Comments on: Microsoft meets the hackers

special report In the name of education, the software giant invites security researchers to infiltrate Windows systems.

Bluehat event

I think that Microsoft had a great idea there. The US government has been blackmailing hackers for years for research purposes - but this is a much friendlier environ.

monkey coders

so they held a conference and brought in hackers as such, to tell
them where they've been going wrong..

i sure as hell feel safe, knowing monkeys are coding.

why did they have to regularly be given talks to produce safer code;
obviously not listening.

[MonocularJack]

The Simian Mind

I don't know if you are a software engineer or not but the problem is not that Microsoft engineers aren't listening, it's the nature of trying to foresee how something *might* be exploited while still producing a useful OS.

It's like when you hide a present from your wife or kid thinking there is *no way* they will find it there and the next day they walk into your office holding the damn present you spent all that time hiding.

[John Kuzak]

monkeys are coding

http://www.analogstereo.com/vacuum/miele_dust_mites.htm

[vox365]

Beneficial, but.....

"consensus" has never been the mode of change or advancement for any technology. Consensus satisfies a few immediate problems but ultimately leads to stagnation. Hackers, unpleasant as they are, force critical thinking and demand change from the potentially complacent mind. Good intentions pave... etc.

[John Kuzak]

critical thinking

http://www.analogstereo.com/vacuum/miele_hay_fever.htm

[katamari]

Ah, Mister Anderson...

...you are sadly mistaken. Hackers *ARE* a bunch of teenagers living in their moms basements.

I'd like to introduce you to the world of IRC, Mr. Anderson. Please, step into the Internet's biggest cess pool -- where you will find the source of every single "hack", virus, worm, or scam.

I'd also like to inform you that Microsoft Security regularly monitors their gateways for any outbound traffic to ports 6660-6667. Hmmm, could I be simply talking smack, or is there an actual POINT to Microsoft's concern with IRC?

Good day, Mr. Anderson.

[PLDK]

waste of time...

What blows me away is that Microsoft actually thought they would get the most talented and serious hackers to come in and show the tools of the trade.
What are you guy's thinking.....a true hack never gives away the juciest of secrets. hmphf

[Planet_Jeroen]

False:

That depends entirely on the motivation of the hacker. There are a lot of security experts out there that do daring hacks in their own time, while working as security advisor during the day. These people are not in it for the IRC botwars, the illegal data storage or money. They do it for the thrill, the challenge, and to help the community.

Your true hacker is one that relies on excisting sploits, else he wouldnt care about juicy secrets, he'd make them himself.

But I've tried nothing and I'm all out of ideas!

all too familiar

[devanjedi]

I resent two things

I resent two things in this article:
First, the word 'hacker' is here just to draw readers, inspire fear and awe and to mislead.
Second, why are we supposed to be impressed if the guy in charge of Windows knows about MD5? OF COURSE, he's supposed to know about MD5- but Ina Reid seems to imply that we should be impressed because he does!

[devanjedi]

My mistake

Ina Fried, not Reid- sorry.

[dejo]

You've Just Won A New Car!

Reminds me of when the cops tell criminals they've won a raffle
in order to lure them in...

[WesFlash]

Why?

Why did they need hackers to come in and show them how their code gets exploited? It sounds more like the management there in Redmond lost the ability to keep their people focused, inspired and have an internal driven nature to improve existing code and write new code that is secure and not just stable.
Shame on MS for having the religion of security but not strong enough in their faith at the top levels to convert and fully inspire their employees to fight the battle against insecurity in such a way that they would need such a wake up call from hackers coming into their offices for them to see what is happening in the real world.

Hackers???????????/_*Buzzwords_Bah

Since 1962 I've been working through international sources to protect my own intellectual rights.

Never been hacked or infected.

Do you thinnk giving away something called "economic security" and golden parachutes can buy loyalty?

Too big is too big!

Want real security? Stop paying salaries to security people.

Remember Bin Laden?

How about the Chinese, North Vietnamese, North Koreans, Iranians and Arabians.

Cultural differences engender secrecy

Sanskrit, Ancient Hebrew, and the unwritten languages using verbal analogies, implications, and time based iflections top mention few variables which change each time they are used?

