Microsoft Releases Super-Secure XP to US Air Force 507
Wired is reporting that Microsoft is releasing the most secure version of Windows XP ever created, but only if you are the US Air Force. "The Air Force persuaded Microsoft CEO Steve Ballmer to provide it with a secure Windows configuration that saved the service about $100 million in contract costs and countless hours of maintenance. At a congressional hearing this week on cybersecurity, Alan Paller, research director of the Sans Institute, shared the story as an template for how the government could use its massive purchasing power to get companies to produce more secure products. And those could eventually be available to the rest of us. Security experts have been arguing for this "trickle-down" model for years. But rather than wield its buying power for the greater good, the government has long wimped out and taken whatever vendors served them. If the Air Force case is a good judge, however, things might be changing."
Autorun? (Score:5, Funny)
Now i see why they disabled autorun. :D
Re: (Score:3, Interesting)
Maybe so. And while "the most secure XP ever" might not be that secure in absolute terms, I'm sure it's still a step forward. So even if the choice might not be ideal for the military, it really helps the average consumer (and I suspect that security wasn't the Air Force's primary concern - they just wanted to spend less on the patching treadmill). For once, I'm happy with my tax dollars at work.
Re:Autorun? (Score:5, Insightful)
Re: (Score:3, Informative)
Modded troll by people who don't get security.
99% secure is 100% insecure.
It doesn't matter if there are 85% less vulnerabilities than before. The fact that there are still 15% left means a targeted attack will still succeed!
All it takes is a single vulnerability, and you're security is useless.
Stop using the troll mod as a replacement for either:
"That makes me uncomfortable."
or
"I don't understand that."
Re:Autorun? (Score:5, Funny)
You're security is useless?
ARRRGGHH!
Apparently, so is my grammar.
See? Piss me off, and I can't spell.
That must be my superhero weakness....
STEEL DOOR! (Score:3, Funny)
Meet GRASS HUT!
Re: (Score:3, Insightful)
Next up: Why we don't lock our doors, because thieves might happen to carry lockpicks!
After all, locks are not 100% secure, therefore, that security is totally useless, right?
Re:Autorun? (Score:5, Insightful)
Re:Autorun? (Score:5, Funny)
Wow, that needs to pass into our lexicon. "Bucket XP".
Re:Autorun? (Score:5, Funny)
I think something like it is already there.
I hear "bucket, it's XP" all the time around my office.
What do you mean "you need to get your ear-ring checked?"
Re:Autorun? (Score:5, Insightful)
Personally... If I'm being forced to patch a rusty old bucket, I'd rather start with the one that 85% less holes...
Re:Autorun? (Score:5, Insightful)
Computer security is the same way. You *can* cracl WPA(1/2) encryption, but if you neighbour has his connection open (or is using WEP), you are not likely to become a target.
The exception, which appears in this situation, is when you are chosen as a target due to a high payoff (military). In this case, simply being harder than your neighbour is NOT going to help you.
Re:Autorun? (Score:5, Insightful)
Exactly, locks (unless you pay a shitload for them) are not designed to keep people out. Any locksmith will tell you that the only thing a lock will do is make your neighbours house an easier target.
Arguably, an alarm system is more important in keeping people out than the lock on the door. If they kick down the door and a message goes off that lets them know that you know they are there and that the police are coming shortly, they usually won't stick around that long.
Same thing applies to computer systems. It is more important to know that you have an intrusion as soon as possible than the actual prevention of the intrusion.
Not that you want to leave the door unlocked, but rather you need the ability to lockdown and detect when someone is there when they shouldn't be.
Re: (Score:3, Informative)
It depends, physical security and data security are not always comparable in that sense. Yes the obnoxious alarm and police being on the way is a problem if you need to load up 50" tv and stereo into your van while fending off the dog.
The computer paging the owner on the other hand might not be a problem. If what I want is your identity and you have a fast connection I could copy an awful lot your how directory before you could even get to a keyboard to the machine to see what is happening, or shut it dow
Re:Autorun? (Score:5, Insightful)
I disagree. Security is a layered thing, both in implementation and subversion. If I'm running Windows NT with no service packs and no firewall, I'm easily hacked by 90% of people.
If I'm running Windows XP patched and firewalled, I'm easily hacked by 1% of the people. If I'm running OpenBSD fully patched with no open ports aside from SSH, I can be easily hacked by .01% of the people (likely a BSD or SSH developer who slipped in a back door).
