Slashdot Mirror
DRM Hole Sets Patch Speed Record For Microsoft
puppetman writes "Wired columnist Bruce Schneier has an article up called 'Quickest Patch Ever', about a patch that was issued within three days to fix a vulnerability in Windows Digital Rights Management (DRM)." From the article: "Now, this isn't a 'vulnerability' in the normal sense of the word: digital rights management is not a feature that users want. Being able to remove copy protection is a good thing for some users, and completely irrelevant for everyone else. No user is ever going to say: 'Oh no. I can now play the music I bought for my PC on my Mac. I must install a patch so I can't do that anymore.' But to Microsoft, this vulnerability is a big deal. It affects the company's relationship with major record labels. It affects the company's product offerings. It affects the company's bottom line. Fixing this 'vulnerability' is in the company's best interest; never mind the customer."
So this is going to be the least installed patch for windows ever. untill they make it mandatory
I often have trouble remembering which way is out of bed in the morning.
What's their excuse going to be the next time a user vulnerability that has exploits in the wild has to wait for the next release cycle?
No matter what anyone in your company tries to tell you, this kind of rapid response is EXACTLY what we are clamoring for when we ask that you take security seriously. Please tell your bosses. Thanks...
W..w..W - Willy Waterloo washes Warren Wiggins who is washing Waldo Woo.
From the article:
"It should surprise no one that the system didn't stay patched for long. FairUse4WM 1.2 gets around Microsoft's patch, and also circumvents the copy protection in Windows Media DRM 9 and 11beta2 files."
So it's not totally horrible... though I'm sure (and the article agrees here) that M$ will be quick to fix their fix.
This leads me to 2 questions: "can patching be regulated?" and "should patching be regulated?". It seems obvious the free market can't keep our computers secure. I've been wrong before though. I guess maybe it could if people didn't already have the expectation that they shouldn't have to pay for patches b/c Microsoft should fix their own faulty software.
I guess it's all pretty moot since open source is going to take over the world anyway.
Does this sig remind you of Agatha Christie?
For a second there, I thought it was Tuesday.
Reviewing just the first hour of video games.
'Quickest Patch Ever'... for Microsoft. Linux distros have definitely had patches available within 48 hours of a security hole being found. IIRC the samba team once fixed a hole within 24 hours and it was in most of the big distros within another 24.
And isn't it sad that the quickest patch they ever release is for a hole no user cares about? More proof that MS cares more about their corporate friends than users.
Developers: We can use your help.
"ut to Microsoft, this vulnerability is a big deal. It affects the company's relationship with major record labels."
what relationship? why is it important?
Do the get money from them? Is Steve B. banging a secretary in the RIAA office?
I just don't get it.
The Kruger Dunning explains most post on
I know it seems like semantics, but Schneier's piece is not an article. It's an editorial, an opinion piece -- even if it is based on some real event(s). We really should differentiate between the two, as I do prefer 'news for nerds', not 'opinions for nerds'. I've already got opinions o'plenty, and the comment section is where I like to see others' opinions. :)
"Trolls they were, but filled with the evil will of their master: a fell race..." -- J.R.R. Tolkien on Olog-hai
DRM Hole Sets Patch Speed Record For Microsoft & Gets cracked again!!
Wincopy
fatal holes in the browser? whatever
allowing spyware to take over? who cares
DRM? we're on it!
The fast fix suggests that rapidness of response might be a function of "whose ox is being gored".
As TFA says, it's simple. A normal security hole costs the user money, not Microsoft. This "security hole" (indirectly) costs MS money so it gets fixed ASAP. MS is, if nothing, good at protecting its bottom line.
So this is going to be the least installed patch for windows ever. untill they make it mandatory
Actually, this is a very serious question: is the patch marked critical, or not? This is important, because:
1. If the patch is critical, it will get criticized for being, in effect, mandatory degradation of capability (by the tech-savvy). Also, this will make light of Microsoft's security policy, to call this sort of patch 'critical'.
2. If the patch is not critical, then - oh, the irony - by default, it will not be installable on computers failing WGA. Perhaps Microsoft will get around this. But, as WGA currently works, only critical patches are allowed to systems marked as 'non-genuine'. This would be amusing - pirated copies of Windows would not receive this unwanted patch, but paid-for copies would.
I can't find, in TFA or the sources it cites, any mention of the severity of the patch. Anyone know the answer to this?
