Microsoft's "Dead Cow" Patch Was 7 Years In the Making

narramissic writes "Back in March 2001, a hacker named Josh Buchbinder (a.k.a Sir Dystic) published code showing how an attack on a flaw in Microsoft's SMB (Server Message Block) service worked. Or maybe the flaw was first disclosed at Defcon 2000, by Veracode Chief Scientist Christien Rioux (a.k.a. Dildog). It was so long ago, memory is dim. Either way, it has taken Microsoft an unusually long time to fix. Now, a mere seven and a half years later, Microsoft has released a patch. 'I've been holding my breath since 2001 for this patch,' said Shavlik Technologies CTO Eric Schultze, in an e-mailed statement. Buchbinder's attack, called a SMB relay attack, 'showed how easy it was to take control of a remote machine without knowing the password,' he said."

Comments

Now I get it

[Maniacal]

So that's how they came up with the name 'Windows 7'

Re:Now I get it

[thewils]

Things look a bit bleak for Windows 2008 then :(

Re:Now I get it

[mfh]

So that's how they came up with the name 'Windows 7'

No, they needed to get some luck for Windows, so they added the lucky number 7 to it. This bug fix was introduced to confuse us all.

Re:Now I get it

[Yvan256]

George Costanza works for Microsoft?

'been holding my breath since 2001 for this patch'

[Anonymous Coward]

...and boy are my arms tired.

P.S. I'm dead.

my prayers are answered!

[Trepidity]

Seven years ago, The Register devastated me with this terrible news:

It's backward compatibility that has MS in a trap now. "NTLMv2 was created to address many of these issues, and if Windows came configured to use only NTLMv2 these would not be issues, unless the user knowingly opened himself up to allow communication with older operating systems," Sir Dystic noted.
[...]
However, if for some reason it's necessary for you to use the many thrilling features of Windows networking without NTLMv2, then there is absolutely nothing you can do but pray.

Finally, I can use my favorite thrilling NTLM features without giving in and using NTLMv2!

port 139

[heffrey]

Oh well, I guess I'd better block incoming public Internet traffic on port 139 then. That's a shame because it's been so very useful to have an Internet facing SMB share.

Windows Server Admin? On Slashdot? Are you kidding

[drachenfyre]

Like any windows server admin reads slashdot.... And the ones that do aren't going to stick their hands up and say "Oh, pick me" so we can all berate them for their choice in closed source server operating systems.

Re:SMB?

[Anonymous Coward]

It took me a while, but apparently Sir Dystic was(is?) a member of The Cult Of The Dead Cow (reference).

What a crappy headline. I hate teasers like that.

Re:Does anyone use this OS any more?

[heffrey]

Hardly anybody still uses Windows, it's dying out.

Re:Windows Server Admin? On Slashdot? Are you kidd

[0racle]

I do.

You can make fun of me :)

That said, if you have a Linksys firewall

Now you deserve to be made fun of.

Re:Easter egg for Windows 7?

[dkleinsc]

That would make it harder to get to than the Secret Cow Level in Diablo II, because in Diablo II all you have to do is go through Hell, whereas with Windows 7 you have to install it successfully.

Re:Does anyone use this OS any more?

[Sponge Bath]

...stop telling suits that all they need to administer Windows is someone with one finger

Damn skippy! Alt-Ctrl-Del takes three fingers.