Slashdot is powered by your submissions, so send in your scoop

 


Forgot your password?
Close
typodupeerror
×
Security Media Microsoft

SecurityFocus On MS Security "Hole" 413

Posted by timothy from the if-you're-sitting-at-the-console dept.
friday2k writes "There is an interesting writeup at SecurityFocus that puts the latest security 'hole' in XP into perspective. It is a worthy read and should remind us all of the real issues out there." And it collects into one place much of the flak I caught after posting about the claimed security hole opened by the XP Recovery Console.
This discussion has been archived. No new comments can be posted.

SecurityFocus On MS Security "Hole" More

SecurityFocus On MS Security "Hole"

Comments Filter:

  • So what? (Score:3, Interesting)

    by Anonymous Coward on Wednesday February 26, 2003 @05:32PM (#5389889)
    If as many people tried as hard to find security holes in OSX or Linux, there'd be reports for those daily as well.

    • Ubiquitousness doesn't explain MS vulnerabilities (Score:5, Interesting)

      by Infonaut ( 96956 ) <infonaut@gmail.com> on Wednesday February 26, 2003 @05:49PM (#5390040) Homepage Journal
      If as many people tried as hard to find security holes in OSX or Linux, there'd be reports for those daily as well.

      That's patently untrue. It's a well-known fact [mi2g.com] that Microsoft's security problems are not due to exposure alone.

      Microsoft's development model is fundamentally flawed from a security perspective, because it squarely places featureset additions above security. The corporate culture at Microsoft is and always has been more about gaining marketshare than about anything else.

      It seems that there are differences in security, above and beyond the monopoly domination Microsoft enjoys. How many ISPs use FreeBSD to run their servers? Hmm.. I wonder if there's more to it than just speed and the fact that FreeBSD is Open Source.

      I'm not alone in my assesment. There's this security guru named Bruce Schneier. Perhaps his name has crossed your desktop at some point. He's contemplating getting a Mac, because he is tired of hassling [siliconvalley.com] with security problems on his Windows machines.

      • Indeed, if a particular system were more vulnerable than Windows then crackers would scan for that system and attack it. Opportunists go for the easy prey, not necessarily the most common thing. You can find non-MS nodes on the internet if you look - that's not a problem.

      • Re:Ubiquitousness doesn't explain MS vulnerabiliti (Score:5, Insightful)

        by Mitreya ( 579078 ) <mitreya@g[ ]l.com ['mai' in gap]> on Wednesday February 26, 2003 @06:45PM (#5390603)
        Microsoft's development model is fundamentally flawed from a security perspective, because it squarely places featureset additions above security.

        Indeed. And not only featureset but usability and user-friendliness factor are also placed above security issues.
        As a result we have a dominant OS that's insecure and a secure OS that's mostly unusable by anyone who is not a third generation sysadmin. In all that rush no one had the time to write an OS that's is BOTH secure and user-friendly. Flame away :)

        • I agree here. I've been using Linux since 1995 almost exclusively at home, for security, stability and development reasons, but the older I grow, the more I think of this:

          It's great that we have security. Most people won't mind security. Even Joe Sixpack seems to understand that security is generally good. Now, people are starting to get that Open Source is secure, stable, blah blah blah..

          The thing with Linux (and probably BSD's though I don't have much experience there) is that most people that know what is a server, can set up a linux server. Even most of those people can keep their server relatively secure with security.debian.org and shutting down redundant stuff and such. But even many of those people are not willing to switch to Open Source on desktop.

          As I see it. Linux IS decent desktop OS too. If you pre-install Gnome or KDE or pretty much anything else for someone, they will be able to use it. My girl-friend has no trouble at all with my wmx-based desktop, after about 2 minutes of briefing. But the thing is, once things get nasty on Linux desktop they often need even MORE experience with the OS than when running a server.

          Once you have to touch the command-line, it can be a pain before you get used to it, but finding the relationships between the nice GUI and all the scripting and configs and stuff, is even more so.

          No flames though, this is getting better all the time, I think, but the fundamental nature of UNIX as opposed to Windows seems to make UNIX easier for someone who knows what he's doing (like sysadmin or developer) while Windows is still easier for my mother, which unfortunately might have to mess with the network settings to read her mail, even if somebody assisted her by phone.

