Slashdot Mirror


US Security Services May 'Have Moles Within Microsoft,' Says Researcher

Barence writes "U.S. government officials could be working under cover at Microsoft to help the country's cyber-espionage programme, according to one leading security expert. According to Mikko Hypponen, chief research officer at security firm F-Secure, the claim is a logical conclusion to a series of recent discoveries and disclosures linking the U.S. government to 2010's Stuxnet attack on Iran and ties between Stuxnet and the recent Flame attack. 'It's plausible that if there is an operation under way and being run by a U.S. intelligence agency it would make perfect sense for them to plant moles inside Microsoft to assist in pulling it off, just as they would in any other undercover operation,' he said. 'It's not certain, but it would be common sense to expect they would do that.'"

228 comments

  1. Ockham's razor by Anonymous Coward · · Score: 5, Insightful

    ... or they just paid/threatened Microsoft. Much simpler and easier.

    1. Re:Ockham's razor by Culture20 · · Score: 3, Insightful

      ... or they just paid/threatened Microsoft. Much simpler and easier.

      And it has the added bonus of being legal. "Moles in MS" would be a big no-no, no?

    2. Re:Ockham's razor by JeffSh · · Score: 3, Insightful

      Only if it were to ever be acknowledged, something that has zero possibility of ever happening.

    3. Re:Ockham's razor by Sir_Sri · · Score: 4, Informative

      Or they just paid former microsoft employees with technical positions to come work for the government.

      Didn't the NSA offer to help 'secure' windows 7 (http://www.computerworld.com/s/article/9141105/NSA_helped_with_Windows_7_development), they could just offer to help with 'collaboration' and then provide some security fixes and use some of the loopholes they find before anyone else does.

      Now the israeli's. They have spies at microsoft. The US government probably not directly, at least not in the US, there are enough cheaper no risk ways to get what they want.

    4. Re:Ockham's razor by Anonymous Coward · · Score: 0

      And his name is Bill Gates!!

      Shock, horror!

      'It's not certain, but it would be common sense to expect they would do that.'"

      So, its just something the researcher just imagines....

      Good research.

    5. Re:Ockham's razor by Anonymous Coward · · Score: 5, Funny

      "Moles in MS" would be a big no-no, no?

      Actually, it sounds like it'd be a runaway hit reality show.

      "For the past year, we sent a Google developer deep undercover at Microsoft armed with an Android-powered hidden camera and an agenda to subtly promote open technologies. Now, we're going to show you the results. Sometimes hilarious, sometimes heartbreaking, sometimes horrifying; tune in starting this August on Slashdot TV for 'Moles in Microsoft' to see what happens when development ideologies collide in the real world."

    6. Re:Ockham's razor by cayenne8 · · Score: 2

      Only if it were to ever be acknowledged, something that has zero possibility of ever happening.

      I dunno about that.....of late, the Obama administration is been quite 'leaky' when it comes to secret/covert ops.....what we already know about Stuxnet comes to mind.

      --
      Light travels faster than sound. This is why some people appear bright until you hear them speak.........
    7. Re:Ockham's razor by Aighearach · · Score: 5, Interesting

      We can get even simpler and easier, MS already gives the military access to their source code so that it can be reviewed. This is a requirement for all the software used on the most secure systems.

      It has always been viewed as a joke around here, because unless they are going to fix the bugs themselves, having the source isn't going to make windoze take extra care about your data.

      So the simplest and most obvious answer is, they didn't need to sneak in, and they didn't need to make threats either.

    8. Re:Ockham's razor by JeffSh · · Score: 2

      To further this idea, even if we were to have it confirmed, what would it change? The population is too pacified to really care.

    9. Re:Ockham's razor by NatasRevol · · Score: 1

      Attack Microsoft!

      --
      There are two types of people in the world: Those who crave closure
    10. Re:Ockham's razor by s.petry · · Score: 5, Insightful

      I'm not even sure they would have to do that. The technical details in TFA are a bit scarce, but enough exists for a better theory than the TFA presents.

      Someone with some hefty CPU power broke the MS cert, which allowed them to create their own at will and spoof a MS cert.

      The Government has the access to MS source code, and their methods. If you know where hooks get applied and how priorities work, you don't need to be from MS to write good code. You just need to be a good coder.

      Spoofing Windows Update server really would not be that hard. Hell you don't even need a real man in the middle attack if you have a forged Cert and know the structure. You just need to spoof a DNS answer, the client will do everything else for you.

      Having the fake key is huge! Write an application, sign as Genuine MS, put on a faked Windows update server, reroute a DNS call. Shazam! Of course there is other knowledge required, such as evading AV detection, etc.. but they had that figured out very well also.

      It would take a good team, and time, but no need to have a mole. I would not be surprised if the US Government had moles in MS, but if they did it would primarily be for reasons other than Stuxnet and Flame, or any other computer espionage program.

      --

      -The wise argue that there are few absolutes, the fool argues that there are no probabilities.

    11. Re:Ockham's razor by ackthpt · · Score: 5, Funny

      We can get even simpler and easier, MS already gives the military access to their source code so that it can be reviewed. This is a requirement for all the software used on the most secure systems.

      It has always been viewed as a joke around here, because unless they are going to fix the bugs themselves, having the source isn't going to make windoze take extra care about your data.

      So the simplest and most obvious answer is, they didn't need to sneak in, and they didn't need to make threats either.

      That explains some of the mental breakdown of returning veterans...

      --

      A feeling of having made the same mistake before: Deja Foobar
    12. Re:Ockham's razor by flyingsquid · · Score: 4, Insightful

      ... or they just paid/threatened Microsoft. Much simpler and easier.

      The problem with the claim put forward in the article is that it is *not* the logical conclusion of what we know about Stuxnet and Flame. What we know about Flame is that (i) it's the most advanced piece of malware ever created (that we know about), (ii) it has connections to Stuxnet, (iii) it's primarily targeting Iran, but it's also targeting Syria, Palestine, Egypt, Saudi Arabia. That information tells us a lot about who was behind it.

      Okay, so first off, Flame is very large and extremely advanced. That implies a country with an advanced cyber-warfare program. That list is fairly short, and the big names on it are the United States, Russia, China, and Israel.

      Second, the people behind Flame were also involved in Stuxnet. The people analyzing Stuxnet came to the conclusion that it was the work of two different countries, with suspicion falling on the U.S. and Israel. In the New York Times article, it's reported that Stuxnet is designed by the U.S., but the Israelis helped out. The Obama Administration has not denied anything published in that article.

      Third, Flame is primarily targeting Iran, again that points to the U.S. and Israel, Iran's primary enemies. However, Flame's secondary targets are all areas that are potential threats to Israel (Syria, Palestine, Egypt, Saudi Arabia) but this list does not include countries that pose security threats to the U.S. but not to Israel (Afghanistan, Iraq, North Korea). Finally, there are also some Flame infections in Israel itself. Given that one of the purposes of an intelligence organization is (unfortunately) to spy on their own citizens, that also fits the idea that Flame is written by the Israelis.

      If Flame is Israeli, then the idea that the U.S. is planting spies in Microsoft is not the "logical conclusion" of the facts at all. So does this mean that the Mossad has penetrated Microsoft? Well, I suppose it's possible. It would antagonize the U.S. to learn that our ally has spies in our corporations, but it's also been alleged that Israel has moles in the Pentagon, so it wouldn't be entirely surprising, either.

    13. Re:Ockham's razor by Darinbob · · Score: 1

      Or they just have smart enough people that can figure out how Windows works without actually having to be an employee. Much simpler too to just have a cheap summer hire save up all the source code on a thumb drive.

    14. Re:Ockham's razor by Anonymous Coward · · Score: 0

      MS has a given a license to MANY people to look at the source code. The US is one of them. This is a non news story...

    15. Re:Ockham's razor by Johann+Lau · · Score: 1

      Bill Gates, the inventor of punk rock, shaking hands with a goon while both smirk in agreement? Not possible.

    16. Re:Ockham's razor by davydagger · · Score: 1
      thats the good thing about free/open source is when you work in the open there is no need for cloak and dagger.

      When everyone can read your source code, there is no need for spies, and no rewards for them either.

      US goverment moles inside microsoft, as if microsoft needed prodding to partner with the US government to do ANYTHING. Is this more FUD to make MS look like they are innocent in all this. Heck they probably got a pretty big pay off.

      If there ARE US government moles in MS, I hope they are FBI, and I hope to one day see a RICO style raid for running a criminal racket, for their subversive activities.

    17. Re:Ockham's razor by davydagger · · Score: 1

      Okay, so first off, Flame is very large and extremely advanced. That implies a country with an advanced cyber-warfare program. That list is fairly short, and the big names on it are the United States, Russia, China, and Israel.

      no it doesn't imply anything. In the world of software there is no correlation between being "advanced" and funding, or size of organization. Anyone with a computer and a compiler can write code, and a bigger organization doesn't always attract better coders.

      GCC, the linux kernel, etc... come to mind as advanced software developed by invidiuals/small foundations that beat anything a large company or nation state could accomplish.

      Also, since "reverse engineering", and "malware writing" has always been on the fringes of socially acceptable, its easier to assume the best writers of malware come from the fringes of society, not working for nation states.

      The idea that flame was written at behest of the Israeli government, or at least in Israeli "intrests" is compelling but not conclusive.

    18. Re:Ockham's razor by Anonymous Coward · · Score: 0

      Here's a simple way to tell whether or not Obama will leak something: Will it hurt the Republicans or help his election? If yes, then it will be leaked, regardless of how many people it puts in danger. If not, then he'll prosecute anyone who even suggests that they may know what a journalist is to the fullest extent of the law, by which I mean the executive orders he writes.

      So, don't worry, we'll never hear anything about this one from Obama's administration. Releasing that information won't help Obama get reelected.

    19. Re:Ockham's razor by Anonymous Coward · · Score: 0

      Or they just wrote a BS news article for the FUD.

    20. Re:Ockham's razor by steelfood · · Score: 2

      Little known secret about Gitmo: Terrorists voluntarily spill the beans after they're forced to analyze the Windows source code for exploits. Everybody's led to believe it's waterboarding, but that's actually the lesser evil. There's a reason they don't send drones out for the engineers-turned-terrorists.

      --
      "If a nation expects to be ignorant and free in a state of civilization, it expects what never was and never will be."
    21. Re:Ockham's razor by Anonymous Coward · · Score: 0

      would fail big, it doesn't have enough attention whores with plastic titties and no brain

      captcha orifices

    22. Re:Ockham's razor by Anonymous Coward · · Score: 0

      Or - far more realistic - Microsoft offered this "services" in exchange for turning a blind eye on anti-competitive practices.

      Oh - and closed software is far more safe than open source software. At least - that was the claim. Guess this claim is under just a little bit of pressure now?

      Bottom line - its smells like rotten fish, but everybody that puts his nose in the right direction could notice this smell already years ago.

    23. Re:Ockham's razor by X0563511 · · Score: 1

      Heck they probably got a pretty big pay off.

      Yep. Because if they didn't share the code, then the software wouldn't have been allowed in. The "big pay off" was being allowed to sell the product to them.

      --
      For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
    24. Re:Ockham's razor by Anonymous Coward · · Score: 0

      Someone with some hefty CPU power broke the MS cert

      MD5 was proven to be weak back in 1996, and further exploited in 2004-2008. MD5 collisions have been done in the past using about 18 hours on 200 PS3s (source). Any moderate size botnet (~20,000 machines) could duplicate that computing effort.

      I would not be surprised if the US Government had moles in MS

      Illegal and explicitly prohibited by numerous. However, they could legally have a working agreement with MS to share and exchange information.

    25. Re:Ockham's razor by svick · · Score: 0

      No, no, you don't understand. See, "open development ideology" means that they use open source software, not that they contribute to it.

    26. Re:Ockham's razor by Anonymous Coward · · Score: 0

      Microsoft actively shares source code with many governments, not just the US. India even has copies. Not to mention nearly every large University has access and most large enterprises. I've directly worked for three separate commercial companies that had Microsoft source (I do driver development). It's not that hard to get, just expensive and a lot of NDAs to sign.

