Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Security Operating Systems Software Windows IT

Vista Hackers Get Busy 215

Posted by CowboyNeal from the fresh-meat-for-the-wolves dept.
An anonymous reader writes "Microsoft's long-awaited Windows Vista release Thursday for business customers will get more than just the passing attention of network administrators. That's because hackers will be eagerly waiting to do what hackers do best: start some mischief." Some folks on the Black Hat set got a sneak peek at Vista earlier this year, so they've had time to prepare.
This discussion has been archived. No new comments can be posted.

Vista Hackers Get Busy More

Vista Hackers Get Busy

Comments Filter:

  • The most retarded story ever? (Score:5, Insightful)

    by Anonymous Coward on Thursday November 30, 2006 @09:00PM (#17059328)
    Because crackers were obviously waiting until Vista was available in stores.

    • Re: (Score:2, Funny)

      by Anonymous Poodle ( 15365 )
      Yeah, hacking a beta would lose you style points . . . . .

      • Re: (Score:2, Informative)

        by Ubitsa_teh_1337 ( 1006277 )
        Actually, the final version of Vista has been available for ~3 weeks online, so it's not just the beta that people have been hacking away at.

        • Re: (Score:3, Funny)

          by Fred_A ( 10934 )
          Really ? Hmmm. I can't help but wonder if my coasters would look better with a 0 Day vista on them.

    • Re:The most retarded story ever? (Score:5, Insightful)

      by Anonymous Coward on Thursday November 30, 2006 @09:07PM (#17059450)
      Well, yes. I'm sure all the crackers have gotten their grubby little mitts on the thing already, but the general populate hasn't. What good is being able to break into Vista already, when no one is using it yet. Once the use of the OS starts to grow after it is released, there will be an abundance of targets. Not so, right now.

      • Re: (Score:2, Insightful)

        by Monchanger ( 637670 )
        You can't get a Slashdot story written about you (albeit anonymously) by being the second confirmed crack.

        That, and the adoption is still low due to there not being an available cracked version...

      • Re:The most retarded story ever? (Score:5, Insightful)

        by Jahz ( 831343 ) on Thursday November 30, 2006 @11:40PM (#17060780) Homepage Journal
        Well, yes. I'm sure all the crackers have gotten their grubby little mitts on the thing already, but the general populate hasn't. What good is being able to break into Vista already, when no one is using it yet. Once the use of the OS starts to grow after it is released, there will be an abundance of targets. Not so, right now.

        Targets? Are you under the impression that the only reason to exploit a machine is to form a bot net? Additionally, have you considered that an exploit written/discovered during beta can, in most cases, be SAVED until release? It's not like the evil hackers are reporting their hacks to Microsoft for QA purposes.

        *sigh*
        • And what do you suppose the adoption rate of Vista within the next few months will be? I'm betting 0%, give or take. Hackers would be better off going after OS/2.

          • Re:The most retarded story ever? (Score:4, Insightful)

            by Danse ( 1026 ) on Friday December 01, 2006 @01:14AM (#17061490)
            And what do you suppose the adoption rate of Vista within the next few months will be? I'm betting 0%, give or take. Hackers would be better off going after OS/2.

            With OEMs installing it on new boxes, I'm betting the sales pick up fairly quickly. I sure won't be one of them, but I know plenty of people who wouldn't think twice about getting the latest OS on their new PC.

    • Re: (Score:3, Funny)

      by quakeroatz ( 242632 )
      That right! First we'll all drop $300 on Vista, crack it, that will show them!!

      Wait....

      • Re: (Score:2)

        by darkonc ( 47285 )
        You seem to forget that most exploits are profit-oriented these days.

        Besides: The VISTA betas have been available for free, so you don't need to shell out $money to get a copy to test your cracking skills on.

    • Re:The most retarded story ever? (Score:5, Insightful)

      by StikyPad ( 445176 ) on Thursday November 30, 2006 @09:19PM (#17059572) Homepage
      No, they were waiting for legitimate customers to install it so they could try out their hacks in the real world. See sig.
      • No, they were waiting for legitimate customers to install it so they could try out their hacks in the real world. See sig.

        Rrrright. Because no legitimate customers have been running vista for months [microsoft.com] already.
      • Sure, 100% business machines Likely the high end workstations.

        It's a botnet Dream!

        Plus there might actually be useful information on these machines.

        And 0 day hacks + Windows Phone home (rendering them undetectable) = massive pwnage.

    • Re:The most retarded story ever? (Score:5, Funny)

      by The Great Pretender ( 975978 ) on Friday December 01, 2006 @12:16AM (#17061046)
      They should have released Vista during NASCAR season, then the crackers would've been too distracted to mess with it.

