"Blue Hat" brought together the world's most powerful software company and the security researchers who pick apart its products. Participants included:
Jim Allchin: Jim Allchin is Microsoft's group vice president in charge of the Windows
unit. His job is to oversee the development of current and future versions of the operating system.
Matt Thomlinson: As Microsoft's director of security engineering, Matt Thomlinson is in
charge of making sure programmers throughout the company are up to speed on current and emerging threats.
Noel Anderson: Noel Anderson is Microsoft's program manager for wireless, mobility and
home networking. He's one of the Windows programmers responsible for
managing the ways in which the operating system connects to wireless
networks.
Dan Kaminsky: Dan Kaminsky's recent research includes looking at the limitations of
hashing algorithms, as well as the potential for sending large files via
the Internet's Domain Name System. He is currently doing work for Avaya.
HD Moore: HD Moore is the creator of Metasploit, a tool that system administrators can use to test whether their systems are safe from intrusion.
During a recent talk in Redmond, security researcher Dan Kaminsky wasn't sure how geeky to get. After all, he was talking to a bunch of executives on the first day of Blue Hat, not Microsoft's rank-and-file engineers.
So he kept his comments brief when it came to a flaw in something called MD5--a "hashing" algorithm, or a kind of fingerprint used to authenticate documents. He figured it was probably too esoteric for his audience. The rest of his presentation was focused on a different security topic.
But when it came time for questions, "this one guy with a shock of white hair looks straight at me and just says, 'MD5.'" Kaminsky, who said the comment seemed more like an order than a request for information, complied by demonstrating how two Web pages could have the same "hash," as the man listened and nodded knowingly.
A week later, Kaminsky learned that his interrogator was Jim Allchin--one of the highest-ranking executives at Microsoft and, as the person in charge of the Windows operating system, one of the leaders in the technology industry as a whole. Allchin's questions made clear just how deep the technical knowledge runs among the most senior ranks of the world's biggest software company.
The brief encounter made a lasting impression on Kaminsky. "I was like, 'Who was that guy?'" he said.
--Ina Fried
Associate editor: Yvonne Guzman
Copy editors: Leslie Katz, Richard Defendorf
Design: Michelle White
Production: Michelle White, Mike Markovich
By Ina Fried
Staff Writer, CNET News.com
June 15, 2005 4:00AM PDT
REDMOND, Wash.--The random chatter of several hundred Microsoft engineers filled the cavernous executive briefing center recently at the company's sprawling campus outside Seattle.
Within minutes after their meeting was convened, however, the hall became hushed. Hackers had successfully lured a Windows laptop onto a malicious wireless network.
"It was just silent," said Stephen Toulouse, a program manager in Microsoft's security unit. "You couldn't hear anybody breathe."
Wireless networking
engineer, Microsoft
The demo was part of an extraordinary two days in which outsiders were invited into the heart of the Windows empire for the express purpose of exploiting flaws in Microsoft computing systems. The event, which Microsoft has not publicized, was dubbed "Blue Hat"--a reference to the widely known "Black Hat" security conference, tweaked to reflect Microsoft's corporate color.
The unusual March gathering, a summit of sorts between delegates of the hacking community and their primary corporate target, illustrates how important security has become to the world's most powerful software company. Microsoft Chairman Bill Gates himself estimated earlier this year that the company now spends $2 billion a year--more than a third of its research budget--on security-related issues. Security has also become one of the main themes of the company's developer conferences, including last week's TechEd event, where Microsoft pitched security improvements in Windows to 11,000 attendees.
Blue Hat was significant for other, less tangible reasons as well. It provided a rare glimpse inside the netherworld of computer security, where the ethical lines are sometimes fuzzy in the technological arms race between network engineers and the hackers who challenge them. During the course of the event, each side witnessed for the first time the inner workings, culture and psychology of the other.
"I didn't know if we were going to end up with this massively adversarial experience or if this was going to be something of a collaborative mode between all of us," said Dan Kaminsky, one of the outsiders who presented at the conference. Like others in the hacker group--many of whom are known as "security researchers" in their professions--he noted that the relationship ended up being the collaborative sort.
