Forgot your password?
typodupeerror

DRM Hole Sets Patch Speed Record For Microsoft 397

Posted by Zonk
from the great-priorities dept.
puppetman writes "Wired columnist Bruce Schneier has an article up called 'Quickest Patch Ever', about a patch that was issued within three days to fix a vulnerability in Windows Digital Rights Management (DRM)." From the article: "Now, this isn't a 'vulnerability' in the normal sense of the word: digital rights management is not a feature that users want. Being able to remove copy protection is a good thing for some users, and completely irrelevant for everyone else. No user is ever going to say: 'Oh no. I can now play the music I bought for my PC on my Mac. I must install a patch so I can't do that anymore.' But to Microsoft, this vulnerability is a big deal. It affects the company's relationship with major record labels. It affects the company's product offerings. It affects the company's bottom line. Fixing this 'vulnerability' is in the company's best interest; never mind the customer."
This discussion has been archived. No new comments can be posted.

DRM Hole Sets Patch Speed Record For Microsoft

Comments Filter:
  • Patch (Score:4, Interesting)

    by Damastus the WizLiz (935648) on Thursday September 07, 2006 @03:20PM (#16061402)
    So this is going to be the least installed patch for windows ever. untill they make it mandatory
    • Critical, or not? (Score:5, Insightful)

      by kripkenstein (913150) on Thursday September 07, 2006 @03:32PM (#16061495) Homepage
      So this is going to be the least installed patch for windows ever. untill they make it mandatory

      Actually, this is a very serious question: is the patch marked critical, or not? This is important, because:

      1. If the patch is critical, it will get criticized for being, in effect, mandatory degradation of capability (by the tech-savvy). Also, this will make light of Microsoft's security policy, to call this sort of patch 'critical'.
      2. If the patch is not critical, then - oh, the irony - by default, it will not be installable on computers failing WGA. Perhaps Microsoft will get around this. But, as WGA currently works, only critical patches are allowed to systems marked as 'non-genuine'. This would be amusing - pirated copies of Windows would not receive this unwanted patch, but paid-for copies would.

      I can't find, in TFA or the sources it cites, any mention of the severity of the patch. Anyone know the answer to this?
      • Re:Critical, or not? (Score:5, Interesting)

        by SoCalChris (573049) on Thursday September 07, 2006 @03:38PM (#16061547) Journal
        This would be amusing - pirated copies of Windows would not receive this unwanted patch, but paid-for copies would.
        That's a good question. If it isn't marked critical, that will be just one more instance of a pirated product being superior to a genuine product (Pirated games not requiring the CD to play, pirated music not being restricted to certain devices, pirated movies not displaying unskipable ads & warning, etc...)
      • Re:Critical, or not? (Score:5, Interesting)

        by nine-times (778537) <nine.times@gmail.com> on Thursday September 07, 2006 @03:40PM (#16061564) Homepage

        How can they make it a mandatory patch, even if marked critical? It seems to me that the most they could do is impose a restriction that you couldn't install other patches until you installed this one, but they still can't force you to install it.

        <microsoft bashing bitch session>It really makes me wonder whether, as Microsoft introduces more "security" and "protection" that diminish a user's capability, at what point will it cease to be worthwhile to upgrade/patch/fix? Sometimes I think that point was crossed with the introduction of Windows XP</microsoft bashing bitch session>

        • Re:Critical, or not? (Score:4, Informative)

          by abandonment (739466) <mike...wuetherick@@@gmail...com> on Thursday September 07, 2006 @04:47PM (#16062018) Homepage
          I think that WGA has already proven that it's not worth upgrading. Running a hardware firewall and being half-intelligent as an internet user is more than sufficient to protect yourself from ANY issues with non-patched software.

          I know some people that have never upgraded their windows XP ever via windows update, yet have never been infected with virus' (virii?) or other malware. Just takes half of a brain on the user-end to make this possible.
      • Re:Critical, or not? (Score:5, Informative)

        by guruevi (827432) <<evi> <at> <smokingcube.be>> on Thursday September 07, 2006 @03:44PM (#16061591) Homepage
        Dear Windows Media Licensee,

        On August 25th, 2006, Engadget.com reported on a software tool that would allow consumers to decrypt WMDRM protected content. In response, on August 28, 2006, Microsoft released an update to the individualized blackbox component (IBX) designed to ensure that client applications using the Windows Media Format SDK version 9.5 who individualize to this latest version are robust against a new circumvention tool.

