Slashdot Mirror
Microsoft's "Dead Cow" Patch Was 7 Years In the Making
narramissic writes "Back in March 2001, a hacker named Josh Buchbinder (a.k.a Sir Dystic) published code showing how an attack on a flaw in Microsoft's SMB (Server Message Block) service worked. Or maybe the flaw was first disclosed at Defcon 2000, by Veracode Chief Scientist Christien Rioux (a.k.a. Dildog). It was so long ago, memory is dim. Either way, it has taken Microsoft an unusually long time to fix. Now, a mere seven and a half years later, Microsoft has released a patch. 'I've been holding my breath since 2001 for this patch,' said Shavlik Technologies CTO Eric Schultze, in an e-mailed statement. Buchbinder's attack, called a SMB relay attack, 'showed how easy it was to take control of a remote machine without knowing the password,' he said."
So that's how they came up with the name 'Windows 7'
MG
...and boy are my arms tired.
P.S. I'm dead.
When did Hobbit write his paper about CIFS (Common Insecurities Fail Scrutiny)?
-jcr
The only title of honor that a tyrant can grant is "Enemy of the State."
I mean, seriously, most of us have written it off, and it makes bad business sense too.
At work we've cancelled plans to use Win7 and WinVista and are moving to all Linux where we can, just from a staffing level perspective.
-- Tigger warning: This post may contain tiggers! --
Seven years ago, The Register devastated me with this terrible news:
Finally, I can use my favorite thrilling NTLM features without giving in and using NTLMv2!
10 PRINT CHR$(205.5+RND(1)); : GOTO 10
Could a Windows Server Admin worth his/her salt please explain to us what SMB is, who would use it, and if there was a workaround that made the vulnerability a non-issue?
Hmm - there was an attack called C2MyAzz that was even simpler than the man in the middle attack. It would just spoof the handshake between client and server. The attacking workstation would watch for client->server message requesting authentication. The attacking workstation would send a packet back to the client before the server, asking the client to send back a clear-text password. Much easier than a man-in-the-middle attack, and it worked well. When it was released, Microsoft's official response was "most organizations use switches and routers, so this is not a problem". Originally released in 2001, IIRC.
Oh well, I guess I'd better block incoming public Internet traffic on port 139 then. That's a shame because it's been so very useful to have an Internet facing SMB share.
Like any windows server admin reads slashdot.... And the ones that do aren't going to stick their hands up and say "Oh, pick me" so we can all berate them for their choice in closed source server operating systems.
It's always been easy to take control of a machine without the password. Sit down in front of the computer. Now the only thing stopping you is yourself. Oddly enough, that's what keeps most systems up... The fact that the vast majority of people are honest, decent folk. That, and they don't know what a null pointer is.
#fuckbeta #iamslashdot #dicemustdie
Back in March 2001
Back then I was still in high school [now I'm a Ph.D. student]. The twin towers still stood. The Bush administration hasn't shown its true colors yet. The Fellowship of the Ring was all the buzz, as was the first Harry Potter film. I had just dipped my feet into "this Linux thing", with Red Hat 6.2. Back then, fips [First Indestructive Partitioning System or something] didn't exactly live up to its name. Good thing I never keep backups :(
Think back seven years. Where were you? How many times have you changed occupation, had kids, changed partner, moved to a new city, changed your lifestyle habits, reconsidered your core values and beliefs, or made some other big change in your life?
I do.
You can make fun of me :)
That said, if you have a Linksys firewall in place, it usually takes care of the issue. Granted the attacks you'll get internally *can* happen, but we have managed to circumvent SMB exploitation via policy settings in Windows. It works fine for us, nice to see they finally patched it though.
The price is always right if someone else is paying.
"I've been holding my breath since 2001 for this patch"
With lungs like that he should try free-diving!
This is not a bug but a fundamental design flaw.
aka "a feature"
What made it worse? Taking 8 years to fix it or disclosing it before the patch was released?
Further it is not a bug at all. It is essentially badly designed protocol having a hole and instead of abandoning it and making users upgrade, MSFT left this hole open for 8 years. All the in the name of backward compatibility. Why has backward compatibility trumped security for 8 years? It not surprising no one takes MSFT's statements about its commitment to security seriously?
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
How many people were actually a victim of this exploit? Is there one documented case of an electronic break-in because of this exploit?
So does that mean we can expect a Dead Cow Level to be hidden in an included Windows 7 app, a la Flight Sim hidden in Excel 97.
Now you deserve to be made fun of.
"I use a Mac because I'm just better than you are."
Well at least they're fixing things...eventually...
Guess they just keep trying and trying until we have no idea what it is anymore.
Wonder how many decades it'll be until Vista is fixed.
