Slashdot Log In
XP2 Spotted In The Wild
Posted by
michael
on Thu Aug 26, 2004 09:10 AM
from the watch-out-or-it'll-chew-you-up dept.
from the watch-out-or-it'll-chew-you-up dept.
LostCluster writes "WinXP SP2 has just been released to the public via Automatic Update, but eWeek and PC Magazine are together reporting that Windows XP SP2's 'Windows Security Center' is just about as insecure as it could possibly be. According to them, any program (including ActiveX controls) can access and edit the Windows Management Instrumentation database, and therefore spoof the security status of an insecure box to report that it is properly secured."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Clippy.exe is eeevvviiilll (Score:5, Funny)
That MF'ing Clippy.exe in MS Word better stop accessing my Instrumentation database or I'll punch that SOB into the middle of next week. Really any program can access and edit the Windows Management Instrumentation database; I knew solitrae and tetris and an altier motive.
Programs in the wild (Score:5, Funny)
We're out 'ere lookin for signs of the elusive XP2 that's been said to be lurkin' in the wild...
Crikey, I've just spotted a wild paypah-clip in it's natural 'abitat! Look at those big ole eyes an'.. oh!.. there he goes trying to ask me if he can 'elp me!! You see, this creature is what's known as a parasite, 'ee leeches off o' your Windows Management Instrumentation databases. It's 'ard to satisfy one o' these buggers, they'll never leave ya alone until they've done your work for ya.
</steve irwin>
Parent
No problem here! (Score:5, Funny)
SP2 - as secure as any linux distro... (Score:5, Funny)
Re:SP2 - as secure as any linux distro... (Score:5, Insightful)
Parent
Re:SP2 - as secure as any linux distro... (Score:5, Interesting)
Seriously, this Security Console is a good example. "What if somebody could tell if their machine was secure just by opening a control panel?" That's a very good idea -- but it will take at least a year to develop something like this that actually works well enough to be a part of windows. In the meantime, they shake and bake something so people know they're working on it.
This is the Microsoft equivalent of Sourceforge Development Status 1. It's a dog and pony panel that will undoubtedly be replaced by something good in the future -- but by that time, most of the industry will have lost all trust in it.
Such is the case with IIS 6. It's actually pretty good, according to a lot of web programmers I know, but I just don't trust it -- to the point that I'm considering not using C# for impending web projects despite having a massive C# codebase. MS would have to go VERY far to get that trust back, and make a security leap similar to the UI leap they made from 3.1 to 95 or the stability leap they made from 98 to 2000.
Parent
Re:SP2 - as secure as any linux distro... (Score:5, Informative)
You probably don't know it, but marketing is about giving people the product they want. Unfortunately many companies (and Microsoft is one of them) talk about marketing, but what they are really talking about is advertising.
"What if somebody could tell if their machine was secure just by opening a control panel?"
This statement would be a really bad example of marketing: The company and/or its developers and "marketing" experts sit together and brainstorm without ever actually asking the customer. If they were to ask me this exact question, my answer would be:
"Are you really this insane? I don't want a control panel to tell me whether my machine is secure. I want the machine to be secure, plain and simple. Given MS Windows' (whatever incarnation) security track record, I neither would nor could ever trust any application that tells me the security status of the machine from within. It's probably already cracked, infested or whatever anyway by the time I check it. If history tells us anything, it's that any application can be made to tell me that it is secure."
I couldn't agree less with you. According to developers who are far more experienced with Windows than I am (IANAP), Windows is insecure by design, no fix or additional security layer on top of the current product will ever make it more secure. The only way to fix it, is to dump it and start from scratch.
This is the Microsoft equivalent of Sourceforge Development Status 1. It's a dog and pony panel that will undoubtedly be replaced by something good in the future -- but by that time, most of the industry will have lost all trust in it.
Many people argue that XP is, while more stable than all previous versions, with the notable exception of W2K, is still in development status and many of its design features are so braindead, that many knowledgable people have already lost trust in it.
