Slashdot Mirror
Microsoft Consults Ethical Hackers at Blue Hat
linumax writes "For the second year in a row, Microsoft Corp. invited a small number of hackers onto its Redmond, Wash., campus to crack the company's products for all to see.Blue Hat V2 was held on Thursday and Friday and teamed noted "white hat" hackers with Microsoft employees to break into and expose security weaknesses in the company's products. Over 1,000 Microsoft developers, managers and security experts attended, including Microsoft brass Jim Allchin and Kevin Johnson, co-presidents of the company's Platforms, Products & Services Division."
This is a good thing. It always is good to get someone to try and break your software, that way you know what you can do to fix it. Lets be honest here, Microsoft is number 1 in sales, so I hope they can make a better product, for the saftey of everyones computer.
Yay, I have a sig.
I wonder how many items covered this year, were rehashes of last year, and "we told ya so!"
My cat's picked up a Hammer. HEY! Put down that Hammer. Put Down that Hamm...THUNK!
Every day is Blue Hack day.
Microsoft Corp. invited a small number of hackers onto its Redmond, Wash., campus to crack the company's products for all to see
Of course if this were an OSS project, the code would be there for all to see and try to crack instead of 'select' few.
Still, I'm sure it's a useful PR exercise.
A sign of changing times, indeed. It seems pretty clear that Microsoft has needed to buddy up more with the people who can break their software, because it's going to happen anyways, at least now they might have a head start. I can't really commend the decision to start now, though, as it seems to be both forced by the current politics and belated in that they should have had the foresight to do it earlier.
this segregation cannot continue!!!!!
Okay I don't like either of these terms for hackers with morals.. Lets think of something new:
-Deeks (decent geeks?)
-Prerds (Principled Nerds?)
-Fairackers (fair hackers?)
Also remember that the term hacker is not always seen as negative in of itself: From: http://www.smoothwall.net/support/glossary.html "A highly proficient computer programmer who seeks to gain unauthorised access to systems without malicious intent."
~jennifer.k~
Or this "hat" thing has gotten a little retarded, I've never heard of the term "Blue Hat" before. I mean how about calling "Black Hats" == criminals?
Science is but a perversion of itself unless it has as its ultimate goal the betterment of humanity. -Nikola Telsa
I'm sure "(white|blue)-hat hacker" in this case is redefined to mean "anyone who cooperates with Microsoft when finding security vulnerabilities". Of course there are always proper ethical ways of dealing with the discovery of serious security flaws in software--that doesn't mean they have always had Microsoft's business or PR interests in mind.
This is just a publicity stunt, a pretense that Microsoft is taking security research seriously.
If I'm wrong, then it would be interesting to know what security vulnerabilities were "uncovered" at their event. Are they going to be disclosing the details of such flaws? What do you, as a security researcher, have to "sign away" to participate?
It's true no man is an island, but if you take a bunch of dead guys and tie 'em together, they make a good raft.
Blue Hat? As in Red Hat without air supply?
If they are ethical, why are they working with Microsoft?
I'm an American. I love this country and the freedoms that we used to have.
Black Hat = Cool Hackers, mostly under age 18, can not be prosecuted as an adult.
Grey Hat = Hackers transitioning from Black to White.
White Hat = A hacker over the age of 18, who rattles door knobs and probes security, but has stopped defacing websites.
Blue Hat = WTF? Blue hats? Are these smurfs?
Red Hats = Hackers with an RHCE, very, very dangerous.
This type of this stuff happened upon the realese of XP, everyone thought it was secure and i remember geeks and business people alike preaching how great and secure XP is and how there arnet any problems. A year later the problems a rose, now its time for everyone to go out an by Vista so lets peddle how we as microsoft care about our users security to get them to by Vista, then we'll do what we did before... let it get out of control so when it comes to the next version after vista we can look like the heros again
Why on earth would they want to secure an OS, if it gets too secure there is less of a reason for people to spend hundreds of dallors on the next version..
What did they find, hmmmm?
Coderz 4 Life
belly chuckles.
How we know is more important than what we know.
