Become a fan of Slashdot on Facebook

 


Forgot your password?
Close
typodupeerror
×
Microsoft Security

What Spooks Microsoft's Chief Security Advisor 136

Posted by samzenpus from the when-the-darkness-looks-back dept.
alphadogg writes "Microsoft's U.S. general manager/chief security advisor for its National Security Team, Bret Arsenault, thinks like a true security professional. In every bit of good news, he wonders what bad news could be coming. Application security, virtualization security and the fact that over half of computer attacks seen by Microsoft come from the .edu domain are just some of the things keeping him up at night."
This discussion has been archived. No new comments can be posted.

What Spooks Microsoft's Chief Security Advisor More

What Spooks Microsoft's Chief Security Advisor

Comments Filter:

  • students sharpening their pens (Score:5, Informative)

    by ionix5891 ( 1228718 ) on Thursday March 27, 2008 @07:01AM (#22880148)
    half of computer attacks seen by Microsoft come from the .edu domain

    nothing to worry just students testing their scripts against big bad microsoft :) we all did it at one stage ;)

    • Re:students sharpening their pens (Score:4, Interesting)

      by hostyle ( 773991 ) on Thursday March 27, 2008 @07:07AM (#22880178)
      Fatter pipes are bigger targets to would-be evildoers, as it gives them more bandwidth with which to carry out their nefarious deeds. That makes a rooted .edu box almost as important a component of Dr. Evil In Trainings' arsenal as a hollowed out volcano island.

      • Re: (Score:3, Insightful)

        by morgan_greywolf ( 835522 ) *

        Fatter pipes are bigger targets to would-be evildoers, as it gives them more bandwidth with which to carry out their nefarious deeds. That makes a rooted .edu box almost as important a component of Dr. Evil In Trainings' arsenal as a hollowed out volcano island.
        At one time that was true. Not anymore. Haven't you heard? Fat pipes [verizon.com] are cheap and increasingly common these days.

        • Re:students sharpening their pens (Score:5, Informative)

          by Bert64 ( 520050 ) <.moc.eeznerif.todhsals. .ta. .treb.> on Thursday March 27, 2008 @08:04AM (#22880596) Homepage
          Home connections still have fairly poor upstream compared to their downstream...
          People who root boxes want upstream, so they can scan for more boxes to hack, ddos things or distribute malware. They typically have very little need for downstream bandwidth to the compromised boxes.

          • Home connections still have fairly poor upstream compared to their downstream...
            Either you didn't at least hover over my link, or you actually have no idea that Verizon FiOS offers the same speed up and down. And that's not all -- all the telcos (included AT&T) are in the process of developing, deploying and testing this same tech[1].

            [1] This knowledge comes from unofficial sources inside of AT&T

            • Either you didn't at least hover over my link, or you actually have no idea that Verizon FiOS offers the same speed up and down.

              Huh? My FIOS is 5Mbps down and only 2Mbps up. If I upgrade, I get 15Mbps down but still only 2Mbps up.

              Or is this an undocumented feature in FIOS? (I never really bothered to test, even a 5Mbps bandwidth is almost never an issue for me).

              • Well, over here in the NY metro area I have a residential 50 Mbps down, 20 Mbps up FIOS connection. They also offer a 20/20 package as well.

          • Re: (Score:3, Funny)

            by ozmanjusri ( 601766 )
            People who root boxes want upstream, so they can scan for more boxes to hack, ddos things or distribute malware. They typically have very little need for downstream bandwidth

            There's a lot of home users out there running non-admined MS boxes.

            never underestimate the bandwidth of a truckload of pipes...

        • I mean seriously.... Bret Arsenault?

          Did he legally change his name after he got hired? Other cool pseudo-names: Ima Baadash, Tod Newclierre, or John Wepunce.

          • Re: (Score:3, Interesting)

            by Jeremiah Cornelius ( 137 ) *
            He's also a pretty cool guy. His group sponsors big, security awareness events twice a year for MS customers - and these are real sessions, not PR fluff. Bret is friendly and accessible.

