Pros point to flaws in Windows security update

Quote:

---

Security researchers say they're starting to find flaws in Microsoft's latest major update for Windows XP.
Last week, German company Heise Security announced that two flaws could be used to circumvent the new warnings that Windows XP Service Pack 2, or SP2, normally would display about running untrusted programs, potentially giving a leg up to a would-be intruder's attempts to execute code on a victim's PC.

And more revelations about vulnerabilities are on the way, Thor Larholm, senior security researcher with vulnerability-assessment company PivX Solutions, said Wednesday. Larholm has been looking for holes in the security of SP2 since the update was released and has notified Microsoft about several issues, but he would not discuss the details.

"I'm positive that we will see critical flaws over the next few weeks, and worms that will circumvent SP2 features over the next few months," he said.

Larholm has found dozens of flaws in Windows XP and Internet Explorer over the past few years and had previously maintained a Web page of unpatched vulnerabilities in the software giant's browser.

Microsoft would not discuss whether it had received reports of new vulnerabilities in Windows XP Service Pack 2 but did say that the company's researchers had investigated the Heise issues and found them wanting.

"The security response center is investigating those reports," said a representative of the company. "This feature is one that is supposed to protect users against executable files from an unknown source or untrusted locations. At this time, (Microsoft's security response center is) not aware of any instance that attackers could specifically bypass the service through e-mail or a browser."

Security researchers also point out that Microsoft has not solved some well-known issues with a few of the security technologies incorporated into SP2. Though the firewall is improved, it can be circumvented by any locally running program, a problem with most personal firewall programs, said Marc Maiffret, chief hacking officer for security software maker eEye Digital Security. Maiffret and his staff are analyzing the security update as well.

"We have seen some interesting things, but it is only about a week into it," Maiffret said.

The flaw reports could cause companies to hesitate even more before installing Microsoft's latest step to secure Windows. Many companies have said they will hold off on the update until it has been thoroughly vetted.

SP2 is designed to add better security to the operating system's handling of network data, program memory, browsing activity and e-mail messages by changing the system's code and configuration. For example, a revamped firewall is intended to keep attackers out and attempts to prevent malicious applications from connecting to the Internet by requiring that the user give specific permission to each application.

The major software update, which took almost a year to create, came to life after the MSBlast worm hit the Internet on Aug. 11. Almost 26 days before, Microsoft had issued a patch for the security hole the worm exploited, but many people did not install the fix even though there was widespread expectation that a virus would be created to take advantage of the flaw.

Microsoft Chair Bill Gates has described SP2 as the most extensive free update to Windows ever, and executives have acknowledged that work on the update has delayed other projects, including Longhorn, the next major version of Windows.

In addition to making the software available via automatic update, Microsoft will allow information-technology managers to download an upgrade that companies can use to update their machines.

As for flaws in XP itself, eEye's Maiffret points out that the update is about making Windows XP more secure by adding new protection features and better configuration, not about finding all the vulnerabilities in the operating system.

"Microsoft never claimed that SP2 would close all the security holes," he said.

---

Source : http://zdnet.com.com/2100-1105_2-5315063.html

Is this all just becoming a big game?

Let M$ release something.... anything... and see how many holes we can poke in it as quickly as possible? Is that the game for 'reporters'?

Yeah, I can claim that X is a vulnerability.... But is it remotely exploitable granting admin rights... not usually.... Usually it's BS little things that require physical access, often with admin access or at a minimum "power user", (damn I hate that term), access.... they are complaining about the "possibility of untrusted programs"...... That's "NEWS".... right???? :rolleyes:

Show us "the beans" Mr. Accuser... (not you SDK), show me how my box is any more vulnerable by installing SP2 than it was before...... :rolleyes:

That's the thing about 'experts'

Ex = A has been.
Spurt = A drip under pressure.

As for TS and 'show us the beans' I think you nailed it there.

It has always been open season on MS, and probably always will be.
Mind you, with Billion's of $$$ in the bank, I don't see BG losing too much sleep.

Hmmmmmmmmmmmmmm.................