Outside researchers also had informal sessions with company developers, including a "burrito lunch" with the IE7 development team
:-)
IE7 developers and burritos? too many hot air sources in that meeting...
almost as much hot air as balmer
Why do I feel this is nothing more than a marketting move to show MS in a brighter light. After all, they are releasing a new Windows, Office, etc next year...
If they wanted to have their boxes 0wned, they don't have to hold a conference and invite a bunch of hackers over. I know a better way.
Just plug the suckers straight into the net. And wait about three minutes. Done deal.
Weaselmancer
rediculous.
ummmmm ... DUH!!!!!
No, I don't think so. They are playing catch up no matter what they do. We all know that there have been cases of exploits that have been found, use, and not reported.
At least they seem to be responding to pressure to do someting proactive about it now.
The simple truth is that interstellar distances will not fit into the human imagination
- Douglas Adams
Microsoft is ok with "white hat" hackers, but when asked about the "Red Hat" crackers, Microsoft confirmed that these malicious coders only hurt Windows.
Heh, yeah, thats the point of Linux.
You can't expect much in the way of security improvements at Microsoft -- MicroSoft does things to make money. If security costs money for them, or causes the support desks of their customers to take a lot of bullshit calls, they won't do it.
Furthermore, if they were to start prioritizing security (or just plain old "quality") over the task of "making money", their shareholders would be very unhappy.
I think the only thing that could cause them to take it seriously would be some sort of PC-aids: a worm that would linger, damaging business data and hardware -- such that customers would decide to finally junk Windows.
This is very different from other businesses. E.g. if Paypal screws up their security, they will go out of business. So Paypal probably has some awesome security.
http://www.thebricktestament.com/the_law/when_to_
Just like with Windows 2000 (the unbreakable) this is just a publicity stunt. Real security comes from good design, not slap together crap and let 1000 monkeys throw random bits at it.
HTTP/1.1 400
Isn't the definiton of a hacker not a cracker?
------- In the end there are no begining
Black Hat = Cool Hackers, mostly under age 18, can not be prosecuted as an adult.
Grey Hat = Hackers transitioning from Black to White.
White Hat = A hacker over the age of 18, who rattles door knobs and probes security, but has stopped defacing websites.
Blue Hat = WTF? Blue hats? Are these smurfs?
Red Hats = Hackers with an RHCE, very, very dangerous.
You forgot brown hats = hackers with their heads up their asses.....
This "event" should be ongoing because in the real world it is ongoing.
I was in town to do a privacy webcast, and was invited to hang around and see Blue Hat. My thoughts are at http://www.emergentchaos.com/archives/001822.html
Lavender Hat = A hacker afraid to come out of the closet.
Rainbow Hat = He's a hacker and he's proud! 2 Snaps and an @ symbol!
Yellow Hat = A White Hat hacker who's just been pissed on.
Green Hat = A novice who is just learning how to hack. (also known as a n00b, FNG, Script-Kiddie).
smurfs wear white hats.
In related news, Playboy Inc. invited a small group of whackers to their office to check out next year's calendar girls.
Afterwards everyone had lunch with Natalie Portman.
somehow all these whitehat hackers would seem as timid as Ned Flanders...
--Homer J. Simpson
They are aiding Microsoft, the Great Darkness which is called Abomination, Destroyer of the Earth, the Gates of Hell.
Collaboration with the followers of Mammon results in eternal damnation!
Remember folks, slashdot doesn't have a -1 "disagree" moderation!
RHCE flings pen-filled pocket protector at the lcd panel of the Windows Server 2003 box' monitor
yup, dangerous :)
"In the end, there is simply no weapon more devastating than the truth, delivered in just the right way." - tnk1
But from the article I got the impression of 2 things:
1. This is currently some sort of annual peepshow extravaganza: these ties should be kept all the time, pay them, it's important.
2. More critically -
they're proabably going to invest more on stuff like Digital Rights Management, because they're more wary of people hacking MS content. By that I mean they might see things like illegal tranfer of media as a bigger issue, because it affects their reputation/their content protection schemes/their standards. I hope it doesn't sideline what business company users are worried about (things that affect their company, like virii, trojans), and not Microsoft's business model/vision of more trivial things (like preventing media copying) - which is they've been investing a lot in recently. Home Windows != Business windows, or at least it shouldn't be.
That was a dull post.
