Hack in the Box Meets Windows Vista

Strange_Brew writes "It appears Microsoft is really going all out to get Windows Vista secured before its release date in 2007. There's an article on PC World which talks about Microsoft's plan to give Asia's largest hackers conference an inside look at the new security features in Windows Vista this coming September." From the article: "The Hack In The Box conference will host two speakers from Microsoft. The first, Dave Tamasi, a lead security program manager at Microsoft, will give a presentation on security engineering in Vista. The talk will include a discussion about features suggested by hackers and other security conscious members of the computing community, in addition to security improvements made on Vista. The second speaker, Douglas MacIver, a penetration engineer at Microsoft, will review Vista's BitLocker Drive Encryption and the company's analysis of threats and attempts to penetrate the security feature."

Re:I have a feeling...

[instantkamera]

I dont think that this and the anouncement about the Jan release are coincidental. Maybe they realize what is at stake. I dont use Windows and I certainly dont like M$, but i cant really find any reason why this or any further delays are bad. They may not indicate anything, but i think you really have to wait for the dust to settle before making a judgement, Perhaps we are seeing the dawn of a new era at Microsoft. Maybe one where they understand that Monopoly=Responsibility.




OR
not

Vista still "protective" of keeping it's malware

[Anonymous Coward]

One of the common myths is that Windows is just a victum of it's own success. The logic behind the myth is that if Mac or Linux where just as popular then the same exact problems would occur.

There is one major difference... Mac and Linux allow privileged processes to remove (and even replace) a file that still is in use. Vista continues to "protect" files that are in use from deletion.

That box you speak of...

[Animaether]

...it probably requires clarification.

The box they built themselves into - or rather that they had to build around themselves - isn't so much the box that is the security model in Windows. I have no doubt whatsoever that Microsoft is entirely capable of locking down the system so badly that nobody but the most powerful ueber-god of a SysAdmin can open it back up to a casual user, let alone out to the internet for hackers to 'crack'.

But therein lies the problem as well. Windows users are -not- ueber-gods of SysAdmins, and this shows in the decisions that they feel are forced to make. I can't spot it in all the Slashdot story summaries on Vista right now, but there have been at least two stories in which there was a reference to Microsoft dropping a security feature or loosening a security setting -because- major clients of theirs told them that things were 'just too complex'. And this is in an operating system that guides you through reasonably easy-to-read GUIs with hint balloons and help files up the wazoo. You can well imagine what happens if you'd sit them down behind a screen that just shows a prompt and a one-liner telling them that security settings can be changed by editing the text file "omfglolwtfbbq.conf"

So yes, they're in a box that is difficult to get out of - but that's mostly because their clients make the walls so damn slippery after plating the bricks with titanium and burned down all but one of the ladders, then stationed several million angry users alongside it, hissing and whining at them whenever they try and scale it.

They are, well and truly, damned if they do - and damned if they don't. But at least they realize that they are a little less damned in the first case.

Good Idea?

[BigNumber]

I don't know if it's the best idea in the world to go to a hacker conference and brag about how secure your new OS is. That may come off sounding like a challenge to the attendees.

hacks are valuable...

[a_greer2005]

on the black market; face it, a back door or hole would be worth a TON of money to spyware vendors or governments that dont have MS wrapped around their finger...letting the hackers see and attempt to break it will ENCURE that vista comes pre-hacked because of 2 things:

1. the money that can be made by selling the secrets to bad guys.

2. MS hatred goes deep in the hacking community...a lot of "hackers" would love to see vista hackable out of the box to hurt MS.

Perhaps they're looking at security the wrong way?

[insanarchist]

Wouldn't it be smarter for Microsoft to assume Vista *will* be hacked at some point, and base their security around how the system reacts to said hacking, than to assume it won't? I mean, with enough time, anything can be hacked, so it is more of a factor of how long/how much effort it will take & what the hacker can do to the hackee's machine. Is there any real reason to let anything coming in from the internet have any sort of direct access whatsoever to a person's machine? And why would you, by default, let any program access the internet/download random crap? For that matter, perhaps giving the user the ability to add keys to ANY PART of the registry with nothing but a double-click isn't such a good idea. Mod me down if you must, but as a person who has removed (or attempted to remove) hundreds of easily-preventable adware/spyware/virus infections, I do have reasons to vent...

Re:Vista still "protective" of keeping it's malwar

[Tim C]

While what you say is true, who needs a hole to exploit a machine? All you need is to convince a user to run your malware and you're away.

