Forgot your password?
typodupeerror
Microsoft Security Operating Systems Software Windows

Hackers, Meet Microsoft 496

Posted by CowboyNeal
from the come-together dept.
Mz6 writes "The random chatter of several hundred Microsoft engineers filled the cavernous executive briefing center recently at the company's sprawling campus outside Seattle. Within minutes after their meeting was convened, however, the hall became hushed. Hackers had successfully lured a Windows laptop onto a malicious wireless network. 'It was just silent,' said Stephen Toulouse, a program manager in Microsoft's security unit. 'You couldn't hear anybody breathe.' The demo was part of an extraordinary two days in which outsiders were invited into the heart of the Windows empire for the express purpose of exploiting flaws in Microsoft computing systems. The event, which Microsoft has not publicized, was dubbed 'Blue Hat' -- a reference to the widely known 'Black Hat' security conference, tweaked to reflect Microsoft's corporate color."
This discussion has been archived. No new comments can be posted.

Hackers, Meet Microsoft

Comments Filter:
  • Blue? (Score:2, Interesting)

    by XanC (644172)
    I didn't know that... But come to think of it, the Windows 3.0 splash screen was all blue.

    And 3.1 was a black background, but blue graphic.

  • by Neil Blender (555885) <neilblender@gmail.com> on Thursday June 16, 2005 @07:38PM (#12837143)
    What were they thinking? "Oh, shit our OS isn't secure?"
  • by DavidLeblond (267211) <[moc.dnolbeldivad] [ta] [em]> on Thursday June 16, 2005 @07:38PM (#12837145) Homepage
    The event, which Microsoft has not publicized, was dubbed 'Blue Hat' -- a reference to the widely known 'Black Hat' security conference, tweaked to reflect Microsoft's corporate color.

    Must... not... make... obvious... BSOD comment.... aughhh!
    • I'm a little concerned about the hackers 'invited' to attend this conference. You see, school is still in session, and did the parents, or legal guardians of the 'invited' ones sign a 'parent permission' slip? Just a thought, but would any of these hackers happly admit to still wearing super hero underwear?

  • by bani (467531) on Thursday June 16, 2005 @07:38PM (#12837146)
    To me, it's a far more fitting name.
  • Good start (Score:3, Insightful)

    by Jason1729 (561790) on Thursday June 16, 2005 @07:39PM (#12837154)
    But will MS actually do anything?

    It seems like Microsoft is showing their own coders how vulnerable their code is, but these are probably the people who already know that best.
    • Re:Good start (Score:5, Insightful)

      by dpilot (134227) on Thursday June 16, 2005 @07:56PM (#12837281) Homepage Journal
      > But will MS actually do anything?

      But *can* MS actually do anything?

      Given the bowl of spaghetti called nearly 2 decades of Windows, how much freedom of action do they really have to clean things up? Tug at a strand here to fix it, and who knows where the other end is? How many side effects will there be from that one fix? Yet at the same time, their market power is based on Windows and their code base. Force too big a migration, too much retraining, and it might well turn into a different kind of migration - to someone else's platform.

      They've got a ticklish and tough job ahead. But then again, they did it to themselves.
      • Re:Good start (Score:3, Interesting)

        by SWTP_OS9 (658064)
        That is the crux of the matter. I have written programs for clients and it is a mega mess of calls and strange crazy links etc. They change things as soon as you learn how to do something usfull. And not really support area they should but dont.

        All software has a life cycle. And Windows has reached the end of its life. Any decent software engineer will tell you after awhile if you are patching it this hard. All your doing is patching patches! And deffently doing that will cause more problems. Like a room f
        • Re:Good start (Score:5, Informative)

          by drsmithy (35869) <drsmithy@gmailFREEBSD.com minus bsd> on Thursday June 16, 2005 @10:06PM (#12837985)
          It would not supprise me to see Microsoft doing a Apple after Longhorn of creating a new Windows OS from scratch and praying that LH will hold untill it comes out.

          Apple didn't create a new OS from scratch, they bought an existing one - NeXT (although many will argue Apple bought Steve Jobs and NeXT was a nice bonus).

          Moreover, since NeXT was actually released for the first time way back in 1989, OS X's codebase is actually around 4 years *older* than Windows NT's.

          Apple didd this when small and surivived. And MS can do it now but cant pospone much longer.

          Microsoft will not create another from-scratch OS in the forseeable future. There is simply no need. Technically and architecturally NT is just as good as any of its contemporaries. 99% of problems in Windows come from legacy support (being phased out with .NET, x86-86 also providing a convenient excuse) and less than ideal default settings (hopefully on the way out with LH).

