No, actually, the better analogy would be somebody breaks into the jewlery store, steals the jewlery, boxes it up, puts in a note saying 'I send this jewelery for you to try out. Please to wear it and tell me what you think' and mails it from the store's address.
Is it 'ethical' for you then wear it?
However, unless the admins have the time and the knowledge to turn this service off, it will continue to be a problem.
And the first line of any 'how to secure a network operating system' text is 'turn off things you don't need.'
The 'How to secure IIS' checklists and docs that Microsoft puts out all list several aspects of IIS that should be shut off; sample apps, admin pages, stuff that makes sense on an Intranet but not on the Internet. A lazy admin can install NT2K and have a bunch of security holes because they put it on the network and walk away. Guess what happens if they install everybody's golden OS, Linux? Same shit. Why do you think there are projects like Bastille?
If Linux ever achieves critical mass on the Internet, it'll be targeted, and compromised, by just as many of these things as NT/IIS has ever been.
Ok, Jon, so given your wonderful insights into the media and how they think, what would you suggest we actually DO about this?
To paraphrase, "shut up and educate."
No, it's because you go after the biggest share of the pie.
Ramen.worm I think was the most recent example of Linux being just as vulnerable to this sort of thing.
Don't forget, Steve Gibson is the guy who managed to make a 13 year old kid in a chat room, writing code that opens a socket, sends a few IRC commands (the hardest being the Ping/Pong set) and accepts a few commands sound like some sort of Big Black Voodoo Priest, sitting upon a throne carved from human bone, piecing together zombies from heaps of human corpses and sending them out to do his evil work.
If you go here: http://www.microsoft.com/technet/security/search/b ulletins.xml you'll find a lovely XML doc which lists hotfixes going back, I believe, to 1998, what they apply to, what they're superceeded by, and so on.
If you look for 'hfcheck' on the ms sites you'll find a lovely little WSH script that grabs this bulletin, and uses WMI to check servers and tell you what needs to be installed. It defaults to only checking for IIS patches, but that is easily fixable.
Think about 25 percent of the servers on the internet constantly sending out a stream of crap against random websites, not to mention clogging up the wires as they search in vain for more servers to infect.
In other words, imagine if 25 percent of the servers on the internet were suddening acting like SlashDot...
Don't forget also that the attack affects various web-enabled machines, such as certain Cisco routers, HP LaserJets, and the like.
The great part is that the mere attempt to get into compliancy draws ire from Microsoft.
"We note with interest that you recently purchased Exchange 2000 and X amount of CALs, and yet we do not have X amount of Office/Outlook licenses. Please prepare for an audit, as we cannot concieve of you using anything but Outlook, the premiere groupware collaberation tool, with Exchange 2000."
Yup. Whereas a traditional 'wiretap' sits between two phones, the telephonic equivalent of this would be placing an incredibly small recorder in the mouthpiece of the phone itself; it's not a 'transmitted communication' at that point, under the letter of the law.
Sounds like stuff like this will need an amendment to the wiretapping laws to make the letter closer to the spirit.
expansion of the search into a fishing expedition.
Remember, folks, unless they have the little piece of paper that says 'search warrent' you can make them stand in the door when they're asking questions, cuz if you let them in, they'll wander around looking at things while they talk to you.
There are two (three actually) main schools of interview these days.
School one is what I like to call 'I am the Alpha, I am the Omega.' They're not looking for the correct answer, they're looking for their answer. And if you give a correct answer that isn't their answer, you didn't give them the correct answer.
School two is the 'I wanted to be a psychiatrist' school, where some managerial idiot starts doing behavioural modeling and response interviewing, which he learned at a two day course, and draws conclusions from it. "Tell me about a time you had to work in a team. Tell me about a time that you had to work under pressure..."
School three is the interviewers who don't suck. They're often not looking at what answer you give, so much as how you arrived at that answer.
Let me give an example. I learned this trick from my first full time boss, and use it to great effect.
The Kobyashi Maru Database
You are the DBA of a database running a client server application. Several people in the office use your application, and all is well. One day, a DBA from a different group is told to install an app for his users onto the DB box. Shortly thereafter, people who use your app start complaining about performance being slow, and data being lost sometimes. What do you do?
And the beauty is that there is no correct answer. No matter what they say, you explain why that doesn't help or won't work. This gives you two benefits: you get to see where their strengths and weaknesses lie, and you get to see how they work things through, under pressure.
A little bit of questioning by the applicant eventually reveals that it's the other DBA's new app causing the problem.
