How long before MS deals with these issues?

I found this link to eEye's Upcoming Advisories on Full Disclosure. This highlights the issue of patch mechanisms and releasing info on known exploits. Certainly the present patch system isn't working (and MS' particular method of announcing a week beforehand that a patch will be released strikes me as nothing more than marketing).

To me, there are two issues here: disclosure of known problems and the patch process. I personally believe in full disclosure (the concept) as it makes admins more aware of problems and should, for the most part, help them pay attention to risks. The second issue is one that I truly don't know what the answer is other than perhaps expanding MS patch team. Evidentally, they do not have enough power if it takes more than 3 months (6 months for the most recent ASN vuln) for them to put out solutions to help secure/fix systems.

Maybe it's just me.

Microsoft's major problem is that they no longer think like customer's. In doing this, they have made the mistake of assuming that what they offer to people, they will automatically want. Marketing is only half-doing its job: That is, it is just finding out what people want NOW.

What they SHOULD be doing is finding out what people need, and what they'll want and need before they need it. As long as Microsoft plays defense in this way, and always reacts instead of acting, they will never achieve their full potential.

That is one of the main reasons that Linux and other open source OS's/software is doing as well as it is. It is directed fully by the people's needs and desires, with no real concern for marketing, with the occasional exception. (Although even Red Hat is somewhat returning to Open Source, with the release of Fedora.)

But what do I know? I'm just an under-grad CS student.

Let's look at this logically for a moment. Microsoft is a company. Okay, with that being said we really should give them enough credit to know what needs to be done properly. Why? Because customer service isn't a trade sercret, it is an accepted standard.


Thus, I'm betting MS knows full well what is going on and could in fact release patches MUCH sooner, but there is something internal going on. It isn't external and dealing with us, I would bet money on it. We can't preassume that the MS coders are dumb, because look at the windows OS, thus I bet it is quite possible they could fix a patch in a heartbeat.... if it wasn't for internal affairs, permissions, manager setbacks.

In short, what I am trying to say is that I am quite sure MS is well aware of it's situation and of customer appreciation. But that there are internal affairs at work hindering the process the employees are doing to fix and release patches. Tons of hoops to jump through I'm sure that only come from internal bad management.

I mean, let's be serious here. It isn't like their patches being slow are a secret, I'm sure they know but something we can't grasp or take into consideration is that something may be hindering them unseen to us.

Imho, the subject of full disclosure will always be a difficult subject. On the one hand i believe what msmittens say's is a very powerfull argument for full disclosure. On the other. Releasing known vulnerabilities goes against one of the main security related ethos's of need to now . Does Joe public need to no every issue that is found. Anouncing a problem must put dangerous information in to the hands of dangerous people. Who otherwise may have to go look for this information, thus giving the people whos job it is to fix these problems time to find a fix.

To give you an example of the need to no ethos. I was a miltary radio opperator for some years, one of the pieces of equipment i used was known by three letters. As i did not need to no what those three letters stood for and only how to use the kit i was never told what those three letters stood for. I did find out in the end but it took nearly six years.

Ok so that shows a level of paranioa but does show how effective need to no can be. I also exept that this type of ethos can hinder investigation when problems are found. But then i did say it was a difficult subject in the begining.

Just a few thoughts.

Jinxy.

Joe Public? Joe Public is no threat if he gets his hands on information that is already available to everyone else.

Let's be honest here, sysadmins will be paying MUCH closer attention to this information that Joe Average will be, and occasionally we might get another MSBlaster. When we do, the vulernability has been known about for quite some time, the then old patches are in place, and there's nothing to worry about, except for a few minor exceptions.

The real problem is when Microsoft acknowledges these problems in a very minor way that is rarely recognized largely, but just picked up by a few admins and the occasional worm writer. THAT's where the problem comes in, IMHO.

Also, while it WILL increase the danger because more vulnerabilities are known, I am sure that it will also make things much more secure by the same token. I believe that over-all, life would be safer. There'd atleast be the "I told you so stance."

Sun Tzu, I see your point, but that's still a short-coming of Microsoft that they could have, and should have, over-come by now. Exchanging one short-coming for another doesn't really matter, there's still the flaw.

"Just because its better doesn't mean its perfect."