          • Re:Good start (Score:5, Interesting)

            by peragrin (659227) on Thursday June 16, 2005 @10:18PM (#12838052)
            nope it's not being phased out.

            the managed .NET code that was supposed to be an all new APi is being removed to speed up the deadline. Avalon is being back ported to windows XP. Win FS is being dropped due to it being to big of a concept and MSFT doesn't have anyone to copy off of.

            Longhorn I hoped would of been a complete rewrite. it failed. There is not a single new innovative feature in longhorn now. spotlight searches fast and effective, on all but networked drives. GPU driven displays OSX and a large number of X server's(sgi's)

            New remote command shell is a combination of applescript and a python interpreter. It would of been cool but it's been delayed.

            Yet somewhere MSFT found the time to make their own Bit torrent P2P client and server setups. I guess it shows where MSFT lays it's priorities. An app that won't bring them cash or their Next Generation OS.
            • Re:Good start (Score:3, Insightful)

              by SuperDuperMan (257229)
              Microsoft can't put every single one of there thousands of programmers on a single task like working on Windows.

              And it's not like they are understaffed on the OS team. Adding more programmers to a project does not ensure success and may actually make the process take longer.
              • Re:Good start (Score:3, Insightful)

                by peragrin (659227)
                Very true, but when your cutting features that you have promised for the past 6 years just to get the product out the door something is seriously wrong.

                Since XP was released.
                OS X has matured into a great product getting faster and better with each release.

                Linux has gone from hard to install for the average person to being easy.

                Beos has come back from the dead.

                Sky OS was competely written by a lone programmer(1999-2005)including drivers and a full GUI.

                Now MSFT out numbers all those companies/people by 1
            • Re:Good start (Score:3, Insightful)

              by Anonymous Coward
              Idiot. MS *Research* wrote a *paper* about some peer-to-peer technology. They have near free reign; indeed, it's one of the only research labs left that do. This has nothing to do with corporate priorities.

              Slashdot responses about MS and BitTorrent are just FUD.
        • by MMaestro (585010)
          As anyone who plays console video games can tell you, any change in hardware, software or even the controllers can result in serious and unexpected changes in the long run.

          How long do you think it took Windows to reach the state its in now? If you looking at just the major changes there have been a LOT compared to other software. (Windows 95, 98, 2000, XP, not counting updates, ME, or versions older than 95 and the unreleased Longhorn). Has there EVER been a major serious of software changes in history on t

      • Re:Good start (Score:4, Informative)

        by zbuffered (125292) on Thursday June 16, 2005 @10:39PM (#12838172)
        Like the article, your post contains no commentary on the actual nature of the specific Windows problems demonstrated at "Blue Hat".

        Using tools like void11, you can disconnect wireless clients. Windows automatically attempts to reconnect to the WAP. If you've got an identically-named WAP and you can overpower their WAP, they'll connect to yours instead. They won't be notified, and will think that they are on their own network. Which doesn't matter too much because you could alternately just sniff all their traffic (or even inject your own) without setting up a WAP of your own.

        There's a lot that MS can do about it, and code written 2 decades ago has absolutely no bearing on it.
      • What's really sad (Score:3, Insightful)

        by btarval (874919)
        "But *can* MS actually do anything?"

        It's really sad that they had several hundred engineers sitting around, getting taught lessons like this. 99% of the so-called hackers out there really aren't that great. And it's unlikely anything earthshattering here was used.

        I find it truly surprising that not one single Microsoft Engineer could take it upon himself to discover these flaws beforehand. And that they were surprised by these results.

        That tells me a lot about the Engineering talent. Hopefully som

    • Re:Good start (Score:5, Insightful)

      by still_sick (585332) on Thursday June 16, 2005 @08:17PM (#12837403)
      It seems like Microsoft is showing their own coders how vulnerable their code is, but these are probably the people who already know that best.

      I think it's a matter of levels. Sure, they doubtless know about all the holes in the code or whatever (being the ones that, y'know, PATCH it) - but it's a totally different understanding than that of an expert user.

      It's like an Automotive Engineer and a Mechanic. They both "know" essentially the same things about any specific car. But it's their viewpoints and specific backgrounds that make their individual understandings both unique and useful.
    • Re:Good start (Score:5, Interesting)

      by dbIII (701233) on Thursday June 16, 2005 @08:30PM (#12837469)
      Microsoft is showing their own coders how vulnerable their code is, but these are probably the people who already know that best.
      Possibly not. Isn't it the policy at Microsoft to almost exclusively hire recent graduates that haven't worked elsewhere? Even a monoculture of the best graduates is still a monoculture, and it is quite likely that they are not aware of things that are common knowlege elsewhere. Bringing in others gave us NT - not bringing in others gave us Outlook, IE in a state of near abandonment for years, ping so far off standard you could use it to crash servers and a whole lot of software in which it is obvious that little thought of security or even networking was involved.

