Forgot your password?
typodupeerror
Microsoft Operating Systems Software Windows IT

Microsoft States Full TCP/IP Too Dangerous 575

Posted by Zonk
from the don't-let-them-have-all-the-toys dept.
daria42 writes "To fully implement the TCP/IP protocol in Windows XP would make creating denial of service attacks 'entirely too trivial', Microsoft has claimed. The company was responding to claims by Nmap author and well-known security expert Fyodor that by repeatedly disabling the ability to send TCP/IP packets via the 'raw sockets' avenue, Microsoft was asking the security community to 'pick their poison': either cripple their operating system or leave it open to hackers. Admitting that a recent security patch had intentionally disabled a community-developed workaround to Microsoft's TCP/IP changes - which were first implemented in Windows XP Service Pack 2 - the company claimed it had received little negative feedback on the issue."
This discussion has been archived. No new comments can be posted.

Microsoft States Full TCP/IP Too Dangerous

Comments Filter:
  • by TripMaster Monkey (862126) * on Thursday April 28, 2005 @09:55AM (#12371023)
    News Flash: Butter is good on toast!

    From the Article:


    "Supporting packet sends from simple user-mode raw sockets makes it entirely too trivial for compromised systems under control of hackers to launch massive distributed denial of service attacks," Microsoft warned in a statement to ZDNet Australia .


    Interesting that M$ sees fit to lecture us on the dangers of raw sockets now, given their prior stand on the issue. [grc.com]
    • by rsmith-mac (639075) on Thursday April 28, 2005 @10:08AM (#12371211)
      Let's give MS some credit here, I think even they've come to realize that Gibson was right and raw sockets for users was a mistake. The fact of the matter is that they fixed the issue by taking away raw sockets, and now they have to defend that position.
      • Restricting them is a start in the right direction, but the way Microsoft did it is screwed up.

        What they should have done is make raw socket restrictions mandatory on Windows XP home and below (Media Center, Reduced Media and Starter edition) and allowed Windows XP professional and above to at least be able to run with full raw sockets if you turn on a setting in TCP/IP settings.

        They have this new Security center thing running all the time warning you about your antivirus and firewall changes. It would ha
        • Any malware that wanted raw sockets turned on would then be able to turn it on itself.
          • True, but you can make it very difficult to change it.

            For example, you can make it an addon in "Add/remove Programs" like they do with UPNP. that way, in most cases you would need to put the Windows XP CD into the machine in order to install open Raw Sockets.

            Yes the malware could include the files to install Unrestriced Raw sockets, but if the files to enable Raw Sockets are protected and restriced correctly it would be dfficult for any program other than Windows to modify them.
    • Steve "Ahab" Gibson (Score:3, Informative)

      by Anonymous Coward
      Since you link to Steve Gibson Research, I'll have to link to grcsucks [grcsucks.com]. His (Steve's) views were wrong then, and they're still wrong today. The "raw socket == ddos" argument was thoroughly discredited:

      Dissecting Steve Gibson GRC DoS Page [grcsucks.com]
      Raw Sockets are not a Security Risk [grcsucks.com]

      Bloody, I know about too many old flamewars.
      • by TripMaster Monkey (862126) * on Thursday April 28, 2005 @10:58AM (#12371922)

        Funny...if Steve's views were so discredited, why does M$ agree with him now?
        • "Steve's views were so discredited" = chicken
          "M$ agree[s] with him now" = egg
        • by Anonymous Coward on Thursday April 28, 2005 @12:23PM (#12373119)
          Microsoft agrees with him because this is an easier excuse than trying to fix Windows so not everyone website's active-X control has admin privileges.

          The real solution to the problem isn't breaking networking functionality depending on if you bought the cheap or expensive version of the OS.

          The real solution would be to restrict raw sockets to require Administrator/root privileges, and make it harder for the averages Outlook attachment to get root privileges.

          Microsoft, on the other hand, sees this as an excuse to not fix Outlook and Internet Explorer, and instead sell more of the expensive version.

  • by mfh (56) on Thursday April 28, 2005 @09:55AM (#12371026) Journal
    To fully implement the TCP/IP protocol in Windows XP would make creating denial of service attacks 'entirely too trivial'

    This is because XP is not designed right, not because the TCP/IP protocol is wrong. (just to be clear)

    The quote [seclists.org] from Fyodor is:
    "Pick your poison: Install MS05-019 and cripple your OS, or ignore the hotfix and remain vulnerable to remote code execution and DoS."

