Slashdot Mirror

← Back to Stories (view on slashdot.org)

NTLM 100% Broken Using Hashes Derived From Captures

Posted by Soulskill on from the progress-bar-complete dept.

New submitter uCallHimDrJ0NES writes "Security researcher Mark Gamache has used Moxie Marlinspike's Cloudcracker to derive hashes from captured NTLM handshakes, resulting in successful pass-the-hash attacks. It's been going on for a long time, probably, but this is the first time a 'white hat' has researched and exposed the how-to details for us all to enjoy. 'You might think that with all the papers and presentations, no one would be using NTLM...or, God forbid, LM. NTLMv2 has been around for quite some time. Surely, everyone is using it. Right? Wrong! According to the last data from the W3 Schools, 21% of computers are running XP, while NetMarketShare claims it is 39%. Unless someone has hardened these machines (no MS patches do this), these machines are sending LM and NTLM responses!' Microsoft has posted a little guidance for those who need to turn off NTLM. Have fun explaining your new security project to your management, server admins!"

155 comments

  1. Thanks alot.... by Anonymous Coward · · Score: -1

    Asshole

    1. Re:Thanks alot.... by Jeremiah+Cornelius · · Score: -1

      Somebody needs to take a good look at themselves.

      --
      "Flyin' in just a sweet place,
      Never been known to fail..."
    2. Re:Thanks alot.... by Jeremiah+Cornelius · · Score: -1

      http://www.the-fed.org/media/volume26/issue5/goofus_gallant.jpg

      --
      "Flyin' in just a sweet place,
      Never been known to fail..."
    3. Re:Thanks alot.... by hairyfeet · · Score: 3, Insightful

      Somebody needs to get with the last decade since MSFT made Kerberos the preferred authentication method waaaaay back in Win2K, so if you are still using NTLM for authentication after it has been depreciated for 13 years? I'd say you have bigger problems than NTLM being hacked.

      --
      ACs don't waste your time replying, your posts are never seen by me.
    4. Re:Thanks alot.... by Billly+Gates · · Score: 4, Insightful

      I already replied to someone saying the best way to harden XP is called Windows 7.

      I do not understand the strange obsession of keeping XP. Does it save money. No.

      Geeks with aspergers lack the social skills to grow a pair and tell the cost accountants they are morons as if these companies who handle customer social security numbers, credit numbers, and other things with their billing department are ripe pickings with XP.

      XP has been proven time and time again to be old, insecure, and has security features from a different era. It comes with IE 6. I mean did MS really make it that secure? Oh it is password protected. THat is good enough ... check.

      IE 6 - 8 are being exploited right now under XP because it lacks protected mode and even the Mr. Fixit from that exploit has already been circumvented. But those on XP claim they are saving money and how great and secure their OS is that wont listen. Just because it runs on machines with 256 megs of ram doesn't mean it is supperiorly coded and of high quality. THe misinformation many supposedly IT professionals are astounding.

      I should start bookmarking these so when someone mods me down and says how great XP is and why change to an inferior bloated OS like win 7 I can cite this and the IE 6 -8 hole links?

      --
      http://saveie6.com/
    5. Re:Thanks alot.... by Anonymous Coward · · Score: 1

      lol. Yeah, wikipedia said it, it has to be true. Oh, wait... you didn't even read the complete subsection of the wikipedia article. Your position in IT management awaits.

    6. Re:Thanks alot.... by jones_supa · · Score: 1

      Just because it runs on machines with 256 megs of ram doesn't mean it is supperiorly coded and of high quality.

      XP SP3 doesn't even cut that anymore. A bare installation hovers around 384 megs already.

    7. Re:Thanks alot.... by strikethree · · Score: 1

      I have been noticing this a lot lately but I decided to offer this friendly little help to you:

      depreciated is not the word you are wanting to use. The word that you actually want is deprecated.

      http://en.wikipedia.org/wiki/Depreciation

      http://en.wikipedia.org/wiki/Deprecation

      Cheers :)

      --
      "Someone needs to talk to the tree of liberty about its ghoulish drinking problem." by ohnocitizen
    8. Re:Thanks alot.... by Anonymous Coward · · Score: 0

      Yes, Kerberos is fun.

      But don't use CNAMEs in DNS to point domains to a proxy.
      Or don't authenticate to localhost for a webservice.
      etc...

      Not to mention patches for certain issues that are available for windows 7, but not for Windows server. with no intention to release patches.

      Kerberos is better, but it is still broken in real world setups.

    9. Re:Thanks alot.... by thoromyr · · Score: 1

      of course, anyone taking your advice has their head screwed on wrong. Maybe your going about your advice wrong. First, try to learn something about the topic on which you want to give advice. Second, don't insult the people you are talking to at every turn. You really like the phrase "grow a pair", for example. Grow up.

      Of course, the same criticism could be leveled at this post. Except I'm not trying to give you advice, just pointing out why your "sage advice" is falling on deaf ears.

    10. Re:Thanks alot.... by Evro · · Score: 1

      Another thing about XP - any computer purchased in the past ~3 years is going to come with Windows 7. You can get Core i5 Lenovo laptops with 8gb ram for ~$600-$700. Yes, it costs money, but if your org is running computers from 2005, it's probably worth upgrading anyway, unless you have a valid reason for sticking with XP (e.g. your users run software that requires XP and won't run on Win7).

      At my last job, cost was one of the barriers to upgrading to Win7. But we pitched it as a hardware upgrade - moving from slow Core Duo 1.8 ghz desktops with 2 GB ram to the Lenovos I described above. It was a huge win for us all around - we migrated to Win7 and upgraded the hardware in one shot, while improving everyone's workflow by moving from desktops to laptops.

      --
      rooooar
    11. Re:Thanks alot.... by hairyfeet · · Score: 1

      Actually its worse than that Billy as XP still has the old WinNT 4 memory manager which frankly was designed in an era when memory was worth its weight in gold so it'll pimpslap the living hell out of swap LONG before you've even used half the RAM in the system. So in actuality you aren't saving any memory, you are just swapping more. Compare this to Win 7 where I have 500MB of my 8GB free right now, am I running something intensive? Nope its merely caching all my most used programs and Windows features so if I click on them its instant. if I do launch something intensive like my shooters Win 7 will just dump the cache and hand it over and when finished it refills the cache which is a MUCH smarter and saner design choice. Now anything I use day to day loads with ZERO disc access, just click and done.

      So if you look at the internals of WinXP there really isn't much they can do to make it run any better or safer, like that 7 year old graphics card every drop of performance has done been squeezed out and you can't fix it, the lack of non admin users, the lack of low rights mode, the inability to protect the memory or keep it from using swap when you have memory free, these things are part of the core and just can't be fixed without dumping the whole, they just can't do it.

      Win 7 is supported until 2020 at the very least (since it has become the new XP I have a feeling it'll get an extension or two) and HAS all the extra security and core OS features that make it capable of handling the multiple cores and multiGB of RAM we have today. When XP was released I can tell you the average system was a 300MHz PII with 64MB-128MB of RAM, hell those $50 cheap tablets have better specs than high end PCs ran under XP RTM. Its time to let the old thing go, like Win9X it served its purpose at the time but now it should just rest in peace and everyone move on. Even XP X64 (in reality 2K3 Workstation 64) had lousy memory management, it could take a lot of memory but it was up to the individual programs to use it wisely.

      --
      ACs don't waste your time replying, your posts are never seen by me.
    12. Re:Thanks alot.... by Bert64 · · Score: 1

      This "Strange obsession" is called backwards compatibility...

      Companies have lots and lots of very poorly written software which was designed to run on XP, and doesn't work (the same) on anything else. The reasons why it doesn't work are varied, some just refuses to run when it detects a version it doesn't recognise while others depend on the weaker security model of XP or other such things, while some software mostly works but some features are broken or behave differently.

      The cost of testing all this software, and replacing what doesn't work is HUGE both in terms of money and man hours.

      Some of the software may not be easily replaceable, i have encountered many companies locked in to closed source software where the original vendor has gone bankrupt, leaving them with an old version, no source code, no specifications on how the data is stored etc.

      Besides, if you're going to make the huge investment of moving to a different system, it would make more sense to move to Linux... At least then you will significantly decrease your long term costs.

      --
      http://spamdecoy.net - free throwaway anonymous email - avoid spam!
    13. Re:Thanks alot.... by Cid+Highwind · · Score: 1

      The cost of testing all this software, and replacing what doesn't work is HUGE both in terms of money and man hours.

      Eventually the cost of cleaning up the messes script kiddies make every time they pwn one of your XP machines (and lost business that comes with constantly sending out those "sorry, our security sucks, and now your name, password, credit card numbers, and social security number are on pastebin." messages to customers) will be HUGE-er.

      --
      0 1 - just my two bits
    14. Re:Thanks alot.... by hairyfeet · · Score: 1

      Riiight, Linux is gonna save you money long term....how exactly? Lets look at the OS breaking moves just in the past 5 years, ALSA for a broken Pulse, KDE 3 and Gnome 2 just getting really good and stable....only to get shitcanned for alpha quality replacements, oh and lets not forget all the kernel twiddling by Linus "I'm an arrogant ass" Torvalds and the entire WiFi subsystem getting a serious rewrite that broke as much as it fixed. Quick, what do BSD, OSX,iOS,Windows,Solaris and even OS/2 have in common that Linux DON'T? A stable driver ABI so when one subsystem gets futzed with the whole thing don't shit itself and die, that's what.