      It's like the old saying - three ways to do things: right way, wrong way, army way. Training recent graduates to the corporate culture only works if there are others coming in to stop it being an exercise in corporate narcissism, which is dangerous in a company like Microsoft that makes money by high volume, low development cost "good enough" software as distinct from the expensive low volume stuff you would trust to handle a stock exchange or air traffic control. If they aimed to be the best they would not be so successful, they would be undercut.

      The guys writing the code need to be aware of what is going on in the rest of the world.

      • Re:Good start (Score:3, Insightful)

        by Fallen_Knight (635373)
        Not to mention todays grads don't have the skill of the former.

        used to be you loved CS to go into it, now many do just for a quick buck or a job.

        i'm in 3rd year at SFU, and most poeple i know can't program worth a damn. pointers, multi threaded stuff, assembler confuses many of them. Some never used anything but java untill this year! and then here i am sitting in CMPT 300 as the teacher tried to teach C++ to most of the class and THEN theach OS OS and threads. sad.

        Skill level has come way down. there ar
  • by shm (235766) on Thursday June 16, 2005 @07:40PM (#12837158)
    From TFA, "... some of the engineers were turning red, becoming obviously angry at the demo hacking incident ..."

    I would think they would be looking at their shoes.
    • by Hockney Twang (769594) on Thursday June 16, 2005 @07:50PM (#12837240)
      Contrary to popular belief, most of these developers aren't intentionally releaseing what they know to be insecure code. They test it beforehand, and sign their work. They are making what they believe to be a good effort at security.

      Imagine if you made a product, and were fairly proud of the work you had put into it, and then someone grabs it, and publicly demonstrates that it's terribly flawed, making you appear to be a fool. It's natural to be angry, and hopefully it will only inspire them to greater vigilance in an attempt to save face.
      • by bani (467531) on Thursday June 16, 2005 @07:57PM (#12837285)
        Saving face is exactly the wrong motivation to fix security problems.

        If it takes public embarassment to get these engineers to take problems seriously, then they're totally fucked.
      • I would not be angry I'd be ashamed.

        I'm always open to somebody trashing my code. If they can trash it I need to learn what flaws I'm not aware of that I'm coding.

  • ...like a Phoenix. Slowly, people are catching on. I mean, this HAD to raise some eyebrows.

    It's one thing to read about this on the internet - people say all sorts of things on the internet and you learn to tune it out ater a while.

    But seeing it in front of your own very eyes, watching the hack attack commence in the blink of an eye, the pulse of a heartbeat, the shiver of a twitch, the essence of a raindrop, the flash of an instant, with the click of flint before it ignites the gunpowder in a Civil War era cannon-- etc-- it's shocking.

    And so, ten years later, after learning from the hackers, their once-sworn enemies, the Great Microsoft rose to became Operating System: NWO. And that, my children, is the story of how Herr Syrs Bill Gates and Al Gore created and patented the internet.
  • Hey! (Score:5, Funny)

    by Mr2cents (323101) on Thursday June 16, 2005 @07:41PM (#12837167)
    The event, which Microsoft has not publicized, was dubbed 'Blue Hat' -- a reference to the widely known 'Black Hat' security conference, tweaked to reflect Microsoft's corporate color.

    Hey, IBM is Mr. Blue! Microsoft is Mr. Pink!
  • Pay outs (Score:5, Insightful)

    by 1967mustangman (883255) on Thursday June 16, 2005 @07:42PM (#12837170)
    So microsoft has what like 50 billion in cash reserves? Why don't they just do a bug bounty and like $50 a bug. Like mozilla did. 50 billion/50 = 1 billion bugs they could find and fix that would hav to make some kind of dent right....................oh wait never mind.
  • by djKing (1970) on Thursday June 16, 2005 @07:42PM (#12837176) Homepage Journal
    M$'s corporate color is blue? Could have sworn it was green.

    - Peace
  • by yagu (721525) * <yayagu@NosPam.gmail.com> on Thursday June 16, 2005 @07:42PM (#12837178) Journal
    The hackers, for their part, seemed equally impressed with the technical knowledge of the senior executives they encountered.

    At one point, researcher Matt Conover was talking about a fairly obscure type of problem called a "heap overflow." When he asked the crowd, made up mostly of vice presidents, whether they knew about this type of issue, 18 of 20 hands went up.

