Microsofts "Honeymonkey" Project

g0bshiTe writes "Ever hear the saying, 'given enough time a room full of monkeys could type out Shakespeare'? Well Microsoft seems to be taking this saying to heart, and taking a cue from the Honeynet project, they have created what they have dubbed 'honeymonkeys.' Security Focus has an article which describes this honeymonkey network, which is little more than a network of virtual Windows XP boxes in various patch states. These boxes are setup to crawl the seedier side of the web in search of vulnerabilities not bieng reported, and are being actively exploited in an attempt to further secure their product. Sounds like a decent idea from the Redmond crew to me."

Warning: This Operation Has Side Effects

[Anonymous Coward]

In addition to getting info on new vulnerabilities, they'll probably also get loads of malware to add to the anti-spyware tool. This is a good thing.

Good idea

[X0563511]

This is a pretty good idea. If anything, it will help curb the script kiddies indesciminantly flinging exploits around. Unless you want that overflow you found to get patched, pick and choose your targets carefully.

Re:Did the sun rise from the West?

[EpsCylonB]

A good idea from the MS guys is a really rare thing.
And as such, it is certainly worth the praise.

No its not, from a company that has a 50 billion dollar warchest and can afford to hire the best and brightest, you should expect only good ideas.

Exploits on real vs. virtual XP boxen

[G4from128k]

Virtual boxen will catch a wide array of exploits, but may miss some. For example, it sounds like they look for attempts to create executables on disk, so a RAM resident nasty might escape notice. Also, some exploits many only work on "real" machines such as those proposed for exploiting hyperthreading [slashdot.org].

The point is that to the extent that the virtual XP box fails to emulate ALL the features of real hardware, there will be some room for doubt. Despite this misgiving, I commend Microsoft for tackling this problem.

They are Building Security Rep

[mpapet]

This the kind of BS that they will use to claim "PronHorn is more secure!!!" The reality of this would go something like:

1. Set up weak boxes
2. Send them to questionable sites.
3. Watch them get infected.
4. Figure out how they got infected.
5. Report how they got infected.

Then
A. Do nothing, there's "no budget" to fix the problems. (very likely)
B. Modify the code -just- enough to get rid of the worst offenders. (least likely)
C. Charge the end-user a subscription to "protect" them from threats found in their research with another enterprise software package. (my choice as most likely)

In the end Microsoft says, "We've committed billions to increased security in pronhorn. It's more usable and real secure and "just works." Apply more anti-competitive practices liberally and maintain monopoly.

What bugs me the most is it will sound like it's true and kill Linux adoption. But the security patches will just keep coming.

Seedier Side of Web...

[Anonymous Coward]

I wonder how Microsoft defines the "seedier" side of the web, and how the sites the various computers visit are regulated.

It would be interesting to run the same test, but equipping half of the machines with an alternative browser.

"if ($body_maintext[$n] =~ /ActiveX|Microsoft\sVM/) {
$seedy_side_of_web=1;
}
"

Maybe a lot of thought

[JoeBuck]

Suppose Microsoft wanted to come up with a way to get the bad guys to avoid attacking Microsoft. Maybe they could spread the word that a significant range of IP space is honeypots and honeymonkeys and lions and tigers and bears, so then all the kiddies go off and attack someone else.

Re:Innovation from Redmond?

[Umbral Blot]

wait, so them stoping people from illegally pirating their product is a bad thing??