      Microsoft Shared Source

    27. Re:Ockham's razor by dnahelicase · · Score: 4, Insightful

      >

      It would take a good team, and time, but no need to have a mole. I would not be surprised if the US Government had moles in MS, but if they did it would primarily be for reasons other than Stuxnet and Flame, or any other computer espionage program.

      I would be surprised if the US doesn't have "spies" within Microsoft. Microsoft is huge, and hugely important in how the world handles data. I would be shocked if the US, China, India, Russia, and several other countries didn't have "spies" somewhere in Microsoft.

    28. Re:Ockham's razor by dnahelicase · · Score: 2

      I dunno about that.....of late, the Obama administration is been quite 'leaky' when it comes to secret/covert ops.....what we already know about Stuxnet comes to mind.

      I'm not so sure knowing about stuxnet is really a leak. I seem to remember, when Iran started complaining about it, that pretty much everyone thought it was the US/Israel.

      It really didn't appear to be anyone else, and it didn't appear like anyone else would really care - so confirming it was the US/Israel was about as revealing as someone telling me that it's possible the US might have invaded Iraq for oil-related reasons

    29. Re:Ockham's razor by mcgrew · · Score: 1

      Bill Gates, the inventor of punk rock

      HUH????

    30. Re:Ockham's razor by man_of_mr_e · · Score: 1

      Neither GCC or the Linux kernel are products of "individuals/small foundations". Both GCC and the Linux kernel have tons of money behind them, with contributions by paid developers from large corporations like IBM, Oracle, HP, Intel, etc.. Red Hat also employs a number of kernel and GCC developers, and they certainly are not small. In fact, very little in GCC or the kernel is done by any non-paid developers.

      The thing is, the complexity of software like Flame pretty much guarantees someone was paid to write it. First, it was developed in a relatively short amount of time. Second, it's extremely complete in everything it does. Hobbyists working on things tend to only write enough code to get something to work. This is one of the primary problems with Open Source. You need an absolutely huge base of people to make any given software "polished" and complete, because most developers will simply not work unpaid on things they don't find to be very important (like documentation or that last 20% of the work to solve all the edge cases).

    31. Re:Ockham's razor by Bert64 · · Score: 1

      Well, it's also highly likely that there are foreign government moles in MS too, given how widespread their software is foreign governments would be pretty foolish not to try and infiltrate them.

      --
      http://spamdecoy.net - free throwaway anonymous email - avoid spam!
    32. Re:Ockham's razor by mcneely.mike · · Score: 0

      Sorry, he must have meant
      Bill Gates, the inventor of drunk cock (Micro Soft)

      --
      soylentnews.org Go there to enjoy the people!
    33. Re:Ockham's razor by MHolmesIV · · Score: 2

      It certainly would run afoul of our Moonlighting policies.

      On the other hand, my life has just become awesome! The next coworker I talk to could be a spy.

    34. Re:Ockham's razor by Likes+Microsoft · · Score: 2

      Not to belabor the obvious. This is one reason open source, over time, is more secure that closed source. Which would you rather rely on, software that has source code anybody can look at, or software that only the development company and the military of the world's sole superpower can look at?

      Of course, nefarious elements can put subtle security bugs in open source projects, but one hopes over time that the community is able to find and eliminate them.

      --
      -- Who am I? How did I get here? My God, what have I done?!
    35. Re:Ockham's razor by s.petry · · Score: 1

      You agreed with what I said about them possibly having spies, but no other input. Do you really think they would be there to infect the OS and devise espionage schemes? I found that extremely unlikely. More like, they are making sure certain things don't get fixed, and making sure that the good people at Microsoft don't behave in corrupt ways that they are not known to act (Corrupt for the US is good, corrupt for China not so much). Maybe watching to make sure foreign influences don't hack espionage in to the code as well.

      --

      -The wise argue that there are few absolutes, the fool argues that there are no probabilities.

    36. Re:Ockham's razor by Anonymous Coward · · Score: 0

      Why only microsoft ? And, for that matter why would this be limited to US security services ?

      I would assume that US, Chinese and at least a few other security services have moles in every company that has a lot of software on the world's computers, or important software. That list would include the likes of microsoft, google, siemens, redhat, skype, nokia, ... 99% sure have at least one relatively high-placed mole for each of the worlds security services. High profile attacks have been discovered against more than a few telco's, often leading to the conclusion that nobody really knows how long the network was tapped. You may fear a call over AT&T is less than secure against US authorities, but it would amaze me that it'd be secure against Chinese eavesdropping, or even French eavesdropping for that matter.

      And of course, it isn't even a decent challenge to put a "mole" in linux, although arguably they would have to be smarter than they'd have to be inside microsoft. Although there's blatant attempts to do this as well : anyone remember this ?. Now these guys were discovered, of course, but I find it rather hard to believe people wouldn't try harder. And I particularly like the scenario of exploited compilers, where the exploit wouldn't even have to be present in actual source code.

      Not just that, but any company that has more than a specific hiring rate would be easy to infiltrate "on demand", and even more easy now that everybody's clamoring for "equal opportunity" hiring practices, which are laws that have the exact purpose of subverting hiring decisions. Any company with, say, over 2000 employees would be easy to infiltrate these days (not just because those laws mind you, people are easily dumb enough without help from others).

      It is known that chinese authorities somehow got access to more than a few gmail boxes. It is known that the greek telephone system was hacked for at least 8 years, allowing tap on demand, and the reponsible party has never been found. It is known xerox photocopiers were moles for US authorities inside soviet embessies. It is known someone (probably russian) downloaded cisco's entire source code base, although the hackers were russian, there just happens to be a huawei software image that, in a diff, happens to share 2mb of code with a cisco image. Anonymous got into, well, the list is rather large today, isn't it ?

      And given the fact that Obama could get a group of apparently less than 100 hackers operate under the radar of the security community itself for, what, around 3 years ... They easily slipped past people who spend ~40% of their waking lives looking for security exploits, which presumably means they would slipped with equal ease past the kernel "lieutenants".

      Global hacking is not quite the province of nation states anymore. I'm sure that there are multiple companies that do it, given the fact that it requires but a few dozen people.

    37. Re:Ockham's razor by s.petry · · Score: 1

      Thanks for that correction, good gawd everyone knows that Al Gore invented punk rock right before the internet!

      --

      -The wise argue that there are few absolutes, the fool argues that there are no probabilities.

    38. Re:Ockham's razor by AssholeMcGee+ · · Score: 1

      MS is used almost exclusively by several branches of Government. The fact MS got out of a Congress hearing/investigation with no punishment should be a red flag. The Scary part is how they could be involved with Linux? Linux is not a popular OS but they are sought after for various purposes, I am sure they would also deny it up and down if they have any involvement in these same operations.

    39. Re:Ockham's razor by Will.Woodhull · · Score: 2

      That is indeed the obvious advantage.

      Another clear advantage to open source is that it is easy to obtain the source code from multiple different routes and run comparison checks, thus assuring that the source code you have is in fact the code everyone is using. If you are buying copies of closed source code on the black market, you have no assurance that the code is correct in all respects, and no way to assure that the seller is not an agent of the CIA, Mossad, MI5, or the French Foreign Legion.

      Maybe you can get hold of a few different copies of the source code. And maybe some are in agreement with each other, but some are different. You still do not know which one, if any of them, is correct.

      More than likely, Iran has a number of copies of Windows source code and is spending a fair bit of their tech resources on trying to figure out which ones are bogus.

      I am a big fan of FOSS. But I have got to say that this line of reasoning has surprised me with being a valid argument for the continued existence of Windows. It can do great things for western counter intelligence operations that would be impossible in an all FOSS world.

      --
      Will
    40. Re:Ockham's razor by Anonymous Coward · · Score: 0

      If we're all about finding the "logical conclusion" then I think we should at least consider that neither the Flame nor Stuxnet developers would have much use for any Microsoft source code that isn't already widely distributed anyway.
      There is at present no evidence that someone for example checked in backdoors into Microsoft's source control, or set up Microsoft's build servers to insert dubious bits that aren't in the source code, or something like that.

    41. Re:Ockham's razor by Aighearach · · Score: 1

      or software that only the development company and the military of the world's sole superpower can look at?

      It was India's military that was involved in a high-profile leak/theft of MS source code by the Russians. Perhaps that is much worse than if only the US Military had it. The average sysadmin can't get legal access, but the foreign criminals trying to get to customer CC numbers already have been studying it for years.

      Open source at least levels the playing field.

    42. Re:Ockham's razor by Anonymous Coward · · Score: 0

      We can get even simpler and easier, MS already gives the military access to their source code so that it can be reviewed. This is a requirement for all the software used on the most secure systems.

      Citation needed:

      Its gotten to the point where no vendor hip to the NSAs power will even start building products without checking in with Fort Meade first. This includes even that supposed ruler of the software universe, Microsoft Corp. Its inevitable that you design products with specific encryption algorithms and key lengths in mind, said Ira Rubenstein, Microsoft attorney and a top lieutenant to Bill Gates. By his own account, Rubenstein acts as a filter between the NSA and Microsofts design teams in Redmond, Wash. Any time that youre developing a new product, you will be working closely with the NSA, he noted.

      The long, strong arm of the NSA [CNN, 1998]

  2. They don't need them... by Anonymous Coward · · Score: 4, Insightful

    The US Government has licenses for the Windows source code. Nothing we've seen those virii do have required anything more than that.

    1. Re:They don't need them... by Gr33nJ3ll0 · · Score: 5, Insightful

      In this case the article is talking about MS CERTIFICATES, so having access to the source code is irrelevant.

    2. Re:They don't need them... by Anonymous Coward · · Score: 1

      So Microsoft just leaves their private keys in their source code? It's fun to bash Microsoft security policy, but I highly doubt they're that stupid.

    3. Re:They don't need them... by Anonymous Coward · · Score: 0

      I think the idea is that Microsoft wouldn't have had those security holes unless an intelligence agency had planted them there deliberately.

      Which, given Microsoft's security track record, is laughable.

    4. Re:They don't need them... by Anonymous Coward · · Score: 1

      except a signed certificate, but even that was cracked using a new MD5 collision attack. AKA there is no mole in Microsoft, it was just a smart person using a lot of computer resources.

      http://blog.trailofbits.com/2012/06/11/analyzing-the-md5-collision-in-flame/
      https://speakerdeck.com/u/asotirov/p/analyzing-the-md5-collision-in-flame

    5. Re:They don't need them... by NatasRevol · · Score: 1
      --
      There are two types of people in the world: Those who crave closure
    6. Re:They don't need them... by Anonymous Coward · · Score: 0

      Hell Microsoft MVP's do too http://www.microsoft.com/en-us/sharedsource/mvp-source-licensing-program.aspx

      It's not THAT hard to become an MVP even. I know several, two of which are in the source code program.

    7. Re:They don't need them... by Anonymous Coward · · Score: 0

      It didn't really take 'breaking' Microsoft's root cert, it just took looking at the Microsoft source code and noticing that certain services were generating certificates and checking them against the code for the services that accept certificates and noticing that one of them coincidentally accepts a certificate that was generated. Whether this was a bug in the code or a "bug in the code" (added by Microsoft or insider employees), we may never know, but I think its perfectly valid to assume it was just a standard bug. If you think its beyond the realm of possibility that someone can find a single bug in your security when they have your source code you are insane. Especially in the case of 'closed-source' software.

    8. Re:They don't need them... by s.petry · · Score: 1

      Read TFA, it states specifically that the Cert was broken so they could face MS certificates with ease.

      --

      -The wise argue that there are few absolutes, the fool argues that there are no probabilities.

  3. Wouldn't surprise me. by Anonymous Coward · · Score: 5, Insightful

    What would surprise me, is if the US thinks they're the only one.

    1. Re:Wouldn't surprise me. by 0x537461746943 · · Score: 1

      That is the first thing that came to my mind. I would be surprised if other governments didn't have moles in most big software companies. It wouldn't even take that because some of the software is created in other countries like firewall software which has potential access to a lot of networks.

  4. not only operating systems by fluffythedestroyer · · Score: 3, Insightful

    dont forget security companies and firms... and yes it does make lots of sense.

    1. Re:not only operating systems by Anonymous Coward · · Score: 3, Interesting

      Don't forget that the US Department of Homeland Security maintains a giant list of security flaws. It's called the Common Vulnerabilities Enumeration.