    It's like... we just... can't... win.

    Fyodor goes on to say...

    "Nmap has not supported dialup nor any other non-ethernet connections
    on Windows since this silly limitation was added. The new TCP
    connection limit also substantially degrades connect() scan. Nmap
    users should avoid thinking that all platforms are supported equally.
    If you have any choice, run Nmap on Linux, Mac OS X, Open/FreeBSD, or
    Solaris rather than Windows. Nmap will run faster and more reliably.
    Or you can try convincing MS to fix their TCP stack. Good luck with
    that."


    The answer, my friend, is to drop Microsoft.

    Baby, meet bathwater.
    • by shird (566377) on Thursday April 28, 2005 @10:11AM (#12371252) Homepage Journal
      Or perhaps if you are going to write apps that require such low level network access, you should be using a packet driver (or whatever the mechanism is in windows) to do that.

      The same can be said for any access to hardware that could be considered unnecessary for typical applications or 'harmful' to the hardware (harmful in the sense that it is 'harmful' to the network and your connection).

      I think what MS has done is quite acceptable, given the number of trojans uot there that are DoS'ing and spamming like crazy. Trojans that are on the systems often because of user stupidity rather than an insecure OS. As long as it is possible to actually write such a 'driver' (I think there is a different name for it, but I can't remmeber).
      • I had to reprogram my switches to not accept partial packets because Windows clients infected with scanning trojens where hogging the lines with crap UDP traffic.

        Mind you, I'm not talking about our 3Mb link to the internet. I'm talking about our 100Mb switch in the basement.

        Whatever Microsoft thinks they are doing, it isn't helping in the areas that count.

        • by shird (566377)
          This 'fix' was only just introduced in SP2. Most of those attacks are likely to be from infected machines that aren't patched up - and therefore aren't running SP2. So you cannot really draw the conclusion that its not helping.
      • by Krach42 (227798) on Thursday April 28, 2005 @10:36AM (#12371587) Homepage Journal
        After walking throught he MS articles and stuff, I came across this: http://support.microsoft.com/kb/897656/ [microsoft.com]

        Quoted from there is basically. If you want to use hand-crafted TCP/UDP packets over a raw IP connection, you must enable the Internet Connection Firewall.

        At least, this is for SP1, I don't know if you can get away with this in SP2.
        • by Slashcrap (869349) on Thursday April 28, 2005 @10:53AM (#12371847)
          Quoted from there is basically. If you want to use hand-crafted TCP/UDP packets over a raw IP connection, you must enable the Internet Connection Firewall.

          I was about to reply pointing out that you had obviously meant to say, "disable the Firewall".

          Then I read the Knowledgebase article.

          God, that's retarded. The firewall doesn't do jack shit to block outgoing traffic anyway. Why the hell should it be safer to allow raw sockets when it's on?
      • by aug24 (38229)
        Or perhaps if you are going to write apps that require such low level network access, you should be using a packet driver (or whatever the mechanism is in windows) to do that.

        Which, if you are right, is what the DDoS malware will now start to do.

        Justin.

    • by lheal (86013) <lheal1999@@@yahoo...com> on Thursday April 28, 2005 @10:14AM (#12371295) Journal
      This is because XP is not designed right, not because the TCP/IP protocol is wrong. (just to be clear)

      You nailed it.

      Microsoft is clearly trying to shift the blame from their dain-bramaged design to TCP/IP. How many other operating systems are there that do (more or less) fully implement TCP/IP, including raw sockets? It's almost universal.

      Oh well. I guess Microsoft knows the neighborhood is safer with a crippled lunatic than healthy one.

      • by cirisme (781889) on Thursday April 28, 2005 @10:51AM (#12371821) Homepage

        The brain damaged part has nothing to do with TCP/IP, because their implementation has nothing to do with security.

        Seriously? You really think it's their brain damaged TCP/IP implementation that's at fault? Think again. It may be bad, but giving every program access to raw sockets is a bit silly considering how easy it is to get programs into Windows. But this is a good move, a better one would to have been to make it so it's not as simple to get untrusted programs running in Windows but I digress.

  • Ulterior motives (Score:5, Interesting)

    by bmw (115903) * on Thursday April 28, 2005 @09:56AM (#12371038)
    It's quite obvious that Microsoft has other motives for doing this as this really doesn't do anything to improve security. As was quoted in the article, Fyodor correctly points out that Windows (AFAIK) is the only operating system to put such restrictions on raw sockets and it certainly has not helped their dismal security.