IMHO, this is yet another stupid toy to make the casual home user and the boss feel more secure without actually delivering on the promises. If you were to ask them, they would all answer that they want a machine that is actually more secure rather than a having a MS tool that tells them they are. Once they told you, you design a product that is actually secure and does what the customer wants. This is marketing from an academic's point of view.
Parent
Its not that bad (Score:5, Insightful)
The nag "Where if your anti-virus" box is a reminder that windows needs an AV program to run properly. I can't stress how important a built-in firewall is, even if it is "weak" its still going to introduce people to the concept of a firewall much more than the old version did. Personally, I dont think ports over 1025 should be blocked by default, but that's just me.
I've been running SP2 since MS released the final version and am pretty pleased with it. XP even feels snappier. It passes the "grandma" test fairly well and like you wrote is a good first step towards securing windows. If it only helps fight spyware installs its worth its bytes in grams of gold. Especially for us techies who get called, bothered, etc for stuff that is completely preventable.
This is really the first step to securing windows for the everyman, if such a thing is truly possible. Soon enough current machines will be replaced with machines with processors which understand NX, thus making the feared buffer overflow much less fearsome.
Even though SP2 is going to cause all sorts of headaches with clients, friends, and family, I'm very optimistic about what it can do to help stop spyware and to a lesser extent worms and viruses. Its a real shame there isn't an equivalant SP for the HUGE win2k user base out there. Seems like the script kiddies will now be focusing on win2k machines from now on.
Parent
Re:SP2 - as secure as any linux distro... (Score:5, Interesting)
It drops an executable into the Startup folder for the *user*. In other words, no root privledge is ever exercised, and the app would likely do nothing on a correctly-configured box (the worst malware can do running as non-root is wipe a user's directory -- same as in Linux or any other OS with similar permissions). Learn about security before you comment on it, please.
Parent
Re:SP2 - as secure as any linux distro... (Score:5, Interesting)
First, let me assume you didn't mean what you said. What you *did* say doesn't make sense, as the only way for a system to run with less privileges would be for it to not even have a System Administrator account while leaving some other system with that authority. That sort of top-down authority over PCs seems quite out there for all sorts of reasons.
So, lets assume you mean "the main problem is users running with more privileges than they need". The problem at core then is *why* they run at higher privilege than necessary. Part of the reason is that Run As and the like are not inconvenient and just not well known. In the process of making the system more "user friendly" Run As and ilk aren't at all discussed. In fact, users added at install are given power user (which can do all sorts of nasty things to applications) or administrator power.
For the complete naive (or to overcome various limitations to Windows sessions, like not being able to do persistent apps in the background (dialup users on at least Win 2k (and possibly Win XP, though having not used it in that capacity I couldn't say), you know what I'm talking about)), this means having one account open either all the time or possible on auto-login. For the less naive (or users who can figure ways to overcome the limitations of Windows), you'll create multiple users, but then all users can still screw up the entire machine with *anything* they run. Yes, physical access does mean you can 0wn a box, but like you pointed out with so many buggy programs it also means very much that non-physical access can 0wn the box too.
My point in all this is, even users who *try* to do some security are still fucked over thanks to MS opting for ease of use and "usability" over reducing privileges, finding a better way to have someone admin the box (and watch users flee when they realize they have to do work; oh, but it's better to go under the MS banner of low/no maintainance, turn a blind eye to the reality that most PC software needs maintained, then moan to all your techie friends that your computer is so slow, keeps crashing, etc), and teaching the user how to run the few necessary programs in "less-secure" mode (anything automatic short of extensive hashing will end up being spoofed and exploited all over, so it's better to rely on the user) while making sure Windows itself is actually designed to handle multiple people using a machine.
But, all those stack protectors should slow down those hackers, hopefully (well, assuming they're done at runtime in a staggard approach to avoid a whole cluster of near-identical hardware all producing the same value; the last thing you want is something predictable), which is at least some small consolation for those who actually update their machine...
