TCP/MS, We'll Cure What Ails You 478
Cringely can string some words together from time to time, and this week's installment is a pretty good one. He's been reading a little too much Gibson (raw sockets have nothing to do with the spread of MSTD [?] 's), but overall, he's probably right. When the time is ripe, I think we'll see a move exactly like this.
Dunno. (Score:2)
I kinda found that funny, given MS's history.
Besides, I severly doubt that the DOJ will look favorably upon this move, or even if ms will have the fortitude and the gonads to even propose such a thing.
Yes, it would be cool, but I honestly think the folks in redmond don't have the ability to carry out something like this, on such a large scale and have it work properly from day one.
I'm actually not sure who could design the protocol - perhaps a think tank of the best programmers around the world hired by several governments for actually good money?
And yes, I read the last paragraph, and I still think XP's only redeeming feature is allowing us to write our own IP headers.
Old Days (Score:2, Insightful)
Oh god, not another. (Score:5, Insightful)
Even if they weren't, there are SO MANY possible security exploits you can run using a small army of 0wn3d windows boxes. Including (but not limited to) just packeting the crap out of Steve "Bloody" Gibson's webserver. For instance, has anyone considered using something to script the IE network libraries (COM objects, I would imagine) in the background and launch a 'many millions of perfectly valid requests, complete with cookies and everything' attack?
How would you defend against that?
This whole raw socket thing has been blown out of all proportion. Can we please stop fretting and find a way of PREVENTING these big attacks from being spread. Or possible. Or something.
Dave >:(
Re:Oh god, not another. (Score:3, Insightful)
Even if they weren't, there are SO MANY possible security exploits you can run using a small army of 0wn3d windows boxes. Including (but not limited to) just packeting the crap out of Steve "Bloody" Gibson's webserver.
The point is not that raw sockets provides new exploit opportunities. The point is that raw sockets are required to spoof ip headers. With raw sockets Gibson would have not have been able to put in place the filters that he did because the attackers would constantly vary the source IP addresses using packet spoofing.
Yes, winpcap exists. But Gibson's point is that without raw sockets in the core OS, it is hard to spoof packets. An attacker currently has to install a whole new network driver if they want to install a packet-spoofing exploit on a Win 9x/ME machine. Compared to the ease of writing simple trojans in VBS, this is very complex, and not something that we're seeing happening much (if at all) at the moment.
Anyway, the existance of winpcap hardly reduces the power of Cringely's conspiracy theory that MS is intentionally making TCP into a broken protocol. You see, winpcap was developed with the assistance of the kind folks at MS Research...
For instance, has anyone considered using something to script the IE network libraries (COM objects, I would imagine) in the background and launch a 'many millions of perfectly valid requests, complete with cookies and everything' attack.
Sorry? I fail to see how using the InternetExplorer COM object introduces the opportunity for new exploits... It's hardly rocket-science to generate a well-formed HTTP request ('including cookies'--"wow I managed to include the text 'Set cookie:' in my HTTP header without even using MS's COM interface!")
Re:Oh god, not another. (Score:2)
However I monitor snmp logs on my Cisco DSL modem and it's been hit about 50 times today.
In both cases my web server is IIS, but it was never vulnerable to this worm even it was identified or MS released a patch, because I had properly installed the server.
The Solution Is Clear (well, maybe) (Score:5, Interesting)
1) educates -- infects your computer and gives you
a multimedia presentation on flaws within "Hi! I'm Victor Virus!
I'm an Outlook Virus. How did I get in your machine?"
2) secures -- "Would you like me to install a Zone Management
package?"
3) explains alternatives -- "Did you know there are other alternatives
to Microsoft?"
4) Highlights Microsoft abuses...
Re:The Solution Is Clear (well, maybe) (Score:3, Interesting)
I also wrote Script Sentry [jasons-toolbox.com] which traps those VBS scripts (as well as DOC, XLS, SHS, SHB, REG, HTA, and more), shows you details as to what it would do if run, and lets you decide whether or not you really want to run it. So if a user opens up that new Love Letter they just got in the mail and sees a "This will change your registry" message, hopefully they will be scared/wise enough to cancel the action.
Raw Sockets == IP packet spoofing (Score:4, Redundant)
Raw Sockets allow someone to send forged IP packets (spoofing) that appear to come from any IP address the sender chooses.
This makes filtering a DoS attack harder, because you can no longer filter the traffic by IP or domain.
So, right now the limited defense in the DDoS zombie attacks from Windoze is the fact that the IP packets have valid source addresses. These can be filtered at backbone or ISP provider routers.
If these attacks used spoofed IP packets, there would be no easy defense.
Re:Raw Sockets == IP packet spoofing (Score:3, Informative)
Re:Raw Sockets == IP packet spoofing (Score:3, Funny)
What's your point ?
Re:Raw Sockets == IP packet spoofing (Score:2, Insightful)
There is a very good reason to do the bulk of your computing as a nonprivileged user, and this is it. Unfortunately, being a nonprivileged user is not an option in WinXP...
Re:Raw Sockets == IP packet spoofing-- So? (Score:3, Informative)
???!
So says gibson. Why does that make things easier? Have you ever set up a screening router? You can filter out whatever you want...
Re:Raw Sockets == IP packet spoofing-- So? (Score:2)
If you are running web services on a limited bandwidth connection (T1/etc) a filter at your ISP (i.e. before your gateway router and you) prevents all the bogus traffic from reaching your machine and wasting bandwidth (and CPU).
Not necessarily (Score:5, Funny)
If these attacks used spoofed IP packets, there would be no easy defense.
Except for if every damn net admin would WAKE UP and SMELL THE COFFEE and IMPLEMENT EGRESS FILTERING or SOURCE ROUTE VERIFICATION or whatever your router calls it.
If you have a router built within the last 5 years, I can pretty much guarantee you it supports it. So turn it on already!
If every border router on the internet used it, we could stamp out IP address spoofing overnight. No magic about it. All the border router has to do is check that the source address of the packet is within the range of addresses that it 'owns'. If it isn't, drop it, and log the MAC address so that it can be traced.
Easy huh? Any router worth its salt can do it, so...
Please!?!? What does it take to convince you?
Re:Not necessarily (Score:2)
What about the 'only root can use ports 1024' feature of Unixes, which Windows doesn't implement? Does that mean that Windows is a security threat? No. If you're being so stupid as to trust the originating port number, you deserve everything you get.
Egress and, er, ingress filtering around the edge of your network may be good enough most of the time; it doesn't protect you against PCs inside the network starting to spoof things, but you may feel you can trust your own employees (and don't let them run Outlook).
Re:Raw Sockets == IP packet spoofing (Score:2, Insightful)
It used to be the case where you could manage to create 'blind' TCP sessions by predicting the ACK number produced by the remote host. This was pretty commonly used on IRC where someone would have a legit, non-spoofed connection and sit in a channel and have a blind, spoofed TCP session along side it. He could then see the channel activity, and even interact with others through the spoofed connection, usually long enough at least to gain ops and take the channel.
These days (almost?) every new TCP/IP stack will generate acceptably random ACK numbers to prevent these ACK prediction spoofs. But for the purposes of a DoS, it doesn't matter if you never get the return packet. In fact, in the case of ICMP, it works to your advantage. If I flood 1400 byte ICMP echo requests using spoofed IPs (random or otherwise), not only will I hit your downstream bandwidth but because of the replies you (by default) generate I'll also be hurting your upstream bandwidth and your replies won't flood me back.
As most others have pointed out, the only real solution is egress filtering. Unfortunately if a box is compromised that is sufficiently close to a backbone, this solution (FWICS) won't work.
