Submitting a review for consideration is easy; please first read Slashdot's book review guidelines. Updated: 2008114 by samzenpus
All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2009 Geeknet, Inc.
Well... (Score:3, Informative)
Re:Well... (Score:4, Insightful)
Too bad so many XP users don't opt-in to patching
This is Microsoft's fault for not offering a security only patch channel and pushing WGA ,etc through as windows updates.
I know this is probably comes across as trolling but it's not just Microsoft bashing for the sake of it.
Parent
+5 informative? (Score:4, Informative)
Good grief. MS offers ALL security patches to EVERYONE, including pirates, and also offers many other patches such as stability and performance updates to everyone as well.
---
"There seems to be a myth that Microsoft limits security updates to genuine Windows users," wrote Microsoft's Paul Cooke, who works in Windows Client Enterprise Security. "Let me be clear: all security updates go to all users."
----
From http://www.tomshardware.com/news/windows-pirate-bootleg-security-patches,7666.html [tomshardware.com]
Parent
Re: (Score:2)
I'm not talking about pirates, there are many cases where legitimate users do not what to apply all patches to their system, but applying only security patches is acceptable.
For example a company that has ie6 only Intranet sites don't want to test against ie7/ie8 but still want security patches for ie6, without having to comb through all the updates and pick out the security ones.
e.g. the equivalent of using debian and having the security repo enabled but not backports.
Re: (Score:2)
Using it manually you can, however AFAIK using it automatically there is no way to apply only security updates.
Re:Well... (Score:5, Insightful)
No, this is the fault of people who pirate their operating system and then expect it to be supported. Some things have a price. Pay the price if it is worth it to you. Don't use it if the price is not worth it to you. Some people call that "vote with your wallet". Just taking it for free and then expecting support is ludicrous and the height of hypocrisy.
While I do agree that pirating a piece of software and expecting support is unreasonable, Microsoft is only increasing the number of botnets when they refuse updates to pirated software. Refuse software and hardware updates, but at least include security updates. With the increased number of botnets, that's more computers out there trying to infect others and it will without a doubt hit legitimate systems owned by users who just ignore that little yellow shield with the exclamation point on their taskbar. It is also their fault, but some people just don't know better.
Parent
Re:Well... (Score:5, Insightful)
Let's think about this not from a moral perspective, but from a business one
Ok, lets do that.
As Microsoft software is the single most predominately used OS in the world, having large numbers of these installations being vulnerable to botnets is not only putting the efficient working of the global networks at risk, costing large sums as innocent ISPs upgrade their infrastructure to cope with the deluge of useless spam traffic and and virus payloads; costing businesses large sums to protect themselves from the deluge of virus, phishing and spam that routinely attacks their users; costing consumers vast sums as they attempt to protect themselves from the same deluge of attacks; but also puts the economy at risk with phishing attempts and other fraudulent and criminal activities that at best reduce people's confidence in using it for economic activity.
Given the above, the government should step in and force Microsoft to be more responsible for securing the national infrastructure from these attacks. Infrastructure that the modern economy depends upon. They keep telling us how many billions of Dollars are lost to virus attacks, how much conficker cost business, etc. Imagine how much the economy would suffer if there was a really big botnet/virus that did more than inconvenience users.
You can ignore moral aspects here and focus on the purely economic. We did that with banker's bonus-driven practices, and look how well that turned out. By ignoring the 'moral' aspects of Microsoft's monopoly and their self-interested lack of securing their OS, we may yet suffer similar problems.
(this isn't really Microsoft bashing, its more monopoly bashing)(though, I recall someone senior at MS saying they liked piracy because it made developers and users become accustomed to Microsoft software which had a beneficial effect to them - perhaps it is Microsoft's fault after all).
Parent
Re: (Score:2)
Meanwhile, various problems with Windows updates are conveniently forgotten. Of about 7 machines that I updated to XP SP3, one was a "Gotcha" from Microsoft. The eternal reboot thing. That didn't bother me terribly - it was a minor inconvenience to wipe and reinstall. But, what about the non-technical great-grandma who had no backups? All her pictures of grandchildren and great grandchildren were probably lost when her dorky grandson started muddling with her old, outdated system. How much you want to
Re: (Score:2)
Software piracy may be wrong, but allowing those computers to sit on the Internet spreading vulnerabilities is too. Microsoft should either disable non-genuine versions altogether or offer the security patches to them for the sake of the rest of us.
Re: (Score:2)
Re: (Score:2)
Apparently [slashdot.org] windows offer update to pirates too, but that is not my point. My point is that i should be able to auto-install security updates without having to worry about other patches and software being downloaded with it. IIRC ie7 and/or ie8 were installed via automatic updates (and set themselves as default browsers), there are situations where that is not acceptable.