    Of course, there's always the possibility of ignorance...

    Never attribute to malice that which is adequately explained by
    stupidity.


    but I really have to doubt that Microsoft is quite this dumb. They've got a lot of really tallented people working there so you have to think that someone would have thought about this. Then again, they have demonstrated a supreme lack of understanding when it comes to security so who knows.
    • Re:Ulterior motives (Score:5, Interesting)

      by Anonymous Coward on Thursday April 28, 2005 @10:21AM (#12371388)
      Then again, they have demonstrated a supreme lack of understanding when it comes to security so who knows.

      Actually, I think we're seeing the maturation of a "corral the wagons" paranoia in Microsoft's culture. Lacking the ability to push any serious innovation internally (let's be serious, most of Microsoft's innovations during the past 20 years were brought in through acquisitions or copycat development ala VMS for NT, liberal borrowing from OS/2, Apple and Mach, etc). Now that antitrust severely limits acquisition growth, Microsoft is facing the same threat that broke Worldcom. Unable to make significant acquisitions, unable to meet growth internally, and now unable to cook the books like Worldcom, Microsoft's certain to get very defensive as the pressures heat up.

      I thought I saw the beginnings of this phenomenon in 1998 at the IPv6 summit, where Microsoft's techs at the conference were explaining their implementation at first with great pride, only to be somewhat ashamed at how much they hadn't followed the specification very well, had numerous bugs and compatibility issues, and were clearly well behind everyone else. Nearly every other operating system had a much more mature implementation. (How long did that IPv6 stack remain a beta too?)

      Amazingly, Microsoft is now attempting to patent IPv6 [zdnet.com] through a copy-cat specification (as was discussed on slashdot [slashdot.org]). Somehow it's not amusing when the kid who was not very successful in his participation in the group assignment decides to take exclusive credit for the group's effort.

      So now Microsoft is blaming IPv4's engineering (when just like IPv6, everyone else seemed to understand and master the assignment EXCEPT Microsoft)?

      As a teacher of mine once said to perpetual underachievers in class: Perhaps you might consider a career in food service instead?

      • by blahtree (55190)
        As a teacher of mine once said to perpetual underachievers in class: Perhaps you might consider a career in food service instead?

        Some people are too arrogant for words. People learn differently and are motivated by different things. That teacher has clearly not studied learning in any meaningful way.

  • A wise decision (Score:5, Insightful)

    by jawtheshark (198669) * <.moc.krahsehtwaj. .ta. .todhsals.> on Thursday April 28, 2005 @09:56AM (#12371043) Homepage Journal
    Of course nobody needs raw sockets, and after all no other operating system supports them. I mean, it's not as if OpenBSD, Mac OS X, FreeBSD, NetBSD, the various Linux flavours support it. It would be too dangerous.

    No, Microsoft... none of those support raw sockets. Oh, wait... they all do. The problem is not raw sockets, the problem are the holes in the OS in the first place. If your OS doesn't run services that can be hacked, or if the applications don't allow to execute untrusted code there is no problem. Avoiding raw sockets is treating the symptoms, not the cause.

    • Re:A wise decision (Score:5, Informative)

      by TheRaven64 (641858) on Thursday April 28, 2005 @10:06AM (#12371177) Journal
      On UNIX-like systems, creating a RAW socket can only be done by the superuser. Putting a similar restriction on Windows (substitute Administrator for superuser) would provide no benefit, since Windows is designed in such a way that most users run as an Administrator. Depressingly, the RunAs service has been around for many years now, completely eliminating the need to run as an Administrator. Unfortunately, the lack of a decent UI for this service has prevented its widespread use.
  • by X0563511 (793323) *
    It isn't already easy to create and launch a DDoS attack from Windows XP? So we get an almost crippled TCP stack in the name of making something a little less easy to do.

    Sounds like a fair trade to me! [/sarcasm]
    • Re:Ha! (Score:5, Insightful)

      by Pakaran2 (138209) <windrunnerNO@SPAMgmail.com> on Thursday April 28, 2005 @10:07AM (#12371180)
      It isn't "almost crippled."

      Ordinary users on Unix are subject to even worse limitations (which is, in fact, why ping among other utilities runs setuid root).

      Has anyone found that this makes Unix unusable for them? For that matter, outside of DDoS, connection hijacking, and abusing smtp servers to cover your tracks when spamming, is there ever any need for an application programmer to falsify a source address? Doing so means you won't get a reply from whatever you're trying to do.