        This update is not yet available for the Windows Media Format 9 Series FSDK or for users of Windows XP Media Center Edition 2005 Update Rollup 2.

        Consumers are not at risk in any way. Content services can require that the updates be present in order to issue licenses by following the instructions below. Please note that the version number of IBX was not incremented as part of these updates to avoid delaying the release of these critical breach mitigations. Consequently, the only way to determine if the update is installed is to query the build number of the IBX. This requires code executing on the client.

        To determine the build number of the IBX:

        1. Ensure the PC is running the August 2005 update to Windows Media DRM. See the attached white paper for details.
        2. Determine the path of the WMDRM folder. The path is stored in the registry at HKEY_LOCAL_MACHINE\Software\Microsoft\DRM\DataPath
        3. Identify the file name of the latest IBX. If the machine has been individualized only once, the IBX file name will be indivbox.key. Otherwise, the IBX file name is in the form indivbox_xxx.key, where xxx are digits 0-9. The file name with the greatest value of xxx will be the latest IBX.
        4. Call GetFileVersionInfo() to retrieve the build version of the file identified in step 3. See [link].
        5. If the IBX file version is 11.0.5497.6285 or greater, then the updated IBX is installed

        Please submit questions to [email removed]

        Best regards,

        Windows Media Licensing Department
        Microsoft Windows Digital Media Division

        Basically -> the content provider CAN require that patch to be there. I don't know whether it's a separate patch through WMP or through MSUpdate but since I don't use Windows/Microsoft I can't speak for them.
        • Re: (Score:3, Interesting)

          It sounds like it should be easy enough to make WM licenees believe the patch has been installed when it really hasn't.
        • Re: (Score:3, Insightful)

          by pete6677 (681676)
          Keep in mind who Microsoft's real customers are: the content providers paying big bucks for a Microsoft-exclusive distribution arrangement. The consumers who pay $200 or so for a Windows license (or who don't pay at all) are not where Billy G. got his billions from. Microsoft is simply fixing problems in order of business priority.
      • Re:Critical, or not? (Score:4, Informative)

        by Anonymous Coward on Thursday September 07, 2006 @04:05PM (#16061737)
        Neither, this is not a "patch" in the sense people think it is, and it has nothing to do with windows update. All it is is a new version of your "individualized" private keys. drmv2clt.dll isn't touched by the fix, you just re-indiv your machine, and get the new keys from MSFT.
      • Re: (Score:3, Insightful)

        by LucBorg (853592)
        Fine they are being a typical company, but it's not as if Apple would behave any differently if something like this happened to their music.
        • Re: (Score:3, Insightful)

          by MightyYar (622222)
          Actually, this DID happen to Apple when Hymn broke the FairPlay encryption. It remained broken, off and on, for quite a few months (years?) until iTunes 6 came out. Even now, you can buy music using the older "broken" iTunes software and break the encryption. Eventually they will probably disallow the use of pre-6, but I don't think they have yet.
      • Re: (Score:3, Insightful)

        by 200_success (623160)

        In the long run, it doesn't matter whether this particular patch is mandatory. The next time there is a truly security-related patch for Media Player, they'll either include this fix or require it as a prerequisite.

    • Re: (Score:2, Informative)

      It's not hard for them to make it mandatory. I've only recently figured out how to tweak the registry to allow me to disable automatic updates again. So all they have to do is change that registry setting and make it a critical update...
      • Re:Patch (Score:5, Informative)

        by Danga (307709) on Thursday September 07, 2006 @04:01PM (#16061709)
        I've only recently figured out how to tweak the registry to allow me to disable automatic updates again.

        Umm all that I have to do to disable automatic updates is:

        1) Start->Control Panel
        2) Click Automatic Updates
        3) Select Turn Off Automatic Updates
        4) Press OK

        No registry tweaking needed. Now I do have XP Pro, do other versions of XP really make you edit the registry? That would really piss me off.
    • Re:Patch (Score:5, Interesting)

      by Fordiman (689627) <fordiman AT gmail DOT com> on Thursday September 07, 2006 @04:40PM (#16061958) Homepage Journal
      Meh. It's already rebroken. And this time, with video support.

      MS is just way too slow for t3h hax0rz.