    "I doubt that there is another large company on this planet that has that level of technical competency in management roles," Moore said.

    First, at a company like Microsoft, I'd be asking about the 2 senior managers who didn't know about heap attacks. Second, this whole article is a bit of a puff piece it seems designed to put Microsoft in the best light, "Can't we just all get along?".

    Good for Microsoft that they're willing to do this kind of thing... shame on them for waiting until the five years into the 21st Century. While I don't hold much hope Microsoft truly cares about security other than how it affects their public image and bottom line, maybe that kind of pressure will finally be enough to get them to clean up their mess, if only a little bit.

    • At one point, researcher Matt Conover was talking about a fairly obscure type of problem called a "heap overflow." When he asked the crowd, made up mostly of vice presidents, whether they knew about this type of issue, 18 of 20 hands went up.

      "I doubt that there is another large company on this planet that has that level of technical competency in management roles," Moore said.


      Anyone can say that they have knowledge of a particular issue...how many of these vice-presidents actually went on to demonstrate
    • While I don't hold much hope Microsoft truly cares about security other than how it affects their public image and bottom line

      To Microsoft, security is about features. A builtin "firewall", VPN, encryption of this or that, trusted something or other. Applets and wizards.

      They're basically stuck in that position, too. The cash cow is actually layer upon layer of such features, fundamentally designed for a different, and far less ambitious, job than it's now asked to perform.

      I'd better stop, o

  • "End of an era"? (Score:4, Informative)

    by TripMaster Monkey (862126) * on Thursday June 16, 2005 @07:44PM (#12837194)


    From TFA:


    "The security faults we are seeing could end up bringing an end to the era of personal computing," Kaminsky said. "The ability to customize our computers is under attack from those who are customizing it against our will."

    Funny...the Fedora install on my laptop seems fairly customizable and fairly secure all at once...
    • Re:"End of an era"? (Score:4, Interesting)

      by Randseed (132501) on Thursday June 16, 2005 @08:34PM (#12837498)
      It depends. That seems to usually be the bottom line in this kind of thing.

      Linux these days is generally more secure out of the box. But when you install it, you really need to do a 'netstat -ln' and see what's open. Then set up a reasonable firewall. Your average idiot out there can't do this. (I use Gentoo, so I have absolutely no clue how other distributions handle this stuff, and I don't know what kind of blackbox firewall setups are out there.)

      Linux can be less secure than Windows. Usually that's accomplished by turning on all sorts of crap that you don't need, not securing it, and not updating it.

      Windows, by default, is a typical blackbox. The thing is an absolute mess. Years after they first appeared, we still have Outlook viruses that pop up every day. Web browsing with MSIE is like playing Russian Roulette. At least with Linux you don't have to worry about that as much. With Linux, you set the system up, and it stays set up that way for the most part. So many packages (malicious and legitimate) change settings in Windows, that it's nearly impossible sometimes to have a good picture of what is going on with your system.

      I took a Windows system down ony my home network because after one of my family used the thing for a few months I threw a traffic and systems analyzer on the thing and saw so much spyware and so many viruses on it that I couldn't justify letting the thing stay on my network. This was with Norton Antivirus running on it, mind you. As it is, any Windows installation I have is sectioned from the rest of the network for just that reason. They sit on their own subnet, can't talk to each other, can't talk to the LAN, and can only route out to the Internet.

    • by Effugas (2378) *
      What would you think if almost all the code on your system was assembled by Microsoft -- even the third party stuff?

      Strange. Bad. Awful.

      But it's the reality with RPM, or even Apt/Emerge. The Linux distributions really have limited how much stuff the average user installs randomly from the net. But it's a temporary thing...Spyware for Linux isn't worth developing, because there aren't enough non-geek eyeballs to sell.

      It's overall a pretty cool article, but the comparison I had made when talking to Ina
  • by WillAffleckUW (858324) on Thursday June 16, 2005 @07:44PM (#12837195) Homepage Journal
    would be more appropriate than Blue Hat conference.
  • From TFA: That shift began in earnest with a well-publicized memo written by Gates on the concept of "trustworthy computing" in 2002. Security had long been a concern at Microsoft, but the issue became imperative after several high-profile attacks exposed the degree of its vulnerabilities.

    Sheesh! It's 2005 and there are still unpatched vulnerabilities. Damn hackers, they're always faster than us! (/sarcasm)
    • Sheesh! It's 2005 and there are still unpatched vulnerabilities. Damn hackers, they're always faster than us! (/sarcasm)

      Heck, they just released a bug fix for an IE bug that was already fixed, put back in by mistake (since it was still in IE), and refixed in Firefox ... today.

