Slashdot Mirror
Microsoft to Publish Blue Hat Findings
An anonymous reader wrote to mention an InfoWorld article about Microsoft's plan to publish some of the findings from last week's Blue Hat conference. From the article: "'Everything was fair game,' wrote SQL Server engineer Brad Sarsfield in a blog posting. 'Hearing senior executives say things like: 'I want the people responsible for those features in my office early next week; I want to get to the bottom of this' was at least one measure of success from my point of view for the event.' The Blue Hat name is a play on the Black Hat conferences, which have occasionally been criticized by IT vendors. The 'Blue' part comes from the color of badges that Microsoft staffers wear on campus." They have descriptions of some of the sessions up on the site for your perusal.
I'm sure the executives started the whipping sessions with the person responsible for allowing SQL Server to function happily with a blank 'sa' password.
Web2.0: I love when people Flickr my cuil and digg my boingboing until my google is reddit and I start to yahoo
Could MS actually be taking security seriously?
/ 1750217&from=rss and other notables. I'm curious if MS will ever really look at what it is that causes so much to go wrong with their departmental OS.
Naaahh...
I'm sure this was a very interesting conference - nice to see names like Johnny Long there ( Google Hacking for Penetration Testers ) http://books.slashdot.org/article.pl?sid=05/04/11
All the same, I'm sure the findings will be taken back, discussed among those who know and forgotten or buried by marketing executives.
The Kai's Semi-Updated Website Thingy
Way to quote some random guy and talk about blue badges and go on for four sentences without giving any indication of what the conference is actually about.
Anyone ask why SSL still doesn't do AES? I mean it's 2006 and Microsoft is really the only vendor who DOESN'T do AES or 256-bit encryption in SSL. (I know, they said they'd put it in Vista, but that doesn't help the millions of Windows XP users or Windows 2003 administrators out there.)
The 'Blue' part comes from the color of screens that Microsoft staffers see on campus.
Someone had to say it, folks!
- Andrew
I meta-moderate because I care.
"Well, we've learned that the hat is, in fact, blue."
I want the people responsible for those features in my office early next week
With quotes like that, it's no wonder Vista's long list of features has been dwindled down to a new Media Player and better video drivers.
And maybe they want to make sure when everyone thinks "$color hat" they *don't* think of "Red Hat".
MS plays that sort of game a lot.
Server engineer Brad Sarsfield in a blog posting. 'Hearing senior executives say things like: 'I want the people responsible for those features in my office early next week; I want to get to the bottom of this' was at least one measure of success from my point of view for the event.'
I'd be a little more worried if I was Brad. That feature your boss wants to know who's responsible for..what if it's 'Clippy'???
Weaselmancer
rediculous.
"Badges?"
"We don't need no stink'n badges!"
"Academicians are more likely to share each other's toothbrush than each other's nomenclature."
Cohen
the Seattle Inquisition!!!
Moderation in All Things... Especially Moderation - gurutc
Does that mean domesticated or tame?
No folly is more costly than the folly of intolerant idealism. - Winston Churchill
This is your last chance. After this, there is no turning back.
You put on the blue hat - the story ends, you wake up in your bed and believe whatever you want to believe.
You put on the red hat - you stay in Wonderland and I show you how deep the security-hole goes.
He who knows best knows how little he knows. - Thomas Jefferson
I want the people responsible for those features in my office early next week
No problem, he's already sitting there.
Now just how do they expect to get Steve Jobs in their office?
Moderation in All Things... Especially Moderation - gurutc
This is a pretty standard way for companies to handle lynch mobs of unhappy people: Put an exec up on a stage and have everyone yell their guts out and promise to investigate it thoroughly. This is not done just for software security, but just about everything.
Undoubtedly one or two simple, yet highly visible, things (eg. the password check) will be fixed to show that some action was taken.
Engineering is the art of compromise.
whaddya tryin' to do, cover a bald spot?!!!
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
BSOD is the special secure mode for a Windows computer.