      Check the fine print at the bottom of the page: "CVE is co-sponsored by the National Cyber Security Division of the U.S. Department of Homeland Security."

      So that means the government doesn't even need to go looking for holes - security companies send them to the government directly to be listed!

      No mole required, just a "friendly" email informing them that they're going to keep silent for a bit and "forgetting" to post the alert publicly.

    2. Re:not only operating systems by Anonymous Coward · · Score: 2, Informative

      Don't forget that the US Department of Homeland Security maintains a giant list of security flaws. It's called the Common Vulnerabilities Enumeration.

      Check the fine print at the bottom of the page: "CVE is co-sponsored by the National Cyber Security Division of the U.S. Department of Homeland Security."

      So that means the government doesn't even need to go looking for holes - security companies send them to the government directly to be listed!

      No mole required, just a "friendly" email informing them that they're going to keep silent for a bit and "forgetting" to post the alert publicly.

      CVE doesn't work that way. From the FAQ:

      Isn’t CVE just another vulnerability database?

      No. CVE is not a vulnerability database. CVE is designed to allow vulnerability databases and other capabilities to be linked together, and to facilitate the comparison of security tools and services. As such, CVE does not contain information such as risk, impact, fix information, or detailed technical information. CVE only contains the standard identifier number with status indicator, a brief description, and references to related vulnerability reports and advisories.

      The project arose because different vendors were assigning different names and ids to vulnerabilities and generally just confusing the hell out of everyone. CVE just provides a standard id that all of the different security researchers can use to refer to the same issue.

      In practice, researchers typically contact MITRE or other software vendors participating in the program to obtain a CVE ID, possibly before the assessment of the vulnerability is complete. Then they announce it themselves with the CVE ID and send a note to MITRE letting them know that the vulnerability is now public. MITRE then updates the CVE website with information about the vulnerability. If the government did want to restrict information about a security vulnerability they'd need to convince the security researcher not to announce it at all, just omitting it from the database wouldn't be enough.

  5. Why would the US government need moles? by Apharmd · · Score: 4, Insightful

    I doubt Microsoft would balk at any requests at access. These are, after all, matters of national security, and are therefore paramount over all other concerns. No decent American (ahem) company could refuse.

    1. Re:Why would the US government need moles? by fuzzyfuzzyfungus · · Score: 4, Insightful

      As long as it doesn't pertain to any matter regarding the possibility of tax liability, of course.

      There are just some sacrifices that are too great to bear...

    2. Re:Why would the US government need moles? by Anonymous Coward · · Score: 0

      You sound like somebody who actually trusts government.

    3. Re:Why would the US government need moles? by Eponymous+Coward · · Score: 2

      Hmmmm... then even if I use TrueCrypt, there's no way to trust it.

      I'm guessing this is where stories about the Chinese government rolling their own Linux distro come from.

    4. Re:Why would the US government need moles? by Anonymous Coward · · Score: 0

      "I doubt Microsoft would balk at any requests at access."

      Not when they're likely to get a bit of state sponsored corporate espionage thrown in for sweetener. Not like America has a history of that sort of thing ... What's that you say Air Bus?

    5. Re:Why would the US government need moles? by Nutria · · Score: 1

      No decent American (ahem) company could refuse.

      As opposed to Kaspersky? Some Russian spook was in K's offices 10 minutes after the announcement was made that K had discovered Flame.

      And the PRC? They've got patriotic countrymen in every tech firm in the US and Europe.

      --
      "I don't know, therefore Aliens" Wafflebox1
    6. Re:Why would the US government need moles? by Anonymous Coward · · Score: 0

      what tax liability? microsoft funnels a large portion of their sales through OTHER countries (such as luxembourg, ireland, etc..) where corporate tax rates are much, much lower than in the u.s, as well as structuring deals such as the skype acquisition to minimize or eliminate any u.s. taxes owed.

  6. As expected by Anonymous Coward · · Score: 0

    No surprises here.

  7. When did /. become Infowars? by cpu6502 · · Score: 4, Informative

    They THINK there MIGHT be moles inside Microsoft. ("Definitive proof!" says Alex on his radio show.) That's nice. I think their might be moles inside everybody's backyards..... I haven't actually seen any, but let's publish it anyway and scare everyone.

    1. Publish some random guy
    2. Spin it to make it sound factual "evidence"
    3. $profit$

    --
    My AC stalker: " I personally agree with your posts most of the time, but that won't keep me from modding you troll"
    1. Re:When did /. become Infowars? by Anonymous Coward · · Score: 0

      When did /. become Infowars?

      Just remember, it was the numbered visitors to this site that voted this thing into view. We cowards had nothing to do with it.

    2. Re:When did /. become Infowars? by Anonymous Coward · · Score: 0

      t was the numbered visitors to this site that voted this thing into view.

      THIS is what's scaring me...

    3. Re:When did /. become Infowars? by Anonymous Coward · · Score: 0

      Honestly, I'd rather read about exotic physics and alien autopsies if we're going to be reading about unsubstantiated conspiracy theories.

    4. Re:When did /. become Infowars? by Anonymous Coward · · Score: 0

      It's more like this..
      There are rumors that Stuxnet and Conflictor could be a US government covert operation. Let's take that rumor and add another rumor that the US government must have moles inside MS.

    5. Re:When did /. become Infowars? by jellomizer · · Score: 1, Offtopic

      But that is how conspiracies work. The more information you don't have the stronger the evidence that it must be real.
      I mean a while back they took a mixed race baby born in a different country, paid the hospital to lie to publish a new paper reports, and an other insider generated false documents to prove he was born in the United States, Pay for a team of actors to say they knew this child when they were children, all in the offshoot that perhaps this child (where the culture at the time figured had near 0 chance of major success in life) would become president and support the Socialist Cause....

      The facts are... Well some of the people who knew him as a kid called him a more anglo saxon nickname which is very close of his real name.

      --
      If something is so important that you feel the need to post it on the internet... It probably isn't that important.
    6. Re:When did /. become Infowars? by Aighearach · · Score: 1

      Numbered what, like twenty-seven bazillion?

    7. Re:When did /. become Infowars? by Anonymous Coward · · Score: 0

      Mikko Hypponen is an attention whore. He says outrageous things to draw people to F-Secure, who are basically irrelevant.

    8. Re:When did /. become Infowars? by Anonymous Coward · · Score: 0

      No, like 97333

    9. Re:When did /. become Infowars? by Anonymous Coward · · Score: 0

      Oh my god! Are you saying...Bush is Mexican?!

    10. Re:When did /. become Infowars? by Anonymous Coward · · Score: 0

      When it comes to "M$", Slashdot has been pushing conspiracy theories and FUD since the 90s.

      It's one of the reasons why don't bother reading this site to learn actual truthful news. (I read it more for the amusing posts made by pathetic overweight basement dwellers)

    11. Re:When did /. become Infowars? by bobbied · · Score: 1

      But that is how conspiracies work. The more information you don't have the stronger the evidence that it must be real. I mean a while back they took a mixed race baby born in a different country, paid the hospital to lie to publish a new paper reports, and an other insider generated false documents to prove he was born in the United States, Pay for a team of actors to say they knew this child when they were children, all in the offshoot that perhaps this child (where the culture at the time figured had near 0 chance of major success in life) would become president and support the Socialist Cause....

      Yea, and the moon landings where faked too.... Seriously, there are just some things that do not make sense to keep beating and this whole birther thing is a long dead horse, as is the idea that the moon landings were faked or 9/11 was an inside job. Besides, there are more effective arguments you can use to use that don't involve wild conspiracies where you have to suspend all reason.

      It's usually better to not think of things as conspiracies anyway. Folks are usually not that good at cooking up such complicated hoaxes and are even worse at pulling them off. This is especially true of hoaxes that would require the cooperation of large numbers of folks over long periods of time.

      --
      "File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
    12. Re:When did /. become Infowars? by MikeyC01 · · Score: 1

      Makes perfect sense!

      If they deny it, they're lying
      If they admit it, it's because we forced them to admit it "by knowing what they're doing"

      *Cue country music for jeans with kevlar codpieces or freeze dried food or Reynolds Wrap*

    13. Re:When did /. become Infowars? by s.petry · · Score: 1

      Are you sure? Hell if I had a few trillion dollars like some of them guys and no real job, I'd probably sit around scheming all day. I have morals, so doubt my scheming would be in the same lines as theirs, but still..

      --

      -The wise argue that there are few absolutes, the fool argues that there are no probabilities.

    14. Re:When did /. become Infowars? by s.petry · · Score: 1

      And you do realize that many of those theories came out to be correct right? Such is the nature of conspiracies, if theories are correct then they show themselves. Search for TCP ACK, Tread milling applications, and monopoly for a start. Then compare many of those posts to the US vs. MS, Iowa vs. MS, Novel vs. MS, etc.. etc...

      Of course there is always some chatting and opinion tossing in threads as well, but that is the nature of any forum. It's very odd that a company that people talking about a company that has been found guilty of illegal monopolistic practices is considered FUD by you. Do you have any idea how many times they have been found guilty?

      Sure, peoples opinions of MS can be harsh. Most people knowing their practices and damage to the environment (computing, not Green space) think it's deserving.

      --

      -The wise argue that there are few absolutes, the fool argues that there are no probabilities.

    15. Re:When did /. become Infowars? by s.petry · · Score: 1

      Wow, must be way passed my bed time. '''It's very odd that a company that people talking about a company that has been found guilty of illegal monopolistic practices is considered FUD by you. Do you have any idea how many times they have been found guilty? ''' haha, sorry. Let me try that again with English

      It's very odd that you believe it's FUD when people talk poorly of MS. They have been found guilty of abusing their monopoly power many many times. Any guess at how many times? It is a large number, look it up.

      --

      -The wise argue that there are few absolutes, the fool argues that there are no probabilities.

  8. They may just ask by EvilBudMan · · Score: 1

    Seriously, they might be undercover from some but not the ones that do the hiring. That way they could get in just the right posisition to be in.

  9. You might as well title this differently by Anonymous Coward · · Score: 3, Insightful

    "Foreign government officials could be working under cover at Microsoft".

    Since many/much of the actual development is overseas anyway.

  10. Doesn't really make sense to me by danparker276 · · Score: 0, Flamebait

    I don't see how working at microsoft would give you any advantage at making Stuxnet or Flame. It's not like Microsoft put secret holes in their OS so people in MS can access everyone's computer. Probably my mom wrote that article.

    1. Re:Doesn't really make sense to me by SuricouRaven · · Score: 1

      Having access to Microsoft's signing certs for updates and drivers would be a huge help. I imagine the US government has some involvement - even if they don't want the certs themselves, they also don't want an employee with access forced to leak them after agents for China/Iran/Other kidnap and threaten to murder his daughter. So it's in the best interests of the US to at the very least ensure Microsoft's internal security team is doing their job.

    2. Re:Doesn't really make sense to me by Aighearach · · Score: 1

      I don't see how working at microsoft would give you any advantage at making Stuxnet or Flame. It's not like Microsoft put secret holes in their OS so people in MS can access everyone's computer. Probably my mom wrote that article.

      Indeed, it was inside information from Siemens that was used in Stuxnet, and Siemens cooperated fully and completely.

    3. Re:Doesn't really make sense to me by quarkscat · · Score: 3, Interesting

      Imagine a government with access to a complex OS source code. Then imagine that they get data on all manner of security holes as they are discovered. Imagine also that this government has access to OS security update certifications. Finally, imagine that this same government has the ability to hack into server DNS tables to route targeted users to their alternative 'security updates'.

      The penetration of any software company by undercover government operatives would hardly be surprising, but entirely unnecessary. Microsoft would hardly be alone as a target of such espionage -- every software company would be vulnerable, including OSS. There is also the issue with 'backdoors' hard-wired into computer hardware, including especially telecom systems. IIRC, this became an issue recently with news of backdoors alleged to exist in VLSI circuits manufactured in China. Older news alleged that Israel also puts backdoors into the telecom hardware they sell & ship, including to the USA government.

      If virtually every government does such spying, including upon their own citizens, and any number of software & hardware companies do the same with their customers, any cautious user of such technology should be aware of the potential security breaches they expose themselves to every time they connect to the internet, or open their front door for that matter. Redundancy & breadth of security beats security through obscurity any day.