If you look at debian/fedora there is always the option of keeping an entirely stable (no new software/bugfixes*) except for security patch
Re: (Score:2)
"Opt-in" Is The Wrong Term (Score:3, Interesting)
It isn't quite true to suggest people don't "opt-in to patching" on any Windows product. It is more the case the process is arcane and confusing to some users. And worse still, the system trains the rest of the users to blindly accept things that look like "official updates" when they are really malware. I've lost track on the number of times someone asked me what was going on when the WGA thing pops up. The way it is worded and framed seems to freak users out and I see why: Going for months with a legi
Yay, tight integration of browser with OS... (Score:3, Insightful)
Anybody else think something is integrated with something else in a deeply, deeply wrong way here?
Re:Yay, tight integration of browser with OS... (Score:5, Funny)
Anybody else think something is integrated with something else in a deeply, deeply wrong way here?
I most certainly do! This is unfair! When will Firefox and Opera have such privileged access to kernel space. It results in a bad user experience when the Javascript code I slave over can only help you manage your user files, registry keys and kernel libraries if you're using IE.
Yours truly,
Crafty McStealsYourShit
Parent
Re: (Score:2)
Re: (Score:2, Interesting)
According to Microsoft, the Windows kernel improperly parses Embedded OpenType (EOT) fonts, which are a compact form of fonts designed for use on Web pages.
One question: Why is the kernel parsing fonts?
Re: (Score:3, Informative)
From what I understand: GDI functions are in the kernel for speed reasons - constantly switching to usermode just to draw things slows down the system.
Vista moved it into userspace, and lots of users complained about slowness. Looking at the vulnerability details, this just gives you privilage elevation on Vista (and related servers), not remote code execution.
For Windows 7, MS moved GDI back into the kernel, with some redesign. So they apparently fixed this issue when they returned GDI to user mode.
Again
Re:Yay, tight integration of browser with OS... (Score:5, Informative)
Anybody else think something is integrated with something else in a deeply, deeply wrong way here?
No, not really, at least, not in the way you're insinuating. The Win32k kernel mode driver is essentially the major component of the Windows kernel responsible for kernel-mode graphics related processing. Put more succinctly by MS from the MS09-065 [microsoft.com] security bulletin:
Win32k.sys is a kernel-mode device driver and is the kernel part of the Windows subsystem. It contains the window manager, which controls window displays; manages screen output; collects input from the keyboard, mouse, and other devices; and passes user messages to applications. It also contains the Graphics Device Interface (GDI), which is a library of functions for graphics output devices. Finally, it serves as a wrapper for DirectX support that is implemented in another driver (dxgkrnl.sys).
The handling of EOT (Embedded OpenType) fonts is apparently (at least partially) handled by the kernel and presumably a component of the GDI system. IE supports EOT fonts and presumably just hands them off to the kernel, after all, it is delegated the responsibility of handling them, so why re-implement it in IE? The flaw is not really in IE but in buggy code in the relevant processing. There is an argument to be made that IE really shouldn't be explicitly processing these fonts by default in an untrusted network (and this can be changed in the preferences, but is not the default), but the flaw itself is in the system call code itself; the latter is merely about reducing attack surface in the case of exploits such as this arising.
My point is, this isn't really a case of IE being "overly" coupled into the system (which isn't to say it isn't, just that I don't view this as an example of it). Whether it's sensible engineering to have the kernel handle this stuff is probably a far more interesting and valid argument. Protecting against system call vulnerabilities is pretty tough, as you do expect the kernel to be trusted, indeed, if you can't trust the kernel you have serious problems. A quick google seems to suggest Firefox doesn't support EOT fonts, and I'm not sure if any other browsers do either, but if they did, they may well have their own exploit situations as well.
Parent
Re: (Score:2)
Minor correction:
This isn't necessarily limited to EOT fonts, but is a flaw in the font parsing code in the kernel in general. EOT fonts are just the exploit vector as specific to IE, but other font types can be used for less likely exploit vectors, such as TTF fonts in a Terminal Services setup. The point is this is a flaw in a kernel system call and IE's use of this system call + default settings makes it vulnerable to exploitation.
Re: (Score:2)
Did you read my original post?
Whether it's sensible engineering to have the kernel handle this stuff is probably a far more interesting and valid argument.
Re: (Score:2)
It would be deeply, deeply wrong if IE was the only way to get infected. The vulnerability [vupen.com] is quite interesting -- it can be invoked by crafting a special Embedded OpenType (EOT) font file, which then exploits a vulnerability in kernel mode driver that parses font code. So you can be exploited using Microsoft Office, Wordpad -- anything that can display EOT-embedded fonts. All you have to do is open a document containing the offending font. Of course, IE is easy to exploit because all you need to do is put
Re: (Score:2)
Note that Windows 7, in which most drivers are back in user space, is not vulnerable to this exploit. Killer reason to upgrade, imho. This is also the reason most video driver crashes don't crash Windows 7 -- the display is simply re-initialized.