      As for backwards compatibility...uhhh, hello? XP Mode? Comes with Win 7 Pro? Lets you make a nice little locked down XP install while still having all the security and benefits like a better memory subsystem that is Windows 7? I've set up several businesses on Win 7 with XP Mode and frankly it runs great, the employee just clicks the desktop link just like they would have in XP and the VM runs the program easy peasy. the ONLY thing its not good for I've found is graphics heavy stuff like gaming which lets face it most businesses aren't gonna be allowing you to run your old Win9X games anyway. ironically I've not had a bit of trouble running ALL my win9X games on win 7 X64...as long as I pirate them thanks to the old shitty 16 bit DRM they used to use. But the games themselves? Run fine.

      But its really not hard for a business to set up a test bed with Win 7 and XP Mode to test their old software, hell you can get dual core machines now for less than $200 so there really is no excuse not to have a test bed and the things gained by switching, better security, faster workflow (jumplists and breadcrumbs...I still don't know how we lived without those) a MUCH better and actually sane memory subsystem that will have all the programs they use daily loaded into RAM and ready to go when they are, and finally the frankly insane amount of money you are pissing away by hanging onto those old P4s and CRT monitors, I've had business owners tell me that after I switched over their office their electric bill went down a good 35% just from not blowing all the juice on feeding and cooling those old power hogs. It just doesn't make any kind of sense, not from a security, economic, nor business sense, to keep old hardware.

      --
      ACs don't waste your time replying, your posts are never seen by me.
    15. Re:Thanks alot.... by Anonymous Coward · · Score: 0

      What is it exactly with you and your retarded diatribes? Are you an alcoholic?

  2. And this is important because? by maugle · · Score: 1

    OK, I did the unthinkable and skimmed the actual article, but I still have no idea what NTLM does, why it was chosen for whatever task it does, or what the potential repercussions are now that it's broken. Even the "Reminder About the Downside of Doing Nothing" section, which I hoped would explain exactly what an attacker could do, was light on details. Something about sending passwords to a remote machine?

    Can anyone shine some light on this?

    1. Re:And this is important because? by UnknownSoldier · · Score: 5, Informative

      NTLM stands for Windows NT Lan Manager. Is was used in earlier Windows from NT 3.1 (yes THAT old) up til Win 2K3 IIRC.

      Users would authenticate their login credentials to the system. NTLM is the sub-system that does that authentication.

      For more details see wikipedia: http://en.wikipedia.org/wiki/NTLM

    2. Re:And this is important because? by Jeremiah+Cornelius · · Score: 2

      NTLM, you COULD go to Wikipedia - failing all else.

      This is the name for Microsoft's 2nd generation authentication protocol - for issuing challenges and responses related to encrypted passwords as a shared secret. The passwords are hashed with a salt, and the value compared with the known password, by the authentication service. This is a variant introduced by Windows NT on the LAN Manger scheme - cooked up in the remote past by MS and IBM, based on Ungerman-Bass software.

      This is important, because LM and NTLM are trivial to ether crack or spoof. Backwards compatbility was the bugbear for NTLM. v2 addresses many of the issues - but is relatively recent. Every XP / Server 2003 era machine sends the old-style hashes, as a part of Auth handshake sequences.

      It's now been demonstrated that this is not a trivial matter - that the hash may be derived simply by performing computation on the artifacts for challenge and response. Then a legitimate hash can be injected by an attacker, in standard "pass-the-hash" fashion.

      --
      "Flyin' in just a sweet place,
      Never been known to fail..."
    3. Re:And this is important because? by azulcactus · · Score: 1

      The first paragraph on Wikipedia is excellent: http://en.wikipedia.org/wiki/NTLM Also important to note this is only referring to NTLMv1 which is hella old. Also just because you are running Windows XP still doesn't mean you are using NTLMv1. It's a bit more complex than that.

    4. Re:And this is important because? by Jeremiah+Cornelius · · Score: 1

      UPDATE!

      He doesn't just pass the hash - He gets THE PLAINTEXT PASSWORD. This allows anywhere, anytime auth access, instead of MITM.

      --
      "Flyin' in just a sweet place,
      Never been known to fail..."
    5. Re:And this is important because? by Curate · · Score: 3, Informative

      I distinctly remember using NTLMv2 in both NT 4.0 and Win2K, for a product I was developing for those platforms. NTLMv2 was an option. You could also choose whether the negotiation could downgrade to NTLM if the other side didn't support NTLMv2, or if the negotiation would insist on NTLMv2. But NTLMv2 didn't become the default until Vista -- the first version of Windows that strongly emphasized security.

    6. Re:And this is important because? by buchner.johannes · · Score: 1

      If you have a web proxy (e.g. squid) with user authentification, you probably are also using NTLM for sending hashed one-time passwords. The only other alternative is Digest authentication, which only few client programs support. The NTLM version used depends on the client machine.

      --
      NB: The message above might reflect my opinion right now, but not necessarily tomorrow or next year.
    7. Re:And this is important because? by Anonymous Coward · · Score: -1

      You COULD stop sucking dicks too but who are we to complain?

    8. Re:And this is important because? by smhsmh · · Score: 1

      My reply may be somewhat off topic, but give it a read:

      SlashDot is to journalism as COBOL is to programming.

      I read SlashDot because it is an important and timely source of technical news. But all too often articles are incomprehensible (without research) to readers outside some particular narrow discipline. Writing a lead in to an article is a skill that requires more than technical knowledge -- it requires knowledge (and some assumptions) about the experience of the intended readership. Like several other readers -- who know a lot about lotsa things, but not everything about everything -- without some research I couldn't decide immediately whether I ought pursue the article contents further. My apologies to everyone else who knows s/he knows everything about everything.

      I think SlashDot would be a better place (and more worth more people perusing every day) if more posters were familiar with basic tenets of reportage: "Don't bury the lead." "Answer the 5 questions in the lead." "Know no more than your stupidest reader knows." (The last quote isn't a real tenet of journalism -- I just invented it, and it is arguably baaaad advice.)

      I have a friend who is a retired newspaper journalist. I wonder if I could interest him in devising some guidelines for ShashDot postings that even amateurs could apply with some improvement to the quality of their posts. Anyone enthusiastic about this?

      BTW, I mean no disrespect to the original poster DrJONES. His article is otherwise useful and relevant, at least to some in the community. I'm suggesting only that SlashDot style ought be more self aware and aware of the readership...

    9. Re:And this is important because? by Anonymous Coward · · Score: 0

      v2 addresses many of the issues - but is relatively recent.

      compared to LM maybe, but still it has been in windows since NT4.0 days, that is hardly recent in IT terms.

    10. Re:And this is important because? by Anna+Merikin · · Score: 1

      As a working reporter/writer for two decades, I offer some other tips:

      Each sentence should be less important than the one before it. This is called pyramiding in the trade; it allows the reader to quit once he/she understands enough, or for an editor to cut from the bottom.

      Never use a big word when a small, familiar one will do.

      Keep sentences to less than thirty words, if at all possible. This is mandatory for the lead (first sentence.)

      Be brave in paragraphing; do it often.

      Read the AP, Chicago or other online style guides, and commit to memory E.B.White's Elements of Style.

    11. Re:And this is important because? by Nimey · · Score: 2

      XP and 2000 can be made to use NTLMv2 but you have to either use Group Policy or set it in Local Security Policy. I don't know /why/ Microsoft didn't make it default to at least use v2 if both ends agreed, but they wouldn't have forced it on because of back compatibility with NT4 domains.

      --
      Hail Eris, full of mischief...

      E pluribus sanguinem
    12. Re:And this is important because? by Anonymous Coward · · Score: -1

      Because it breaks intranet sites that rely on IE 6.

      The whole point of upgrading to IE 6 from Netscape is you can write VBscript that used NTLM for authentication with the domain controller. I see no way to do this with NTLMv2 so we stay with NTLM1 and XP/IE6 as the years go by.

    13. Re:And this is important because? by Nimey · · Score: 1

      Dear god, I hope you're exaggerating.

      --
      Hail Eris, full of mischief...

      E pluribus sanguinem
    14. Re:And this is important because? by Fnord666 · · Score: 2

      I have a friend who is a retired newspaper journalist. I wonder if I could interest him in devising some guidelines for ShashDot postings that even amateurs could apply with some improvement to the quality of their posts. Anyone enthusiastic about this?

      This will remain irrelevant until the editors do some editing rather than accepting article submissions that are no more than the output of a script that scrapes an RSS feed.

      --
      'The tyrant will always find pretext for his tyranny.' - Aesop's Fables
    15. Re:And this is important because? by Billly+Gates · · Score: 1

      I think he is right.

      Iwrote some simple asp site that did just that with IE 5.5 when Windows 2000 was brand new.

      Hopefully these dinosaurs are going down since XP is getting EOL. Can a recent web developer tell me if you can use NTLDMv2 today with a modern browser?

      --
      http://saveie6.com/
    16. Re:And this is important because? by Anonymous Coward · · Score: 0

      I could be incorrect, but it sounds like he's still using NT Domains and not Active Directory (which supposedly uses kerberos instead of ntlm).

      In any case keeping NTLM around in XP/2003 was reasonable because there were so many Win9x clients around at the time. However that was 10+ years ago.

    17. Re:And this is important because? by fatphil · · Score: 2

      Pah. You should have left it at 4 points.

      Do paragraphing not often, but only as often as makes sense. One-sentence paragraphs are for those with grade 2 reading and writing level.

      See Anna Merkin.

      See Anna Merkin paragraph.

      Paragraph, Anna Merkin, paragraph.