      Wow, it's like watching paint dry.

      Luckily for them hackers just go away on vacation in the intervening years between bug fixes ... right?

  • by kryogen1x (838672) on Thursday June 16, 2005 @07:46PM (#12837213)
    How many Red Hat jokes are going to be made now?
  • by ronark (803478) on Thursday June 16, 2005 @07:48PM (#12837222)
    At one point, researcher Matt Conover was talking about a fairly obscure type of problem called a "heap overflow." When he asked the crowd, made up mostly of vice presidents, whether they knew about this type of issue, 18 of 20 hands went up.
    "I doubt that there is another large company on this planet that has that level of technical competency in management roles," Moore said.

    So what? Maybe they read some document informing them of what a heap overflow is. It's more important that these managers understand what goes into the code and the technical details that make the system operate, not what an "obscure" problem like a heap overflow is. Microsoft's managers can only claim technical know how if they have experience working as developers, because otherwise it's simply too hard to understand the real issues that the engineers have to face.

  • by ratta (760424) on Thursday June 16, 2005 @07:49PM (#12837226)
    White hats do white magic

    Black hats do black magic

    Blue hats do blue screens of death

  • by UnknowingFool (672806) on Thursday June 16, 2005 @07:50PM (#12837234)
    Programmers actually thought that their code could not be exploited. I don't know if this is collective arrogance or part of the MS culture, but it seems most of the world outside of MS knows how easily code in general can be exploited. With as many security problems MS has had and Bill Gates many public proclaims about security, you would think that they would know there may still be issues in their code.
  • Microsoft Security (Score:4, Insightful)

    by jfonseca (203760) on Thursday June 16, 2005 @07:51PM (#12837241)
    Microsoft has managed to link itself with bad code to a degree that, recently, I spent over 40 minutes convincing a programming team that Code Complete was actually a good book and did not reflect the bad quality of Microsoft software.
  • by kmactane (18359) on Thursday June 16, 2005 @07:56PM (#12837280) Homepage

    I remember when Windows 95 came out, with its weak, obviously-an-afterthought "web browser" (IE 3.0). It was painfully obvious that Microsoft had missed the Internet boat, and shortly thereafter, Bill Gates sent his historic all-hands memo pointing the company in the direction of the Internet.

    It took them some time to get it right, but eventually IE took over. Now, you'd have a hard time finding a Microsoft product more complex than Minesweeper or calc.exe that doesn't connect to the Net somehow. And let's not forget that Netscape provided Microsoft with some much-appreciated help in taking over the Web, by screwing up their own release schedule so badly that there never was a Netscape 5.0.

    Flash-forward to a couple of years ago, when Bill sent out yet another all-hands memo, pointing the company in the direction of security. At first, we all laughed. But now it's becoming more and more obvious that they're taking security every bit as seriously as they once took the Internet. They are aiming to be the top of the heap in security, and they've got drive, ambition and aggression.

    Make no mistake, this kind of event is exactly what a company that wants to get secure should be doing. Thomlinson's comments about how seeing their code exploited "hits people in the gut", and the fact that "he was glad to see the crowd of engineers taking things personally" -- these things are right on the money. These things say to me that, within a few years, we're going to see some really damn secure stuff coming out of Microsoft.

    In the meantime, Firefox exploits are cropping up at a seemingly greater pace. This worries me. It looks like a repeat of 1997, when Netscape lost huge amounts of ground to IE by producing a product that wasn't as good as the competition. SP2 wa s huge leap forward in security for Windows and for IE, and Blue Hat makes it obvious that Microsoft is just going to get better at it. In the meantime, Firefox appears to be standing still on the security front, or maybe even losing a little ground. Sure, it's still miles ahead of IE's security, but if IE keeps up the pace, it will overtake Firefox sooner or later -- probably sooner.

    Is there any way the Firefox development team (and the OO.o team, and anyone else who's working on high-profile F/OSS projects) can take a lesson from Blue hat? Can we get together events like this of our own?

    If we don't, I can already see that by 2009 or so, at the latest, I'll be telling clients to go with Microsoft products, because they're more secure than F/OSS. And I don't want to see that happen.

    • by Mingco (883841) on Thursday June 16, 2005 @08:08PM (#12837368)
      They are aiming to be the top of the heap in security, and they've got drive, ambition and aggression.
      Ironically, once they reach the top of the heap in security, they'll discover that it has been overwritten by overflowing buffers.
    • These things say to me that, within a few years, we're going to see some really damn secure stuff coming out of Microsoft.