I wonder what these self-styled "security researchers" would do for a living if it were not for Micro$oft :)

I have yet to hear one of them come up with anything positive?

reminds me of the saying:

"Big fleas have little fleas, upon them do grow,
And little fleas have lesser fleas and do not even know."

Ack............I am just getting too cynical I suppose.

Cheers

The Tao teaches us to not act until others require us to act, and to not learn unless others require us to know.

The reasoning behind that idelology is that you can plan, predict, expect, and number crunch... but nothing says wisdom like learned experience. I see Microsoft possibly taking this route, which although it makes certain security nuts ("WHY WASN'T THIS FIXED ALREADY!!!111") it also gives them quite the advantage. Not all forms of security are predictable, and I don't just mean 0 day. They bitched and complain when XP allowed raw sockets but Microsoft did it anyway. And through real life experience and user responces(as well as bug traq lists) they have come to learn how raw sockets can be exploited on their OS, why, and what must be done to patch that hole.

See what I'm getting at? Rather than blindly apply security features that may have an impact in theory, it still doesn't hold the water or real data results of a actual experience of it. I see Microsoft as not acting unless someone needs them to, not enhancing unless someone needs them to. Similar to a child touching a stove to learn that it is indeed hot and having first hand experience, rather than being told that the stove is hot and thinking that it is always going to be that hot at any given time during the day.

Because at that point in time it won't be guess work, it will be comments, emails, suggestions, bugs, facts and figures. Just a side thought in responce to another security "guru" chewing away at MS, and just my own humble opinion.

I have your beans...

What happens in SP2, is if you download an exe from an attachment, then the exe is appended with a security restriction that equals the security levels of the email you opened. Restricted level email = restricted level attachments. If you run that exe, it should warn you that it is untrusted. The flaw: By dragging the file into a command prompt (or something), you don't get a warning. So the vector is a email worm similar to bagle, it take user interaction and instruction to run.

But those beans are fried if you strip attachments like on TS's ninja mailserver. You aren't any more vulnerable than SP1, in fact you are less vulnerable to a .exe attachment. BIG DEAL :hello:

edit:

And .exe files renamed to .gif will be run executable in cmd. So same case, you still gotta talk the user into running the file in the cmd prompt. So unless TS's ninja mailserver blocks .gif's as attachments...

Quote:

---

Originally posted here by nihil
I wonder what these self-styled "security researchers" would do for a living if it were not for Micro$oft :)

I have yet to hear one of them come up with anything positive?

---

You can drop the "self-styled" along with the quotes around "Security Researchers" in reference to Larholm. Like it or not, he discovers vulnerabilities, many of them. I am unaware of any reason why this is bad. This is leading to better software, isn't that a good thing?

Soda:

Quote:

---

The flaw:

---

Er.... Isn't the "flaw" the user himself????? I mean c'mon.... If you don't know what the cmd prompt is what could possibly be so important as to coax a user of this level into following the instructions without suspicion. Or, if you do know what the cmd prompt is you should know better then to be doing what the instructions say anyway..... Shouldn't you?????

This is a perfect example of the developers having to try to determine _every_ potential action by the end users and as I was told a long time ago "It doesn't matter how good you think you are at predicting what the idiots will do with your computer and stopping them because they will simply breed better idiots". ;)

Everyone is running around trying to find the first SP2 exploit, and what they found was a bug. Yeah, it's exploiting the user, but listen to MS's response

Quote:

---

"We have investigated your report, as we do with all reports, however in this case, we don't see these issues as being in conflict with the design goals of the new protections. We are always seeking improvements to our security protections and this discussion will certainly provide additional input into future security features and improvements, but at this time we do not see these as issues that we would develop patches or workarounds to address."

---

Until the next patch, there is a documented way to bypass SP2 security measures against mass mailers. I just don't see why a batch file can't be included in the email instead of asking the user to open the command prompt.

So yeah, not a big deal. We'll probably see a worm just to so someone can claim the first SP2 worm, but it won't be a blaster or sasser.
http://www.heise.de/security/artikel/50051

I do think Ms should have implemented the same securitycheck on the shell aka cmd.exe.

Quote:

---

you still gotta talk the user into running the file in the cmd prompt

---

True, but we all know how easy that is. As Jurgen Schmidt pointed out: look at those viruses that send password protected zipfiles. People will do anything if asked. Just use a bit of social engineering and away we go....