"You know you don't act like a scientist, you're more like a game show host." Dana Barret
That's freakin' hilarious! Mod funny!
Your mind looks a little cramped. Why don't you stretch it a little?
and /. has 60 comments of flamebait for every 3 decent comments.
Grow up linux zealots.
How many seconds into the conference did it take for them to get royally pwned?
"For the second year in a row, Microsoft Corp. invited a small number of hackers onto its Redmond, Wash., campus to crack the company's products for all to see."
Admiral Ackbar sez...
IT'S A TRAP!
Education is the silver bullet.
This does nothing towards Mom and Dad surfing the internet using IE. Getting owned is simple.
XP/SP2 and 2003 Server are pretty much secure out of the box. When can we look forward to
IE being moved to user space? Never? When can we look forward to an O/S that doesn't have a re-ocurring fee every three years? Why do I have to agree to license a patch (MS05-51) for software I bought that was defective in the first place?
If it weren't for Quicken, Mom and Dad would be using SuSE by now.
Enjoy,
It's just the normal noises in here.
ak uz jsem ekl, design Mobil serveru v prvních msících neml se zpravodajským vzhledem nic do inní, titulní stránka byla odkazovníkem na samostatné, jednoduse vedené rubriky. Nebylo to samoúelné, pvodn jsme server chápali jako spojení nezávislých stránek, navíc jsme vbec nepoítali s njakým zpravodajstvím. Pouze jsme hodlali udrzovat seznamy telefon, pehled operátorských sluzeb a jejich ceníky, tedy vsechno to, co operátoi ani výrobci mobil na internetu v té dob nemli. Kazdý z nás tí tedy ml na starosti svoji sekci" a tam si ádil po libosti. Jenze uz krátce po neoficiálním startu v listopadu 96 a jest silnji po tom oficiálním v lednu 97 se ukázalo, ze tohle uspoádání není sastné. Lidem se nechtlo procházet nezávisle na sob aktualizované sekce a protoze si vsimli, ze kazdá z tch sekcí se aktualizuje minimáln jedou týdn, chtli, abychom odkazy na aktualizace centralizovali.
Nejdíve jsme se to pokusili osulit a Petr nainstalova na server njaký script, který zjisoval, kdy byly které stránky upraveny a automaticky je adil podle data modifikace. Jenze ani to nebylo to pravé oechové, protoze kdyz jsme opravili njaký peklep nebo zaktualizovali malikost, ihned se to na výpisu tohoto scriptu projevilo.
Rozhodli jsme se poohlédnout, jak to esí ve svt. Abychom pedesli podezení, ze jsme padlí na hlavu a pro jsme hned od poátku nepouzili klasický zpravodajský styl, rád bych pedeslal, ze na pelomu let 1996/7 nebylo vbec jasné, CO je to ten klasický zpravodajský styl. Rzné servery to esily rzn a to diametráln odlisn. Asi nejrozsíenjsí esení bylo pouzití sekce ve stylu Whats New" - tedy odkaz na titulní stránce, který vás navedl na posledn pidané lánky, tedy prakticky stejné esení, jaké jsme pouzili i my. Titulní stránka odkazovala tedy na nejrznjsí sekce a na novinky, sama ale pehled novinek a posledních lánk neobsahovala.
Jiné servery novinky na webu vbec nepublikovaly a rozesílaly je výhradn emailem, takze web jim vlastn slouzil jen pro registraci k odbru emailových zpráv. V echách toto esení pouzíval L. Zajíek pro rozesílání News on Net - rozesílal je emailem a na bajt.cz se najít nedaly nebo jen nepravideln.
Dalsí servery pro publikování pouzívaly PDF - a to a uz formou dokument stazitelných na webu, tak objednávaných emailem. Zde bylo hlavním motivem snaha o zachování grafické jednoty, ada publikací totiz nenávidla na internetu fakt, ze nebylo mozné pesn ovlivnit, jak dokument v tom kterém prohlízei a nastavení systému vypadal. Na tohle nebyli z novin zvyklí - lánek v novinách vypadal stejn v LA jako v NY.
