms will be in place to avoid any other safety or technical issues."

Perhaps the Minister can now explain why his desktop PC doesn't even run properly.

Les Hatton gives his opinion at IT Week:

... the Royal Navy is all set to go to sea with Windows on warships. Am I alone in thinking that this has to be one of the most terminally stupid IT decisions of the century?

...this was first attempted in the mid-1990s. There was a wonderful description of the then-latest generation of a US missile cruiser, the USS Yorktown, having to be frequently rebooted because its underlying network of computers running Windows NT crashed somewhat inconveniently. Apparently the design meant that critical systems such as steering could be lost in mid-battle.

So here we are again. This time the dec

Re:"Windows for Warships": old old news

[toby]

My tongue in cheek point about the Minister was meant to illustrate that he has never connected the dots between the flaky infrastructure that runs his department and the flaky infrastructure being chosen to defend "the realm".

don't give me lame-ass quotes and figures about how your Debian box that runs as a web server off of your xDSL line hasn't crashed in months

While I have plenty of lame-ass multi-year uptimes to quote from my own experience, I'd rather talk about Vxworks, NetBSD, embedded Linux, or a host of other embedded RTOS (often UNIX based) that are appropriate examples with appropriate operational records. Windows of any flavour has no appropriate operational record; the very thought of it is laughable. NASA doesn't send it to space and if I were a Navy sailor I wouldn't put my life in its hands either.

mission-critical hardware and software are a totally different environment,

Which is kind of the whole point, isn't it.

and I'm sure that with whatever OS is used for such tasks that thousands of man-hours are devoted to ensuring that system failures are the extreme exception

On the face of it, this seems sane; yet, with their reputation and future at stake, why has M$ so far failed to apply these "thousands of man-hours" to security and reliability of their costly products? Their record inspires no confidence whatsoever. I think if just one intelligent-man-hour had gone into this decision, things might have turned out a whole lot rosier for the Royal Navy.

The computers there are nothing more than graphical data and situational displays.

And why should these therefore be left prone to failure? Would you fly in an airliner that ran Windows for flight control? What if it just ran Windows for its "graphical data and situational displays"? By singling out the "relative unimportance" of these displays by way of defending an inappropriate technology choice (for any role), is a backwards to win the argument. But thanks for trying.

Re:"Windows for Warships": old old news

[keraneuology]

If I'm wrong, give me some citations or references and I'll be more than happy to review them - and if I'm proven wrong I'll admit that I was mis-informed, or that my information is out-of-date...or that I was dead-wrong.

How about:

"The software will run the bulk of the command and control systems in the three "decision centers" being designed into the CVN-77s architecture" - Brian Roach, Lockheed Alliance manager for Microsoft Federal.

Or improving interoperability among sensors, advanced communications systems, high-performance ship network connectivity, aircraft control systems, and other electronics on the ship.

The Navy wanted to trim costs by using off-the-shelf components, the operating system being one of them. The plan is to run pretty much the entire ship off of Windows, except, presumably (I hope) the reactor - last I heard Windows was explicitly prohibited from being used for reactor control because it wasn't a "real time" OS.

Re:"Windows for Warships": old old news

[Anonymous Coward]

The whole point of the Windows for Warships project is to replace all those embedded systems with a couple of off the shelf Windows systems running custom software. If they were just using it for driving displays then why did the ship have to be TOWED back into port after Windows crashed? Perhaps it is because the system was directly controlling propulsion, communications, navigation, and everything else that used to be controlled by seperate hardware.

Seriously

[Anonymous Coward]

Stop downloading pirated software and you will have done virtually everything you need to do to actively defend your computer from root kits!

Re:They keep flogging this outdated line of reason

[Anonymous Coward]

Using UNIX doesn't magically impart one with security smarts. There are still tarballs out there without any form of verification, that means a full audit before and after you run configure. I also suggest that you adopt the habit of checking your target and audit any scripts called from the Makefile before doing a make install.

Security is a process and UNIX people traditionally knew what they were doing, if you suddenly have a bunch of clueless clickmonkeys (AKA Windows admins) adopting *nix we will see increased virus and worm activity. Fear!

Re:MS(ux) for a few reasons, this is just one of t

[jacksonj04]

The trouble is that people do not listen. Unless they do not actually have admin access to the system, the chances are if a box pops up going "You need admin access to install this, if you have it then just shove in a username and password here:" people will do so regardless.

Hell, in XPSP2 it has this big balloon which pops up repeatedly going along the lines of "Listen you pillock, you don't have firewall or automatic updates turned on. You really do need these. Click here and I'll set it all up for you, it's about 3 seconds work!". I know people who, when have this pointed out to them, go "Oh I never read that, it just keeps popping up".

The only other thing to do with some people is forcibly configure things, which I'm sure we'd all hate. I use Active Directory to force fine-tuned update compliance and firewall settings across my home network, but home users can't even negotiate a simple dialogue going "Here's what you need to do, here's why you need to do it, here's how to do it".

So when IE pops up a convenient dialogue warning about the fact that HotPornDialer32.exe isn't signed and is in fact coming from a website with an invalid certificate, along with a warning about exactly why it's bad to click 'Install', people will do anyway. Perhaps a Firefox-esque forced delay is in order so people can't just click 'OK' without thinking.

Microsoft, the world, and everything

[FluffyCow]

If microsoft stopped empoying dumbshits, then maybe these problems wouldn't exist. supposedly in Vista they're removing a majority of the legacy code, though I highly doubt any computer system running windows could ever be called "secure", unless the user isn't an "average" user.

Let's put it this way. I run an anti-virus program, three forms of spyware/adware removal, and a firewall, yet I still get problems from shit getting installed on my system that I didn't specifically click the "yes" button, because stuff hijacks its way in when I install other programs. I'm not talkin' bout the "click yes to install bonzai buddy and lose all your personal information!!!11one!" things, either. I mean stuff that literally appeared without my knowledge. At this rate, when Vista comes out, I'm dropping money on something else. I could save 300 dollars, buy better hardware, and make a linux box and pray my games will run in the whatever windows emulators are out there.

Anyway, the rootkit problem isn't getting solved.

I forget who said it, but this axiom remains true: "The only safe computer is one not connected to the internet."

The answer is YES!

[aeoo]

I got infected with a rootkit, and man was it a pain to get rid of it! The main problem for me was that Windows was not a modular system that I could boot in pieces and that there was no useful boot log, etc. In other words, the problem is that Windows is essentially a black box, and so it was very hard for me to make an intelligent decision on how to defend the system. Obviously something starts the rootkit, but WHAT? There are so many entry points, and they are so thoroughly block-boxed, undocumented (from a power user's perspective), non-logged, etc., that I think the answer to the question is yes.

Is the closed source code of Windows preventing us from actively defending our systems?

Yes, most definitely. If it was open source, it would be more modularized and I could better understand the boot sequence and various entry points. In my experience, main open source projects are documented far better than many closed source software packages. Some closed source vendors even go so far as to withhold documentation (*ahem*Adobe*ahem*).

Is it easier to find defects in open source?

[QuestorTapes]

> ..it is easier for the "bad" guys to find the security holes in open source
> software.

Is it? I wonder if this isn't a case where we don't look for proof becuase we've assumed we know the answer. Certainly, with open source, you can examine the source. But examining complex kernel source code is no trivial task. Given the large amount of practice and study on methods of hacking closed source systems, isn't is possible that this having the source doesn't really make it easier after all? That it just offers a method not available on closed source systems?

Re:They keep flogging this outdated line of reason

[spinkter]

Sorry, but you're just plain wrong.

"This has been refuted time and again..."

Really? Got an example?

Try this one on for size: Firefox didn't have an security issues until it started becoming popular. The Mac had a few recently too.

Windows SERVERS are not the common target of these root-kits, the DESKTOP is because it IS the most popular.

If Joe Beerbelly used Linux on the desktop, you'd have to take away his ability to install programs to protect him. How useable is the system at that point?

"If Windows represent a bigger target, it SUPPOSEDLY has the "advantage" of being closed-source but the open source Unices, which are fewer in number SHOULD be an easier target."

Hogwash. Why would i target a system that fewer installs? I need an army of machines to get my spam out or to propagate my virus. *nix can't provide that right now.

I'm not saying that *nix is no good, but the logic that it is a smaller target therefore relatively unchallenged holds true.

Why bother with root kits?

[TheRealDamion]

Most Windows users I know wouldn't know how to tell other users are on the system in the first place, so a rootkit isn't even necessary. You just need the exploitable code to not take over too much system resources or bandwidth, which are the only clues most users will spot.