            If he's at RSA this year, drop by the MS booth and say hi to him.

          • Re: (Score:1)

            by Forseti ( 192792 )
            What, cause it's spelled somewhat similarly to arsenal? It's a relatively common French name, and pronounced "Arseno", so your analysis breaks down a little... :-)

    • Re:students sharpening their pens (Score:5, Insightful)

      by an.echte.trilingue ( 1063180 ) on Thursday March 27, 2008 @07:10AM (#22880202) Homepage
      True. Students usually have time on their hands, knowledge at their disposal and being young they still have an underdeveloped sense for the potential consequences of their actions. Oh, and T1 connections directly into the dorms. Just talk to somebody who administers a university network: trying to keep students from "playing" with the school infrastructure is a nightmare.

      • Re:students sharpening their pens (Score:4, Interesting)

        by Brian Gordon ( 987471 ) on Thursday March 27, 2008 @07:13AM (#22880222)
        No T1 directly into my dorm.. unless you're at MIT chances are you're starved for bandwidth and have to sleep during the day and game all night to get any decent pings.

        • Re:students sharpening their pens (Score:5, Funny)

          by Anonymous Coward on Thursday March 27, 2008 @07:27AM (#22880328)

          unless you're at MIT chances are you're starved for bandwidth and have to sleep during the day and game all night to get any decent pings.
          You don't get very good grades, do you?
        • It might be a T1. A T1 is only 1.5 Mbit. That's not enough bandwidth for a dorm full of MIT students who are all trying to play online games and hack.
        • Most schools have Greater then a T1 speeds to their dorm rooms! A T1 is a measly 1.544Mbps. Most dorms have at least a 10Mbps connection to the LAN and 1-8Mbps to the Internet.
        • Our's has a 10x10 pipe that goes directly to the hall; however, divide that by the 200~300 students in the dorm hall and the mbps drops back to dial-up.

        • Re: (Score:1)

          by fbartho ( 840012 )
          more schools than MIT have great dorm networks. My saddest regret when I left the dorm system was that I couldn't get internet access as fast as in the dorms for less than 500$/month. My only affordable options were comcast or DSL and it turns out that DSL would usually have as good effective upstream as comcast. Go Blue! (umich.edu) I wish the fiber providers would get their asses in gear and provide me!
      • Peesh... T1.

        You should try working for an ISP, where we have a gigabit pipe into the office... now, if I could only persuade IT support to get me a network card capable of keeping up with it ;)

    • Re: (Score:1, Flamebait)

      by no-body ( 127863 )
      Nope - that goes differently: Do you believe anything some sworn in M$ looney coughs up?

      NOPE!

      Totally PR brainwashed individuals learning from their propaganda bible, dreaming or living in a different reality!

    • Re: (Score:3, Insightful)

      by jav1231 ( 539129 )
      I smell a big Microsoft initiative for securing colleges and universities coming. Government contracts, proprietary model continues, and it's all for our children.

  • Big surprise? (Score:3, Insightful)

    by suso ( 153703 ) * on Thursday March 27, 2008 @07:02AM (#22880150) Journal
    over half of computer attacks seen by Microsoft come from the .edu domain

    Actually, does this really surprise anyone? I think if you took away the botnets that might attack Microsoft, you might have
    something more like 80%. Not that it was an attack, but I used to always use billy@microsoft.com as a return address when I was testing
    e-mail or showing someone something.

    • Re: (Score:1, Interesting)

      by Anonymous Coward
      When I got pissed off enough by spam around 1994/95 at university, I would launch DoS attacks (syn flooding) against the offending websites :)

      I'm sure there are plenty of students young and stupid like I was at the time.

    • Re: (Score:2)

      by xaxa ( 988988 )
      I only have a small mail server's logs to look at (just my personal domain). But I haven't seen *any* botnets in the .edu domain attempting to deliver spam to me in the last 20 days. I think Microsoft is referring to cracking attempts?