Still, in such a charged atmosphere, it didn't take long for emotions to show.
Matt Thomlinson, whose job it is to help make Microsoft engineers create more secure code, noticed that some of the engineers were turning red, becoming obviously angry at the demo hacking incident. Yet as painful as the lesson was, he was glad to see the crowd of engineers taking things personally.
Thomlinson frequently makes similar entreaties to the engineers on the need for secure code, but he said his own lectures don't have the same effect. "It kind of hits people up here," Thomlinson said, pointing to his head. "Things are different when a group of programmers watches their actual code exploited. It kind of hits people in the gut."
For two days, Microsoft staffers took these body blows repeatedly as they learned of various exploits. On day one, several dozen executives, including some of the company's most senior ones, were exposed to this simulated wrath in a makeshift boot camp. Among the participants were Jim Allchin, Microsoft's Windows chief, and Brian Valentine, head of core Windows operating system development. The second day drew about 400 rank-and-file Windows engineers, including people who don't necessarily focus on security features in their day-to-day work.
Security researcher
Allchin is not just any high-ranking software executive: In the technology industry, his name has become largely synonymous with the Windows operating system he oversees. A strong supporter of Blue Hat, Allchin wanted the Windows group not just to hear about security issues, but to see them as well.
"I'd already been through lots of days of personal training on the tools that are used to do this," Allchin said about the work of the hackers. "I personally wanted to really do a deep dive and really understand from their perspective."
It was a relatively safe way to get the experience. In a world where "white hats" are the security do-gooders and "black hats" are the hard-core villains, the hackers at Blue Hat were hardly representative of the dark side; if they had any pigment at all, it was no more than a tinge of gray.
This could well be a significant reason Microsoft held the event--to woo an influential group that has the choice of reporting security flaws discreetly or going public with them. The software maker routinely preaches the benefits of what it calls "responsible disclosure."
To the researchers, Microsoft's motivation was less important than the opportunity to meet in person with those who hold the keys to the kingdom and explain why they do the things they do.
"It is rare that I can present to the people who are both responsible for and capable of fixing the issues that I cover," security researcher HD Moore said,
Continued ...
them where they've been going wrong..
i sure as hell feel safe, knowing monkeys are coding.
why did they have to regularly be given talks to produce safer code;
obviously not listening.
I'd like to introduce you to the world of IRC, Mr. Anderson. Please, step into the Internet's biggest cess pool -- where you will find the source of every single "hack", virus, worm, or scam.
I'd also like to inform you that Microsoft Security regularly monitors their gateways for any outbound traffic to ports 6660-6667. Hmmm, could I be simply talking smack, or is there an actual POINT to Microsoft's concern with IRC?
Good day, Mr. Anderson.
What are you guy's thinking.....a true hack never gives away the juciest of secrets. hmphf
First, the word 'hacker' is here just to draw readers, inspire fear and awe and to mislead.
Second, why are we supposed to be impressed if the guy in charge of Windows knows about MD5? OF COURSE, he's supposed to know about MD5- but Ina Reid seems to imply that we should be impressed because he does!
in order to lure them in...
Never been hacked or infected.
Do you thinnk giving away something called "economic security" and golden parachutes can buy loyalty?
Too big is too big!
Want real security? Stop paying salaries to security people.
Remember Bin Laden?
How about the Chinese, North Vietnamese, North Koreans, Iranians and Arabians.
Cultural differences engender secrecy
Sanskrit, Ancient Hebrew, and the unwritten languages using verbal analogies, implications, and time based iflections top mention few variables which change each time they are used?
coverage. Keep it up.
The idea behind ANY sort of 'hashing' is to be a 'one-way' encryption. For instance if you divide two numbers and toss the remainder or the quotient and keep the rest, you just lost data! You can't get back to the original input of the method. Keep applying this over and over and before long the output is so 'mangled' that it's unique.
Now, MD5 has been proven and tested to the point where it would take a hell of a lot longer than 3 minutes (the time it took to take over that laptop), to generate an identical MD5 for a file with identical filesizes as a legit file.
