Slashdot Log In
MS Security Guy Wants Vista Bugs Rated Down
Posted by
CmdrTaco
on Sun Mar 18, 2007 08:07 AM
from the grass-is-greener-on-his-side dept.
from the grass-is-greener-on-his-side dept.
jcatcw writes "Gregg Keizer reports that Michael Howard, an MS senior security program manager, says that the Microsoft Security Response Center (MSRC) is being too conservative in its Vista vulnerability rating plans. Microsoft's own bug hunters should cut Windows Vista some slack and rate its vulnerabilities differently because of the operating system's new, baked-in defenses."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Hmmmm. . . (Score:5, Funny)
More like "half-baked"... (Score:3, Funny)
Yeah, right. He's been reading too much William Gibson...
Isn't that ..... (Score:5, Funny)
Re:Isn't that ..... (Score:4, Funny)
Parent
Re: (Score:3, Funny)
Re:Isn't that ..... (Score:5, Insightful)
Let's say on *nix there's a vulnerability that allows for remote ssh access. You can only get in as an unprivileged user, heck, you may even get
Just because your system is overall more secure doesn't mean that you don't blow the whistle on the flaws just as hard. It's called VIGILANCE.
Parent
Re:Isn't that ..... (Score:5, Funny)
Mmmm... while it's true that the price of freedom is eternal VIGILANCE, remember that you can get Vista Ultimate for as little as $399.95.
Parent
Re: (Score:3, Informative)
Did you intend those two scenarios to be mutally exclusive?
Rating a bug low does not necessarily mean that it is fixed slower.
Re:Isn't that ..... (Score:5, Insightful)
A bug may be high severity (e.g. remote access) but low priority (e.g. because it's believed that other factors mitigate the remote access).
Another bug may be low severity (e.g. a user interface quirk) but high priority (e.g. because reviewers have seen it and are talking down your product because of it).
Severities should be based on how much damage may be caused to the *users* of the program. Priorities are usually determined by how much damage the bug causes to the *developers* of the program
Parent
Re:Isn't that ..... (Score:5, Insightful)
Don't take this personally, but:
What frickin' planet are YOU on? Most Windows users expect Windows to take care of all that FOR them....and boy, are they surprised to find that clicking that "You're infected! Click here to pretend to fix your computer whilst actually infecting it!" actually DOESN'T fix a darn thing. I'm not talking ALL Windows users, but it's a frighteningly large group.
What MOST Windows users want is a system that doesn't make them THINK.
Parent
Re: (Score:3, Interesting)
You're saying that as if it's a bad thing. Do you insist on an OS that makes you think a lot?
While you're thinking on the OS you could be thinking on the next YouTube or something. Why waste so much talent? Anyway, if Microsoft survives Vista (which it'll most likely do), and has success with Vienna, we'll have exactly that: proliferation of managed, secure code and deprecation of binary code (which will run in sandbox) except for a range
Re: (Score:3, Interesting)
You say that as though the amount of thinking a person can do is a finite quantity, and that each time you think you decrease this quantity, so therefore the wise thing to do is conserve it as much as possible.
However, it's really more like a muscle -- the more you use it, the more able it becomes. Linux made me think very much when I first began using it, especially considering that this w
Re:Isn't that ..... (Score:5, Funny)
While the first part is true, Windows users (myself included), by definition, are ignoring one fundamental security practice... they aren't using a secure system in the first place. It's like making sure your front door is bolted shut and you've got bars over all your windows, but your house only has three walls (and it's not triangular).
Parent
Re:Isn't that ..... (Score:5, Informative)
To give some context to who Michael Howard is, he is one of the head security guys at Microsoft. One of his roles is to improve the development process across Microsoft to improve security. So the MSRC responds to actual security vulnerabilities, while Michael looks at why the development team missed the bug and how to avoid it in future products.
If you read what Michael actually said the issue becomes more apparent. A security bug that affect Vista and XP will usually be given the same rating, even if Vista has defense mechanisms that it make it extremely unlikely that it can be exploited. In the security alert they will list any defense mechanisms that make it harder to exploit the bug, but they don't change the rating.
Parent
Hal Howard (Score:2, Interesting)
A rough translation to human speech... (Score:5, Insightful)
This was a public service translation, for those who have trouble understanding Microspeak...
Its about the bug, not the environment (Score:5, Insightful)
Say a new local SSH exploit has been found allowing attackers to gain root privileges. Does the fact that you'd need user accounts which are actually useable by people make any difference on the severity of the exploit? "Gee, cut the homeuser some slack since they won't have any real user accounts to begin with. So stop scaring them and rate the bug as it really is?" ? But... The bug really is what it says to be. In my example its a critical issue, in the case of a Vista bug its Important.
Just because you may benefit from the extra security enhancements doesn't imply everyone else does. So please; cut out the idiocy and the desperate attempts to push Vista forward by focussing on all good points and ignoring the bad points, and simply keep calling things what they are. I for one now question the professionality of this guy.