      Top five domains (number of spam messages delivered to me):
      120 .net, 110 .com, 98 .ru, 95 .pl, 83 .it
      (Very simple statistics: just grepping the mail log for domain names. It doesn't include any host with no reverse DNS. And I don't get that much spam, as you can se

    • Re: (Score:1, Informative)

      by Anonymous Coward

      I used to always use billy@microsoft.com as a return address when I was testing

      billg@microsoft.com would have been better.

  • Cleaner Version (Score:5, Informative)

    by Anonymous Coward on Thursday March 27, 2008 @07:08AM (#22880186)
    Without [networkworld.com] all of the ads. Won't someone please think of my eyes?
  • over half of computer attacks seen by Microsoft come from the .edu domain IT Teachers have too much free time on their hands... But I bet the other half comes from .cn domain.
  • i presume same things that spooks every other network admin

    *rooted linux boxes, yes these are dangerous in wrong hands :(
    *Russian business network
    *chineese spammers
    *prolonged multi gbit DDOS

    • Yes, but this is Microsoft's Cheif Security Advisor ...

      This is slashdot ... the headline should read "What spooks Microsoft's Chief spook?"

  • The guys is an idiot (Score:3, Interesting)

    by Anonymous Coward on Thursday March 27, 2008 @07:17AM (#22880254)
    The reason why the security flaws are dropping is because the 2 largest groups of crackers are operating under foreign govs. The russians were out to make money, But now operate with the russian gov. In addition, the chinese crackers have also switched up. Why? Because they can do all this legally in their country and not worry about a bullet to the brain. The simple fact is, that 5 years ago, these folks were cracking systems for money. Now, they are cracking targeted systems (i.e. DOD) and using subtle openings. Almost certainly the big openings are being saved for future use.

  • Q&A (Score:5, Funny)

    by cerberusss ( 660701 ) on Thursday March 27, 2008 @07:22AM (#22880288) Journal
    Question: What do you think about Microsoft's U.S. general manager/chief security advisor?
    Answer: I think it would be a good idea.

  • What Spooks Microsoft's Chief Security Advisor (Score:5, Funny)

    by somethingwicked ( 260651 ) on Thursday March 27, 2008 @07:29AM (#22880340)
    What Spooks Microsoft's Chief Security Advisor?

    Flying chairs?

  • What do you prefer? (Score:3, Insightful)

    by miffo.swe ( 547642 ) <daniel...hedblom@@@gmail...com> on Thursday March 27, 2008 @07:43AM (#22880436) Homepage Journal
    "Application security, virtualization security and the fact that over half of computer attacks seen by Microsoft come from the .edu domain are just some of the things keeping him up at night."

    As a user of said computers/servers i much prefer a scripthappy student whimsing around my systems alerting me about security issues. What do worries me are govt founded hackers stealing sensitive information, research and other secrets leaving no n00b traces for me to discover. Its not the actual breakin that worries me but what the perpetrator do thats an issue. If someone breaks in but does no harm i can live with that. My feelings may get hurt but the company is ok atleast.

    An application/OS vendor ofcourse prefer the stealth hacker since the student hacker brings into attention all the various security issues with their products and makes people look for other options. Many vendors prefer a company being hacked to pieces before letting an exploit being known publicly. Microsofts own exploit policy is a very telling sign of this. As long as an exploit isnt used extensively its not going to get patched regardless of how many systems are exploitable. That worries me at night...

    • Re: (Score:3, Insightful)

      by Bert64 ( 520050 )
      I doubt it's students in control of those .edu systems...
      They are probably being used as jump boxes by hackers operating elsewhere, including those government sponsored ones.

  • Comment removed (Score:3, Interesting)

    by account_deleted ( 4530225 ) on Thursday March 27, 2008 @07:46AM (#22880456)
    Comment removed based on user account deletion

    • Re: (Score:1)

      by Forseti ( 192792 )
      What you say is true, and the time-to-market requirements of the current market certainly aren't conducive to long QA cycles prior to release, but still; Using the word "innovation" as an excuse in a story about Microsoft? Get real!