      Meanwhile, I'm testing the new version in conjunction with Vongo (Downloading a movie now). Let's see how that works. If so, I may stick to Vongo rather than BitTorrent ('cept, the very rare/hard-to-find stuff will still get me on BT).

      I'm sure the DRM astroturfers on here will scoff, and say, "Yeah right, you spoiled rich college kid theif scumbag criminal. You're just going to keep stealing from the mouths of millionaires like the incorrugible brat you are." If you'll just take it as read that I said 'Fuck off, tool.', we can avoid the whole thing.
  • by Eldred (693612) on Thursday September 07, 2006 @03:21PM (#16061413)
    What's their excuse going to be the next time a user vulnerability that has exploits in the wild has to wait for the next release cycle?
    • by Stripsurge (162174) on Thursday September 07, 2006 @03:23PM (#16061431) Homepage
      Easy. They used up all their overtime hours already.
      • by skaap (681715) on Thursday September 07, 2006 @05:23PM (#16062216) Homepage Journal
        I wonder if they'll introduce clippy to this:

        Clippy: It looks like you're trying to pirate some music, do you want me to:

        1. Send your details to the RIAA
        2. Delete your files
        3. Ruin the files by overlaying Cliff Richard music into it?

      • by HermMunster (972336) on Thursday September 07, 2006 @05:24PM (#16062231)
        In WA state the programmer is a slave to overtime. WA state laws allows busineses to require overtime without having to pay for it on any salaried worker. This is a device of Microsoft. Microsoft lobbied to get he laws changed so that the programmer positions changed.

        A programmer is the person who actually, through their very creativity and knowledge, makes the product come into being. This is far different than someone that works as an assembly line worker who just does their small part. Programmers are the reason the products exist. For me, that's the reason I don't work as a programmer. I don't want my blood, sweat, and creativity exploited by companies such as Microsoft that make billions of dollars a quarter on my work.

        WA needs to revert back to the laws that allow these programmers to get paid overtime. It is only fair. This isn't a management position and thus should never have been changed. It only happened because Microsoft lobbied to make it happen.
    • by buro9 (633210) <david.buro9@com> on Thursday September 07, 2006 @04:17PM (#16061815) Homepage
      That they didn't have the bug pre-patched?

      In the case of DRM, the system is setup to block comprised clients at the server level immediately.

      In the case of DRM, backup DRM methods are already pre-written and ready to ship.

      As soon as a system is compromised, the existing method is deactivated, servers notified to deny licenses, and the new system is delivered via the servers.

      They are able to 'patch' this so quickly because they already had it written months, if not years, ago. Just like when this one gets compromised, they will be able to 'patch' as fast because they already have the next backup DRM method already on the shelf waiting.

      They know this is a game with those who circumvent DRM, and a game which requires time for each DRM method to be circumvented. So they build a store of different methods of DRM and when one is circumvented they release the next. The game continues... and time is currently on the side of Microsoft as they have their next few moves on the shelf ready.
    • by marcello_dl (667940) on Thursday September 07, 2006 @06:11PM (#16062568) Homepage Journal
      What's their excuse going to be the next time a user vulnerability...
      Windows has no users. It has hostages.
  • by MightyYar (622222) on Thursday September 07, 2006 @03:22PM (#16061418)
    No matter what anyone in your company tries to tell you, this kind of rapid response is EXACTLY what we are clamoring for when we ask that you take security seriously. Please tell your bosses. Thanks...
    • Plain and simple (Score:5, Insightful)

      by Anonymous Coward on Thursday September 07, 2006 @03:27PM (#16061455)
      this kind of rapid response is EXACTLY what we are clamoring for when we ask that you take security seriously


      The fast fix suggests that rapidness of response might be a function of "whose ox is being gored".
      • by MightyYar (622222) on Thursday September 07, 2006 @03:30PM (#16061483)
        Exactly! The cat's out of the bag... we know that they are CAPABLE of a 3-day turnaround. That line about having to wait for testing and blah, blah, blah was totally bogus, apparently.
        • by Skye16 (685048)
          Well, just to play devil's advocate - what if the vulnerability fix was, literally, a couple of lines of code? Maybe it was just a tiny fix.