I have to agree with TigerShark:

Quote:

---

Er.... Isn't the "flaw" the user himself????? I mean c'mon.... If you don't know what the cmd prompt is what could possibly be so important as to coax a user of this level into following the instructions without suspicion.

---

I mean, is it a problem that the EXE attachment will run from a command prompt without consideration for its alleged security level? Sure. However, the users dumb enough to do that don't even know what a command prompt is or how to find it. If a piece of malware actually walked a user through moving the file to execute from a command prompt and how to do it and they follow those instructions and get infected they should just be fired. There is nothing a security administrator, technology or policy can do against stupidity of that degree.

I also liked the quote from Pooh Sun Tzu:

Quote:

---

The Tao teaches us to not act until others require us to act, and to not learn unless others require us to know.

---

I have a new book by Richard Bejtlich called The Tao of Network Security Monitoring: Beyond Intrusion Detection that I haven't had a chance to look at yet. I like the philosophies behind Buddhism and the Tao although I understand they are separate and unique philosophies.

Quote:

---

The Tao teaches us to not act until others require us to act, and to not learn unless others require us to know.

---

Sounds like the definition of procrastination to me. I always thought that prevention was the best defense. MS developed a new security measure to prevent mass mailers. Now it turns out that it can be bypassed.

Is a user really that dumb when receive an email from their bosswith a picture file attached, and follow it's directions? They are if they didn't learn a lesson from a previous mass mailer, but I remember a time when I didn't think viruses could happen to me (pre-broadband). Some people still live in that era.

One more thing about that quote: I would rather see prevention techniques go wrong, and learn from that, than leave a bug wide open and learn the hard and irresponsible way. I've never seen anyone win a war by letting soldiers into their base just to see what kind of weapons they have.

Sometimes there simply are _no_ technological solutions to administrative problems!!!!!!

Quote:

---

Is a user really that dumb when receive an email from their bosswith a picture file attached......

---

And is the virus that intelligent to be able to pick out the target's boss from the list of email addresses it is presented with? There's fetched, far fetched and beyond far fetched... I think we can all see where this one lives..... ;)

BTW, I totally agree that stupid people are the biggest problem in any network (or anywhere else for that matter), and obviously can't be patched. My point is that Windows is trying to acheive the dummyproof OS, and this is a flaw on the way to that goal. Dummyproofing is good, I think. :confused:

The "email from your boss" example was taken from my work. The boss opened an attachment, and his address book was all the employees (I got to clean up the remains).

Now I'm going to chipotle for a burrito. ::bandit::

:hello:


edit:

Response to TB waaay down there-

Agreed.

Quote:

---

Originally posted here by Soda_Popinsky

Now I'm going to chipotle for a burrito.

---

Nothing like their pillows of mexican goodness to to ease the pain.
Love that place..:)

It's this simple:

They'll never be able to patch stupidity.

Quote:

---

They'll never be able to patch stupidity.

---

Which brings us back to the issue at hand. Yes, these are vulnerabilities in the strict sense of the word, but if the extenuating circumstances necessary to exploit a vulnerability are such that you have better chances of hitting the lottery on consecutive weeks than getting hit with it- its not that big a deal.

I whole-heartedly agree that remotely exploitable vulnerabilities and vulnerabilities that escalate privileges with a minimum of effort, etc., etc., blah, blah, blah should be addressed and patched ASAP.

But, the security researchers and security firms often blow their discoveries out of proportion and the media makes things into much bigger deals than they ought to be.

It seems there are two basic thoughts running through this thread: 1) Should someone try to break everything that's published and 2) where to draw the line in addressing known bugs/vulnerabilities. While I am more in the phyiscal security game than cyber security at this point of life, it seems to me that these are fundimental questions in almost any area of security. In the first place, any system that is used by human will always be somewhat vulnerable to "stupid human tricks." While security professionals (and software designers) have an obligation to armor the system as much as possible against such things, I would never claim that I had thought of all the things someone might do or the sequence they might do them in. As a result, none of my designs are foolproof, I just haven't yet found the right fool for some of them.