  • This Guy Doesn't Get Security (Score:3, Interesting)

    by segedunum ( 883035 ) on Thursday March 27, 2008 @07:49AM (#22880470)

    Among the most frustrating findings for Arsenault: Just over half of all attacks originated from the .edu domain. "[That's] a fundamental problem," he said. "We've got to do a better job with the university systems to stop that."
    You can never run around trying to get people, and universities, to stop things that are basically open-ended. If those are the number of attacks you're experiencing then those are the number of attacks you're experiencing, regardless of where they originate from and why. The web is a free place, and it shows an exceptional naivety to think that can be stopped by pressuring universities.

    But Arsenault does sweat over whether there's really less exploitable code, or whether it's more a case of such code just being kept secret by nation states looking to wage cyberwar.
    Rrrrrrrrrright. So just like with Iraq's incredibly destructive weapons, if there isn't anything happening then it's because there is something even more devious and cunning going on?

    Mind you, I wouldn't have expected anything less from Microsoft's Chief Security Advisor.

    • Re: (Score:2, Informative)

      by Time Ed ( 970465 )
      I think he "gets it" just fine. Most of his assessments are right on the money compared to what I see day-to-day.

      Who wouldn't want to stop attacks against their site? Half the attacks I see are sourced from Asia. The other half from US-based broadband connections. We buy BIG pipes, and my execs pay a lot of money for our provider to work with regional ISP's to filter attacks at the source.

      Like it or not, he's right: attacks are becoming application-based. Mostly browser-based. The other end of that is socia

  • Computer Security what is a crime and what isn't? (Score:5, Insightful)

    by mlwmohawk ( 801821 ) on Thursday March 27, 2008 @07:50AM (#22880476)
    I hear a lot of people make the analogy that computer breaches are like breaking and entering, and while some of the actions are, some are clearly not.

    Mischief is the motivation of youth. Vandalism is a form of expression. We've all participated in it in some form, so everyone get off their high horse, and rather than "get tough on crime," its time to figure out the difference between kids having fun and serious criminals. It is also time to make computer systems in "the digital world" as resilient to mischief and vandalism as real physical buildings are in the real world.

    We've all carved our names in a tree in a park. We've all stolen a pack of gum or something from a store. We've all done petty crimes when we were young. The difference in the digital world is that everything is so brittle and poorly built and the mischief that is expected from youth ends up costing companies [B|M]illions of dollars. In the classic movie, "War Games," a kid practically starts world war III, the analogy fits if you excuse the hyperbole.

    From a societal point of view, we need to separate the smarts kids being mischievous from the criminals committing real harm, just like we do in the real world.

    • Re:Computer Security what is a crime and what isn' (Score:2, Insightful)

      by Anonymous Coward

      Mischief is the motivation of youth. Vandalism is a form of expression. We've all participated in it in some form, so everyone get off their high horse

      Ahem.
      Perhaps it is your horse that you should be dismounting from. Don't presume to speak on behalf of everyone else with regard to participation in unruly behaviors. Dipshit.

      We've all stolen a pack of gum or something from a store.

      ORLY??
      Somebody owes me a free pack of gum, then. Apparently I missed "sticky finger day" when I was a kid.

      we need to separate the smarts kids being mischievous from the criminals committing real harm

      Your arrogance astounds me. You actually think that "mischievous" behavior and socially irresponsible law breaking is somehow correlated to "being smart". Wow.