Even a noob in the unix world would use something like "w" at a command prompt to gain some basic knowledge of a user being connected in.

Windows and secure are mutually exclusive

[Anonymous Coward]

Back in the days when our company still had Windows servers it was a nightmare of patching, re-installing, retreiving backups, getting rid of viruses, chasing hackers, spending hours on the phone on Windows insecurity related service calls, etc. etc.

The easy job I have today I largely owe to Linux. The switch turned out the best decision our company has ever made and, especially in terms of security, has paid off many times already.

ask yourself a similar question

[richardpenner]

Does not knowing what's inside the Pentagon prevent American troops from defending our country?

There are good Windows Rootkit Revealers

[jambarama]

I've had to deal with a highly infested windows system a few times. There are a lot of ways to deal with it; my favorite is reformat and hand them Mepis (or another easy distro) but some people can't handle that. I had one system in particular I couldn't completely clean up, I had logged in safe mode and cleaned, but there was still something (with no services or processes I could see running) going on. So I grabbed this Rootkit Revealer and it found my problems. It was a cinch to log in under dos and get rid of the problems (although in retrospect I could have used Knoppix or another LiveCD.

So there are good Windows rootkit revealers, you just have to look for them.

This was expected.

[miffo.swe]

Before the solution to all problems on windows was antivirus. Then, when spyware came you needed antispyware. Now, you also need a rootkit detector (wich can be fooled pretty easy). The only way to be sure to find a rootkit is to read the harddisk from a trusted system. Couple this with Vista wich is alledged to have encrypted disk because of DRM and you have a heck of a hard time cleaning your computer.

The problem is that DRM only solves a small part of all things malicious, not everything. It doesnt defend against bad applications and all programming errors.

The problem is...

[JoeD]

Most people run Windows as Administrator. Why is that?

Because a lot of applications WON'T WORK if they're run as normal users. Why is that?

Because the Windows mindset comes from DOS, where there were no restrictions on what an application could do. Anything could put something anywhere it wanted to. So the developers got used to being able to do that.

Suddenly here comes Windows, and suddenly your application can't save settings to the INI file in C:\WINDOWS anymore, because it doesn't have write access to that directory.

The correct thing is to get an upgrade for the app. But you can make it work by just running as an administrator. So they do. And Microsoft is complicit in this by not putting enough pressure on the application developers to fix their apps to not require administrator access.

Does the closed-source nature prevent people from defending against this? Not really. If everyone ran as root in their Linux systems all the time, there would be just as many exploits for Linux.

Re:The problem is...

[Cro Magnon]

The correct thing is to get an upgrade for the app

I was already using the "latest and greatest". And the vender wasn't likely to release a new version for several months, and no guarantee that IT would work under a User Account.

And Microsoft is complicit in this by not putting enough pressure on the application developers to fix their apps to not require administrator access

IMHO, even something as simple as making User Accounts the default would have helped to encourage devs to make their crap run under a limited account. They knew what the default was and that they could get sloppy and most users would never notice, let alone complain.

Re:The problem is...

[prshaw]

>> And Microsoft is complicit in this by not putting enough pressure on the application developers to fix their apps to not require administrator access. And that is what we all want? Microsoft putting more pressure on application developers on how to write their code? Think that one through again, I don't think it is a real good idea myself.

Closed source doesn't stop the crackers

[leereyno]

Windows is a closed source system. Yet crackers are still able to create malware which lodges itself in the deepest depths of the system. I'm not aware of the cracker community having signed an NDA with Microsoft. If the crackers can create rootkits using publicly available information and the fruits of their own research, then companies like Symantec and NAI, both of which almost definitely have privileged access to the Windows source code, should be more than capable of defending against these attacks. The number one reason why we see so many attacks on windows systems is that there are so many of them out there. Very few are properly secured or run by someone who knows the first thing about how to avoid getting hacked. Most windows systems are run by people for whom computer technology is indistinguishable from magic. Windows therefore represents a cornucopia of low hanging fruit for crackers, ripe for the picking. It would be shockingly amazing if Windows WASN'T the primary focus of their attacks.

Pointing out the popularity of Windows with crackers as further "proof" of closed source software being inherently broken only makes the open source community look bad. Open source has a lot going for it. There is no need to make claims such as this one which are highly questionable on the surface and do not stand up to deeper scrutiny.

Lee

Re:They keep flogging this outdated line of reason

[digidave]

"That design being ?"

For one, better user accounts and software that doesn't require root access to run (Windows is just getting there now). For another, better separation of executables making it very easy to lock out system binaries while still giving access to applications (sbin and bin). Let's not forget that with XP Home, Windows still defaults everyone to being an administrator. I think even Pro does that for the first user created.

"On the server-side - and particularly the non-Windows server side - the single biggest vulnerability and attack vector - the user(s) - have a substantially different profile."

Maybe, but we're not always talking about social engineering. There are plenty of real software vulnerabilities. Social engineering must be dealt with by proper training.

"This is before even getting to the simple fact that unix has had 20 years more to harden itself from attackers."

Are you conceding that Unix is more secure, but using this as an excuse? Even if it's a valid excuse, it still means Unix is more secure, which is all that's important.

"Targets are not only chosen because they're easy, but also because they're useful."

I'd say that huge databases of credit card numbers and other personal information is very useful. I reckon that Unix servers are probably the most useful to break into since they're run by banks and the government as well as large corporations. Some turd's desktop is ok at sending spam, but the big hackers would be after the big servers.

ReactOS

[Anonymous Coward]

Will ReactOS save us?
http://www.reactos.org/
http://test.reactos.org/

Drop capability to load kernel modules

[dpilot]

If /dev/kmem is writable, the dropping CAP_SYS_MODULE only makes it a little more difficult to load a rootkit. I know X needs /dev/mem to be writable, but I'm not sure about /dev/kmem.

How about this solution....

[Rac3r5]

Find these badAsses..
mobilize a big mob to chase him and his cronies..
catch them..
beat the crap out of them...
then find those lawyers trying to defend them..
and beat the crap out of them... ....problem solved....

Re:MS(ux) for a few reasons, this is just one of t

[Frogg]

Perhaps a Firefox-esque forced delay is in order so people can't just click 'OK' without thinking.

I believe people will anyway -- they'll just learn that they have to wait a moment before they can click 'OK'... they still won't think. Maybe most of them never will.

Is the closed source code....

[Anonymous Coward]

... of Windows preventing us from actively defending our systems?

Absolutely NOT. Actually it helped me a lot to defend it. Actively! By switching to open source.

Preventing defense??

[pottymouth]

"question: Is the closed source code of Windows preventing us from actively defending our systems?"

Of course not! Nothing MS and Co has done, so far, can stop you from running [LU]nix or Mac OSX!!

What a load of crap

[LowneWulf]

This should read: "No defence against rootkits"

The implication that the open nature of other kernels gives us any sort of real defence is pure fantasy.

- Every practical OS kernel allows, in some security state, for the kernel to be modified on disk. This is required to update your kernel. If you can update your kernel, you can install a rootkit. Simple as that.

- Any malicious kernel can hide its effects from userspace apps.

No OS I've encountered to date can reasonably defend against this in software. In hardware, you can use read-only media to prevent the first condition, and a TPM to prevent the second (but I'm sure everyone will tell me how 'evil' TPMs are since the threat of DRM is more important than detecting rootkits).

Protection against Rootkits...

[Khyber]

I've kinda made up a half-assed workaround to keep your systems semi-secure. The only problem is you need a few hubs and a couple of routers. Test systems on one router, your more-commonly used systems on the other router. Download programs, install to test machine, see what happens, if nothing, transfer install program to your more-commonly used computers. Yes, it'll take up more of your precious time and of course resources, but it's a small price to pay for security when you're running Windows.

Of course you can always do things like total lockdown of your system by making certain files read-only and password-protecting access to those files (to prevent some automated script from doing an auto attrib (filename).(extension) -r -a -h to modify the file, and then only allowing access to thse files when you're sure the program you're using is "safe" (by Microsoft's definition of safe, anyways.)

And if all else fails, since everyone's going after NT 5+ nowdays, why not move backwards to a less-often attacked OS? Read my most recent journal to see what I mean (plus you'll get a semi-decent speed comparison with older hardware/OS compared to newer hardware/OS. You probably won't be surprised at the results, but hey, it's worth a small read, and might provide some inspiration for your future systems.)

That brings a friends tagline to mind.....

[8127972]

..... My other computer is YOUR computer.