      All that said, I imagine if MS actually put some effort into fixing the security issues with their flagship product in the first place, so it didn't get hacked (hint: disable activex by default, along with integrated vb scripting in outlook), then there'd be no hacked machines to be used in attacks.
      • Re:Ha! (Score:3, Insightful)


        Recap, almost all Win users run as Admin. Mostly because that is the default, everything they use works, and some things that shouldn't require admin privledges do.

        Microsoft's solution then is to cripple Admin so that "bad things" can't be done in that mode.

        This will inevitably lead to Admin on Win being reduced to an equivalent of user mode in *nix. Eventually we will see a new Super Admin that can be entered to do the things that MS takes away from Admin. As long as we can keep developers from wri
  • by Nijika (525558) on Thursday April 28, 2005 @09:58AM (#12371068) Homepage Journal
    Cripple the OS, and leave it open to hackers!

    In Redmond, this is what they call a win win.

    //no Karma Bonus for that one... ;)

    • For a minute there, when you said "They picked C", I thought you meant as in the programming language. Ironically, your post makes almost as much sense with this interpretation. /me runs away.
  • by republican gourd (879711) on Thursday April 28, 2005 @09:59AM (#12371077)
    This is just part of the push to get the core internet routers cut over to NetBEUI well in advance of any ipV6 rollout. If Microsoft can manage that, the internet will be theirs again, just like when they initially built it between Steve, Bill and Woz's offices back in the early seventies.

    Scary thing is, from what I've been reading Oracle will go along with this. And they can tell the future!!
  • rewrite TCP/IP? Embrace and extend it, so that we can have a safe, trusted internet?
    • by PipianJ (574459) on Thursday April 28, 2005 @10:10AM (#12371233)
      Why embrace and extend? All they really need to do is support the evil bit [rfc-editor.org].

      But of course, being Microsoft, you're probably right. They'll make their own implementation of the evil bit, patent it, and charge royalties to others who want to support their new "EDDP" protocol (Evil Data Detection Protocol).

      Not to mention that IIS, Exchange, IE, and Outlook will grow to require use of EDDP during transfers of data, locking Mozilla, Apple, Linux, and others from accessing much of the internet.

      Finally, John C. Dvorak [dvorak.org] will boldly claim that EDDP is the wave of the future, and Apple, Linux, and Mozilla are clearly inferior for not supporting what is clearly a web standard, because if Microsoft says it is, it MUST be.
  • by darylb (10898) on Thursday April 28, 2005 @10:00AM (#12371098)
    Microsoft is just responding to Steve Gibson [grc.com], of Gibson Research, who has hounded them for making raw sockets accessible to all programs in the past.

    • And he is wrong.

      To be clear: The security problem is that the net routs any
      packets it can, and some TCP/IP stacks will choke upon
      *receiving* (a flood of) bad packets. Trying to make it
      difficult to *send* those packets from Windows is essentially
      useless.

      Removing raw socket support from an operation system is a
      trivial, bogus attempt to hide the problem without fixing it. A
      root-compromised system can send raw packets no matter what the
      vendor implements.

      There are two reasonable places at which to resist thes
      • by Lothsahn (221388) <Lothsahn@@@SPAM_ ... u_bastardsyahocm> on Thursday April 28, 2005 @11:53AM (#12372701)
        Technically, you are right... But Gibson's claim is that by not providing easy access to raw sockets, it becomes much harder to engineer viruses or other malware to produce successful attacks. He never claims it's impossible--in fact, he claims that the user can reimplement raw socket support--but reimplementing raw sockets is significantly more difficult than using an existing API. And considering that a large majority of viruses and malware is due to 5cr1p7 k1dd135, and not real hackers, this helps. Remember, this doesn't make Windows secure, it's just one step to make it less harmful... and that's Gibson's claim. It's one piece of the puzzle (that's mostly empty at this point).
  • I remember... (Score:3, Informative)

    by Karpe (1147) on Thursday April 28, 2005 @10:01AM (#12371106) Homepage
    Steve Gibson's crusade [grc.com] againts Windows raw socket capabilities. Did Microsoft listen, and now is being criticised for doing that?
  • raw sockets+MS?! (Score:3, Interesting)

    by quetzalc0atl (722663) on Thursday April 28, 2005 @10:01AM (#12371108)
    are they kidding?

    if you are mucking with protocols by using raw sockets, are you really going to be coding it on a windows platform? i can imagine a worm or trojan doing it perhaps - in a ddos scenario - but since when has raw sockets become the red-headed stepchild implicated in this?
  • My TCP/IP (Score:5, Funny)

    by wombatmobile (623057) on Thursday April 28, 2005 @10:01AM (#12371109)

    Maybe Microsoft is right. Protocols are dangerous.