      The phrases of the day are, "Trust no one", "Security in depth", and "If it can't be accessed remotely, it's more secure & less vulnerable". At that point, physical security & Tempest-hardening secure your valuable data. The rhetorical question is, "How valuable is your data if you cannot readily access it?" I found it humorous that the USA government recently wanted reporters to write their news stories on government-supplied computers, if only to avoid unwanted data leaks & stop potential whistleblowers in their tracks.

      Trust the USA government, or any government, or any corporation with an agenda? Why take that risk unmitigated? And who in Hades would put vulnerable sensitive SCADA systems in close proximity to the Internet except an idiot?

    4. Re:Doesn't really make sense to me by bobbied · · Score: 1

      Imagine a government with access to a complex OS source code.

      Hmmmm.... I close my eyes and imagine that.... Um.. Not much help to me without the necessary tools to build said source into something and perhaps some documentation that explains how stuff is supposed to work... Oh, Well I suppose you could eventually figure out what tools you needed though trial and error, then developed your own documentation on the internal workings of Microsoft's code.. But make no mistake, it's NOT going to be an easy task to work through enough of this to even attempt to use the knowledge for anything useful.

      Besides, it would be MUCH easier and cheaper to co-opt some hardware vendor's driver set and slip your stuff into that than risk doing the same at Microsoft.. Not that I'm saying it didn't happen, only that it seems easier other ways.....

      --
      "File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
    5. Re:Doesn't really make sense to me by danparker276 · · Score: 1

      I'm sure China would have more spies working inside MS than the US. Well MS is an international company with offices all over the world.

    6. Re:Doesn't really make sense to me by quarkscat · · Score: 1

      Besides, it would be MUCH easier and cheaper to co-opt some hardware vendor's driver set and slip your stuff into that than risk doing the same at Microsoft.. Not that I'm saying it didn't happen, only that it seems easier other ways.....

      I agree. And there have been documented cases of this being done. One of the most famous was the worm installed in firmware of a printer shipped to Iraq that incapacitated big chunks of Saddam's air defense system, courtesy of the NSA.
      And again regarding hardware: I wonder how many add-in PC cards like video or network that have back-doors built-in, or even hidden 'features' built into the firmware. I just threw out a serial/parallel ISA board so old that it was all TTL logic, no VLSI, no firmware.

      Some wise-guy is going to install malware in a video card that 'steals' a miniscule number of clock cycles & memory that can compromise the entire contents of your fire-walled network. Almost anything that can be done with software can be done with 'solder', and a lot more difficult to deal with.

    7. Re:Doesn't really make sense to me by s.petry · · Score: 1

      You are making it way way way to complex!

      1. Develop virus

      2. Break MS MD5 certs (NSA has enough compute power to have done this, but many others as well).

      3. Set up server running web services mimicking MS Update. Really not that difficult with ASP pages.

      4. Intercept clients DNS request for MS update, send IP of your fake server.

      5. Send "Update" which contains Virus

      The virus in this case was extremely complex, but the rest is really script kiddie territory.

      --

      -The wise argue that there are few absolutes, the fool argues that there are no probabilities.

    8. Re:Doesn't really make sense to me by SuricouRaven · · Score: 1

      Intercepting DNS would risk easy detection. Better to just intercept the TCP connection by IP address - trivial to do, anyone who has ever set up a transparent proxy knows how - and use that. You need to be upstream of your target, but plenty of easy uses for that. For example, the government of China is well-known to use industrial espionage on behalf of Chinese companies - how about putting the update-hacker in hotels, to snare the laptops of business travelers? All the trojan need do is transmit the documents folder back to the attacker's server and then destroy all evidence of it's own existence. Grab the contents of enough laptops, and you're sure to get something juicy. And it shouldn't need saying that this would be an excellent way for government forces to get a spy trojan into citizen's laptops, whether that be a police force gathering evidence against a drug dealer network or an oppressive state spying on dissidents for anything that can publicly justify some jail time or reveal their contacts.

    9. Re:Doesn't really make sense to me by s.petry · · Score: 1

      I'm sure that this happens very often. Hotels are notorious for espionage, hence most companies require VPN and recommend you don't use a Hotel's service. When I worked at the DOD we had to use encrypted satellite cards on travel, using any public internet was strictly not allowed.

      Outside of the DOD, cheap is the name of the game. Cheap is always far from secure.

      --

      -The wise argue that there are few absolutes, the fool argues that there are no probabilities.

  11. Moles? What the fuck. by girlintraining · · Score: 1

    Government: "Hello there, Microsoft. This here is a really big gun. We want your source code."
    Microsoft: "Ummm, okay."

    The End

    What's this crap about a mole again? Moles are for when you can't just walk in the front door and take whatever you want.

    --
    #fuckbeta #iamslashdot #dicemustdie
    1. Re:Moles? What the fuck. by Anonymous Coward · · Score: 0

      Agreed, the premise is just absurd. Somebody noob is trying to practice disinformation.
      -whipcrack- Back to your cubicle!

    2. Re:Moles? What the fuck. by Anonymous Coward · · Score: 0

      What's this crap about a mole again? Moles are for when you can't just walk in the front door and take whatever you want.

      ...and a few month later, you walk in the front door and put the modified source into the microvault, with a big red sticker, "don't look at this, dont remove it, but maintain it's presence 'til 2097 in all new windows-versions...?

    3. Re:Moles? What the fuck. by Artifakt · · Score: 1

      Make an obvious show of force, and fifty people know about it. When one of them talks, you have no idea who spilled the beans, and in fact, you really can't tell if anyone did or if it's an outsider just speculating that you leaned on Microsoft. The quietest way is to plan in advance. Find a young guy in your agency who has what it takes to become just the right employee in the right position a few years down the road, and pay him* to get really good at what you think Microsoft will want by then. The second best approach is to let just one or two people on the inside at Microsoft know why you want somebody hired there. Combine this with the carrot and stick doctrine - offer the one or two persons at MS a nice treat, and quitely research their pasts in case you need to whip out a stick later. If you can't find any negatives on one of these guys, and he seems like a real pro-government boy scout, maybe you can just ask him to become your mole so you don't have to plant one.

      *him could, of course, be her, or with MS, maybe it.

      --
      Who is John Cabal?
    4. Re:Moles? What the fuck. by Aighearach · · Score: 1

      I know you're new around here, but please, everybody else has known for years and years that the US Government already has a license to MS source code. Even countries like India have that license. What is in the source isn't secret, and the files have even been broadly published for example on torrent networks. It is highly restricted, but not unknown or unknownable.

      And in the general case, any company that is providing software for use in the most secure military installations gave access to their code years before their software was running in those installations. So just knowing that the Navy runs ships off of windoze should be enough to (in addition to be frightened) know that their source code is available to anybody with the right security clearance.

    5. Re:Moles? What the fuck. by couchslug · · Score: 2

      "Government: "Hello there, Microsoft. This here is a really big gun. We want your source code."
      Microsoft: "Ummm, okay." "

      That's a terrifying abuse of government power! I hope they don't extort source from the Linux community.

      --
      "This post is an artistic work of fiction and falsehood. Only a fool would take anything posted here as fact."
    6. Re:Moles? What the fuck. by drinkypoo · · Score: 1

      Government: "Hello there, Microsoft. This here is a really big gun. We want your source code."
      Microsoft: "Ummm, okay."

      How about "Hello there, Bill Gates. We've noticed that you've been abusing your monopoly position. You're going to do what we say now or we will take away all your money. If you play ball, Ashcroft will declare that no action needs to be taken against you or Microsoft.

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
  12. The article asks a question? by noahgolm · · Score: 2

    Then obviously they don't really know for sure (so says Betteridge's Law of Headlines).

  13. Moles whitin F-Secure by Anonymous Coward · · Score: 1

    Stuxnet, duqu, flame all these malware is found by russian security companies.

    My guess is that all western security companies are infiltrated by spooks

  14. Wouldn't it be Siemens? by Anonymous Coward · · Score: 0

    Why Microsoft? Wouldn't it be Siemens or other industrial equipment/control manufactures that are involved with *industrial equipment*?

    1. Re:Wouldn't it be Siemens? by Sir_Sri · · Score: 1

      The security vulnerabilities used to get stuff on the network and computers themselves would be a microsoft issue. Most of the industrial control equipment software wouldn't even try and be secure.

  15. Glenn Beck reporting style. by Joe+U · · Score: 2

    Now I'm not saying there are moles at Microsoft and Apple, but neither of them have reported back to me either way.

    So, what are they hiding?

    1. Re:Glenn Beck reporting style. by cpu6502 · · Score: 1

      And Rachel Maddow. And Ed Schultz. And .....

      But Beck usually backs-up his stuff with documents. Quoting Bill Ayers or Cloward-Piven from the 70s saying, "We will blow-up government buildings and take over through force," is pretty damning. Quoting the FBI Agent who infiltrated the organization and confirms they were prepared to kill to achieve their ends is also pretty damning.

      --
      My AC stalker: " I personally agree with your posts most of the time, but that won't keep me from modding you troll"
    2. Re:Glenn Beck reporting style. by Joe+U · · Score: 1

      You forgot Rush and O'Reilly.

      Beck is a hack. Actually, all of them are, Maddow, Limbaugh, etc...

      The "news" attack style he and his counterparts use are so filled with holes and fallacies you could drive an entire interstate highway worth of trucks through them.

  16. I believe by thestudio_bob · · Score: 0

    I totally believe it. Apple had a mole in the board room. He allegedly stole plans for the iPhone and took them to Google.

    --
    The real Sig captains the Northwestern. This one captains /.
  17. NO by Anonymous Coward · · Score: 0

    They pay MS like every other super-power. They also pay colleges and other vendors to discover exploits that aren't made public. Even if they had moles, it wouldn't be USSS agents.

  18. Re:Of-course by CraftyJack · · Score: 1

    moderation undone.

  19. No need for the gun by Mr+44 · · Score: 1

    Every major government around the world ALREADY has access to Windows source code. Starting in 2001, when Microsoft's security started being a major focus, they began a program to grant access to the code to interested parties.

    http://www.microsoft.com/en-us/sharedsource/government-security-program.aspx

    http://www.microsoft.com/en-us/sharedsource/

    1. Re:No need for the gun by Anonymous Coward · · Score: 0

      Yeah, but who gets access to the *real* source code?

  20. Go full Tin-foil Hat! by treerex · · Score: 3, Funny

    Let's not beat around the bush! I say Microsoft has known USG agents working on the systems intentionally putting holes in the OS that can then be leveraged for zero-day attacks against other governments. Balmer is in cahoots I say! CAHOOTS!

    1. Re:Go full Tin-foil Hat! by Anonymous Coward · · Score: 0

      You're probably not far too off from the truth

  21. the plutal of virus is viruses... by Anonymous Coward · · Score: 0

    just a heads up so you don't look like such a clown in the future.

    1. Re:the plutal of virus is viruses... by akeeneye · · Score: 2

      It's "plural", not "plutal". Pedantry Fail. Just a heads up so you don't look like such a clown in the future.

      --
      The man who dies rich dies disgraced. -- Andrew Carnegie
    2. Re:the plutal of virus is viruses... by TheRealGrogan · · Score: 0

      We already know you're a clown, but just so you don't look like a retard, the correct word for the language construct that denotes more than one instance of an object is "plural"

      You assfucks who make typographical and/or spelling errors while correcting someone else's posts are funny. It's also quite likely that the person already knows that "virii" isn't correct and is just using it stylishly. Just like the penii that you enjoy sucking the chocolate from.

    3. Re:the plutal of virus is viruses... by NatasRevol · · Score: 1

      I thought it was peni?

      --
      There are two types of people in the world: Those who crave closure
    4. Re:the plutal of virus is viruses... by Anonymous Coward · · Score: 0

      I've never understood why people get so mad at grammar national socialists. English isn't my first language, and I find the corrections useful.

    5. Re:the plutal of virus is viruses... by spire3661 · · Score: 1

      Because in a casual conversation like a forum post, grammar Nazis add nothing to the actual conversation. It is usually a small mind that cant find anything else to say, so they hunt for grammar errors.