Now, of course, the eventual answer needs to be 'I punt it off to our supervisors and let them deal with it.' But anybody who says that is obviously, as Scott Adams calls it, "Juan Delegator." Talk to the DBA? He says it's your app's fault. Show him proof? He doesn't believe it. Try to fix the server? You can't touch his stuff. Buy a new box? No money. And so on.
Now what Scifi series is this reminding me of?
Ah yes, BattleTech.
Our programmers are the pinnacle of five hundred years of selective breeding and intensive training. Five hundred programmers are grown from a genetic sample, then raised together, being constantly tested. Most will die in that testing, or prove unworthy and be demoted to a lower caste.
Programmers who don't work to death by the time they're thirty five are considered solahma, fit only for changing the diapers of young sibkos, and for going on suicide runs, such as fixing Y2K problems.
Yes, and had the medicos simply asked Lucas for permission, things might have been different. Maybe not.
Lucas has been traditionally very very open to people using his trademarks for noncommerical things; take a look at the Troops video, or Park Wars, or the Dude videos, and so on.
Actually, under US law, in theory, I should be able to say "I warrent that the contents of these packages are legal" and short of obvious danger signs, that's all you should need. I might or might not agree with it, but it's that whole 'innocent until proven guilty' thing.
And yes, Napster's been given a list of songs, and they've been told that if they can't guarentee 100 percent that those songs, or no portion thereof, will pass through the nap network, they can't go forth.
In other words, I've given you a list of explosive compounds that you must not let through a checkpoint. But if somebody later smuggles some through in a huge shipment of spices, you're screwed.
Incorrect. What the US courts said is basically "if you can't prove it's legal, we can't let you transfer it. And we hold you responsible for illegal things which are transfered."
So lets apply that fairly, shall we? That means, first of all, the US Postal Service. Starting tomorrow, the USPS must, MUST ensure that all data and materials which traverse it's network are in no way shape or form illegal. That means they'll be examing everything you send through the mail, and rejecting (and reporting) things they don't like. Send postcards so you don't get nasty reminders of this policy, like opened and resealed envelopes.
Next, telephone. All telephone calls will be monitored, and the circuit will be closed at the first mention of anything illegal.
Next, courier services. UPS, FedEx, DHL, etc etc, will be required to search all parcels, and to inform the FBI if you attempt to send or recieve anything illegal in the US. That means if you try to send something to, say, Russia, and it isn't illegal in Russia, but is illegal in the States, you'll hear a knock knock knocking at the door.
Need I go on? Fine.
Cars will have monitoring devices installed. Go over the speed limit, turn without signalling, take a hand off the steering wheel, boom, car shuts down where it is, and a unit is dispatched to impound it and you.
Passing into, or out of, any private building will require your person and articles to be searched, because the owners of said building would, under these laws, be responsible for anything you were found carrying or doing that is illegal.
I'll leave further examples up to the reader.
It's their own damn problems if they don't care to crack open a networking textbook and look for "Quality of Service."
Where X is defined as the number of users at a given point of time, A is defined as any given member of X, B is defined as the amount of bandwith any given member of X is allocated, and Y is defined as the total available bandwith out of the private network into the public, then the relationship between X, Y, A and B can be expressed as:
B(A) = Y/X
You just refuted your own statement, son. What's the point testing security measures that, say, 80 percent of people aren't willing or able to do? That wasn't the point of this.
A lot of people are told by the Linux evangelists 'just pop the CD in, follow the instructions, and the way to Paradise is clear.' So they popped the CD in, followed the instructions, and found out that Paradise is a cold, dark place indeed.
Scientists also point to a series of cave paintings depicting violent acts as probably having desensitized the killer, allowing him to take another life. "As you can see, even primitive man faced the problem of violence in the media, and this poor chap paid the price."
Slashdot Mirror
No, actually, the better analogy would be somebody breaks into the jewlery store, steals the jewlery, boxes it up, puts in a note saying 'I send this jewelery for you to try out. Please to wear it and tell me what you think' and mails it from the store's address. Is it 'ethical' for you then wear it?
Crap, that's not the right link. And now I can't find it. But it is out there. There have already been ask slashdots about it.
http://www.showstopper.com
Ok, Jon, so given your wonderful insights into the media and how they think, what would you suggest we actually DO about this? To paraphrase, "shut up and educate."
Yes, but had they used it recently? It's an ISAPI dll, and should get unloaded if it's not used for a while.
No, it's because you go after the biggest share of the pie. Ramen.worm I think was the most recent example of Linux being just as vulnerable to this sort of thing.