I have an idea. Let's embrace and extend DRM in Windows. From now on, the operating system will not allow anything to read any information from anywhere. Your own files on your hard drive? Sorry, you can't access them, because you might accidently pirate your English class essay that you wrote last night, and Windows, being much, much, much smarter than you could ever dream of being in your wildest dreams, is therefore charged with the duty of making sure you don't do something illegal like that.
Microsoft is serving its customers' best interests. Their customers are system builders such as Dell, purchasing managers at businesses, and media companies.
The guy at the keyboard of a Windows Vista box, using Microsoft Office at work, and Windows Media Player at home is not the customer, he is the product.
This sort of story indicates something about Microsoft's priorities. It doesn't mean they're evil and/or going to software hell. It just indicates something about their priorities.
My turnips listen for the soft cry of your love
So let me see if I get this right... they'll wait a month for normal patches, sometimes longer for some that've been well known but they either can't fix or don't see the potential risk... but in general, if a new vulnerability is found on the Wednesday after black Tuesday, they'll wait a month (at earliest) to release a patch even if an exploit is in the wild... yet when it comes to protecting their cash cow, they'll fix it right away. In other words, screw the consumer... we can just damn well wait for updates to critical vulnerabilities, but when it comes to protecting their own revenue stream, they'll fix something right away. Not sure why I would've thought they'd do any different... but it would seem they rushed to provide a "bug fix" to protect their revenue stream, but won't rush to creat "critical updates" that customers need. Amazing...
Normally. Microshaft ignores security problems for at LEAST a month, they they deny that a problem exists for at LEAST another month, then they "study" the issue for at LEAST another month, then they "work on the problem" for at LEAST another month, and finally release a patch that does not really address the original problem and breaks a half dozen other things (and apparently inflicts even more sadistically controlling DRM on Microshaft's victims).
When the summary says "Within three days" they mean "three days after it was reported in engadget".
Coz,FairUSE4Wm was released on August 19th in the forum.Microsoft patched it on August 28th.So 9 Days.
Wincopy
Microsoft did not really "patch" their DRM. This wasn't a code change. Their DRM was designed to be updateable in the event that it was compromised.
There is a big difference in how fast you can roll out what ammounts to a configuration change and how fast you can roll out a code change.
That said, it didn't seem to do much good given that it was cracked again in a matter of days.
So Microsoft wasted no time; it issued a patch three days after learning about the hack. There's no month-long wait for copyright holders who rely on Microsoft's DRM.
It's nice of Microsoft to let us know where their priorities lie. Obviously, things aren't as complex as Microsoft have let on (one of the many excuses for not getting patches out) if they can patch something that quick.
"Oh no. I can now play the music I bought for my PC on my Mac. I must install a patch so I can't do that anymore."
Really? I'm going to Windows Update as I write this. Mind you, good luck finding anyone who actually uses PlaysforSure. For those that are they've found out that stores selling Windows Media files are crap (you effectively rent your music - yay, what a great idea!) and they're looking to get out before they buy any more of the crap. Microsoft have some slight delusions of grandeur about the importance of their DRM software.
An opinion piece is an "article" ("piece" and "article" in the relevant senses are synonyms.) It is not a "news article". But the existence of the opinion piece is itself news, as are the underlying facts it relates too, so a Slashdot article pointing to it is not inconsistent with the slogan "News for nerds."
Of course, the full slogan is "News for nerds. Stuff that matters." Whether the second part is a limitation on, or addition to, the first is debatable.
It's a good thing I have automatic updates turned off. However, automatic updates in Vista will be turned on by default. If I ever end up using Vista, that will be the first feature that I disable which is a shame since automatic updates are a good thing if you can trust the company that performs them.
The KB891122 patch wasn't developed in response to FairUse4WM 1.0 -- MS started working on it after seeing an earlier bunch of tools (drmdbg and friends) that were released on the cover CD of a Japanese magazine a few months ago, but were too cumbersome in operation to gain widespread use.
FairUse4WM "merely" wrapped up the techniques used by these tools in a neat package, and got to the frontpage of Engadget. It was pure luck that MS had a patch available at the time, even though it took extraordinary effort on the behalf of its DRM partners to implement, and denied "legacy" OS users, as well as users of the latest Media Center version, the use of new DRM-protected tracks.
A patch for FairUse4WM 1.2 still isn't available, even though the tool was released last weekend.
BTW, if you think MS is getting screwed by class breaks like this, think again. Content providers (think: RIAA members) will call in their non-refundable advances (usually over $25K per label!) received from distribution partners (think: music stores) for "material breach of contract". MS will fix the issue, the RIAA gets richer, and the guys that actually try to get music to you get screwed. Oh, well, they're used to it...