      I don't think so. Of course they are now taking security a bit more serious, but there are so many big conceptual mistakes, so many design flaws, they won't and can't fix, or they would break thousands of applications which you can't just recompile...

      Like:
      - case insensitive but case-preserving filesystem (ambiguities in filenames)
      - active X and other unsafe scripting languages all ove
      • - case insensitive but case-preserving filesystem (ambiguities in filenames)

        How so? You can't create (for example) readme, README and ReAdMe all in the same directory on Windows, so you can't cause ambiguity like that.

        - writeable windows\system and other writeable directories. ACLs are nice, but you do have to set sensible defaults..

        Normal users don't have write access to the Windows of Program Files directories. Now, you can argue that MS hasn't exactly made it easy for people to run as normal users,
    • "Flash-forward to a couple of years ago, when Bill sent out yet another all-hands memo, pointing the company in the direction of security."

      That is the problem, security can't be achieved the same way that browser market domination was. To fix security, MS will need the following:

      A lot of rewritting, that is expensive. But can be done.

      A lot of testing, that FOSS gets for free and MS pays a lot. But can be done.

      Also, they'll need to modify the relationship they have with their customers. That is a hard on

    • by jafac (1449) on Thursday June 16, 2005 @09:14PM (#12837736) Homepage
      Make no mistake, this kind of event is exactly what a company that wants to get secure should be doing.

      Exactly. Working for a major Systems Integrator, our customer actually has a special team of people who do nothing but hack systems, and recommend security changes to the products they buy.

      We thought we had locked down our systems pretty well. They turned it out pretty good, and produced a 92-page report. (of course, some of it was gratuitous).

      However, the end result: slapping security changes onto an already-developed product, results in a whole lot of breakage. This lesson will benefit our NEXT customer. And it will really, really hurt our current customer. The lesson? Security should be designed-into a system from the start.
    • by Anonymous Coward
      First, MS did not get IE right. They used thier dominant desktop position to squeeze out other players. The failure of netscape was due equally to the netscape problems and the fact that MS sabotaged Navigator. I have used nearly every major browser since Mosaic. To this day IE does not provide the expected overall functionality one would expect in a web browser, but exists merely to support a few, mostly lame, MS features.

      Second, most of MS problems are caused by the fact they miss nearly every boat

      • I hate to break the news to you, but IE3 was on par with Netscape 3, and IE4 just blew Netscape out of the water. MS only 'sabtaged' Netscape because IE was simply a much better browser at the time.

        Hell, for the longest time, IE was THE browser to use because of it's standards compliance, features, etc...

        Also, the only security advantage Firefox has with not being integrated is that it's not shipped with the OS. The fact is, is that IE is shipped with every single Windows computer, and as such anyone ca
      • Firefox is not comparable because firefox is not a component of the OS. It is not, as is IE, an application front end, but a standard stand alone web browser. The critical nature of firefox bugs cannot reach that of IE becuase they are not, by definition, OS level faults.

        IE has no greater ability to do damage to the system than Firefox does.

  • by kt0157 (830611) on Thursday June 16, 2005 @07:58PM (#12837301)
    In my previous company I tried to communicate with engineers. I was an engineer, but it's still damned hard. Programmers just don't "get it" without hard work. In the end, this kind of smack-in-the-face-by-the-real-world approach is what is needed.

    I reckon it's because so many programmers have at least a touch of Asperger's. The number of times I'd try to explain that customers behave like monkeys, focusing on the wrong things, buying products for the wrong reasons. But these reasons aren't "wrong" if it means the difference between selling a product and not selling a product. That yes, it's "wrong" to buy a product because we've used Times Roman screenfonts but the competitor used Tahoma, but just change the goddamn font, OK?

    Reminds me of the story about 1-Click from Amazon. After patiently explaining what he wanted, the developers all nodded and said, yes, they can do 1-click. A few weeks later the prototype is ready and Bezos tries it out. He clicks on a book. And up pops a dialog box that says "Are you sure?"..

    Read about this in Cooper's book "The Inmates Are Running The Asylum."

    K.
  • by MrNonchalant (767683) on Thursday June 16, 2005 @08:03PM (#12837331)
    I'm banking that I'm the first one to say this, and that there are at least a few reasonable moderators out there.

    This represents a step in the right direction for Microsoft. Perhaps as a community we need to face the possibility that they may be changing. I read the entire article, and it seemed as if Microsoft genuinely wanted to change. I run Linux, and so do a lot of you, so it is understandable when a lot of you will deride Windows no matter what because it represents a competitor. I just don't buy into that philosophy, it doesn't hold much room for fair.