Hello,

I am extremely frustrated by the vagueness of the language "may allow an attacker to execute code remotely".

So what kind of "code execution" are we talking about? How far into my PC could someone penetrate when exploiting a hole like this? I mean could these holes offer the ability to someone to read all my files? Create user accounts and gain remote access? Or are we talking stuff more on the level of annoyances, such as the NTAUTHORITY restart glitch, msblast, etc? Things like that?

I can't seem to find a clear and straight answer on exactly what capabilities or access - at a user, program, or file level - this kind of a hole gives a potential attacker.

Could someone clear this up or point me to a URL with info?

Thanks!

I disagree SonofGalen. And allow me to explain.

Quote:

---

1. Exploit is find by MS and published

2. Thousands of kiddies boot up VB and write the next worm/exploit automagic script

3. ???

4. Hell breaks loose again

---

Or, perhaps they see it like this, which actuall works:

Quote:

---

1. MS finds an exploit (or bugtraq) but doesn't publish full information. And since they are the only ones with full information, the finer details are left out.

2. Kiddies sit back and continue using old programs for older exploits out a few years ago.

3 ???

4. No one gets hurt because the finer points are removed from the scripties accessable toolkit.

---

See what I am saying? While yes there will be people out there that can penetrate and make use of the exploit because of their skill level, they are not the majority. Script kiddies are. Thus, by eliminating that extra bit of information until a good patch is released they can ward off the kiddies. I see your point as well, but sometimes will call for STRAIGHT foward information while others need to be kept away from public's view. And I agree, it is an MS flaw, but we should at least be aware of the correct flaw :)

Quote:

---

Originally posted here by vibronic

I am extremely frustrated by the vagueness of the language "may allow an attacker to execute code remotely".

So what kind of "code execution" are we talking about? [/B]

---

When patches are released, there is an option to read about the entire patch just to the left of "add to list". It will give a full summary of what is wrong, how it is an exploit, and how the patch fixes that. Finding information on specifics before the patch is usually difficult because MS holds those finer details, as I explained above.

Pooh, I have to disagree with this:

Quote:

---

1. MS finds an exploit (or bugtraq) but doesn't publish full information. And since they are the only ones with full information, the finer details are left out.

2. Kiddies sit back and continue using old programs for older exploits out a few years ago.

3 ???

4. No one gets hurt because the finer points are removed from the scripties accessable toolkit.

---

This kind of logic is flawed because it assumes that ONLY MS found the exploit. What about the ones that do know and use it? Why not state what the particular flaw is and suggest a work-around until the patch is released? At least address it for those that will need to fix it because someone will get hurt. They don't need to release POC but at least state where the problem is so that if I want to defend myself I can. It's not Joe Public that has millions of dollars to protect (although Joe Public may be worth that as a group). It's the administrators who have to protect company image to the stockholders.

*shrug* Maybe it's just me. There is, however, still a flaw with the particular patch system (the Sapphire worm certainly brought that out when MS hadn't even patched their systems). And perhaps that is part of MS' problem.

Quote:

---

1. MS finds an exploit (or bugtraq) but doesn't publish full information. And since they are the only ones with full information, the finer details are left out.

2. Kiddies sit back and continue using old programs for older exploits out a few years ago.

3 ???

4. No one gets hurt because the finer points are removed from the scripties accessable toolkit.

---

It sounds to me like you're saying this is what they're doing now, and defending it. If this is the case, then it seems rather flawed to me. It seems fairly obvious that people are getting hurt, and "all hell" breaks loose anyway.

If they release all of the code, here's what I see as happening:

Quote:

---

1. MS finds an exploit and fully publishes all of the information.

2.1. Thousands of script kiddies find it and write VB code for it.

2.2 At the same time, hundreds of thousands of admins find it, patch for it and take precautions.

3. ???

4. Thousands of programs are released, and almost all of them are impotent. The ones that aren't are coupled with something else (not yet discovered), so it would have been dangerous anyway, OR they wouldn't really be a script kiddie.

---

If I'm missing something, please point it out. This is just my opinion.

It sounds to me like you're saying this is what they're doing now, and defending it.