    Wouldn't it be safer if we all just had a My TCP/IP folder?

  • Privileges anyone? (Score:5, Insightful)

    by bigberk (547360) <bigberk@users.pc9.org> on Thursday April 28, 2005 @10:02AM (#12371117)
    I can't believe this issue of Windows security is so difficult to understand. You read all these articles about viruses and trojans but people keep failing to mention the obvious - you must never casually run Windows with Administrator privileges.

    It's because so many people are used to doing this by default, and so many third party apps demand Admin privileges, that Windows security is a nightmare.

    There's more to the Windows security picture of course (insecure services as well) but you can prevent so many problems just by avoiding that Admin account. It's quite normal to have raw sockets via root/Administrator privileges. The problem is that all windows users (and any software they download) are Admins.
    • by yagu (721525) *

      ..., you must never casually run Windows with Administrator privileges.

      It's because so many people are used to doing this by default, and so many third party apps demand Admin privileges, that Windows security is a nightmare. ...,

      I find the problem to be the insidious architecture of XP specifically the lack of clear demarcation between a priveleged user and an admin. I consult in both unix and Windows worlds for a living, so I'm on a Windows box a lot! (way more than I like) And I pretty much al

      • by Foolhardy (664051)

        I find the problem to be the insidious architecture of XP specifically the lack of clear demarcation between a priveleged user and an admin.

        Power Users is kinda in the middle. I guess the idea is that you can assign permissions and privileges to users as needed.

        And I pretty much always have myself configured as an admin type user... not because I have to all the time (I do lots of work not needing that level of access) but more because of the unpredictability of what isn't going to work in some strange w

    • by gaspyy (514539) on Thursday April 28, 2005 @10:58AM (#12371923)
      The default users get Administrator priviledges because many popular programs simply refuse to work correcty with limited rights. Over the top of my head, Winamp 5 and Trillian 3.1 are guilty of this. Sure, you can workaround by giving write access to everyone for those folders, but it's crazy.
  • FMEA (Score:5, Interesting)

    by millahtime (710421) on Thursday April 28, 2005 @10:03AM (#12371125) Homepage Journal
    Failure Modes and Effects Analysis... I would love to see that done on windows. Maybe find the problem itself rather than work around it and leave the faulires in there. Bad by design.
  • Raw Sockets are not disabled at the server versions.
    Under Windows 2003, programs with admin privleges can use Raw sockets.

  • Dear MS Employees, We have started the FUD about TCP/IP. Now press forward with MS/IP. Once we release it we'll charge everyone a fee to use it because we know it will be more secure than TCP/IP. After all, it comes from Microsoft. With Love, Bill
  • So when... (Score:5, Interesting)

    by RailGunner (554645) on Thursday April 28, 2005 @10:04AM (#12371137) Journal
    So, they're going to re-disable raw sockets? I'd suggest that the IP implementation on SP2 is broken already. For example - when will you be able to send more than 8K in a single packet using a Java Socket on Windows XP Service Pack 2?
    String sString = "Some string more than 8K";
    Socket client;
    PrintWriter sock_out;
    try
    {
    client = new Socket (InetAddress.getByName
    ("127.0.0.1"), 5678);
    sock_out = new PrintWriter
    (client.getOutputStream(), true);
    sock_out.flush();
    sock_out.println (sString);
    sock_out.close();
    client.close();
    }
    catch (EOFException eof)
    {

    }
    catch (IOException e)
    {

    }

    Try it yourself - see if you can receive more than 8K in a recv() call in Windows XP SP2. You can't.
    If you do the same on Linux or OS X, you can. On Windows XP SP1, you can.

    Thanks, Microsoft.

    • Re:So when... (Score:5, Insightful)

      by Temporal (96070) on Thursday April 28, 2005 @10:39AM (#12371639) Journal
      Why are you relying on such things? A TCP conection is a continuous stream of bytes, not a bunch of separate packets. There has never been any guarantee that send()s and recv()s would match up 1:1, even if they are less that 8k. If you are relying on this behavior, you need to fix your design.
    • Re:So when... (Score:3, Informative)

      Hi,

      With Windows sockets, it is imperative to look at the error returned by send() if it fails. If the error is WSAENOBUFS, then it means that the packet you are trying to send is too large and must therefore be reduced. It is possible that the Java implementation doesn't do this.