Jason.
Re:Raw Sockets == IP packet spoofing (Score:3, Informative)
It blocks many different attachments based on their extension. It also notifies the user when they try to send such an attachment that it might be a bad idea.
It's described in MSKB article Q290497.
Stealth viruses (Score:2, Interesting)
Once a virus is detected, software can be written to clean it and possibly prevent its further transmission. These days, the delay between first detection and anti-virus software is usually a few days.
The more time a virus spends lying dormant or slowly spreading, the more time there is for someone to find it and spread the word. There are a small number of highly secure systems run by highly paranoid sysadmins who do things like compare all files to known good copies on a regular basis and log all network traffic. Even a quiet virus will be detected if it attempts to spread to one of these systems. If the virus attempts to infect something like a Honeypot, it will be detected. And then, the game is up.
These virii are only effective against the uninformed. The slower it moves, the more time it gives information to spread.
Redressing the balance in the press (Score:2, Interesting)
Host-based problems have host-based solutions (Score:2)
In particular, to make program not do something that it shouldn't one doesn't need to rely on the protocol that is security-neutral anyway (the other end can be malicious even if you aren't) but should place restrictions on the processes on the host.
Capabilities system, that now can be used to manipulate processes' abilitites to use raw sockets without making them run as root at the same time, is one of the examples how it's done in the kernel. While I am sure, neither RXC, nor Microsoft engineers looked a it, Linux already implements it and even had a sendmail security bug related to improper implementation of that.
The critical missed point (Score:4, Insightful)
They're missing the first law of complex systems. I can't remember the exact quote, but it goes something like:
All complex systems that work began as simple systems that worked.
You can't replace today's Internet, the result of decades of evolution, with something purpose-built from scratch to do as much. The attempt will suffer from the second-system effect [tuxedo.org], and just plain won't work.
It's easy for a columnist to ask for something drastic. Too easy. But it sells papers (or click-thrus, or whatever we're selling today).
Half-truths and misdirections (Score:3, Insightful)
I don't know about you guys (and gals), but last time I was at this tiny web site for a tiny computer manufacturer [dell.com], I had the choice of Win98 SE, WinME, Win2K or Win2K with an upgrade to WinXP. That doesn't sound like manufacturers are limiting my choice of viable Microsoft operating systems to me.
People wouldn't be forced to participate, but if they remain anonymous, I might choose to block them. I certainly wouldn't accept file attachments from them. I know you hate this idea, but I think the Internet needs a fingerprint.
Hmm... And who would control this "fingerprint"? Our beloved government, who is trustworthy? A large computer corporation like, say, Microsoft? And how would something like this work internationally? Who is forcing you to accept attachments now? I run Win98, WinME, Win2K and WinXP all on different machines. Over the last week, I've been sent about 10 emails with both SirCam and Badtrans, and none of my machines are infected. Why? First off, I didn't open the attachments right away. Second, I tested the attachments by saving them and then scanning them first. This is not a difficult concept! If someone puts a big package in your mailbox at home, and it's ticking, do you just open it up if the return address says it's from someone you trust?
You can choose not to have a fingerprint, but then your ability to communicate with others may be limited -- a price many people may choose to pay.
This is endorsed by the same crowd that bitches about MS Passports [slashdot.org]?
If kids want to install an Internet game, the game's IP port would be registered and permitted to operate, hopefully by the parent.
Why can I not see this happening in the general population? The average users I know bitch about having to confirm Internet activity when Zone Alarm or other personal firewalls pop up and ask.
Programmers who ought to be familiar with Microsoft's plans have suggested that the real motive for raw socket support is for Microsoft to use Windows XP to exploit a bad situation, to deliberately make things worse.
Jesus, what a conspiracy theory. This guy gets paid for this?
Move along, Cringley. Common sense tells us that you're just spreading FUD. Meanwhile, I'll get modded down for criticizing you, I'm sure.
--SC
How DID they do that? (Score:5, Interesting)
It wasn't actually Microsoft. (Score:2, Interesting)
Back to my point, the majority of reports are not going to point out that these email virii only work through MS Outlook - because the news perceives that web-based mail and Outlook make up the totality of their target audience's concept of 'email'. And why should they take the time to be accurate? They might piss off Microsoft, they might alienate some viewers from their "friendly" news service, and it's close enough anyway.
Re:How DID they do that? (Score:4, Insightful)
First (as others say) is that the slobs in the media don't know of the existence of Mutt, Pine, Eudora, etc. They know Outlook, Notes, and AOL client.
Second, they don't know the subject that they talk about. Here in Washington, there used to be some smart TV reporters. But they weren't photogenic enough, so they were fired, or offered bad jobs/pay cuts. So now, WUSA has a bunch of young, attractive morons on the payroll. What does this have to do about anything? Like many media outlets, they have no experience with anything. It's not just computers. It's local politics, health science, world events... Most (not the modifier) reporters are just dumb. Reminds me of a college roommate. Okay guy, but not the sharpest tack in the drawer.
But, at least some of them interview people with half a clue. Which brings me to point three: the people they ask are either M$ users, MCSE's, or in some way involved heavily with Microsoft. To them, Outlook IS email. So they describe it that way.
The next reason I see is simple: MSNBC. Yeah, yeah, yeah, separate editorial staff, independent reporters, yadda, yadda, yadda.
Now, take all of these (which individually might be minor) but remember how much news comes over an AP wire (or Bloomberg, or whomever). Listen to your local news. Much of it is a rehash of some simple wire-service article. Reporting with an emphasis on the 're'. And these folks don't know tech.
I doubt that any of these alone could cause the problems. But taken as a whole, we have this situation. Basically, the blind leading the blind.
Re:How DID they do that? (Score:5, Insightful)
The only way I can explain it is that most people use Microsoft software, and what we use must be the best, right? I mean, how often does someone buy a new car and then complain about all the problems that it undoubtedly has? Hardly ever. It must be the same with computers; the Windows users have an emotional investment in the product and they want everything to be just fine, so they apologize for shoddy software; "Oh Windows crashed, I bet the next version is better, this one is getting quite old", "Oh I got a virus, I wish those evil hackers would be put to death". See my point? They never think to blame Microsoft because they are Microsoft to a certain extent; they belong to a huge fanclub of a massive group of people. That's gotta feel good.
And it makes it tough for us non-Microsoft users to get along with. Like the abused wife that toddles on back to her jerk of a husband, so the users return to Outlook, because "this time it will be better" and "I don't know how I could possibly function if my calendar and e-mail client were two separate programs."
Re:How DID they do that? (Score:5, Insightful)
Well, I was chatting with an ex-microsoft employee who had moved over to the white-side and he put things in perspective. Microsoft has strategic meetings where they sit around a table and say "how can we own this?"
That put a different light on all those subtle incompatibilities I had always had to deal with.
Backslash instead of slash in paths... / for options instead of - (remember switchchar?
Re:How DID they do that? (Score:2)
Microsoft has strategic meetings where they sit around a table and say "how can we own this?"
So does any and every company that is run by good strategists (i.e. any business that wants to stay in business for the long haul). That's the basic business process: Find a niche, find a way to enter it and then find a way to dominate it. That's just being competitive in the marketplace.
Where it becomes a problem (and illegal, in many countries) is when a company (ab)uses its monopoly in one niche to dominate another niche, rather than trying to gain dominance through making a better product, doing a better job of marketing, setting a lower price, etc.