          I'm currently doing a toy desktop OS with the idea of trying to combine the ease of use, even when going to system levels, with easy to develop with API, and strong security.. then again, don't hold your breath =)

        • As a result we have a dominant OS that's insecure and a secure OS that's mostly unusable by anyone who is not a third generation sysadmin. In all that rush no one had the time to write an OS that's is BOTH secure and user-friendly. Flame away :)

          I realise that the sysadmin comment was facetious, but you *did* say flame away ;)

          Yes, realistically, linux *IS* harder to learn than windows (learn, not neccesarily use). However, if you will settle for *only* using a windows-like interface, mandrake and lycoris are pretty damn accessible. Windows (in the easy-peasy sense of the word) is a *user's* operating system. Sysadmining isn't just point-and-sneeze in windows either.

      • The original poster said "If as many people tried as hard to find security holes in OSX or Linux, there'd be reports for those daily as well" and you countered with that article on mi2g.

        What does that article say? It says "Based on the number of vulnerabilities announced in 2002 that affect operating systems..."

        Now, either I'm an idiot or that article is basing its results on REPORTED VULNERABILITIES. Might the number of reported vulnerabilities have something to do with how hard people ARE LOOKING FOR VULNERABILITIES?

        The ONLY way to test the relative vulnerability of an OS is to do a thorough code review of each, or send experts on each into a room and ask them to find exploits (and both approaches won't even be that accurate).

    • If they reported _every_ M$ bug on Slashdot all the good articles would get pushed off the front page.

      OS X and Linux have their fair share of holes but they are generally patched faster and those patches don't have to come in this crazy "Service Pack" form of update that fscks your system.

    • Re:So what? (Score:3, Interesting)

      by El Cubano ( 631386 )

      If as many people tried as hard to find security holes in OSX or Linux, there'd be reports for those daily as well.

      There are as many people. Only with respect to Linux, they tend to be the developers themselves. Thus, the problems are usually fixed before the official kernel (or whatever other product) is released.

      Not only that, but if you fall victim to a security breach in an unstable or development version of a product, you were probably warned. I have yet to see an unstable or development release that did not include something to the effect of: "Don't use this if your data is particularly valuable to you."

      It's different with products from companies like Microsoft and Oracle, because we are almost always talking about "stable and complete" products.

    • Open-source vs. Microsoft security? Apache vs. IIS (Score:5, Interesting)

      by hkmwbz ( 531650 ) on Wednesday February 26, 2003 @07:07PM (#5390827) Journal
      It is difficult to prove this one way or the other. First, the source code for Linux is available, and as such more people can study it, and they probably do. Windows might be more widespread, but how many Windows users are actually knowledgeable enough to even find a security hole?

      It doesn't matter how many users it has because they users won't be looking for security holes in the first place. So if you put 10 Windows users in a room, none of them would know much about these things. Putting 10 Linux users in a room, and you increase the chance that you'll find a real hacker. I'm a Windows user myself, so I'm not trying to sound like an elitist bastard. I haven't even uncovered any security holes in my life.

      But it is difficult to determine this case, as there are a lot of questions and too few answers.

      Let us instead look at a piece of software where the numbers are reversed - where Microsoft's product has only a small part of the market.

      I am talking about the open-source Apache HTTP server, vs. Microsoft's IIS.

      Apache has 60-70 per cent of the web server market. IIS has less than 30 at the moment. Yet, despite these figures, Apache has had far fewer known security issues than ISS. How does this fit with your question? Obviously, there are a lot more eyes on Apache due to its large market share?

      So how does IIS come out so crappy when it comes to security?

      I think we can come to the conclusion that your "it's not as frequently used so very few are looking for security holes"-like statement simply does not make sense. It is a myth. FUD?

  • Best quote from the article (Score:5, Funny)

    by t0qer ( 230538 ) on Wednesday February 26, 2003 @05:33PM (#5389902) Homepage Journal
    I mean, if I wanted to hork data off of a system I had full physical access to, I'd just grab the drive, stick it in my pocket, and walk out whistling "Jimmy Crack Corn and I Don't Care."

    Now I can't get that song out of my head!

  • Holy shit! (Score:5, Funny)

    by Anonvmous Coward ( 589068 ) on Wednesday February 26, 2003 @05:34PM (#5389910)
    Anybody else stunned that Slashdot posted an article about MS that didn't involve an explanation as to how they're incompetant?