      And commit Strunk and White to the *bin*, not to memory. See the many comments by Pullum on Language Log and elsewhere, for example, for reasons why. Pay special attention to the fact that White apparently doesn't even know what the passive voice is before deciding you should follow anything he recommends.

      --
      Also FatPhil on SoylentNews, id 863
    18. Re:And this is important because? by Mikkeles · · Score: 2

      I found the following on the MS site:

      What caused the issue?
      Until January 2000, export restrictions limited the maximum key length for cryptographic protocols. The LM and NTLM authentication protocols were both developed before January 2000 and therefore were subject to these restrictions. When Windows XP was released, it was configured to ensure backward-compatibility with authentication environments designed for Windows 2000 and earlier.

      Export restrictions screw you again!

      --
      Great minds think alike; fools seldom differ.
    19. Re:And this is important because? by Cid+Highwind · · Score: 2

      I wonder if I could interest him in devising some guidelines for ShashDot postings that even amateurs could apply with some improvement to the quality of their posts. Anyone enthusiastic about this?

      Not in the slightest. I am, in fact, enthusiastically unenthusiastic about bringing the assumption that your reader needs all the 'the five Ws' answered or technical background spoon-fed to him onto the web.

      Newspaper style guides were written for a time when a person who didn't understand the technical background had to pedal down to the library and find a book on the subject, read it, and come back to finish the story days or weeks later. It was better to give them a layman's understanding of the science than hope he would come back. Those assumptions don't hold when we have tabbed browsers and wikipedia.

      --
      0 1 - just my two bits
    20. Re:And this is important because? by Anonymous Coward · · Score: 0

      I prefere to use integrated windows authentication when developing intranet sites and locking it down with A/D permissions via IIS.

    21. Re:And this is important because? by micheas · · Score: 1

      Not quite.

      The attacker only gets the password, however the password is never directly used, it is always converted to the hash.The hash is essentially the real password, and for injection attacks is more useful than the password as it saves you from converting the password to the hash.

      --
      Work bio at MMWD
    22. Re:And this is important because? by ulzeraj · · Score: 1

      Squid works fine with Kerberos and AD authentication. And since Vista and Windows 7 are a pain to setup Proxy authentication on Squid ntlm_auth most people should be using Kerberos or digest right now.

      http://wiki.squid-cache.org/ConfigExamples/Authenticate/Kerberos

  3. This summary is terrible by Anonymous Coward · · Score: 2, Insightful

    This is one of the worst summaries I have ever read here. I can easily imagine the joy in the submitter as they are dancing to their own over the top writing style. NTLM is 100% broken. Oh no! Microsoft stopped recommending it and switched to Kerberos starting with Windows 2000. Who the hell cares that someone broke a protocol from 10+ years ago? If anything, it makes NTLM look really good. What sensationalist trash this is.

    1. Re:This summary is terrible by Jeremiah+Cornelius · · Score: 1, Informative

      If you knew this well enough, XP - a significantly deployed OS - sends these hashes anyway. It takes a Registry Change through group-policy to change the behavior.

      You want fun? Sit on the corp net of any silicon valley company with Wireshark. It's still XP heaven out there... And all the SAMBA servers? Easy pickings, Kerb5 or not.

      --
      "Flyin' in just a sweet place,
      Never been known to fail..."
    2. Re:This summary is terrible by Anonymous Coward · · Score: 0

      What do you do for a living that you're doing that?

    3. Re:This summary is terrible by Jeremiah+Cornelius · · Score: 2

      Used to do pen/vuln. No more.

      Now, I'm a PowerPoint engineer!

      --
      "Flyin' in just a sweet place,
      Never been known to fail..."
    4. Re:This summary is terrible by Anonymous Coward · · Score: 0

      lol. Clearly you are clueless. Kerberos is tricky to configure correctly. More auth traffic in a AD domain falls back to NTLM than uses Kerberos. Also, it looks like the post was intended for a technical audience. Go back to your Cheers reruns on Hulu. You may want to try the kitten RSS feeds rather than Slashdot.

    5. Re:This summary is terrible by BitZtream · · Score: 2

      So ... everyone joined to ActiveDirectory then eh? Its been known that NTLM hashes could be reused for years.

      And for the record, my Samba servers have been using kerberos for years, not sure why yours aren't. Shitty admin perhaps? Must be as the previous stated reason is what causes a clueful admin to move to kerberos back in 2001 when XP made it possible to use network wide.

      When you start mixing unix and windows servers on a domain you pretty much start off by switching everything to kerberos so everything works properly.

      --
      Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
    6. Re:This summary is terrible by Anonymous Coward · · Score: 1

      "This summary is terrible"...
      Agree... this is being overblown. Any competent admin of a network of any size already followed guidelines issued nearly a decade ago to start forcing NTLMv2 only unless there was some very specific reason not too. Back in say 2004 time frame there were reasons, by 2008 there really was no excuse. Even if someone missed it it's a simple GPO change and refresh to mitigate as already pointed out throughout the thread. Yawn.

    7. Re:This summary is terrible by Anonymous Coward · · Score: 0

      That isn't what this article is about. NTLM has been 100% broken by black-hats for years. This is a white-hat write up on how it was done.
      This is purely informational, who cares how the submitter submitted it? You got the fuckin point right? No you didn't, because you are stupid and clearly obsessed with irrelevant details.

      For the record, you post was nothing but sensationalist trash as well.

    8. Re:This summary is terrible by davester666 · · Score: 1

      I don't know, maybe everybody didn't immediately switch every machine in their company to XP on day one?

      --
      Sleep your way to a whiter smile...date a dentist!
    9. Re:This summary is terrible by Anonymous Coward · · Score: 0

      Aww, you have a fan club. Aren't they just precious!

    10. Re:This summary is terrible by Anonymous Coward · · Score: 0

      Seems to be payback that troll Jeremiah Cornelius had coming from reading those replies. You're probably him I would say judging from the tactics trolls use. Learn to spell JC.

    11. Re:This summary is terrible by Anonymous Coward · · Score: 0

      Unless you're working at a company that still has some old servers, running on well-past-EOL operating systems, lingering in the shadows, necessitating other, newer servers to keep using the old methods to connect to the old servers.

      You, obviously, have not worked at a large enough company yet.

    12. Re:This summary is terrible by Anonymous Coward · · Score: 0

      Actually I have, and in another response talked about just what you mention as being the last time I saw a non ntlmv2 only network that was 2009 with a company who refused to upgrade 2 win2k boxes and the app software running in dark corner of the accounting dept. Truth is though for something on the order of 95% of the folks out there this should be a non-issue that has long since been address prior to the current decade. Hopefully this serves as yet another nudge in the right direction for those organizations dragging their feet.

    13. Re:This summary is terrible by Anonymous Coward · · Score: -1

      Why'd ya pull yer resume off LinkedIn Jeremiah Cornelius -> http://slashdot.org/comments.pl?sid=3368135&cid=42529887 Is it since someone spotted you're not only a "San Fran 'Man'" (a fella is more like it) and that you can't even spell what you allegedly used to do for a job? It's PENETRATION, not "pentration" as you spelled it there (one would think an anal penetration man from San Fran'd know how THAT is spelled at least, lol). Jeremiah Cornelius likes to troll others, but can't handle it when it's done in return showing he is illiterate -> http://slashdot.org/comments.pl?sid=2238996&cid=36457426 and that much is obvious. You fail troll. How many years did you leave your resume up there with that fail on it? Yes you have been trolled. You like? I wager you don't since you removed your faulty resume (on the very thing you took pride in that you can't even spell correctly most likely indicating you weren't any good at it either).

    14. Re:This summary is terrible by Anonymous Coward · · Score: -1

      Why'd ya pull yer resume off LinkedIn Jeremiah Cornelius -> http://slashdot.org/comments.pl?sid=3368135&cid=42529887 Is it since someone spotted you're not only a "San Fran 'Man'" (a fella is more like it) and that you can't even spell what you allegedly used to do for a job? It's PENETRATION, not "pentration" as you spelled it there (one would think an anal penetration man from San Fran'd know how THAT is spelled at least, lol). Jeremiah Cornelius likes to troll others, but can't handle it when it's done in return showing he is illiterate -> http://slashdot.org/comments.pl?sid=2238996&cid=36457426 and that much is obvious. You fail troll. How many years did you leave your resume up there with that fail on it? Yes you have been trolled. You like? I wager you don't since you removed your faulty resume (on the very thing you took pride in that you can't even spell correctly most likely indicating you weren't any good at it either).

    15. Re:This summary is terrible by Anonymous Coward · · Score: -1

      Why'd ya pull yer resume off LinkedIn Jeremiah Cornelius -> http://slashdot.org/comments.pl?sid=3368135&cid=42529887 Is it since someone spotted you're not only a "San Fran 'Man'" (a fella is more like it) and that you can't even spell what you allegedly used to do for a job? It's PENETRATION, not "pentration" as you spelled it there (one would think an anal penetration man from San Fran'd know how THAT is spelled at least, lol). Jeremiah Cornelius likes to troll others, but can't handle it when it's done in return showing he is illiterate -> http://slashdot.org/comments.pl?sid=2238996&cid=36457426 and that much is obvious. You fail troll. How many years did you leave your resume up there with that fail on it? Yes you have been trolled. You like? I wager you don't since you removed your faulty resume (on the very thing you took pride in that you can't even spell correctly most likely indicating you weren't any good at it either).

