Vista Hackers Get Busy

An anonymous reader writes "Microsoft's long-awaited Windows Vista release Thursday for business customers will get more than just the passing attention of network administrators. That's because hackers will be eagerly waiting to do what hackers do best: start some mischief." Some folks on the Black Hat set got a sneak peek at Vista earlier this year, so they've had time to prepare.

Wondering how many...

[Darundal]

...Viruses and other bits of Malware will be out in the wild ready to hit machines running Vista when corporations and other VLK owners start getting it installed and running. Microsoft claims it is their "Most Secure Operating System EVER," should be interesting to see how well they actually do maintaining that claim. I bet nothing for 2 days, but ~5 within the next week. What should be more interesting is how much press they get, and how Microsoft responds to them.

Re:Hack WGA First

[Jherek Carnelian]

Make it better. The less piracy of windows there is in the world, the more people will get into free alternatives.

Hell, make it deny everyone. The less legitimate use of windows there is in the world, the more people will get into free alternatives.

Re:Hack WGA First

[Iriestx]

Ding ding ding. After seeing the WGA/DRM nightmare that is Vista, I wiped my Windows partition and am full time Ubuntu. I've never been happier with and more excited about the future of my OS.

Third party application.

[Utopia]

Windows Mail identifies and stops all ten threats on its list,
Stratio-Zip, Netsky-D, and MyDoom-O are able to bypass security when a third-party email client is used.

Good proof that Vista is insecure.

Re:Helping Hacker Culture Grow

[slackmaster2000]

This will never change in the media.

The term "hacker" has for a very long time been used to describe those individuals who break into computer systems. Your computer gets "hacked," your software is "cracked." When Hollywood makes a movie about kids who break into computer systems, they are called "hackers." When you read in the paper about people going to jail for breaking into computers, they are referred to "hackers." This is the terminology that average people understand.

Aside from all that, "cracker" has been a derogatory term "white guy" for longer than computer crackers have been around. If I saw a headline that read "Cracker Arrested" I'd picture some fat guy with no shirt yelling obscenities at the cops.

I think that hackers have to let go of the label. Besides, if Jurassic Park has taught us anything, it's that "I'm a hacker" sounds really, really dumb....unless you really do break into computer systems, in which case it's a bit more on the cool side.

Personally, I just tell people that I'm a computer nerd. Being proud of being good with computers doesn't impress the masses too much, so it helps to diffuse the inevitable smirk by just admitting right off that you're a nerd and you damn well know it.

Beats the ThunderBird mail-eating bug.

[Animaether]

Sorry, going to be almost entirely off-topic here because a submission on this was rejected and I think it deserves at least some exposure. If it was Outlook eating e-mails Slashdot would be having a field day, but alright.

ThunderBird v1.5.0.8 introduced an issue where malformed e-mails (namely the Referer: header value matches the Message-Id: header value) is causing the e-mails not to be displayed. They are received, they're in the mailbox file, but they're not displayed. The error is probably somewhere in the Threading code, but affects non-threaded Views all the same. Worse yet, if you compact your folders (as you are recommended to do regularly), the invisible e-mails will also actually be deleted.

This issue has been in ThunderBird since 1.5.0.8 release, obviously. It was first discovered on November 9th. A bug was logged on November 11th. It is now December 1st (here anyway), and an official fixed release is not expected until later this month.

There is no telling how many users are affected by this bug, as most users will never realize that the mail isn't arriving - and when told, the first few things they would check is spam filters, their ISP's spam filters, firewalls, junk filters, and then the MozillaZine page on disappearing e-mail (sad that there's such a page) - which makes no mention of this bug either.

I'll take an exploit any day - turn my machine into a zombie if you must - but causing me to lose mail for no good reason, knowing about it, and not officially fixing it, is inexcusable.

That said - the fix is in the 1.8 branch, in 2.0, and in the nightly builds. Thing is, only way to know about it is if you read the bug (change referrer - bugzilla.mozilla blocks slashdot referrers):
https://bugzilla.mozilla.org/show_bug.cgi?id=36040 9 [mozilla.org]

Predictions

[Beryllium Sphere(tm)]

o Exploits will be in older code.
o The first "exploits" announced will be simply userland Trojans, as will most that follow.
o Old-style remote exploits will be unusual and dramatically rarer than we're used to.
o Nobody will notice the difference. The media will lump all problems together and the reports will boil down to "LOL V1st4 pwned".

MS has hunted down unsafe APIs and banned crypto algorithms that are damaged (MD5) or that nobody can figure out how to use correctly (RC4). They compile with stack canaries. They've added address space layout randomization. A large number of people in Canada will forever snarl at me in derision for saying this, but Microsoft is beginning to absorb lessons from the success of OpenBSD.

It's never going to be the same, of course. There's not enough money in the world to audit Microsoft's cetacean code base to OpenBSD standards and I can't believe the design of Windows would support privilege separation.

Re:Third party application.

[innocence18]

Isn't this the same as lumping Apache vulnerabilities in with Linux vulnerabilities? 3rd party mail app problems are hardly Vista's fault are they?

Re:Hack WGA First

[Iriestx]

The biggest appeal to me was all of my hardware working on the first boot. The biggest headache I've had trying to make the switch was making all my hardware work. Once that happened, the shackles took themselves off.

Re:The most retarded story ever?

[rucs_hack]

does this mean XP will become safer?

I mean, if all the hackers are working on Vista, surely the current crop of XP worms etc will go out of date, and a properly set up XP box won't be at such risk from a constantly evolving virus enemy