That is correct. The reason why is because despite the information being publically figured out, there are no major side effects going on. Sure, the info and the notices and whathave you, but no large scale interruption to the system because of that exploit. Yes, there is a virus or two running around rampant but that only began once MS released their full security advisory on it.

So while I do see your point, I still see a valid "On an need to know basis". If the full details are withheld (and trust me, I dare someone to even try all of these scary exploits on me) then the kiddies can't get to it until a patch is released. Because if an exploit is fully published and a patch not released soon afterwards then of course the exploit will be taken advantage of. What does this mean? As in your above example you are assuming that by publishing their information that means they are also releasing a patch, and thus the admins patch while the scripties script. But that isn't how it works. MS holds information and does't release full exploit information until the patch is released. IF, in fact, they released all exploit information and then went to work on the patch.... the exploit would be across the board.

They learned this with their OOB on XP and 95. Don't disclose full information until a patch is ready, because it is *that* many less scripties trying to exploit a hole not yet fixed and fully understandable. :) Good conversation by the way. So while I agree with you on making it public information and releasing a patch, don't forget that MS won't release information until they release a patch. Good, Bad? Seems to be working, even if that means it is coming in slow :)

Shouldn't the senario read

Quote:

---

1. MS finds an exploit (or bugtraq) but doesn't publish full information. And since they are the only ones with full information, the finer details are left out.

2. Kiddies sit back and continue using old programs for older exploits out a few years ago (while MS come up with a new version of Windows)

3 ???

4. No one gets hurt because the finer points are removed from the scripties accessable toolkit (and by the time they figure it out there is already a new version of windows out for those customers who want to be "on the cutting edge" or "ahead of the security game")

---

To support PST's comments..

The smaller the army that attacks the better defended.. less informed the attacking army the better armed..

I am mixed about the announcment of M$ Bugs.. .. I like to know to help me defend.. But I don't want to many Blackhats knowing.. so as to reduce my potential for problems..


cheers

Quote:

---

Originally posted here by pooh sun tzu
They learned this with their OOB on XP and 95. Don't disclose full information until a patch is ready, because it is *that* many less scripties trying to exploit a hole not yet fixed and fully understandable. Good conversation by the way. So while I agree with you on making it public information and releasing a patch, don't forget that MS won't release information until they release a patch. Good, Bad? Seems to be working, even if that means it is coming in slow

---

Security by obscurity....Nice.

Seems to be working?

Not hardly.

Last nigh on TechTV, I watched as they interviewed the guys that found the hole. He said it was the worst voulnerability he had ever seen to date with Microsoft.

But then again, "This just makes Windows stronger because it is the most tested" ;)

****ing Bill Gates. What does he know about software, he was the one who came up with the whole "Sharing is bad" Idea in the first place. Thus some good came of it when people were like "Alright, **** you to then" and made GNU. I hate Microsoft as a company. I can't stand them. Windows, that's ok, for a desktop. But I still think Bill is an ******* caring only about money, and trying to live down that reputation that most cheerleaders also have (Being easy ;) )

So, while everyone runs around trying to update Windows, and stick up for Microsoft, I will sit here, on my Slackware Linux box, and get some actual work and play done.


Oh, almost forgot!


Look at this:

Quote:

---

Within the last few weeks at our company we have been doing testing to
find out total number of patched machines we have against the latest
Messenger Service Vulnerability. After checking few thousand computers
we have found several hundred were still affected even though patch has
been applied. We have scanned with Retina, Foundstone and Qualys tools
which they all showed as "VULNERABLE", however when we scanned with Microsoft
Base Security Analyzer it showed as "NOT VULNERABLE". This was at first
confusing; one would think an assessment tool released by the original
vendor would actually be accurate. On the flipside it really didn't make
sense to us why would three different commercial scanners show as vulnerable
if they are truly patched. So we decided to do the ultimate test. We
ran messenger service exploit against the machines that MS Base Analyzer
showed as "Not Vulnerable" and 3rd party vulnerability scanners that
showed as "Vulnerable". Results were as expected, machines were exploited
and Microsoft Base Analyzer failed to detect the vulnerable machines
properly.