Not the desktop anyway. It's a monopoly. The actions of Microsoft are those of a monopolist.
Deleted
First of all, the DRM code is most likely pretty self-contained, and is only interfaced with by a limited amount of code. (All the files run through some version of the Windows Media Encoder engine, remember?). So on that front, it's a hell of alot easier to patch an issue contained to DRM-land than it is to deal with something like IE, which has to interact with a much messier set of incoming files (the Web).
Even then, the reason you don't release a patch in three days is that you're probably going to screw it up and not actually fix the problem. Amazingly enough, that appears to be exactly what happened.
First of all, it's been cracked again. Look up FairUse4WM 1.2.
Second of all, from what I've seen, it's not pushed out via windows update, but rather the client you are using for music. For instance, Napster pushed out the new version via a tiny patch when I launched the client. There IS a way to trick your client into believing that you already have the latest version (thus preventing the forced update). Look it up in the doom9 forums.
This should keep the crack working until Napster pushes out a completely new version of the client that explicitly checks the version, or Micrsoft issues a regular update.
-T
P.S. Napster provided free of charge by my university. Hell, as a grad student, I guess I get paid to use it...
And isn't it sad that the quickest patch they ever release is for a hole no user cares about? More proof that MS cares more about their corporate friends than users.
Is it proof that MS doesn't care enough about users, or is it (by extension) proof that users don't care much about OS vulnerabilities? Sure, they may complain, but do they actually take action and demonstrate that they care, by switching to more secure OS's (by moving to Apple or Linux)?
After all, MS reacts to what its customers and business partners care about. The music companies go apeshit over stuff like this, but users (both corporate and personal) haven't really demonstrated that they'd rather take their business somewhere else, so why should MS give them anything more than lip service?
Stop by my site where I write about ERP systems & more
Not all fixes pose the same risks or require the same amount of testing.
A patch for a DRM component surely involves much less code churn, risk, and testing than a change to a core OS component (such as network stack or IE) would require.
Furthermore, as the original post indicated, no end-users are going to care about this patch or badmouth it in the press if it doesn't perfectly close the hole. And partner businesses aren't going to abandon their deep investments in Microsoft's platform just b/c of one hole. This scenario actually presents less pressure on Microsoft to have to get the fix right compared to other scenarios, meaning they can afford to do less up-front testing.
* I know someone will want to reply to this post to say: This is Slashdot, and you're looking for fairness?!? HahaaHAhaAHA! I know this is Slashdot, and so I know better than to expect to see fair reporting around here. Still, there's no harm in trying to raise the bar a bit.
Moderator hint: a comment is neither "Flamebait" nor "Troll" if it is true.
I know this goes against the Slashdot groupthink but yeah, real customers (as in people) do get hurt by this kind of thing.
My brother used to subscribe to the Napster "all you can eat" music service, in which you basically rent music - you pay a fixed amount each month and just listen to however much you like. If you stop subscribing you lose access to the music. He liked this business model, because it suited the way he listens to music. I'm the same. There isn't any way to implement this without DRM, and if DRM is not robust, that business model will die. And then the silent section of the populace who doesn't read Slashdot, and doesn't really give a crap about DRM, will just get pissed off.
You've gotta love how one sided DRM debates here always are ... the artists and non-technical users are sort of presumed to not exist, or not be important.
People seem to be overlooking who the customer REALLY is here. The bottom line lies in corporate back scratching for multi-$$$$ contracts and agreements
One business contract with a large label, Dell, or Sony is worth more than the mutterings and begrudging updates from Windows consumers. Most of us are not the customers, we're the consumers. Most people don't buy windows from microsoft, they buy it from Dell, or Gateway, or whoever else sold them their computer. The Dells, Gateways, etc are the customers. The game companies writing for xbox 360s, the phone vendors embedding wince, they're the customers.
Bottom line, If you're bitching about this update, you're a consumer. If you think it's a good thing, then you're the customer.
That article is completely misleading. This "Vulnerability" has been known about since January 2005, the tools to bypass it were available since then, they just didn't have a fancy GUI to make it easier. This is actually one of the LONGEST periods Microsoft took to patch something.
+1 IDisagreeSoHeMustBeATrollOrAnAstroturferOrAShill
Just like the bozos in congress that attach totally unrelated garbage to a bill trying to get passed, Microsoft will probably just attach it to another update that people will actually install...
DEAD DEAD DEAD DELETE ME
Microsoft's level of quality in the Windows software offerings is similar to GM's level of quality in their car offerings -- good enough for most. Then they both put further efforts toward matching the competition's features and product line.