Engineering is the art of compromise.
our chief weapons are:
Fear
Torturous OS
and a distinct desire for coffee, preferably espresso con lattee, although I'll settle for a mocha
-- Tigger warning: This post may contain tiggers! --
Ok, now Im confused. I thought the current /. theory about delays and feature cancellations in Vista was that the development team were to busy dodging chairs to get any coding done?
OK, it's time to have mercy on you guys who haven't figured it out.
There is no Microsoft.
It's all a MMOG/interactive fiction thing where geeks pretend to be code monkeys in service to the evil empire. C'mon, the Gates was a bit subtle, I admit; you could almost believe he existed. But Ballmer should have clued you in. No real board would hire a guy like that unless they were running a side show and needed a "Wild Man of Borneo".
The coolest part of the hack was when they started sending out boxes of their "product", complete with CDs and manuals (look closely -- a lot of it's just "ipsum lorem"). That was sheer brilliance. I picked one myself as a souveneir, I'm looking at the box up on my book shelf right now, it's very well done. Just the other I had to keep my elderly father-in-law, who was an engineer back in the day and no dummy, from "borrowing" my copy. Boy would he have been surprised.
Oh... God Gad.
You didn't actually install any of that shit, did you?
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
well, I think that there's nothing wrong with a Blue Hat conference, it can even be useful, but trying to pretend that Blue Hatters will be attacking one's weak points is as disasterous as attacking Iraq or Iran and not expecting an ever-changing homebrewed guerilla warfare that adapts faster than one can plan.
the reality is that the attackers will be Black Hats. Blue Hats may be useful, but they aren't the ones attacking you.
-- Tigger warning: This post may contain tiggers! --
That was the funniest thing I've read all week. Mad Props to you sir, and Mod this guy UP
I believe Microsoft DOES support 3DES on SSL. My "FIPS 140-1" configurations require it. Look for this key in your windows registry - if you have this key, your SSL does 3DES:
r ol\SecurityProviders\SCHANNEL\ciphers\Triple DES 168/168
HHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Cont
Large company actually paying attention to what it's seeing
yes we can all feel cynical based on many other similar stories.
but every now and again a company will surprise it and attempt to actually <i>solve</i> problems.
A lot of Microsoft's problems date from interesting "for the user" support features. This could be interesting to follow...
(can you tell I've just been watching Red Vs Blue?
I do hope that nobody actually paid for this news.
guh.Free Software: Like love, it grows best when given away.
"Hearing senior executives say things like: 'I want the people responsible for those features in my office early next week; I want to get to the bottom of this' was at least one measure of success from my point of view"
Ah, good to know the culture of blame is still a backbone of American industry. Likely that those senior executives are the ones that requested said features originally. But that's okay, I'm sure they'll find some scapegoats.
Vincent J. Murphy
Spandex Justice
"I want the people responsible for those features in my office early next week"
The features with security issues? Isn't he risking a fire hazard by doing this? I thought buildings had maximum occupancy ratings?
*ducks*
You are checking your backups, aren't you?
Microsoft's site will not have the kind of controversial material that has popped up at Black Hat. "All researchers at the BlueHat are responsible," Kornbrust said.
Translation: All presenters know what side of their bread is buttered and by whom.
Let's celebrate our new openness by censoring ourselves!
Somebody kick me in the shin please. I must be asleep and dreaming that I'm stuck on that Moron Planet again.
"A microprocessor... is a terrible thing to waste." --
GeneralEmergency
The Blue Hat name is a play on the Black Hat conferences, which have occasionally been criticized by IT vendors. The 'Blue' part comes from the color of badges that Microsoft staffers wear on campus.
Actually the Blue Hats are a symbolic salute to their employer's greatest technical accomplishment: The Blue Screen of Death
The blog talked about in the article is here: http://blogs.technet.com/bluehat
I find it perticulary funny that executives want to smack the ones resonsible for random features. From what i have read and understand the executives is the ones who constantly have demanded more features and not security.
Im sure the staff at Redmond is eagerly awaiting the executives bitchslapping eachother and themselves to the next monday. Im sure most of the marketing department will call in sick.
HTTP/1.1 400
'I want the people responsible for those features in my office early next week'
Somebody is going to practice throwing chairs during the weekend..and many others are gonna practice ducking them...