Re:How DID they do that? (Score:2)
Speaking as someone who used CP/M back in the day (okay, dammit, it was 20 years ago), CP/M (at the time the IBM-PC came out) didn't have subdirectories, didn't use / for options, and used Control-D for an EOF marker. I'm not 100% sure about text file end of line control codes (this is a *long* time ago), but I don't think I had to do anything fancy between Apple ][ and C64 formats and CP/M, and certainly nothing fancy for big boxen formats (of course, at the time, transfer protocols like Kermit and Modem7 handled such things).
Now, this is the dim memory of someone posting at 2:30am (and too damn lazy to do a google search), but I accessed plenty of Unix boxes (and VMS) at the time, and didn't have file format problems, so I'm guessing that it was the same.
Anybody else remember Magic Window for the Apple ][? Or the original WordStar. Wow. I'm seeing amber all caps when I close my eyes...
--
Evan
Re:How DID they do that? (Score:2)
CP/M didn't have paths (neither did MS-DOS 1.X), just the USER command. Slashes were used for options, some of the command syntax was patterned after some old DEC operating systems, such as RT-11 V2 and RSX-11 (MCR era). Remember PIP?
CTRL-Z was the EOF marker and CR/LF was the line terminator. Files lengths were a multiple of the sector size.
Re:How DID they do that? (Score:2)
Re:How DID they do that? (Score:3, Informative)
That's right - I remember a common problem of that era were nulls and/or random binary junk padding out the end of files to an "even" size.
--
Evan
Re:How DID they do that? (Score:2)
Almost right. CP/M ran on the Z-80 and 8086 (The version was called CP/M-86). MS-DOS was meant to run on the IBM PC which were 8088 machines. The 8088 was a scaled down version of the 8086.
Re:How DID they do that? (Score:2)
Re:How DID they do that? (Score:2, Funny)
I'm happy now.
Re:How DID they do that? (Score:4, Insightful)
Scenerio one:
-- Arthritis is, by nature, a waxing and waning problem for people who experience it. This means that half the time it hurts and half the time it doesn't on average. The medications for it aren't always that good, and barely affect the 50/50 chance of improvment.
-- Let's say a filthy-rich golfer buys a copper bracelet for 100 dollars to cure his arthritis, and he experiences a decrease in pain! Note that this decrease in pain is likely to be a naturally-occuring decrease. Nonetheless, he attributes this decrease in pain to the copper bracelet.
-- Now, another filthy-rich golfer also bought a copper braqcelet for 100 dollars to cure her arthritis, and she experiences an increase in pain. In other words, the bracelet appears to have done nothing for her arthritis. She paid 100 dollars for it, so she doesn't really feel like admitting her foolishness for buying the bracelet, of course!
-- In summary, about 50% of the people who buy copper bracelets go on to recommend them to friends, and 50% of them are too embarassed to say anything bad about them.
Now, go next door, and talk to your neighbor about their computer's operating system and computer that they just put down a few month's salary on. Are they going to say anything bad about the super-duper Wintel machine they just drained their wallets for? I doubt it. Also, what are they going to compare it to?
People feel a lot better having to pay for a product and seeing a smooth interface and knowing that their company endorses it. This seems to be a fact of capitalism. I really hope this fact becomes fiction...
Footnote: The copper-bracelet example is from some medical/doctor journal/magazine article. Sorry, but I can't remember the issue number or title. Anybody know the article I'm thinking of? I hate using nifty ideas and not giving due credit
Capitalism? (Score:2, Insightful)
But it would appear to be a fact
New OSS flamewar....yeah! (Score:2, Insightful)
1)Um, are you under the misapprehension that Linux et al are secure OSs on the basis that there haven't been any viruses targeted at it to speak of?
I believe linux...and pretty much any Unix i've dealt with (Solaris,OSF, Ultrix...) are much more secure OS's, becuase it's much harder to write an exploit for a unix box than for a windows box. Writing a buffer flow exploit to compromise a server process is order of magnitudes more work than sitting down and writing and emailing a Word document that takes advantage of the VBscripting to erase you harddrive.
There are "talented" crackers out there that do target unix machines. You can do a lot of real damage if you can compromise a large corporate Unix system....but you have to expend real effort to discover a new exploit on a unix system. With windows on the other hand....the same "feature" is being exploiting repeatedly to cause damage....how many differently named viruses have to circulate before MS removes this exploitable "feature."
Point out a "feature" of linux, or unix that gets repeated used for malicious activity...but people refuse to fix. Bind and sendmail, mainstays of unixland have had a history of exploits but the software makers make it a point to fix the problems asap. Software will be buggy, and bugs can turn into exploits, and then they get fixed. But a FEATURE like VBscripting is not a bug. VBscripting is a very powerful and woefully insecure FEATURE, but MS refuses to strip out the VBscripting features or add a layer of security to their use. MS viruses...don't use bugs in the code...they use perfectly acceptable scripting commands...to do bad things, and MS refuses to do anything about this FEATURE!
2) On the general subject of quality, Linux still hasn't got anything to compare with the Office suite.
No i think there are some candidates for comparision. Take Staroffice...is as slow as MSOffice, and for me staroffice does crash on occasion just like MSOffice...the big difference I've seen is that staroffice doesn't take down the entire OS with a BSOD when it desides to stop working.
You need to upgrade your gnome. I'm living in Ximian gnome on my PC and I haven't had the GNOME Desktop crash yet. But I'll be damned to figure out why my windows PC won't get past the logon box without causing a GPF.
3) I used to buy into this idea that OSS necessarily produced better quality software, but it just isn't true. Large products are flawed for many reasons: release deadlines, unforseen design errors, resource constraints, but mostly because people in general just aren't smart enough
I still believe OSS development makes far better products, but my reasons have nothing to do with being able to make product deadlines or whatever. I do not believe that OSS makes products more quickly. I don't care about release deadlines...the OSS products will get done when they get done....as long as products are making steady progress, that's what matters. How long did it take MS to make a stable OS worth actually paying for? From MS-DOS upto win200...how many manyears or should i say mancenturies of development time went into that development cycle. If want to believe in the pay for every yearly broken release, and call it a full product fine...I'm sick of it. Just don't bring your timeline baggade to the OSS community. Products get done when they get done. I believe that OSS development makes better products, for the simple fact that the source code is available. I believe OSS makes better products becuase in the long run those OSS products are far more adaptible and allow for more innovation. -jef
Re:How DID they do that? (Score:2)
Why, pray tell, would a virus writer interested in mass vandalism bother with Linux when it has only a tiny share of the market?
By that logic, why didn't the writer of Code Red write a worm to attack Apache instead of IIS? Apache does have a larger share of the web server market. Could it be because an Apache worm is harder?
Re:How DID they do that? (Score:5, Insightful)
Ok you had me untill this part mate, and that's going way too far. Sorry to tell you, but the hassle of deleting and not opening annakournikova_jpg.vbs doesn't quite compare to some woman getting beaten by her husband. Not to mention the fact that it's nobody's fault that you get a virus except the prick who wrote the virus. Not microsoft's, and not even your less pooter-savvy mate who thought he was gonna see anna's tits. If enough people used a standard linux desktop for it to be worthwhile, more people would write virii for linux. As linux's popularity grows, so will virii begin to appear, or I'll eat my hat.
He didn't compare the severity of Microsoft viruses to the severity of wife-beating; he compared the emotional dependence of the victims of both upon the perpetrator of both. In other words, he is trying to answer the question "what keeps them coming back for more?"
Windows XP Home Edition runs everything as root. How can you apologize for that? They have said that user accounts and permissions are too complex for the consumer, yet both Mac OS 9 and Mac OS X have user accounts and permissions. Mac OS 9's are of the training-wheels variety, but Mac OS X is full-bore, hardcore Unix. iMac users are getting by, so surely Windows users can adjust? The reality is that bad network security is good for Microsoft, because they never get blamed, only "Internet hackers" get blamed, and they want us all to use MSN anyway, not the Internet.