As to whether bugs/vulnerabilities should be identified when they are present, I think I would say yes, as a general rule. If the difficulity is fully understood along with how it might be exploited or inadvertantly activated, purchasers of the system can decide if the effort of correcting it is worth the cost within their own scheme of costs and impacts. Personally, I can't get really concerned with the vulnerabilty announced here within my user context, although others might have a different take on it and I freely admit I don't know what the impact of the fix might be on the usability of XP.

Quote:

---

I would rather see prevention techniques go wrong, and learn from that, than leave a bug wide open and learn the hard and irresponsible way. I've never seen anyone win a war by letting soldiers into their base just to see what kind of weapons they have.

---

It's a different way of living life, so I would prefer that you didn't call my lifestyle and way of learning "irresponcible". My entire career and research in security has been based upon that principle. Now I run XP security tests on AO without them getting cracked. Now I can write security tutorials on rock solid OS configurations. I learned because I let it happen, and because I let it happen I learned the cause/effect of the situation. And because I was able to see first hand the methods used in exploitation I am able to prevent it in the future by not only prevention through paranoia, but definative experience.

This is the same reason I won't run a virus scanner on my windows home machine, and havn't for seven or eight years. I don't get them, period. If/when I ever get one then I will know how it got past me as a computer user rather than just a program which blindly preforms it's job. And once I know how it got past me, my own methods will be improved to prevent it.

Two different ways to solve the same problem, so let's not critisize either of them. You do what works for you, because we all know it does indeed work for you, and I will do what works for me because I know it does indeed work for me. You like security through prevention and that's fine. It's like buying insurance in a car in case of a future accident. To me, security is like not getting the insurance and learning from the mistakes I make(and the errors in car control) so that I can improve my driving as well as make improvements to the car's handling. Some may see it as irresponcible, I see it as self-improvement through life. Does this mean in a work situation with 400 computers I play dumb? No. Self experience is not about forgetting what the past has taught you, but about applying and improving upon it. I would still place a central virus scanner, firewall, and monitoring tools. Not because it's paranoid or prevention, but because I've learned first hand what can happen without it, and now can do so much more in responce to a future attack than just run a bunch of tools.

And no, a general will not allow troops to enter a base to see what weapons they carry, but they will allow them to get in close enough to define their tactics and take a slight loss, so they better know how to fight back. Swordfighting, martial arts, chess, is the same way. You learn how your opponent works rather than trying to guess and make costly moves, even if this means giving up a pawn for the good of all. That entire concept, a sacrafice for the larger good, is eastern thinking anyways and thus the difference in how you and I view things.

None the less, let's not take it down to calling my way of life "irresponsible".

edit: Someone pmed me and said I should add this to clarify:

My methods of learning and security focus more on improving the user side of things, in which the user becomes smarter and more self-secure with or without programs to prevent stupid mistakes. In time you learn how to do and prevent all the things programs helped in the first place.

I can agree with that. From what I know about you, it seems like you do more consultant work that administration and maintenance, and in that case you would need an in depth look at how an exploit works, in order to relay it to who you consult to.

My users, on the other hand, could care less how the latest mass mailers harvest their address book, and what port gets opened when a ftp server gets planted. For me not to take preventive measures and workarounds, would be irresponsible. It doesn't matter if my users are smart or not, I'm not their mommy and I'm not going to punish them for being stupid. My job is to make "it" work, and that's why I am there. The second it looks like I am teaching lessons to the users the hard way, I'm out of a job.

I do know what you mean pst... I wouldn't be running Aim if I didn't. ;)

I didn't mean the context to be interpreted as it was, so don't take offense.

I can now see where you are coming from Soda, and thank you for not only your patience with me, but also in being kind enough to help me see the different point of view we both share. While you lean more towards administration I do infact lean more towards consultation.

:) My apologies for having seen what you posted in a wrongful light. I should have known better than that.

I think the most amusingly put and succinct comment on this whole affair was posted to BugTraq early this morning...... :D

Quote:

---

Where do we draw the line on this social engineering stuff? If I send an e-mail to someone telling them to flush their iPod down the crapper does that mean the iPod is vulnerable to a toilet attack?

---