    • Re:Computer Security what is a crime and what isn' (Score:5, Interesting)

      by Jason Levine ( 196982 ) on Thursday March 27, 2008 @08:31AM (#22880872) Homepage
      I guess I'm just a "goody two shoes." When I was growing up, I never stole a pack of gum (or anything else) from a store. I never carved my name in a tree or participated in vandalizing something at all (much less as a "form of expression"). My motivations in my youth had nothing to do with mischief. I did experiment with computers, but they were my own computers or they were the school's and I was acting within the limits of my classroom activities. For example, when asked to program a slot machine program on an old Apple IIe, I finished *way* before everyone else. So I started adding in more features. I added in betting, and still people weren't done. So then I added in a mobster that you could borrow money from if you were broke. (I coded it so that you either paid him back in a certain number of turns or he broke an arm and a leg of yours, took all of your money, and the game ended.) I was exploring the limits of what my coding could do, but it was without causing harm/damage to someone else's property.

      • Re: (Score:2)

        by QuantumG ( 50515 ) *
        Let me guess, you were well-to-do right?

        See, kids who grow up poor get to see the injustice of the world first hand and, unlike adults, they feel the need to do something about it. Problem is, they're kids, so they can't.

        • I wasn't poor growing up, but I wasn't "well-to-do" either. My family was comfortably middle class. My father worked hard to earn a living just like I do today.

    • We've all carved our names in a tree in a park. We've all stolen a pack of gum or something from a store. We've all done petty crimes when we were young.
      Speak for yourself.
      • You've never broken the law? You've never exceeded the legally posted speed limit? You've never spit on the street? Tell me where you live and I bet I can find a few local ordinances you've broken.

        Don't lose the point by being pedantic.

    • Vandalism is a form of expression.
      I tried to tell the judge that rape is a form of art, and that convicting me would be like convicting Michelangelo for painting the ceiling of the Sistine Chapel, but for some reason she didn't agree. Bitch!
      • This is exactly what I'm talking about. Equating serious crime with mischief. Vandalism is by no means the violent act that rape is.

        • Re: (Score:1)

          by frehe ( 6916 )

          This is exactly what I'm talking about. Equating serious crime with mischief. Vandalism is by no means the violent act that rape is.

          My previous post was obviously not serious, but this is. I consider vandalism to be a "serious crime", in the meaning that yes, it is a crime in most (all?) places to destroy other people's property, and yes, any crime that effects other people in a non-trivial negative way is serious IMHO. How would you like it if someone spray painted your car or house, ripped up all the plants in your garden, or broke into your computer and did god-knows-what to it? And for clarification, no, this doesn't mean that I eq

          • Re:Computer Security what is a crime and what isn' (Score:4)

            by mlwmohawk ( 801821 ) on Thursday March 27, 2008 @11:44AM (#22883184)
            Again, you are being "absolutist" about this, and that is the problem. Your descriptions do not describe mere mischief, but harassment and intimidation. They *may be* acts described as vandalism, but they are more serious than what I'm talking about.

            Putting a sticker on a street sign. Carving your name in a tree. Small mischievous things are far different than wholesale destruction.

            This "zero tolerance" absolutist world we live in doesn't allow children to make mistakes or recover from bad judgment. One mistake and they want to bring the full force of law down on you.

            Some transgressions should not be considered crime even though they share some similarity, and in some cases repercussions, as real crime. Kids have bad judgment, it is a fact and it is a flaw in human beings. We should seriously consider this during prosecution.
            • Thank you for making sense, even if you don't get modded up for it. It's sad to see so many self-selected "smart" people that just accept rules and laws simply because they exist, rather than because they are there for a just reason, and don't understand that because there's an infinite range of human behavior, there should also be an infinite range of reactions to it.

            • Re: (Score:1)

              by frehe ( 6916 )

              Your descriptions do not describe mere mischief, but harassment and intimidation.

              So where/how do draw the line between on one hand "mere mischief", and on the other hand "harassment and intimidation"?

              Putting a sticker on a street sign. Carving your name in a tree. Small mischievous things are far different than wholesale destruction.

              Things like that make your neighborhood look like crap if enough people do it. There's a good Swedish saying than exemplifies this: "Många bäckar små bildar stor å." (Literal translation: "Many small brooks create a big river." Closest English saying I know of: "Many a little makes a mickle."/"Many a mickle makes a muckle.") I'm annoyed each time I get into the elevato

              • Preface:
                At this point in time I have a 16 year old son and a 2 year old daughter.