      --
      Good-bye
    6. Re:the plutal of virus is viruses... by mcgrew · · Score: 1

      For fuck's sake, Sheldon, the T and F are right next to each other. He's probably at work and forced to use IE 6 or 7, which don't have spell checkers.

      Frag somebody for spelling "lose" with two "O"s, changing the meaning of the sentence, and you have a point. Otherwise the only point is on your head.

    7. Re:the plutal of virus is viruses... by Anonymous Coward · · Score: 0

      Penii for your thoughts on the subject.

    8. Re:the plutal of virus is viruses... by Anonymous Coward · · Score: 0

      I wish this was reddit. Then the dicks that are posting are entertaining.

    9. Re:the plutal of virus is viruses... by s.petry · · Score: 1

      For fuck's sake, Sheldon, the T and R are right next to each other. He's probably at work and forced to use IE 6 or 7, which don't have spell checkers.

      Since we're making corrections.. FTFY

      --

      -The wise argue that there are few absolutes, the fool argues that there are no probabilities.

    10. Re:the plutal of virus is viruses... by s.petry · · Score: 1

      Why do coward tell lies? Virii

      You can find the same definition in numerous sources. It may not be in Websters or Oxford but it has been acceptable for nearly 2 decades as slang for the plural of virus.

      --

      -The wise argue that there are few absolutes, the fool argues that there are no probabilities.

    11. Re:the plutal of virus is viruses... by mcgrew · · Score: 1

      woosh...

    12. Re:the plutal of virus is viruses... by Anonymous Coward · · Score: 0

      An excellent troll on an excellent pedantry thread. Hats off to everyone.

    13. Re:the plutal of virus is viruses... by hoboroadie · · Score: 1

      I am extremely pedantic by nature, (my nickname IRL is "CorrectnessMan) so I fight the impulse constantly, on and off-line. Some times, in certain contexts, it may be helpful to point out an error. I like to think that I can tell the difference. I've certainly learned that it annoys people any time.

      --
      They feared that it could be used to suppress protest or support unpopular rule.
    14. Re:the plutal of virus is viruses... by hoboroadie · · Score: 1

      The plural of medical viruses is viruses, so I would interpret the OP's use of the term on a biological noun (government personnel) as being incorrect. YMMV.

      --
      They feared that it could be used to suppress protest or support unpopular rule.
  22. Sigh. by Sycraft-fu · · Score: 4, Informative

    You don't need a big gun to get the MS source code. It isn't some big fucking secret like all the ./ers seem to think. It isn't GPL, but plenty of institutions have copies. Basically any government that uses Windows does, huge surprise there. Also a lot of research universities. One such university I know that has it is ASU. Then there are copies in the hands of partners for better debugging/integration of their products.

    Just because the source isn't on Sourceforge, doesn't mean it is some massive secret. A bit of Google would get you http://www.microsoft.com/en-us/sharedsource/default.aspx which is MS's page on their source sharing.

    1. Re:Sigh. by ipduh · · Score: 1

      what about planting code to products destined for certain customers ( goverments , countries , etc )?

  23. Skin Cancer by Matt.Battey · · Score: 2

    The question should be, whether these moles will lead to skin cancer, and if Microsoft should limit's exposure to the sun to counter balance them.

    1. Re:Skin Cancer by ColdWetDog · · Score: 1

      The question should be, whether these moles will lead to skin cancer, and if Microsoft should limit's exposure to the sun to counter balance them.

      Why do you think Microsoft is headquartered in the Seattle area?

      Coincidence? I should think not.

      --
      Faster! Faster! Faster would be better!
  24. More baseless nonsense please by WaffleMonster · · Score: 2, Interesting

    Author of TFA dreams up some impossible to falsify idea - offers no supporting evidence of any kind except to say it is plausable.

    I love myself a good MS conspiracy and I'm sure there are plenty which actually do exist but lets not reward intellectual laziness.

    Just two questions:

    1. What do editors of PC Pro get paid to do?
    2. What is it doing on slashdot?

    Now if you'll excuse me my magic unicorn 'Flame' is hungry and wants a bowl of lucky charms before flying back to the land of lua to meet the angry birds.

  25. Why not... by cis4 · · Score: 2

    ...put a worm in apple?

    1. Re:Why not... by Anonymous Coward · · Score: 0

      ...put a worm in apple?

      Because hipsters need watched? Oh nevermind, they were being spied on before it was cool to be spied on.

  26. Re:The Great Deciever! by s.petry · · Score: 0

    They (MSM) pretty much fixed that by stopping the reporting on how much time is taken away and how much it costs now. Unless some whistle blower publishes shit like the GSA Vegas party, you won't see it on MSM.

    Fox, NBC and ABC even justified the GSA party claiming that "Private business do this sort of thing all the time.". It's a very obvious game of "don't look at this thing, go look at that shiny thing!". Unfortunately people happily frolic to the distraction, so your facts do no good. People don't want facts, they want shiny things to look at.

    --

    -The wise argue that there are few absolutes, the fool argues that there are no probabilities.

  27. Could US cyberspies have moles inside Microsoft? by cpu6502 · · Score: 1

    The answer to headlines that end with a question mark:
    No.

    --
    My AC stalker: " I personally agree with your posts most of the time, but that won't keep me from modding you troll"
  28. but it would be common sense by AdrianKemp · · Score: 1

    1) The fact that it's common sense does not mean the government is doing it

    2) If it's common sense, why is it worthy of news?

  29. OSS too! by Anonymous Coward · · Score: 0

    And these same "agents" could easily become FOSS developers too. I see no reason why a few whorey geeks, bottles of M-Dew and some pizzas couldn't be stuffed into some cozy realm of the Pentagon. Ubuntu, for example, has how many millions of lines of code? Can it all be reviewed adequately? Since the first time I saw the bleedin thing, I always did suspect Unity was designed by some classified DARPA psyops division, perhaps with intent to induce mass suicides amongst the last front of technological freedom fighters.

  30. Hashtag by ThatsNotPudding · · Score: 1

    #Duh

  31. Didn't the NSA offer to help 'secure' Linux? by Anonymous Coward · · Score: 0

    "Didn't the NSA offer to help 'secure' windows 7 (http://www.computerworld.com/s/article/9141105/NSA_helped_with_Windows_7_development)" - by Sir_Sri (199544) on Friday June 15, @12:54PM (#40336511)

    SeLinux bearing distros, specifically? See here -> http://www.nsa.gov/research/selinux/

    They didn't just "offer" to help, they did... only question is, per what YOU ARE ALLUDING TO/IMPLYING? How much so and for WHAT reasons??

    (Absolutely - so, that "all said & aside", mainly from you regarding the NSA & Windows: CAN YOU TRUST Linux TOO?)

    APK

    P.S.=> Your 'argument' is like a razor that CUTS BOTH WAYS... & we'll tolerate NO 'FUD' here today!

    ... apk

    1. Re:Didn't the NSA offer to help 'secure' Linux? by Bert64 · · Score: 3, Insightful

      If you are sufficiently concerned about it, then you can inspect the sourcecode of linux and/or remove the parts you don't want...
      You can't do that with windows.

      If you're a national government, then you certainly have the resources to inspect linux, and you'd be foolish not to inspect the software you use for critical infrastructure.

      Even if you can't or won't inspect the linux source, you at least gain some assurance from the fact that many independent people with differing goals are able to see the source. Again, this is something windows simply doesn't provide.

      --
      http://spamdecoy.net - free throwaway anonymous email - avoid spam!
  32. Countdown Clock by ThatsNotPudding · · Score: 1

    I think it is a matter of time before US media is banned from reporting on the findings by computer security experts - especially the uncontrollable ones in Russia and Finland - under the guise that it aides and abets terrerists.

  33. Not just US by fa2k · · Score: 1

    If it's truly beneficial to have moles in software companies, you can expect that China and maybe Russia also have them too.. The only benefit seems to be the certificates and access the update servers.

    1. Re:Not just US by DaveV1.0 · · Score: 1

      ^This^. In fact, no one should be surprised to find that many companies, from Facebook to Oracle to VMWare, have moles from various governments around the world. And, it wouldn't be limited to IT companies, either. Ford, GM, Toyota, Caterpillar, Boeing, and any large and/or innovative organization that uses foreign and/or contract workers would be prime target for industrial espionage. And, not just from enemies, but from nominal friends as well.

      --
      There is no "-1 offended" or "-1 you don't agree with me" mod options for a reason.
  34. YES by Anonymous Coward · · Score: 0

    I feel that there is no doubt that Microsoft products have been altered to please the government one way or another. I am also suspicious of encryption programs as they are exactly the kind of spot an intelligence agency would target for control.
                      It is the very nature of governments that free and open communications between people will never exist. In order to perpetuate a government's existence there will always be a great deal of covert activity directed at the population.

  35. No. by Anonymous Coward · · Score: 3, Informative

    Read more about what actually happened. Microsoft was using some keys with md5 hashing that weren't properly set to prohibit their use for code signing and those keys were signed by the Microsoft root. Using a collision attack they created a copy of a signed key and used that to sign their code.

    Brief Explanation:
    http://blogs.technet.com/b/srd/archive/2012/06/03/microsoft-certification-authority-signing-certificates-added-to-the-untrusted-certificate-store.aspx

    Detailed Explanation:
    http://blogs.technet.com/b/srd/archive/2012/06/06/more-information-about-the-digital-certificates-used-to-sign-the-flame-malware.aspx

    Hotfix MS just published to speed up the revocation process:
    http://blogs.technet.com/b/pki/archive/2012/06/12/announcing-the-automated-updater-of-untrustworthy-certificates-and-keys.aspx

    http://support.microsoft.com/kb/2677070

  36. in other news by Anonymous Coward · · Score: 0

    there are microsoft moles masking as linux developers,
    the real gremlins that keep linux off the desktop.

    1. Re:in other news by quarkscat · · Score: 1

      Please, don't be shy Anonymous Coward. I believe that you are onto something there.

      When conspiracy theories ultimately are discovered to be conspiracy fact, the mainstream media will dismiss it as 'common sense everyone knew', 'nothing to see here', and then put the sheeple back to sleep. Causality doesn't equate to coincidence. Anyway, I don't believe that any chain of statistically improbable events conflates to mere coincidence. Mere coincidence is highly over-rated. It is stated, with some degree of proof, that only six degrees of separation exist between any two otherwise seemingly unrelated events. Accidents do happen, but not usually by pure accident.

      And it is no accident that linux has been effectively kept off the desktop. You could blame that on Microsoft moles, or you could blame it on linux developers, or you could blame it on Microsoft moles posing as linux developers. The actual cause might even lay elsewhere, but you have presented one theory. Who the fuck are you, AC, that I might properly honor your brilliance?

      If I had mod points, I would definitely mod your post up a few notches ...

  37. Why bother? by Mike+Buddha · · Score: 2

    Why would hte government bother with moles when it can just read the Microsoft engineers minds from it's spy satellites. It's common sense that they'd be doing this.

    --
    by Mike Buddha -- Someday the mountain might get him, but the law never will.
  38. Problems with Open Source? by Anonymous Coward · · Score: 0

    Is the bigger question not "How many NSA agnets code holes into Linux/BSD". Also, with those companies that sell exploits (with government customers), how many for-profit without-morals hackers are coding holes in these projects and selling exploits on?

  39. Re:The Great Deciever! by Anonymous Coward · · Score: 0

    "pictures of him cleaning brush out?"

    And you present this as proof no state work was done. Provide evidence, which of course you cannot, or admit you have no point.

    And you are right these were not vacations.

    http://www.washingtonpost.com/opinions/president-obama-campaigner-in-chief/2012/04/30/gIQATAfbsT_story.html

    "Obama has managed to take things to a whole new level. According to statistics compiled for a book to be published this summer, the president has already set a record for total first-term fundraisers — 191 — and that’s only through March 6. Measured in terms of events that benefit his reelection bid, Obama’s total (inflated in part by relaxed fundraising rules) exceeds the combined total of George W. Bush, Bill Clinton, George H.W. Bush, Ronald Reagan and Jimmy Carter."

    Campaigner in chief.

    Keep trying drone, but you are going to have to work a *lot* harder to keep covering for the statist.