Nothing is 100% secure -- HOW secure you are is the important thing. If this super XP lets in 15% of attacks, you need to ask who knows and who would bother to run those attacks, as well as what other layers of security beyond the desktop are available.
If you're running a desktop operating system "in the wild" with no patched firewall software of any kind to block basic traffic, then you should add that layer.
Re: (Score:3, Insightful)
Nah, doesnt really work that way. With tens of thousands (or is it hundreds of thousands as I read someplace else?) of these exploits out there for Windows XP, being secure against 85% isn't saying much. Compare that to the number of exploits out there for OpenBSD (times) .01% (times) the number of possible attackers (which will give you a fraction of an exploit).
Yes, nothing is secure, but 85%/15% is not a good ratio when compared with the number of exploits times the number of already exploited machines
Re:Autorun? (Score:5, Funny)
The exception, which appears in this situation, is when you are chosen as a target due to a high payoff (military). In this case, simply being harder than your neighbour is NOT going to help you.
So, what you're saying is, we need to let our economy keep tanking until people would rather hack into Canada?
-Taylor
Re: (Score:3, Insightful)
The best known attack against WPA2 is a bruteforce attack. The basis of WPA2 in PSK mode is a 256 bit AES cipher. The key is based on both the password and the SSID (the SSID acts as a salt).
WPA2 with a good password is a perfect example of a truly secure protocol. If you started to crack my home wireless network you might finish around the time that the run is running out of fuel and certainly long after humanity has either evolved to something entirely unrecognizable
Re:Autorun? (Score:5, Insightful)
Holding out for absolute perfection, I see. Let me know when you find it. I'm stuck here on planet Earth where nothing is 100% anything.
Re: (Score:2)
In the case of random attacks, you're right.
But this is the military we're talking about. Pretty much 100% of their attacks will be targeted.
Nothing less than 100% secure will do.
Is it possible? No. But it's certainly possible to get a hell of a lot closer than "85% less holes than regular XP!"
Cat out of the bag...? (Score:2)
Next up, the Army and Navy. After that, government agencies ... finally, big businesses and the public.
Re: (Score:3, Interesting)
Next up, the Army and Navy. After that, government agencies ... finally, big businesses and the public.
Yes, so we will be able to buy XP instead of the best and most secure OS, Vista!!!!!
I think that this is the best own goal ever done by MS in its long life, on two counts. first, they are saying that XP is arguably more secure than vista. second, they are saying that while all organizations are created equals, some are more equal than others. Why is it that i cannot buy XP anymore, while the Air force can?
So, I do not think that "big business and the public" will ever be able to buy that. Never. not eve
Re: (Score:3, Informative)
Where do you get that they are saying XP is more secure than Vista? Another angle to consider is the one that the Air Force has been running XP for a long time and all of their applications are coded to work with XP. Microsoft took the smart route and improved what the Air Force already had instead of forcing them into an upgrade. Vista very well may be more secure than XP, and Windows 7 might be more secure than both of them.
For as long as I've been using computers, I've hated the forced upgrade cycle t
Re: (Score:3, Funny)
I'll be truly impressed (Score:5, Funny)
When the navy puts windows on their ships.
Re:I'll be truly impressed (Score:5, Funny)
http://gcn.com/Articles/1998/07/13/Software-glitches-leave-Navy-Smart-Ship-dead-in-the-water.aspx?p=1 [gcn.com]
i know feeding the trolls - but he wanted to be impressed
Re: (Score:3, Funny)
i know feeding the trolls - but he wanted to be impressed
You mean -- he wants a squad of royal marines marching behind a drummer boy to haul him out from behind his plough, slip the King's shilling into his pocket when he ain't looking, then send him off to see the world with His Majesty's Navy?
Well, it takes all kinds I guess.
Re: (Score:3, Informative)
it wasn't a Whooooosh.. it was truth.. and if you read it you would understand
Re: (Score:2, Funny)
Silly fool. The Navy has always had windows on their ships. Originally they ported them from British designs and called them "port-holes". What was really impressive was when they put windows on boomers. Admiral Nelson designed the Seaview around its Herculite(tm) bow windows.
I would just love to see... (Score:5, Funny)
...what they did to make it secure. Is the default wallpaper black with a big picture of a lock on it?
Re:I would just love to see... (Score:5, Funny)
A subtle point (Score:5, Insightful)
"Having the most secure Windows ever" does not equate to having secure Windows.