If you want to know more about rootkit detection -

[andreyw]

If you want to know more about the topic of rootkit detection, please see Phrack Volume 0x0b, Issue 0x3d, Phile #0x08 of 0x14. http://www.phrack.org/phrack/63/p63-0x08_Raising_T he_Bar_For_Windows_Rootkit_Detection.txt

Virtues of read-only clients

[davidwr]

Imagine a windows shop where:

All systems network-booted.
All writable media was on trusted servers, except maybe a floppy or writeable CD.
For speed, local copies of common unchanging files, i.e. 90% of MS-Windows and 90% of "c:\program files", were kept on read-only media such as a HD with the write line disabled or a flash card plugged into a r/o reader.

The network boot ties down configuration to a given machine and allows patching from a trusted source.

The local ro hard disk or flash gives you fast booting.

If a client is compromised, reboot, with speeds approaching a purely local reboot.

Every time the cumulative size of the patches gets too big, re-image the hard drives or flash media.

Now, you better watch your server very carefully and make sure there are no unauthorized boot servers.

What will this take on the client end that's not common today:
- read-only media
- a layered file system
- memory for ramdisk for volitile files you don't care to save on the server

And the answer is....

[cranky_slacker]

"So the problem is serious, and well outlined by this question: Is the closed source code of Windows preventing us from actively defending our systems?"

The well thought out answer is that no, it isn't. But it does make us dependent on MS to protect us.

Which is exactly how I suspect MS wants it to be.

oh, waaaah!

[Anonymous Coward]

translation:
" I 'know' about computers as long as they run window$ but Mr. Gates just isn't serving me properly -- I don't *wanna* learn to use a real operating system, I spent years learning window$!!! OMG not the CLI!!!! Pleeeeeease, I'll paaaaaaaaayyyy! Can someone please help? waaaaaaaaaaaaaaaaah!"

Re:MS(ux) for a few reasons, this is just one of t

[Anonymous Coward]

Hang on, when I'm at home i am ADMINISTRATOR of my PC.

Developer Options

[supradave]

I have always found it extremely annoying that Windows allows you to set a flag that makes your process invisible to the process table. Gee, I can't see what's running so I have no clue as to what's running. What SFB thought that up? (I know, it was the guy that likes to spy on what you are doing while you are working.)

Read-only root

[dpilot]

How do you get around the stuff that likes root to be r-w, like /etc/mtab? I know it's frequently suggested to replace this with a symlink to /proc/mounts, but I also understand that some software doesn't like this. There is also some other stuff that likes to write into /etc, like /etc/dhcpcd/dhcpcd-eth0.info.

Re:Read-only root

[julesh]

How do you get around the stuff that likes root to be r-w, like /etc/mtab?

Symlink these files to copies in /var/etc, or something like that.

Really, this stuff should be in /var anyway; it's only in /etc for historic reasons/because of bad design.

Re:Read-only root

[dpilot]

You're right about that one.

I've tried symlinking things before, and found that some code just doesn't like it - like knews and .newsrc. But to be honest, I've never really tried a read-only root. It's about time I did.

sysinternals.com has a tool

[e40]

rootkit revealer.

Closed source code of Windows...

[RaguMS]

Is the closed source code of Windows preventing us from actively defending our systems?

Well, it's preventing US since we don't have the source code... but it's also not our job to fix Windows code. It's Microsoft's job, and that's what they get paid to do.

Solution

[drpimp]

There is a common solution for computer security (not realistic)

- Install any OS
- Store in a concrete barracks
- Get Armed security
- DO NOT connect to the internet

SOLVED!!! (sarcasism)

Story of finding a root kit...

[hhr]

A fun read....

http://blogs.msdn.com/jeremyk/archive/2004/07/19/1 87696.aspx/

It's about an MSFT engineer tracking down a problem caused by a bug in a root kit.

Window XP: No real "Safe Mode"

[MROD]

The main problem when trying to get rid or detect rootkits on Windows XP/Server 2003 is that the "Safe Mode" is not at all safe at all.

By the time the system has booted far enough to get into "Safe Mode" it's already loaded so many DLL's, including the obfucating rootkit ones, that there's no way of accessing the filesystem to see the malware.

Now, if Microsoft had added a single-tasking, statically linked command line emergency system which would allow you to just manipulate an NTFS filesystem this would be the greatest step forward in rootkit/malware removal.

Alternatively, "Safe Mode" should load only those DLL's which are hard coded into the kernel to load, along with signatures and checksums to make sure (as much as you can) that those files haven't been tampered with.

As it is, the only way I've found of de-rootkitting machine is using Knoppix 3.6 and captive-NTFS!

Re:Window XP: No real "Safe Mode"

[Kormac]

It's called the recovery console, and its been available since Windows 2000.

Boot from your XP/2k media, and select "Repair an existing installation with the recovery console" (its buried somewhere in the installer).

Or, you can install it to your Win2k/XP boot loader menu by running :\i386\winnt32 /cmdcons

It has quite a bit of functionality; you can disable services, devices, and make changes to the file system. Since it's only a command console, very little of the OS is loaded.

Kormac

Re:Window XP: No real "Safe Mode"

[RzUpAnmsCwrds]

Have you heard of the recovery console? Or WinPE/BartPE? Both can be run off a CD, so rootkits are not an issue. Unless, of course, you burn the CD with an infected system.

Re:Window XP: No real "Safe Mode"

[MROD]

Am I right in thinking that the recovery console is specific to each machine?

If it is then it's unmanagable for anything other than a very few machines managed by a single person, rather than the various user machines which I first see when they turn up with their laptop with a problem.

Re:Window XP: No real "Safe Mode"

[MROD]

Would that second item be the same as "Safe Mode with Command Prompt"? If it is then it's already too late.

I'm guessing that because the only way the NT kernel know how to ready the filesystem is by loading the ntfs drivers it'll also load the nasty drivers installed by the root kit.

Re:Window XP: No real "Safe Mode"

[Jugalator]

Now, if Microsoft had added a single-tasking, statically linked command line emergency system which would allow you to just manipulate an NTFS filesystem this would be the greatest step forward in rootkit/malware removal.

Hmm, are you talking about something like the Microsoft Recovery Console for Windows 2000 and onwards, accessible from the bootable install CD? Yes, I don't think there's anything there for rootkits, but I do think they have that system in place already.

Re:Window XP: No real "Safe Mode"

[Anonymous Coward]

Wrong!

ALL the drivers for the recovery console are loaded off of the CD.

Geeze, what is it you that section of /.ers that know NOTHING about what they are talking about and yet continue to flap their gums in the breeze?!?!?

Re:Window XP: No real "Safe Mode"

[andrewweb]

" Would that second item be the same as "Safe Mode with Command Prompt"? If it is then it's already too late. I'm guessing that because the only way the NT kernel know how to ready the filesystem is by loading the ntfs drivers it'll also load the nasty drivers installed by the root kit."

It's not the same. You can bring the recovery console up off the CD loading nothing from the hard disk.

Cisco Security Agent

[dangermen]

Cisco Security Agent - CSA builds profiles of what programs/people do. When people do something they don't normally do, CSA stops them.

ie. Man walks into office every day, uses office, outlook, and web browses. Man web browses website, website tries to exploit IE vulnerability buffer overflow. CSA sees the browser trying to execute 'out of boundary' code and kills it. CSA does a WONDERFUL job of this. Being a Cisco product though, it isn't cheap. Then again, worms are never cheap either.

wrong

[Anonymous Coward]

many linux 'distros' require kernel recompiles not to support the printer 'driver' but to support some obscure sub library that the printer drivers depend on and wasnt included in your xyzpdq flavor of linux for various obtuse reasons (The main dev had bad haddock for lunch and didnt like including libraries starting with letter h)

in the real, actual world, setting up printing on most falvors of linux is a pain in the butt. there are a few that do it well but they are just that, a few. anyone who says otherwise is either suffering from 'it worked for me, therefore it works for everyone' disease, or they are just zealots who are in it for an argument not to actually help computers get better for humanity.

Unrealist expectations, anyone?

[gillbates]

At the risk of sounding trollish, I think it's kind of naive to expect Windows to be secured. I've been watching MS since the Windows 3.1 days, and I've never seen any improvement in regard to security. Sure, Microsoft talks a lot about it when their customers talk about it, but they don't actually do much toward that end. Why people still expect such a fundamentally flawed OS to be secure real soon now is beyond me. If Microsoft hasn't produced a secure OS in 20 years of business, what makes you think they're going to change now?