    16. Re:This summary is terrible by Anonymous Coward · · Score: -1

      Why'd ya pull yer resume off LinkedIn Jeremiah Cornelius -> http://slashdot.org/comments.pl?sid=3368135&cid=42529887 Is it since someone spotted you're not only a "San Fran 'Man'" (a fella is more like it) and that you can't even spell what you allegedly used to do for a job? It's PENETRATION, not "pentration" as you spelled it there (one would think an anal penetration man from San Fran'd know how THAT is spelled at least, lol). Jeremiah Cornelius likes to troll others, but can't handle it when it's done in return showing he is illiterate -> http://slashdot.org/comments.pl?sid=2238996&cid=36457426 and that much is obvious. You fail troll. How many years did you leave your resume up there with that fail on it? Yes you have been trolled. You like? I wager you don't since you removed your faulty resume (on the very thing you took pride in that you can't even spell correctly most likely indicating you weren't any good at it either).

    17. Re:This summary is terrible by Anonymous Coward · · Score: -1

      Why'd ya pull yer resume off LinkedIn Jeremiah Cornelius -> http://slashdot.org/comments.pl?sid=3368135&cid=42529887 Is it since someone spotted you're not only a "San Fran 'Man'" (a fella is more like it) and that you can't even spell what you allegedly used to do for a job? It's correctly spelled PENETRATION, not "pentration" as you misspelled it there in front of 1,000's no doubt (one would think an anal penetration man from San Fran'd know how THAT is spelled at least, lol). Jeremiah Cornelius likes to troll others, but can't handle it when it's done in return showing he is illiterate -> http://slashdot.org/comments.pl?sid=2238996&cid=36457426 and that much is obvious. You fail troll. How many years did you leave your resume up there with that basic literacy fail on it? Yes you have been trolled. You like? I wager you don't since you removed your faulty resume (on the very thing you took pride in that you can't even spell correctly most likely indicating you weren't any good at it either).

    18. Re:This summary is terrible by Anonymous Coward · · Score: -1

      Why'd ya pull yer resume off LinkedIn Jeremiah Cornelius -> http://slashdot.org/comments.pl?sid=3368135&cid=42529887 Is it since someone spotted you're not only a "San Fran 'Man'" (a fella is more like it) and that you can't even spell what you allegedly used to do for a job? It's correctly spelled PENETRATION, not "pentration" as you misspelled it there in front of 1,000's no doubt (one would think an anal penetration man from San Fran'd know how THAT is spelled at least, lol). Jeremiah Cornelius likes to troll others, but can't handle it when it's done in return showing he is illiterate -> http://slashdot.org/comments.pl?sid=2238996&cid=36457426 and that much is obvious. You fail troll. How many years did you leave your resume up there with that basic literacy fail on it? Yes you have been trolled. You like? I wager you don't since you removed your faulty resume (on the very thing you took pride in that you can't even spell correctly most likely indicating you weren't any good at it either).

    19. Re:This summary is terrible by Anonymous Coward · · Score: -1

      Why'd ya pull yer resume off LinkedIn Jeremiah Cornelius -> http://slashdot.org/comments.pl?sid=3368135&cid=42529887 Is it since someone spotted you're not only a "San Fran 'Man'" (a fella is more like it) and that you can't even spell what you allegedly used to do for a job? It's correctly spelled PENETRATION, not "pentration" as you misspelled it there in front of 1,000's no doubt (one would think an anal penetration man from San Fran'd know how THAT is spelled at least, lol). Jeremiah Cornelius likes to troll others, but can't handle it when it's done in return showing he is illiterate -> http://slashdot.org/comments.pl?sid=2238996&cid=36457426 and that much is obvious. You fail troll. How many years did you leave your resume up there with that basic literacy fail on it? Yes you have been trolled. You like? I wager you don't since you removed your faulty resume (on the very thing you took pride in that you can't even spell correctly most likely indicating you weren't any good at it either).

    20. Re:This summary is terrible by Anonymous Coward · · Score: -1

      Why'd ya pull yer resume off LinkedIn Jeremiah Cornelius -> http://slashdot.org/comments.pl?sid=3368135&cid=42529887 Is it since someone spotted you're not only a "San Fran 'Man'" (a fella is more like it) and that you can't even spell what you allegedly used to do for a job? It's correctly spelled PENETRATION, not "pentration" as you misspelled it there in front of 1,000's no doubt (one would think an anal penetration man from San Fran'd know how THAT is spelled at least, lol). Jeremiah Cornelius likes to troll others, but can't handle it when it's done in return showing he is illiterate -> http://slashdot.org/comments.pl?sid=2238996&cid=36457426 and that much is obvious. You fail troll. How many years did you leave your resume up there with that basic literacy fail on it? Yes you have been trolled. You like? I wager you don't since you removed your faulty resume (on the very thing you took pride in that you can't even spell correctly most likely indicating you weren't any good at it either).

    21. Re:This summary is terrible by Anonymous Coward · · Score: -1

      Why'd ya pull yer resume off LinkedIn Jeremiah Cornelius -> http://slashdot.org/comments.pl?sid=3368135&cid=42529887 Is it since someone spotted you're not only a "San Fran 'Man'" (a fella is more like it) and that you can't even spell what you allegedly used to do for a job? It's correctly spelled PENETRATION, not "pentration" as you misspelled it there in front of 1,000's no doubt (one would think an anal penetration man from San Fran'd know how THAT is spelled at least, lol). Jeremiah Cornelius likes to troll others -> http://slashdot.org/comments.pl?sid=2238996&cid=36457426 , but can't handle it when it's done in return showing he is illiterate, and that much is obvious. You fail troll. How many years did you leave your resume up there with that basic literacy fail on it? Yes you have been trolled. You like? I wager you don't since you removed your faulty resume (on the very thing you took pride in that you can't even spell correctly most likely indicating you weren't any good at it either).

    22. Re:This summary is terrible by Anonymous Coward · · Score: -1

      Why'd ya pull yer resume off LinkedIn Jeremiah Cornelius -> http://slashdot.org/comments.pl?sid=3368135&cid=42529887 Is it since someone spotted you're not only a "San Fran 'Man'" (a fella is more like it) and that you can't even spell what you allegedly used to do for a job? It's correctly spelled PENETRATION, not "pentration" as you misspelled it there in front of 1,000's no doubt (one would think an anal penetration man from San Fran'd know how THAT is spelled at least, lol). Jeremiah Cornelius likes to troll others -> http://slashdot.org/comments.pl?sid=2238996&cid=36457426 , but can't handle it when it's done in return showing he is illiterate, and that much is obvious. You fail troll. How many years did you leave your resume up there with that basic literacy fail on it? Yes you have been trolled. You like? I wager you don't since you removed your faulty resume (on the very thing you took pride in that you can't even spell correctly most likely indicating you weren't any good at it either).

    23. Re:This summary is terrible by Anonymous Coward · · Score: 0

      Why'd ya pull yer resume off LinkedIn Jeremiah Cornelius -> http://slashdot.org/comments.pl?sid=3368135&cid=42529887 Is it since someone spotted you're not only a "San Fran 'Man'" (a fella is more like it) and that you can't even spell what you allegedly used to do for a job? It's correctly spelled PENETRATION, not "pentration" as you misspelled it there in front of 1,000's no doubt (one would think an anal penetration man from San Fran'd know how THAT is spelled at least, lol). Jeremiah Cornelius likes to troll others -> http://slashdot.org/comments.pl?sid=2238996&cid=36457426 , but can't handle it when it's done in return showing he is illiterate, and that much is obvious. You fail troll. How many years did you leave your resume up there with that basic literacy fail on it? Yes you have been trolled. You like? I wager you don't since you removed your faulty resume (on the very thing you took pride in that you can't even spell correctly most likely indicating you weren't any good at it either).

  4. To disable ntlm on old computers by Anonymous Coward · · Score: 0

    To disable ntlm on old computers I believe that if you enforce 14 character paswords it will stop working.

    But don't take my word for it.

    1. Re:To disable ntlm on old computers by Anonymous Coward · · Score: 0

      >14 chars disables LM, but not NTLM.

    2. Re:To disable ntlm on old computers by Anonymous Coward · · Score: 2, Funny

      >14 chars disables LM, but not NTLM.

      >14 character passwords also disables some users.

    3. Re:To disable ntlm on old computers by Anonymous Coward · · Score: 0

      ^^This^^

  5. A very real attack by enlefo · · Score: 1

    I'm been a victim of pass the hash attack... they can fuck you up pretty up pretty good.

    1. Re:A very real attack by Anonymous Coward · · Score: 1

      they can fuck you up pretty up pretty good

      From that... it sounds more likely you were the victim of a man-in-the-middle attack, either that or trojan horse or malware insersion.....

    2. Re:A very real attack by Aardpig · · Score: 4, Funny

      In fact, I think he may have been penetrated via a back-door.

      --
      Tubal-Cain smokes the white owl.
    3. Re:A very real attack by enlefo · · Score: 1

      Clearly y'all haven't been passed hash before...

  6. So... by futhermocker · · Score: 1

    Smoking hashes is bad for your windows?

    --
    KERNEL PANIC -SIGFAULT AT ADDRESS #51A54D07
    1. Re:So... by Mike+Frett · · Score: 1

      No, Windows is bad for your Hash. Just add some Penguins to your Hash and it should be alright.

  7. How to harden an XP machine ? by Taco+Cowboy · · Score: 2

    We still have quite a number of XP machines in our front office.

    How to harden those XP machines and make them use NTLM2 instead?

    Thanks !!