Re:A subtle point (Score:5, Funny)
Re:I would just love to see... (Score:5, Interesting)
Re: (Score:2)
In Military Speak:
Re: (Score:2)
Now, in the Parent's defense, he wasn't being a troll, just very obvious. Someone feel free to fix that.
Re: (Score:3, Informative)
In Windows XP Embedded, you can choose which components to install, on a significantly more fine grained scale. For example, you can leave out Windows Explorer (i.e. the icons on the desktop, task bar, and File Management tool (the my computer window, etc)). I'm not sure quite how fine grained the driver selection is, but it is still far more fine-grained than tradition XP installations. You can definitely leave out unused network stacks, etc.
But for some reason few people seem to be aware of it, or choose
Re: (Score:2)
ha! mine is blue with white text
Re: (Score:2)
Is the default wallpaper black with a big picture of a lock on it?
I'm betting it's blue and has a big picture of a devil on it. [wikimedia.org]
Re: (Score:2, Funny)
...what they did to make it secure.
They changed the EULA to the GPL.
Re: (Score:2)
Re: (Score:2)
No they just made an XP theme and boot screen for OpenBSD.
How to secure XP (Score:5, Funny)
Re: (Score:3, Funny)
Re: (Score:2)
i remember at a PC shop i worked at we had legit copies of 98se come in with a virus infecting one of the files already on the disk.
while our MS Sales rep was very quick to replace them we kept one and taped it above the time clock.. just as a reminder that no mater what we do we are all doomed
Re:How to secure XP (Score:5, Insightful)
In all seriousness, I'd imagine usability is likely the reason this won't see a public release -- "really secure" and "really easy to use" aren't necessarily mutually exclusive, but you can bet they sacrificed the latter for the former in this case. I'd fully expect application compatibility to take a serious hit, and for many Windows features to be cut entirely.
This product is probably unusable for the average consumer. I'm sure there are some enterprise contexts in which it'd make perfect sense, though.
And of course, Microsoft doesn't want to dilute Windows Vista/7 sales with a new edition of XP (which they'd have to support for years) either.
Most secure ever?! (Score:2)
Next will be Windows 3.11 (Score:2, Funny)
Next most secure ever release for US army will be Windows 95, then Windows 3.11 and at the top of security development ever will be release of MS DOS 1.0.
If... (Score:2, Interesting)
Re:If... (Score:5, Insightful)
Re: (Score:2)
If they can make it more secure, why don't they offer everyone the secure version?
They did - it was called Vista - but users complained that it is annoying to have to click "Allow" every time a trojan asks to get installed, so it didn't quite work out.
It's not a new version, it's just a configuration. (Score:5, Informative)
'The Air Force, on the verge of renegotiating its desktop-software contract with Microsoft, met with Ballmer and asked the company to deliver a secure configuration of Windows XP out of the box. That way, Air Force administrators wouldnâ(TM)t have to spend time re-configuring, and the department would have uniform software across the board, making it easier to control and maintain patches.'
So if you'd like to do it yourself, you can secure your XP too.
http://nvd.nist.gov/fdcc/fdcc_faq.cfm [nist.gov]
I'm not sure super secure is the right word for this version of XP though, given that there are a lot of security features it is missing that Vista, Windows 7 and some other OSes have.
Re: (Score:2)
Re: (Score:2)
That's fine for corporations where people are paid to configure systems. However, Joe Consumer who doesn't know anything about enabling components or disabling services will find such a system completely unusable. It no longer will "Just Work".
Maybe Joe / Joan should just learn rather than expecting everything to just work. Or they should pay for the privilege of remaining ignorant and get someone else maintain all the computers they need to use. At least if you disable everything by default it forces them to make this choice rather than currently where they get to just blame everyone else when their identity gets stolen.
Re:It's not a new version, it's just a configurati (Score:5, Insightful)
Re: (Score:2)
Wow
MS is probably holding the air force hostage (Score:5, Interesting)
Re: (Score:2)
Re: (Score:2)
I think in these rough economic times our government needs to really start exploring more OSS/free solutions out there.
Great point - think how good for the economy it would be if the gov't stopped buying commercial software altogether! Thousands of developers/QA/etc would soon find themselves out of jobs, and able to contribute to open source projects all day long while collecting unemployment!
