Slashdot Mirror
New Developments From Microsoft Research
prostoalex writes "Information Week magazine runs a brief report from Microsoft Research, showcasing some of the new technologies the company's research division is working on. Among them — a rootkit that eliminates other rootkits, a firewall that blocks the traffic exploiting published vulnerabilities, a system for catching lost e-mail, a honeypot targeted at discovering zero-day exploits, and some anti-phishing applications."
> a rootkit that eliminates other rootkits
Well, there goes kernel stability.
I'm really not sure I want a future Norton RootKit Protector installing itself, bugs and all, into my kernel.
How the fuck does email get "lost"? How could that happen? Even a server crash should not cause that.
Why not, instead, spend the time and money finding the real problem in your email system and fixing that? I handle about 1,500 in-bound messages a day. By their calculations, I should be losing 15 or so, every day. Yet that does not seem to be happening.
If you fix the problem of "lost" emails, then why run a system to find alert people to email that is not lost any more?
If your system is unreliable, adding complexity usually does not make it more reliable. You need to fix the problem at the lowest level possible.
Since this is Microsoft, they're probably referring to Exchange/Outlook. Exchange is mostly database driven now. If you're losing messages in your database, having someone re-send them is NOT the approach you want to take.
You have what is known as "database corruption" and that does NOT spontaneously solve itself. You have a serious problem.
excellent, this will amount to a microsoft tutorial for hackers on how to deploy their stuff whilst simultaniously removing those from competing groups....
From what I know of the Microsoft research, is that it is patent fishing net so that in the future they can sell/control techologies. Basically covering future turf, so that they can control cash flows and maybe make some money on top of it selling the patents. Control in such way if fooling company developing their product would have some nice feature that will partly infringe on the patent. Then microsoft can hurt the company and tell it what to do. And tech is developed far enough to have an idea for patent, and then dropped. Sort of like slugs sliming up the IP territory.
I might be wrong, its been a while.
There appears to be no legitimate purpose to such research.
1. A rootkit that eliminates other rootkits can probably also be eliminated, so this research does not really solve a problem.
2. Rather than perfecting a rootkit, they should be working towards making a rootkit an impossibility in their OS.
3. If you can write a rootkit, eliminating other rootkits does not appear to be that large of a challenge in the first place.
4. If you want to eliminate a rootkit, reinstalling the OS seems like a better idea.
5. There are countless illicit uses of such software.
Are they developing this rootkit in an effort to develop new security for their OS? I don't get it.
If this is microsoft innovation, it's not very innovative. All these 'technologies' are basically extra layers of software to fix the bugs in the first layers ... be it security (phishing stuff, adaptive firewalls, etc etc) or losing emails ... which should not happen anyway and we already have basically the same technique they're developing in the mail protocol, namely confirming a received email.
---
"The chances of a demonic possession spreading are remote -- relax."
Lemme get this straight. A company is working on a rootkit for their own OS. Now, it could be me, but if I didn't sleep through OS programming, as the maker of the OS I already have total control over everything in it (provided my user allows me to have it, which is pretty much a given with MS OSs). Why do I need a rootkit?
Not to mention that Vista was trumped to be the most secure, un-hackable system ever. How do you install a rootkit on it? I thought it is impossible (spare your corrections, I know it is possible no matter what. I just want to get an answer from the guys that keep telling me it is impossible to rootkit Vista).
So we're now at the "who gets deeper into the system" war. Because one thing is a given, 3 days after the MS rootkit to destroy other rootkits, the rootkit to destroy the MS rootkit is rolling out. Then it's a month 'til patchday and... you know the drill, we already live it.
There is no technical solution to social problems. As long as people are dumb enough to click everything offered to them while they're running on admin or root privileges, those things will exist and they will work. Now, with Vista finally trying to run on low privileges, the social engineering part will become bigger to get the user to grant more privileges when necessary for the bug to survive, but since pretty much EVERY program will need those for installation, people will hand out those privileges like freebies, because it's customary that a new program needs them.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
OK, so you've got a clean image saved somewhere. Now what?
How do you detect whether you've been infected, when all you have is an image of an NTFS filesystem?
And once you are infected, how do you clean up without losing all your user files?