Nkteré nejmodernjsí servery pouzívaly poutání lánk pímo z titulní stránky - abych byl pesnjsí, slo zejména o News.com patící spolenosti CNET a také konkurenní ZD News. To byla v eském pojetí pímo hypermoderna, protoze to uz jste museli pedpokládat, ze kazdý týden ne-li kazdý den bude nco nového, aby se vyplatilo to poutat pímo z titulní stránky. Navíc to nabourávalo dosavadní vnímání internetu jako doplkového média k papírovým titulm. Podobný systém pouzil pro své Invexové vydání na podzim roku 1996 server Ziv, jenze ten pak prakticky odumel a byl aktualizován sporadicky.
So blue hats are hackers that actually admire Microsoft? Am I the only one who sees a contradictory here? Not a single architect appreciates a building that is built built from the top-down. Just like no true hacker appreciates M$ or their design and data structures. Adults are to good for "hats" or anything material of the sort anyways.
http://slashdot.org/comments.pl?sid=48776&threshol d=1&commentsort=0&tid=106&mode=thread&pid=4942964# 4943347 ], StarOffice 6.0 lashdot (nimi tulee merkeistä: /.) on suosittu teknologiaan suuntautunut www-sivusto. Sivun rungon muodostavat käyttäjien tekemät uutispoiminnot, kysymykset ja arvostelut. Slashdot käyttää Apache-webpalvelinta mod_perl laajennoksella ja MySQL-tietokantaa.
Sivuston avasi syyskuussa 1997 Rob "CmdrTaco" Malda. Nykysin sivua pyrittävät hänen lisäkseen Jeff "Hemos" Bates ja Robin "Roblimo" Miller. Kesäkuussa 1999 sivuston osti Andover.net, joka helmikuussa 2000 fuusioitui VA Linux -yhtiön kanssa.
Slashdot on myös kuulu siihen liittyvästä slashdot-efektistä, joka tarkoittaa sivustojen tukkiutumista (yleensä perin lyhyessä ajassa) useiden satojen käyttäjien pyrkiessä katsomaan uutisessa mainitun linkin sisältöä. Tämä voi johtaa jopa siihen, että sivusto ei enää vastaa palvelupyyntöihin.
Rob Malda kosi nykyistä vaimoaan Kathleen Fentiä 14. helmikuuta 2002 Slashdotin etusivulla julkaisemallaan jutulla.
With so many security holes cropping up in the past, it would be more prudent for Microsoft to have a honeypot setup. This event (article) is closer to a marketing show (call in white hats, black hats, anybody) for a new release. Microsoft does have the resources to put up such a "Challenge" machine and try to keep it online by fixes, lure the real black hats to crack it. Fixing that would really help them work on their security (if they are truly concerned.) There are reports of independent Honeypot projects setup for assessing network security. It's high time Microsoft tried it at their expense for the benefit of their customers.
No Greater Friend, No Greater Enemy! (Lucius Cornelius Sulla)
Slashdot.org bendir á opið bréf Friðriks Skúlasonar ar sem hann gagnrýnir samkeppnisaðila sína í tölvupóstvírusa bransanum fyrir að auka bara á vandann af Sobig.F og álíka tölvuormum í stað ess að reyna að leysa hann. Ég frétti af essu bréfi á síðunni hans Bjarna.
:-
;-) Reyndar virðist /.-un vera einnig tiltölulega algeng á litlum vefum sem eru hýstir hjá aðilum sem eru með bandvíddartakmarkanir, .e. egar búið er að sækja 100Mb á mánuði frá essum vef á lokast hann. Já og svo auðvitað silly silly Java-crapletvefir :-) /. (nenni ekki að finna URL, sorrý) um að hvernig væri hægt að nota gamla vél með ekkert allt of mikið af resoursum sem mundi léttilega standast the /. effect.
/. (nenni ekki að finna URL, sorrý) um að hvernig væri hægt að nota gamla vél með ekkert allt of mikið af resoursum sem mundi léttilega standast the /. effect.
;-) Reyndar virðist /.-un vera einnig tiltölulega algeng á litlum vefum sem eru hýstir hjá aðilum sem eru með bandvíddartakmarkanir, .e. egar búið er að sækja 100Mb á mánuði frá essum vef á lokast hann. Já og svo auðvitað silly silly Java-crapletvefir :-)
/. (nenni ekki að finna URL, sorrý) um að hvernig væri hægt að nota gamla vél með ekkert allt of mikið af resoursum sem mundi léttilega standast the /. effect.