This seems like a no-brainer, but they must have had some reason for putting all those things in kernel space before. Perhaps performance? But isn't the Win7 performance better anyway?
Re: (Score:3, Informative)
NT 3.x supported user-space drivers and was criticized by reviewers for poor graphics performance (especially those who wanted to run visualisation/CAD apps on it). But it was rock-solid, as you can imagine.
NT 4 introduced kernel-mode display drivers, which helped it become very popular with engineers who needed these apps (remember, the only other 'mainstream' OS on the market at this time was Win95/98 and System 8/9; NT was rock-solid by comparison and Linux didn't have many commercial apps at this time).
Re: (Score:2)
Turn in your geek card. The integration began with IE 4 and the active desktop feature in Win98. At that point, we were screwed, blued and tattoo'd by MS.
That's shocking! (Score:3, Interesting)
They thank someone from Google for helping them spot the vulnerability! It's in the acknowledgements:
http://www.microsoft.com/technet/security/Bulletin/MS09-065.mspx [microsoft.com]
Re: (Score:2)
They thank someone from Google for helping them spot the vulnerability! It's in the acknowledgements
They always do that. It is in Microsoft's interests to publicly acknowledge the people who send them security reports because they want to encourage people to do that. It is preferable to what happened in the recent story [slashdot.org] where the guy posted the bug in a blog rather than telling them directly.
The accepted practice is to privately tell the company about a bug and give them time to fix the problem before posting about it publicly.
It's Still Windows (Score:3, Insightful)
No wonder my home system was such a dog this morning. It was pulling the latest patches and updates.
Meanwhile, it's still Windows. There's only so much improvement you can make when the manufacturer insists on packing so much into the "kernel." I was always taught that the OS kernel is the one piece that provides the interface between all software and all hardware. File systems, GUIs, internet browsers and lesbian Pr0n are all just forms of software that should be clients to the ultimately optimized but minimalist kernel.
Re:It's Still Windows (Score:5, Informative)
So in trying to bash Microsoft you're saying that Linux sucks?
Linux is a monolithic kernel. Windows is a hybrid kernel. Linux puts a lot more into kernel mode/real mode than Windows does. Many drivers in Windows are user mode drivers, for example, particularly printers. The only thing I can think of that runs in kernel mode in Windows and not in Linux is the graphics system -- which is why the screen flickers and changes resolutions slower in Linux and Windows tends to run full screen games and video better with DirectX, but it also rarely brings the system down... not that a system you can't get desired display output from is useful entirely.
Parent
Re: (Score:2)
Oh come on now, "hybrid" kernel is nonsense marketspeak; all the high-level services such as networking and filesystems and drivers run in the same address space. How they chat to each other is irrelevant here, NT is a monolithic kernel. And what the hell is a configuration database, the Registry, doing as a kernel service? And then there's GDI etc. --- (up until recently used to be) a kernel service.
No, that was me (Score:2)
No, that was me, driving my Mac Truck(tm) Lorry Load(tm) Malware Package through the gaping holes in your operating system. The patch you think you applied is just a little eye-candy to make you feel all warm, snug, and safe. It's working. too. :-)
Would the big customers know more? (Score:5, Interesting)
But while Storms speculated that Microsoft knew the EOT font flaw was a security issue -- and waited until now to patch older Windows -- Lai thought that Microsoft didn't realize until recently that it was also a security vulnerability in editions prior to Windows 7. "I think they fixed this bug as part of the code sanitization during [Windows 7's] development cycle. It was actually only publicly disclosed recently, and then they patched it in other Windows
The article is speculating what did Micrsoft know and when did it know it etc. Microsoft's standard line defending its security through obscurity policy is, "we are not providing any details because it is going to help the hackers". But what about its big customers? Almost all businesses do not care much about its small customers. So forget small timers. But Microsoft has to coddle its big Fortune500 company customers. Would they be informed, even under confidentiality agreements and non disclosure agreements, which platforms and applications are vulnerable?
How do these big companies justify being so meek and acquiescing to Microsoft? If these Fortune 500 companies chip in 100,000$ a year, they can create an Institute of Software Interoperability and go towards reducing their switching costs. Microsoft has total revenue of more than 25 billion dollars, and a significant chunk comes from these big companies. They pay off has to be enormous for these companies.
Fourteen? (Score:5, Funny)
So sore.
and what, pray..... (Score:2)
Seriously tough, I think that when people choose to use a browser that messes with system internals above other browsers that are NOT messing with the kernel, they get what they ultimately deserve. I remember a particularly buggy period that really had me going definitely over to Firefox: whenever IE crashed, I had to reboot. With firefox, killing the program would su
Mac, Linux, anything but Microsoft (Score:2)
Re: (Score:2)
The primary vulnerability was mitigated by using Firefox and Open Office. The drive by needs IE or Powerpoint or Word to execute.