Security cover up?!

If you actually bothered to do real research, Bin Laden is just a puppet for the UN.

British MI5 and MI6 agents (British equivalent to CIA agents in the USA), have been caught shooting Iraqi Police, the men we're suppose to be training to secure the place when we pull the troops out in the distance future -never going to happen-.

http://www.prisonplanet.com/articles/september2005/200905stagedterror.htm
http://news.bbc.co.uk/1/hi/world/middle_east/4264614.stm

Lets not forget an interesting part of why President Kennedy was probably shot - Operation Northwoods!!! ABC News http://abcnews.go.com/US/story?id=92662&page=1 and Baltimore, Maryland did an article http://web.archive.org/web/20030126125150/www.sunspot.net/templates/misc/printstory.jsp?slug=bal-te.md.nsa24apr24

BBC article about a 'plane bomber' being a CIA agent http://news.bbc.co.uk/1/hi/world/americas/4535661.stm

The truth is stranger than fiction!!!

interesting ....

It would have been assumed the guys who do research on security at MS, would have known about this :-)

[Blazer2008]

Give them food and they will sell it!

MS is just up to getting ideas (from blue hatters) in order to program the public into thinking they are working on security to release a New OS with top notch security "built in" for a new price. HA. They themselves speak of the "HACKERS" they met as being Grey Hatters - so they are marching to level 2 observationists, nevertheless - better than their own. From the top down you can smell bloatware. Let them waste their time on fixing the stuff that will only be thrown in the trash for future generations. Spend the billions...keep'em coming.

Interesting...

Now honestly, all of you talk about this as though its a new thing. Fact is, things like this have been going on for years. For every dissolusioned teenager that hacked as a youngling, there is a dissolusioned adult willing to sell the information to the proper party. Microsoft really does work their behinds off to make sure that everything they sell is secure. The fact is, a new exploit comes out almost every day, thats how it should be. with every program there is a hole, there is no foolproof system, it just takes a mind willing to take the time to find the flaw. This is about people understanding on a broad level - technology is there for us as a whole to grow. People are driven by conflict, through breaking their own limits. Hack away as far as im concerned. someone will always be there with a better hack, and with a better fix.

[John Kuzak]

People are driven

http://www.analogstereo.com/vacuum/miele_dustbag.htm

Great write up.

I enjoyed reading the technical article. Great
coverage. Keep it up.

MD5 was the fault?

People, do you even know what MD5 actually is?!

The idea behind ANY sort of 'hashing' is to be a 'one-way' encryption. For instance if you divide two numbers and toss the remainder or the quotient and keep the rest, you just lost data! You can't get back to the original input of the method. Keep applying this over and over and before long the output is so 'mangled' that it's unique.

Now, MD5 has been proven and tested to the point where it would take a hell of a lot longer than 3 minutes (the time it took to take over that laptop), to generate an identical MD5 for a file with identical filesizes as a legit file.

Microsoft's using MD5 as the 'scapegoat' to this step in their lack of security, goes to show you just how much they hate Open Source Software, the GNU.org GPL (General Public License), and how much they use FUD (Fear, Uncertainty, and Doubt) attacks to point the finger of blame onto others.

How Linux programmers around the world who don't all speak English and barely break the language barrier with translation tools like Altavista's BableFish engine, can beat a team of over paid all English speaking idiots who claim this and that.

I for one question the existance of all this Anti-Virus software for Windows... If you could simply fix the exploits at the root of the problem. Why doesn't Microsoft just do that then? If they cared so much about increasing their monopoly, make a better Operating System than Linux! Instead of buying out the parts of the Linux community that'll give in and partnering with hardware companies so they don't make software drivers in Linux. Only instead, they create a market out of EXPLOITS for companies like Panda/Macafee/Norton/and ofcourse MICROSOFT! Where the fixes are always 'RE-ACTIVE' not 'PRO-ACTIVE' like Linux. Where the system has to constantly scan everything for 'viral' activity. When the system could simply check for this stuff on the fly internally to prevent exploits from occurring.

