Slashdot Mirror
MS Giving Exploit Writers Clues To Flaws
In the IT trench writes "How's this for a new twist on the old responsible disclosure debate? Hackers are using clues from Microsoft's pre-patch security advisories to create and publish proof-of-concept exploits. The latest zero-day flaw in the Windows DNS Server RPC interface implementation is a perfect example of the tug-o-war within the Microsoft Security Response Center about how much information should be included in the pre-patch advisory."
I know the ongoing debate about whether open source or closed source has the security advantage when it comes to exploits in code.
But this is a case where a half-and-half approach is probably the worst of all.
Maybe they should do what Mozilla does, which is to "hide" vulnerabilities until they either patch them or feel that a sufficient number of people have applied the patch (which is of course the other problem). Of course, like with Blaster for example, you can release a patch and 30 days later the exploit nails all the people who didn't bother to fucking patch.
I can see some people's heads exploding with this one.
Open source projects have to write security advisories, too. They just have the option of including the patch with the advisory.
That's great. Now they have an excuse to be incredibly vague about the problem in the advisories. It will be like the Government and National Security Letters.
"We need you to submit to this, to protect you from hackers. We can't discuss the issue as it's a trade secret and a threat to computing security. This is a critical venerability. But we can't tell your why. Just install this patch when it comes out and you'll be better. Trust us, we know what we're doing."
They also know How To Ask Questions The Smart Way.
Crackers have the upper hand on system administrators, because the focus is very narrow. System administrators have to RTFM and stay up-to-date on everything from why Alice can't print (because her network cable is unplugged) through to debugging the cause of a fatal exception/crash in a plugin they've written for a HTTP daemon. System administrators are very overloaded with work whereas crackers can take it much easier.
I actually think that MS pushes out some patches too fast. My Windows laptop gets autopatched and the problematic parts of the system (wireless networking in particular) sometimes get screwed up for a while until the next patch set arrives. I don't think that MS is responsible for all the breakage. Often, MS makes a change which can break an existing driver or app. From a user's perspective all that you see is that a MS patch breaks the system.
Engineering is the art of compromise.
The problem with this is the bad press MS would get from announcing 11 exploits for every one they discovered. Those "outside the know" would think MS insecurity had gone up by 11x. MS already has major press issues about their many security exploits, they don't need 11 times that.
Also, introducing fake honey pots in the code would cause problems. If they announced it and fixed each one, the honey pots would be useless. If they announced it but didn't fix it, they'd look like they didn't care/or it would make it obvious it was a honey pot. If they didn't announce it or fix it, then invariably some security researcher would find it (it has to be discoverable to become a honey pot) and blast MS for the security vulnerability.
Only one of them, the $20,000 in your basement. The reason you only do that for one night is that it isn't a good long-term security solution. Eventually, someone will find out that you have that much cash lying around and your chances of being robbed go way up.
Congratulations. You have just unwittingly illustrated the mindset that makes businesses wary of open-source software, and gives bite to Microsoft's FUD. Of course not all open source coders have such a knee-jerk mindset, but you are a member of an influential (in intimidation power, not number) minority.
You have tried to support your argument with faulty reasoning! Go directly to jail; do not pass Go, do not collect $200!
The headline should instead read something like Hackers Create Exploits Using Microsoft Published information. This IS what hackers do after all. They read documentation and manuals. They find out how things work with all the available information. They social engineer. Trying to pin this on Microsoft is childish.
You realise RPC is, in fact, a UNIX feature? That it's there on your Linux/Sun/BSD/OSX box? That like anything running on a known port it's easily blockable at the firewall? Or via IPSEC if you don't run a firewall? And that the Win2003 firewall will block it by default?
Well done; next time I develop code I'll make sure I name my services something like "Sooper secure, non-remote admin interface", because we wouldn't want to make the cracker's job easier with a name now would we?
C's time has passed! the IT industry can not afford it any more economically as well as politically. Even the slightest mistake can cost millions of dollars.
And before someone says it's all about the programmers and not the language, I would say I agree: it takes a God programmer to produce a flawless C program. The God programmer category has few members around the world, and most of them are not in Microsoft (hint: they are Linux / open source guys).
So it's time to stop using this horrific programming language called 'C'. It worked so far, but its flaws are very serious...time to move on!
Good idea, if it wasn't for the fact that the legitimate uses for all these things far outweigh the trouble they cause.
I have excellent Karma and I am not afraid to Troll it.