In other news . . . (Score:3, Interesting)
The Air Force has yet to explain who, if anyone, authorized the bombing of a Redmond, WA software company by a squadron of B-52s.
how is this diffrent... (Score:2, Insightful)
AF Standard Desktop Configuration (Score:5, Interesting)
While this was an interesting article, the XP and the Vista versions used by the USAF are the same ones used by the general public. The only differences are the security setting, the firewall configuration, and the user configuration. No one is an admin unless they need to be, and no normal day-to-day work is done in admin mode (same thing you do in Linux, no doubt).
I didn't know this article was going to be published, but when I found it, I was not surprised by the comments. I've been working on this program for more than 2 years. Users hate it. Developers loathe it. Network security staff loves it.
Nothing can make Windows (or any other OS) completely secure if it's connected to a network. This is as close as the federal government as ever come.
Re: (Score:2)
Which means the Air Force probably got it right.
diversity is fantastic protection (Score:3, Insightful)
The airforce and the military in general would do well not to create a monoculture; especially not one based on an arguably insecure operating system that is nearing its end of life. Despite the existence of *nix alternatives that are of comparable ease of use and generally superior security and customization, the military continues to insist that using an old operating system full of flaws and actively exploited by the vast majority of malware is suitable for government use. There is something very wrong here.
Re: (Score:2, Interesting)
oh yes, we definitely don't want a monoculture. Please make sure the poor 19 year old airman who barely knows how to install a driver in XP now must know how to do so on a Ubuntu box, a Macintosh, XP, Vista and for the hell of it, a couple Win 3.1 boxes 'just in case'. And pity the poor sergeant who is given a Powerpoint presentation by the general and has to figure out how to make it work across 4 different versions of Office, OpenOffice, etc.
But at least we'll know when we get hacked that only part our
Really? (Score:2)
No shit Sherlock!
Security measure (Score:2)
Don't tell me! They removed the floppy disk drive - yes?
You too can have your own "Super-Secure" XP setup (Score:5, Funny)
( Also, is it just me or does the "XP" after "Super-Secure" look like a smiley representing someone laughing their guts out? )
jdb2
heres a demo (Score:2, Informative)
Win7 RC1 is out and the AF just secured XP? (Score:2)
Re: (Score:2)
NASA doesn't use bleeding edge technology, but you want our national defense system(s) to be running on it? Someone promote this man to a government military buying agent!
oh yeah! (Score:2)
OK, as if, anyone smell BS here, like I do?
Here is a link to a story of how the Air Force wanted to create a wrold botnet to control and send cyber attacks should they need them for global scale cyber warfare.
http://tech.slashdot.org/article.pl?sid=08/05/15/1654235 [slashdot.org]
My guess is, it was easier to get M$ to bend and rewrite certain things that would allow the Air Force to backdoor into systems, and create a buzz, saying that we now have the best and most secure version of XP EVER!, Because we bought it so much,
Re: (Score:2)
sorry typos.... ...should read
> and close the image
> clone the image
Sane defaults (Score:2)
Can anyone explain why a company with the manpower and wealth of Microsoft can't just ship XP with sane security defaults out of the box for everyone else?
This is the 21st century, right?
Most secure version of Windows XP ever... (Score:2)
that's not really saying much.
85 percent of attacks were blocked (Score:5, Insightful)
Now lets rephrase that; 15% of the attacks were still successful after a complete lock-down configuration was applied and lots of manpower went into burning custom installation disks and procedures. Is it just me or does anyone else see a problem with this?
Re: (Score:3, Interesting)
This is way beyond a "stock" system...
Okay... I'd still like to see the stats for a fully patched stock system before I say "Oh, this isn't worth the effort."
But it still completely fails to protect the host against 15% of the *known attacks* in the wild?
Do you have a comprehensive list of those attacks? I know that I don't.
How many of those attacks are software keyloggers? There's not a whole hell of a lot that you can do to protect against that.
How many of them are hardware keyloggers?
USB or FireWire DMA memory access sploits?
We need details before we can pass judgement. Until we have these details, this "report" is just some MS PR flack
Screenshot (Score:2)
Makes sense (Score:2)
So, if you're an organization with a lot of guns and airplanes you can get a better deal from MS?
Simple (Score:2)
super secure sudo (Score:2)
Is there any way of scripting this und
no video... (Score:2)
I was hoping to see Balmer yelling "Gilligan!" and hitting him with the little plaque.
Microsoft lobbying vs. US Air Force (Score:2, Funny)
And the US Air Force lost this fight.