      Here is a snippet of code that is NECESSARY to be able to transfer data reliably on Windows. Please note that while just a single send() will work most of the time, there is no garantee that it will. Try, for example, sending
  • by quetzalc0atl (722663) on Thursday April 28, 2005 @10:05AM (#12371152)
    ...since the admin can always write packets (in frames)directly to the layer 2 driver. all they are doing is breaking the BSD sockets API - security through obscurity? right....
  • I agree... (Score:3, Insightful)

    by ebrandsberg (75344) on Thursday April 28, 2005 @10:05AM (#12371158)
    If you can't have a secure OS, the OS should be less vulnerable to being abused. So in effect, use Linux or other OS's if you need to use raw sockets.
  • Replacement (Score:5, Interesting)

    by Mr_Silver (213637) on Thursday April 28, 2005 @10:07AM (#12371184)
    As soon as I saw this, it made me rememeber this article [pbs.org] by Cringely (written in August 2001) which discusses the "problem" of raw sockets.

    From it:

    According to these programmers, Microsoft wants to replace TCP/IP with a proprietary protocol -- a protocol owned by Microsoft -- that it will tout as being more secure. Actually, the new protocol would likely be TCP/IP with some of the reserved fields used as pointers to proprietary extensions, quite similar to Vines IP, if you remember that product from Banyan Systems. I'll call it TCP/MS.

    How do you push for the acceptance of a new protocol? First, make the old one unworkable by placing millions of exploitable TCP/IP stacks out on the Net, ready-to-use by any teenage sociopath. When the Net slows or crashes, the blame would not be assigned to Microsoft. Then ship the new protocol with every new copy of Windows, and install it with every Windows Update over the Internet. Zero to 100 million copies could happen in less than a year, and that year could be prior to the new protocol even being announced. It could be shipping right now.

    Food for thought.
    • by SuperKendall (25149) * on Thursday April 28, 2005 @10:49AM (#12371779)
      Yes, the path becomes clear...

      Abandon the industry standard for VMs (Java) and roll your own (.Net).

      Abandon the industry standard for portable documents (PDF) and roll your own (Metro).

      Abandon the industry standard for networking (TCP/IP) and roll your own (???).

      Each sounds more improbable than the last. Yet the first one has happened, the second is going to happen, and thus the third seems much less improbable than it would have otherwise.
  • by cyngus (753668) on Thursday April 28, 2005 @10:08AM (#12371195)
    I am actually going to side with Microsoft on this one. It is not as if they removed raw sockets, but rather restricted access to them. Let's consider who needs raw sockets, mostly advanced users. Advanced users are going to have an Administrator or root account on the Windows machine and therefore should have access to raw sockets, no? There is almost no reason for the average user to have raw sockets. They do create a real risk of bad network behavior and I imagine if someone were to create TCP/IP today instead of 30 years ago when the Internet was a much smaller, nicer place, raw sockets would not be part of the spec.

    As an aside, I think I'm going to take the rest of the day off, agreeing with Microsoft is mentally jarring. It has to make you question existence just a little and also make you a touch ill.
  • They're making it easy to choose a Mac and OS X for my next computer.
  • by pandrijeczko (588093) on Thursday April 28, 2005 @10:16AM (#12371313)
    I run Linux and UNIX with my "insecure" full TCP/IP stack. My UNIX-y machines have an IP address, subnet mask, gateway, etc. etc. These machines do not get worms or viruses.

    I run Windows 2000 with my "secure" limited TCP/IP stack. My Windows machine has an IP address, subnet mask, gateway, etc. etc. This machine would get virii if I didn't run a virus checker, firewall, etc.

    There is one difference between the two scenarios above - the operating system!

    Yes, my UNIX-y boxes are subject to attacks from the Internet but not random attacks like viri and worms.

    An attack on my UNIX-y boxes comes from a single, person or script trying to get into my box and trying to (probably) buffer overflow a specific application daemon like FTP, Telnet, etc (not that I run either of these on the Internet anyway!)

    So let's not blame it on the "TCP/IP" stack because all attacks are as a result of attacking applications that use the stack, not the stack itself.

    We'll also remind ourselves here that UNIX was built around TCP/IP 25 years ago whereas MS refused to believe TCP/IP existed until 15 years ago after Windows 3.11 came out and they had to write a limited stack to install into Windows.