As for your argument that popularity is the only reason Microsoft operating systems are virus-riddled, that is bunk. There are 25 million or more Macs out there, and there are lots of people who would love to stick it to Apple because they think Apple is on some kind of high horse. Why are there only a handful of Mac viruses? The system is completely scriptable, so there are tools there. But the worst Mac viruses all run in Microsoft software on the Mac. If you don't have Microsoft software, then you are susceptible to less than half of the viruses that run on the Mac.
Blaming virus writers is easy, but think of it this way: the guy who wrote "Melissa" simply sat down at his computer, wrote a document in Microsoft Word, and emailed it as an attachment to another user. He didn't cut through a chain-link fence, he didn't pick a lock, he didn't hack somebody's password; he just wrote a Microsoft Word document. One of the features of Microsoft Word documents is that they can include tables; another is that they can include scripts that send emails. Who is to say that using one feature is not a crime and using the other one is? Ignorant politicians and cops who believe Microsoft and their apologists. There were no Windows programs until Microsoft created the Windows API that provides the environment for them, and there were no Outlook viruses until Microsoft created an environment that demands them. If there is no security in that environment, then you can't expect things to be secure. If you leave your flashy sports car running and unattended with the doors unlocked, you have to share some of the blame when someone takes it for a joyride. Microsoft is practically begging people to write these viruses, which is the point of the article. They can't be this stupid ... they are doing it on purpose to give Unix itself a bad name. To make the world so scary that their users will cling to Microsoft's skirt like frightened children.
Re:How DID they do that? (Score:3, Informative)
Here's my guess: too much Windows software out there assumes you have "Administrator" privileges.
I recently installed Windows 2000 and, not being a complete idiot, I set up accounts for myself and my wife. I did not give myself Administrator privileges; instead, to make system changes, I log in as Admin and make changes. You know, just like on Real OS's.
Imagine my complete lack of suprise when all the apps that don't work properly. They all assume you have unfettered write access to any directory in the world. I've had to go down manually, guess which files each app wants to write, and then change the permission on those directories so that it can happen.
To MS's credit, Office did work properly. It's just that most Windows apps are not multi-user aware! Windows vendors, test your damn apps on NT without admin permissions!
Re:How DID they do that? (Score:4, Interesting)
It's simple. 95% of the computer-using public doesn't know that there is anything besides Microsoft out there. I have had people tell me crazy things like "of course Macs run Windows."
So, naturally they'll call this an "email virus" or "computer virus" instead of "a shoddy security flaw particular to one operating system." The level of analysis in the latter description is far, far over the head of most computer users. And MS doesn't have any competition to make security a big deal in their OS advertisements.
(I love Apple, but we Apple users just don't count. There are not enough of us. Like it or not, we are the lunatic fringe. Long live the fringe though!)
To most folks, Microsoft is a benevolent, Barney- like giant without which there wouldn't be computers at all. "How can you blame such a wonderful company for what some misceant hackers do? It certainly isn't Microsoft's fault that computers have these fundamental flaws, or that there are people that exploit them. Ooh! Someone emailed me a magic elf animation!"
Like ex-Pres Clinton, Microsoft has a teflon coating. Fascinating, and disturbing.
Re:How DID they do that? (Score:3, Insightful)
- Viruses must be targetted at the most prevalent software - a virus written for mutt isn't going to spread anywhere as it will be mailed to 9 Outlooks, 2 NS messengers, and a pine.
- Security priviledges don't make you any more secure for these. So the attachment you ran isn't running root, so what - it still has access to your address list file, it can still send email, and it can still delete the files you actually care about (as opposed to the ones that come with the distro).
- Unix poeple are normally computer savvy so are a less likely target for social manipulation, but if the answer was to switch to linux then all the people who have to work with computers but don't care for them or know much about them (non IT businesses) would be using linux. If these people got an email from a coworker asking them to run the attachment, they would.
- Social manipulation asside. There have been the odd viruses taking advantage of MS security flaws - ones where you don't even have to open the attachment to get infected, granted. Any software written in C running on windows or linux is vulernable to things like this - NS Messenger for instance (runs on many platforms) had a buffer overrun bug meaning you could run arbitrary code on someones machine just by sending them a message. pine and mutt etc might have many but since they aren't popular it doesn't matter.
Sure, Microsoft haven't doen nearly as much to prevent this stuff as they should have, but I think that if every man and his dog was running your 'safe' email client on your 'safe' OS, you would find it wasn't very safe at all.Rather than everyone switch from outlook, the solution is probably for everyone to be a little less inbred with which email clients they use.
Re:How DID they do that? (Score:3, Insightful)
Um...the I Love You worm, the most destructive (in estimated $ costs) computer infection in history, was a
That's first of all. And second of all, Outlook's idea of attachment security is to pop up the same "this is an attachment are you sure you want to open it?" dialog box for every attachment, whether
A simple list of things MS could do to improve email attachment security:
1) Run any executable attachments opened directly from Outlook in a sandbox; require user confirmation for any changes to existing files, for creating any new files, or for sending out any email.
2) Turn macro protection in Word on by default, and run Word macros in a similar sandbox.
3) Disable any scripting elements in HTML email; no java, javascript, ActiveX or VB script, just plain HTML.
4) Only pop up a warning when opening an attachment which might actually be dangerous, i.e.
That's 4 changes which would be neither too difficult to impliment nor too annoying or confusing to users. Yes, buggy permissions and buffer overflows happen in most all software, and requiring MS to audit code ala OpenBSD would be impossible. But they're certainly not doing anywhere near what they should to make viruses more difficult to spread.
An Appeal to Bill Gates. (Score:2)
As posted to microsoft.public.win2000.general:
Come on, Bill.
I know you've got this great vision for a wonderful Internet and a computer on every desktop and all that stuff. I've met you in person on two occasions, and found you to be friendly, personable, brilliantly intelligent, and I know you believe very strongly that your vision of the computer industry isn't flawed. I even grudginly like you for your passion, courage, vision, strength and business acumen. Most damningly towards wanting to hate you, I also believe you and Melinda are true philanthropists.
But I'll still bet money that I had an e-mail address before you did. And you and I both know that this has to stop. At this point, I tell my consulting customers that running IIS is as irresponsible as drinking and driving. My procmail filter automatically sends all e-mails from Outlook mail clients to /dev/null. Like drinking and driving affects all road users,
the many blatant security flaws in Windows and related programs affect all
Internet users.
Please make it stop.
Copied and pasted from my (Apache on UNIX) webserver [glowingplate.com] log:
(D'oh! Slashdot Lameness filter sees all the capital Ns of the Code Red worm buffer overflow and won't let me paste, so you'll have to see it here.) [glowingplate.com]
Automatic Ping of Death for Code Red Requests? (Score:2)
Hey guys, this is somewhat unrelated to the stuff in this conversation, but it's about M$ vulnerabilities, so I'll ask anyway.
If we all set up out webservers to send a ping of death or some other blue-screen/reboot DoS attack automatically to anything that shows the signature request of the IIS worm, wouldn't that help to at least slow the spread of this thing?
The shell script to tail the log file and run a script would be pretty easy, but does anyone have anything tried and true for Linux/UNIX that will force a reboot of an affected Win NT/2000 server?
At this point, I see this as an eye for an eye, I'm kinda tired of all don't patch their systems despite big media attention. Besides, it'll definitely give me a sense of satisfaction to confirm a kill when the server doesn't respond to an automated regular ping a few seconds later.