And honestly, I don't blame them. Windows was designed to put multimedia on the desktop, and turn the PC into a consumer-class appliance. And toward that end, Microsoft has been very successful. They know how to do the ease-of-use and multimedia stuff. Security isn't their strong suit. So what?

You probably know the saying about using tools for the purpose they were designed. If Windows is a tool, it was designed for games, not security, so don't expect it. If you want security, run Linux or UNIX, or perhaps an IBM mainframe. But don't install Windows on your machine and then start whining about how insecure it is. If your box gets owned, well, you've got only yourself to blame, because you knew Windows was insecure when you installed it.

If you must run Windows, just accept the fact that you're going to have to format and reinstall every year or so. This is what the rest of the world does, but here on ./, there's this expectation that computers can run forever without crashing. That might have been true when the mainframes and UNIXes were king, but now, for the average person, insecure systems are a fact of life.

Knoppix to the rescue.

[Stephen Samuel]

You can use a live CD like Knoppix to boot and examine your system for greeblies.. This applies to both Windows (( clamav )) and Unix (( chkrootkit )) issues. Note that doing an exaustive search of a large filesystem can take hours. If you're more 0worried about uptime than security, then take an image of your disks and do the checks on a different box. (exterma; 5" USB drives are really good for this).

Why would they?

[TheLink]

Why would MS make that available?

Wouldn't they rather make DRM available, and promote that as the preferred "treatment"?

Step 1
"Users can't be trusted to not run the wrong programs, so let's 'protect' them from themselves"

Step 2
"Users can't be trusted to not run the wrong programs, so let's 'protect' us and our friends from them"

After all, Windows really isn't less secure than Linux. They're both in the same _class_ of security.

I daresay the same "download and run everything" users given a "Desktop Linux" would do the equivalent of switching to root to install a "Kournikova screensaver".

Seeing that so many windows users actually entered a password to unlock zipfiles and then ran the trojan executables in them, it can't be difficult to get these bunch to run su -; perl trojan.jpg (where trojan.jpg is a perl script) or even "./configure; make install".

So one way to protect these people from themselves is "Trusted Computing" (see Step 1).

Re:Why would they?

[Anonymous Coward]

Why would MS make that available?

No idea, but they do, so I don't know what you're on about.

Ummm, no.

[Anonymous Coward]

I'm sorry, but anyone thinking that just running tripwire is going to save your butt is very sadly mistaken. Yes, tripwire will help. But it is not a silver bullet. There IS no single silver bullet.

The problem with tripwire is that it is easy to overlook spots, most notably, directories which change often (E.g. logfile, lockfile and spool directories).

Once an attacker has root, s/he can install their binaries in one of these directories and it is highly likely that tripwire has been configured to overlook it.

All of the publically available standard tripwire config files that I have seen have this problem with them. The alternative is to constantly deal with lots and lots of output, which kind of defeats the purpose of tripwire.

Instead, you should combine tripwire with other tools to scan the weak areas. Just looking for setuid root files in odd places (via /bin/find) can go a long way. Replace /bin/find with a static version on a CD-ROM if you like.

Rootkit, Shmootkit...

[eno2001]

When was the last time anyone in the FOSS world actually wrote a patch to protect against a known rootkit? Hmm? I'm waiting... The fact of the matter is that the security (while it will never be perfect for ANY OS) in FOSS software/OSes is much better than in the Windows world. Protections aren't written as a reaction to a known problem, they are written before it becomes a problem. Yes, that even means things like the recent Firefox revelations. There are no known exploits, just holes that could be used to exploit. In the Windows world, more often than not, there are several exploits utilizing a hole before it's patched. If they were to change their development model to FOSS, a lot of those holes would get cleaned up faster. End of story.

Re:Try again - a little snack for a Troll

[haruchai]

Well, since you can't spell G-O-O-G-L-E, try this:

http://www.securityfocus.com/columnists/188

Jeez, Mr. Troll, if anyone is washing in Hog water, it's you. Unix machines ARE the army of the Internet and have been since its inception. So, for the sake of efficient distribution of malware, Unix machines should have been the logical target.
Of course, it would be double duty to write viruses for Windows but find a way to distribute them by way of Unix, but, oh wait, this has been done by E-MAIL!!

How to turn off Security Center alerts

[Vandil X]

1. Open up the Security Center applet in the Control Panel.

2. In the left margin of the Security Center window, click the "Change the way Security Center alerts me" link.

3. In the window that appears, uncheck the alerts you don't want to see (Firewall, Automatic Updates, Anti-Virus) and click OK.

Re:How to turn off Security Center alerts

[tehcrazybob]

How exactly does this make the computer more secure? Most people won't even go to this level of effort. The issue here is that people ignore that balloon, which happens to be an EXTREMELY IMPORTANT balloon. We don't need to make the thing go away, we need to make the users follow the instructions in it, or make the secure settings default and do away with the balloon altogether.

MS has a "Shared Source" initiative, BUT

[WebCowboy]

...it really isn't as effective as it could or should be

Does Microsoft over share their code with developers?

I'd say they "under share" if you ask me. My employer has a fairly close relationship with Microsoft and to my knowledge no one in our company is privvy to the source code to any of Microsoft's OS.

The "Shared source initiative" is really just a marketing term under which MS lumps all its programmes involving the disclosure of source code. These range from truly open source projects like those involving automated generation of application installers to special agreements with governments to permit government security audits on Windows OS source code.

The terms under which third-parties may obtain source code to operating systems is quite limited:

* you are only permitted access to Win2K, WinXP, Win2K3 server. You may NOT legally see the source to MSDOS versions 1.0 to 8.0 or their respective GUIs (Windows 1 to 3.11,95,98 or Me) under any circumstances as far as I know.

* generally, you must be a licensed user of at least 1500 seats--a large enterprise user--unless you are a government, or an affluent MS MVP. My employer qualifies here easily...HOWEVER...there is one problem:

* Quoted from MS' terms: "Source code may not be used to assist with the development of a commercially distributed product." In other words, not only can you look but not touch the source, you cannot eve look at it to make your software product better...oh yeah, and don't think ditributing GPLed software isn't "commercial distribution" because that is forbidden as well.

This third restriction, along with other NDA terms, make us and many others INELIGIBLE for viewing the source to any version of Windows. There is only one form of source licensing in which you CAN distribute software that you developed with the assistance of Windows source code--and that is if you obtain an OEM license agreement. The restriction is still pretty severe...these licensees can only distribute drivers for hardware which they develop and distribute. Since my employer sells more than driver software, if we wanted such a license we'd have to evoke our own "chinese wall" and be extremely careful that those who have access to Windows source code will NEVER work on the development of our commercially distrubuted applications.

Given these restrictions it looks rather unlikely that developers of antivirus software have source access to Windows since they commercially distribute the software. Unless, however, they have negotiated a specific, custom agreement with MS. This has happened at various times, and usually it ends up where MS licenses the outside party's technology for inclusin in their own products. A good example is Citrix--they negotiated for access to the source code of the NT kernel many years ago (before NT4 came out) because their WinFrame product basically installed a modified kernel and they needed access to enough of the source to build that kernel. Later MS strong-armed Citrix into a pretty sweet licensing deal to their MultiWin kernel for inclusion in NT4 TS edition and future NT-based Windows releases.

Such cross-pollination generally happens pretty naturally and frequently in the open source world, but from what I gather the above was only accomplished with a lot of time, money, lawyers and legal documents generated in triplicate. I fear that in the closed-source-MS world the only way we'll get the most effective anti-malware technology possible into Windows will be when MS strikes such a cross-licensing deal and bundles antivirus functions into its OS. At that point, 3rd party vendors of antivirus products will have to shift focus, perhaps offering software that extends functionality or eases the management of the built-in AV functions. It's pretty much inevitable actually, since the closed model of development discourages diversity and friendly collaberation in favour of homogeneity and antagonism towards others.

Re:MS has a "Shared Source" initiative, BUT

[east coast]

Does Microsoft over share their code with developers?

Sorry, I was trying to say "ever share". My typing skills have gone to hell recently. Sorry again.

Re:MS(ux) for a few reasons, this is just one of t

[Lumpy]

i have the solution for the inept family members. If they demand to run windows then in order to get free IT support from me they have to let me install trustnoexe on their machine. I set it up via a vnc session after they start the vnc server by an icon on their desktop.

yes, they can no longer install software themselves. but no spyware or viruses can get past it as they are not on the approved to run list.

is it a PITA for the computer owner? yes. But they will accept it if they want free help from me. it works great for most of my family and typically most people do not install software often if at all after they get it set up to run the way they want.