  • Translation (Score:3, Funny)

    by nuintari (47926) on Thursday April 28, 2005 @10:17AM (#12371339) Homepage
    Translation: Our OS is a dog and we need to neuter it to keep it under control.

    Not that this will solve anything, no raw sockets? I don't need no raw sockets, I have 48 billion bogus dns lookups!
  • by k96822 (838564) * on Thursday April 28, 2005 @10:17AM (#12371341) Journal
    Okay, the company with a baffling amount of security holes [microsoft.com] is giving advice on computer security. That is about as absurd as, say, the company with worst software quality giving us advice on how to develop quality software [microsoft.com].

    To quote Ted Kennedy, "Hello? Hello?!!"
    Some days, life is just a little too weird to take.
  • by spadadot (879731) on Thursday April 28, 2005 @10:28AM (#12371479)

    I wrote an article about a very serious problem related to Windows Server 2003 TCP/IP.

    Here's a quote : "Trying to set up a Windows Media streaming server to stream high-quality videos, I came across what I can now call a TCP/IP bug in Windows Server 2003 (Standard Edition). In some (not unusual) situations, the server simply cannot use all available bandwidth between itself and the client.
    [...]
    Eventually, I came to accept the idea that Windows Server 2003, an OS designed for server tasks, is not able to fill a 2Mbit/s ADSL connection. Yes I know it sounds incredible but I've been looking without success for another conclusion for the past 3 months."

    Read the full technical explanation and see what Microsoft has to say about it : Microsoft Windows Server 2003 Buggy TCP/IP ? [dariospagnolo.org]

  • Bad Logic (Score:3, Interesting)

    by Master of Transhuman (597628) on Thursday April 28, 2005 @10:50AM (#12371799) Homepage

    People who are saying the "average" user doesn't "need" raw sockets while saying that the hacker who does will use another OS ANYWAY are obviously missing the point.

    Why bother disabling something that's part of a standard when it will have no effect on either the average user or the hacker?

    MS is saying here that if the "average" user had raw sockets, they could program DoS code? I don't think that's gonna happen.

    All disabling sockets has done is inconvenience nmap users - who just happen to be sys admins running security scans on their networks from their workstations.

    Maybe MS doesn't want them to be able to run nmap? Like maybe they might find out how insecure their systems are?

  • by ajs318 (655362) <sd_resp2 AT earthshod DOT co DOT uk> on Thursday April 28, 2005 @10:53AM (#12371843)
    The various BSD flavours support raw sockets. So does Solaris, and even Linux for that matter.

    The difference with the Unix-like systems is that ordinary users don't get to poke about with dangerous stuff.

    The real point is that Windows software has for too long depended on the assumption that the user has full unfettered access to every resource on the computer -- an assumption which had to cease to be true when Windows became network-aware, because in a networked environment some things are properly restricted. Yet for the best part of ten years, Windows continued to run without privilege separation; and application programmers took advantage of that, creating code which turned out to be fundamentally broken.

    Face it, the bathwater is minging and the baby is dead -- there is nothing worth saving in the whole sorry mess. Whether bad water killed the baby, the dead baby made the water worse, or the two are unconnected, isn't really important right now. What is important is to get rid of them both, scrub out the bathtub and start again.

    Of course, if you're going to switch to a new version of Windows -- which would have to be totally incompatible with all that sloppily-written software needing root access for no good reason -- then that would be about as big a change as switching to some other operating system. That must worry Microsoft .....
  • by Proudrooster (580120) on Thursday April 28, 2005 @11:02AM (#12371978) Homepage
    What's the fuss? So RAW sockets aren't available in user mode. That will keep infected PC's from DDoS'ing the universe (temporarily), until the virus/spyware writers exploit holes in the O/S to escalate their priveledges.

    MS is just temporarily making exploiting a machine harder, but it will ultimately be futile and lead to even more nefarious and hostile virus/worm/spyware applications. This is a bandaid at best.

    Windows is architected so poorly from a security standpoint, that it's probably time to just start over. Security in Windows has always been a "bolt-on" hack. And just remember, no matter what you do, Security is an Illusion.

    Is it time for developers at SlashDot provide an interface similar to GMAIL so that I don't have to put HTML tags in my comments?
  • by presroi (657709) <neubau@presroi.de> on Thursday April 28, 2005 @11:04AM (#12371995) Homepage
    I remember "Steve Gibson" was bashed and debunked for talking about raw sockets in 2000 or 2001.