If they have root access, they can hose the whole system. If they don't have root access (or refuse to supply the credentials), they can still hose their own user account. Either way, if you're looking to add another PC to your zombie botnet, the difference is immaterial, especially on single-user machines.

Even if there were absolutely no remotely exploitable holes, there will always be enough naive and incautious users to provide a rich hunting ground for malware.

Defects are Microsoft's fault... ALL of them!

[Korexz]

Design is what is wrong with 99.999% of all software. No one ever spends the time, effort, and money to make sure that their system is designed correctly. Rarely do they update the initial requirements during development, or test the system against the requirements. This is why MS has failed before. They keep throwing money at the problem and never addressing the process that is really the problem. I can tell just by looking at the MSDN documentation that MS has no clue how a good majority of their software works. Definitions of object properties are pathetic. You can have a property called "htmlid" and the definition is the ID of the html... ?!? really... but what does it DO? Further investigation of Visual Studio Team System shows that the process is nothing more than a few high level diagrams. When you work at that level you miss the details... that is where the problem exists. An OS is so massive that the details are crucial. MS created the beast and they are responsible for taming it. Can you imagine the cost to MS of actually developing Vista the correct way... it would take YEARS and hundreds of billions of dollars... The interative process of refining the requirements the correct way would have cost them twice what they are claming Vista has already cost them. MS made themselves the industry leader and they should be responsible for maintaining their position appropriately. Instead we will get yet another half complete OS, with hundreds of updates every year, and never ending reports of defects. We will suffer and MS will continue to control the OS market. I would even go so far as to say if MS was a responsible company and did their job we would see far less defects in every other application that depends on Windows. I have found errors in the Windows IIS server through a .NET app. The developers swore it was their application but I persisted and we found the error was MS's fault. MS release a patch after months of investigation. I wonder how often a defect fix is just a workaround of a bug that MS created in the first place?

Re:fundamentally flawed

[rs232]

"The problem with windows security is primarily one of legacy support."

Noncense, backward compatibility should not break security. Windows was sold as suitable for secure use in a networked environment. It was even given C2 [infoworld.com] security certification. The problem is the WinNT memory management unit running under the x86 processor. Something that was first tackled under Linux with Exec Shield [redhat.com]. The Windows version called NX [findarticles.com] can be bypassed as otherwise JIT bytecode won't work.

"inter-processes communication was flawed lacking any authentication method, kernel / userland seperation was virtually nonexistant,"

Wait a minute WinNT was touted as being more secure because of it's use of operating modes [osronline.com]. Ring 0 had full access while user apps were restricted to Ring 3, the highest restriction. At least that was the theory [securiteam.com].

"these issues persisted right up till XP when microsoft started to take security seriously with SP2."

Er, They still persist [secunia.com]. See here, much of this code is included in Windows Server 2003 and will be included in Longhorn [google.com]

"Microsoft just like the rest of us is new to the whole OS design thing."

When Microsoft hired on the Digital VAX/VMS [iiit.net] team they had an oppurtunity to design a secure OS. Most of the defects in the OS can be traced to managment decisions to favor features over security. Embedding Internet Explorer in the OS was one such decision.

"What needs to be done is .. implement a version of windows that incorporates everything we've learned over the last 20 years or so"

If by "We" you mean Microsoft, "We" haven't learned anything since 1988 [archive.org], 18 years ago. Why wait, why not upgrade to SuSE [desktoplinux.com], all the eye candy of Vista without the security vulnerabilities.

I see a lot of this kind of revisionist history on the Internet and in the media. Is there a whole department that does nothing all day but pollute the athmosphere with self serving distortions such as this. How anyone say this with a straight face is beyond me.

'the security kernel of the Windows NT server software was written before the Internet,
and the Windows Server 2003 software was written
before buffer overflows became a frequent target of recent attacks'

David Aucsmith [ossir.org], Security Architect, Microsoft.

Re:The never ending story

[Sloppy]

I think I may be "that guy."

On my lil' 800MHz notebook with "only"(?) 256M RAM, Konqueror kicks Firefox's ass. I don't have time to wait for Firefox. Firefox is my choice on beefier machines, but as a "slimmed down Mozilla," it's a joke. There's nothing slimmed-down about it, and I'm amazed that they turned an I/O-bound application into a CPU-and-memory sucking experience.