Microsoft's "Dead Cow" Patch Was 7 Years In the Making

narramissic writes "Back in March 2001, a hacker named Josh Buchbinder (a.k.a Sir Dystic) published code showing how an attack on a flaw in Microsoft's SMB (Server Message Block) service worked. Or maybe the flaw was first disclosed at Defcon 2000, by Veracode Chief Scientist Christien Rioux (a.k.a. Dildog). It was so long ago, memory is dim. Either way, it has taken Microsoft an unusually long time to fix. Now, a mere seven and a half years later, Microsoft has released a patch. 'I've been holding my breath since 2001 for this patch,' said Shavlik Technologies CTO Eric Schultze, in an e-mailed statement. Buchbinder's attack, called a SMB relay attack, 'showed how easy it was to take control of a remote machine without knowing the password,' he said."

Comments

Re:SMB?

[corsec67]

SMB is used by Windows for file/printer sharing.

Re:SMB?

[eln]

http://en.wikipedia.org/wiki/Server_Message_Block

Also,

http://justfuckinggoogleit.com/

Re:I forget...

[spacerog]

According to Google, 1997. Yeah, over a decade ago.

CIFS: Common Insecurities Fail Scrutiny

- SR

Re:SMB?

[corsec67]

http://en.wikipedia.org/wiki/Cult_of_the_Dead_Cow
and
http://en.wikipedia.org/wiki/SMBRelay

Re:Does anyone use this OS any more?

[stevied]

I've hacked an interesting little solution together for my household, which I'm sure would scale. I've been using Linux for about 13 years, and have forgotten more tricks than most people know. Over that time I've done a certain amount with Windows, too, but the lack of a rich toolset and open / free documentation and source always put me off spending too much time on it. I understand things are a bit better now on those fronts, but I chose where to invest my time ages ago. I've certainly not bothered about keeping up to speed, have no experience with Vista, Office, 2007, etc.

Anyway .. I have to provide a Windows environment for a family member who's really not up to learning anything new. I wanted to be able to manage it, secure it, control changes to the configuration, etc., etc., and eventually hit on the idea of just running XP inside VBox on Ubuntu. It starts automatically, changes to the main Windows partition are discarded on each shutdown, and I can do all my management with ssh (and occasionally rdesktop if I need to actually fiddle with Windows, which is rare.) Performance is fine even on old hardware.

Virtualization on the server is obviously mainstream now, and I guess many users are running virtualization software themselves to provide access to apps on other platforms and run old software. I haven't seen much about using virtualization as a platform for managed desktops though, and I reckon it has some advantages: moving images between machines when hardware fails or users move departments; change control; configuration testing, etc., etc. Knowing you've got the exact same disk image in use on a herd of workstations, regardless of hardware, seems like a good thing for peace of mind ..

Re:Does anyone use this OS any more?

[benjymouse]

You could have just used Windows SteadyState Hint: Can revert harddisks state at each reboot while still allowing windows update to run and make persistent changes, can leverage much of the same policies (restrictions) Windows allows in a domain, but without the central AD. Among other things.