Microsoft's using MD5 as the 'scapegoat' to this step in their lack of security, goes to show you just how much they hate Open Source Software, the GNU.org GPL (General Public License), and how much they use FUD (Fear, Uncertainty, and Doubt) attacks to point the finger of blame onto others.
How Linux programmers around the world who don't all speak English and barely break the language barrier with translation tools like Altavista's BableFish engine, can beat a team of over paid all English speaking idiots who claim this and that.
I for one question the existance of all this Anti-Virus software for Windows... If you could simply fix the exploits at the root of the problem. Why doesn't Microsoft just do that then? If they cared so much about increasing their monopoly, make a better Operating System than Linux! Instead of buying out the parts of the Linux community that'll give in and partnering with hardware companies so they don't make software drivers in Linux. Only instead, they create a market out of EXPLOITS for companies like Panda/Macafee/Norton/and ofcourse MICROSOFT! Where the fixes are always 'RE-ACTIVE' not 'PRO-ACTIVE' like Linux. Where the system has to constantly scan everything for 'viral' activity. When the system could simply check for this stuff on the fly internally to prevent exploits from occurring.
Actions should speak louder than words people, and if that's the case here then, CLEARLY, Microsoft sucks! Wake up people!
I've never known webpages to use MD5 on the actual page content. Most client/servers use ETags, which are based off the INode (location of the hard drive), filesize, and last modified date/time in Unix Epoch relative timestamp form.
I think Microsoft just made the claim of MD5 being the cause because it's Free Software, and Linux/GNU/Free Software (Foundation) is their biggest competitor.
As close to PROOF as you can possibly come to this, the Halloween Documents (memoes from Microsoft to it's employees) http://opensource.org/halloween/
And the links spread out on this page http://microsuck.com/content/whatsbad.shtml
Are all excellent reads. You will learn just how Microsoft manages to make Linux and Free Software in general look 'evil' and 'costly', with lies that are believable, so that you 'obey' like a slave to their Fear-Uncertainty-Doubt (FUD) attacks. For when you compete with Microsoft, there is no level playing field!
They have been more prepared by virtue of security threats and outright attacks than they ever were from simply an honest technical need.
I still find that most every network is vulnerable. I know some people will say this publicly and follow it up with comments along the lines of a computer unplugged and submerged in concrete, etc.
I don't mean vulnerable in that sense...
I mean vulnerable in the sense that a "hacker/cracker/attacker/etc." is reading your e-mail and contemplating what to do with that list of passwords and credit card info deom some list on your computer.
This is only the first skin of the onion and when any company is faced by a thorugh determined mind that is resolved to attack it by any means necessary, then that company will simply be at the mercy of said assailant.
Now, this sounds like talk. And actually it is written words, but do not discount my words as "warning" for a warning they are not. A truth is a truth in that it can simply be proven "true" or "false".
With that said, I would remind everyone from Redmond to Washington to tighten your own borders and do so in a thorough scorched earth fashion.
I typically build a concentric network defense from a layered model with keypoints that observe other selected keypoints.
I suggest the same approach by taken but also with physical security, biometrics if available, policy and training.
These items should be mandatory, too often they are not because they conflict with corporate policy or they upset the executives in one manner or another.
Someone once told me "There are ways to protect a network, software, code, etc. ...".
To whom I replied, "They better be some good ones"
Think about it...
In defense, the networks of today are more secure than they have ever been.
However, are they as secure as they could be?
Let your consience be your guide...
In the end each company is as secure as someone reports it is...
Who reports to whom?
- Zealot yes, but not just for Linux.
- by November 24, 2005 4:04 PM PST
- I consider myself a Zealot for freedom and open source. So I'll support (BSD) Unix, Linux, and ReactOS. Because as long as we have idiots who support tyrants like Bill Gates, the human race will merely think it's free, while it lives under the guise of ignorance and slavery.
- Like this Reply to this comment
-
(38 Comments)Perhaps the ultimate problem with Windows is they strive most of all to make it so easy any moron can use it to do simple things, (ex. play games/check email/etc.). For it's when you remove challenge from people's lives that they often become the most lazy! Whether it's mental or physical laziness, it still leads to dependency.