Re:Its about the bug, not the environment (Score:5, Informative)
Note that OpenBSD is also adopting similar defense-in-depth strategies, including SSP and N^X. Adoption is much more haphazard on Linux Distros, so you may be at much more risk running an application such as SSH on Linux than on OpenBSD even when it is compiled from the same source code.
Parent
Re:Its about the bug, not the environment (Score:4, Informative)
http://gcc.gnu.org/gcc-4.1/changes.html [gnu.org]
Parent
Re:Its about the bug, not the environment (Score:5, Insightful)
Errr, NO , this guy promulgating deceptive doublespeek. But perhaps he knows better - perhaps he's just a dishonest jackass and not a retarded jackass. What was your point again?
Parent
Re:Its about the bug, not the environment (Score:5, Insightful)
As we've heard that much (some?) of their vaunted security is actually just optional smoke and mirrors (several of the user security features for instance), I don't think MS Vista should be given any easier ride than any other operating system. Let it be judged independently, on its own merits, and not through re-definition of what is critical or not for political (and of course publicity and monetary) purposes.
Any system that defines itself as "secure", but isn't, deserves to be ranked accordingly. Microsoft (and it isn't alone by a long shot) has a very long history of selling one thing and delivering another. Changing the criteria based on what they are selling isn't warranted until what they deliver matches that in every respect. So far, they aren't doing that with MS Vista either.
Parent
Re:Its about the bug, not the environment (Score:5, Informative)
- /GS. In theory works fine. In practice, you MUST (1) get the software publisher to compile with the switch, (2) cannot use inline assembly (/GS bails out on such code), and (3) must be willing to sacrifice a small bit of performance. In other words, a fair amount of real-world code can't use this. And oh by the way, this doesn't protect against all buffer overflows - it only protects against the easiest category. It's still quite possible to corrupt data with a buffer overflow, and maybe use that data to gain control.
- /SafeSEH. Right
... how many common languages don't have good exception handling? You said C only, right? And how often do you use Windows exceptions in C? Not much, you say? When I've seen SEH code, it's almost always very narrowly scoped and thus easy to get right - in real code, Windows SEH is just a trampoline to get into another exception mechanism. Making it "safer" adds no value.
- ASLR. This one makes generating a sucessful exploit a little more difficult - moves it from medium-easy to medium, because it's harder to hit a "target buffer". Of course, for compatibility reasons, a fair number of apps turn this off (they have assumptions about where code lives, and/or need the wasted address space). It helps - statistically. But a lucky guess is still going to succeed, and I don't trust luck for security.
- DEP. A two-pronged technology, which (1) uses the NX bit and (2) disallows syscalls from data segments. Oh but wait, (1) requires having a fairly recent processor and (2) is fine for some apps, but breaks for anything that does dynamic code (e.g. a Java runtime), so it's also disallowed for many, if not most, apps.
So what do we find out from this list? You get defense-in-depth - IF you are running the latest hardware, IF you use only software built with MSFT's favorite options (some of which are opt-in), and IF you only run apps that embrace all these strategies. How many Joe Consumers fit into those ifs? Datacenters might be closer, but I'll bet even they can't generally say all these hold true.I'm glad open-source is adopting some of these measures. But let's be realistic - all any of these technologies do is make a sieve less leaky by putting a second sieve underneath. Something is nice, but we would be fools to treat any of these security "features" as more than a speed bump.
Parent
Re: (Score:3, Interesting)
Usually those are described as mitigations, since there are no security guarantees associated with them (since they can be bypassed, they're not security features.
Re: (Score:3, Interesting)
And that is a correct assumption to make. If a security "feature" can be bypassed or disabled, you can't make any other assumption. I firmly believe the biggest threat to Microsoft security is Microsoft itself. Policy from one section of Microsoft is fighting policy from another section. The se
You keep using that word (Score:2, Insightful)
Or, you're a FUD-peddler whose job it is to convince Gartner that you don't suck... I'm not sure.
New rating for new system? (Score:4, Insightful)
An exploit is still an exploit. It doesn't matter if it's found in a brand new OS or the predecessor.
Thank god there are people who doesn't agree with him.
Re:New rating for new system? (Score:5, Funny)
Parent
This is not wise (Score:5, Insightful)
In short I don't think Michael should assume. When you assume, well, you know.
stop whinning and just.... (Score:4, Insightful)
Re:stop whinning and just.... (Score:5, Insightful)
Not because of anything so simple as crap coders or Microsoft being shit (lame reasons when there are so many others that can be justified with examples) . They can't because it's too complex, subject to too many attack vectors, and closed from peer review of code.
Time was this refusal to allow external entities to search for and fix bugs in their code was acceptable as normal business practice. Since Linux got more popular, people have started to see that peer review of code is superior when it comes to finding and fixing errors.
I'd be willing to bet that if Linux was closed source it would be as defective as Windows is. That it isn't testifies to the usefulness of open source/bsd style approaches.
Parent
Re: (Score:2, Insightful)
Re: (Score:3, Informative)
P.S.: Note that OpenSource programs with few developers interested in the code run into this same problem. Good peer review takes lots of eyes in multiple environments over an extended period of time. A structured code walkthrough just isn't the same thing. It helps, but it's not the same.
