Slashdot Mirror
Microsoft Invites Black Hats into Vista
gtzpower writes "Microsoft is inviting hackers to 'Take Your Best Shot' at Vista. 'You need to touch it, feel it,' Andrew Cushman, Microsoft's director of security outreach, said during a talk at the Black Hat computer-security conference. 'We're here to show our work.'" From the article: "A security team with oversight of every Microsoft product — from its Xbox video game console to its Word program for creating documents — has broad authority to block shipments until they pass security tests. The company also hosts two internal conferences a year so some of the world's top security experts can share the latest research on computer attacks." Essentially a tie-in with an article we discussed yesterday.
aren't they already freaking there?!
ed
------------Now-----------
MS: "Have it Vista, hackers -- see if you can find any exploits"
BHs: *they go to it* "Nope, we don't have any security holes to report to you, it looks like Vista is impenetrable."
------------Vista is released-----------
MS: "What the heck? How can there be over twelve-thousand viruses for Vista on the day it's released?!"
BHs: "All your Vistas are belong to us! Thanks for your help Microsoft!"
A computer once beat me at chess, but it was no match for me at kick boxing.
The real black hats want it to be widely deployed before they start exploiting it.
proof, n. A demonstration that a conclusion is implied by certain premises and axioms.
Say, wait. If you've just given prerelease test copies of Vista to 3,000 "black hats"... and you're hoping they'll find bugs in them and report them back to you before Vista ships... I mean... how do you know that's what they're actually going to do?
What if some of these "black hats" look over Vista, find security bugs, keep them secret, go back to Microsoft and say "Whelp! Looks like Vista doesn't have any security holes at all!"; then wait for Vista to be released, and once it's out have a 0-day exploit that they can use in their offshore spam/spyware businesses and that no one else will even know exists until two years from now when a gray hat independently finds and publishes it and Microsoft finally fixes it?
I mean, of course that's a worst case scenario. But still, sometimes I think the old thinking on how the world of hackers works no longer really applies now that the primary motivating force is not pride, but money (in the form of sweet, sweet herbal viagra).
It is a trap. They have a suicide booth in there, with Vista logo's printed all over it. The last thing you ever hear before dying a horrible bloody death is the Windows Vista Chime.
Promote Charity on Myspace, Show Your Colours!
"Now Vista, can you show us on this doll where the hacker touched you?
"Let the record show that the victim pointed to the KERNEL!"
- None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
Isn't that what all versions of Windows have always been?
Avoid Missing Ball for High Score
Any of you who listen to Security Now will have heard M$ have re-written the networking stack (as discovered by Symantec et.al).
Needless to say, even after this testing and patching, there is a high probablity the networking interface will still have a few 'zero day' flaws...
Something like this would bring the wannabees and dingbats out of the woodwork. A real paranoid black hatter wouldn't want to have his identity known or put himself under Microsoft's sights for a non-serious amount of money. You'd better believe that people that take this challenge will be closely watched from now on.
Where does the school board find them and why do they keep sending them to ME?
If I seem short sighted, it is because I stand on the shoulders of midgets