Yes it would...

[Baldrson]

Administrative tools being replaced by a root-kit happens after the hole has been discovered and penetrated. It is simply a way to make maximum use of the hole and cover the tracks. If there were no hole in the first place, because there were insurance companies paying real programmers real money to be real professionals -- the holes wouldn't be there.

Re:Yes it would...

[bill_mcgonigle]

If there were no hole in the first place, because there were insurance companies paying real programmers real money to be real professionals -- the holes wouldn't be there.

Huh? I thought we were talking about private API's not being made available to application developers.

Administrative tools being replaced by a root-kit happens after the hole has been discovered and penetrated.

Usually through a buffer overflow, which isn't specified by the API.

Are you suggesting there should be API's for the admin tools so we can use 3rd party admin tools? A new process viewer, volume manager, add/remove software tool, etc?

Re:Yes it would...

[Baldrson]

Things like buffer overflows are deviations from the API. They are noncompliant side effects. A Widely used API with insurance companies betting on it would have all kinds of bonded testing corporations going after the API with test suites that determined whether such noncompliant side effects operated in a given implementation.

All I'm saying about administrative tools/root-kits is that they are a secondary consideration to the fundamental security flaw: closed APIs supporting natural software monopoly such as MS's. The fact of the matter is that administrative tools should be considered applications. The subset of the system API they use merely differs from most applications.

Re:Yes it would...

[bill_mcgonigle]

Ah, I see your point.

I think clickwrap licenses need to be invalidated before Microsoft will do anything here.

This is pretty much what many security researchers do - throw bad data at public API's and see what breaks. As long as users are non-indemnifying Microsoft with the EULA, Microsoft has a by.

I'm surprised insurers are writing business continuity policies for people who use Windows, but they do.

From a slashdot post long, long ago...

[Anonymous Coward]

"The root of all evil is C:\

Could give an example please?

[snowwrestler]

Firefox didn't have an security issues until it started becoming popular. The Mac had a few recently too.

I haven't seen or heard of a single Mac virus, worm, or rootkit in the wild since OS-X was released. I've gotten plenty of security updates from Apple, but these are patches, not exploits. In other words they're internal to the code, so they have no relation to popularity--the code has no idea how many computers it's installed on. Whereas exploits are human-created new code that could be inferred as being related to popularity. But I haven't heard of any. I'd love to know if some have actually been found (as opposed to hypothesized).

Firefox-esque delay fixed

[Donny Smith]

>Perhaps a Firefox-esque forced delay is in order so people can't just click 'OK' without thinking.

It's funny you should say that - there's a fix for that bug and it comes in shape of a Firefox extension that helps you get rid of the nagging delay.

http://www.mrtech.com/news/messages/5071.html :-)

Re:Firefox-esque delay fixed

[jZnat]

But the delay is in the about:config preferences, so I don't see why you'd need an extension to change one single preference (unless you're talking about the MR Tech Local Install extension).

Re:MS(ux) for a few reasons, this is just one of t

[Nogami_Saeko]

Actually, if fewer people ran 2K/XP as admin, there'd be a lot fewer problems with viruses and trojans - many (most?) are unable to install using "normal means" (ie: through a browsers or email client) using non-admin accounts.

I've given some serious thought to doing that myself, but I've never been hit badly enough to worry about it.

That said, some of the new rootkits are very, very good and kind of frightening. Do a bit of investigating at some of the hacker websites (like the guy who wrote the trojan which was used at Valve for the famous HL2 theft), and you'll see how sophisticated they've become since that very early version that was relatively easy to detect compared to what's out now...

For the newest trojans, aside from actually physically booting windows from a clean source (ie: bootable clean CD-ROM that can check file signatures and such), these new trojans are undetectable by even the most current scanning software (including scanning tools from sysinternals and such). They hook the OS early enough, and at such a low-level that they're completely invisible when you're running the OS itself.

N.

Re:MS(ux) for a few reasons, this is just one of t

[darkfire5252]

This seems like a symptom of a different problem, not really a problem in and of itself. Users become complacent with dialog boxes, systray warnings, etc, because there are no limits or standards regarding when these warnings are issued.

In the same session I can recieve the "Take a tour of windows," "Your firewall is not turned on," "Clean up your desktop icons," and "Your hardware could not be installed" messages, all from the same section of the screen with the same look. Starting immediately after Windows installation users are taught those are 'random message bubbles' that could mean anything. Users just get discouraged when they have to acknowledge that they are sending information across the internet unencrypted, then acknowledge they are entering a secure site, then acknowledge they are leaving a secured site.

There's a better way

[Anonymous Coward]

Especially if you have lots of data and are afraid that it might not all get backed up ("Damn, the computer doesn't know what songs are on my CDs any more, now I have to go to FreeDB for all of them...")

This is for the old win98, which a lot of folks still use and which should be regularly cleaned out anyway, since MS no longer supports it. The same will apply to XP, just the directory names will be different.

First, you MUST have made a bootable floppy when you installed Windows. No bootable floppy and you're SOL.

Boot your system with your (now write protected, of course) floppy. When you get an A: prompt, deltree /y c:\windows. Then deltree /y c:\*.dat. This removes your Windows directory and your registry.

del C:\command.com (if "file not found" you're OK). del c:\autoexec.bat

deltree /y c:\*.sys
deltree /y c:\*.bin

Then get rid of the "program files" directory, then fdisk /mbr (on the off chance that a virus or root kit has written itself to teh master boot record, like the old-skool floppy viruses did). Note that if you DON'T fdisk /mbr even reformatting the hard drive won't get rid of the rootkit, as a simple reformatting leaves the MBR intact.

Finally, reinstall Windows and all of your software.

Simple and easy, should only take you a full day or three. With win 98, repeat at least every three months.

If your machine is dual-boot with some flavor of Linux, you'll probably also have to also reinstall that as well, as the "fdisk /mbr" will wipe out grub or lilo, depending on which one you use.

However, if you ARE running a dual boot machine, disable all networking on the Windows side. It's pretty hard to remotely break into a machine with no network support. If you're really paranoid, make sure your modem is shut off when you boot into Windows.

And if it's a games machine? Hell, just don't keep any data on it. You'll only be sending spam when you're playing DOOM anyway (and you'll no longer be an LPB) ...that said, yes it is often faster and easier to fdisk and reformat, especially if you have a ghost CD.

Re:MS(ux) for a few...Sys Admin?? What's that?

[lcsjk]

To submitter, parent and grandparent! You might as well be asking them to draw the curve of 1/ABS(x^2).

These users have a machine that starts them with admin priviledges, and then does not tell them or help them to be anything different. It also does not tell them why they should. When they see a pop-up that tells them they need to need to be admin and to enable their antivirus, or firewall, or whatever, they say "What?!!" and then click on 'close this window', or if it sounds good they will click 'allow'.

Programmers need to understand that people need very-extremely-simple instructions that take them step-by-step through the setup that will make their computers safe. Yes, that takes a lot of time and will require testing by the little old lady cashier at the grocery, but once you master the fact that it can be made to work, computing will become safer for all of us.

Bad question

[jasonmicron]

Is the closed source code of Windows preventing us from actively defending our systems?"

If you can go in to the source code and tinker with it, chances are you don't need any help defending your system in the first place.

Re:MS(ux) for a few reasons, this is just one of t

[Anonymous Coward]

Since I am merely a stupid user how can I tell the different between the pop-up which says
"Listen you pillock, you don't have firewall or automatic updates turned on. You really do need these. Click here and I'll set it all up for you, it's about 3 seconds work!"

and then really does the work

and the pop-up which says

"Listen you pillock, you don't have firewall or automatic updates turned on. You really do need these. Click here and I'll set it all up for you, it's about 3 seconds work!"

and then installs a root kit then really does the work

automated attacks more difficult

[willCode4Beer.com]

Another benefit of a configurable kernel is that there are so many variations. The variety makes it much harder to write a worm that is effective againt a significant percentage of Linux boxes. Worm writers know that with Windows they can make alot of assumptions about what is where when writing shell code.
An automated attack against a RedHat box will usually fail miserably against a Slackware box, even if they have the same packages and security configuration (which they probably won't). When you consider the huge variety of distros and wacky hardware that people run Linux on, it no surprise that most successful attacks are 'manual'.

If you think about it, we have an OS that if someone wants to break into your boX, they WILL have to do it personally, as opposed to releasing a worm that attacks 1000's of machines at a time.
Seems to me you're less likely to get compromised in the first category. If someone *really* wants to get access, THEY WILL (regardless of OS), just don't make it easy.