          Then again, it could have been a huge effort, where developers weren't allowed to go home, use the telephones, or even use the bathroom, until it was fixed. I sure as hell don't know for sure. I'm just saying, either could be possible.
          • by Abcd1234 (188840) on Thursday September 07, 2006 @03:42PM (#16061578) Homepage
            Well, just to play devil's advocate - what if the vulnerability fix was, literally, a couple of lines of code? Maybe it was just a tiny fix.

            Actually, I suspect the vast majority of security fixes are just this. Usually it involves adding a couple more error checks to function inputs, putting length limits on operations on memory buffers, that sort of thing. I suspect it's quite rare for a patch to be any more involved, unless it's the result of a serious error in design.
          • Re: (Score:3, Interesting)

            by DaggertipX (547165)
            Good point, good point... but why can't they do this with the security patches that are just as small then? I mean, sure, some of the patches may require billions of lines of code and touch every product in their lineup, but I have a hard time believing they all do. In fact, I would be shocked if there weren't quite a few of them that are easier to repair, once the vulnerability is known, than this was.
            I don't want the "monthly rollouts were requested by corporate customers" line, either... Even if they
            • by rcw-work (30090)
              there is no reason to not release them to those that want them earlier, as well as a monthly package.

              That depends on if the vulnerability was already public knowledge. Once a patch is released, it usually only takes someone a day or two to find out what was patched, how the unpatched version can be exploited, and how to adapt some existing worm to automatically exploit it.

          • Well then release it on Patch Tuesday.
            Or was this a "critical" DRM fix? :-/
          • by radtea (464814) on Thursday September 07, 2006 @04:26PM (#16061867)
            Well, just to play devil's advocate - what if the vulnerability fix was, literally, a couple of lines of code? Maybe it was just a tiny fix.

            I once moved a single line of code up one line and broke the product in a subtle and interesting way that fouled up major testing, delayed a milestone, and severely and justifiably pissed off one of my colleagues.

            There are no small fixes. A famous single-character error (typing "." for "," in a FORTRAN DO loop header, so it read DO I=1.10 instead of DO I=1,10) resulted in the destruction of a spacecraft.

            So I guess fixes that involve changing less than one character are safe to release with minimal testing. All the rest need the full cycle.

            The only reason why Microsoft might not do that in the present case is because keeping partners who depend on DRM happy is really, really important, and therefore they are willing to take the risk of crashing user's machines. Either that, or the person making the decision is just not very smart, a possibility never to be discounted.

            • Re:Plain and simple (Score:4, Informative)

              by gludington (101178) on Thursday September 07, 2006 @04:49PM (#16062026)

              There are no small fixes. A famous single-character error (typing "." for "," in a FORTRAN DO loop header, so it read DO I=1.10 instead of DO I=1,10) resulted in the destruction of a spacecraft.

              While I agree that even tiny changes can have large consequences, it appears the FORTRAN-lost-a-spacecraft bug is a programming urban legend that eventually made its way into computer texts as a cautionry example. (See this Google archive [google.com] of a relevant 1993 alt.computer.folklore discussion on Mariner I.)

    • by Anonymous Coward
      Normally. Microshaft ignores security problems for at LEAST a month, they they deny that a problem exists for at LEAST another month, then they "study" the issue for at LEAST another month, then they "work on the problem" for at LEAST another month, and finally release a patch that does not really address the original problem and breaks a half dozen other things (and apparently inflicts even more sadistically controlling DRM on Microshaft's victims).
  • is the phrase "it figures". Frankly, I'd expect nothing else from them.
  • by mendaliv (898932) on Thursday September 07, 2006 @03:23PM (#16061429)
    From the article:
    "It should surprise no one that the system didn't stay patched for long. FairUse4WM 1.2 gets around Microsoft's patch, and also circumvents the copy protection in Windows Media DRM 9 and 11beta2 files."

    So it's not totally horrible... though I'm sure (and the article agrees here) that M$ will be quick to fix their fix.
  • Regulation? (Score:5, Interesting)

    by linguizic (806996) * on Thursday September 07, 2006 @03:23PM (#16061433)
    If Microsoft abandoned this Sisyphean effort and put the same development effort into building a fast and reliable patching system, the entire internet would benefit. But simple economics says it probably never will.

    This leads me to 2 questions: "can patching be regulated?" and "should patching be regulated?". It seems obvious the free market can't keep our computers secure. I've been wrong before though. I guess maybe it could if people didn't already have the expectation that they shouldn't have to pay for patches b/c Microsoft should fix their own faulty software.
    I guess it's all pretty moot since open source is going to take over the world anyway.
    • The free market is perfectly capable of keeping our computers secure... For anyone who values security.