                So where/how do draw the line between on one hand "mere mischief", and on the other hand "harassment and intimidation"?

                That is the hard part, isn't it? The fact that it is not easy should not mean that we should abandon it.

                I'm annoyed each time I get into the elevator in my house and see the increasing amount of stickers and scribble on the walls.

                I agree will Bill Maher, if you are not annoyed every day, you are not living in
  • It may seem strange, but if you're a security professional and relish a severe challenge (or just want the money), then the Redmond campus may be just the place you want to be! However, after a while I can only imagine that the experience must feel more like beating your head against a wall.

  • "One reason for this, Arsenault says, is that vendors like Microsoft, Apple and Red Hat have done a good job in recent years securing the IP stack and operating system."

    So either Microsoft's chief security advisor really thinks Red Hat is responsible for Linux security, and also thinks that security can be layered on in recent years rather than being a fundamental part of the core design starting from day one, or more likely his title should be "Marketing Advisor/Security Spin Specialist"

  • your own fault (Score:3, Interesting)

    by nguy ( 1207026 ) on Thursday March 27, 2008 @08:21AM (#22880744)
    Among the most frustrating findings for Arsenault: Just over half of all attacks originated from the .edu domain. "[That's] a fundamental problem," he said. "We've got to do a better job with the university systems to stop that."

    There's a simple solution: stop maintaining the fiction that one company and one operating system can do it all. If you want to be a vendor of high-uptime, high-reliability systems, concentrate on that market segment and stop marketing your systems to the mass market. On the other hand, if you want to be a vendor of flaky commodity operating systems, stop worrying about your systems not being secure and stop marketing them as such (oh, and run your own corporate operations on something that actually is secure).

  • opportunity knocks? (Score:4, Interesting)

    by sgt scrub ( 869860 ) <saintium@nOSPaM.yahoo.com> on Thursday March 27, 2008 @08:21AM (#22880748)
    With Vista and other new products, Microsoft ships the hardening guide along with the product

    Dell, Toshiba, HP, et el do not send that documentation along with a new machine when Vista is pre-installed. Could they be held accountable for people getting pwnd? Could this be an opening to get the M$ tax back when someone is forced to buy a machine with Vista on it?

  • It's been about three now since the last Windows system at home was converted to Linux. And we sleep just fine, thank you.

  • Could it be? (Score:1, Flamebait)

    by BCW2 ( 168187 )
    The fact that he has to use M$ products?

    • Re: (Score:2)

      by BCW2 ( 168187 )
      Tell the truth or a reasonable possibility and get modded flamebait. The standards around here are falling faster than SCO's stock did.

  • What spooks me (Score:2, Insightful)

    by MrVictor ( 872700 )
    This security guy cited userland applications as the next battleground in windows. This, to me, sounds like he is trying to drum up support for completely locking down user space and only allowing signed apps to run in future versions of windows. Vista already forbids non-signed kernel mode drivers from running and has the ability to differentiate between signed/unsigned user apps. Previously, in XP, signed kernel mode drivers were an option and it was _not_ forced upon you. Application development on windo

    • Re: (Score:3, Insightful)

      by mlts ( 1038732 ) *
      Actually, those times are upon us, and its not a bad thing. Any professional software developer will sign their install code, .MSI files, .CAB files, and executables before it ships. Its not uncommon for a company to have a domain policy of refusing to execute any executables on a production network that are not Authenticode signed.

      Why is this not a bad thing? Simple due diligence/CYA. If I install a signed executable from a company and it causes a malware breach, then the damage done can be explained a
      • I agree with you. It isn't a bad thing when the end user or a company has the option of turning on/off code signing. When it is forced upon everyone by Microsoft it is certainly a bad thing.

Slashdot Top Deals

You are always doing something marginal when the boss drops by your desk.

Close