Re: (Score:2)
Missing the point (Score:4, Insightful)
Tired article on a stupid statement. (Score:4, Insightful)
I'm sure we've all said a few things that were externalized "thought experiment" instead of "well thought out conclusions". And I think I can see how his line of thinking was going, although I disagree with his statement. And I wouldn't be surprised that in hindsight he disagrees with his own statement.
Microsoft has inadvertently set this guy up as a fall guy by anointing him as a semi-official spokesperson. Hopefully he won't find himself on the street due to what is a failure of his management.
Obligatory (Score:5, Funny)
That's a hard one. (Score:2)
A little late for that... (Score:5, Insightful)
By this logic, then, shouldn't most of the bugs for Linux and OSX have been rated as "relatively unsafe", while the Windows bugs were almost universally labeled "Über-pWnz0r3d"?
It seems like he wants this just so he can compare turds to turds, boosting the sales of Vista by saying the Windows 98 and 2000/XP bugs of yesteryear were worse because the same bug is arguably less severe under Vista. It may be true, but he should hope that if anyone takes him seriously, they don't start rating severity relative to similar bugs in competing products.
Be careful what you wish for...
softer... (Score:3, Funny)
It would seem.. (Score:4, Funny)
MS Security Guy? (Score:2)
Of course! (Score:4, Funny)
An interesting response (Score:5, Interesting)
baked in? (Score:5, Interesting)
in Microsoft Vista, what's higher than administrator?
root
superroot
supersuperroot
that's right, there are three privilege layers above administrator in Vista.
users cannot access those, but software can.
"Oh, you're a process, here's the keys!"
"Oh you're a user? You want to access your computer, confirm or deny?"
Re:baked in? (Score:4, Funny)
Parent
OS bakers poem (Score:4, Funny)
a look at microsoft half-baked
hit the bong and sing this song
windows got security wrong
Around we go with disclosure fud
Michael Howard please pass the bud
I think MS needs to talk to a lawyer (Score:3, Insightful)
Simple send each and every person who works for the company in anyway to a lawyer and tell the obey the first rule.
SHUT THE FUCK UP
Just stop talking, do NOT say anything, remain silent.
MS just can't do that and keeps blurting out things that make it seem extremely silly indeed.
This latest claim is like saying that a grease fire in your kitchen isn't dangerous if you live near a firestation. That getting shot through the chest isn't as much a of a hassle and shouldn't count as an attempt on your life because you happen to be in a emergency room.
A bug, is a bug, a security hole is a security hole. That they are even rated is already bad enough. They should have just one variable "fixed" wich is a boolean.
Claiming that a so called critical bug isn't as severe because the unproven untested OS it runs on has some safety measures, which by the way have been programmed by the same people who programmed the bug, is not exactly raising my opinion of MS.
Had they simply listened to the lawyer they would have kept their mouth shut and not dropped another notch in my estimation.
Perhaps it is all part of a cunning plan with them hoping that humans like computers suffer from wrap around and if they lower my opinion far enough it would wrap around to positive again.
or they are stupid.
But I liked the end, unless Vista picks up it will receive the same non-attention as OS-X, now that gotta smart.
They want to do something about security? (Score:3, Informative)
That means getting rid of "Security zones". All documents displayed by the HTML control must be considered "untrusted".
To do this, start by getting rid of the ability for documents viewed in the HTML control to request the use of ActiveX objects, since no documents are considered trusted, ActiveX can't be used anyway.
At the same time, provide a mechanism like IO Slaves for applications to install controls... a mechanism that can not be requested by a document.
Modify Windows Explorer and Software Update to use this application-controlled mechanism to install components into the HTML control.
Create an IE shell that installs an "ActiveX IO Slave" to restore the existing behaviour. This shell will display windows with some visual indication that they are untrustable and dangerous. Users who acually require this functionality during the transition can run the "Insecure IE" shell.
In the next major release of Windows, remove that component.
Conservative? (Score:3, Insightful)
Err, right. So if they're so conservative, how come they'll rate a remote code execution bug as "moderate" if the code is run in a restricted context (see, e.g. http://www.microsoft.com/technet/security/Bulleti
It's Simple - This is the "new" Microsoft spin (Score:3)
Then they also had some Microsoft bozo post on his blog that he was going to compare vulnerabilities - actually, not even vulnerabilities but FIXES - between OS's - using the same discredited methodologies they've been using since forever. Naturally Windows came out ahead. He even tried to head off criticism by admitting he was a Microsoft bozo. Naturally, that didn't work.
In other words, Microsoft is trying to spin Vista's failure to be a "Windows security cureall" - especially since OneCare has been a PR nightmare by failing antivirus checks and then deleting users Outlook email files.
It's just another pathetic Microsoft pack of lies.
Remember, folks: ANYBODY authorized by Microsoft to talk to the public is a LIAR.
Microsoft does NOT sell software. It sells LIES.