    • Re: (Score:3, Interesting)

      by rucs_hack ( 784150 )
      does this mean XP will become safer?

      I mean, if all the hackers are working on Vista, surely the current crop of XP worms etc will go out of date, and a properly set up XP box won't be at such risk from a constantly evolving virus enemy

      • Re: (Score:3, Insightful)

        by Orange Crush ( 934731 )

        does this mean XP will become safer?

        About as safe as Win98 is today. XP will still be the most common desktop OS for years to come. Average users don't upgrade OSes. Heck, they don't even patch them. XP was released in 2001, yet three years later Windows 98 still accounted for more than a quarter [wikipedia.org] of Google page views.

        Also, Vista's (theoretically) harder to pirate than XP was and I'd wager that a large part of XPs early adoption was via corp .iso's.

  • Hack WGA First (Score:5, Insightful)

    by Mateo_LeFou ( 859634 ) on Thursday November 30, 2006 @09:02PM (#17059378) Homepage
    Make it better. The less piracy of windows there is in the world, the more people will get into free alternatives

    • Re:Hack WGA First (Score:5, Interesting)

      by Jherek Carnelian ( 831679 ) on Thursday November 30, 2006 @09:24PM (#17059616)
      Make it better. The less piracy of windows there is in the world, the more people will get into free alternatives.

      Hell, make it deny everyone. The less legitimate use of windows there is in the world, the more people will get into free alternatives.

    • Re: (Score:2, Interesting)

      by Iriestx ( 1033648 )
      Ding ding ding. After seeing the WGA/DRM nightmare that is Vista, I wiped my Windows partition and am full time Ubuntu. I've never been happier with and more excited about the future of my OS.

      • Re: (Score:3, Funny)

        by Redlazer ( 786403 ) *
        I did the same, but then i ended up saying to myself "Now what do i do?"

        But, much like someone above said, to each his own. I like playing games, and most games are not available for Linux. Dont get me wrong, Linux is fantastic, but it just lacks that ease of use and get up and go that Windows has. And yes, the WGA thing does keep me up at night, staring at my computer, expecting it to try and kill me in my sleep. And then take my wallet.

        -Red

      • Good luck. I never quite got the appeal of Ubuntu (pretty die-hard fedora guy), but I understand it's helping many such as yourself cut the shackles.

        • Re: (Score:2, Interesting)

          by Iriestx ( 1033648 )
          The biggest appeal to me was all of my hardware working on the first boot. The biggest headache I've had trying to make the switch was making all my hardware work. Once that happened, the shackles took themselves off.

        • Re: (Score:2)

          by Fred_A ( 10934 )
          Good luck. I never quite got the appeal of Ubuntu
          It's a polished Debian. It should be self explanatory.

          Apart from that, since it's a Linux distribution, it installs pretty much the same thing as any other Linux distribution, so in the end there isn't much difference, especially to a seasoned user.

  • Always a game (Score:5, Insightful)

    by nawcom ( 941663 ) on Thursday November 30, 2006 @09:03PM (#17059398) Homepage
    Microsoft software will always be a puzzle game to hackers and such; closed, hidden, and exciting to find.

    • Re: (Score:3, Funny)

      by hollywoodb ( 809541 )
      puzzle game ... closed, hidden, and exciting to find
      Isn't that the credo of Windows users?

      "6 months running, don't know what the hell is happening, time for (another) reinstall!"

  • It's Starting Already... (Score:5, Funny)

    by Anonymous Coward on Thursday November 30, 2006 @09:03PM (#17059408)
    I don't even have the operating system installed and I'm worrying about the hackers and the virus already.

  • Wondering how many... (Score:2, Interesting)

    by Darundal ( 891860 )
    ...Viruses and other bits of Malware will be out in the wild ready to hit machines running Vista when corporations and other VLK owners start getting it installed and running. Microsoft claims it is their "Most Secure Operating System EVER," should be interesting to see how well they actually do maintaining that claim. I bet nothing for 2 days, but ~5 within the next week. What should be more interesting is how much press they get, and how Microsoft responds to them.

    • Re: (Score:2)

      by jmp_nyc ( 895404 ) *
      I bet nothing for 2 days, but ~5 within the next week.