Finally, just talk a good game about quality to your sales people and the general public. New car buyers don't follow advice from professional drivers or mechanics, any more than consumers listen to IT pros or technicians about what OS to install.
I can just see it now -
The amount of testing needed for any patch, as variable or fixed as it may be, does not in itself justify the "second Tuesday of the month" approach.
I fully understand that there may be very critical patches that may take a few weeks to develop and test properly. I also fully agree that MicroSoft should not release those prematurely. However, it is not because one critical patch isn't ready that others that are ready must be queued up for up to a month. After all, if said critical one doesn't make the deadline, do they then also postpone publishing the others for an extra month? No. So why postpone at all the first time round? MicroSoft should just release each patch when it is ready, testing included. Not sooner, but also not later.
Linux user since early January 1992.
Its all about money. The DRM is key to their relationship with media partners. If DRM is broken then all Windows users will suddenly, uncontrollably start pirating their media; we can't help it, apparently, and without the DRM firmly in place, we mind end up like Sweden.
I'm sure they're more "worried" about DRM breaking than the everyday security holes that merely allow someone to glom your computer onto their botnet, since there's money and contracts that depend on the DRM. The EULA is probably the only agreement that might be impacted by a security flaw, but we all know those are meaningless.
blog
We tend to think of all patches as security patches, but that isn't the case. A change to DRM should not, on the face of it, appear among the security updates seen on Tuesdays.
I was going to suggest this. When I really need to run something that's Windows-only, I run it in a WinXP virtual machine on my Linux box.
I was actually surprised at how spry Windows feels, when it's not bogged down by a lot of anti-virus/spyware/adware, automated backup programs, and the like. Of course, without those things it's not a terribly useful host OS, because it gets owned so easily (click on wrong link in Internet Explorer -> ActiveX control -> rootkit), but as a guest OS, I just disable all patching and auto-updates.
When I'm done with whatever I'm doing with it, I just roll the image back to its saved state and shut it down. Basically I can abuse the living shit out of it, and then just kiss it goodbye the second it starts acting up.
Obviously you need to take steps to make sure that you save your work somewhere not on the VM's drive (duh...), but I could definitely see the possibility for working like this. I still hate working in Windows, but Windows as a VM is orders of magnitude nicer than Windows running on the actual metal.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
One of the many M$ troll accounts that cloud around here challenged me to produce references to M$'s infamous Windoze source code national security claim swiftly followed by sale of said code to China and Russia. Of course, I'd love to trot that whole mess out again. Non free software exists on trust alone and M$'s performance there really shows what contempt they have for the US Government and their customers.The memory hole has not yet extinguished the information presented by eweek and Microsoft themselves. You can read it all yourself.
From eWeek, 2002:
If you need to, you can always reference the anti-trust evidence, which is still published and available. The quotes in the article are more than enough for me.
A quick Google Search digs up all the articles here and a parade of Wintel rags falling over themselves to toe the party line. ZDNet echos Alchin again in 2004, a year after they had already sold out! Something called Neowin joins the chorus of woe that someone might look at the source code to W2k or NT4 and see how crappy it is. All as if any real hacker needed it.
The very next year, 2003, M$ announced sale to the highest bidding governments as noted above. Included was China and other friendly countries. But you know, Bill Gates it's just business buddies being chummy. Microsoft would never place the interests of Communist dictators over the rights and well being of their fellow citizens, would they?
The double talk going on at M$ was glaring and all of was bullshit. Access to the OpenBSD source code has not made OpenBSD less secure, it's made it better. The whole episode represented more perjury and a three year FUD attack on free software than it did treason, but you have to wonder what they really believe. Looking back, it's a low point in US corporate history that will only be made worse when they unravel like Enron did. The biggest lie of all is that the Microsoft Monopoly is based on anything more than mass delusion.
I ask you once again, do you trust Microsoft to do as they say? With your business? Code so crappy, it can't be shared but is shared with your worst enemies. If you do, you probably will tell me that Windows XP is easy to install, has good uptimes and other nonsense like that. I'm not sure anyone really believes anything other than Windoze is "good enough because I'm using it for one or two specific tasks." No, that's not good enough and Vista's imminent flop is a good chance to move on to something better. The market is filled with better contenders and M$ will not be missed.
Friends don't help friends install M$ junk.
Anyone know how the GetFileVersionInfo() call works? Does it just read the IBX file version as a sequence of unencryted bits from the .key file? If so, why not just take a hex editor to it and 'update' your old version to one which fill pass the DRM checks?