Re:automated attacks more difficult

[drsmithy]

The variety makes it much harder to write a worm that is effective againt a significant percentage of Linux boxes.

Most exploits target userspace code, not the kernel.

An automated attack against a RedHat box will usually fail miserably against a Slackware box, even if they have the same packages and security configuration (which they probably won't).

I can't see many reasons why that should be true (assuming they have the same version of some exploitable daemon). A few files being in slightly different (but still quite predictable) places shouldn't slow down well-written code (whether or not it's well written, is another story...). I mean, how often do you bump into a Linux machine without bash, find, grep, perl, awk, etc, etc ?

Re:automated attacks more difficult

[willCode4Beer.com]

can't see many reasons why that should be true

Try writing some shell code and injecting it and you will see why.

Re:They keep flogging this outdated line of reason

[Anonymous Coward]

Newsflash for those who didn't get the memo: Windows leads by a huge margin ON THE DESKTOP.

Newsflash for those who didn't get the memo, or for that matter read the news recently. Malware goes where the money is, that happens to be delivering spyware/adware these days. The desktop is where most users reside thus it's also where the most malware shows up as well.

Secondly have you tried browsing the web lately without adblock? Servers don't need rootkits, they're already serving ads as fast as they can.

There is a solution

[Beryllium Sphere(tm)]

MS Research put together an elegant tool called GhostBuster, mentioned above in one of the +5 replies, which answers your question.

What does a rootkit do? It hides things. MS Research's insight is that this is all you need in order to detect one. Boot twice, once from CD and once from the suspect hard disk. Run a system inventory in each session. Then compare the two. Look for files and registry keys that a clean system can see that don't show up when you boot from the suspect system.

This approach cancel out all the problems with version management and undocumented files.

why all things to all people

[willCode4Beer.com]

Why must an OS be all things to all people?
Maybe your mother can have a different OS than you. If you are an advanced user and she is a novice, why should you use the same OS?
This is like a Mac fanatic defending a one-button mouse because its easier for a novice. About 30 minutes of use moves a person above the state of pure novice.
Just imagine a world where people make their computer revolve around their own needs instead of sucumbing to it. A diversity of OS's means that any attacks are limited in scope. Everyone is better off.
Lets face it, windows is the best OS for some people, linux is the best for others, mac is the best for others, bsd is the best for others.....
Why should we choose an OS based on what Mom or Grandma needs? Get your OS for what YOU need. Mom and Grandma are smarter than you think, and can decide what makes their lives easier.

OT:
regarding the printer. when I bought a new printer for my linux box, I just plugged it in and the printer setup wizard started immediately. I was printing a test page in 30 seconds. The same printer on Windows XP took 5 minutes to setup and required a reboot

Re:why all things to all people

[Dan_Bercell]

OT: regarding the printer. when I bought a new printer for my linux box, I just plugged it in and the printer setup wizard started immediately. I was printing a test page in 30 seconds. The same printer on Windows XP took 5 minutes to setup and required a reboot Only reason why it would take that long and require a reboot is because you install the printers OEM cd, which installs a whole bunch of additional software that isnt required to print. Usually that additional software gives you editing options, ink/toner management from the desktop... ie things you can do from a GUI instead of doing it from the command line interface of the printer itself.. Personally I hate the OEM CDs and additional software the install, and just install the driver for the printer.

Re:why all things to all people

[Decker-Mage]

Hear, hear! I'm sick and tired of the evangelism which probably means I'm hanging around in the wrong place {sigh}. These beasts are just tools and when I advise someone, or when I'm designing a machine for myself, I select the machine and OS to support the applications, not the other way around. That cart don't go so well with the horse behind it, IMNSHO. I have six computers and not a one of them has the same OS on them and it's a very mixed bag: 2000AS, WS2003Web, triple-boot WS2003Ent/*nix of the week/XP beta testing platform, Solaris 10, Novell/SuSE 9.2, and even Win 3.11 for duping 5 1/4's and really antique support ;-). That doesn't even count the virtual OS's for testing other things which I can't talk about. See? That's my toolbox and those are my tools, not an evangelical pulpit.

Why people feel the need to shove something down other people's throats or evangelically browbeat them is a mystery to me. I'm here to solve people's problems, not make life more difficult. I present the options that are within their budget, explain the distinctions without bias, then let them decide. BTW, since they have made an investment (client buy-in), I've also found they are willing to put more time into learning their systems and learning about protecting themselves. I sometimes think we, the geek community, are our own worst enemy! Sheesh.

Re:MS(ux) for a few reasons, this is just one of t

[lgw]

This all changes in Vista. However, it's all for nothing if the user types in his password to install malware anyway. Or if there's a priveledge-escalation bug (like the one recently discovered in OSX) to exploit. Ultimately, there's always adumb user, and always a security hole somewhere, but the fact we can't make security *perfect* shouldn't discourage us from making security *better*.

No Defence? SpyCatcher is a good defense.

[NerdMachine]

The anti-spyware product SpyCatcher 2006 (free as in beer version) will detect rootkits when they are being run. It also uses some rootkit technology to foritfy itself from spyware trying to detect anti-spyware products.

Re:They keep flogging this outdated line of reason

[drsmithy]

For one, better user accounts and software that doesn't require root access to run (Windows is just getting there now).

This is neither a design problem, nor even a Windows problem. Software that (unnecessarily) requires Administrator access to run is the fault of the software developer, not Microsoft/Windows.

For another, better separation of executables making it very easy to lock out system binaries while still giving access to applications (sbin and bin).

You mean like, say, %SYSTEM% and %PROGRAMFILES% ?

Let's not forget that with XP Home, Windows still defaults everyone to being an administrator. I think even Pro does that for the first user created.

Again, this is not a _design_ issue, it's a default configuration issue. A _design_ issue would be if there were no way of creating non-Admin users (eg: like Windows 9x).

Maybe, but we're not always talking about social engineering. There are plenty of real software vulnerabilities. Social engineering must be dealt with by proper training.

It's not just social engineering. An experienced user will not only have a machine that is harder to penetrate, but also be able to identify that a machine has been exploited sooner, and fix it quickly.

Or, to put it another way, desktop users are highly unlikely to ever know their machine has even been exploited in the first place, let alone fix it.

Are you conceding that Unix is more secure, but using this as an excuse?

I'm pointing out why the GP's reasoning is specious. How secure a machine is has 99% to do with the user(s) and software and 1% to do with the OS.

Even if it's a valid excuse, it still means Unix is more secure, which is all that's important.

And if life were that simple, you'd have a point - but it isn't. It's just as possible to run a secure Windows machine as it is an insecure unix one. It's the user that has the biggest impact, not the OS.

I'd say that huge databases of credit card numbers and other personal information is very useful.

Certainly - it's also very difficult, because the people responsible for the servers know they have a juicy target and treat it appropriately (in both the pre-emptive and reactive sense).

I reckon that Unix servers are probably the most useful to break into since they're run by banks and the government as well as large corporations.

And I reckon they're among the hardest to break into and get away with it - thus making them highly unattractive targets.

Some turd's desktop is ok at sending spam, but the big hackers would be after the big servers.

"Big hackers" aren't using spyware and web-browser exploits.

Bonus!

[NMZNMZNMZ]

This works on any OS! Amazingly effective technique!

Probably already said but...

[TractorBarry]

This has probably already been said but I'm pissed and am having a casual browse before bedtime....

Sysinternals

If you must use Windows these fine folk are well worth a visit (should be mandatory...)

Re:Probably already said but...

[Anonymous Coward]

No.

We had an infected (via IE) sales laptop enter into the Lan. Needless to say, all Windows boxes were owned within three days (IDS box didn't detect it). Process explorer helpled for the Win2000 and NT boxes, but all the XP versions (SP1 and SP2) were owned. It was a bitch to get rid of (reformat/reinstall and new laptop subnet). You have rootkits that are now just waiting (idle) to get inside a Windows network to infect other machines (could happen to Linux/OSX too).

When you can hack the Windows kernel so easy and hide your program from any other programs, you have a shitty OS.

Analogies are awesome.

[Quikyn]

"If I leave a loaded gun lying on the sidewalk and someone picks it up and shoots someone else, I think I may get some bad karma."

Indeed you might. I'd like to try a hypothetical to look at this differently:
Lets say you live in a world where everyone wears a bullet proof vest because people being shot is something you expect to see every day ...

