Microsoft Releases Super-Secure XP to US Air Force

Wired is reporting that Microsoft is releasing the most secure version of Windows XP ever created, but only if you are the US Air Force. "The Air Force persuaded Microsoft CEO Steve Ballmer to provide it with a secure Windows configuration that saved the service about $100 million in contract costs and countless hours of maintenance. At a congressional hearing this week on cybersecurity, Alan Paller, research director of the Sans Institute, shared the story as an template for how the government could use its massive purchasing power to get companies to produce more secure products. And those could eventually be available to the rest of us. Security experts have been arguing for this "trickle-down" model for years. But rather than wield its buying power for the greater good, the government has long wimped out and taken whatever vendors served them. If the Air Force case is a good judge, however, things might be changing."

Comments

Autorun?

[someone1234]

Now i see why they disabled autorun. :D

Re:Autorun?

[TropicalCoder]

You're kidding aren't you? "85 percent of attacks were blocked after the configuration was installed". ...and the remaining 15% were not! The concept of a secure computer running Windows XP is a contradiction in terms. The military needs to do better than this, or China is gonna whup their ass.

Re:Autorun?

[cbiltcliffe]

You're security is useless?

ARRRGGHH!

Apparently, so is my grammar.

See? Piss me off, and I can't spell.
That must be my superhero weakness....

Re:Autorun?

[tsm_sf]

Wrong analogy. Try: "This bucket has 85% fewer holes than Bucket XP."

Re:Autorun?

[supernova_hq]

Exactly, locks (unless you pay a shitload for them) are not designed to keep people out. Any locksmith will tell you that the only thing a lock will do is make your neighbours house an easier target.

Computer security is the same way. You *can* cracl WPA(1/2) encryption, but if you neighbour has his connection open (or is using WEP), you are not likely to become a target.

The exception, which appears in this situation, is when you are chosen as a target due to a high payoff (military). In this case, simply being harder than your neighbour is NOT going to help you.

Re:Autorun?

[roc97007]

Wow, that needs to pass into our lexicon. "Bucket XP".

Re:Autorun?

[Burning1]

Personally... If I'm being forced to patch a rusty old bucket, I'd rather start with the one that 85% less holes...

Re:Autorun?

[nabsltd]

I think something like it is already there.

I hear "bucket, it's XP" all the time around my office.

What do you mean "you need to get your ear-ring checked?"

Re:Autorun?

[vertinox]

Exactly, locks (unless you pay a shitload for them) are not designed to keep people out. Any locksmith will tell you that the only thing a lock will do is make your neighbours house an easier target.

Arguably, an alarm system is more important in keeping people out than the lock on the door. If they kick down the door and a message goes off that lets them know that you know they are there and that the police are coming shortly, they usually won't stick around that long.

Same thing applies to computer systems. It is more important to know that you have an intrusion as soon as possible than the actual prevention of the intrusion.

Not that you want to leave the door unlocked, but rather you need the ability to lockdown and detect when someone is there when they shouldn't be.

Re:Autorun?

[timeOday]

99% secure is 100% insecure.

Holding out for absolute perfection, I see. Let me know when you find it. I'm stuck here on planet Earth where nothing is 100% anything.

Re:Autorun?

[lymond01]

I disagree. Security is a layered thing, both in implementation and subversion. If I'm running Windows NT with no service packs and no firewall, I'm easily hacked by 90% of people.

If I'm running Windows XP patched and firewalled, I'm easily hacked by 1% of the people. If I'm running OpenBSD fully patched with no open ports aside from SSH, I can be easily hacked by .01% of the people (likely a BSD or SSH developer who slipped in a back door).

Nothing is 100% secure -- HOW secure you are is the important thing. If this super XP lets in 15% of attacks, you need to ask who knows and who would bother to run those attacks, as well as what other layers of security beyond the desktop are available.

If you're running a desktop operating system "in the wild" with no patched firewall software of any kind to block basic traffic, then you should add that layer.

Re:Autorun?

[Facegarden]

The exception, which appears in this situation, is when you are chosen as a target due to a high payoff (military). In this case, simply being harder than your neighbour is NOT going to help you.

So, what you're saying is, we need to let our economy keep tanking until people would rather hack into Canada?
-Taylor

I'll be truly impressed

[Anonymous Coward]

When the navy puts windows on their ships.

Re:I'll be truly impressed

[Amouth]

http://gcn.com/Articles/1998/07/13/Software-glitches-leave-Navy-Smart-Ship-dead-in-the-water.aspx?p=1

i know feeding the trolls - but he wanted to be impressed

I would just love to see...

[mdm-adph]

...what they did to make it secure. Is the default wallpaper black with a big picture of a lock on it?

Re:I would just love to see...

[houstonbofh]

I am just waiting for it to show up on the torrent sites! Secure Windows, WooHoo!

Re:I would just love to see...

[Keruo]

My guess would be

• disabled non-microsoft drivers
• removed networking
• removed usb stack
• removed firewire stack

How to secure XP

[snspdaarf]

But what good is XP without drivers for keyboard, CD/DVD drives, USB ports, or NICs?

Re:How to secure XP

[merreborn]

But what good is XP without drivers for keyboard, CD/DVD drives, USB ports, or NICs?

In all seriousness, I'd imagine usability is likely the reason this won't see a public release -- "really secure" and "really easy to use" aren't necessarily mutually exclusive, but you can bet they sacrificed the latter for the former in this case. I'd fully expect application compatibility to take a serious hit, and for many Windows features to be cut entirely.