Re: (Score:2)
Re: (Score:2)
And yet, Apple's default browser Safari has a pretty terrible security record, the latest OS X release contained a bug that nuked account data, and OS X consistently falls behind both Linux and Windows in defence-in-depth security mitigations. While Apple might like to boast about its operating system security, this doesn't appear to be due to any particular "hardened" design versus other mainstream operating systems and in fact lacks solid implementations of various security features that have been standar
Re: (Score:2)
snow leapard has been out for 2 months and service pack 2 has just been released. the fixes are for some pretty obvious stuff that should not have made it past QA like the Flash performance issues.
OK, just a second now... (Score:3, Interesting)
'Anyone running IE [Internet Explorer] is at risk here, even though the flaw is not in the browser, but in the Win32k kernel mode driver.'
Why aren't users of other browsers on the older Win platforms vulnerable? Is there some other risk or problem that is being ignored or even concealed?
Man, I can't believe I got that out without laughing...
Re:OK, just a second now... (Score:5, Informative)
I discovered this bug (check the credit section [microsoft.com] in the advisory), so can explain. The bug is in parsing a component of TTF files, which are handled by the GDI kernel subsystem in Windows. Anything that tries to load fonts can be used to exploit this vulnerability, as they will eventually reach this code, Internet Explorer just happens to be the easiest way to reach it remotely.
Other browsers _are_ affected, the difference is that there's only one level of indirection before the vulnerable code in Internet Explorer, and at least two in other browsers. This is because IE supports EOT files directly, which via TTLoadEmbeddedFont() are decoded and passed straight to GDI, where as other browsers take a TTF input, convert it into an EOT and then pass that to TTLoadEmbeddedFont, so you have to convince three different chunks of code your input is valid (the browser, t2embed, then gdi), instead of just two in IE.
If you use any browser that support @font-face on Windows (Safari, Firefox 3.5+), you should still patch and reboot.
Parent
Legal generalization: (Score:2)
Anyone running IE [Internet Explorer] is at risk here,
That statement is still true, even when the rest of it is missing. ^^
Then again, what does it give us, to help those, who were chosen by natural selection, to be punished?
Wouldn't it make more sense so block all packets coming from IE users?
Use the drive-by hole, to put a trojan on those systems, whose only purpose it is, to block all outgoing traffic, except Microsoft servers and their DNS mappings, until the system is updated. If the system is updated, the trojan restores everything, and deletes itself.
I
Why only MS patches... (Score:2)
Re:And the others? (Score:4, Funny)
They're not fixes. They're just there to introduce more vulnerabilities that will "encourage" people to shift to Windows 7 ;)
Parent
Re: (Score:2)
Sir, thank you for a good Huxley quotation (your sig).
Re: (Score:2)
Not sure the real level of facetiousness here, but I think that's a pretty insightful comment.
In what way? They just fixed bugs all the way back to Windows 2000. That says to me that there is still life left in the old OS yet. If they wanted to encourage people to upgrade, they wouldn't back port all of the fixes.
Re: (Score:3, Insightful)
Not fixing would backfire. Would you buy a product from a company that totally abandons the existing product as soon as they release a new one?
Re: (Score:3, Insightful)
Dude. Yes I'm talking even tho I said I wouldn't but I've been thinking about this a lot.
Don't you wonder *why* you upset *everyone* every time you talk online? Think about it. You are the one who is acting like a troll. A quick google of your name (which I did because you called a slashdot account "easily trackable", even though I don't use this name anywhere else, but you have registered APK accounts all over the place, plus I found your email address and physical mailing address) brought up several threa
Re:And the others? (Score:5, Informative)
What about the fourteen other fixes?
The article talks about them at the end (on the second page):
Microsoft also issued critical updates for Vista and Server 2008 [microsoft.com], as well as for Windows 2000 Server. On the latter, which harbors a bug in its implementation of the License Logging Server [microsoft.com], a tool originally designed to help customers manage Server Client Access Licenses (CAL), Storms urged users of that aged operating system to apply the patch pronto, even though the machines are probably well-protected.
"Windows 2000 Server has the logging server enabled by default, but those systems are likely behind multiple firewalls, and people running [Windows 2000 Server] are pretty cognizant of the fact that it's an older version and will act accordingly."
Excel and Word also received patches today. Eight vulnerabilities were addressed in Excel in MS09-067 [microsoft.com] and one in Word with MS09-068 [microsoft.com]. Both updates also affected the Mac editions, Office 2004 and Office 2008.
For more info, check out the top six listings here [microsoft.com].
Parent
Re: (Score:2)
And they say AI isn't ready for real-world applications yet. pfft.