    Giant Anti-Spyware, IE 7, and the anti-vrus acquisitions are all good indications. Let us just hope, for the internet and personal computing's sake, that Microsoft doesn't blow it and charge for them. Either that, or blows it so hard their customers (corporate and power user home) all look for more stable operating systems (hint: all other consumer desktops of any note run a Unix derivative of one sort or another).
    • by dustmite (667870) on Thursday June 16, 2005 @08:24PM (#12837436)

      Microsoft always catch up after being behind everyone else after roughly ten years, in everything they do. The same is true for their current drive towards security, where they are starting to catch up to, say, the seriousness with which 1980's UNIX vendors approached security.

      The underlying problem though is that Microsoft only ever develop anything reactively, never proactively. Every move they've ever made has been kind of like: "hey look, company XYZ has produced this excellent product ABC, and everyone loves it, let's also start working on something like that and release a semi-decent version five years from now". This will never change.

      So it's all fine and well that Longhorn 2006/7 will be the first MS OS ever actually built with a serious company-wide intention of being secure, but the question is, do you want to always be at least "ten years behind" like that? Do you think it's good to keep putting your money into the company that only knows how to "catch up", in an industry that really runs much better when there is leadership and innovation?

    • Sure, Microsoft is moving in the right direction; however, I would call it more of a shove than a move. Microsoft's not doing the pushing in this case, which makes it so hard to understand without some context.

      Microsoft has become synonymous with bad software. Why else would a company as powerful as Microsoft become so desparate as pull off this latest stunt?

      This story includes:
      1. Uncooperative Black Hats that somehow manage to cooperate with Microsoft to assist in securing the OS, yet remain blacker th
  • by kmortelite (870152) on Thursday June 16, 2005 @08:03PM (#12837333)
    "It was just silent," said Stephen Toulouse, a program manager in Microsoft's security unit. "You couldn't hear anybody breathe."

    And then some guy in the back stands up and starts yelling "Developers! Developers! Developers..."
  • by CaptainCarrot (84625) on Thursday June 16, 2005 @08:07PM (#12837363)
    Or at least part of it anyway. From the article:

    The second day drew about 400 rank-and-file Windows engineers, including people who don't necessarily focus on security features in their day-to-day work.

    "Don't necessarily focus on security features"? If this is just the reporter making up his own description it's not so bad. But if he's just echoing what he was told by Microsoft or whoever his source was, then they're looking at this backward and probably have been for a long time.

    Anyone who touches that code for any reason at all has to keep security in mind every time he does it. It doesn't matter if he's responsible for authentication or whatever else they're including under the rubric of "security features". Any bit of code is a potential vulnerability. It only takes one buffer overflow, one set of bounds that's not checked, one line of code that doesn't validate the terminator on an input text string, to create one. And then it's a security problem for everybody. If making non "security feature" programmers aware of these issues is a new thing at MS, they've been doing this all wrong for years. (As many have suspected, but seeing it possibly confirmed is still a bit of a shock.)

  • a little niggle (Score:4, Informative)

    by JamesD_UK (721413) on Thursday June 16, 2005 @08:07PM (#12837364) Homepage
    Can people write, or the editors make sure that article summaries are just that, not cut and pasted paragraphs from the article? The posting makes it look like Mz6 wrote those paragraphs which is only true if she's Ina Fried .
  • by G4from128k (686170) on Thursday June 16, 2005 @08:14PM (#12837390)
    Unless Microsoft uses NO wireless on its campus or unless the walls were RF shielded, this was a very dangerous stunt. If a hacker can gain access to a Windows machine via wireless (and they can according to this account), then they would be able to (and might have) accessed wireless networks outside the meeting room but inside the corporate firewall. Range is no protection as it would be not hard to build a high-gain antenna into the lid of a hacker's laptop and orient it to pickup WiFi elsewhere on the Microsoft campus. If a hacker can gain access to an inside machine, they could plant a backdoor for later exploits including attacks on the the company's codebase.

    I'm not a shareholder or a user of their products (except to the extent that the vast majority of the companies I do business with use Microsoft) but I find this an extremely irresponsible act on the company's part. If they want to try this sort of security testing, and they should, it should be done off-site or in a shielded room.
    • If a hacker can gain access to a Windows machine via wireless (and they can according to this account), then they would be able to (and might have) accessed wireless networks outside the meeting room but inside the corporate firewall.

      Anyone doing even halfway decent wireless networking in the corporate environment is simply using the wlan as a transport layer for a VPN. Without the VPN you can't get anywhere.
  • by Ridgelift (228977) on Thursday June 16, 2005 @08:24PM (#12837439)
    FTA: Yet regardless of the mutual admiration, some tense moments were inevitable during the confrontation.