Gaman að sjá íslenskt fyrirtæki vera Slashdottað í tætlur, gaman sjá faglegt og málefnalegt diss milli fyrirtækja í samkeppni, og gaman að sjá frétt eftir sjálfan sig birtast á Slashdot í fyrsta skipti (eða er etta kannski annað skiptið...? helv. gullfiskaminni).
Ég velti fyrir mér hvað ég sæi ef ég kynni að greppa kryptísku Apache loggana á Klaka...
ss, etta sést varla á álagsgröfunum. Ég hélt í smá stund að að væri eitthvað spennó að gerast, en á var að bara essi venjulegi kl. 18:00 "allir að athuga hvort að urfi að uppfæra eitthvað" toppur.
Gott að sjá að FRISK lifði af. Ég man síðast egar einhver sagði "að verður ekkert álag á essum vef" og á fór aðeins öðruvísi
Bjarni: jamm, eins algengt og að er að slashdotta síður í klessu, á eru etta hreint og beint illa uppsettir vefjónar/gagnagrunnar sem valda essu. Ég las einmitt grein á
Bjarni: jamm, eins algengt og að er að slashdotta síður í klessu, á eru etta hreint og beint illa uppsettir vefjónar/gagnagrunnar sem valda essu. Ég las einmitt grein á
ott að sjá að FRISK lifði af. Ég man síðast egar einhver sagði "að verður ekkert álag á essum vef" og á fór aðeins öðruvísi
Bjarni: jamm, eins algengt og að er að slashdotta síður í klessu, á eru etta hreint og beint illa uppsettir vefjónar/gagnagrunnar sem valda essu. Ég las einmitt grein á
Gott að sjá að FRISK lifði af. Ég man síðast egar einhver sagði "að verður ekkert álag á essum
I thought Smurfs have white hats. Except for Papa Smurf, who wears a red hat. Too bad it isn't a fedora.
No one cares what your captcha was
Houston TX, USA
BAM! 2/3rds of the colored hat market cornered.
Blue Hat, embrace?
White Hat, extend?
Red Hat, Destroy!
Also there are reports of MS products named genthree, hustleware and ooboontoo. Windows Vista will be renamed at the last minute to Windows11, that's right its Solaris10 and OSX +1
You can't out-market MS son!
Not blue hats.
Anglers have been invited to this year's "Fish in a Barrel - with Shotguns" conference.
Hackers? Or Feature Finders?
With all of the lies Microsoft has told, and the fact that they were caught faking evidence in a court of law, do you seriously think you can believe a word that comes out of their mouth now? Microsoft has shown that they cannot be trusted.
Only a complete idiot would trust Microsoft and I love that fact that they will never have 100% of the desktop or server markets.
Long Live Linux!
No, no, you have to go to the authoritative source to understand the colors:
Black = Destructive, mostly damage-causing.
White = Healing and protective.
Red = A combination of Black and White.
Blue = Learns from watching others.
Blue would also be known as a "Script Kiddie". It's appropriate that Microsoft is focusing on Blue Hats.
Brian "Psychochild" Green
MMO developer's blog
Obviously they're learning from the OSS movement, which is good.
Will they still make money... of course. This doubles as a great PR stunt.
Right, mister cool hacker. Find the hole so that it gets plugged before the release. Then enjoy the nice DRM. Remember the Xbox hack which only works because some 007ish game has a buffer overflow ?
...putting a division of M1A2s up against the Brink's Armored Car man. But you're still apt. Apt!
Facts do not cease to exist because they are ignored. - Aldous Huxley
The questions I have are
1. Why don't they hire these guys to play around and do this all of the time?
2. If they have people finding holes for them, why are there still holes?
"I would imagine that if we look into the future at the sixth Blue Hat ... there probably won't be anything like the topics discussed at the first and second one, because things will have changed,"
Unless its Internet Explorer, at which point it will take 7 years and actual competition of some sort appears.
Monopolies. Hurt. Us. All.
CRACKERS, dammit! The hacker community is getting mighty pissed at being brought down to their level!
Now, where'd I put those security codes...
Goten Xiao