Microsoft denies fault in hacks
Microsoft is denying that a recent rash of Web server attacks are the company's fault.
In a blog posted late Friday night, Bill Sisk, of the Microsoft Security Response Center, wrote that the attacks are not due to any new or unknown security flaws in Internet Information Services or Microsoft SQL Server. Rather, he says, the attacks are made possible by SQL injection exploits, and he points Web developers to the company's list of best practices to prevent such attacks.
Ongoing attacks have affected half a million Web pages, compromising them so they serve up malware, according to several reports. The hacked sites include government sites in the U.K. and sites belonging to the United Nations.
All it takes for a computer to become infected is a visit to a compromised site. While viewing that site, the injected Javascript loads a file named 1,js. The file is located on a malicious server, which then attempts to execute eight different exploits targeting Microsoft applications.
Related story: Web 2.0, meet Internet attack 2.0
Jennifer Guevin is assistant managing editor of CNET News. She focuses on science and green tech. But she also makes the occasional contribution to CNET's kitchen gadgets blog or writes about the latest Web distraction. Once a week, she takes the mic as host of CNET's Daily News Podcast. E-mail Jennifer. 
"[attempt] to execute eight different exploits targeting Microsoft
applications."
As easy as it is to automatically blame Microsoft for this one, when you read the source material for this one, it's clear that the tools to prevent it were available- the coders simply didn't use them.
Since this affects Java as well, I lean more towards sloppy programming and not the provider of the tools themselves.
Should I blame Craftsman because the waterpump on my Chevy broke when I didn't use the wrenches provided to me in the kit?
Microsoft's business customers can send logs to Microsoft so they can track this stuff, and I'm willing to bet of the 1.8 million, they didn't just recieve five and call it not their fault.
Why do we in the computer industry atomatically blame the victim or the developer? Is this conditioning or our binary way of thinking or?
The real people who we should be blaming and going after is the malware writers (MalZ) and not Microsoft or Mozilla or McAffee.
We might also start blaming our governments as well for being so far behind in combatting this criminal behaviour.
When someone breaks into your house do you blame the contractor?
When someone steals your car do you blame Ford?
We have to stop this blame the developer mentality because it takes us way from what should be our main focus and that is finding and eliminating the MalZ that are attacking our systems. We need to either get our police forces to start catching these guys or we have to do it ourselves if they are unable or unwilling.
That said, there is a vast difference between languages that have little documentation and no real IDE to speak of, and a language (like, say, ASP) that have a plethora of IDE support and brags on ease-of-coding and ease-of-deployment.
So where was Microsoft when their IDE's failed to check against a simple SQL injection attack? Where was Microsoft when their bragged-on ease-of-use/ease-of-deployment language and development tools failed them utterly? Where was Microsoft? Why, they were busy blaming users for taking them at their word, that's where.
--
And there's still one other monster question at hand here.
Why is it that when a PHP script allows a PHP-based site to be pwned, the sysop merely has --at most-- to be rid of the offending script, and rebuild/restore the bits and bobs within the chrooted directories that Apache was handling at the time.
Meanwhile, this little IIS/ASP exploit apparently allows a perpetrator to [i]own the entire frickin' server[/i]. Perhaps that little bit speaks volumes on just how insecure IIS and Windows is than anything else, and blaming users for that chain of an attack is not ignorant - it's stupid.
--
Guess that, overall, Microsoft does have to eat some crow here... and maybe they won't be so cavalier about pushing their pet languages as so eay to build and deploy anymore? Heh - I'm not holding my breath.
/P
malware writers"
Spot on! Fire for effect!
All operating systems need to be as bullet proof as possible and
updated as necessary, but the real criminal is the criminal.
Are you telling me that the vault manufacturer would not be held liable?
If someone breaks into my house and my alarm system didn't take note of it, guess who is also at fault?
That is a much closer analogy to software security than your uninformed comments. Many companies, most notably Microsoft pay lip service to employing secure coding practices, and the end results are predictable.
Unlike the alarm company, MS skates out of all financial. legal, and ethical liability.
Unfortunately we will have many people here who will blame the provider of the tools and not the people who failed to use them, or those that used them in a malicious way.
It's an important distinction to make in my view.
Wow... there is some intelligence on these comments.
Especially if Ford, through predatory marketing practices, held 90% or so of the market and retail shelf space.
Microsoft has never told a lie, so that settles it then.
Granted it is not 100% effective and developers still need to be aware of these issues which is a major problem, even today. Most developers have no business writing code because they do not have the necessary background to write secure, efficient code.
Any framework worth using would have caught something as simple as this. Let me guess, the countless exploits against Windows over the years is not the fault of Microsoft either.
I fault Bjarne Stroustrep for C++. What an poorly thought out, eventually bloated beyond all reason language.
Unfortunately there are many people in society today that do not believe in personal resopnsibility. Some are posting here in the very story thread. Those are the scary people.
Now if I had been using an iSink, the sink would still be stopped up, but it would smell better and have interesting colors. :)
Your comments are laughable.