Parent
Re:SP2 - as secure as any linux distro... (Score:5, Insightful)
I'll grant that some of the Windows defaults are appauling, security-wise, and creating users as Administrators is part of that. Microsoft are making an effort to advertise features like Run As, though - there's a topic in XP help explaining why running as an Administrator is a bad idea, for instance.
(That said, I've no idea how many people actually read it, of course).
The point I'm trying to make is that any system with uneducated administrators is going to have security problems, sooner or later. Most Unix users tend to do their research and understand why running as root is a problem, as do the application developers. If your applications will run fine as a normal user, then people will run as a normal user.
That doesn't apply as strongly in the Windows world - people are much less likely to do any security research, and application developers do have a tendency to make it harder for people to run as a user. That's beginning to change, though - the current guidelines for the "Designed for Windows" logo on software include a requirement that software runs correctly as a non-administrator.
Hopefully, the next release (be it a SP3 or Longhorn, should it ever be released) will concentrate on the user education side of things, and make it easier to do the right thing with regards to least privilege.
Parent
Leave it to microsoft (Score:5, Interesting)
Internet Meltdown Predicted for Today (Score:5, Funny)
That's ok (Score:5, Funny)
That's ok. MS probably wants it to be easy to use so that everyone can use it.
Pseudo Problem. (Score:5, Insightful)
This is like complaining that one can shut down your computer by removing the power plug.
Re:Actually, no... (Score:5, Informative)
Yes it does [google.com]
Parent
Scary stuff. (Score:5, Interesting)
Step 2: Drag the scrollbar down a bit and let go
Step 3: Start -> Programs -> Startup
That's just spooky.
Re:Scary stuff. (Score:5, Informative)
Step 0: Open IE
Couldn't even drag the scrollbar in Firefox :-/
Then I opened IE and tried it - jackpot. Nice little booom.exe in my startup folder. I have SP2 installed. Good grief.
Parent
Re:Scary stuff. (Score:5, Funny)
I guess I'll have to switch back to IE.
Parent
Incorrectly report, but change? (Score:4, Interesting)
What I've yet to see is any indication that its possible to actually do the turning off of things, which would be rather more serious.
As it is, surely the only problem is if you forget that you turned something off? I've no big plans to make my box insecure now I've done configuring it on installation.
Close it anyway MSFT or stop the default Admins! (Score:5, Insightful)
Sadly just about everyone runs shit as Administrator (it is the default mode for XP Home installs) to make life easier and as MSFT has noted they are opening themselves up to the attacks... For those that will mention that Linux is so much better remember that these are the same people that wouldn't like to have to change to root (sudo, su, login, whatever) to install anything and would be opening themselves up to the same vulnerability level as if they had been running Windows.
Basically the problem was in design... They should not have had an open API controlling the "WSC" and thus malware would not be able to detect the presence of the programs' status from a single location. The real problem is that MSFT isn't admitting that it is a serious problem and needs to be changed on a different level... Saying that malware writers are going to use the direct route and disable the firewall/AV outright, while true, doesn't get them off the hook for creating this hole that is more difficult even for a more advanced user to notice.
Re:Close it anyway MSFT or stop the default Admins (Score:5, Interesting)
Linux, I feel, has a better system at the moment. However, as this is the developers fault, I see no reason why linux would be immune from this problem.
Parent
UA String any different? (Score:4, Interesting)
No real surprise (Score:4, Insightful)
Personally, I'm just glad that it doesn't bomb randomly after install. Yet.
Need root? (Score:5, Insightful)
While we are not aware of any malware exploiting this, we think it will only be a matter of time. The one mitigating factor that we found is that to change the WMI, and spoof the Security Center, the script has to be running in Administrator mode. If executed in Windows XP's Limited Mode, it will give an error, and not allow changes. Unfortunately, most home users who will be at risk, run in the default administrator mode.
How can we convince people not to run admin mode? It's easy at work, in UNIX land (most people don't get to know root pw.) But most Windows users I know don't even know the difference.
Every windows security problem I know of can be solved, or at least significanly mitigated, by users not running root.