    • Re:Holy shit! (Score:4, Funny)

      by mrmud ( 219198 ) on Wednesday February 26, 2003 @06:02PM (#5390181) Homepage Journal
      Anybody else stunned that Slashdot posted an article about MS that didn't involve an explanation as to how they're incompetant?

      Yeah, I think the pigs are none to pleased about flying around and smacking into buildings. And I heard there was a mistaken delivery of 10,000 colocation air conditioners to hell...

  • I hate to say it.. (Score:5, Insightful)

    by grub ( 11606 ) <slashdot@grub.net> on Wednesday February 26, 2003 @05:35PM (#5389914) Homepage Journal

    .. but he is right about the physical security. Not long ago I walked a client several hundred km away through an OpenBSD boot via floppy so he could change his forgotten root password. I don't hear the masses screaming for Theo's head because this is possible.
    • Most of "us" (slashdotters, geeks in general) know that physical security is at least as important as network security. Joe Sixpack doesn't. What are the odds that Joe Sixpack is using OpenBSD? How quickly would your "security vulnerability" hit the media if the general public were to find out about it?

      As I said in a previous comment [slashdot.org], once the rumour gets out there, it will hit the media.

    • Re:I hate to say it.. (Score:3, Interesting)

      by jc42 ( 318812 )
      Not long ago I walked a client several hundred km away through an OpenBSD boot via floppy so he could change his forgotten root password.

      Somewhat longer ago, maybe 10 years back, I was part of a small team running a booth at a trade show. The booth next to us had a couple of guys who had puzzled looks on their faces, so two of us walked over and asked if there was a problem. They had a Sun workstation that they couldn't get to work because nobody knew any passwords. I reached over, rebooted it into single-user mode, changed the root password to something they knew, then did a full boot, and handed it back to them.

      The first thing one of their guys did was to change the root password again. And he didn't want us to watch the keyboard while he did it, so we couldn't see the password. We just looked at each other and walked off, trying not to laugh in their faces. "Uh, dudes; you just missed something important."

      A couple of years later, Sun added the ability to have a single-user password, so our neighborly helpfulness no longer works. I wonder what a Sun customer does now if the only person who knows a machine's password is squished by a semi? Junk the machine?

      There are some pretty silly "security" discussions going on.

  • win2k console? (Score:5, Informative)

    by Telastyn ( 206146 ) on Wednesday February 26, 2003 @05:35PM (#5389915)
    This appears to be a problem using the win2k recovery console on a winxp install, not the XP console.

    And all it allows you to do is copy files around. Whoopty do. Pop in a linux boot floppy with ntfs support and do the same thing, only easier (because the win2k recovery console doesn't support wildcarding; lame.)

    • Re:win2k console? (Score:2, Insightful)

      by zurab ( 188064 )
      Whoopty do. Pop in a linux boot floppy with ntfs support and do the same thing

      I thought that one point that was made was that you could use the win2k recovery console on XP without having to reboot it. That is at least slightly different.

      If any user was in possession of this recovery console, he or she could defeat the XP's multi-user environment while XP is still running. Moreover, it proves that it is possible for someone to design a tool that effectively bypasses XP's multi-user security *without* having to boot into a different OS and mount partitions from there.

      Obviously, the risk is not as bad as some articles depicted, but it's not a non-issue either.

  • Too many idiots. (Score:5, Insightful)

    by aridhol ( 112307 ) <ka_lac@hotmail.com> on Wednesday February 26, 2003 @05:36PM (#5389922) Homepage Journal
    The problem is that the "bug" was posted once. From there, it spread a bit. Once enough people heard it, it was stated as fact, even though it was nothing.

    Once the general populace knows about a problem, the media has to say something, because how would it look if they didn't report on a new trend? Suddenly everybody "knows" about the problem, even though it does not exist.

    • Whether or not, in this particular case, the reported exploit is not the vulnerability described, there have been so many valid, exploitable, preventable, denied by Microsoft, bugs/cracks/flaws/exploits/holes that Microsoft is presumed guilty from the get go. And considering their programming and their behavior following, this is to be expected. They've created an atmosphere where the logical, understandable response is to mistrust them. That's their doing, and they're the ones to fix it (if at all possible).
      • There are enough people here who will say that Microsoft is the problem. It's been said many times, many ways. It's repetitive. I think that both reasons are true, but I didn't want to say the one that will already be covered by everybody else.