    --
    Muchas Gracias, Señor Edward Snowden !
    1. Re:How to harden an XP machine ? by Dr.Who · · Score: 5, Informative

      The Microsoft article http://support.microsoft.com/kb/2793313 referenced above points to http://technet.microsoft.com/library/cc960646.aspx

    2. Re:How to harden an XP machine ? by Jaime2 · · Score: 1

      XP already uses NTLMv2. You really want to make it refuse to do NTLMv1 and LM. The link in the summary tells you how.

    3. Re:How to harden an XP machine ? by yuhong · · Score: 5, Informative

      You can also use Group Policy:
      http://technet.microsoft.com/en-us/library/cc738867(v=ws.10).aspx

    4. Re:How to harden an XP machine ? by Anonymous Coward · · Score: 5, Funny

      How to harden those XP machines and make them use NTLM2 instead?

      My blanket recommendation for hardening XP machines is to encase them in concrete.

    5. Re:How to harden an XP machine ? by rb12345 · · Score: 3, Informative

      By default, XP allows inbound NTLMv2 authentication from remote clients but does not use it outbound to authenticate to remote servers. The same setting that makes XP refuse LM/NTLM also enables outbound NTLMv2.

    6. Re:How to harden an XP machine ? by Anonymous Coward · · Score: 1

      How to harden those XP machines and make them use NTLM2 instead?

      My blanket recommendation for hardening XP machines is to encase them in concrete.

      But I sell Lucite computer encasement kits, you insensitive clod!

    7. Re:How to harden an XP machine ? by Anonymous Coward · · Score: 1

      | You can also use Group Policy:
      | http://technet.microsoft.com/en-us/library/cc738867(v=ws.10).aspx

      Or just cut out the middleman. If one downloads the fixit package the result is a ridiculous 1 MB .msi file, which merely runs a small, embedded VBScript, which changes a single Registry setting:

      HKLM\System\CurrentControlSet\control\LSA\LMCompatibilityLevel
      DWORD value: 3

    8. Re:How to harden an XP machine ? by operagost · · Score: 2

      Even on a machine without AD, you can at least use Local Security Policy to access the setting in the Network Security category. Why they tell you to hack the registry, I don't know. While you're there, you should also enable "Do not store LAN Manager hash" and "Do not allow anonymous enumeration of SAM accounts and shares" (the latter only if you have no NT 4 domains or NT/9x clients).

      --

      Gamingmuseum.com: Give your 3D accelerator a rest.
    9. Re:How to harden an XP machine ? by yuhong · · Score: 1

      XP Home don't have Group Policy.

  8. This can be set via Group Policy by yuhong · · Score: 2

    http://technet.microsoft.com/en-us/library/cc738867(v=ws.10).aspx

  9. Secure Networks vs. Insecure Networks by Cassini2 · · Score: 4, Insightful

    The crucial detail is whether the physical layer of the network can be trusted. If the physical layer is trusted, then NTLM works fine. Historically, lots of corporate networks controlled every computer on the office network, and air-gapped the internet.

    Many modern networks, including wireless networks, have a non-trust worthy physical layer. In this case, only end-to-end encryption protects the network. Yes, the newer versions NTLM protect against the most obvious password scanning attacks. However, with a non-trust worthy physical layer, it is possible to simply scan all the network traffic and get the file contents from the network directly. Also, some (almost all?) ODBC and database servers send passwords in the clear. This makes it straightforward to do simple network traffic analysis attacks, and directly gather valuable information from the company network.

    The bottom line is that only protocols like SSH work against a non-trustworthy physical layer.

    1. Re:Secure Networks vs. Insecure Networks by petermgreen · · Score: 1

      . If the physical layer is trusted, then NTLM works fine. Historically, lots of corporate networks controlled every computer on the office network, and air-gapped the internet.

      To what extent did they control them though? The bigger a network gets the more chance of a rouge device getting on it either through compromise of a machine that was legitimately there or through introducing a machine illegitimately.

      --
      note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register
    2. Re:Secure Networks vs. Insecure Networks by Anonymous Coward · · Score: 0

      What kind of rouge device runs Windows?!

    3. Re:Secure Networks vs. Insecure Networks by Anonymous Coward · · Score: 0

      He shows a phishing attacker where the user sends the hash. The attacker doesn't have to compromise your network.

    4. Re:Secure Networks vs. Insecure Networks by Cassini2 · · Score: 1

      To acheive any kind of security with Windows NT 3.5/4.0, you really need to control the physical layer thoroughly. Any device on the network is a potential source for untrusted code. Once you had untrusted code running on the computer, the network was compromised.

      With Windows XP and Windows 7, it's pretty much impossible to lock down the computers. The security certifications that Microsoft had for Windows NT 4.0 no longer exist.

      The only current desktop operating system technology that is equivalent to the security I was deploying with Windows NT 4.0 is SE Linux.

    5. Re:Secure Networks vs. Insecure Networks by Anonymous Coward · · Score: 0

      Or Kerberos. You can secure ssh sessions with Kerberos, and AD is actually a very good implementation of it.

    6. Re:Secure Networks vs. Insecure Networks by greg1104 · · Score: 3, Informative

      Also, some (almost all?) ODBC and database servers send passwords in the clear.

      Many database servers allow encrypted passwords, but there are surely a lot of database installations that don't take advantage of it. In PostgreSQL you can use SSL for the client network connection, which ODBC passes through. Setup SSL as the only way to connect, and encryption has to happen before it hits the wire. MySQL has a similar trick. Both are just using the OpenSSL library under the hood to encrypt the network traffic.

      On the commercial side, Oracle does the same thing with ORA_ENCRYPT_LOGIN. SQL Server has client and server settings that enforce encryption. Basically, if your database traffic isn't encrypted, it's more likely because someone didn't think that was important than because it was impossible. It's a simple checkbox to add to database selection requirements, and it's not hard to find a DBMS that has the capability.

      I find people who just stuff user passwords into the database (which can be the same passwords as other services) rather than putting password encryption into their application can also leak data. In PostgreSQL using the built-in pgcrypto makes that easy. You also have to be careful to use the same network encryption approach for any replication client, or it's possible to just sniff that instead to get the data. In Postgres those connect with the same encryption possible options as any other client. Most of the tutorials on setting up replication don't cover this though.

    7. Re:Secure Networks vs. Insecure Networks by codewarren · · Score: 1

      The crucial detail is whether the physical layer of the network can be trusted

      Someone maintains that physical layer. Even if they are employees of the company, it doesn't follow that they can be trusted. Someone with access to the physical layer and an NTLM hack could "become" anyone else on the network and do whatever he wanted with little fear of getting caught.

      Put another way, If everyone that was employed by the company could be trusted, they could all share the same login with unlimited access. If that makes you cringe, then so should NTLM. I think that's the point of the article.

    8. Re:Secure Networks vs. Insecure Networks by operagost · · Score: 1

      I'm not sure what you mean with XP and 7 (and I assume Vista). Those are client systems. No, they don't offer Kerberos services. You need the server product. As client systems, they are far superior to NT 3.x and 4.0. Your "impossible to lock down" statement is just a setup for Linux fanboyism.

      --

      Gamingmuseum.com: Give your 3D accelerator a rest.
    9. Re:Secure Networks vs. Insecure Networks by Anonymous Coward · · Score: 0

      Server 2012 is to SELinux as a bank vault is to a safety box.

    10. Re:Secure Networks vs. Insecure Networks by Anonymous Coward · · Score: 0

      What kind of rouge device runs Windows?!

      A compact one. Most women keep them around for touch ups.

  10. Tobacco Cutting Machine by tobaccocutter · · Score: -1, Offtopic

    Good. Helpful for me. http://www.tobaccomachine-leafshredder.com/

  11. Simple - secpol.msc (local one or AD level) by Anonymous Coward · · Score: 0, Informative

    Once in either version (I'd do it from the global group policy settings from the AD admin level), follow this down thru the left-hand side pane tree items:

    Security Settings -> Local Policies -> Security Options

    Then, in the right-hand pane, go to Network Security grouped section.

    There, use the "LAN Manager Authentication Level" & set it to NTLMv2 (refuse others, ONLY IF you don't have a "mixed mode" type domain setup, meaning machines or servers that MUST use NTLMv1).

    There's about 10 others in that group too (In Windows 7 that is, I don't recall THAT many in earlier models, but that's just me operating on memory alone though & it's been YEARS since I even used Server 2003 or XP).

    So - depending on the version of Windows you're doing this on?

    It varies!

    ( & iirc, it got MORE 'stringent & complex' in each version, but all the NTLM stuff is RIGHT THERE in them all - in Windows 7/Server 2008 onwards, you can even set 'exception machines' up too).

    APK

    P.S.=> Of course, there's also the EASY WAY OUT, via the "FixIt Tool" Microsoft put out today as well, here -> http://support.microsoft.com/kb/2793313 which give a GOOD RUNDOWN of what's going on in it too...

    ... apk

  12. Addendum: By "AD Level"? Meant gpedit.msc by Anonymous Coward · · Score: -1

    That's your Group Policy tool (secpol.msc, the mmc.exe snapin that I mentioned earlier is pretty much only a SUBSET of that, but more focused on security-based policies)...

    Again - Do it as the Network AD admin, makes it simpler than doing it machine-by-machine (or even using the "FIX IT" Tool I noted from MS they released today).

    * There you go!

    APK

    P.S.=> Sorry about that, not that it really matters, but it's best to give COMPLETE information when possible (I am beat tired today is all, had to kick out some tenants & had to clean the hell out of the place too after working ontop of it - I'm just shot, but that above should "complete the picture")...