So, you claim the NSA asked Microsoft to not put AES in IE? This doesn't make much sense either. Like I said, almost every other browser, client or server already supports AES on SSL (including those offered by IBM). It's just weird that Microsoft lags so far behind.
Don't forget Kurt Cobain's ashes. :P
but that doesn't help the millions of Windows XP users or Windows 2003 administrators out there
That's exactly why it's not there. It creates more incentive to upgrade to Vista. The fact that you are paying more money for features that you should already have is lost on M$ target audiences.
Yeah, Microsoft finally added AES to its core crypto stuff back in 2003 (I think), but for some odd reason they didn't extend support into the areas that would have used it most: SSL for IIS and SSL for IE. (Dunno if Outlook Express would have used it...probably.)
'I want the people responsible for those features in my office early next week'
I recall maybe 8-9 years ago at my large former employer. There were some screw-ups going on coming from an IT subdepartment at corporate headquarters. After trying in vain to work around things on my end I finally picked up the phone and called up the person in charge. Before I could launch into my tirade the person said, "I'm in charge, but I'm not responsible." Reminds me of what will happen Monday morning amidst the chair-littered corridors of Redmond. Lots of finger pointing and ducking...
Not that weird. Yes, every other browser/client/server supports it. IE still has comfortably more than half of the browser market, even though it's in decline. So, if the NSA can't break AES, they ask M$ not to put it in, and a large chunk of the traffic remains readily readable.
"But," you may say, "anyone who knows what they're doing will use something more secure." True. However on one hand, crooks and terrorists are often (albeit not always) stupid, and might not always do so; and on the other hand, the easily broken traffic can be quickly sorted out, leaving a smaller quantity of harder-to-break traffic where content analysis is neglected but traffic analysis approaches become profitable. Limiting the capabilities of the drooling-luser set is helpful, because it makes it easier to pick out the bad guys who hide by leaving a smaller set of both the good and the bad guys who can hide. Rather than struggling to separate all the good from the bad, they can first quickly separate the smart from the stoooopid.
Of course, there's no proof the AC's assertion is true... but it doesn't matter much for the sake of arguement.
//Information does not want to be free; it wants to breed.
Need Moderator Points. Must mod parent +1 Funny.
either that or a good Tully's espresso maker ... (also Seattle, probably used by Blue Hatters)
-- Tigger warning: This post may contain tiggers! --
Yell if you like, but your only choice is to hire me or fire me. You stopped giving out raises years ago.
"SQL Server engineer Brad Sarsfield" Since when was SQL programming classified as a field of engineering...
Blue team are the good guys, Red team are the communists
People do things for reasons. Hammering them for things that turn out badly just produces CYA, fear and paralysis. Red in tooth-and-claw management always devours itself.
Hey... When is Microsoft going to respect the orange (MS temporary) grunts and their 1337 skills? Of all the MS workers I've talked with, only the Orange ones have appeared to be been finding all the undisclosed vulnerabilities.
Sounds like it may be career-threatening to be a Blue and while reporting in an undisclosed vulnerability within Redmond campus.
Blue Hat, bah! Just a forum to mock the blue workers, and perhaps, justifiably so.
> An anonymous reader wrote to ..
From a description of one of the sessions (names changed to protect... somebody):
... it is often the case that developers expect a core technology to provide one security assertion, when in fact it provides a whole set of unrelated assertions. X and Y have found that many security flaws ... are the result of a fundamental misunderstanding of a core security technology.
...[are]... almost without exception, misused. ... X and Y discussed how to find out if your application is making silly security assumptions or whether you have truly mitigated risks against it.
This talk covered the security technologies in Windows that
So, security is the responsibility of the application? Does anybody remember the old song: "I beg your pardon! I never promised you a rose garden!" Or is there a new winner of the Not My Job award ( http://www.nickh.org/pix/notmyjob.jpg ) this year?
Does this make me a Red Hat, for being constantly annoyed by M$ products?
(There are other reasons, of course, but I thought I'd stick with their analagy).
[ insert meme here ]
Can You Build Secure Solutions Built on Microsoft Core Technologies? The shortest of the Blue Hat seminars
Nothing costs nothing