      Windows is not designed or sold to people who value security. It is designed for and sold to people who value being able to use the 'Windows System', which includes generic PCs, a large collection of software, and moderate ease of use to the unskilled. Security is not a primary concern, though that is changing.
      • The free market is perfectly capable of keeping our computers secure... For anyone who values security.

        Yes, but here is where externalities come into play - for home users, insecure systems pose as much of a problem for the rest of the world as it does for them. If they were meant to feel the pain that their hacked computers caused, they'd patch.
    • If you were King today, then how would you set up a patching regulatory agency? How would you staff it? Would it be a federal agency or is each state free to have unique patching regulations? How do you determine which software is subject to patch regulation?

      The devil is in the details, my friend, and I suspect any attempt to do this would result in a messy hash of confusion with no winners.
    • Re:Regulation? (Score:5, Insightful)

      by RocketScientist (15198) * on Thursday September 07, 2006 @03:39PM (#16061553)
      The free market is EXACTLY how this should be fixed.

      It's currently regulated so that the free market has NOTHING TO DO WITH THE PROBLEM.

      The primary issue, and this is exactly out of Mr Schneier's playbook, is that Microsoft has no direct civil liability for their defects. It's exaclty as if you couldn't sue Ford becase your Pinto's gas tank exploded. Ford would have no reason to fix the defect. Well, the same problem here: if you buy defective software, you have no recourse to sue the manufacturer of the product. Remove that lack of liability and you'll start to see problems get fixed very very quickly.

      If Microsoft was civilly liable for every piece of spam that was sent by a Windows zombie PC, there would very quickly be patches.

      Less protection of corporations, and more market forces, would fix this problem. This is EXACTLY the kind of problem markets are very good at fixing. The problem is that the current regulation circumvents the market.
      • Re:Regulation? (Score:5, Insightful)

        by spun (1352) <loverevolutionary@@@yahoo...com> on Thursday September 07, 2006 @03:48PM (#16061626) Journal
        Unfortunately, free markets lead to concentration of wealth. Concentration of wealth leads to concentration of power, which leads to control of the regulatory process. Free markets invariably become unfree because of a runaway feedback loop. At least in democracy we have checks and balances. Where are the checks and balances within a free market that will work to keep it free? there are none.
        • Re:Regulation? (Score:5, Insightful)

          by ChronosWS (706209) on Thursday September 07, 2006 @04:30PM (#16061898)
          And there's no concentration of wealth and power now, in our democracy? Maybe you've missed the consistent erosion of our rights lately, and fail to realize that the people eroding those rights also have the power to use force (as in they can lock you up and/or kill you) to further their ends AND it's perfectly legal so long as the right people are paid off (or themselves coerced.)
    • Not the desktop anyway. It's a monopoly. The actions of Microsoft are those of a monopolist.

       
  • by hansamurai (907719) <hansamurai@gmail.com> on Thursday September 07, 2006 @03:24PM (#16061435) Homepage Journal
    For a second there, I thought it was Tuesday.
  • Ever? (Score:3, Insightful)

    by truthsearch (249536) on Thursday September 07, 2006 @03:25PM (#16061438) Homepage Journal
    'Quickest Patch Ever'... for Microsoft. Linux distros have definitely had patches available within 48 hours of a security hole being found. IIRC the samba team once fixed a hole within 24 hours and it was in most of the big distros within another 24.

    And isn't it sad that the quickest patch they ever release is for a hole no user cares about? More proof that MS cares more about their corporate friends than users.
    • by TopShelf (92521) on Thursday September 07, 2006 @03:56PM (#16061682) Homepage Journal
      And isn't it sad that the quickest patch they ever release is for a hole no user cares about? More proof that MS cares more about their corporate friends than users.

      Is it proof that MS doesn't care enough about users, or is it (by extension) proof that users don't care much about OS vulnerabilities? Sure, they may complain, but do they actually take action and demonstrate that they care, by switching to more secure OS's (by moving to Apple or Linux)?

      After all, MS reacts to what its customers and business partners care about. The music companies go apeshit over stuff like this, but users (both corporate and personal) haven't really demonstrated that they'd rather take their business somewhere else, so why should MS give them anything more than lip service?
    • Patch turnaround time doesn't matter all that much.