    ... apk

  13. Old news by Anonymous Coward · · Score: 0

    Folks have known, for years, that windows hashes are password equivalent. Grab a hash, don't bother decrypting the pword, since you can use the hash directly.

    With all the issues with windows pwords/pword hashes, it appears if MS could do something wrong with handling pwords, they did.

    1. Re:Old news by Anonymous Coward · · Score: 0

      Great reading skills dude. This is not about pass the hash. It's about getting the hash without admin rights. Getting the user to send the hash. The hash can now be derived in a day via the observed challenge and response. It might be good to actually read the article.

  14. Here's why by ArchieBunker · · Score: 0

    The submitter has a hardon for Linux and is giddy that the authentication mechanism for an OS that is over a decade old now can be broken.

    --
    Only the State obtains its revenue by coercion. - Murray Rothbard
    1. Re:Here's why by arth1 · · Score: 5, Informative

      I'd say this affects Linux too - a bunch of machines with Samba are quite possibly vulnerable, and need a different settings change than what Windows does.
      At a minimum, the following in the smb.conf

      [global]
          client ntlmv2 auth = yes
          lanman auth = no
          ntlm auth = no

      For winbindd, a recompile might be required.

    2. Re:Here's why by Anonymous Coward · · Score: 0

      Yeah, totally not because this affects 40% of the computers in production.

  15. Many many thanks to all !! by Taco+Cowboy · · Score: 0

    Thanks for the informative info that you've so generously shared !!

    Thanks again !!

    --
    Muchas Gracias, Señor Edward Snowden !
  16. Net Net use the settings recommended for years now by Anonymous Coward · · Score: 0

    While the blog is interesting and useful all it does it reenforce what any windows network admin worth his salt has known and been told for years from Microsoft.
    I've not seen a domain where that policylevel 3 (or higher) isn't force by gpo in a couple years, though no doubt I'm sure they're out there, the last case i did see involved a company that just refused to migrate two win2k boxes they were still using on their network for some other piece of software they refused to upgrade. If your company has competent admins and doesn't have a bunch of old win2k or not service packed win3k boxes you should already be set, and even if your not it's easy fix in most environments.

    .

  17. Re:It is called WIndows 7 by Billly+Gates · · Score: 5, Insightful

    It is time to get with the times.

    Yes, I worked in corporate I.T. before and know all the tired arguments. The OS will turn 13 years old later this year. 13 years?!

    Not to mention XP SP 3 after 800 or so updates is slower and not the speed daemon it once was as 9 out of 10 CPU cycles are work around exploits. Stop defining yourselves and your ego on an OS made by the same people who wrote IE 6?

    The idea for security in XP is from the last century where all you needed is a good password. It lacks things a modern internet enabled OS have today. It is not a trendmill at this point nor is MS being evil to the mean old beancounters who refuse to see hidden costs and just licensing on a spreadsheet in excel. This story, the one on IE 6-8 being vulnerably last week on slashdot, and many others stating XP is so primptive because it doesn't have protected mode, ASLR, are DEP fully (only a few things have that on XP).

    If you ask this because your IT department has no plans to upgrade then another job who treat your profession and seriousness with respect.. They are incompetent and when shit hits the fan and social security numbers are stolen you will get the blame as the cost center and be let go anyway.

    It is obvious with the latest security issues in IE6, IE 7-8 (in non protected mode), XP, and now this that it is time to let it go instead of workaround it. Investing time and money into it is like investing cash into a car with 200,000 miles.

    These costs are real and so are the liabilities. Grow a pair and sell yourself the cheap asshats at your company? You are not saving anything by keeping an outdated insecure infrastructure and it is not unreasonable to upgrade to a 3 year old OS.

    --
    http://saveie6.com/
  18. And the big question is ... by GNUALMAFUERTE · · Score: -1, Flamebait

    Why the fuck people still trust microsoft?

    They keep coming up with more retarded, proprietary technologies that don't seem to solve any particular issue, and are solutions looking for a problem ... and eventually turn into huge problems themselves.

    --
    WTF am I doing replying to an AC at 5 A.M on a Friday night?
    1. Re:And the big question is ... by Anonymous Coward · · Score: 0

      Why the fuck people still trust microsoft?

      Because Open Sores trolls and Apple fanboys still have no fucking answer to MSSQL, Exchange, or Office.

      That's fucking why.

      Hey, you asked.

    2. Re:And the big question is ... by Anonymous Coward · · Score: 0

      So why do home users use Windows?
      MSSQL and Exchange are totally irrelevant at home, and there are any number of word processors (the only part of Office that matters to a home user) people could use.

    3. Re:And the big question is ... by aztracker1 · · Score: 1

      Although GP is flamebait at best.. Because when LM and original NTLM were created it was an issue, and in 2003 compatibility was an issue, is why it is still around.

      That said, I will say that for most people's needs there are plenty of adequate solutions. I find that LibreOffice(and OOo) do a decent job. PostgreSQL in many ways exceeds what MS-SQL does, and there are some decent integrated mail/calendar servers... I do think that Exchange is to this day best in it's class, and there are some features of MS Office that will lock some in. However, the fact is, most people don't need any MS software.

      NOTE: I make my living doing software dev in an MS centered environment.

      --
      Michael J. Ryan - tracker1.info
    4. Re:And the big question is ... by Anonymous Coward · · Score: 0

      I don't see how this relates to this article. Security experts are constantly looking for vulnerabilities in all platforms.

    5. Re:And the big question is ... by Anonymous Coward · · Score: 0

      Runs faster than Linux desktop.

    6. Re:And the big question is ... by BradleyUffner · · Score: 3, Insightful

      So why do home users use Windows?

      Because they don't want to deal with stuff like this just to get sound working.
      https://wiki.archlinux.org/index.php/Advanced_Linux_Sound_Architecture

    7. Re:And the big question is ... by mstefanro · · Score: 1

      I remember trying most of the relevant stuff on that page on archlinux and still not getting the sound to work properly.

    8. Re:And the big question is ... by Anonymous Coward · · Score: 0

      Bull. It's familiar, and most software is written for it. That's the primary reason. Windows is not faster by the time you add on all the security required to protect it.

    9. Re:And the big question is ... by GNUALMAFUERTE · · Score: 1

      Ah, you are right. That's why MySQL has a bigger marketshare than mssql, all serious mailservers use either sendmail, postfix or qmail, and LibreOffice is close to a 25% market share.

      --
      WTF am I doing replying to an AC at 5 A.M on a Friday night?
    10. Re:And the big question is ... by GNUALMAFUERTE · · Score: 1

      I love how lately saying the truth is flamebaiting/trolling.

      What issue was there back in 2003?

      Microsoft tried to steer the market away from TCP/IP. It took them ages to get proper TCP/IP support, and when they did, they stole most of it from BSD (this was proven in the famous windows 2k code leak). They hate standards because it makes it harder to lock in their customers. NTLM is nothing but crapware designed to lock-in people. Really, explain WHAT exactly is it that NTLM solves/fixes, now or 10 years ago?

      --
      WTF am I doing replying to an AC at 5 A.M on a Friday night?
    11. Re:And the big question is ... by aztracker1 · · Score: 1

      NTLM is a bit more than 10 years old... Hell v2 which addressed most of the OP issues is older than that. LM was created in the late 80s iirc. As for the BSD code in the NT network stack, that had been known for long before the code leak... It's been noted in license documents for over a decade. Why because BSD coffee is allowed in closed source programs. The post I referred to is flame bait because it is... Your post wasn't about truth, it's about hate. I don't love Microsoft, but I certainly don't hate them. Maybe you should double check what you think you know before spouting off.

      --
      Michael J. Ryan - tracker1.info
    12. Re:And the big question is ... by aztracker1 · · Score: 1

      Looks like LM 1.0 was released in 1987, and NTLM in 1993...

      --
      Michael J. Ryan - tracker1.info
    13. Re:And the big question is ... by Anonymous Coward · · Score: 0

      I love how lately saying the truth is flamebaiting/trolling.

      I love when a known associate of Roy Schestowitz cries about "truth". You've been smoking his propaganda pipe for a long time.

    14. Re:And the big question is ... by GNUALMAFUERTE · · Score: 1

      What the fuck are you talking about, you retard?

      --
      WTF am I doing replying to an AC at 5 A.M on a Friday night?
  19. Re:IE 6 apps wont work with NTLMv2 by Billly+Gates · · Score: 0

    It is a big problem if you are moving to WIndows 7 on the client side and they are trying to virtualize IE 6/XP/Server 2k3 for their apps. If you upgrade then the authentication will fail. Many are dragging their feet so they do not have to deal with this until 2014.

    --
    http://saveie6.com/
  20. The most notable nike free 3.0 dame by nikenfljerseyss · · Score: -1, Offtopic

    The most notable nike free 3.0 dame building cheap nike is Prince Lucien asics shoes Campbell Nike Free Shoes Hall, asics running shoes the nike free run tallest, ugliest building on nike free campus. cheap nike frees According to nike free kids legend, visit a grad student committed suicide by home jumping from click the Billige Nike Free Tilbud 8th floor. nike free running Veronica Lee welcome is really nike free 3.0 hot nike free norge and nike free run norge she used Nike Free Danmark to work in Prince Lucien Campbell Hall, nike free run womens she went nike free nz on jeopardy's nike free run dk college nike free 3 championships Nike Free Sko and lost.

  21. god DAMMIT by Anonymous Coward · · Score: 0

    Oh FUCK. ME. Sigh. "Guess I know what I'm doing tomorrow."