Re:How DID they do that? (Score:2, Funny)
*waits for the moderators to notice the word FreeBSD and start sucking away the karma*
Can WE Sue Microsoft? (Score:4, Insightful)
Quoted from Cringely:
If it were not for Microsoft's carefully worded user license agreement, which holds the company blameless for absolutely anything, they would probably have been awash in class action lawsuits by now.But can't sysadmins sue Microsloth for the gross negligence that consumes our bandwidth?
I know the license agreement that I made when I opened my Windows 2000 CD only affected my Windows 2000 desktop. It has *nothing* to do with the bandwidth - which I pay for - that this stupid [glowingplate.com] [expletive deleted - Ed.] worm [glowingplate.com] has consumed.
I'm not normally litigious, but Microsoft needs to clean up their act.
Anyone know a good class-action lawyer?
Time for action (Score:2)
So here's what we're gonna do. We're gonna split the Intranet right down the middle. That's right, the whole dang Intranet, from Wahoo to The Amazon's, right straight down the middle. And don't you be like some of my guys around here, telling me that it's "impractical" or "impossible", or that "I have no clue how the Intranet works", cause I don't really want to hear it. I've had enough, and it's time to take action.
So like I said, straight down the middle. One half goes to that Billy Gates guy up there in Seattle, the other goes to you Linucks guys. Now, I understand that there's not one guy in charge of Linucks, so I'd suggest you form a committee to handle it. If you need some help with that, well, drop me a line, and come on up for some help: if there's one thing I know about, it's committee's.
So anyway, one half to Billy, one half to Linucks. Both parties will be able to run the Intranet however they want, and we'll let the American People decide. The American People deserve the best, most great Intranet they deserve, and it's high time we let The American People decide the future of the Intranet. It's simple economics people, like you learned in college, the Law of Diminishing Returns! Adam Schiff himself would be proud!
Signed, George W. Bush
MS already changed tcp already... (Score:5, Insightful)
There was a time when Sun servers responded "slowly" to windows HTTP requests because microsoft changed the behavior of TCP slowstart, etc...
I'm sure there are other examples.
Re:MS already changed tcp already... (Score:3, Informative)
Btw, it wasn't just HTTP requests that were slow, it was any TCP connection establishment.
Re:MS already changed tcp already... (Score:3, Informative)
I'm not so sure about this. While experimenting with Squid's user agent logging facility to see who was running what browser on my network, I noticed that MS Internet Explorer actually claims to be "Mozilla 4.0" - go figure.
I can say for certain that Microsoft's support web site does not tolerate unknown browsers graciously at all - when confronted with Netscape 6.0 beta or a Squid anonymised user agent string, it got stuck on one page redirecting back to itself...
Re:MS already changed tcp already... (Score:2)
Is this guy nuts? (Score:5, Insightful)
Re:Is this guy nuts? (Score:3, Insightful)
Well, he was a hacker before he went into journalism. Worked for Apple in the garage days. Read about his DSL/802.11 link. He has some technical expertise and he knows who to talk to at MS, Apple, and other places. I think the MS plan he talks about (TCP/MS) is interesting (not neccessarily good, just interesting). He does have good sources.
Wrong Premise (Score:5, Insightful)
1. Raw sockets in windoze is not the end of the world. *nix systems have them, even vxworks. A number of ISP's filter forged packets. If this type of spoofing is such a harm, it is trivial for ISPs to implement this. Cripling stack interfaces in OS'es is rediculous.
2. Passport will not authenticate every connection made on the net. Sorry, this is a pipe dream M$ sold you on somehow. And second, priority net traffic based on M$ passport is even more impossible.
Re:Wrong Premise (Score:2)
Ahh, now that is a good point. On a Unix box you must hack into the root account before gaining access to the raw sockets. On Windows, there's no need to do anything of the sort. Heck, today it'd take you about 15 minutes to work up a hack in MS Word that can write any darn thing it likes into your system registry, no restrictions.
What is scary here is not access to raw sockets. The issue here is unrestricted, no protections, any
Heck, Microsoft has already commented on this very issue. They are already blaming those nasty virus authors for the coming up screw ups. (my apologies for not having a link, read this one a couple of months back.) Even they know it's going to be bad, but yet they are still moving forward with this.
Lastly, keep in mind that we're not talking about NT or 2000 here. Both of those OS's have the ability to run as either an admin or a regular user with limited abilities. We're talking about a version of 2000 that has had it's securities stripped so as to be compatible with ME (aka, Win 95 Version 5).
Re:Wrong Premise (Score:2)
Somehow I doubt it (Score:3, Insightful)
Furthermore, how is it exactly that TCP/MS would prevent things like Code Red from happening? An application is vulnerable to stack overflow exploits because of the application code itself, not because of the protocol through which it receives data. Registering the ports that an application listens on won't help if the app contains a vulnerability.
Cringely goes on to suggest that all connections be traceable - well, that's fine, except that it doesn't solve the problem of people launching viruses from public terminals, or obtaining free trial dialup accounts using fictitious information. Digitally signing specific applicaitons with an Active-X control style GUID, and only granting access to validly signed applications might help, but I can't see developers embracing that idea. Even if they did, it only takes one compromised certificate to release any number of malicious programs.
And did Gibson actually write Zone Alarm? Cringely seems to think so, but it's marketed by Zone Labs, not GRC.COM. Anyone know for sure?
Strags
Anonymous untraceable (Score:2)
This somewhat misses the point of traceable TCP. It doesn't matter whether we catch the bad guy, what matters is that we can stop the flow of traffic to our overloaded site. Untraceable traffic cannot be effectively firewalled against.
Re:Somehow I doubt it (Score:3, Interesting)
SO don't be so sure that something like this would save the world. The infrastructure you describe is daunting to say the least with smart cards, and keys, etc. Just ask anyone who has tried to implement an enterprise sized PKI - its a scary task and its not in Microsofts interest - they'll probably continue to use plain old userids and passwords.
WHich will make for funny TV the next time there is a worldwide virus that wrecks a lot of systems, the FBI will track the virus using Microsofts info and arrest some poor grandma who had her credentials lifted.
Must be some good stuff (Score:2, Funny)
Don't read, it's a rehash. (Score:2)
That, and we normal folk already knew them anyway.... well, for odd values of "normal", anyway.
Hi, I've lived under a rock for a while (Score:5, Interesting)
You can already do this. You can trace email. You can block email from those you don't know. And this system won't work to block email worms because usually they come from people who you know.
Get with it, man!
Dancin Santa
Re:Hi, I've lived under a rock for a while (Score:3, Informative)
You can already do this. You can trace email. You can block email from those you don't know. And this system won't work to block email worms because usually they come from people who you know.
Caller ID, like rdns mapping of incomming ip addresses (cumbersome) etc. You can do this sort of strategy on so many levels... Of course someone who says that Linux is safer than Windows on one hand and that raw sockets are dangerous evidently is simply paroting what he has read and not actually studied the matter. Has he heard of any sort of authentication service or tactic? That is what these are about and of course many people do block people without the proper credentials from access to their networks ;)
Raw sockets exist in Windows 2000, and I assume that it has a bit to do with the FreeBSD code in the TCP/IP stack... This code has helped to make Win 2k far more stable on a network than its predicessor, IMO. If they are such of a problem, why not acuse Linux or FreeBSD of the same problem...
He also states:
And what's with those file attachments, anyway? Replace mail clients and APIs with secure models. The new model will not run attachments as they do today. E-mail attachments should not have access to the e-mail client, APIs, etc. Attachments should not have access to the operating system by default. The user should approve the use of some APIs, like having to give permission before device drivers are updated.