We have concluded that, although the patch was installed on these machines,
the patch management script failed to reboot those few hundred systems,
therefore these machines were vulnerable until the next successful reboot.
After a successful reboot all 3rd party tools showed the machines as
not vulnerable and the exploit tool did not successfully exploit the
machines. 3rd Party tool assessments were accurate the machines were
truly vulnerable prior reboot.

Had we trusted Microsoft Base Analyzer we would still be vulnerable.


To prove this, I have captured screen shots and converted them in pdf
format for your viewing pleasure. The screenshots shows exact same scan
conducted with Foundstone tool and MBSA.

Screenshots: http://www.elusiveworld.com/scanshots.pdf


I would love to see if there are any more like us out there who encountered
this problem. If you had similar problems our recommendation to you do
not fully depend on MBSA, since the tool is just as buggy as the company
itself.

Questions comments email me at [email protected]
or Aim: Evilkind.

---

Nice to see how Microsoft also makes Windows seem more secure. ****ers.

I'm only going to respond to one part of your post gore, because the rest of it is trollbait and I simply won't bite.

Security by obscurity... nice

Security through means of obscurity is by all means a valid step towards security. By no means it is a singular solution, but that in conjunction with other security solutions is the only logical step. You can't set aside possible steps towards a more secure network just because of a coined phrase. If there is an extra step that will help, by all means use it, but not as a singular solution..

WHo's running around updating windows? It's a small patch, did my entire domain in about 3 keystrokes. ... Click Click Boom.

Windows is infinitely more complicated than linux, that's both parties strong points. Linux is very popular because of GNU, without it there wouldn't be a platform to stand on with regards to it's scale and popularity. I love em both.

Date Reported:
September 10, 2003

Vendor:
Microsoft

Description:
A remotely-exploitable vulnerability that allows anonymous attackers to compromise default installations of the affected software and gain the highest possible level of access (SYSTEM).

Severity:
High

Remote Code Execution:
Yes

Software Affected:
This vulnerability affects core services in the operating system.

Operating Systems Affected:
Windows NT 4.0 (all versions)
Windows 2000 (all versions)
Windows XP (all versions)
Windows Server 2003 (all versions)

Estimated Number of Vulnerable Machines:
300 Million

Status:
Patch in progress.


On this we’re talking about 154 days since its been reported. Well past the acceptable mark.

Its out there. It exists.

Now let us say you are the one who discovered it and that you’re extremely concerned about the security of the machines of others. I mean that’s your business. That’s what you get paid to do and you want to do it well. Your well aware there are many out there who are more concerned with finding things like this to satisfy a cult type herd instinct or are just plain criminals and are hard at work looking for the same things you are.

Someone else will find it if they haven’t already. Real black-hats, the one’s that make their living stealing info do not believe in full disclosure. It only closes doors that they have open to them. They are quite happy keeping it a secret.

Windows is not open source so how do you write a patch for it?

IMO your only recourse is to threaten to release it if they don’t fix it and you’d better follow threw if you want to remain credible. Lets face it ms is a corporation of the worst degree. If given an eternity that’s how long they’ll take.

Full-disclosure is a tool to protect us.

I think the point made here is that it shouldn't take M$ 6 (3) months to release a patch....

I can understand the concern of M$ - release q quick fix to a major problem and then have to relase the fix to the fix, and finally the fix to the fix to the fix :- This results in public ridicule - M$ must be cretins!

When *nix does it no one comlains since it's open source to start with and the developers aren't getting paid - So AFA *nix IC known vunerabilities can be published quickly and patched quickly without the worry that people will say "Now you've released a patch to a patch" .....

M$ have been slated, here at AO included, for this behaviour.

People need to grow up enough to allow M$ (and others) to make mistakes while trying to serve the best interests of their customers.

Then vunerability information can be released as it is known, with the sure knowledge a patch will be quickly available. Even if that patch isn't perfect, because soon a patch to that patch will be released.

All that is required is for everyone to stop ridiculing M$ for making mistakes, whilst trying to do the 'right thing'.

Today for fedora I've downloaded 12 new versions of parts of the system, all released in the last 48h.

Why - dunno - It never made the news, becuase that's the way it is. If that had been M$ there would have been an outcry!