Hidden cows is a pinball egg
So, if I patch my XP workstations, will I still be able to talk SMB to Win98?
(Stop laughing you bastards, I was being serious...)
I read /. and I admin windows and linux servers.
I agree with your post about SMB and would like to add to it....
Even then, I doubt any business would have any box with smb/samba enabled without a firewall preventing internet based or external smb connections.
The modern computing environment is complicated by laptops that travel outside the corporate network firewall. Users frequently enable SMB on their company laptop when at home or at coffee shops, airports, etc. to transfer files between machines. A (computer) member of a zombie bot herd can then exploit a weakness like this to take control of the laptop and add it to the zombie herd. When the laptop returns to the corporate network, it becomes a zombie recruiter.
This is probably how the Obama campaign was compromised.
Seth
$5 / month hosted VPS on linux = awesome!
Has it anything got to do with the cult of the dead cow? www.cultdeadcow.com ? They got some internetattention for their BackOrifice stuff waaay back, AFAIK.
All those moments will be lost in time, like tears in rain. Time to die.
It wasn't meant in seriousness, but if you want to take it and run, feel free.
Just meant that any port blocking software or hardware (as simple AS a Linksys firewall) prevents this from being anything of an issue.
Hell, even Windows built-in firewall will do the trick.
The price is always right if someone else is paying.
Ubuntu is our friend, fuck WIN 7. I have a pre beta copy of WIN7 and every time I tell the guys I work with that I want to install it I get dissed hard. Perhaps they will fire me if I even say WIN 7 anymore.
Why has backward compatibility trumped security for 8 years?
Well, if you look at the original notice you'll see it ends this way:
Perhaps Microsoft decided to hold off publication of the exploit code until none of their valued customers were using the service. B-)
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
http://support.microsoft.com/kb/q147706/
You will see that the affected operating systems are old and that Microsoft long ago told people how to configure their systems to avoid this issue.
Why has backward compatibility trumped security for 8 years?
"Microsoft: putting the 'backwards' into 'backward compatibility'."
When Microsoft abandons ActiveX and other technologies that run unsandboxed binaries from random websites, then I'll start taking their claim that they care about security seriously.
Call me when they patch a PDP-11 bug
RT-11 (Regular? F/B?)? RSX-11M? Its little friend RSX-11S? Or the ill-fated IAS, bastard spawn of RSX-11D, a.k.a. the "On The Buses" variant, tragically tortured and killed by a jealous and petty Dave Cutler?
RSTS-11 doesn't count; it was a bug.
I've posted on the Veracode Blog about this issue for clarification purposes.
Here's the content:
With regard to the recent Patch Tuesday fix, there has been an issue fixed regarding NTLM Relaying, that has been around for more than eight years.
In 2000, I wrote an advisory about NTLM relaying (CVE-2000-0834). The problem turned out to be significantly larger than I originally suggested in the advisory. The attack extended to other NTLM-based authentications on other protocols and allowed general-purpose credential theft via a man-in-the-middle attack.
The SMBRelay tool was published in 2001 by Sir Dystic of Cult Of The Dead Cow, and that really took it to the next level. The protocol completely fell apart. It kicked off a number of other analyses of the NTLM protocol that finally resulted in this patch. Eight years after itâ(TM)s discovery.
At least they got around to it. Thanks!
--chris
(Buy my house! http://tinyurl.com/dilshouse)
My #1 beef with Microsoft is that they market it so that every small to medium business owner thinks that everything will all run together happily on one box all "plug-n-play" and snuggly whirring away on the floor of their office closet.
I have the hardest time convincing users that they cannot run their 20-user network on one SBS 2003 server, with Exchange (running OWA and OMA), running their heavily-accessed SQL database, sharepoint, anti-virus server software, backup software, and company file and printer sharing to 5 multi-function copiers and expect 5 9's of freaking uptime.
This is how it is marketed. This is what the end user expects when shopping for a Microsoft solution. You tell them that they'll need at least 3 separate boxes, Server, Exchange, SQL, etc all separate, RAID and ideally a failover system and an excellent firewall for the remote access they look at you like you're nuts. So they buy it and have it set up their way, it works like hell for a year, then they end up paying in the end to have it done again the right way (and more this time, because they have to now migrate off of their old system).
And the Microsoft money machine chugs on.
Just disrupt the deflector shield with a tachyon burst.
and you wonder why the unitedhackers archive is...
so useful.
In the past 4 years more and more i am finding a select group of older exploits to work again.
Little tweak here , little tweak there , or none at all in the case of one that dropped as a test on a hosting linux box showed every SINGLE virtual server
every path, even with chmods that forbade it.
Wonder what that does to sites stupid enough to host CC information when there are multiple sites on the server.
