Vista's Security Rendered Completely Useless 415
scribbles89 sends in a story that originally ran in SearchSecurity; it sounds like it could be a game-changer. "While this may seem like any standard security hole, other researchers say that the work is a major breakthrough and there is very little that Microsoft can do to fix the problems. These attacks work differently than other security exploits, as they aren't based on any new Windows vulnerabilities, but instead take advantage of the way Microsoft chose to guard Vista's fundamental architecture. According to Dino Dai Zovi..., 'the genius of this is that it's completely reusable. They have attacks that let them load chosen content to a chosen location with chosen permissions. That's completely game over.'" Update: 08/08 14:23 GMT by KD : Changed the link, as the story first linked had been lifted without attribution.
Marketing opportunity (Score:5, Funny)
Microsoft has reacted to this security exposure by launching a new version that puts the OS out of reach and is guaranteed attack-proof: Vista for Vacuums.
Re:Details... (Score:2, Funny)
It'd be interesting to see a description, and see if other systems with similar protections are vulnerable.
Hmm.... No, I can't think of anything as "secure" as vista to be as insecure.
Article is also completely useless (Score:0, Funny)
The article is also completely useless, as it doesn't explain the vulnerability in any detail necessary to understand it.
sounds like a publicity stunt (Score:1, Funny)
Well, OK, then. Security (Score:5, Funny)
But what about all the _other_ great things about Vista? Like......ummm, you know.
Re:Well, OK, then. Security (Score:4, Funny)
But what about all the _other_ great things about Vista? Like......ummm, you know.
The Aquaducts?
Re:Marketing opportunity (Score:3, Funny)
Microsoft has reacted to this security exposure by launching a new version that puts the OS out of reach and is guaranteed attack-proof: Vista for Vacuums.
Then Vista would really suck.
Re:Details... (Score:5, Funny)
PS1="root@computer:~#"
export PS1
# Pwned
The Real Story is The Time of Post (Score:2, Funny)
Re:Details... (Score:1, Funny)
I'm sure I'm not the only one who remembers running some little script [slashdot.org] with normal user privileges, and suddenly seeing the prompt change from
user@computer:~$
to
root@computer:~#
Hey, psst, want some root exploit?
$(echo rkcbeg CF1='ebbg@\u:\j#\040'|tr '[a-m][n-z][A-M][N-Z]' '[n-z][a-m][N-Z][A-M]')
Re:Details... (Score:4, Funny)
It's more like the 4004 or before. Don't trust the result on your handheld calculator if someone else has been in possession of it. It probably just says "boobies" if you turn it upside down.
Not a real problem (Score:5, Funny)
Hackers will get so frustrated with the repeated, "Are you sure you want root privileges?" dialogs that they'll give up.
Re:Details... (Score:3, Funny)
That's it! Damn it, I thought they'd fixed it!!
Let's test it: /media/winxp
adpsimpson@asimpson:~$ PS1='root@computer:~# '
root@computer:~# rm -r
rm: remove write-protected directory `winxp'?
Whoa, what are all these popups??
Re:Details... (Score:3, Funny)
Your exploit would fail on OpenBSD. It is truly more secure.
Throw this in the bucket... (Score:4, Funny)
Re:Details... (Score:5, Funny)
Windows vulnerabilities are extraordinary?
I'll have some of what you're drinking, please.
Re:Neowin Plagiarists? (Score:4, Funny)
Although it's no surprise that kdawson posted an inane "story" without any detail that bashes Microsoft, that lawyer comment is amusing enough to at least make the spam worth reading for a change. ;-)
Re:Details... (Score:5, Funny)
Re:Details... (Score:3, Funny)
Call me when my server is also covered it hot grits and petrified.
Re:Details... (Score:5, Funny)
your running kernel...
"Excuse me, is your kernel running?"
"Yes..."
"Well then you'd better go catch it before it trips over your address space layout randomization and skins its knees on the data execution prevention!"
Re:Marketing opportunity (Score:4, Funny)
Microsoft has reacted to this security exposure by launching a new version that puts the OS out of reach and is guaranteed attack-proof: Vista for Vacuums.
Then Vista would really suck.
No, if you put Vista on a vacuum, it would probably blow!
Re:Well.... (Score:3, Funny)
The Black Hat conference is a trap. You buy tickets online and get Party Vanned 10 seconds after you hit submit on the web form.
Re:Details... (Score:5, Funny)
You want to punish people for their choice of OS? That's freaking hysterical. I think you need a little perspective realignment...
Especially considering the fact that if you run microsloth the punishment is the crime.
Re:Details... (Score:5, Funny)
I read it and now my system IE is full of toolbars. Oh shi
Re:Details... (Score:5, Funny)
Re: Vista issue (Score:5, Funny)
Perhaps now that breaking security for Vista will become such a trivial matter, all those evil malware coders will focus on other, more challenging OSes...
Mind you, a lot of people consider a product's solidity by the number of patches released, so, Vista is about to start looking real good, nah?
Re:Well.... (Score:5, Funny)
Re:Details... (Score:2, Funny)
It would only work on the sort of Neowin-reading "power users" who turn off security features to gain (perceived) speed and convenience.
Perceived? So you are stating that UAC is not a real inconvenience just perceived? So. Tell me. How long have you worked at Microsoft?
Re:Well.... (Score:5, Funny)
www.fbi.gov/cheapblackhattickets/ is not the real ticket site ya know.
Re:Details... (Score:2, Funny)
Re:Details... (Score:5, Funny)
Asked to comment on an old, well documented and proven super-threat with complete details provided, a Microsoft spokesman responded "What the Hell are you talking about?"