Federal Desktop Core Configuration (Score:2)
Oxymoron? (Score:4, Funny)
>> the most secure version of Windows XP
Isn't that an oxymoron? Kinda like dry water?
dead right (Score:2)
Re: (Score:3)
It is probably a case they have a lot of Windows Apps that need to be ran, and it is cheaper to get Microsoft to secure windows then to report their products to an other OS (Who really isn't that much more secure anyways) try to get resources to secure the Open Source OS to an acceptable levels, (Or find out how to configure OpenBSD to do what you want) then pay to report all your apps and retest and security check them all again.
What the air force is doing is Replacing the Doors/Windows and Locks from the
Re: (Score:2)
An AF-only Windows only has to support AF-approved apps.
That makes creating a 'more secure' Windows much easier, because you can eliminate a ton of 3rd party stuff. But the public will not accept such a restricted system.
addendum (Score:2)
Seriously though, if the government purchased software from companies other than Microsoft, we would have much better competition in the marketplace and better alternative software.
Re: (Score:2)
From where? If other companies produced software that did as much as the stuff out of Redmond, they might.
The combination/interoperability (on an enterprise level) of Windows|Exchange|Office|SharePoint|ActiveDirectory|SQLServer is pretty hard to beat. Even with all the MS holes.
Show us another OS as the base where I can build all of that. Now convince me to rebuild the thousands of the tiny office level apps (Excel/
Re: (Score:2)
"Stop purchasing Microsoft products. Duh."
The military of all customers is in the ideal position to do this.
Back in The Day when all we had were green screen Unix terminals, life was simple and users didn't break the system.
Conversion is merely of giving orders to people who obey them. The military should select more secure, Open alternatives which it can tweak and control, then order users to change.
Re: (Score:2)
Everyone whines about security, then they get it and they whine about having to click "allow" or "accept" on popup boxes.
But that's not security, it's annoying and it reinforces the bad habit many people have of clicking"Yes / OK / Allow" on every dialog they see.
Re: (Score:2)
Yup. Whether it's computer security, physical security, communications security - the more secure you are, the greater a pain in the ass it is. Whether it's checkpoints or check boxes, there's a balance between security and usefulness, and where the balance point lies varies greatly.
Re: (Score:2)
The BSOD joke stopped being funny when Windows 2000 was the OS to have (Unless you were subjected to ME. If so, I pity you). XP was solid. 2003 was solid.
Yes, once Windows 2000 came out there was never BSODs ever again. Oh wait... [gizmodo.com]
Re: (Score:3, Insightful)
let's see, Windows on hospital equipment recently got Conficker because Microsoft no longer provided security patches for Windows 2000 and NT. I'm now wondering how long the British Navy thinks these subs will last and how they'll deal with unpatched Microsoft operating systems running the show when Microsoft stops feeding them patches?
Hey USAF! If you can't see the source code and see the patches for later versions, you can't have any hope of securing the system in the long run. You're only hope for securi
Re:I bet the british wished they had this... (Score:4, Informative)
let's see, Windows on hospital equipment recently got Conficker because Microsoft no longer provided security patches for Windows 2000 and NT.
Uh, no. The MS08-067 patch that addresses conficker was released for Windows 2000 at the same time as all the other OSes, with the exception of NT. http://www.microsoft.com/technet/security/Bulletin/MS08-067.mspx [microsoft.com]
Re:I bet the british wished they had this... (Score:5, Informative)
let's see, Windows on hospital equipment recently got Conficker because Microsoft no longer provided security patches for Windows 2000 and NT.
Extended support for Windows 2000 doesn't end unitl July of 2010. The patch that fixes the exploit on Win2k is here [microsoft.com] if interested.
As for NT, the long term support ended over 5 years ago.
Re:Obviously this can't work (Score:5, Informative)
Users are free to configure their systems for higher security. Note that doing so may limit functionality you are used to. For example, you can configure your system so that all users run as normal users (no administrative functionality). Running users as normal users is part of all security guidance. Not all XP software will run if you do this. You can set IE to high security mode by default and disable Flash, etc. Doing so breaks much of the web but is more secure. You can get security, but it will impact your user experience.
It is easier to secure Vista and 2K8 server systems.
security program manager at Microsoft (Score:5, Funny)
I wouldn't mention this on your next job application
Re: (Score:2)
I think they should fix all problems with their software before selling it
You obviously don't know the first thing about software development.