Word of caution 75000 exploits/as you call hacks in an archive take time to test out and money of which i have never had, it is only now that when i get help and support do i find such things.
I am not one of those black hats , not white hats.
I am grey , he who deserves and has patience and shows respect may learn or be shared too.
To the rest of you. Good luck.
Remember mentors last words, for they are all our words.
"Microsoft has released the specifications for the binary file formats used by pre-2007 Microsoft Office applications"
And we all know how well Microsoft maintains backwards compatibility with its office file formats...
Ofcourse, if you're using IE then someone could construct a malicious site that redirects to an smb address, IE will dutifully try to connect to the share and send the authentication details that you are currently logged on with.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
I guess this is why people would know my name when I went into anonymous chat boards. It was weird, every time I went to a site they magically knew I was there.
P.S. I'm dead.
Dead Cow? Is that you?
Am I eval()? - http://www.monst3r.com.br
Microsoft got their ass handed to them there - they've been saying how open source hinders innovation - that bug would have been fixed less than a week after it was discovered.
After some Googling, I found out that this bug doesn't affect anyone because it's a bug in a service everyone has turned off on a port that all firewalls block by default. Which may explain why it took seven years to fix. It wasn't so hard to fix that a team took seven years to do it, it was just at the bottom of the priority cue. In any case, a more complete article summary would have been welcome.
Yes, I also know that some newer Linksys firewalls actually do SPI, but apparently that fact glossed over you.
You just need something to do port blocking. But feel free to stay on your high horse. It's an attitude that keeps *nix relegated to geeks and not go mainstream because of the same type of attitude the admins convey.
The price is always right if someone else is paying.
A good overall security guide is here:
HOW TO SECURE Windows 2000/XP/Server 2003, & even VISTA, + make it "fun-to-do", via CIS Tool Guidance (& beyond):
http://www.tcmagazine.com/forums/index.php?showtopic=2662
It shows you how to config NTLMv2 for instance to be 'proofed' vs. this form of attack this thread on this website is noting today, and the techniques been known for the better part of a decade.
If you are a standalone machine (single machine not on a LAN at home or LAN/WAN on the job for instance on a network there) it goes into far more that is effective vs. this, and other attacks possible on a Windows NT-based OS.
By following both the CIS Tool and this guide's points, You also go faster online as a bonus ontop of being far more secure (91/100 on Windows XP, and 86/100 on Windows Server 2003 scores are quantified for viewers from CIS Tool evaluation (a multiplatform benchmark of security based on industry best practices for securing PC's and Servers that was well noted by sources such as COMPUTERWORLD)).
Whoever modded you funny must think they are clever. It appeared to me that you asked an honest question. Here is the best answer I can give you (2 hrs. of your time, tops, for years of stable and faster uptime for years into the distance, by following a guide, an automated tool for security of PC/Server evaluation from a free and reputable security audit tool, some registry hacks (automated via .reg files that are fully internally documented no less with sources), and instructions on how to use layered security in detail, with tools/tips/tricks/techniques that really work, if you can follow/take direction, use common-sense, & adhere to some simple rules (and, of course, it depends on if you can read english or not))
A good overall security guide is here:
HOW TO SECURE Windows 2000/XP/Server 2003, & even VISTA, + make it "fun-to-do", via CIS Tool Guidance (& beyond):
http://www.tcmagazine.com/forums/index.php?showtopic=2662 [tcmagazine.com]
It shows you how to config NTLMv2 for instance to be 'proofed' vs. this form of attack this thread on this website is noting today, and the techniques been known for the better part of a decade.
If you are a standalone machine (single machine not on a LAN at home or LAN/WAN on the job for instance on a network there) it goes into far more that is effective vs. this, and other attacks possible on a Windows NT-based OS.
By following both the CIS Tool and this guide's points, You also go faster online as a bonus ontop of being far more secure (91/100 on Windows XP, and 86/100 on Windows Server 2003 scores are quantified for viewers from CIS Tool evaluation (a multiplatform benchmark of security based on industry best practices for securing PC's and Servers that was well noted by sources such as COMPUTERWORLD)).
It'll only auto-login if you let it. There is a reason that anyone with half a clue disables that.
Shavlik is the biggest piece of shit in the entire software world. It's surprising that its CTO (Eric Schultze) is prepared to show his face in public - let alone jibe Microsoft on the quality of its software.
What's that saying about people in glasshouses?
Yeah, but it's turned on by default which means that millions of people will have it turned on...
People who have a clue are more likely to be using other browsers too, and i don't believe any others have such a ridiculous "feature".
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
This topic was discussed on March 31 2001 at @lanta.con in Atlanta, Georgia.