If you discover that the most popular vests are actually vulnerable to ... I dunno ... being shot? By publishing this you inform all the people that the protection they depend on is flawed, and they can fix it. You also inform all criminals of the problem and that makes them a bigger threat in the interim.

Is this bad karma? I would think it would be your responsibility to demonstrate the flaw.

a reason to say 'no'

[andy_t_roo]

a good step in the direction would be a big red message saying: $program is attemtion to change $(low-level,and important thing), PRESS NO unless you are installing new hardware. if you give the user a good reason to click no by default, that would remove a large number of problems where things that shouldn't be requesting system level changes do. possibly the real problem is that the average user doesn't know what actions require what permissions.

Re:They keep flogging this outdated line of reason

[The Bungi]

Heh. Be careful with your examples or you might dig yourself a larger hole than you intended. If your logic is correct then Solaris (which was opened up only a few months ago) would have had a terrible security track - the problem of course is that it doesn't. It's about on par with the BSDs and Linux. Same goes for HP-UX and Xenix.

Also, by your calculations other 'propietary' operating systems like VMS and other 'old school' boxes that are outward-facing would be rooted every other day. Believe me, that's not the case.

It certainly seems to me that there are far more defacements and intrusions out there involving Unix-like OSes than Windows boxes. Of course Windows desktops are trapped in botnets and whatnot, but much of that can be traced back to user stupidity. The idea that a Windows computer cannot be successfully secured is a dear one to most open sores fanboys, but it's unfortunately not true.

Finally, all you need to do is to (theoretically at least) extrapolate the number of vulnerabilities Firefox (as an example of an 'open application') has had since it was first released and arrive at the conclusion that it will have a worse track record than IE. And isn't it interesting that the great majority of these vulnerabilities were discovered by people who were not looking at the source code? The same way vulns in IE are discovered. So if you are right we must have expected that Firefox should have shipped with zero bugs. None. But that's not quite the case, now is it?

And why doesn't IIS6 have more vulnerabilities than Apache 2?

Your logic seems leaky to me.

Defense against rootkits is apparently in Vista

[jschoenberg]

According to this link, Vista will include some protection against rootkits:

Windows Vista Security and Data Protection Improvements

"In addition to these features, Windows Vista can clean many worms, viruses, rootkits and spyware thereby ensuring the integrity of the operating system and the privacy of users' data."

Re:MS(ux) for a few reasons, this is just one of t

[Anonymous Coward]

The problem with the reason why most people dont install automatic updates and firewall is for 2 reasons, reason 1 windows firewall is a load of junk, no flexability in rule sets and REDUCES network efficiency (WTF?). Second windows update, click on and it will ask for another 200 megs worth of os junk to be installed, wait a month and it will need a crap load of patchs to be installed, Patch after patch after patch after patch when will it end?

No i can understand why people dont like this, run a linux box and you get a) a decent firewall that doesnt mess up the system, b) Source code patches for the kernel that can be compiled when required (and are tiny) and software updates which are package dependant, not just a big chunky block of programmed flabb that ms decides to dump in your desktop so make your machine even more slower performance wise because by now if your windows box has been running for more then 6 months the ammount of dodgy registry entries have made your pc 1/3 slower from what it was when you took it out of its box.

Anonymous moderation

[BeanThere]

Agreed, there's a problem, and metamoderation doesn't help. I think part of the solution is to get rid of anonymous moderation - show the usernames of every mod when you click on a post and see the 'detailed' moderation breakdown, so moderators will think twice before hitting '-1', and those moderators pushing obvious agendas (e.g. the astroturfers, sock puppets and so on) could soon be exposed. Either that, or fix metamoderation, or build an interface for some kind of meta-moderation 'voting' into the general thread interface so anyone could immediately click it if they saw an unfair moderation.

Re:They keep flogging this outdated line of reason

[Dan_Bercell]

These large Unix systems... you know the ones holding all the personal data are broken into on a regular basis. However you wont hear about it unless it effects you or is something that happens locally. you would be suprised has to how often a large corporation may have security issues, but wont disclose them unless they have to.

One solution

[Anonymous Coward]

Try to post it as "code" instead of plain text.

From my testing (trying to post Perl code) that seems to bypass the junk character nonsense.

Tripwire is a waste of money

[Nailer]

RPM already records checksums of every file it installs. It can also be run from a rescue CD pretty easily, and can use a known good backup of the RPM database to achieve similar functionality to tripwire.

Nothing against tripwire, if you didn't have RPM it'd be a fine tool, just checksumming everything twice for no reason sounds silly.

Re:They keep flogging this outdated line of reason

[Nailer]

> Really? Got an example?

IIS. Less than half the market share of Apache httpd.
If popularity doesn't mean anything in terms of server exploits, why would it mean something in terms of desktop exploits?

Re:MS(ux) for a few reasons, this is just one of t

[Decker-Mage]

Where have you been? That was true in the past but if you've updated XP to SP2 it certainly ain't true anymore. ActiveX and installation require that the user grant permission. In Windows Server 2003 it's even tighter as you have the Internet Explorer Enhanced Security Configuration to contend with unless you manually rip out that component. It doesn't allow a damn thing except straight HTML, zip, nada, nothing. You have to add a site to your trusted list, even Windows Update, before any active content or cookie is allowed to prompt you and even then it defaults to the restricted security zone and requiring authorization for every little thing you might want to do. That's actually pretty handy since I have the various ad servers blocked here that way ;-).

Sorry, but you the (l)user have to give the openings before something happens now. Actually, with my setup here (WS2003Ent.), Firefox is the least secure browser I have which is strange to say the least. It's still my preferred browser though. I just had to put a proxy in front of it to filter out the active content, unless the site is granted permission, and tweak some settings away from the defaults.

Two weapons and a technique for Windows...

[Decker-Mage]

Two weapons that you can use, which are free, are Root Kit Revealer and AutoRuns from the SysInternals web site. Tons of free system administration tools that allow you to go down to a very deep level if/when you need it. The article for Root Kit Revealer there gives more details about what it would take to circumvent it so I won't repeat it here.

As for the technique, every loving file on my Windows boxen are MD5 checksummed and the master list is kept in an encrypted volume along with all my NDA stuff using DriveCrypt. If I have any reason to suspect something has tinkered with on my systems, and once a month no matter what along with other major maintenance, I do a diff on checksums. It's not hard, just a bit of tedium until you script it, just as with monitoring log files. I consider it right up there with my regular virus checks despite the fact that my security policies here would prevent one from even getting into a system in the first place. Insurance (risk management).

Re:MS(ux) for a few...Sys Admin?? What's that?

[Decker-Mage]

Frankly I haven't seen this problem for the people (clients) that I've worked with and yes, most of them do run as an administrator. Along with locking down their networks and systems, installing various free software, and such, I also give a running teach-in on simple security measures that they can use to protect themselves. I developed my lessons while I was in the US Navy administrating and repairing over 575 desktops and I don't know how many laptops (we never did get an accurate count) at a Naval Air Station. It got real old cleaning up systems after some id10t brought a disk from home, or opened the wrong attachment, so the training became mandatory and lo and behold the number of incidents dropped like a rock.

Not a single client of mine in over ten years has caught a worm or a virus. Users can learn, you just have to have patience and put it in terms they can understand. It also helps to reach out to their circle of friends to make sure that they are following safe practices as well. Unfortunately, I've noticed that all too many of my geek friends have neither the patience nor the willingness to speak anything resembling normal English or in terms people can relate to when talking about this subject. Sorry, but that's the truth.

Re:MS(ux) for a few reasons, this is just one of t

[jacksonj04]

One of them pops up a bubble in the system tray as soon as you log in, as well as popping up a big security centre window the first time you turn the machine on or install SP2. In fact, if you're not part of a domain, it kicks in the initial security centre configuration before you even get the chance to log in.

All it takes is for them to pay attention once.

Re:MS(ux) for a few reasons, this is just one of t

[armb]

When I first put XP on my home machine, I set it up with an admin account and normal users. After the third game my children wanted to put on it not only wouldn't install without admin rights, it wouldn't run either, I gave up and made everyone an admin.

Re:MS(ux) for a few reasons, this is just one of t

[jacksonj04]

Is it bollocks. Most people wouldn't know about network efficiency, and with the speed of systems today and trickle updates, it doesn't make any difference if it's 200KB or 200MB.

Running a Linux desktop is a pain in the arse, whichever way you look at it. Yes you do get a firewall, after much prodding aboug, and people DO NOT WANT TO HAVE TO COMPILE THEIR OWN PATCHES INTO THE KERNEL. Linux is a moot point. Why not get a Mac instead, or a hardware firewall? We are dealing with Windows, and whilst Linux is a generally superior server OS it cannot yet compete for Joe Public on the desktop without someone to support it.