      What really matters is probably something like the mean time to patch install on vulnerable systems as measured from the time of vulnerability disclosure, or the % of patched hosts after a given fixed time period. Think about it: if you turn out a patch in 30 minutes, but it takes on average six months for the patch to get installed, how much did that marvelous engineering feat really matter?

      It might matter a lot to a few people, but by assumption (6 month
  • by geekoid (135745) <dadinportland @ y a hoo.com> on Thursday September 07, 2006 @03:25PM (#16061440) Homepage Journal
    "ut to Microsoft, this vulnerability is a big deal. It affects the company's relationship with major record labels."

    what relationship? why is it important?
    Do the get money from them? Is Steve B. banging a secretary in the RIAA office?
    I just don't get it.
    • There are a LOT of media companies that put out a LOT of music and videos that are played on a LOT of Windows computers that they want to keep an eye on.
    • Re: (Score:3, Insightful)

      by nine-times (778537)
      Microsoft is trying to sell their formats on the strength of the DRM. DRM is what record companies want. If the DRM is insecure and easily cracked, then it won't be used.
    • by hublan (197388) on Thursday September 07, 2006 @03:32PM (#16061494) Homepage
      what relationship? why is it important?

      It's called Zune and MSN Music. If the labels don't think that Microsoft can bolt down the music they "sell" to people then the labels don't want Microsoft to be selling their music. Microsoft wants to own this market segment because Apple does, since it forms a part of their new "MS is your everything" strategy.

      Plus it might also make the labels pull the plug from other on-line music stores that use Microsoft's DRM technology, opening themselves up to another volley of lawsuits.
    • by gstoddart (321705)

      what relationship? why is it important?
      Do the get money from them? Is Steve B. banging a secretary in the RIAA office?
      I just don't get it.

      Microsoft is convincing people do distribute content in their own formats, and part of the argument they make to content providers is that their DRM will keep their stuff secure and free from piracy and terrorism.

      When people can get around MS's DRM, the media companies might have to start looking for something other than MS proprietary stuff.

      MS loses money if that happens

    • Re: (Score:3, Insightful)

      by daranz (914716)
      There are DRM-ed WMA playing portable devices and online download services. It's in MS's interest to keep the DRM doing what it's supposed to do. Otherwise, everyone goes to iPod and iTunes, and that's not what MS wants.
      • Otherwise, everyone goes to iPod and iTunes, and that's not what MS wants.

        I think a lot of people have already gone to the iPod and iTunes, not that I have anything against alternatives like SanDisk's new player. But I'd bet that even the people who work for Microsoft are a lot more likely to have an iPod than a Zune player....

  • Not an article (Score:3, Insightful)

    by Red Flayer (890720) on Thursday September 07, 2006 @03:25PM (#16061444) Journal
    I know it seems like semantics, but Schneier's piece is not an article. It's an editorial, an opinion piece -- even if it is based on some real event(s). We really should differentiate between the two, as I do prefer 'news for nerds', not 'opinions for nerds'. I've already got opinions o'plenty, and the comment section is where I like to see others' opinions. :)
    • An opinion piece is an "article" ("piece" and "article" in the relevant senses are synonyms.) It is not a "news article". But the existence of the opinion piece is itself news, as are the underlying facts it relates too, so a Slashdot article pointing to it is not inconsistent with the slogan "News for nerds."

      Of course, the full slogan is "News for nerds. Stuff that matters." Whether the second part is a limitation on, or addition to, the first is debatable.

    • Schneier is well respected, and his opinion generally means a lot to people who actually care about security. And yes, I do prefer news, but then, I did not know about the real events.
  • Priorities (Score:5, Insightful)

    by wardk (3037) on Thursday September 07, 2006 @03:26PM (#16061453) Journal
    fatal holes in the browser? whatever

    allowing spyware to take over? who cares

    DRM? we're on it!
  • Who profits? (Score:5, Insightful)

    by Damiano (113039) on Thursday September 07, 2006 @03:28PM (#16061464)
    As TFA says, it's simple. A normal security hole costs the user money, not Microsoft. This "security hole" (indirectly) costs MS money so it gets fixed ASAP. MS is, if nothing, good at protecting its bottom line.
  • Oh, I know! (Score:4, Funny)