      I wouldn't take the other side of that bet. It looks like any of those early adopter companies that are running Lotus Notes (or any other third party mail client) are screwed from day 1. [zdnet.com.au] It seems that Microsoft put a big lock on the front door, but left the sliding glass door to the back yard wide open.
      -JMP

      • Re: (Score:3, Informative)

        by I'm Don Giovanni ( 598558 )
        All I see in your referenced article is that faulty third party email clients might be tricked into running executable attachment malware. How is this Vista's fault? The faulty third party email clients are at fault. Sophos is making a big deal out of this because they sell security software and want to make sure people still buy their stuff.

        At least the malware run by these clients won't run with admin priveledges under Vista, so it's at least as good as Linux wrt that. And Vista's builtin mail client

  • Outcome is Predetermined (Score:4, Insightful)

    by mpapet ( 761907 ) on Thursday November 30, 2006 @09:20PM (#17059582) Homepage
    1. Windows will always have "enough" security for most users. There's no incentive for them to do any better because they own the market already. Therefore, end-user security is not important.
    2. The target is too big and the OS too poorly designed for running a reasonably safe desktop.
    3. The outlook for system administration is good because there will be plenty of work.

    What's sad is the Wikipedia page that compares Vista to XP conveniently studiously avoids the fact that Microsoft and the media corporations now control essential parts of your computer. http://en.wikipedia.org/wiki/Features_new_to_Windo ws_Vista [wikipedia.org]

    I give the first verified Vista exploit 90 days from the day they ship to consumers. What's your bet?

    • Re:Outcome is Predetermined (Score:5, Funny)

      by RAMMS+EIN ( 578166 ) on Thursday November 30, 2006 @09:25PM (#17059642) Homepage Journal
      ``I give the first verified Vista exploit 90 days from the day they ship to consumers.''

      Is that because it takes them 187 days to verify it?

      • Beats the ThunderBird mail-eating bug. (Score:4, Interesting)

        by Animaether ( 411575 ) on Thursday November 30, 2006 @10:36PM (#17060326) Journal
        Sorry, going to be almost entirely off-topic here because a submission on this was rejected and I think it deserves at least some exposure. If it was Outlook eating e-mails Slashdot would be having a field day, but alright.

        ThunderBird v1.5.0.8 introduced an issue where malformed e-mails (namely the Referer: header value matches the Message-Id: header value) is causing the e-mails not to be displayed. They are received, they're in the mailbox file, but they're not displayed. The error is probably somewhere in the Threading code, but affects non-threaded Views all the same. Worse yet, if you compact your folders (as you are recommended to do regularly), the invisible e-mails will also actually be deleted.

        This issue has been in ThunderBird since 1.5.0.8 release, obviously. It was first discovered on November 9th. A bug was logged on November 11th. It is now December 1st (here anyway), and an official fixed release is not expected until later this month.

        There is no telling how many users are affected by this bug, as most users will never realize that the mail isn't arriving - and when told, the first few things they would check is spam filters, their ISP's spam filters, firewalls, junk filters, and then the MozillaZine page on disappearing e-mail (sad that there's such a page) - which makes no mention of this bug either.

        I'll take an exploit any day - turn my machine into a zombie if you must - but causing me to lose mail for no good reason, knowing about it, and not officially fixing it, is inexcusable.

        That said - the fix is in the 1.8 branch, in 2.0, and in the nightly builds. Thing is, only way to know about it is if you read the bug (change referrer - bugzilla.mozilla blocks slashdot referrers):
        https://bugzilla.mozilla.org/show_bug.cgi?id=36040 9 [mozilla.org]
    • What's sad is the Wikipedia page that compares Vista to XP conveniently studiously avoids the fact that Microsoft and the media corporations now control essential parts of your computer.

      and this has meaning in the market Vista shares with cable TV, the PVR, HDTV, the video game console and DVD player because...?

      free-as-in-beer and free-as-in-freedom do not have the same meaning to Microsoft's target audience as they do the Geek. to the middle class, the computer is an office machine and a household appl

  • Sneak Peeks (Score:5, Insightful)

    by RAMMS+EIN ( 578166 ) on Thursday November 30, 2006 @09:22PM (#17059604) Homepage Journal
    ``Some folks on the Black Hat set got a sneak peek at Vista earlier this year''

    It seems to me pretty much everyone got a sneak peek at Vista earlier this year.

    • Re: (Score:2)

      by Utopia ( 149375 )
      That comment seems to be from the Slashdot editor not from the submitter.
      Obviously he didn't get a peek.

        .

  • Helping Hacker Culture Grow (Score:5, Informative)

    by foobsr ( 693224 ) * on Thursday November 30, 2006 @09:24PM (#17059624) Homepage Journal
    If you are a writer or journalist, don't say or write hacker when you mean cracker. If you work with writers or journalists, educate them on this issue and push them to do the right thing. If you catch a newspaper or magazine abusing the work `hacker', write them and straigten them out (this appendix includes a model letter).