As it is, automatic updates and Windows firewall are designed to be a set-and-forget approach to security which for 99% of users works perfectly. They don't care about being able to allow specific ports outgoing access, or whether the packets are UDP or TCP. They don't want to have to recompile shit, they just want to be able to click a button and the machine does the rest. Which automatic updates and Windows firewall does quite well.

Re:They keep flogging this outdated line of reason

[digidave]

Most importantly...

"It's just as possible to run a secure Windows machine as it is an insecure unix one."

If we avoid the lowest common denominator, it's possible to secure a Unix system far more than it's possible to secure a Windows system. Tools such as SELinux and chroot aren't available on Windows (unless some 3rd party has made them). Chroot especially is a standard tool for securing a public-facing service such as web or ftp. SELinux is still young, but does wonders to prevent an exploited app from doing any harm.

They did!

[jim_oflaherty_jr]

It's called Knoppix!

Win2K security certification

[Mr2001]

TCSEC has apparently been superseded, and Windows 2000 is rated at Common Criteria level 4 out of 7.

More FUD from Mr 'I make up stats'

[Foofoobar]

Earth calling moron. PHP was an apache foundation project until within the last year when it was released to Zend to watch over the project. It is still released under an open source license (while the Zend engine is NOT).

And I like the way you admit that they are not amateurs and then contradict yourself yet again.

Let me know when you make up your mind or if you ever find out whose ass you are pulling this 99% stat from. I love the fact that you keep repeating it without saying where it comes from. Makes you look all the more like a Microsoft shill spreading FUD.

Re:More FUD from Mr 'I make up stats'

[Anonymous Coward]

You're stupid. You were talking about PHP as if it were an ASF project right now. I told you it is not. Now you're changing your tune.

When did I contradict myself? I said that most of the ASF guys are not amateurs except for those working on some projects like Jakarta Commons. Then I said that most open source programmers don't commit to ASF projects and are amateurs -- like those working on Drupal.

Let me know when you can understand English.

Captain FUD and the Fud Mongers

[Foofoobar]

Whatever you say Mr 'I make up stats'. It's not my fault that you make assumptions. Besides, my point still stands that it's an open source project and you have openly admitted that they are not amateurs. Hence the contradiction. But then 99% of FUD mongers like yourself lack the intellect to detect their own contradictions.

This is mainly due to the fact that 99% of Fud mongers suffer from a form of premature retardation. This

See? It's amazing how easy it is to make up stats. 99% of people can do it.

Of course 99% of all people will call it FUD. But then 99% of FUD is a non-fat dairy substitute.

So when do we get to see where that 99% stat came from, hmmm? Which body cavity did you plummet to come up with it? Inquiring minds want to know. :)

Making up stats

[Foofoobar]

Still waiting on where you found that 99% stat? Methinks the lady doth FUD too much.

The Definition of Amateur

[Foofoobar]

It also turns out that 99% of FUD mongers don't understand simple dictionary definitions. So here you go, let me teach you at least one thing today and hope it sinks in.

amateur n.
      1. A person who engages in an art, science, study, or athletic activity as a pastime rather than as a profession.

So all one of these guys has to do is get paid at some time to code. And hence, not amateurs. This definition does not apply to the project they work on but whether they have EVER gotten paid to write code.

I'll bet there is a 99% chance that you still won't understand this. And I'll bet there is a 99% chance that you still won't be able to find that made-up stat you keep quoting.

But hey, if it weren't for people as stupid as yourself, I'd never be able to laugh this hard. :)

Or should I say that there is a 99% chance that I would never laugh this hard. :)

Re:The Definition of Amateur

[Anonymous Coward]

You're stupid.

    amateur
              . . .
              2: lacking professional skill or expertise; "a very amateurish
                    job"; "inexpert but conscientious efforts"; "an unskilled
                    painting" [syn: {amateurish}, {inexpert}, {unskilled}]
              . . .

Context clues. Learn them. Use them. Come back when you are able to read English above a 2nd grade level.

Re:The Definition of Amateur

[Foofoobar]

Wow this is like having an argument with a 3 year old.

You are so right. They must lack professional skill because they program open source applications. That alone proves they don't have skill. Not the fact that they may be paid for it.

Do you realize how stupid you sound or is this some kind of joke? What short bus driver put you up to this?

I'm beginning to feel bad for teasing a retarded little boy but hey, if you play with the big dogs, 99% of the time you are going to get fucked. Of course 99% of the time, people can generally back of there stats with facts. Those that can't are 99% of the time, complete liars.

Mah I take it back, this is still funny as hell. Though I believe there is a 99% chance that you were aborted and survived. But 99% brain loss is still pretty good after all you managed to figure out how to turn on your Windows machine. But then again, 99% of terminally ill patients can run Windows.

LOL. Go home little boy. :)

Re:The Definition of Amateur

[Anonymous Coward]

You're stupid. I didn't say they were amateurs because they were open source programmers.

I told you to come back after you've learned English. Learn it right this time.

Return of Captain Retardo and his Fake 99% stat

[Foofoobar]

I understand your inability to comprehend this considering the the fact that your family tree is a straight line.

But the fact remains that in your earlier post, you asserted that 99% of open source developers were amateurs; a fake statistic which you stil refuse to backup. Since you haven't the capacity to read or just have never made the effort, I have recapped it for you. It's be nice to dumb animals day so I figured what the hell.

So indeed, you did say they were amateurs because they were open source developers. How else is that supposed to be interpretted? Did you mean that they were all cantalopes? Did you mean they were all flying butt monkeys resembling your mother?

If so then you should have said so. But in fact you didn't.

So tell us, did the labotomy hurt much?

Re:Return of Captain Retardo and his Fake 99% stat

[Anonymous Coward]

You're stupid. "Most open source programmers are amateurs working on junk like Drupal and the Jakarta Commons libraries." That's what I said. Where do you see, "99% of open source developers are amateurs?" Do you enjoy burning your straw man, or do you seriously not understand that I am not nurb432. I can see how a kindergarten-level grasp of the English language could lead to the latter.

"So indeed, you did say they were amateurs because they were open source developers." Care to point out where I said that? I said that most open source developers are amateurs, not that they are amateurs because they are open source developers. Again, if you understood your native language, we would not have this confusion.

Come back when you can understand the language in which we are arguing.

Re:Return of Captain Retardo and his Fake 99% stat

[Foofoobar]

Wow. That blow to the head must have given you memory loss as well. Let us recap for the mentally challenged, shall we?

99% of the people that donate time to OSS are amateurs. Its a matter of precentages. 1% does not make the *group* a bunch of professionals.

Now's your chance to claim to be someone else and not the original poster... which obviously is yet another lie in your tapestry of fabrications. But hey, it's worked worked so well for you now, why stop? :)

Re:Return of Captain Retardo and his Fake 99% stat

[Anonymous Coward]

Let us recap for the mentally stupid who apparently still cannot understand English.

From my post: "Do you enjoy burning your straw man, or do you seriously not understand that I am not nurb432. I can see how a kindergarten-level grasp of the English language could lead to the latter."

From your post: "99% of the people that donate time to OSS are amateurs. Its a matter of precentages. 1% does not make the *group* a bunch of professionals." -- nurb432

Oh yeah. You're stupid.

Re:Return of Captain Retardo and his Fake 99% stat

[Foofoobar]

Sure you aren't. If you say so there Captain Retardo. That's about as believable as your 99% stat. Got an yother stories you wish to entertain us with?

Re:Return of Captain Retardo and his Fake 99% stat

[Anonymous Coward]

Ah hell... who am I kidding. Of course, I'm nurb. And I generally just like to make up stats out of my ass because I am a Microsoft shill. And you were right on about my brain damage. In fact, I'm a throwback and a scientific oddity and am having my cage cleaner type this for me.

Re:Return of Captain Retardo and his Fake 99% stat

[Foofoobar]

Well I'm sorry about you being a neanderthal but perhaps cage life is the bet thing for you. And I'm glad that you finally admit to being a fesces throwing FUD monger. See, now don't you feel so much better? :)

Re:Return of Captain Retardo and his Fake 99% stat

[Anonymous Coward]

Yes I do feel better now having told you the truth and also having relieved myself on the floor of my cage. I'm sorry I'm such an imbecile and feel it necessary to lie and spread FUD. I've just never felt the love of a woman (sheep don't count) and this is my only outlet of entertainment.