  • So... (Score:5, Funny)

    by NanoGator ( 522640 ) on Wednesday February 26, 2003 @05:36PM (#5389932) Homepage Journal
    ... who still thinks the Registry is a bad thing?

    (comment to be taken lightly. Should irritation persist, chill.)
    • "... who still thinks the Registry is a bad thing?"

      Hmm. Whoever modded this comment as "Troll" probably didn't read the article.

      The article basically says that the vast majority of Windows config stuff is in the Registry. The Registry cannot be read from the console. I think it's because it's binary, I've tried to do it before and no luck. So you really can't do a whole lot but dump files to a floppy or something with this console.

      If the dude with the mod points had read the article, he probably would have found the comment rightfully amusing and not 'trolling'.

    • Re:So... (Score:3, Interesting)

      by CrazyDuke ( 529195 )
      I do!

      (boot sequence)

      Windows has detected an error in the system registry and is now restoring a previous backup.

      Registry fixed. The computer will now reboot.

      (boot sequence)

      Windows has detected an error in the system registry and is now restoring a previous backup.

      Registry fixed. The computer will now reboot.

      (boot sequence)

      Windows has detected an error in the system registry and is now restoring a previous backup.

      Registry fixed. The computer will now reboot.
      ...ad infinatum...
    • This "problem" is not caused by the existence of the Registry, but by dumb admins who allow booting of alternate media. That's not to say the Registry is wonderful, of course..

    • Re:So... (Score:5, Interesting)

      by DrXym ( 126579 ) on Wednesday February 26, 2003 @06:40PM (#5390549)
      The registry is an awful thing for the simple reason it sticks all your eggs in one basket. Now I know technically there are various 'hives' but if the registry gets corrupted in any signifcant way you are completely screwed whether one hive is nobbled or another.


      Your choices after that boil down to - restoring from a backup registry and praying that it works, or reinstalling. The recovery console is a joke and a last ditch effort. The only times I've required it are when I foolishly marked my temp folder as encrypted and a service pack used it before peppering my system32 dir with encrypted files and during recent filesystem data corruption. On neither occasion was it particularly useful and I was sorely pushed each time to recover to a working system.


      At least Unix gives you a fighting chance since configuration files are all individually named and occupy different places on the disk. It is quite possible to identify the precise problem and fix it if necessary. Those files might be messier, but at least its easy to back them up (since they're not 'live') and *much* easier to restore them. It is my opinion that the registry is quite possibly the most awful things about Windows, even before considering the mess of registry keys it actually contains.

  • WRONG! (Score:3, Insightful)

    by chill ( 34294 ) on Wednesday February 26, 2003 @05:36PM (#5389934) Journal
    [I posted this on SecurityFocus.]

    Actually, it is CRITICAL in one aspect.

    If Avaya's security consultant Ken Pfeil is correct when he said:

    "If the system is a member of a workgroup and not a domain, you can just change the user's password that the file was encrypted under," Pfeil said. "Then you can log on as that user having access to the encrypted file."

    Then EFS is useless in the standard configuration for protecting hard drives. Specifically, hard drives on LAPTOPS, which frequently get stolen.

    Most likely this is an IMPLEMENTATION issue, though, and NOT a "hole" in XP. It sounds like the certificate/key used for EFS is stored on the drive, and the password for it is tied to the Workgroup/Domain password. The certificate/key really needs to be stored on a USB key or other removable media, so it can be kept separate from the system.

    Encrypting files/folders/partitions on hard drives is supposed to guard against exposure EVEN WHEN CONTROL OF THE SYSTEM IS COMPROMISED!

    Case in point -- laptops. What is the point encrypting data on the drives if when stolen, the machine can be consoled and the password changed, opening all the files?

    I do not know if you can move the certificate/key off to removable media. If you can, like I suspect, then it is an implementation issue and not a "hole". If not...

    You are right in that it was overplayed as a major catastrophy, though. For almost all other cases, if you've lost control of the hardware, you're screwed.

    -Charles Hill
    • Yes, the EFS isn't really a proper guard against data being stolen upon loss of laptop. It is at most to stop casual people from picking up a laptop and ransoming off information. Any mediocre admin will be able to recover the information.