    The New Hacker's Dictionary [outpost9.com]

    CC.

    • Re: (Score:3, Insightful)

      by GaryPatterson ( 852699 )
      While I sympathise to some extent, you're fighting a lost battle. In fact, it's pretty much the same one that people who bemoan that the word "gay" no longer means happy lost years ago.

      To 99.9999% of the world, Hacker == Cracker == bad person

    • Re: (Score:3, Interesting)

      by slackmaster2000 ( 820067 )
      This will never change in the media.

      The term "hacker" has for a very long time been used to describe those individuals who break into computer systems. Your computer gets "hacked," your software is "cracked." When Hollywood makes a movie about kids who break into computer systems, they are called "hackers." When you read in the paper about people going to jail for breaking into computers, they are referred to "hackers." This is the terminology that average people understand.

      Aside from all that, "cracker

      • Re:Helping Hacker Culture Grow (Score:5, Funny)

        by badboy_tw2002 ( 524611 ) on Thursday November 30, 2006 @10:21PM (#17060160)
        You mean REALLY liking computers won't turn my hair blue and introduce me to a world of leather clad babes and techno music? I thought I just wasn't using mine enough. This is disappointing.

        Yeah, I don't really understand why people get mad at "hacker == cracker". They're mislabled as badboys. You wouldn't want them mislabeling you as fat lonely nerds who live in their....

        Wait.

        Shit.

      • Re: (Score:3, Insightful)

        by ampathee ( 682788 )
        Personally, I say 'geek' - I think it sounds cooler than 'nerd'.
      • Or just accept to use it as both. I say 'I like to hack neat soultions together' and also say "yeah, those hackers love to put botnet backdoors on your private LAN". I don't know why it can't have both meanings effectively and make everyone happy.

    • Re: (Score:3, Insightful)

      by ConceptJunkie ( 24823 ) *
      Get over it. That battle was lost a decade ago. Nobody cares anymore.

      Or are you one of those folks who still gets into System V/Berkeley flame war...

      • Re: (Score:2)

        by Dunkirk ( 238653 )
        Yeah, well, can you blame him? He's also one of those guys who makes everyone say "GNU/Linux."

    • Re:Helping Hacker Culture Grow (Score:5, Insightful)

      by Dunbal ( 464142 ) on Friday December 01, 2006 @12:02AM (#17060932)
      don't say or write hacker when you mean cracker

            No. That's the thing really. With the DMCA, both of them are criminals now anyway...

      • Re: (Score:2)

        by iwan-nl ( 832236 )
        With the DMCA, both of them are criminals now anyway...

        ...in the US of A. Most other countries don't have these ridiculous suppressive laws.

  • I saw a long line of these guys at compusa (Score:5, Funny)

    by Anonymous Coward on Thursday November 30, 2006 @09:29PM (#17059656)
    They were all standing around with their tents in their black hats waiting to crack stuff and make keygens and shit. I asked why they were waiting in line when they could have had the RTM weeks ago on Usenet? They replied, "What's Usenet?" Those black hats must really fuck with the circulation in your head. I wonder if Slashdot editors wear black hats.

  • Third party application. (Score:3, Interesting)

    by Utopia ( 149375 ) on Thursday November 30, 2006 @09:51PM (#17059890)
    Windows Mail identifies and stops all ten threats on its list,
    Stratio-Zip, Netsky-D, and MyDoom-O are able to bypass security when a third-party email client is used.

    Good proof that Vista is insecure.

  • Predictions (Score:5, Interesting)

    by Beryllium Sphere(tm) ( 193358 ) on Thursday November 30, 2006 @11:13PM (#17060586) Journal
    o Exploits will be in older code.
    o The first "exploits" announced will be simply userland Trojans, as will most that follow.
    o Old-style remote exploits will be unusual and dramatically rarer than we're used to.
    o Nobody will notice the difference. The media will lump all problems together and the reports will boil down to "LOL V1st4 pwned".

    MS has hunted down unsafe APIs and banned crypto algorithms that are damaged (MD5) or that nobody can figure out how to use correctly (RC4). They compile with stack canaries. They've added address space layout randomization. A large number of people in Canada will forever snarl at me in derision for saying this, but Microsoft is beginning to absorb lessons from the success of OpenBSD.

    It's never going to be the same, of course. There's not enough money in the world to audit Microsoft's cetacean code base to OpenBSD standards and I can't believe the design of Windows would support privilege separation.