  22. Learn to spell Jeremiah Cornelius by Anonymous Coward · · Score: 0, Troll

    It's PENETRATION, not "Pentration" as you spell it on your resume, BOY -> http://www.linkedin.com/pub/jeremiah-cornelius-cissp-issap/2/620/a58

    * So much for your "I am a black man" b.s. too (which also makes you a liar)...

    Ah yes - NOW?

    Now, I know who & WHAT you are, as well as where you are/from, too, you troll...

    (A "San Fran Man" TOO I see, lol... you KNOW what they say about those, rotflmao!)

    * Your location pretty much EXPLAINS why you act more like a WOMAN than a MAN then, & why you 'troll' others -> http://slashdot.org/comments.pl?sid=2238996&cid=36457426

    (OH, don't worry - I took a screenshot of that, so that even AFTER you alter it for CORRECT SPELLING, I can laugh @ you about it too... HOW MANY YEARS HAVE YOU LEFT IT THAT WAY?)

    APK

    P.S.=>

    "Used to do pen/vuln. No more." - by Jeremiah Cornelius (137) on Tuesday January 08, @09:32PM (#42527343) Homepage

    So you're also MERELY A USER OF TOOLS THAT GUYS LIKE MYSELF WROTE FOR YOU TO "USE"... nothing more - figures!

    That's ALL THAT TYPE IS - even the CISSP's I've met as well!

    I also saw a LOT of "consultant" in there too - the BULLSHITTERS of the INDUSTRY, no questions asked, lol!

    (Fact, because WITHOUT those tools? You couldn't do a DAMNED THING!)...

    ... apk

    1. Re:Learn to spell Jeremiah Cornelius by Anonymous Coward · · Score: 0

      I find it interesting that you're willing to totally rip into him (I didn't read the posts so I don't know if he deserved it or not) anonymously. That's fucking rich.

    2. Re:Learn to spell Jeremiah Cornelius by Anonymous Coward · · Score: 0

      Trying to defend yourself by ac posts Jeremiah Cornelius? It fools no one.

    3. Re:Learn to spell Jeremiah Cornelius by Anonymous Coward · · Score: 0

      Hahahaha Jeremiah Cornelius needs to get "hooked on phonics" special edition for resume writers.

    4. Re:Learn to spell Jeremiah Cornelius by Anonymous Coward · · Score: 0

      Better than Jeremiah 'ripping into im' the san fran man way by anal penetration.

    5. Re:Learn to spell Jeremiah Cornelius by Anonymous Coward · · Score: 0

      I find it interesting a 'fella' from San Fran misspells penetration (anal penetration's big there)

    6. Re:Learn to spell Jeremiah Cornelius by Anonymous Coward · · Score: 0

      Haha, ya got to Jeremiah Cornelius - he pulled his resume off LinkedIn.

    7. Re:Learn to spell Jeremiah Cornelius by Anonymous Coward · · Score: 0

      APK puts the A in asshole eh? Its pathetic to think he deludes himself that he wins, poor little midget!

  23. Wait, you're telling me XP is insecure? by Arancaytar · · Score: 1

    Holy SHIT!

  24. Re:It is called WIndows 7 by Sigg3.net · · Score: 2

    Win is great for business, just turn off every bells and whistle and you will have an XP like experience.

    OpenSUSE is better IMHO, but win7 should not be overlooked.

    Recently did some work on a pristine Win8. It works just like Unity..

    --
    Defining Statistics and Social Research
  25. W3 schools by mstefanro · · Score: 1

    Who would've thought a day would come when W3-schools is used as a reference in a non-humorous way?

  26. Re:It is called WIndows 7 by Anonymous Coward · · Score: 0

    You worked in corp IT and you think it is as easy as flipping a switch to make the change? Unlike the home enthusiast who doesn't mind learning the in/outs of a new OS many corporate users are task focused. The computer is a tool the same as a phone. For better/worse those users have no more interest in how the computer works than I have in the innards of my car's manual transmission. As long as it works I'm happy. If it doesn't I see an expert. You may consider the change from Win XP to Win 7 to be minor but for millions of corporate users any change can be huge and require training which is a double whammie of cost and lost productivity time. From a TCO perspective it is much cheaper to patch and manage than upgrade. The benefits of Win 7 are intangible to the end corporate users.

  27. Re:It is called WIndows 7 by Anonymous Coward · · Score: 1

    9 out of 10 CPU cycles are work around exploits

    No.

    Yes it is more bloated now than the initial release and slower as a result, not helped by all the stuff installed on it now which uses more CPU than an equivalent program would have used 15 years ago, plus your AV program probably is checking every file/web access (but not Windows itself). But...

    It isn't consuming most of its time actively running additional code to prevent exploits. Almost every exploit is corrected by correcting the original code to fix the bug that allows a buffer/integer overflow etc. Not by keeping the original code and installing extra code to filter the inputs to it.

  28. JC the troll can dish it out, but can't take it by Anonymous Coward · · Score: -1

    Trying to "hide this" Jeremiah Cornelius? LMAO -> http://slashdot.org/comments.pl?sid=3368135&cid=42529887 via downmods?

    Yes - that's YOUR STYLE, bullshit artist troll that you are. YOU CAN'T EVEN SPELL WHAT IT IS YOU CLAIM TO DO RIGHT, lol, for Pete's sake!

    Jeremiah Cornelius = 'evangelist/consultant' (bullshitters), & yes, troll too (by his OWN admission quoted in the link above). CISSP? Bah - CHUMP work (you merely use tools guys like MYSELF, actual coders, produce for you to USE, user!).

    * YOU have been trolled - you like?

    (You, your pals webmistressrachel, countertrolling, gmhowell, & the LONG NOW GONE Barbara, not Barbie alias tomhudson MULTIPLE ACCOUNT USING TROLL I busted & ran off sure like to dish it out, but you can't TAKE IT in return...)

    APK

    P.S.=> No, like I said, for all of you trolling me for years here? I am going to do it back to YOU, so you & yours learn a lesson!

    (I already took care of webmistressrachel, & tomhudson/Barbara, not Barbie (showing them BOTH terribly technically weak in computing MANY times) - & I told you YOU were next - just to teach YOU & YOURS ala trolltalk.com a lesson... here 'tis, & it's JUST THE START! Payback is a BITCH, troll!)

    ... apk

    1. Re:JC the troll can dish it out, but can't take it by Anonymous Coward · · Score: 0

      looks like someone's off their meds.

    2. Re:JC the troll can dish it out, but can't take it by Anonymous Coward · · Score: 0

      Sentences start with capital letters Jeremiah. Learn to write and spell. Posting as ac to attempt to defend yourself against your blatant mess of a resume isn't working either. Fix it. How many years has that been that way was the question. Only you can answer it and answer to yourself on that rather grievous error which is very funny since you claimed you do it as a job but you cannot even spell it properly. I see you're a known troll around here also from your posting history. Standard practice stale old so called comeback, Jeremiah? Please. Projecting your own issues onto others seems to be a trend for you judging by your post history as well. Do consider taking your meds instead of projecting your faults onto others, and learn to write and spell please.

    3. Re:JC the troll can dish it out, but can't take it by Anonymous Coward · · Score: 0

      Jeremiah's been doing bathsalts at the gay bath house in San Fran again (he finds it "penetrating", as in anally, hahaha)

  29. Re:It is called WIndows 7 by thoromyr · · Score: 1

    you may have worked in corporate IT but you have no clue. What is your source for wild ass claims like "9 out of 10 CPU cycles are work around exploits"? Oh, right, you pulled that out of your ass -- an invented statistic to try and make XP look bad. The problem with that claim is that it is patently false as is obvious not only to anyone with a clue about CPUs, application execution, or anything related -- but even to anyone who gives it a passing thought (for one, your assertion implies 1/10 the performance of an unpatched XP box). Someone who runs XP and installs Vista, Win7 or Win8 is (very likely*) going to experience a slow down, not a speed up. In general, people are aware that XP is "faster" than its successors and when you use lies to bolster your case you actually weaken it.

    The claim that "security in XP is from the last century where all you needed is a good password" also shows your utter and complete ignorance of XP and security architectures. Of course, you don't offer a single item to backup your claim. It would be hard to, unless you made it up on the spot like your statistic from above, as it simply isn't true.

    That isn't to say that people shouldn't be moving off of XP. But they should do it for real reasons, not some made up crap, and posting obvious lies only weakens that case.

    Its amazing that such a stupid post got modded insightful. Then again, this *is* slashdot...

    * except for blind fans of Microsoft, it is apparent that the successors of XP require more resources. This really shouldn't come as a surprise to anyone, but one consequence is that a system spec'd for XP is going to be under spec for Vista/Win7/Win8 and run slower. Potentially a lot slower (particularly dependent on how much RAM they have). Of course, MS has managed to shave a little off of boot time and there are other minor improvements such as the infinitesimal gain from disabling recording of access times (on a local file system of decent design -- which NTFS has -- there is no perceptible improvement).

  30. Re:It is called WIndows 7 by operagost · · Score: 1

    It is not a trendmill at this point nor is MS being evil to the mean old beancounters who refuse to see hidden costs and just licensing on a spreadsheet in excel. This story, the one on IE 6-8 being vulnerably last week on slashdot, and many others stating XP is so primptive because it doesn't have protected mode, ASLR, are DEP fully (only a few things have that on XP).

    Anyone have a Gibberish-English dictionary?