This product is probably unusable for the average consumer. I'm sure there are some enterprise contexts in which it'd make perfect sense, though.

And of course, Microsoft doesn't want to dilute Windows Vista/7 sales with a new edition of XP (which they'd have to support for years) either.

It's not a new version, it's just a configuration.

[YesIAmAScript]

'The Air Force, on the verge of renegotiating its desktop-software contract with Microsoft, met with Ballmer and asked the company to deliver a secure configuration of Windows XP out of the box. That way, Air Force administrators wouldnâ(TM)t have to spend time re-configuring, and the department would have uniform software across the board, making it easier to control and maintain patches.'

So if you'd like to do it yourself, you can secure your XP too.

http://nvd.nist.gov/fdcc/fdcc_faq.cfm

I'm not sure super secure is the right word for this version of XP though, given that there are a lot of security features it is missing that Vista, Windows 7 and some other OSes have.

MS is probably holding the air force hostage

[t0qer]

So I have this on good authority from someone who works there... A few years back the VA decided to start migrating from IIS to apache. At the same time they wanted to migrate file servers as well. When MS caught wind of this, they told the powers that be at the VA, "You drop us, and we'll audit you." Part of the contract MS holds with the VA is they're allowed to perform a license audit any time they want. The VA did its own internal investigation and figured out pretty quickly that MS had them, "Over the barrel" so to speak... I don't think the Air Force really wants to use MS stuff, but if they're in a similar situation as the VA, this doesn't bode well for them. I hope the Obama administration catches wind of this and puts a stop to this practice. It isn't right that my tax dollars are being forced into MS's pockets. I think in these rough economic times our government needs to really start exploring more OSS/free solutions out there.

AF Standard Desktop Configuration

[PapaSmurph]

While this was an interesting article, the XP and the Vista versions used by the USAF are the same ones used by the general public. The only differences are the security setting, the firewall configuration, and the user configuration. No one is an admin unless they need to be, and no normal day-to-day work is done in admin mode (same thing you do in Linux, no doubt).

I didn't know this article was going to be published, but when I found it, I was not surprised by the comments. I've been working on this program for more than 2 years. Users hate it. Developers loathe it. Network security staff loves it.

Nothing can make Windows (or any other OS) completely secure if it's connected to a network. This is as close as the federal government as ever come.

A subtle point

[Dystopian Rebel]

"Having the most secure Windows ever" does not equate to having secure Windows.

Re:A subtle point

[houstonbofh]

I guess the irony of having to go to a "dirty pirate site" to get "the most secure windows ever" is lost on you. To get security, you have to steal it? (Or use %uname)

You too can have your own "Super-Secure" XP setup

[jdb2]

It's called running XP in VMware under Linux.

( Also, is it just me or does the "XP" after "Super-Secure" look like a smiley representing someone laughing their guts out? )

jdb2

Re:If...

[Red Alastor]

Because it's probably not the most compatible Windows and might lack some features.

85 percent of attacks were blocked

[hAckz0r]

85 percent of attacks were blocked after the configuration was installed.

Now lets rephrase that; 15% of the attacks were still successful after a complete lock-down configuration was applied and lots of manpower went into burning custom installation disks and procedures. Is it just me or does anyone else see a problem with this?

Re:Obviously this can't work

[secPM_MS]

I am a security program manager at Microsoft. The article gets much of it wrong. The Air Force wanted the machines preconfigured to a secure configuration so that they did not have to do this configuration. Such configurations are not distributed to the general public because of the impact on generalized consumer useability. Microsoft always publishes a security guide which provides guidance on configuring systems for different threat environments. For example in the Windows Vista Security Guide, Chapter 5 is titled "Specialized Security - Limited Functionality". Such security guides exist for NT on.

Users are free to configure their systems for higher security. Note that doing so may limit functionality you are used to. For example, you can configure your system so that all users run as normal users (no administrative functionality). Running users as normal users is part of all security guidance. Not all XP software will run if you do this. You can set IE to high security mode by default and disable Flash, etc. Doing so breaks much of the web but is more secure. You can get security, but it will impact your user experience.

It is easier to secure Vista and 2K8 server systems.

Re:It's not a new version, it's just a configurati

[JATMON]

if you look closely at the article, this is something that the air force did between 2005-2007. so this is actually old news. 'The Air Force began the project in 2005 and finished installing the new configuration on systems in 2007. In contracts with hardware providers it demanded that vendors pre-load the special Windows XP configuration onto systems before delivering them to the Air Force.'

Re:I bet the british wished they had this...

[anjilslaire]

let's see, Windows on hospital equipment recently got Conficker because Microsoft no longer provided security patches for Windows 2000 and NT.

Uh, no. The MS08-067 patch that addresses conficker was released for Windows 2000 at the same time as all the other OSes, with the exception of NT. http://www.microsoft.com/technet/security/Bulletin/MS08-067.mspx

Re:I bet the british wished they had this...

[j79zlr]

let's see, Windows on hospital equipment recently got Conficker because Microsoft no longer provided security patches for Windows 2000 and NT.

Extended support for Windows 2000 doesn't end unitl July of 2010. The patch that fixes the exploit on Win2k is here if interested.

As for NT, the long term support ended over 5 years ago.

security program manager at Microsoft

[rs232]

"I am a security program manager at Microsoft"

I wouldn't mention this on your next job application ;)