Steve

steve if you think that keeping the fact that there are enormous holes in its security a secret serves the interests of the customers ill have to disagree. As a customer “I” want to know if there’s a real danger that a professional hacker can break in here and clean us out. How many of us will look like **** to our bosses after telling them that "we are secure". we're up to date on all of our patches and as hardened as we can be. After im hacked do you think ill be able to blame microsoft?

If they weren’t worried that they might loose some sales in the interim they would recommend some work arounds or areas to pay special attention to. Hell even tell me to take my servers off line or disconnect my network from the internet or continue on knowing the risk. But the key word here is “knowing”. They’ve put me out on a limb of a termite infested tree without telling me the dangers. While its true there is always a chance of this happening “IF” a hole is discovered by someone. To not tell of a discovered hole to me is a bit criminal in itself.

I don’t care about anyone else’s OS problems as much as my own. Im working a windows network which the company I work for paid and keeps on paying real big bucks for. Its my right to take offense at what ms is doing because their doing it directly to me.

If a PoC were released on this. We as security people would have a workaround in place before the skiddies found a shell code that will work with it and have somebody compile it for them.

For the sake of this discussion, lets say I am a park ranger. My job is to keep the park safe from hazards to the public that use it.
One day I find a pit on the edge of a large path that could injure someone if they were to fall into it. This pit is off to one side of the path that not many people would use, so I cover this pit with branches and leaves so that no one will see the pit and malicously push someone else into it....untill I can find time to come back out and fill this pit in. Just call me 'Microsoft'.

Monix, I feel that doesn't apply at all for this situation in particular. You see, while the pit already has a preset method of fixing it for repairs (filling it up, etc), they can begin repairs immediatally. where as MS has to actually research the exploit and then fix it on unknown methods.

However, the larger point I am trying to make is, I don't see people purposly going running and jumping into the pit to get the park ranger fired, where as I do see scripties jumping into the no-solution-yet pit and getting the admins in deep ****. :)

pooh sun tzu, what I meant with the allagory was, when you find a hole, even if you can't fill it in right away.....it is better to mark it as a hazard than to cover it up and hope no one stumbles into it.

I agree, but the point was the example doesn't apply to the computer security situations :) When people hear about exploit information in computer security situations, the script kiddies run to it in herds and we have exploitation problems while we wait for the vendor to repair it. When people hear about a hole in the ground, they make sure to not fall into it, rather than run to it and try to jump into it.

See what I mean? The difference is with computers script kiddies WANT to fall into the hole and cause damage. In the forest, no one wants a sprained ankle.

Don't get me wrong, I see your side completely and how it applies to most every situation in a common day. I honestly do. But script kiddies aren't common people, and the network security world behaves differently when a hole is in a network.

however it isn't as if the park ranger is trying to hide a pit he found himself...someone else told he about it after he stubbled upon it. on of the many explorers in the forest and the next stumble could be fatal.

its not as if were talking about DoSing a web server, setting up a warez site or writing to an ftp directory. its not about someone tricking someone into going to a malicious webpage and getting a trojan, we're talking about kerberos, ntlm and the complete compromise of entire networks with system privilages here. no esculation required. its not a hole in the woods its highways collapsing and the people riding upon them should know.

I'm not to sure how my whole post was nothing more than troll bait, but I still think a valid concern is in this E-mail message I posted showing Microsoft's scanners showing this secured when they really are not. Microsoft does not give one **** about customers, they care about money.

I agree with Ted completly here.

If I am going to drive down I-Microsoft, I damn well better know when they took the bridge out, as I don't feel like sinking in my car to the bottom of lake security that it once covered.

*stands alone as one of the few, rare MS supporters?*

And here come the "you're a sheep" comments, I know it.

SonofGalen. You make the assumption that Joe public is no threat. I would say that as he encompasses evryone in the world, that he is very much a threat. Joe average, may not be however. Joe average would not no a back door from his arse, but Joe publlic incorperates retards aswell as very intelegent people, some of which may well be aspiring black hats.

So lets all tell them how to bugger us about. Save them the research why not.

Why call you a sheep? I already said that and said why I thought so, you in turn reported me. Just out of curiousity, why even take me off ignore. I know you don't like me, so why reply to anything I say? I made a post giving my opinion, and then copied and pasted a few things I found that were relevent to the topic, you replied saying it was troll bait.