Actions should speak louder than words people, and if that's the case here then, CLEARLY, Microsoft sucks! Wake up people!

[Jeremiah256]

I THOUGHT...

I thought MD5 had already been proven exploited?

Is Linux for Losers?

Reality check here. Linux isn't all that great either.

Finally someone has spoken out. See "Is Linux For Losers":

"It's terrible," Theo de Raadt says. "Everyone is using it, and they don't realize how bad it is. And the Linux people will just stick with it and add to it rather than stepping back and saying, 'This is garbage and we should fix it.'"

http://www.forbes.com/technology/2005/06/16/linux-bsd-unix-cz_dl_0616theo.html

It was...

Any software in the world, open/closed source is possibly a target or has already been exploited. But here's the catch! MD5 hashes are so unique in result that it would take a hell of a lot longer than 5 minutes to generate identical hashes. I suppose if you ran bots around the clock 24/7 for a few years, even with a cluster of distributed processing on a private network you could calculate up a binary file that was malicious in nature with a few extra junk bytes randomly placed throughout the file to generate an identical MD5, equal or unequal in filesize it would take way too much effort. Nothing is impossible, but don't think for a moment that something that could take so long would be the point of entry for an attack. When there are so many other ways to exploit a Windows user's machine that can take so far LESS time!

I've never known webpages to use MD5 on the actual page content. Most client/servers use ETags, which are based off the INode (location of the hard drive), filesize, and last modified date/time in Unix Epoch relative timestamp form.

I think Microsoft just made the claim of MD5 being the cause because it's Free Software, and Linux/GNU/Free Software (Foundation) is their biggest competitor.

As close to PROOF as you can possibly come to this, the Halloween Documents (memoes from Microsoft to it's employees) http://opensource.org/halloween/
And the links spread out on this page http://microsuck.com/content/whatsbad.shtml
Are all excellent reads. You will learn just how Microsoft manages to make Linux and Free Software in general look 'evil' and 'costly', with lies that are believable, so that you 'obey' like a slave to their Fear-Uncertainty-Doubt (FUD) attacks. For when you compete with Microsoft, there is no level playing field!

[Darby Weaver]

State of Security

I've administered networks from mostly every venue at this point in my career and can say that most networks are poorly prepared.

They have been more prepared by virtue of security threats and outright attacks than they ever were from simply an honest technical need.

I still find that most every network is vulnerable. I know some people will say this publicly and follow it up with comments along the lines of a computer unplugged and submerged in concrete, etc.

I don't mean vulnerable in that sense...

I mean vulnerable in the sense that a "hacker/cracker/attacker/etc." is reading your e-mail and contemplating what to do with that list of passwords and credit card info deom some list on your computer.

This is only the first skin of the onion and when any company is faced by a thorugh determined mind that is resolved to attack it by any means necessary, then that company will simply be at the mercy of said assailant.

Now, this sounds like talk. And actually it is written words, but do not discount my words as "warning" for a warning they are not. A truth is a truth in that it can simply be proven "true" or "false".

With that said, I would remind everyone from Redmond to Washington to tighten your own borders and do so in a thorough scorched earth fashion.

I typically build a concentric network defense from a layered model with keypoints that observe other selected keypoints.

I suggest the same approach by taken but also with physical security, biometrics if available, policy and training.

These items should be mandatory, too often they are not because they conflict with corporate policy or they upset the executives in one manner or another.

Someone once told me "There are ways to protect a network, software, code, etc. ...".

To whom I replied, "They better be some good ones"

Think about it...

In defense, the networks of today are more secure than they have ever been.

However, are they as secure as they could be?

Let your consience be your guide...

In the end each company is as secure as someone reports it is...

Who reports to whom?

What have you been smoking?

Security is out there, and it's FREE for download. It's called Linux and Unix (or BSD), it's also called Solaris - by Sun Microsystems, where the network is the load average!

All you need is iptables to block ports you don't want access to, no if/ands/or buts. Then research the best most secure daemons for web/ftp/pop3/smtp, whatever your server is going to require. Enable options for secure RSA/SSL encryptions ONLY, meaning, nobody can access the server without encryption. Make sure your kernel is up to date, your daemons are always up to date, now you've got one bullet proof little box.