      This has been known for "some time now".
    • Actually, you are wrong. EFS can only be recovered by the Domain admin, which is off the system (unless they brought their domain controller through the airport with them). This "hole" doesn't help break EFS at all.
    • The certificate/key really needs to be stored on a USB key or other removable media, so it can be kept separate from the system.

      To Quote Dr. Evil: Riiiiiiight. Who do we know that schleps a laptop around and has to pop in a floppy or USB keyfobb in to access their files who isn't going to leave that device with their laptop? I'll grant you that keeping your security keys on your 'real' keychain with a USB keyfobb is moving in the right direction, but the people that get those nice expensive laptops many times can't even be bothered to enter their password when the machine boots up / wakes up. You show me a CEO that could be persuaded to do what you're asking and I'll eat my socks.
      • Thats why they made that little dohicky that works via RF - you wear a token and you can only read your encrypted files if you're within 5 feet or so of your laptop.
    • Fortunately for those of us in the know, they'll have to crack your admin account first. By default, you can only boot to an XP Recovery Console if you can supply the administrator password. You can turn this behavior off via a local security policy, if you wish, but I wouldn't suggest it :)

    • Re:WRONG! (Score:5, Informative)

      by jonsteph ( 561367 ) <(moc.rr.anilorac) (ta) (hpetsnoj)> on Wednesday February 26, 2003 @06:37PM (#5390511)

      Problem is, we're talking about Windows XP, so Mr. Pfeil is wrong.

      Assuming one can get Admin access to the installed OS (re-installing OS destroys access to EFS-protected files), resetting the password on WinXP in a Workgroup (as opposed to changing it) destroys access to DPAPI-protected keys, and hence access to EFS-protected files.

      Win2000 EFS is vulnerable to this sort of attack, but not WinXP.

      With WinXP, an attacker should endeavor to crack the user's password rather than change it to a known value. Even so, this attack can be mitigated by a) using strong passwords, and b) using SYSKEY to protect the SAM from offline attack.

      Other notes:

      1) EFS was principally designed to protect data when the hardware has been compromised, so the premise of this whole comment is wrong.

      2) EFS is one layer of defense-in-depth. It should be combined with strong passwords, SYSKEY, and proper recovery key management.

      3) Windows XP Key security is discussed here [microsoft.com].

      4) EFS does not support keys on removeable devices as of WinXP.

    • No, You're Wrong! Learn Here Grasshopper! (Score:5, Informative)

      by Nintendork ( 411169 ) on Wednesday February 26, 2003 @06:42PM (#5390568) Homepage
      EFS encrypts the file and adds a header for the owner and for the recovery agent(s) which contains the public key used for encryption. Only the owner or recovery agent(s) private key can decrypt the file.

      In a domain, the Administrator account for the forest root domain is the recovery agent. Additional recovery agents can be assigned through the domain group policy object. The certificates are self-signed if no CA (Certificate Authority) is configured. Any recovery agent should export the private key to removable media and lock it up in a secure place and keep another secured copy off site. Delete the copy from the forest root's first domain controller.

      On a stand alone server or workstation (Not a member of a domain), a self signed certificate is generated for use and the local Administrator account is the recovery agent. The private keys for the administrator and your own user account can be exported to a floppy or other removable media and deleted off the computer. Another copy should be kept in another secured location in case the first gets burned down, stolen, corrupt, etc. Make sure the floppy isn't in the laptop carrying case, otherwise, the theif will have your private key when he takes the whole bag.

      Another important thing to note is that the document is decrypted in memory and a clear text copy isn't put on the drive. A hacker going through your drive, looking for deleted temp files will be wasting time. If you want to be extra paranoid, configure windows to clear the page file at shutdown.

      For more reading:
      Click Here [microsoft.com]

      If you really want to learn this stuff, read this book. I found it to be extremely educational and was the only book to explain certificate server to me effectively.
      Click Here [amazon.com]

      -Lucas
      Windows NT and 2000 MCSE

  • Are u kidding? (Score:5, Funny)

    by vivek7006 ( 585218 ) on Wednesday February 26, 2003 @05:38PM (#5389943) Homepage
    What ever happened to journalistic integrity? It's like these people are making it up as they go along just to reel in the hits.

    Jornalistic integrity? Man which world do you live in?