  40. Alcoa or Reynolds? by Anonymous Coward · · Score: 0

    One of these days I've GOT to buy some stock in companies making aluminum......

    There's lots of good money to be made in hats.

    1. Re:Alcoa or Reynolds? by quarkscat · · Score: 1

      And here I thought that tin foil hats, or tin foil hats with a lead liner were the proper head-gear for conspiracy theorists.

      Either I missed the memo, or that memo was nefariously diverted. I'm betting on the latter in this case.

    2. Re:Alcoa or Reynolds? by Roachie · · Score: 1

      The Russians, as well as the US, experimented with microwave technology that could beam sounds and presumably, voices into your head.

      A plausible defense against such an attack? Metal headgear- a Faraday cage, as it were. If one found oneself short of a machine shop and metal working gear one may resort to using tin foil.

      I wonder how effective foil would be at stopping tasers and/or microwave pain weapons? I christen the next generation: tinfoil torsos.

      Life sure is funny.

      --
      This sig is not paradoxical or ironic.
  41. The obvious solution - by choke · · Score: 1

    is for the security and safety of other national interests to avoid using MS Windows at all, since it is most obviously being seeded with vulnerabilities.

    --
    "No good deed goes unpunished"
  42. Pfft, just American spies by Anonymous Coward · · Score: 1

    There are probably spies from every country on earth working inside M$. You'd be crazy not to try and get on the inside.

  43. Probably both moles and covert agreements by gestalt_n_pepper · · Score: 1

    They're not exclusive and the government doesn't trust Microsoft either. Sure, pretend to partner with Microsoft and put in some explicit backdoors. Just make sure that there are a few Microsoft doesn't know about too.

    --
    Please do not read this sig. Thank you.
  44. "could", "may" by Anonymous Coward · · Score: 0

    US security forces may have agents anywhere. They could be living in my desk as I type this...

  45. Meaningless. by Caerdwyn · · Score: 1

    1. DUH
    2. "May have". Yeah, that's news. Meaningless. They "may not have" too. Is there something specific somebody has to say, with something to back it up other than a closed circle of "may have"?
    3. Speculation is fact on Slashdot. This warrants an article, why? Is there NEWS here, or are we going to see "space aliens MAY HAVE dressed up like call-boys and 'anally probed' the editorial staff"?

    Wankers.

    --
    Everybody gets what the majority deserves.
    1. Re:Meaningless. by s.petry · · Score: 1

      3. Speculation is fact on Slashdot. This warrants an article, why? Is there NEWS here, or are we going to see "space aliens MAY HAVE dressed up like call-boys and 'anally probed' the editorial staff"?

      -1. You do realize that Slashdot does not write the articles right? Discussion is Slashdot members, and your number 1 and number 2 have been stated a few dozen times.

      Odd that you seemingly fail to grasp the basic concept of -1 and call others wankers.

      --

      -The wise argue that there are few absolutes, the fool argues that there are no probabilities.

  46. DENY the White BEAST! (non-human) by Anonymous Coward · · Score: 0

    "An intelligence service is the ideal vehicle for a conspiracy." - Allen Dulles

    "The CIA have never been an intelligence organisation. The CIA's motto is to protect American business interests. The CIA cherry picks its intelligence to suit its business goals." Hitler was a British Agent by Greg Hallett

    "We'll know our disinformation program is complete when everything the American public believes is false." -- William Casey, CIA Director (from first staff meeting in 1981)

    "The Central Intelligence Agency owns everyone of any significance in the major media." --William Colby

  47. MS is sneaky by Anonymous Coward · · Score: 0

    A few years back, I had opportunity to interview at Microsoft for an engineering position.
    During one of the interviews, they wanted me to high-level design a system that could determine which versions of libraries exist on a remote machine *without* accessing the file-system directly.

    This is the kind of thinking that inspires Microsoft and inspired me to leave.

  48. Molee molee molee by Impy+the+Impiuos+Imp · · Score: 1

    "Moles" assumes they don't have permission. Years ago I hypothesized one of the reasons the government backed off anti-competitive lawsuits was MS agreed to aid the government in spying through OS backdoors.

    Of course, starting to "donate" to politicians (the real reason behind the laws in the first place, regulators and attorneys general being classical "useful idiots") also helped too.

    --
    (-1: Post disagrees with my already-settled worldview) is not a valid mod option.
  49. hot air? by Anonymous Coward · · Score: 0

    'It's not certain, but it would be common sense to expect they would do that.'"

    Translation: "I pulled this out of my ass... but it has so much truthiness!"

  50. I miss the old days... by Jawnn · · Score: 1

    You know, when the discovery of an driving game in Excel 2000 was the earth-shattering revelation of the year. The current crop of hidden "features" kind a gives new meaning to the term "Easter egg", no?
    Oh, and get off my lawn...

  51. Look at Laser Printers by Anonymous Coward · · Score: 0

    The federal government alreadys gets tracking codes inserted on laser printer output:
    http://en.wikipedia.org/wiki/Printer_steganography

    I'm not sure why they'd work under cover when they're getting what they want without being secreative in the printer sector.

  52. Make No Mistake. by Johann+Lau · · Score: 1

    Bush went to his Ranch to work.

    http://www.youtube.com/watch?v=EkqrI3IibYI

  53. Re:Could US cyberspies have moles inside Microsoft by Anonymous Coward · · Score: 0

    "Are taxes too low?"

    No.

    "Are taxes too high?"

    No.

    "Are taxes just right?"

    No.

    Wait, what? It's gotta be one of those three. You're hypothesis that the answer to a headline that is a question is always "no" is false.

  54. This plus UEFI... by Anonymous Coward · · Score: 0

    ...is total surveillance bliss, ain't it?

  55. Re:The Great Deciever! by Anonymous Coward · · Score: 0

    All you have done is post what vacations Obama has taken without listing Bushies vacations.

    You are convincing nobody but yourself.

  56. Only Microsoft, not Linux. by Anonymous Coward · · Score: 0

    It's a good thing no US government employees have ever contributed to Linux or GNU. We'd all be screwed then.
    No, wait..

    1. Re:Only Microsoft, not Linux. by Bert64 · · Score: 1

      What matters, is that you can see and inspect their contributions, or even remove them if you want.

      Sure, you may not have the skills, resources or desire to inspect the code, but governments certainly do, and certainly should for anything remotely important. Plus for an organisation the size of a national government, inspecting sourcecode once and then using it widely isn't even all that much of an overhead.

      --
      http://spamdecoy.net - free throwaway anonymous email - avoid spam!
  57. "virii" is not a word. by Anonymous Coward · · Score: 0

    "virii" is not a word.

  58. Actually it would be irresponsible if they didn't by Celarent+Darii · · Score: 1

    Considering that probably 90% of the world's information is gathered, produced, or stored by Microsoft software, and that the US Security services are above all an information retrieval service, they would be completely incompetent if they did not have some sort of special 'relationship' with Microsoft.

    Even with official channels, it is always better to have someone on the inside who can verify or enhance the publicly available information.

    I would say that if they don't have moles in Microsoft, they aren't doing their jobs correctly.

  59. Illegal, and unlikely! by kestryn · · Score: 1

    This would amount to surveillance of a US person (U.S.-owned corporation in this case), and would be quite illegal. Believe it or not, that does actually make it unlikely. There is a good deal of mindfulness of law within these agencies - it's usually the outsider appointees/elected officials that don't have the same respect for u.s. citizens/law.

    In any event, 'moles' seem very unlikely, as Microsoft has a great relationship with U.S. intelligence agencies. There are patriots at MS who would likely be lining up to support the country's efforts.

  60. Re:The Great Deciever! by Anonymous Coward · · Score: 0

    Uh, you're the one claiming that Bush worked harder than Obama on vacation.

    Pretty sure the onus is on you to provide proof.

  61. Why any Country or Corporation.. by Anonymous Coward · · Score: 0

    would risk running MS Windows spyware is beyond me. For that matter, why do U.S. corporations and governments risk running hardware produced in Asia?

  62. That was the first backdoor by Anonymous Coward · · Score: 0

    Microsoft welcomed them through many years ago.

    M00V^g 0N

  63. Foolish countries... by Bert64 · · Score: 1

    Why would the government of countries such as Iran, run closed source software from openly unfriendly countries such as the US?

    They should either be writing their own, or at the very least using open source so they can thoroughly audit it.

    Same applies to hardware, they don't need to develop their own hardware from scratch, just use published designs, inspect them and then manufacture their own.

    --
    http://spamdecoy.net - free throwaway anonymous email - avoid spam!
  64. Re:Is Ockham's razor anything like Occam's Razor? by Anonymous Coward · · Score: 0

    ftfy

  65. New Monkey Dance by Freshly+Exhumed · · Score: 2

    Destabilizers! Destabilizers! Destabilizers! Destabilizers!

    --
    I deny that I have not avoided attaining the opposite of that which I do not want.
  66. Re:. Virii Is Not a Word by Anonymous Coward · · Score: 0

    You're Welcome.

  67. mole? more like in plain sight. by Anonymous Coward · · Score: 0

    They're in Microsoft, for sure.
    They have purple badges instead of blue for FTE, or orange for contractor. (Purple used to mean all-access; in a way it still does.)
    Instead of vendor "v-" email addresses (for billable people), they have "business associate" "b-" email addresses (meaning they're on someone else's payroll).

    Does that somehow qualify as a mole?

  68. Why bother hiding? by nurb432 · · Score: 1

    All they have to do is walk up to Microsoft and tell them they WILL do xyz. And let them know if they reveal it, they are violating national security and will be jailed.

    --
    ---- Booth was a patriot ----
  69. You're wrong Bert64, especially on sourcecode by Anonymous Coward · · Score: 0

    Bert64 - Microsoft's licensed out their sourcecode to others before - & in regards to this from you:

    "If you're a national government, then you certainly have the resources to inspect linux, and you'd be foolish not to inspect the software you use for critical infrastructure. Even if you can't or won't inspect the linux source, you at least gain some assurance from the fact that many independent people with differing goals are able to see the source. Again, this is something windows simply doesn't provide." - by Bert64 (520050) on Friday June 15, @05:03PM (#40339367) Homepage

    Ahem... Bert64:

    Do you honestly *THINK* that others besides Microsoft don't have the sourcecode to Windows to inspect the very things you noted?

    * Especially governments?? Heck - even educational institutions have copies...

    (Guess again Bert64... you usually do a LOT better than that by the by, so I am guessing you're NOT yourself today!)

    However, & above all else? I think you just don't like how I turned around the argument of the person I replied to back on him, & the same appears to have happened to you now also, thus, I don't suspect you're "@ peak" today, because you usually don't err like that.

    APK

    P.S.=> Yes, your very argument can be turned against you just as I turned the erroneous argument of the person I replied to against him on the same grounds here (the NSA messing with Linux to create SeLinux) -> http://it.slashdot.org/comments.pl?sid=2918717&cid=40337001

    ...apk

    1. Re:You're wrong Bert64, especially on sourcecode by Sir_Sri · · Score: 1

      Quite honestly I have no idea what argument you were making. You don't seem to have made an argument. You had a some random gibberish and a link about a secure version of linux, which has nothing to do with what I was saying.

      I wasn't alluding to anything. I said clearly that MS handed over everything to the NSA, and that the government can easily hire former MS employees. There's no secret that that would give them basically full access to windows. What they do with linux is a separate matter.

      What educational institutions, or governments have source code to windows? As far as I know even Waterloo students can't get important windows source code. You *can* get pieces of windows source if you have a project. We had a guy here who got access to some source related to their UI for a disabilities device project, but I'm not sure how much of that is available elsewhere (or whether any of that code could even have security vulnerabilities that would matter), I would think it's all stuff that's available with their usual developer licences. But as far as I know we couldn't get source to anything important in windows if we asked for it.

    2. Re:You're wrong Bert64, especially on sourcecode by Bert64 · · Score: 1

      The point is that anyone can read/modify the linux sourcecode...
      Windows sourcecode is only available to certain organisations, i doubt the government of iran has it and it's certainly not available to the general public.

      Also as far as i know, the "shared source" agreement only provides source you can read through, you are not allowed to modify it and i don't believe you can even compile it. What assurance do recipients of the source have that it is the exact same source used to build the binaries they are running?