    • Re: (Score:2)

      by jimicus ( 737525 )
      The first "exploits" announced will be simply userland Trojans, as will most that follow.

      You mean like a lot of spyware today is? Like LoveLetter, MyDoom and Bagle all are?

      They may not be kernel-level exploits. But they're still destructive, they still get everywhere.

  • THE most secure version of Windows, ever? (Score:4, Funny)

    by gelfling ( 6534 ) on Friday December 01, 2006 @12:09AM (#17060982) Homepage Journal
    Mercy me I can't imagine there will be any vulnerabilities at all in this newest highest priced, longest to develop & release version of Microsoft's ratio sum ultra of enterprise operating systems. And even if there are and someone exploits them that would just be unfair and mean. I'm sure I wouldn't want to know about any exploits in this the most critical and hyped version of Microsoft Windows.
  • As the lession of the Mac has tought us, until an OS has a significant market share there will be no viruses. Therefore we should see no viruses for Vista until the install base exceeds the tens of millions of Macs that are around today.

    Right?

    • Re: (Score:3, Informative)

      by I'm Don Giovanni ( 598558 )
      I take it, from your tone, that you're implying that the lack of attacks against Mac OS has nothing to do with its small marketshare. Interesting that you post this one day after Apple patched 31 security holes. And there were three months earlier this year when Apple patched 40+, 20+, and 20+ security holes. So the holes are there aplenty, but they're not being exploited for some reason. If small marketshare isn't the reason that those holes haven't been exploited, then what is the reason? Why don't y

      • You reinforce my point (Score:4, Insightful)

        by SuperKendall ( 25149 ) on Friday December 01, 2006 @03:29AM (#17062320)
        I take it, from your tone, that you're implying that the lack of attacks against Mac OS has nothing to do with its small marketshare.

        How perceptive!

        Interesting that you post this one day after Apple patched 31 security holes

        And then you falter.

        Not all security holes are created equal you know; Some security holes are harder to exploit than others. You can never remove all security holes so you approach security using a tactic called "defense in depth" which builds a layered approach to security, such that even if you have a weakness at some level either the levels above will prevent access for an exploit, or an exploit can only get so far. So Apple fixing 31 security holes means only that they are indeed vigilant about patching security problems.

        Still virus and malware free, even with these 31 exploits it would seem....

        And there were three months earlier this year when Apple patched 40+, 20+, and 20+ security holes

        Yes, and three months earlier we also had no malware or viruses.

        So the holes are there aplenty, but they're not being exploited for some reason.

        (a) you obviously had no idea what the holes were in, and (b) as I said you can never remove all holes - only a fool would imagine that to be possible.

        To help you reach a deeper understanding of the situation, consider this - some of those "holes aplenty" were in the OS X SSH server. yet by default OS X does not have SSH enabled. So, realistically, a hole in that system means nothing for a virus writer, because they cannot count of enough people to be running SSH to make that an exploit they can reach. That is but one example.

        If small marketshare isn't the reason that those holes haven't been exploited, then what is the reason? Why don't you suggest a reason?

        I have - defense in depth. It's too difficult currently to reach the exploits that are open, or to do anything of use when you reach them. Furthermore a good deep defense also means that if an exploit should infect a computer, it's far easier to remove the malicious code - whcih lesses the desire to write an exploit because its lifespan will not be as great.

        Let's turn your whole argument around. Apache is a popular web server, far more popular than any other. Yet it too has a distinct lack of sucessful exploits against it compared with other servers. Since marketshare does not seem to tell us anything about the likleyhood of successful attacks, some other force is at work - and that is a better overall security model.

        Maybe it isn't small marketshare, but it certainly isn't that the holes aren't there (like Mac fanboys like to suggest).

        Mac "fanboys" rarely suggest there are no holes, just that OS X has better security by default which reduces the impact and effect of the holes that will ALWAYS be there. Only "Windows Bitches" distort that argument to claim otherwise. Say, didn't you jus make that mistake?

    • I had trouble with Mac viruses already in 1990. And they were very obnoxious, because the Apple automounted floppy disks. If you inserted one with a virus, your system immediately got infected. If you inserted a new floppy, that immediately got infected too. The only way to clean up was to have a non-writable floppy disk available with the necessary tools.

  • What the hell? Microsoft wasgiving out Beta copies like candy at most every seminar/class for months and months.. its not like they were hiding it.

    Oh, and there was that little 'public download' they had on RC2... geesh.

Slashdot Top Deals

The use of money is all the advantage there is to having money. -- B. Franklin

Close