  • Amen (Score:5, Insightful)

    by SamMichaels ( 213605 ) on Wednesday February 26, 2003 @05:39PM (#5389953)
    I'm with the author on this one. I dislike MS as much as the next guy, but I'd WANT a recovery disc to dump me at a prompt if the data files were corrupt. If the files on the drive are THAT important, they should have been encrypted anyway...and if I was the admin of the box, they would already be encrypted.

    I have nothing to worry about.

    • Re:Amen (Score:2, Informative)

      by chill ( 34294 )
      Reread the original article -- the password for EFS eencrypted files is tied to the user's password. If a user is part of a Workgroup, not a domain (think "laptop, remote user") then you can change the password locally and unencrypt the files.

    • I'm with the author on this one.

      I'm not, or at least I don't understand his passion and personal defensiveness. So a few blow hole Windoze rags got all excited? Could it be that those rags got upset because they actually think Microsoft "Security" is improving just like Bill Gates says it is? Why is Tim Mullen acting so offended? He wrote much of the article in the first person, using "I" no less than sixteen times. "Give me a break", he cries, "When banner ad revenue for a media outlet becomes more important than accuracy, it's time to find a new profession. " Is someone putting undue pressure on poor Tim? Like a major spnsor looking for damage control?

      Others are pointing out that Tim might have gotten the bit about "administrator" access wrong and that's important. The administrator may have control of tools that conceal his presence in a way that makes it easier to alter the system. Undetected system alteration is more damaging than simply digging up data. It gives the perpetrator access to data present and in the future undetected. That's far worse than stealing a hard disk and a good reason to take the five minutes (typical M$ efficiency!) to boot that way. It also justifies the use of the W2K boot disk over a Linux disk, though it's nice of Tim to portray Linux as the ultimate cracker tool. The only thing worse than no security is security that impeeds and lulls the user but aids the cracker.

      "What, me worry?"

  • who doesn't want this? (Score:5, Insightful)

    by garcia ( 6573 ) on Wednesday February 26, 2003 @05:42PM (#5389970)
    News flash: this is expected, and desirable, behavior. The Win2k RC can't read the XP registry, so it thinks it is a corrupted Win2k installation. When it can't verify the SAM, it bails out to the console. Administrators want this behavior. If you have an installation on which some third-party driver has hosed the registry, the Recovery Console will allow you to attempt to fix it. That's what "Recovery Console" means.

    No recovery console does not mean to bypass the password set by the administrator. It means to recover data that has been lost due to reason "foo".

    While I don't see it as being that big of a deal, you could do it w/any OSs bootdisk I suppose (or even a LILO prompt on a Linux machine) I think it is an odd bit of information that should be known.

  • Media exaggerates! Fear at Eleven! (Score:5, Insightful)

    by Hubert Q. Gruntley ( 310405 ) on Wednesday February 26, 2003 @05:45PM (#5389996)
    Media organizations know they get eyeballs when their audience is afraid.

    Ignorant and afraid of terrorists? Watch Fox News.
    Ignorant and afraid of hackers? Read Wired, or WinInformant.

    Maybe we should be afraid of ignorance, instead.

  • Sounds like a really useful tool, (Score:5, Funny)

    by tarquin_fim_bim ( 649994 ) on Wednesday February 26, 2003 @05:48PM (#5390023)
    does XP Recovery Console run on Linux?
    • No need, you can boot it directly off the Win2k CD. And for those cases where you've hosed a server, its a nice tool for getting things back to a basic state of functionality. I've even used it once to switch from the multi-processor kernel to the single processor kernel.

  • I found this part interesting (Score:3, Insightful)

    by bigmouth_strikes ( 224629 ) on Wednesday February 26, 2003 @05:49PM (#5390033) Journal
    "Instead of wasting space on functions that are not even vulnerabilities, they should be covering issues like Oracle's "unbreakable" applications having yet another series of remote buffer overflows that took six months to fix. They should be covering the fact that in order to get the patches for Oracle, you have to pay for them under a service contract. If Microsoft tried something like that, angry mobs of protesters would pull Bill Gates from his own home like a group of crazed Colombian soccer fans and bind him to a whipping post. "

    Although the last part about whipping arouses me in a peculiar way, I'd much rather see Larry Ellison's claims being dissected and put into context. Sure they are a marginal player in most markets, but in the enterprise application business they really advertise aggressively and not so truthfully.

