Slashdot Mirror
Microsoft Invites Black Hats into Vista
gtzpower writes "Microsoft is inviting hackers to 'Take Your Best Shot' at Vista. 'You need to touch it, feel it,' Andrew Cushman, Microsoft's director of security outreach, said during a talk at the Black Hat computer-security conference. 'We're here to show our work.'" From the article: "A security team with oversight of every Microsoft product — from its Xbox video game console to its Word program for creating documents — has broad authority to block shipments until they pass security tests. The company also hosts two internal conferences a year so some of the world's top security experts can share the latest research on computer attacks." Essentially a tie-in with an article we discussed yesterday.
aren't they already freaking there?!
ed
...I was going to point out the dupe, but now the editors have started doing it for us!
"Essentially a tie-in with an article we discussed yesterday."
Argh.
They invite hackers to take their best shot?
Why not just PAY the hackers to do their best at breaking it?
What this world is coming to - is for you and me to decide.
It could be a trap, you know. Bring in the black hats, and then brainwash them en masse so they don't want to use computers anymore but still buy many copies of MS products. No more security problems!
-mrxak
Onions Will Kill You
------------Now-----------
MS: "Have it Vista, hackers -- see if you can find any exploits"
BHs: *they go to it* "Nope, we don't have any security holes to report to you, it looks like Vista is impenetrable."
------------Vista is released-----------
MS: "What the heck? How can there be over twelve-thousand viruses for Vista on the day it's released?!"
BHs: "All your Vistas are belong to us! Thanks for your help Microsoft!"
A computer once beat me at chess, but it was no match for me at kick boxing.
The real black hats want it to be widely deployed before they start exploiting it.
proof, n. A demonstration that a conclusion is implied by certain premises and axioms.
Say, wait. If you've just given prerelease test copies of Vista to 3,000 "black hats"... and you're hoping they'll find bugs in them and report them back to you before Vista ships... I mean... how do you know that's what they're actually going to do?
What if some of these "black hats" look over Vista, find security bugs, keep them secret, go back to Microsoft and say "Whelp! Looks like Vista doesn't have any security holes at all!"; then wait for Vista to be released, and once it's out have a 0-day exploit that they can use in their offshore spam/spyware businesses and that no one else will even know exists until two years from now when a gray hat independently finds and publishes it and Microsoft finally fixes it?
I mean, of course that's a worst case scenario. But still, sometimes I think the old thinking on how the world of hackers works no longer really applies now that the primary motivating force is not pride, but money (in the form of sweet, sweet herbal viagra).
Consider: Microsoft gets to ride free hacks this time-->before the OS gets released. All that nice work, and they don't spend a dime. Interesting also because the release they gave out isn't a 'community-style' release. It makes one wonder if there's a 'Vista-call-home' component to it, too. Might be nice to know which of the coders actually tried to boot the thing, and then note their IP for future reference (or maybe to turn over to the NSA).
Still, with many noted reviewers in full belief that it's swiss cheese, it ought to be fun to see who eats it with crackers.
---- Teach Peace. It's Cheaper Than War.
Security expert at Microsoft: "delay shipping Vista! We know it's ready otherwise, and people are clamoring for it, and stock prices depend on it, but I've discovered a security hole that is very serious!" Bill Gates: "I think you need a career change. Don't you have an assistant that says it's ready to ship as is? Let me talk to him..."
Currently hooked on AMP
Step #1. No open ports.
Step #2. No services running that are not absolutely essential.
The idea is to reduce the number of available avenues for attacks. Then you can focus on protecting/hardening the apps that are running. Such as (on Linux) putting them in a chroot jail.
"Now Vista, can you show us on this doll where the hacker touched you?
"Let the record show that the victim pointed to the KERNEL!"
- None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
r00t access?
Badass Resumes
Microsoft does not want black-hats to be cracking Vista, unless they're visiting a honeypot; for black-hats will keep what they know to themselves, and maybe create false trails. Rather, MS is indicating the grey- and white-hats that they're legally in the clear.
"Black Hat" is simply the name of the conference organiser, a cool name to be sure, but not an indication of who MS is reaching out to.
Wikileaks, no DNS
Sorry, that's not the case. Permissions in Vista really ARE based on tasks, roles, and objects.
Even when you are running as Administrator, it still requires that you consent when you're running tasks/programs/etc that need superuser status. When you run the console while you're logged into administrator, it does not automatically have superuser status--you need to choose to run the console as administrator.
All accesses (to services, registry sections, config/admin programs, and anything that tries to change those) are based on ACLs (access control lists). How do I know this? I'm one of the contracted testers that is working with the vista firewall and its ACLs.
Is it perfect? I don't know. But I do know it feels pretty secure--not entirely different from the way things worked when I played around with setting up Linux server boxes in college (which was only a year ago).
So.. Have they been on a 10 year vacation or something?
End of line..
The title has created some incredibly +5 funny comments, which is great for cheap entertainment, but the title is completely fucking wrong and now the flamethrowers must be unleashed.
From TFA:
After suffering embarrassing security exploits over the past several years, Microsoft Corp. is trying a new tactic: inviting some of the world's best-known computer experts to try to poke holes in Vista, the next generation of its Windows operating system.
Black hats are the bad guys, the guys actually hacking the computers for the sake of getting money and identities. The security experts are the good guys!
Maybe I'm overreacting, but that little change in the title rather important. It turns the story from "Microsoft showing all the efforts it is making to improve security" to "Microsoft so desperate to improve security they invite convicted hackers/spammers/international mafia to come hack vista!"
Of course, without said change, we have no +5 funny comments, and thus no real story to make fun of, because there's not much material to make fun of here, and nothing to critize about Microsoft because what they are doing in the article is what they should be doing. Nice Job Slashdot.
"All great wisdom is contained in .signature files"
In the case of the console, choosing "Run As Administrator" (assuming the admin account you've got access to has full-admin status) is the same as typing "su" into your *nix terminal.
In the case of various tasks (such as, say, firewallsettings.exe, the replacement for firewall.cpl) giving the OS permission to run it (or, if you're on a non-admin account, typing in an admin user/pass) allows you to only run that task.
So, if a certain user account has access to, say, change the firewall settings and not user accounts, and you run the console as an elevated user, you'll be able to run in the console "netsh advfirewall firewall [settings here]" but you won't be able to, say change user passwords.
So yes, it's all ACL-based.
So, having spent years training normal users that the correct way to get anything done is to click "Yes" on every single dialog box that comes up, regardless of what the dialog actually says, they're now doing the same to sysadmins?