Re:Need root? (Score:5, Informative)
Most programs on Linux run happily as a non-root user. So many programs on Windows force you to run as an admin user that most people who even think about trying to run as a non-root user quickly give up...
Parent
I installed it last night (Score:5, Informative)
It's 94.50 mb which takes a while to download. Upon installation and restart the new windows security center pops up and trys to get you to turn on your firewall, automatic updates and antivirus software. By default if any of these are off, there's an obnoxious red shield in the system tray. Turning off alerts for these makes it go away.
Otherwise there doesn't seem to be any major changes.
So far nothing's borked.
Send in the Rovers (Score:5, Funny)
Maybe MS could get NASA to send a few rovers in there to see what they can find out.
I don't think anything can be done. (Score:5, Interesting)
I've always criticised Linux users for being sloppy and the like, but the operating system itself is at least rock solid. It rarely crashes, it has a decent windowing system, and I don't see advisories for it on Bugtraq every 8 hours. Windows is easy to install, but it's all too easy for someone else to compromise. Ease of use is nice, but I think I'll take peace of mind with GNOME on Fedora Core.
Running as admin? (Score:5, Insightful)
The next thing to be said is usually: "But most home users run as admins." (The article also mentions this.) Well, that's not a Windows problem; that's a user problem. Even if Windows forced users to run in "limited mode" (which would cause an outcry in itself - "eek, Microsoft is trying to take away control over our own computers from us"), it also doesn't help that most third-party software for Windows requires admin rights either to install or *gasp* to run. Of course, this is ancient news to everyone with a clue
Of course, even when running as admin, protecting yourself against malicious code is fairly trivial; simply use a firewall (SP2 incidentally includes one), don't run binaries from untrusted sources, surf the web and check your email using something other than IE/Outlook [mozilla.org], use a virus scanner/shield, and keep your apps and OS updated. Again, no news to anyone with a clue.
Re:Running as admin? (Score:5, Insightful)
You are oversimplifying. Ask yourself why most home users run as admins. May it be because that's the default? Because XP doesn't even offer another setup option, but hides it well? Or maybe because tons of things simply don't work if you run as a normal user?
Driving reckless is a user fault, yes. But driving reckless when that's how the manual told you to do it and that's what the car was designed for makes it a bit more tricky to properly place the blame.
Parent
M$ should make the Admin account anoying to use (Score:5, Insightful)
Bad Logic From Microsoft (Score:5, Interesting)
They bypass this obvious lack of security as a feature, and that the application is rather to serve as an extra barrier of obscurity to hackers, and not as a solution to the problem (which it will ultimately be marketed as.)
This unfortunately isn't an adequate mentality. Microsoft appear to make the mistake to think that hackers are as technically challenged as their regular home user base.
Yes! certainly a home user wouldn't be able to craft some accidental software that rips a hole through the new security centre features. However, hackers which discover holes in Windows (Without ever seeing the source code.) have the competency to add the extra layers of dodging to their worms. This it at Microsoft's peril, as now worms can fool a system into reporting that everything is fine, in turn fooling the technically challenged home user into also thinking, that their new DDoS server is also functioning without a hitch.
Microsoft needs to understand that hackers are significantly "gifted" in comparison to their regular user base (many of which who'd think Mac OS X is another version of Windows.) They must craft their security devices such that they can not be trivially undermined, and put an end to the assumption that more easily bypassed road blocks lead to greater security.
Cowards at PC Mag (Score:5, Insightful)
People, get a clue: a "malicious site" can't do anything to your computer, unless your box has already been compromised.
PC Mag, here's an idea: tell the users what the real problem is. You damn well know what it is. But you're afraid, because they spend a shitload of money on ads.
Animated dog... (Score:5, Funny)
Re:Can someone answer this question? (Score:5, Informative)
Parent
Re:Leopard? (Score:5, Funny)
Cue Marlin Perkins (of the old Mutual of Omaha Wild Kingdom [museum.tv] shows):
MP: "Today, we are going to find and capture the elusive XP2 Leopard. My associate, Jim, is armed with a toe-nail clipper and a badminton raquet. Jim, why don't you start marching down that trail over there? I'll be back at the truck with the cameraman and a bottle of scotch."