Huge number of infected sites:
THE UNITED NATIONS (events.un.org/Edetail.asp?EventID=1055&BeginDate=1/22/2007)
United Methodist Church, Harcourt Publishers,
Bahrain Oil and Gas, West Virginia Wesleyan College, e-law, Wyoming Ranch Vacations, Wine Bars, Podcasts, Capacitor sales, Water Heater sales, Toyota dealers, RV parks, chiropracters, etc.
Here's a choice discussion:
"The script -www.nihaorr1.com/1.js is getting inserted into every record of my organizations SQL db. I'm the accidental techie in my office, and I'm clueless as to the vulnerability in our code. After a restore, the site gets hit every other day. I've searched around and no one seems to have an answer to this specific problem. There's no doubt in my mind that our coding has a loophole in it somewhere, but I'm not sure what to look for."
Microsoft didnt blame anyone for it. In fact, nobody was blaming Microsoft either. Both stories made it very clear that the exploit was done through poorly written/tested code on web pages that is user created.
Give Microsoft some time today (Monday) to get their act together so they can blame end users- they haven't had time to even respond to this yet. THEN you can get all up in arms about it. :)
Now the classic response... "Oh yea, everybody knows there is a hole there"...
Just like in the real world; if you only have one kind of honeybee, then a honeybee virus can wipe out the whole population.
So yeah, if you prefer Windows, more power to you; but at least introduce a bit of genetic diversity into the system by using one of the many alternative browsers and email clients. Thanks.
I use a Mac with a Safari/Flock browser combo.
These days, most malware is developed by talented developers, engineers and a few architects who work in criminal organizations.
So, yes, it is the developer's fault. Now there are some things that you can't anticipate, but following coding guidelines that are provided by MS (assuming that's who wrote the OS/Server/Dbase used), is just common sense.
What happens is that most programmers, web programmers and such learn programming by the seat of their pants, self taught, no formality, no security in mind. Then they never learn to program by "Best Practices". They learn to program for "whatever works", which usually is not secure methods. If IT is given the tools and informed not to program this way or the other by the manufacture because it will cause problems, then the fault belongs to the programmer and end user if they use methods not advised.
The "anything" goes has to stop being "the best practice". Sloppy programming has to stopped by the end user and programmer.
That Security Protocol: DO NOT EVER EXECUTE ARBITRARY CODE FROM A REMOTE SOURCE EVER!
(doing so in the past when it was DOD's network would have gotten your security clearance revoked, court marshall, and perhaps some fingers removed ;-()
Even if you trust the source, you cannot trust the connection! someone slices the line mid-transfer and garbage collects on it, you have no idea what your computer might do with that garbage if executed!
The only code that should be executed on any computer (networked or not) is code that is tested, and proven safe on that physical system. You should always do this in isolation from the network first, and then test in isolated network environment, before daring to run that code while connected on the Internet.
Client Side Scripting, be it VB Script, ActiveX control, Java, Flash, Perl, etc. completely violates this, but the world is hooked on this scripting drug, and won't detox, or go to rehab.
The original HTML spec was not vunerable to this because it is a Markup Language not a programming language. It was designed intentionally that way so as to prevent this from happening, because back in the good old days, when the Internet was mostly SMTP, NNTP, HTML and IRC, we knew better than to execute arbitrary remote code!
Maybe I need to go into the IT Security Field because appearently there is not a single intelligent person (with integrity) working in it now, or else they would have told management that scripting is not safe ever!
(but I always suspected that the reason client side scripting actually got out there was that they wanted this insecurity, which is why I have refused that field).
It was the US military and the Standards Organisations that developed this junk heap and the university "free love" attitudes that propogated it around the world...
What a joke.
I remeber using Blackcomb (go and look up your history books) that was secure and worked really quickly over a 1440 baud dial-up link. It was revolutionary stuff - guess who? Microsoft - of course!
- Microsoft is to blame.
- by as901 April 29, 2008 4:35 AM PDT
- Mycrosoft has a lomg standing belief that once you place Windows in your computer ,"Microsoft has a right to access your computer and disable it at will!"
- Like this Reply to this comment
-
-
- OK
- by alegr April 29, 2008 9:09 AM PDT
- Now put your tin foil hat back on. Make sure to give your daily prayer to the holy church of Invincible U-x. Blessed be poor souls.
- Like this View reply
Processing -
(78 Comments)Because of this belief ,mycrosoft always leaves a "backdoor" way for them to access your computer. If they believe that you do not have the legal right to their software ,they can disabled your computer.
To do this trick requires a method to remotely access your computer. When Hackers find that way Microsoft offers "security updates" that close that backdoor and open another.
Many people with legal copies of Windows have suffered Microsofts anger. They may have purchased a legal copy from a friend ,or they may have purchased a legal copy from a company that went under.
It is Microsoft policy to assume guilt. If you are not the one who it was registered to from the beginning ,if you go to their update section ,you may find your computer ,or part of your computer no longer working.
As if that is not bad enough ,Microsoft leaves our systems open and at risk ,so they may inspect our systems at will.
I use Linux. I do so for two reasons. The first is the stable nature of Linux. The second reason is my belief that my computer is my own property , and Microsoft does not have a right to examine or alter my computer ,if they so choose.
Mark Heinemann
Damned forever be those security lists, spreading unspeakable heresies about U-x flaws, such as www.matasano.com.