This guy is out to lunch. It is simply sufficient to limit user privilages and require them to export the attatchments before they can be run.
The only e-mail activity on my PC should be initiated by me, personally. Nothing else should access my address book or send out messages without my express permission. Microsoft will of course reject the idea, mostly because it will fail the "increase market share litmus test." My answer is, "Microsoft, if you do not take responsibility for locking down your APIs, it will become obvious to the public and become a detriment to your market share."
Which Office XP does quite nicely. Of course SirCam bypasses these controls and sets up its own smtp server... YOu cannot get around it totally. I am no more a Microsoft fan than the next guy, but this buy is a bit over the top...
Oh give me a friggin' break! (Score:3, Informative)
--News Flash The internet is not going to be "shut down" by any stupid virus.
--Any half decent FW comes with its own proprietary TCP/IP stack... Yeah MS might think about changing over to something else.
--It is time for "technologists" to cut it out and stop trying to scare the Hell out of everyone with this MS is evil and the internet is falling shit.
--Bottom line if MS was as bad as WE all think it is it WOULD disappear. Truth is it isn't that horrible. For 90 minutes at a time it's a great gaming platform.
Wow, man... (Score:2)
After reading his rant, which admittedly does bring up a couple of interesting points (although the idea of M$ trying an Embrace and Extinguish on TCP/IP strikes me as one which, if attempted, would be laughable in its arrogance and stupidity), I think overall Cringely contradicts himself. First he talks like setting a GUID for everyone on the internet is a Good Idea, and then later on in the article, he attributes the same idea to the Evil Software branch of Microsoft. So, which is it?
On one point I totally agree, however. The current rash of email worms are entirely due to a business decision on the part of Microsoft, and they are culpable. The best, simplest, and most obvious way to fix a good part of this would indeed be to prevent email software promiscuous access to attachments embedded in email messages. No amount of restating the obvious, it seems, is able to either convince institutions to quit sending these (which are often, most unneccessarily and foolishly, in Word format), or to convince mom and pop users to not open them, or at least scan them for viruses before opening. And I'm sorry, but if you open a file sent from someone you've never heard of promising to display a naked celebrity, you get what's coming.
raw sockets: DOS using TCP port 80! (Score:3, Informative)
The deal is that w/out raw sockets, in order to send large ammounts of data, you have to send UDP packets with the data. When creating a datagram socket (i.e. for sending UDP packets), you don't have to get a succesful return from connect() prior to sending data. Thus you can just start sending huge packets.
But with stream socket (i.e. for sending TCP packets), you have to get a successful return from connect() before you can start sending data. Which means that before you can send any data to a server, you have to send a SYN packet, get a SYN-ACK packet back, and then send an ACK packet. Only then will connect() return with a success, and then you can start bombing away at the server with huge packets. But even then if you don't send them in a form that is recognizable by the application, the server will just issue a RST and close down the connection. For example, if your stream doesn't include HELO foobar, when you connect to an email server, the server will just disconnect.
Non-raw sockets make it easier to filter out attacks at the upstream provider because they are usually UDP packets which your web application does *not* need. So you just filter them and then you're done with it.
With raw sockets, it becomes *much* harder to filter upstream. WIth a raw socket, you can create a SYN packet from a random IP address to a web server on PORT 80. That SYN packet can be 9k long if you want it to be. And it will be to a port that you can't easily filter out . Basically, it makes the DDoS attack much easier and harder to prevent. The attack could come from any IP address , and it will be destined for your web server, which (presumably) you want to keep running. How do you filter out a packet destined to port 80 from possibly anywhere without also filtering out the legitimate connections?
Of course, even without raw sockets, you can still initiate a DDoS attack against a TCP port. If there were fewer script kiddies and more programers, it would not be that difficult to write a simple program that uses a stream socket, and DDoS's with a well formed HTTP POST that posts 18MB of data. If the DDoS kiddies were able to program, then that's what they'd do, and they wouldn't need raw sockets to accomplish it.
So while I agree that the addition of raw sockets really isn't that big of a deal, it seems to me that it's a little bit more complex than what I've seen so far.
$.02
Somewhat Flawed... (Score:3, Interesting)
This seems like a nice idea, but I'm not for it, and I'm not sure if it even feasible. An IP address is already like caller ID.
Lets say you were assigned this new unique ID. Who's responsible for ensuring the identity of the payload remains unaltered? The software maker? That sounds familiar! Today, when you send mail, your message might sit at several relays. Is it up to the mail server to implement tracking of this ID? Could you not simply make a mail server that ignored this precedent and spoofed whatever it wanted? This seems the same as someone getting a shell on a box and running some kind of custom relay meant for delivering spam mail anonymously.
I also can't imagine a business deciding to ignore mail based on the lack of this identification. If you have to favor security over a new customer, you have other problems.
The funny thing about this article is that a PC implementing his ideas for security could easily exist now, but the fact is Microsoft isnt going to do that. If they can't follow measures to implement good security now, why would they under this new system?
Personally, I hope the answer to all this DOS'ing does not involve me losing what anonymity I do have (which doesnt seem like much at this point anyway).
Re:Somewhat Flawed... (Score:2)
PGP or GPG is great for e-mail, but not for the socket exploits the article discusses. So when your computer or a keyserver is rendered insecure because of TCP/IP socket insecurities on an XP machine (client or keyserver), then what do you have? Properly written, a virus could enter thru an app that allows insecure raw socket access, and could send nicely authenticated e-mails that begin with "Hello, my friend..." You get the drift.
Sock_Raw (Score:5, Informative)
For the uninitiated...
Generally, when programming, you define a great many things when defining a socket, the layer of abstraction to tcp/ip defining a single connection.
SOCK_RAW is a bit less abstract, you define more of the data that is being used by hand rather than allowing for the socket code to do it for you. Generally the you use SOCK_STREAM of SOCK_DGRAM, which define TCP and UDP sockets, respectively. SOCK_RAW writes directly to IP, so you must encode many of the headers manually rather than automatically, as the other 2 would do, and then write them to this socket.
In other words, it has NOTHING to do with getting viruses! SOCK_RAW is just another socket, but you are writing to the IP protocol, rather than TCP or UDP (which sit on top of IP). It also has nothing to do with being DoS attacked. I have NO CLUE where he got that from.
Re:Sock_Raw (Score:3, Informative)
In other news... (Score:4, Insightful)
Micro$oft is not held back by this issue, however. They are currently working on developing a solution called "MS-over-IP" which will allow TCP/MS packets to travel over non-M$-compliant IP networks. This will be available as a patch to the upcoming Windows XP, for approximately $300. Micro$oft also notes that if your ISP refuses to conform to the new TCP/MS standard, and you do not wish to spend $300, you may switch to their M$N Internet $ervice, which will support native TCP/MS connections.
Micro$oft did not return any calls to our reporters on this issue, and simply sent us an E-Mail saying: "All your packets are belong to us."
Re:In other news... (Score:2)
Already been done... (Score:4, Interesting)
It's called IPv6, and it has QOS, guarenteed delivery, traceablity, and a whole host of other goodies. C'mon, do you really thing Cisco would let MS take away their bread and butter? IPv6 has been in the works for years and was designed specifically to solve all of the issues he mentions. I guess he thinks that only MS is smart enough to develop a new protocol...
This whole article is a red herring, and Cringley's about a technically literate as a door knob.
Re:Already been done... (Score:3, Funny)
Re:Already been done... (Score:2)
We're running IPV6 already with other universities over i2 and I don't see this happening on a large scale for at least another 10 years (and personally, I doubt it will ever happen without some intervening step like a IPV4b or MS/IP...)