Don't forget, Steve Gibson is the guy who managed to make a 13 year old kid in a chat room, writing code that opens a socket, sends a few IRC commands (the hardest being the Ping/Pong set) and accepts a few commands sound like some sort of Big Black Voodoo Priest, sitting upon a throne carved from human bone, piecing together zombies from heaps of human corpses and sending them out to do his evil work.
The exploit, and the patch, affect Indexing Service. Most sites aren't actually using Indexing Service. Hence, no reboot required.
If you go here: http://www.microsoft.com/technet/security/search/b ulletins.xml you'll find a lovely XML doc which lists hotfixes going back, I believe, to 1998, what they apply to, what they're superceeded by, and so on.
If you look for 'hfcheck' on the ms sites you'll find a lovely little WSH script that grabs this bulletin, and uses WMI to check servers and tell you what needs to be installed. It defaults to only checking for IIS patches, but that is easily fixable.
Think about 25 percent of the servers on the internet constantly sending out a stream of crap against random websites, not to mention clogging up the wires as they search in vain for more servers to infect. In other words, imagine if 25 percent of the servers on the internet were suddening acting like SlashDot... Don't forget also that the attack affects various web-enabled machines, such as certain Cisco routers, HP LaserJets, and the like.
The great part is that the mere attempt to get into compliancy draws ire from Microsoft. "We note with interest that you recently purchased Exchange 2000 and X amount of CALs, and yet we do not have X amount of Office/Outlook licenses. Please prepare for an audit, as we cannot concieve of you using anything but Outlook, the premiere groupware collaberation tool, with Exchange 2000."
Yup. Whereas a traditional 'wiretap' sits between two phones, the telephonic equivalent of this would be placing an incredibly small recorder in the mouthpiece of the phone itself; it's not a 'transmitted communication' at that point, under the letter of the law. Sounds like stuff like this will need an amendment to the wiretapping laws to make the letter closer to the spirit.
Yes, and had the medicos simply asked Lucas for permission, things might have been different. Maybe not. Lucas has been traditionally very very open to people using his trademarks for noncommerical things; take a look at the Troops video, or Park Wars, or the Dude videos, and so on.
Actually, under US law, in theory, I should be able to say "I warrent that the contents of these packages are legal" and short of obvious danger signs, that's all you should need. I might or might not agree with it, but it's that whole 'innocent until proven guilty' thing. And yes, Napster's been given a list of songs, and they've been told that if they can't guarentee 100 percent that those songs, or no portion thereof, will pass through the nap network, they can't go forth. In other words, I've given you a list of explosive compounds that you must not let through a checkpoint. But if somebody later smuggles some through in a huge shipment of spices, you're screwed.
Actually, "We apologise for the inconvenience."
Incorrect. What the US courts said is basically "if you can't prove it's legal, we can't let you transfer it. And we hold you responsible for illegal things which are transfered." So lets apply that fairly, shall we? That means, first of all, the US Postal Service. Starting tomorrow, the USPS must, MUST ensure that all data and materials which traverse it's network are in no way shape or form illegal. That means they'll be examing everything you send through the mail, and rejecting (and reporting) things they don't like. Send postcards so you don't get nasty reminders of this policy, like opened and resealed envelopes. Next, telephone. All telephone calls will be monitored, and the circuit will be closed at the first mention of anything illegal. Next, courier services. UPS, FedEx, DHL, etc etc, will be required to search all parcels, and to inform the FBI if you attempt to send or recieve anything illegal in the US. That means if you try to send something to, say, Russia, and it isn't illegal in Russia, but is illegal in the States, you'll hear a knock knock knocking at the door. Need I go on? Fine. Cars will have monitoring devices installed. Go over the speed limit, turn without signalling, take a hand off the steering wheel, boom, car shuts down where it is, and a unit is dispatched to impound it and you. Passing into, or out of, any private building will require your person and articles to be searched, because the owners of said building would, under these laws, be responsible for anything you were found carrying or doing that is illegal. I'll leave further examples up to the reader.
It's their own damn problems if they don't care to crack open a networking textbook and look for "Quality of Service." Where X is defined as the number of users at a given point of time, A is defined as any given member of X, B is defined as the amount of bandwith any given member of X is allocated, and Y is defined as the total available bandwith out of the private network into the public, then the relationship between X, Y, A and B can be expressed as: B(A) = Y/X
Scientists also point to a series of cave paintings depicting violent acts as probably having desensitized the killer, allowing him to take another life. "As you can see, even primitive man faced the problem of violence in the media, and this poor chap paid the price."