    Microsoft developers, for instance, were visibly uncomfortable when Moore demonstrated Metasploit--a tool that system administrators can use to test the reliability of their systems to intrusion. But Metasploit also includes a fair number of exploits, as well as tools that can be used to develop new types of attacks.

    "You had these developers saying, 'Why are you giving the world these tools that make it so easy to do exploitation?'" Kaminsky said. They calmed down, he said, once the researchers were able to state their case.

    "We do regression testing in the real world of software development," Kaminsky said. "If we say, 'This thing isn't going to break,' then we need to test that. What these tools give is the ability to do this kind of testing, to be able to say not just, 'We did the best we could,' but 'We tried stuff and nothing worked.'"

    Nevertheless, he understands why not all Microsoft developers were satisfied with the explanation.
    Wow. This is great (and about time too). What really seems clear to me from all this is the problem with Microsofties is the same problem a lot of slashdot readers suffer from: hubris.

    Open Source software is not bulletproof. It suffers from security defects as well. The big difference, however, is we're up front and honest about it. Microsoft can't afford to be that way, as they rely on customer confidence and their monopoly to stay in business.

    Microsoft seems to be understanding that their real problem in improving security is people, not so much the technology. By letting the "bad guys" knock the bricks down in front of the programmers who build the stuff, it ouggta sink in pretty deep.

    Fix the attitude among the developers and the technical stuff will probably follow. Too bad a lot of slashdotters aren't able to experience the same thing.
  • FINALLY!!! (Score:3, Insightful)

    by Whatchamacallit (21721) on Thursday June 16, 2005 @08:26PM (#12837443) Homepage
    Time for the security guys to SMACK some sense into those MS Engineers! Go Man Go! Your system is like Swiss Cheese and you really really need to freaking fix it! This BlueHat event is literally a smackdown to wake the MS engineers and management up to just how bad it really is. It is critical for the MS Engineers to get shaken out of their MS Corporate boots and have their eyes opened to the truth. Seeing you most recent work getting compromised in seconds must have driven some of these guys completely bonkers!

    The invited security experts are familiar with all kinds of expliots even at the latest patch release. However, the really smart ones are not working security for a living they are doing International Corporate Espionage where you don't publish what you find, you use it over and over and guard it as secret so you can get paid as you steal IP from one company and sell to another.

    Personally, I don't believe that MS will be able to fix Windows unless they go through a complete rewrite, that means beyond Longhorn before they get it right. They can continue to bandaid it or they can start over and design the way OpenBSD designs. Include security regression testing into their milestone workflow. While they are re-doing things they can also fix all the other broken crap that needs fixin!

  • by zogger (617870) on Thursday June 16, 2005 @08:32PM (#12837481) Homepage Journal
    ...on "security"

    uh huh

    think about what that sort of cash would do to help out open software in general terms, all the various neato projects done with a few dollars and a lot of skull sweat. Think about if only a fraction of that went to linux kernel development, say something small, like 100 million dollars, 1/20th of what MS spends on "security research"

    I am just amazed at this,it is just a staggering sum for those products and their "security features".
  • Engineers? (Score:5, Informative)

    by HydroCarbon10 (40784) * on Thursday June 16, 2005 @08:41PM (#12837532) Journal
    WTF is up with calling programmers engineers now? The term 'engineer' is regulated in all 50 states, and calling yourself an engineer without being licensed is worthy of a fine. There are some exceptions, but these vary from state to state, making it best to completely drop the title 'engineer' unless you're actually licensed in the state you're advertising in.
  • by chia_monkey (593501) on Thursday June 16, 2005 @08:43PM (#12837551) Journal
    Yeah...M$ MEANT for that to happen. Here's the real story:

    M$ Exec 1: "Oh sh*t!!! We've got a security problem. One of our computers has been lured to a baaaaad network"

    M$ Exec 2: "Crap. Wait, I know. Get MarComm on the phone. We'll tell the world we were running a test. We're finding flaws so we can fix them. Yeah, that's the ticket."

    M$ Exec 1: "Good thinking! Maybe we should tell them to also release a statement that the BSOD is actually Microsoft's commitment to employee health. A soothing blue screen comes up, gently reminding employees to get up, stretch their legs, refocus their eyes..."
  • by SuperKendall (25149) * on Thursday June 16, 2005 @11:14PM (#12838358)
    "Hackers, Meet Microsoft"

    Oh, I see you're already well-aquanited!

When you don't know what to do, walk fast and look worried.

Working...