      The development process of windows is also far less open, with linux you can see exactly who submitted a patch.

      Whichever way you look at it, linux provides better access to the sourcecode.. How much better varies depending on how much microsoft trusts you.

      Whoever you are, you have a better chance of finding unwanted code inserted by a third party like the NSA, you have a better chance of identifying who put it there and you have a better chance of building a version which excludes the code in question.

      --
      http://spamdecoy.net - free throwaway anonymous email - avoid spam!
    3. Re:You're wrong Bert64, especially on sourcecode by peawormsworth · · Score: 1

      NSA has to work with Microsoft in order to insert the zero day exploits of their own design. With Linux they are free to modify the code to include back doors and bugs needed to infiltrate PC's of desire. I would love to do a diff on the NSA kernel source code on linux between the one available to the public and the one they use to compile kernels for their own agents. I bet the differences would reavel the holes inserted by the NSA.

  70. All backwards by SpaceLifeForm · · Score: 1

    Article is misdirection. If you can not figure it out, you have not been paying attention.

    --
    You are being MICROattacked, from various angles, in a SOFT manner.
  71. lol by KingBenny · · Score: 1

    echo .. 'ol' ...

    --
    Free speech was meant to be free for all... how can anyone grow up in a nanny state ?
  72. i hate to keep posting on the same subject but by KingBenny · · Score: 1

    if this is not anti-propaganda its actually FrontPage ubuntu new cos the soft there gets checked by the whole community and moles would have a very slim chance of getting a snippet into the major distribution (as opposed to etcete)

    --
    Free speech was meant to be free for all... how can anyone grow up in a nanny state ?
  73. It's true... by crankyspice · · Score: 1

    Shortly after we loaded Microsoft's Command Navigation Program hotfix, we were out cruising in our Battlestar when, poof, all our systems went offline and, a few seconds later, in came the nukes...

    --
    geek. lawyer.
  74. Ever wonder why ... by PPH · · Score: 1

    ... Microsoft's antitrust agreement with the DOJ was overseen by the presiding judge of the FISA court? My guess is that they needed to limit the amount of information concerning Windows inner workings being released to third parties where such inner workings were critical to intelligence gathering functions. Who other than a FISA court judge would be cleared to have the FBI/CIA/NSA call up and tell them to leave out details of certain interfaces?

    --
    Have gnu, will travel.
  75. hehe, and he thinks they aren't at F-Secure? by Desmoden · · Score: 1

    Silly human =)

  76. Hmmm by Anonymous Coward · · Score: 0

    I suspect the opposite, Microsoft has infiltrated the US government...

    1. Re:Hmmm by s.petry · · Score: 1

      I believe they are one of the biggest lobbyist companies, so in a way that would be correct.

      --

      -The wise argue that there are few absolutes, the fool argues that there are no probabilities.

    2. Re:Hmmm by chord.wav · · Score: 1

      It cant be Jack Bauer, he uses a Mac....

  77. Re:The Great Deciever! by s.petry · · Score: 1

    That was clear, I was just extending a few thoughts to what you wrote :D

    --

    -The wise argue that there are few absolutes, the fool argues that there are no probabilities.

  78. Re:Actually it would be irresponsible if they didn by s.petry · · Score: 1

    Wrong with your first statement, the majority of the worlds data is on Unix or Unix like systems. Desktop files (.doc, .xls, etc..) are an extremely small portion of the worlds data. The rest of your statement is agreeable.

    --

    -The wise argue that there are few absolutes, the fool argues that there are no probabilities.

  79. 2 points you FAILED on... apk by Anonymous Coward · · Score: 0

    "You don't seem to have made an argument. You had a some random gibberish and a link about a secure version of linux, which has nothing to do with what I was saying." - by Sir_Sri (199544) on Saturday June 16, @01:09AM (#40342365)

    1st: You implied the NSA has offered to "help 'secure' Windows" (which implies they only looked for ways to be able to "backdoor" their way into Windows).

    2nd: I merely showed the NSA actually DID HAVE A HAND IN 'securing' Linux, via SeLinux (which YOU obviously weren't aware of)... so, how do you know they didn't put in "backdoors" they can bust into easily (just like you implied for Windows)?

    ---

    "What educational institutions, or governments have source code to windows?" - by Sir_Sri (199544) on Saturday June 16, @01:09AM (#40342365)

    Take a look @ these links & get back to me after:

    http://www.google.com/search?q=%22windows+sourcecode%22+and+%22government%22&btnG=Search&sclient=psy-ab&hl=en&site=&gbv=1

    and

    http://www.google.com/search?q=%22windows+source+code%22+and+%22educational%22&sclient=psy-ab&hl=en&site=&gbv=1&sa=X&spell=1

    * As the saying goes? "Here endeth the lesson"...

    APK

    P.S.=> So much for you... apk

    1st: You implied the NSA has offered to "help 'secure' Windows" (which implies they only looked for ways to be able to "backdoor" their way into Windows).

    2nd: I merely showed the NSA actually DID HAVE A HAND IN 'securing' Linux, via SeLinux (which YOU obviously weren't aware of)... so, how do you know they didn't put in "backdoors" they can bust into easily (just like you implied for Windows)?

    ---

  80. Bert64 - did YOU say THIS? by Anonymous Coward · · Score: 0

    "Even if you can't or won't inspect the linux source, you at least gain some assurance from the fact that many independent people with differing goals are able to see the source. Again, this is something windows simply doesn't provide." - by Bert64 (520050) on Friday June 15, @05:03PM (#40339367) Homepage

    FROM -> http://it.slashdot.org/comments.pl?sid=2918717&cid=40339367

    Yes, you did... THUS, to that?

    Well then, I will simply point to what I did for Sir Siri (the only person whose argument I turned against them regarding the NSA producing SeLinux, where he implied they offered to 'secure' Windows (obviously meaning to 'backdoor' their way into it)):

    http://www.google.com/search?q=%22windows+sourcecode%22+and+%22government%22&btnG=Search&sclient=psy-ab&hl=en&site=&gbv=1

    and

    http://www.google.com/search?q=%22windows+source+code%22+and+%22educational%22&sclient=psy-ab&hl=en&site=&gbv=1&sa=X&spell=1

    * BOTH links show governments AND educational institutions that have access to Windows' sourcecode, AND, they are 3rd parties that can examine it for flaws (or to learn from it)...

    (As I said to Sir Siri? "Here endeth the lesson"...)

    APK

    P.S.=> As you can see from those links, more than a few governments (including the US Gov't.) have access to Windows source, as well as educational institutions, providing EXACTLY THAT WHICH YOU NOTED FOR LINUX - 3rd parties can & DO peruse Windows source to learn from it, and to shore it up via inspections... above & beyond those from Microsoft (& they get EXCELLENT TALENT, or doesn't Mr. Anders Heijelsberg + Dr. Mark Russinovich ring a bell there as to names I can drop?)... apk

    1. Re:Bert64 - did YOU say THIS? by Bert64 · · Score: 1

      You are completely misreading what i said, so i will spell it out in simple terms for you:

      1, It is easier for people to get access to Linux source than Windows.
      2, Many more people and organisations have access to Linux source than Windows.

      Therefore "linux provides better access to the sourcecode" as i said.

      "If you are sufficiently concerned about it, then you can inspect the sourcecode of linux and/or remove the parts you don't want..." This applies to ANYONE... Only certain organisations have READ access to windows source under restrictive terms, which means they can't make themselves a modified build with unwanted code removed.

      For many organisations and individuals, access to windows source would simply not be available at all via any legal channels, what do you expect people or organisations which fall into this group to do?

      "Even if you can't or won't inspect the linux source, you at least gain some assurance from the fact that many independent people with differing goals are able to see the source. Again, this is something windows simply doesn't provide."
      Organisations with access to windows source have to sign all manner of NDAs, they are not impartial and are bound by contracts which limit what they can disclose to the public. Linux has no such limitations.

      "If you're a national government, then you certainly have the resources to inspect linux, and you'd be foolish not to inspect the software you use for critical infrastructure."
      Do you think microsoft provide sourcecode of windows to governments such as iran? I severely doubt it, in which case the fact that microsoft provide sourcecode to someone else is irrelevant as far as the iranian government is concerned. Linux on the other hand provides source to anyone who wants it.

      Your providing irrelevant links does not change the facts.

      Also, answer these direct questions:

      1, Do YOU have access to windows source code? And if so, what can you do with it (inspect, build, modify, distribute)?
      2, Do YOU have access to linux source code? And if so, what can you do with it (inspect, build, modify, distribute)?

      --
      http://spamdecoy.net - free throwaway anonymous email - avoid spam!
  81. MS may work with US security agencies... !! by WOOFYGOOFY · · Score: 1

    Duh Of The Week.

    OK so everyone already knew this was true only because it's stands to reason. So let's play a game. Why was this :story released as "news"?

    Here's my guess. The government is trying to send a message to young geeks. Hey kids- don't think that your hacker skills or career path are orthogonal to becoming a spy! We're very interested in your skills and you can be part of something that really matters.

    Just my guess.

  82. Much more likely the mole(s) are at F-Secure by Anonymous Coward · · Score: 0

    Security firm F-Secure, can I stop laughing now? Misdirection doesn't just work for magic shows.

  83. I work at MS .. by xycadium · · Score: 1

    .. as a full time vendor and I've never seen any under cover federal agents. This must be a false flag news story of some kind.

  84. Bert64, you were quoted by Anonymous Coward · · Score: 0

    I didn't misread anything. You stated what I quoted here http://it.slashdot.org/comments.pl?sid=2918717&cid=40343179 of:

    "Even if you can't or won't inspect the linux source, you at least gain some assurance from the fact that many independent people with differing goals are able to see the source. Again, this is something windows simply doesn't provide." - by Bert64 (520050) on Friday June 15, @05:03PM (#40339367) Homepage

    ---

    1.) I showed that many independent people with differing goals are able to see the source!

    2.) That they have it in governments and educational institutions as some examples I provided!

    3.) The links are relevant - they prove the very point I noted by showing who/what/where/why/how they had the sourcecode to Windows.

    ---

    * Bert64 - You can try to change your story as you go but it only looks like trying to cover up your mistake by this point...

    APK

    P.S.=> This has nothing to do with myself @ this point after the above evidences of your own words, plus links with proof that show you are indeed, in error in said quoted statement from you!

    Thus - I merely pointed out your errors, and now you're trying to "cover up" for them by altering your initial statements, which again, are quoted above & show you with your pants down in that very quote (because it is in BLATANT error... period, and you know it, since your reaction now shows it)... apk

    1. Re:Bert64, you were quoted by Bert64 · · Score: 1

      1.) I showed that many independent people with differing goals are able to see the source!

      And your examples are not truly independent because they are all beholden to the (rather restrictive) agreement under which they receive the source, so my original statement still applies.

      Have you actually read the terms an organisation has to agree with in order to qualify for the shared source program?

      --
      http://spamdecoy.net - free throwaway anonymous email - avoid spam!
  85. Tell THAT to this guy here by Anonymous Coward · · Score: 0

    http://it.slashdot.org/comments.pl?sid=2918717&cid=40336511

    APK

    P.S.=> After all - he was implying that the NSA built in possible backdoors with his obvious sarcasm in stating they offered to 'secure' Windows, but they certainly DID MORE THAN OFFER THAT HELP FOR LINUX via SeLinux!

    Now - whether they actually BUILT backdoors into Linux is another question (because I don't have proof they did, but I never made any sarcastic statements they did either - I only provided proof as to what & where they have altered it, and that's Linux).

    Yes, they certainly had their hand in Linux, no questions asked, and in ANY SeLinux bearing distro - but perhaps ABOVE ALL ELSE here?

    Well, I see no proofs from he or others replying here now as to them actually altering Windows' sourcecode... apk

  86. Russia != China != USA != colleges, etc. by Anonymous Coward · · Score: 0

    Funny - the USA, Russia, China, & Colleges aren't independent of one another? Sorry - beg to differ... that, or you know something I don't!

    "And your examples are not truly independent because they are all beholden to the (rather restrictive) agreement under which they receive the source, so my original statement still applies." - by Bert64 (520050) on Sunday June 17, @10:19AM (#40351271) Homepage

    It applies alright - to show you were in error Bert64... no qusetions asked: Others, MANY INDEPENDENT OTHERS, have the sourcecode to Windows (legally & others besides that have it, see below)!