    Seeing the tech press just relaying a story like this only confirms the notion that there are no journalists that understand tech, and no techies that understand journalism.

  • Oracle Bug Double Standard? (Score:5, Insightful)

    by iCharles ( 242580 ) on Wednesday February 26, 2003 @05:49PM (#5390041) Homepage
    I was intrigued by the note at the bottom: Oracle having a security flaw, taking six months to fix it, and charging for the patch. I did two or three quick searches of "Older Stuff," and couldn't find an allusion to it.


    In contrast, I know SQL Slammer was reported day-of. In this case, a free patch was available six months prior to the worm. And let's face it: if the patch is available but not applied, it's not Microsoft's, Oracle's, Linus's, or any other vendor's fault--only the SysAdmin in question.


    One major difference was that SQL Slammer took out several networks, where Oracle did not have such impact.


    To \.'s credit (and I'm going mostly off memory), but big critique was on the DB admins, not on Microsoft.

    • But the whole problem is the history of MS patches, I fell perfectly comfortable patching a test *nix computer and going to prod within a few hours. With windows I will have to start at the dev level because 7/10 time it will break something else and the developers need to fix it, then to test and god willing to prod the next day.

      Not even MS keeps up with their patches so who are they to fault sysadmins for not doing the same..

      • ---But the whole problem is the history of MS patches, I fell perfectly comfortable patching a test *nix computer and going to prod within a few hours. With windows I will have to start at the dev level because 7/10 time it will break something else and the developers need to fix it, then to test and god willing to prod the next day.

        Well, that all comes down to the basic tenants of unix. [camalott.com]

        1: Use text files. Easier to manipulate and edit.

        2: Make evry program simpele minded so the next stupid program can take over..

        Chances are if something actually does break, you can easily regress because you know that programs dont squash each others' feet. You just back up the new configs, replace the old configs, and replace the old program. All in all, it isnt that hard at all.

        In the MS world, things bumble over each other, configs are kept in a hard to control place (registry), and regressing certain server software is darn near impossible, without backups. Things are almost guaranteed to break in patches cause they usually add stuff in patches. Then the new+old stuff breaks. MS software is made easy for a limited set of users. Any user who "doesnt want it that way" has to hunt on Microsoft.com or call them up (heh). And chances are, there's bugs to prevent "that way".

  • Finally! (Score:5, Insightful)

    by djkitsch ( 576853 ) on Wednesday February 26, 2003 @05:50PM (#5390051)
    I totally agree on this - I've been doing Win2k installs for a few years now, and I'd have had to totally scrap god knows how many systems if it weren't for the recovery console.

    And the fact that you can use the Win2k boot CD to log in without a password isn't a bug, or even a security hole, it's simply the fact that MS didn't require a password to use the Console in Win2k.

    What do the critics want MS to do? Recall and patch every single Win2k boot CD?
  • I could install a rogue program(keylogger/backdoor etc..)on an XP machine through the 2k recovery?

    if so, it is an issue. espionage is a serious threat.
    • I'm not sure how....you can copy files to the hard drive, but you can't edit them using the console, and there are big restrictions on the files you can edit and overwrite anyway.

      I guess if you really thought about it you could, but there are so much easier ways of doing it.

    • Re:does this mean (Score:2, Interesting)

      by johny_qst ( 623876 )
      The answer is yes since you could transfer your program to the system where it would be run at system start... though this still doesn't make it much of an issue. The key to the article is physical security! Say it with me, physical security. If someone can walk right up to your machine then they can do pretty much whatever they want if they are technically sophisticated enough.

  • It all boils down to... (Score:5, Insightful)

    by Anonymous Coward on Wednesday February 26, 2003 @05:57PM (#5390135)
    PHYSICAL SECURITY. This is the first tenet of network security. Prevent the box from being accessed by those who should have no access. This tenet, however well implemented, is absolutely useless if the baddies that mean your network harm are INDSIDE the network, which in 75% of cases is true. It's a sad-assed day indeed when your own employees are the evil that is supposedly lurking outside the firewall.
    • Yep. My servers are in a server room with a locked door. We use these little black radio wave thingys that we wave in front of a panel to open the doors. each one is coded to a person and to certain doors. Also it has an alarm at that is set at night. Then the whole building is secure. Oh and the KVM has a password.

      So you need access to our building, access to my server room, know the pin to the alarm system and know a user and password on the kvm.