If you want even more security, pay your on site server maintainer to go through the daemon source code and check for buffer overruns. One can avoid buffer overruns simply by replacing sprintf() with snprintf(), which defines the size of the buffer as to not overflow.

Clearly you don't know as much as you would have us think you know if you don't know the difference between a hacker and a cracker. Hackers are the 'good guys', we like to figure out how stuff works, to learn just for the sake of learning. An activity which is purely intellectual aka reverse engineering. Crackers are the people who break into networks, steal or destroy data. But that's mostly only if they know howto program. People who use the work of the Hackers on the net without caring how it works or why it works code wise, are often referred to as 'script-kiddies'. Because most of the time what they use is a script, whether it's bash/bsh/ksh/csh/perl/python/java/java script/php or whatever. I am a Hacker, and I love learning new things about computers everyday. I never attack anybody else's server, just my own (private LAN), just for experimentation only. Stop being ignorant and blaming hackers for your incompetance!

I also have a saying though, if it's exploitable, it deserves to be exploited! Take these new Voice over IP (VoIP) systems that allow like Timer Warner's Digital Phone or Vonage phone service to make calls through the internet. What people don't realize with these systems is how easy it is to spoof your outgoing phone number and caller ID name to anything you want it to read out as. More and more people are using Linux software to make these type of annoying calls to people in the USA everyday. But I don't blame the people exploiting the system, I blame the people who made the system along with these exploits, and FAIL to do anything to fix it! Does Uncle Sam honestly give a damn about trying to fix it? NO! HE DOESN'T!

You can make the same comparison between Apple and Windows (but don't judge me as one of those Apple zealots, I still use a PC with Linux). Apple knew their OS up into OS 9 was a piece of crap. So they spent 2 to 3 years writing a new OS entirely from the ground up using the Darwin kernel as a base model. This evolved over time into what was the first OS X! The security and stability of Unix with the ease of an Apple OS GUI! TADA!

Microsoft can afford to do the same thing... they have the money and the talent working for them (at least I think they might). So why don't they? Even your precious Windows NT kernel in 2000/XP/Vista is running off of code from the 1980's... everytime you download a patch for something in Windows, which isn't even a real patch because it's more of a DLL OS request filter which adds to the number of CPU cycles the system has to perform to verify a request is valid instead of a real patch that modifies the kernel binary data, you're still not fixing the bugs at the ROOT of the problem! Anti-Virus software is the same way pretty much, it stops the problems at the branches, NOT AT THE ROOT! So, I don't blame the people who write viruses for Windows machines, I blame Microsoft for half-assing their wannabe security while they try to make Linux sound just as stupid as they are and for making the morons of the net who use Windows believe their lies about Windows being more secure. Which in the meantime they go about patenting every last thought of concept/idea/method so they can sue people for trying to come up with the 'next big idea' that'll earn them some money. Here's a patent Microsoft has for you, the concept of 'double-clicking', has been patented by MICROSOFT! Tens of thousands if not hundreds of thousands of patents just like this are here today! And also in other countries that support patent/copyright documents. Remember, solute your dictator when he passes you by. *Nazi solute* Hail Gates!!! Hail Gates!!!

[John Kuzak]

reading your e-mail

http://www.analogstereo.com/vacuum/miele_dust_bags.htm

[Michael00360]

knowing thy enemy

It is good to know your enemy inside out. This will ultimitly help Microsoft to better their programming techniques. ( I hope)

Zealot yes, but not just for Linux.

I consider myself a Zealot for freedom and open source. So I'll support (BSD) Unix, Linux, and ReactOS. Because as long as we have idiots who support tyrants like Bill Gates, the human race will merely think it's free, while it lives under the guise of ignorance and slavery.

Perhaps the ultimate problem with Windows is they strive most of all to make it so easy any moron can use it to do simple things, (ex. play games/check email/etc.). For it's when you remove challenge from people's lives that they often become the most lazy! Whether it's mental or physical laziness, it still leads to dependency.