Re:Already been done... (Score:3, Insightful)
One of the reasons that IPv6 is not very popular is because the MS version is proprietary as hell. MS is waiting for the big switch to IPv6 so incompatabilities between Unix and NT/winME could show up. At the time when the first MS-IPv6 stack was written, ms arrogantly assumed NT would own %80 of the server market by the time IPv6 became standard.
With almost everything running on NT, MS could then easily convince IT managers to only run NT on all servers for full network compatibility. The good news is that Microsoft's server dream never came quite true. Unix is still king on the Internet and is surprising gaining marketshare. At only %35 of the server market, I believe the MS IPv6 will not be very standard even if the whole Internet switches to the standard IPv6. But due to the MS-IPv6 problem, IPv4 will never quite go away.
Re:Already been done... (Score:3, Informative)
So exactly how can Microsoft's IPv6 stack be proprietary, when they don't own the routers, switches, et al? You see, if they change the format of the packets, then the router needs to accept the new format. Since CISCO should be setting up their IPv6 stuff to the agreed standard, that leaves Microsoft little choice.
Microsoft's network protocol implementations have always been fairly standard and able to interact with the world at large. I don't see that changing in the future.
As for IPv6, I don't see that really rolling out until XP covers much of the marketplace. XP (and the Server 2002 editions) should have native IPv6 support.
Stop spewing FUD. It isn't any more endearing than when Microsoft does it.
Re:Already been done... (Score:3, Interesting)
Actually, I've heard that IPv6 is not popular because none of the current backbone equipment will switch it and no one wants to be responsible for conversion from v6 to legacy IP...
If MS's implementation is buggy/not compatible, then it probably won't work through any switches or routers, and they will have to change it. IPv6 does have some provisions for vendor specific fields, ala Kerberos, but that'll go over about as well as MS's TNF email format (read 'not at all'), esp. in such a wide open environment as the 'net.
After all, it's not called the INTERnet for nothing. However, I don't doubt that they will be able to push their proprietary extensions into corporate environments, but they really already have done that (SMB & MAPI).
The reality is that TCP/IP is really too low level for MS to worry about. There is no added value to controlling packets, only the payload, which is why they are pushing
Chris.
IPv6 myths (Score:4, Informative)
IPv6 does not have 'traceability' - there is an IETF RFC detailing how to have slowly changing IEEE identifiers (MAC addresses) so that your IPv6 address will not include a static ethernet card MAC address. No more traceable than IPv4, and better in some ways.
IPv6 has no more guaranteed delivery than IPv4 - both of them can use TCP to ensure delivery of packets, but IPv6 has no special features in this area.
IPv6 is all about larger address space, easier router/host configuration and auto-configuration, easier re-addressing, better mobile IP, reduced routing table sizes, simplified options processing, and simplified headers. Please read up on IPv6 at http://www.ipv6forum.com before making these misleading statements.
You're all missing Cringely's main point (Score:5, Insightful)
But Cringely's real point is that Microsoft is a very powerful company with a long history of turning its own technical shortcomings into market strengths. Microsoft's PR machine is incredibly effective - witness the FUD that kicks into high gear any time MS announces anything.
It's also instructional to remember a few Microsoft projects that didn't go off as planned. Ever wonder why journalists never bring up those failed efforts, or points to the millions of wasted dollars MS has spent over the years on vaporware?
Remember how Microsoft Bob was going to "personalize" the computing experience? Well, it failed not once, but twice! [wired.com]. Remember how Chrome [cnet.com] was going to "revolutionize the industry," according to the drooling press?
Because Microsoft is the 800-lb. gorilla of the software world, even when they fail, they get the benefit of the doubt. It comes with the territory. Also, because the Microsoft culture is fantatical about continuous improvement, they have a long history of sucking hard at v1, sucking at v2, becoming fairly usable at v3, and taking over the market by v4 and beyond.
Microsoft has been doing this long enough to realize an opportunity when they see one. Cringely is reminding us that unlike all of you Slashdot readers out there, Microsoft is driven not by desire to build cool, useful technology, but by the desire to control marketshare. That's the be-all, end-all of their existence.
So whether Cringely is correct about raw sockets or the demise of TCP/IP doesn't really matter. Almost every company that has gone toe-to-toe against Microsoft in a market segment has failed because they continually underestimate and miscalculate Microsoft's strengths (IBM, Novell, Apple, WordPerfect, Lotus).
Microsoft has an overarching vision of the computer marketplace that is far more evolved than any of their competitors, with the possible exception of Sun.
Microsoft remains unconcerned with business ethics, is unafraid of censure by the government, and wouldn't hesitate to use the ubiquitous of their own flawed products as an excuse to move the foundation of the Internet to a proprietary framework.
Microsoft doesn't give a shit about the history of the Internet and the spirit in which it was created. They don't give a shit about letting everyone in.
If Microsoft believes they can make the Internet a proprietary environment that they can control, they will work relentlessly toward that end.
Re:You're all missing Cringely's main point (Score:2)
Unfortunately, only the free-thinkers would see it that way. The mindless herd of end users that follows Microsoft would know no different. They would continue to surf and enjoy their digital playground and carry with them the same illusion of freedom they have about the rest of America. These same people never knowing about the DMCA, Sklyarov, DeCSS, or fair-use, (because the media practices awareness control over the public) would just assume that's the way it's always been. The movie, "The Matrix," at least metaphorically speaking, is not far from the truth. In the future, I see a day when people are too "attached" to a system to let go. In this future, I see people who can't define their own reality or even define freedom because of the constraints that are placed upon them since birth. In other words, they will have lost the ability to step outside the box and question the facade they call "reality".
Maybe I've read "Brave New World" one too many times, but the parent post and Cringly's article make for a great introduction to a new 1984esque type of novel. Ok, so I got a little carried away there. LOL.. Anyhow, what I meant convey was that the average user would probably not care since they use windows anyway. They would see all the neat new services that passport provides and consider it a "feature." As scary as this may sound to you, the average joe user knows no better. However, with IPv6 right around the corner, I don't see Microsoft embracing TCP/IP. But have no doubt, if Microsoft could change the very protocol of the internet in yet another attempt capture even more marketshare, I have no doubt that they would at least try. That is what scares me about this company - the complete and total disregard for the open standards that allowed them to become so big in the first place.
Re:You're all missing Cringely's main point (Score:2)
This Seems to be a VERY Risky Strategy (Score:3, Insightful)
This would seem to be an extremely risky strategy due to the high potential that it could backfire from a public perception point of view. My experience is that despite the fact that some people are apologetic toward Microsoft as Cringley points out, there is a steadily growing public perception of the weakness of Microsoft products.
Many Windows users that I know use it because they feel they have to, either for the applications they need, because their workplace demands it, or because they feel they are too non-technical to use an alternative like Linux (and believe me, many of them are). They are well aware of the instabilities and the susceptability to virii, and in fact many of the Windows users I know joke about it all the time even though they use Windows for various practical reasons.
I think at this point in time, if Windows XP doesn't live up to the MS hype about it being a more stable and robust platform, and ends up in fact being less robust, they run a significant risk of damaging their public perception; probably not fatally, but noticably none the less. Given the fact that a wholesale migration to TCP/MS, while possible, is far from a sure thing, this would seem to be a rather risky strategy.