      If we wanted we could go farther and disable booting from floppy or CD and set a password on the bios and lock the rack door, but the first 4 layers seems to be enough.

      That article is totally correct.
    • Because I know you're all wondering:

      ten-et (n):

      An opinion, doctrine, or principle held as being true by a person or especially by an organization.
    • As a fun antecdote along these lines. The company I work for produces computer based physical security systems. (i.e. those cards you carry at work to get through the doors, they are for more than the CEO to identify you by).
      We had a server come back to us for maintainance one time, and as I was picking thorugh the registry, I came across the entries for Diablo 2. Now, it occured to me that Diablo 2 generally runs in full screen mode, so how exactly was the guard monitoring the security system while playing?
      Moreover, why in the world did the guard have access to the CD-ROM drive? There is no need for him to have it, the box itself should have been locked up, with the cables for the keyboard, monitor, and mouse coming out.
      In the end, I sent the system administrator an email asking him to tell the guards to leave the game files on the system next time they send it in, so that I can play while I work. (They had deleted the files) Never did get a response, but I imagine that the SysAdmin wasn't happy.

  • No hole. (Score:5, Informative)

    by Big Mark ( 575945 ) on Wednesday February 26, 2003 @06:00PM (#5390161)
    If this is a hole then so is the fact I can mount your ex2fs /home partition from a boot floppy and ftp all the filez there to whereever I want them to reside. Actually the linux "hole" is worse, as it has infinitely more powerful command-line tools available to a bootflopper.

    People fear the Internet and what a hax0r could do to their PC, but (as this article proves) give me physical access to your machine and I could do more damage to you than 99.999% of crackers ever possibly could - and that's only because I'm not enough of a bastard to [root@localhost /]% rm /*/* on my way out. Know your enemy, he's probably a family member.

    -Mark
  • Listen up! I come to Slashdot for one thing only: Microsoft bashing. If I want to read pro-MS stuff I'll go to -- um, some site that people talk about how great Microsoft is.

    This is too much. Let's hope it's not the start of a trend. Thank God I didn't subscribe.
  • the media blitz on this subject is certainly indicative of their lack of sophistication on the subject. but, given that many other, seemingly more techno-able sources came through with this story, it's not particularly blameworthy. It's believable because it fits into a pattern.

    Microsoft has a history of having gaping security holes in their software. in this instance, a reported bug wasn't what it was made out to be. but I'm sure I'm not the only person who thinks that Microsoft and Security Flaw are nearly synonymous.

    sweatyb

  • Tarnished Brand (Score:3, Insightful)

    by piobair ( 586119 ) on Wednesday February 26, 2003 @06:15PM (#5390295)
    Seems to me this whole issue is a direct result of MS's tarnished brand. Why bother doing research to find out if this weeks security hole is bogus or not? Microsoft's brand is so coupled with "security compromise" you don't need to prove the case anymore to attain public credibility.
  • An IT manager who runs a computer center with lots of servers and personnel wants to be sure that the servers are secure even from some of his employees. One thing that they don't want is some disgruntled employee elevating his security level and then doing massive damage just before he quits.

    What this means is that for servers, being able to elevate ones security level, even for people with access to the box, is not a good thing.

  • So what? (Score:5, Informative)

    by greenrom ( 576281 ) on Wednesday February 26, 2003 @06:33PM (#5390480)
    The recovery console lets you access stuff on an XP machine.... if you have physical access to the machine. Big deal. This handy floppy image [eunet.no] boots to linux and lets you change stuff on an NTFS partition. It also lets you change passwords for user accounts on the local machine and edit the registry. It's a heck of a lot more useful than the recovery console.

    Are there any administrators out there that actually want a machine that is so secure that you can't get into it if you forget the password, even if you have physical access to the box? "Sorry. I can't remember the password to the file server so everyone's work had to be deleted. Have a nice day."

  • Straight from the horses ..... (Score:4, Insightful)

    by IchBinEinPenguin ( 589252 ) on Wednesday February 26, 2003 @09:12PM (#5391815)
    well, I'll let you pick which end

    Law #3: If a bad guy has unrestricted physical access to your computer, it's not your computer anymore. [microsoft.com]

    I wonder if we could /. that server.......

Slashdot Top Deals

What this country needs is a good five dollar plasma weapon.

Close