    --

    Gamingmuseum.com: Give your 3D accelerator a rest.
  31. Set Samba to require NTLMv2 hashes (:-)) by davecb · · Score: 2

    See https://www.samba.org/samba/docs/man/manpages-3/smb.conf.5.html#NTLMAUTH

    If you set ntlm auth = no, then Samba will reject plain NTLM and require either NTLM v2 (the normal case) or LANMAN (if you have bizzarely backdated your XP box). There is a risk that some software w2ill fail, so it's probably best if you create a pair of virtual servers, and set one up to use NTLMv2. As you find out what fails, you can move the unbroken services to the v2 server.

    --dave

    --
    davecb@spamcop.net
  32. Re:It is called WIndows 7 by Billly+Gates · · Score: 1

    "The claim that "security in XP is from the last century where all you needed is a good password" also shows your utter and complete ignorance of XP and security architectures"

    Right, you mean how in XP there is an IMPERSONATION SERVICE where a user mode program can run with kernel mode priveldges and impersonate a critical service?!

    No ASLR, limited DEP, no priveldge seperation in the code. Yeah, XP is last century security wise which is fine as other operating systems from the 20th century lacked those as well.

    "you may have worked in corporate IT but you have no clue. What is your source for wild ass claims like "9 out of 10 CPU cycles are work around exploits"? Oh, right, you pulled that out of your ass -- an invented statistic to try and make XP look bad"

    Yeah, I am making it look bad because in 2013 it is bad. You are telling me after 1,000+ exploits there is no performance penalty or advanced filtering for every input and i/o after 12 years? THe fact of the matter is XP ran good on 128 megs of ram on a Pentium II 300 mhz in 2001. Why can't I run it like this. The answer is because of +700 patches.

    I look at XP like a boat with holes all over encased with 3 feet of bandaids. I have not looked at hte source code and neither have you. I do not have to rely on fake statistics. Look at the evidence of it today? I can not see how it is possible to fix all the exploits without breaking apps.

    My only explanaition is double the code size and filtering out every i/o and input due to the architecture not being able to withstand the malware we have today. NTLM is yet another example, while IE 6 - 8 while still being patched is not being hacked as I typed this because it can not run in protected mode in XP.

    --
    http://saveie6.com/
  33. Re:It is called WIndows 7 by Billly+Gates · · Score: 1

    You worked in corp IT and you think it is as easy as flipping a switch to make the change? Unlike the home enthusiast who doesn't mind learning the in/outs of a new OS many corporate users are task focused. The computer is a tool the same as a phone. For better/worse those users have no more interest in how the computer works than I have in the innards of my car's manual transmission. As long as it works I'm happy. If it doesn't I see an expert. You may consider the change from Win XP to Win 7 to be minor but for millions of corporate users any change can be huge and require training which is a double whammie of cost and lost productivity time. From a TCO perspective it is much cheaper to patch and manage than upgrade. The benefits of Win 7 are intangible to the end corporate users.

    13 years is not the same timeframe as flipping a switch. From a TCO being hacked is very high as well as all sorts of security issues and not being able to log onto vendor/client portals, not being able to read Photoshop, autocad, and office 2013 files from users and other vendors, suppliers, and customers. XP already is getting more expensive to maintain than to keep current and it will get worse and worse.

    As an IT professional it is your responsibility to keep your infrastructure secure and up to date. If shit happens from this exploit (one out of other examples) whose head will be on the chopping block? YOU!

    THerefore, it is your job to go over the risks and do not tell me users do not know how to use Windows 7? It is similiar to XP, and users have been using it at home now and its Vista cousin for years as well. Do your job!

    --
    http://saveie6.com/
  34. Downmods to hide you're illiterate troll? LMAO! by Anonymous Coward · · Score: 0

    Trying to "hide this" Jeremiah Cornelius? LMAO -> http://slashdot.org/comments.pl?sid=3368135&cid=42529887 via downmods?

    Yes - that's YOUR STYLE, bullshit artist troll that you are. YOU CAN'T EVEN SPELL WHAT IT IS YOU CLAIM TO DO RIGHT, lol, for Pete's sake!

    Jeremiah Cornelius = 'evangelist/consultant' (bullshitters), & yes, troll too (by his OWN admission quoted in the link above). CISSP? Bah - CHUMP work (you merely use tools guys like MYSELF, actual coders, produce for you to USE, user!).

    * YOU have been trolled - you like?

    (You, your pals webmistressrachel, countertrolling, gmhowell, & the LONG NOW GONE Barbara, not Barbie alias tomhudson MULTIPLE ACCOUNT USING TROLL I busted & ran off sure like to dish it out, but you can't TAKE IT in return...)

    APK

    P.S.=> No, like I said, for all of you trolling me for years here? I am going to do it back to YOU, so you & yours learn a lesson!

    (I already took care of webmistressrachel, & tomhudson/Barbara, not Barbie (showing them BOTH terribly technically weak in computing MANY times) - & I told you YOU were next - just to teach YOU & YOURS ala trolltalk.com a lesson... here 'tis, & it's JUST THE START! Payback is a BITCH, troll!)

    ... apk

    1. Re:Downmods to hide you're illiterate troll? LMAO! by Anonymous Coward · · Score: 0

      Illiteracy? I believe that you should examine your own construction, punctuation and spelling.

      The headline of your posting includes two non-sentence fragments, with serious ambiguity problems.

      Your final sentence abuses the parenthesis, and nests parenthetical statements that destroy English readability.

      Between these two examples, everything else is a similar train-wreck.

    2. Re:Downmods to hide you're illiterate troll? LMAO! by Anonymous Coward · · Score: 0

      Jeremiah Cornelius posting as AC to try defend yourself's not working. The topic isn't about grammar. That also makes you off topic. Double fail. No, triple fail because you can't even spell what you do for a living correctly http://slashdot.org/comments.pl?sid=3368135&cid=42529887 and from what I read there, you are a known troll that hangs around with other trolls that use multiple accounts to down moderate others also, hence, the down moderations to attempt to hide your massive mess of a resume where you can't even spell what you allegedly do for a living correct. Now, that's hilariously droll.

  35. FUD by Anonymous Coward · · Score: 0

    You would have to be on the network to capture the packets in the first place. Security starts with the door.

  36. Jeremiah Cornholekneelius = 'penetration' expert by Anonymous Coward · · Score: 0

    He's from San Francisco! Men there know anal penetration, hahaha.

  37. Re:Jeremiah Cornholekneelius = 'penetration' exper by Anonymous Coward · · Score: 0

    ROTFLMAO. Not exactly on his resume but makes sense. He's a San Fran man.

  38. Re:It is called WIndows 7 by Tharkkun · · Score: 1

    "The claim that "security in XP is from the last century where all you needed is a good password" also shows your utter and complete ignorance of XP and security architectures"

    Right, you mean how in XP there is an IMPERSONATION SERVICE where a user mode program can run with kernel mode priveldges and impersonate a critical service?!

    No ASLR, limited DEP, no priveldge seperation in the code. Yeah, XP is last century security wise which is fine as other operating systems from the 20th century lacked those as well.

    "you may have worked in corporate IT but you have no clue. What is your source for wild ass claims like "9 out of 10 CPU cycles are work around exploits"? Oh, right, you pulled that out of your ass -- an invented statistic to try and make XP look bad"

    Yeah, I am making it look bad because in 2013 it is bad. You are telling me after 1,000+ exploits there is no performance penalty or advanced filtering for every input and i/o after 12 years? THe fact of the matter is XP ran good on 128 megs of ram on a Pentium II 300 mhz in 2001. Why can't I run it like this. The answer is because of +700 patches.

    I look at XP like a boat with holes all over encased with 3 feet of bandaids. I have not looked at hte source code and neither have you. I do not have to rely on fake statistics. Look at the evidence of it today? I can not see how it is possible to fix all the exploits without breaking apps.

    My only explanaition is double the code size and filtering out every i/o and input due to the architecture not being able to withstand the malware we have today. NTLM is yet another example, while IE 6 - 8 while still being patched is not being hacked as I typed this because it can not run in protected mode in XP.

    XP never once ran good on 128mb's of ram. Window 98 maybe, but not 2000 or XP. 512MB minimum for solid performance.

  39. Re:It is called WIndows 7 by Bert64 · · Score: 1

    No ASLR, limited DEP, no priveldge seperation in the code. Yeah, XP is last century security wise which is fine as other operating systems from the 20th century lacked those as well.

    ASLR was first implemented in July 2001, as part of the pax patch for linux... So it's about as old as XP.
    The idea of DEP was partially implemented much earlier, SunOS 4.x and Digital Unix 3.x had non executable stack areas, Linux had a patch to implement such too, it wasn't until much later that AMD implemented direct hardware support for non executable pages on x86, but it was effectively emulated in software long before that.

    The idea of layers of filtering slowing down XP is ridiculous, that would be such a ridiculous kludge that i don't believe even microsoft would implement things that way...
    On the other hand if they intentionally slow down XP with updates, then it makes subsequent versions more attractive. Users have long criticised MS for new versions being significantly slower and more bloated than old ones, so i wouldn't be surprised to see them using underhanded tactics to distort this perception.

    --
    http://spamdecoy.net - free throwaway anonymous email - avoid spam!
  40. Re:It is called WIndows 7 by Anonymous Coward · · Score: 0

    So GP's post was badly spelled, poorly worded -- and also factually wrong. When you read his paragraphs you can almost feel him think how hard it is to keep a coherent thought in his head for long enough to type it out. You can see him failing at that. Yet, somehow, he got 5, insightful. It's time for some reflection, Slashdot.