Good morning Slashdot (Score:4, Insightful)
No he's not saying viruses spread over raw sockets. He's saying that many viruses/worms like Code Red have the end effect of creating a denial of service attack; denial of service attacks are very difficult to block when the addresses of the packets are spoofed. He's saying that in the future, when 90%+ of the world is running Windows XP (and Windows 95/98/ME/2000 has been discontinued by Microsoft- ever try to get Windows 3.1 anymore?), and 90% of those people haven't used third party tools to secure their computers, there will be a continuous series of distributed denial of service attacks, and viruses like Code Red which will effectivly bring the Internet to a halt. (Most servers aren't running Microsoft OSes, but most of the clients are- the fact that Apache is the most used server is completly unimportant in this matter. Code Red isn't as bad as predicted because most people don't run Windows 2000, but XP unifies the server and consumer OSes so it'll be running on a very large number of computers, making these future problems several orders of magnitute worse.) The end result (as predicted by Cringly) is that Microsoft will extend and embrace TCP to get the Internet (which will be rendered useless by script kiddies and/or attacking foreign governments) working again.
Once implemented, if your web server doesn't speak MS/TCP then no one with Windows will be able to see your site. (And the only servers that will have bug free implementations of MS/TCP will be running a Microsoft OS.) Think that little ploy is hardly enough to overturn the Internet? Then why am I using IE right now? Their ploys have undone greater marketshares.
Someone said that Cisco is working on a way to prevent spoofed IPs at the router, if this is true, then this speculation is for naught. However, the fact that this is plausible should be a wake up call. Microsoft owns all of us. This is the straw that broke the camel's back, I'll resign before I install Windows XP. Microsoft's abuse of their monopoly is an affront to freedom. Live free, or die.
Gibson wrote zone alarm? (Score:4, Funny)
I didn't know Steve Gibson [grc.com] wrote Zone Alarm [zonelabs.com]. When did this happen? What happened to Zone Labs [zonelabs.com]?!
Re:Gibson wrote zone alarm? (Score:5, Funny)
If Gibson wrote Zone Alarm, it'd look as ugly as hell, have lots of BIG and alternating fonts, but be less than 300k in size, written in ASM, and fast as hell.
Re:Gibson wrote zone alarm? (Score:2, Funny)
Seeing as how Zone Alarm is the only darn free/software firewall that appears to work [grc.com], then why run anything else? I'd like to see Microsoft's crack team of security "experts" come up with something comparable.
Oh wait, they did [microsoft.com].
Hahahahah
Re:Gibson wrote zone alarm? (Score:3, Informative)
FEATURES AT A GLANCE
Multi-layer security protection (NDIS & TDI) Since the DSE resides on each computer in the network, it communicates directly with the operating system and negotiates what applications are even allowed to transmit and/or receive data.
MD5 Signature Support As the DSE mandates what applications can bind for communication, it can also check for an MD5 digital signature for permitted applications. This ensures that Trojan horse applications cannot gain access by using the name of a permitted application.
Stateful filtering based on SRC/DST IP address, port & application The DSE maintains a record of all sent packets and can therefore compare incoming packets to the record table to determine if they were requested. Additionally, the DSE can restrict applications to certain ports or destination IP addresses.
Remote access to logs and statistics The DSE contains a separate statistic view that displays all active sessions and includes the status, port, remote IP, application or service and the time associated with each session. Logs may be viewed from the statistics view or sent directly to a syslog server for analysis and reporting.
Suspicious activity monitoring and Intrusion detection The Tiny DSE contains a highly configurable reporting mechanism that can report specific intrusion attempts, or any other type of communication deemed suspicious, to a syslog server or to the CMDS server through an SSL connection.
Re:Gibson wrote zone alarm? (Score:2)
not to worry (Score:5, Insightful)
He's right.
But it doesn't matter.
There are already several easy technical fixes to prevent source spoofing [goldinc.com], and if Gibson and Cringely's phantasy comes true, they will all be deployed in various Internet routers in a matter of weeks. Some of them already are implemented in Cisco routers, but are not enabled by default. Long before things can come to sufficient head to justify Microsoft's appearance as an off-white knight to ostensibly save the day.
See also this article [networkmagazine.com] from Network Magazine.
Re:not to worry (Score:2)
Please remember history... (Score:5, Insightful)
When *I* was a youngin, IBM could do no wrong with many decision makers. I swore I'd never have my head in my ass when I got into decision making positions.
Now I'm 42 and one step away from making the decisions. I can INFLUENCE them now, and due to that, we run Apache for our web servers, I've stopped any thought of IIS from being implemented, and run Linux where possible and NT reluctuntly in some applications....
So don't forget this stuff. Microsoft may gain that market share, but one day hopefully pointy-haired bosses will be a bit better educated and make better decisions and not get sucked in by marketing hype.
Oh, I can dream, I can dream...
I predicted this 4 years ago (Score:3, Interesting)
my boss told me that because we were upgrading to Windows 95.. that it was time to ditch all those servers and get Windows servers with Exchange, et al...
i asked him why should we get rid of our perfectly running servers which had given us no trouble at all just to move to Microsoft? "Because, we're getting in contractors now, and they only know Windows Nt 4.0."
Later on, it was then decided that instead of bases having their own servers and their own email systems, that now that we'd all moved to Exchange, that we'd all put our GALs together (Global Address List - the list that Outlook/Exchange VBScripts use as their distro lists to replicate themselves), then we'd really kick ass.. no more joe.blow@otherairforcebase.af.mil...
my reply was - um... LDAP servers? open Source? Hello? Anyone?
well, skip ahead to today - the US Air Force (and soon all of DoD) is going to be moving from its now Air Force-wide GAL (why we just pull the plug now during virus scares and why we were down for weeks during Melisa) to Active Directory.
back when i shut down all my Sun boxes.. i told my boss that this was just stupid.. why should we give up on what works just to buy what Microsoft is giving us? Their goal was not to give us good products, but to get us to buy their products... and things like Exchange, with its GAL, are just the first protocols that they are trying to hijack and take back on the internet... eventually, all the open ones would be overthrown by the new default MS proprietary ones that would ship someday with newer versions of Windows.
I thought it might end with email.. but i see that i'm wrong.. i agree with Cringley... its going to go all the way.. and we have no way to stop it..
MS will take over the internet.. they are already took over filesharing with SMB, they are taking over email with Exchange, they have taken over HTM L with Explorer, they are trying to take over java with
sigh.. oh well..
Re:raw sockets? (Score:2, Interesting)
Linux provides raw sockets, but only the root user is able to utilise them (and rightly so). Cringely's article doesn't make it clear as to whether or not there's any kind of user-based protection under XP, or whether anything and everything can access raw sockets under XP.
Strags
Re:Yeah. So what? (Score:2)
(b) It is likely that if a universal authentication solution appears, it would be eventually made a government-sanctioned standard, much as they're attempting to do with secure media formats, the government being beholden to the content industry and all that.
Re:Use Linux? (Score:2)
It does suck for games.
All I can say is that it's gotten better - way better over the past year. Grab the latest RedHat or Mandrake or Debiam and screw around with it.
A *lot* of people got a bad taste using crappy early versions. Bad first impressions are hard to shake...
My own Windows install died (again) a couple of months ago and I really don't care at this point.
Be sure to grab the latest Mozilla - It seriously does work as well as IE. If you're using the Netscape 4.7 that comes with all the distros, the web will be painfully ugly.
Pretty much if you have your heart set on using Windows, go with it - I can't change your mind.
Are you so sure? (Score:3, Insightful)
mod up (Score:2)
in linux and apache the kernal and apache executables are configured differently before they are compiled, so it's much more diffecult to have a overflow work against all instances.. of course for a standard distro like redhat and apache binary rpms this isn't true.
Windows is also more common, so your expliot will be more used.
Windows is also owned my Microsoft, a "evil" company, all the better to attack then.
-Jon