    * Then you later tried to "change your story"... saying they're "not independent of one another?? Come on... you messed up, period.

    APK

    P.S.=> As to this? Well, since the others above had to sign an NDA (even though they're NOT the same as one another, different nations even, as well as educational institutions)??

    "Have you actually read the terms an organisation has to agree with in order to qualify for the shared source program?" - by Bert64 (520050) on Sunday June 17, @10:19AM (#40351271) Homepage

    Ahem: Bert64 - I don't HAVE to, to realize that universiites != nations, & that one nation (russia for example) != another nation (china) OR educational institutions (they certainly are NOT nations/governments)...

    It's common-sense, & yet, you seem to have "issues" with that (no, you don't - it's just your PRIDE @ this point you're attempting to save imo)

    Others have the source too, by-the-by: However, by "nefarious" means -> http://www.google.com/search?sclient=psy-ab&hl=en&site=&source=hp&q=%22Windows+2000+sourcecode%22+and+%22stolen%22&btnG=Search&gbv=1&sei=Vi3eT9XRAoqr6QHXsaGKDA

    Bert64 - By the way: They didn't sign any NDA Bert64, did they? Of course not!

    Bert64 - so, your "latest 'out'" attempt here, which didn't work anyway (since nations != colleges and diff. nations are NOT THE SAME)??

    Easily "dusted/blown away", by yours truly, once more, easily (too easily)... apk

    1. Re:Russia != China != USA != colleges, etc. by Bert64 · · Score: 1

      "Even if you can't or won't inspect the linux source, you at least gain some assurance from the fact that many independent people with differing goals are able to see the source. Again, this is something windows simply doesn't provide."

      I will rephrase this yet again:

      If you are under an NDA then you are not independent. Your ability to work with the source (eg publish any bad things you find in it) are controlled by the company with whom you have the NDA.

      That you are independent of other organisations that have the source is irrelevant, you are not truly independent of the organisation that supplied the source since you are beholden to them under contract.

      --
      http://spamdecoy.net - free throwaway anonymous email - avoid spam!
  87. When China = Russia = USA = Colleges by Anonymous Coward · · Score: 0

    Get back to us then, ok? Also - please: Give us SOME credit, won't you? We're not that stupid... lol, I mean, come on:

    Tell you what - when China = Russia = US Government = Collegiate Academics = Hackers/Crackers THAT ALL HAVE WINDOWS' SOURCECODE? Get back to us then... ok?

    * Bert64, listen: There's NO WAY you can even begin to attempt to tell us they're NOT INDEPENDENT OF ONE ANOTHER, & don't have different goals... because obviously, they do (& there's NO NDA on the hacker/cracker types that have the source to it either).

    (Seriously man... you're "reaching", & falling FAR SHORT of the mark!)

    APK

    P.S.=> You just will not admit you screwed up stating that others don't have sourcecode to Microsoft Windows, because many independent others do, and some not even under NDA either (since you're attempting to cling to THAT to try "cover up" your mistakes)... it's astounding... apk

    1. Re:When China = Russia = USA = Colleges by Bert64 · · Score: 1

      You are not independent of a company you have a contract with in respect of anything covered by said contract, to suggest otherwise is just ridiculous.

      --
      http://spamdecoy.net - free throwaway anonymous email - avoid spam!
  88. China, USSR, USA, Colleges, & cracker by Anonymous Coward · · Score: 0

    ARE independent of one another & with DIFFERENT GOALS, no questions asked!

    Until then? Get a dose of reality!

    * You're just "reaching" for straws to try to save your pride from your mistakes here Bert64 - nothing more...

    (With your stating nobody has access to Windows' sourcecode (because as you can see from my posts? MANY INDEPENDENT ORGANIZATIONS (independent of one another), DO!))

    APK

    P.S.=> You can't even FACE when you screwed up bigtime stating this here:

    "Even if you can't or won't inspect the linux source, you at least gain some assurance from the fact that many independent people with differing goals are able to see the source. Again, this is something windows simply doesn't provide." - by Bert64 (520050) on Friday June 15, @05:03PM (#40339367) Homepage

    FROM -> http://it.slashdot.org/comments.pl?sid=2918717&cid=40339367

    You NEED to see contrary proofs, & here they are again:

    http://www.google.com/search?q=%22windows+sourcecode%22+and+%22government%22&btnG=Search&sclient=psy-ab&hl=en&site=&gbv=1

    and

    http://www.google.com/search?q=%22windows+source+code%22+and+%22educational%22&sclient=psy-ab&hl=en&site=&gbv=1&sa=X&spell=1

    BOTH links show governments AND educational institutions that have access to Windows' sourcecode, AND, they are 3rd parties that can examine it for flaws (or to learn from it)...

    As well as hacker/cracker types having copies as well which I posted here:

    Others have the source too, by-the-by - However, by "nefarious" means -> http://www.google.com/search?sclient=psy-ab&hl=en&site=&source=hp&q=%22Windows+2000+sourcecode%22+and+%22stolen%22&btnG=Search&gbv=1&sei=Vi3eT9XRAoqr6QHXsaGKDA

    Bert64 - You can't own up to your mistakes either it seems... apk

    1. Re:China, USSR, USA, Colleges, & cracker by Bert64 · · Score: 1

      Independent of one another in any other field is irrelevant, they cannot act independently of microsoft with the source.

      I may be independent of you in most fields, but neither of us are able to directly post pictures here because slashdot doesn't allow that, so we are both dependent on slashdot in this case.

      Your mention of hackers is grasping... Microsoft never intentionally made source available to them and they can only use it for further nefarious means as anyone who published a vulnerability they found in illegally acquired sourcecode would be running serious risk.

      What it does show however, is that a closed source model provides significant advantages to the blackhats at the expense of legitimate researchers and end users.

      --
      http://spamdecoy.net - free throwaway anonymous email - avoid spam!
  89. OpenSores sourcecode vs. closed source by Anonymous Coward · · Score: 0

    "Your mention of hackers is grasping... Microsoft never intentionally made source available to them and they can only use it for further nefarious means as anyone who published a vulnerability they found in illegally acquired sourcecode would be running serious risk.." - by Bert64 (520050) on Tuesday June 19, @10:26AM (#40369717) Homepage

    1st of all - MS DID MAKE SOURCE INTENTIONALLY AVAILABLE THOUGH, to educational institutions + goverments even, & you LITERALLY STATED THEY DID NOT (see quote of your words below, yet again)...

    I simply proved otherwise with actual evidences, vs. your clearly ERRONEOUS STATEMENT quoted below in my p.s....

    2nd: LMAO - funny part's ANYONE can hack/crack Linux by taking the sourcecode provided & step-trace in a compiler, step-tracing & analyzing it & FAR MORE EASILY than trying it on closed source code using kernel level debuggers like WinDbg or fuzzers, to find the "security holes" in it...

    (Which, of course, also makes it far more dangerous in that capacity, and one doesn't HAVE TO BE A HACKER/CRACKER TO DO IT either... Linux "doth provide" easier means!)

    * Or, are you going to *try* tell us now that checking actual sourcecode traced in a compiler is HARDER than operating with kernel level debuggers over closed sourcecode?

    (That'd be another HUGE LAUGH if you did... I've done both & there is a HUGE WORLD OF DIFFERENCE IN THE DIFFICULTY LEVEL (especially working with kernel level debuggers & assembly language stop dumps... vs. actual sourcecode (that Linux DOES provide & yes, it has that downside, which can be an upside, but a downside nonetheless also - a double-edged sword))

    ---

    "What it does show however, is that a closed source model provides significant advantages to the blackhats at the expense of legitimate researchers and end users.." - by Bert64 (520050) on Tuesday June 19, @10:26AM (#40369717) Homepage

    Thanks for making my point above for me Bert64, with THAT statement from you!

    Yes - because I KNEW YOU'D GO FOR THE "STD. FUD MANTRA" of "Open SORES is better for catching errors in security", but THAT? That works BOTH ways, for security researchers AND hacker/cracker types!

    Yes - sure is, because of the above (easier to do than doing it to closed source code & operating with kernel level debuggers like WinDbg, by far...)

    ("Played you like a fiddle" on that one too... lol!)

    ---

    "Independent of one another in any other field is irrelevant, they cannot act independently of microsoft with the source." - by Bert64 (520050) on Tuesday June 19, @10:26AM (#40369717) Homepage

    Funny then when I pointed out hacker/crackers that did, see my p.s.' closing section below, last link/url

    (So, so much for THAT from you (not that it matters, because your original statement was TYPICAL "Pro-*NIX 'FUD'" & nothing more, & you know it, I KNOW IT, anyone reading knows it - and I caught you in it... period.))

    (Also/again - The USA, USSR, China, Russia & numerous academic institutions are NOT the same, and defintely pursue differing goals... despite your FUD statement I have quoted & requoted from you!)

    APK

    P.S.=> Requoting Bert64's errroneous statement once more for everyone's reference vs. my statements AND PROOFS to the contrary, as well as evidences I used to disprove it totally:

    "Even if you can't or won't inspect the linux source, you at least gain some assurance from the fact that many independent people with differing goals are able to see the source. Again, this is something windows simply doesn't provide." - by Bert64 (520050) on Friday June 15, @05:03PM (#40339367) Homepage." - by Bert64 (520050) on Friday June 15, @05:03PM (#40339367) Homepage

    FROM ->

  90. Bert64 = Hulk, APK = Thor by Anonymous Coward · · Score: 0

    Position 20 onwards in the youtube video control here -> http://www.youtube.com/watch?v=6Attt4dVu0U&feature=related

    * Where Bert64's "FUD" words not only got him floored, but also "pinned" under the weight of his own erroneous words (Thor's Hammer)... & now he can't get out from under them... lol, see my 'p.s.' below!

    APK

    P.S.=>

    "Even if you can't or won't inspect the linux source, you at least gain some assurance from the fact that many independent people with differing goals are able to see the source. Again, this is something windows simply doesn't provide." - by Bert64 (520050) on Friday June 15, @05:03PM (#40339367) Homepage." - by Bert64 (520050) on Friday June 15, @05:03PM (#40339367) Homepage

    FROM -> http://it.slashdot.org/comments.pl?sid=2918717&cid=40339367

    B.S. to the above quote from you! Who/what/when/where/how/why? These links below disprove your words with ease:

    A.) Governments
    B.) Educational institutions
    C.) HACKER/CRACKER types

    That have access to Windows' sourcecode, AND, they are 3rd parties that can examine it for flaws (or to learn from it)... and?

    Yes - They definitely have DIFFERENT GOALS!

    ---

    GOVERNMENTS WITH WINDOWS' SOURCECODE:

    http://www.google.com/search?q=%22windows+sourcecode%22+and+%22government%22&btnG=Search&sclient=psy-ab&hl=en&site=&gbv=1

    ---

    COLLEGES WITH WINDOWS' SOURCECODE:

    http://www.google.com/search?q=%22windows+source+code%22+and+%22educational%22&sclient=psy-ab&hl=en&site=&gbv=1&sa=X&spell=1

    ---

    CRACKERS WITH WINDOWS' SOURCECODE:

    http://www.google.com/search?sclient=psy-ab&hl=en&site=&source=hp&q=%22Windows+2000+sourcecode%22+and+%22stolen%22&btnG=Search&gbv=1&sei=Vi3eT9XRAoqr6QHXsaGKDA

    ---

    BOTTOM-LINE: YOU ARE OFF/WRONG BERT64 - period... & I floored your attempt @ "FUD", as-per-usual, & YOU KNOW I've just GOTTA say it, as is per my own "inimitable style::

    This?

    This was just "too, Too, TOO EASY - just '2EZ'"

    You made it so!

    Now, watching you *trying* to get out from under the weight of your errors by mincing words that don't change a damn thing you initially stated in falsehoolds shown above? Priceless...

    ( & a LOT like watching the Hulk in that video trying to lift Mjolnir, after Thor "WAPS" him with it, lol!)

    ... apkmany independent people with differing goals are able to see the source. Again, this is something windows simply doesn't provide."