    There is a short audio file from Rob Rosenberg from where he repeadingly laughs at his claims.

    By the way, wasn't Gibsons site defaced today by Fluffy Bunny?

    http://www.farook.org/arc20010701.htm [farook.org]

    http://www.vmyths.com/rant.cfm?id=335&page=4 [vmyths.com]

    http://www.theregister.co.uk/2001/06/12/security_g eek_developing_winxp_raw/ [theregister.co.uk]

    and so on. Is there anything new that has happened in the last 4 years?
  • by MemoryDragon (544441) on Thursday April 28, 2005 @11:17AM (#12372177)
    In a system which grants admin priviledges to every user of course raw sockets can be dangerous. But the problem is less raw sockets, the problem is more the system itself which uses it.
  • by Anonymous Coward on Thursday April 28, 2005 @11:42AM (#12372558)
    I work for a company that sells a high-end network security scanning product. We have been dealing with this XP issue now for almost 2 years, and we are not the only ones who have complained to Microsoft. We have pushed our complaints as far through the channels as we can. Microsoft isn't listening.

    Their response is: buy Windows Server 2003 if you want raw sockets. We asked them if there was any guarantee that they would not break the raw sockets feature in 2003, and they would not give us that guarantee. Besides, Windows Server 2003 ships with a lot of stuff we would have to disable to make the box even remotely secure.

    Our CEO even registered a complaint with Microsoft, saying "We pay to use your software and you are hurting our business and hurting our customers and costing us money with this change. And you have heard our complaints and you are ignoring them." Microsoft responded that they would pass our criticism up the chain, and that's the last we heard.

    That's why it irritates me to read in the article that Microsoft has had "little negative feedback" on this issue. I'm sure we're not the only paying customer of Microsoft that has been affected. And they are not telling the truth when they say that "the only thing affected by this change is fingerprinting software": port scanning is affected too.

    So we have started recommending that our customers use the Linux version of our product. Now Microsoft is losing hundreds of thousands of dollars of revenue per quarter just from our company.
  • It also pointed out that "writing and installing kernel-mode code is vastly more complicated" than using an existing raw socket feature,

    Yeh, that's why the majority of people doing this use an widely available rootkit or equivalent to do it for them.

    and that if malware did make it into the kernel of a Windows machine, the user would have more serious concerns than just SYN attacks launched from their machines.

    "If malware can execute code on a Windows machine, the user has more serious concerns than just SYN attacks launched from their machines. That's why Windows doesn't bother trying to close local exploits."
    • It also pointed out that "writing and installing kernel-mode code is vastly more complicated" than using an existing raw socket feature,

      Yeh, that's why the majority of people doing this use an widely available rootkit or equivalent to do it for them.


      Exactly. All it takes is one person to do it. Once the cat is out of the bag, malware authors can just all copy that one.

      It might not even be a black hat that does it. It wouldn't surprise me if the open source pcap driver for windows could be used to sen
  • by Perl-Pusher (555592) on Thursday April 28, 2005 @01:44PM (#12374142)
    With any TCP/IP, I've found that by just unplugging the ethernet cable, a windows desktop can be just as secure as an OpenBSD Server.
  • by MilenCent (219397) * <{johnwh} {at} {gmail.com}> on Thursday April 28, 2005 @02:32PM (#12374768) Homepage
    the company claimed it had received little negative feedback on the issue.

    In other news, a noted chemical manufacturer was found to have been dumping toxic waste products into a nearby water supply for years. In their defense, company spokesmen claims they had received little negative on the issue.

    Local police have been caught on camera beating up suspected felons. When cornered on the issue, they responded by saying that there had been little negative feedback on the issue -- at least, from anyone who mattered.

    In a press conference today, Bush defended his administration's handling of the war on terrorism by saying that they had little negative feedback on the issue. (Possibly because they had suppressed their own report on the issue; outside sources indicate that terrorist activity around the world is four times worse than in the previous year.)

    There, three possible responses to the negative feedback defense. Pick your favorite, I need a drink after this.
  • by multi io (640409) <olaf.klischat@googlemail.com> on Thursday April 28, 2005 @02:45PM (#12374968)
    ...and disable the feature by default for all accounts, including admin.

    I mean, on other occasions you hear them blather about Windows' totally stellar, fine-grained security architecture, and now they want to prevent Joe Average user from accidentally using raw sockets by, uh, removing the feature altogether?

Things equal to nothing else are equal to each other.

Working...