I don't care if you don't like me, that's your choice, and alot of people agree with you, but why reply with saying everything I said except one thing was troll bait? I copied and pasted that from a security list I belong to, from someone who used those scanners..... Where and how is that troll bait?

Bah, **** it, I have more important things on my mind. There's nothing I'm going to say that's going to change the way you think, and I'm not going to bother. Wondering where I'm going to live in a few months after I get ditched again is a bit more important than trying to make someone who believs what they are told to open the mind is about as useful as a Tool CD to Brittney Spears.

Neither would understand it, and neither could comprehend it.

Now go put me back on ignore, which is by the way is the reason I couldn't reply to your OS thread. I tried replying as that is my area of skill, but couldn't because you ignore me. Untill of course I say something you take as a direct attack for some reason.

Back on topic.

Joe public, can be a threat. If you'v ever talked to admins for companies using Windows, Joe opens every e-mail sent to him, and this can be a bad risk for security. My Doom wasn't spread because a bunch of gurus actually opened and installed something that said it was from Microsoft.

It was spread because of people who, after YEARS of hearing not to open things, were stupid enough to do so anyway. As much as I hate SCO, I have come to realise, that even though I think they deserved a whack on the ass, they did not however deserve to lose money.

There are alot of people who hate me, and they may think I deserve to lose money to. So of course I have matured a little bit more, (Bet someone just fainted over that one), But I know just because you are hated, does not mean you should be going broke over some virii writer, even though he does seem to be damned skilled.

I never meant that Joe Public wasn't a threat. Just that 90% of the people out there aren't.

This is one of those catch 22 arguments. To say a black-hat won't take advantage of a publicized vulnerability is crazy. But to also say a disclosure won't benefit white-hats is also crazy. In addition; to hastily release patches that affect a module or say a .dll used by hundreds of thousands of 3rd party software products is also crazy. The risk of additional security holes and closing a conduit or process used by those thousands is a huge risk. When vulnerabilities are discovered at the low Linux kernel level, they don't release a path over night, every time. I remember one that took months.

Most of the time Linux patches only affects a couple of software products, that's it. When you compare that to the complexity of windows; it just doesn't equal out. It's open architecture and simplicity (in terms of raw speed over ease of use) that is the attraction to Linux, plus it's free for the most part. Windows and Linux both have excellent returns on investment when used to meet some need we each have.

You don't have to be a Microsoft zombie to recognize windows for what it is, Microsoft aside, it ****ing big complicated software, perhaps the largest and most complicated piece of code on the planet. It's closed source so thousands of programmers can't look at a piece of code and fix it, but even though you don't agree with it, Bill has the patent and one should be able to patent things if they desire in this country. If you want to modify code and have the support of thousands of cool programmers, use Linux.

So while there are good arguments on both sides of the disclosure issue, I think it boils down to: specific modules that are affected, the risk of public exposure and the ability or risk associated with the capability for some black-hat to exploit it. These seem to be factors in disclosing information. Perhaps partial disclosure could be a catch all? Who knows, we admins or whatever we call ourselves, don't publicize security breaches to our customers without analyzing the risk and fallout (if at all) Unless your in California where you are forced too.

Side note: Until all these great security sites starting popping up since y2K, there was always some secret Linux s’ploits running around the underground. The world was wide open in the 90s and the lambs didn't even know it. Microsoft wasn't even a big server player then and one could travel where ever they pleased.

-------Warning--------The FCC might view this next bit as bad as an ugly tit on TV. ----
HIDE YOUR EYES. This one is for gore. "....about as useful as a Tool CD to Brittney Spears." Yeah but imagine, her completely stoned in your bedroom with "Tool" cranking in the back ground. Wait - make it my fav, "Undertow" at full volume. She has a smile on her face and (had to delete this).

Quote:

---

Originally posted here by Tedob1
steve if you think that keeping the fact that there are enormous holes in its security a secret serves the interests of the customers ill have to disagree.

---

That wasn't the point I was making, the point is that whatever M$ do, the will get slated for it.

I think that in general M$ should have the same options as say linux and release patches quickly, even if those patches require more patches soon after, without having everyone complain about their poor abilities etc.

At least that way they could respond quickly to vunerabilities and could therefore publish them as they are found.

Steve