Parent
Re:this is surprising? (Score:5, Insightful)
Parent
Re:this is surprising? (Score:5, Informative)
Of course, you can "update" them also with mod chips, but I don't think that that is what you had in mind :)
Parent
Re:this is surprising? (Score:5, Insightful)
I guess that depends on what you mean by "have to". An out of the box Fedora Core 2 system will work and play just nicely with your email, office, internet, graphics, video, etc. An OOB Windows XP install will only last 20 minutes once connected to the internet.
Out of the box Fedora may work with everything, but at some point in time, security vulnerabilities will be found in some piece of open source software, and a patch will (quickly) be made available. An unpathed *nix machine can be just as dangerous as a Windoze box.
Parent
Re:this is surprising? (Score:5, Informative)
Windows XP came out in 2001. Do you really need me to tell you that running a RedHat distribution from 2001 would be suicide right now?
Parent
Re:I'm sorry, were you expecting better? (Score:5, Insightful)
Quite frankly, if MS never "innovated", it would be a fairly secure product. NT 3 was practically bulletproof. It's when they started grafting on Win32 junk from 9x, things started to get screwed up. Take off that top layer and everything would be kosher (but a lot less user-friendly)... just like Linux.
Parent
Re:I'm sorry, were you expecting better? (Score:5, Interesting)
Parent
Re:I'm sorry, were you expecting better? (Score:4, Informative)
Parent
Re:I'm sorry, were you expecting better? (Score:5, Informative)
Parent
Re:I'm sorry, were you expecting better? (Score:5, Insightful)
If Microsoft would focus on *real* security like that found in FireFox, OS X, etc., they wouldn't have to put these stupid "security" enhancements in. On the bright side, Microsoft is making Macs veeerrrry attractive to end users.
Parent
Re:I'm sorry, were you expecting better? (Score:5, Informative)
META REFRESH is not a good way to redirect people, and furthermore, it's not standards compliant. Allowing META REFRESH to direct users around the web without their consent is deceptive, and a major usability problem for users.
One of the big goals of SP2 was to improve the web browsing experience for users tired of getting hijacked by bad nasty web pages that intentionally use seemingly harmless methods to corral, trap, and frustrate users.
A lot of people use the META REFRESH directive to move them to a new URL once an old one has expired. Even on FireFox/Mozilla this can be used to trap users, enable phishing, and the like.
Better methods when you can addresses is to:
Use server side URL rewriting, like in mod_rewrite or like available in IIS
Display a simple page with a large clear hyperlink and message to update the original link
Display a simple page like above and use a simple Javascript to move the user (unlike META commands, the Javascript can be disabled).
Use the appropriate 3xx HTTP status code and let the client handle the change appropriately
Parent
Re:You would think.. (Score:5, Insightful)
What Microsoft is doing is analogous to me trying to turn my apartment into a bank:
Initially I just put up a sign that says "Bank" and leave the money lying on my sofa. Then when I get tired of people walking in and taking the money I lock my door. Then they kick in my door, so I get a thicker door. So now they climb in through a window, so I close and lock the windows. They break a window, I put up shutters. They cut through the floor, I lay down cement; ceiling, I add an alarm; they cut the electricity, I buy a generator. Maybe at some point I buy a safe, which works until they pick the safe up and roll it out of a hole cut into my wooden walls. This goes on for years, until eventually I get fed up and move out, and have a building built to purpose that's secure as a bank should be.
Where this analogy breaks down is at some point pretty early on customers would stop giving me their money until I got my act together, where they've shown no intention of doing the same to Microsoft.
Parent
Re:This sounds like a typical... (Score:5, Insightful)
Parent
Re:Please help a Linux Newbie (Score:5, Funny)
What do you mean *They*?
It's the same guy Anonymous Coward every time!
Parent