    by rice_burners_suck (243660) on Thursday September 07, 2006 @03:32PM (#16061496)
    I have an idea. Let's embrace and extend DRM in Windows. From now on, the operating system will not allow anything to read any information from anywhere. Your own files on your hard drive? Sorry, you can't access them, because you might accidently pirate your English class essay that you wrote last night, and Windows, being much, much, much smarter than you could ever dream of being in your wildest dreams, is therefore charged with the duty of making sure you don't do something illegal like that.
    • Re:Oh, I know! (Score:5, Informative)

      by The MAZZTer (911996) <megazzt.gmail@com> on Thursday September 07, 2006 @03:57PM (#16061687) Homepage
      Vista's default file access settings prohibit the access of any hard drive partitions except your Vista one. So you have to go and Take Ownership of every item on every drive, and then give yourself Full Control permissions to be able to use the drive. It's quite annoying, but luckily it's faster in RC1 than B2.
      • Re: (Score:3, Informative)

        by Foolhardy (664051)
        What are you talking about? File access is handled by the filesystem. When you mount an existing fileystem, its files continue to have the same security descriptors as they did before. The only access check done when opening a file is against that file's SD. In order to have the behavior you're implying, Vista would have to intentionally modify the SD of every file to some ridiculous default, just by mounting a volume-- a behavior I've not witnessed and seriously doubt exists.

        What it sounds like is ACTUALL
  • Priorities... (Score:3, Insightful)

    by Supp0rtLinux (594509) <Supp0rtLinux@yahoo.com> on Thursday September 07, 2006 @03:34PM (#16061514)
    So let me see if I get this right... they'll wait a month for normal patches, sometimes longer for some that've been well known but they either can't fix or don't see the potential risk... but in general, if a new vulnerability is found on the Wednesday after black Tuesday, they'll wait a month (at earliest) to release a patch even if an exploit is in the wild... yet when it comes to protecting their cash cow, they'll fix it right away. In other words, screw the consumer... we can just damn well wait for updates to critical vulnerabilities, but when it comes to protecting their own revenue stream, they'll fix something right away. Not sure why I would've thought they'd do any different... but it would seem they rushed to provide a "bug fix" to protect their revenue stream, but won't rush to creat "critical updates" that customers need. Amazing...
  • A Correction (Score:5, Informative)

    by in2mind (988476) on Thursday September 07, 2006 @03:36PM (#16061540) Homepage
    "Wired columnist Bruce Schneier has an article up called 'Quickest Patch Ever', about a patch that was issued within three days to fix a vulnerability in Windows Digital Rights Management (DRM)."

    When the summary says "Within three days" they mean "three days after it was reported in engadget".

    Coz,FairUSE4Wm was released on August 19th in the forum.Microsoft patched it on August 28th.So 9 Days.

  • Not Accurate (Score:5, Informative)

    by ThinkFr33ly (902481) on Thursday September 07, 2006 @03:38PM (#16061552)
    Microsoft did not really "patch" their DRM. This wasn't a code change. Their DRM was designed to be updateable in the event that it was compromised.

    There is a big difference in how fast you can roll out what ammounts to a configuration change and how fast you can roll out a code change.

    That said, it didn't seem to do much good given that it was cracked again in a matter of days.
  • by segedunum (883035) on Thursday September 07, 2006 @03:39PM (#16061557)
    So Microsoft wasted no time; it issued a patch three days after learning about the hack. There's no month-long wait for copyright holders who rely on Microsoft's DRM.

    It's nice of Microsoft to let us know where their priorities lie. Obviously, things aren't as complex as Microsoft have let on (one of the many excuses for not getting patches out) if they can patch something that quick.

    "Oh no. I can now play the music I bought for my PC on my Mac. I must install a patch so I can't do that anymore."

    Really? I'm going to Windows Update as I write this. Mind you, good luck finding anyone who actually uses PlaysforSure. For those that are they've found out that stores selling Windows Media files are crap (you effectively rent your music - yay, what a great idea!) and they're looking to get out before they buy any more of the crap. Microsoft have some slight delusions of grandeur about the importance of their DRM software.
  • It's a good thing I have automatic updates turned off. However, automatic updates in Vista will be turned on by default. If I ever end up using Vista, that will be the first feature that I disable which is a shame since automatic updates are a good thing if you can trust the company that performs them.
    • Vista prompts you during first boot if you want to use automatic updates. You are allowed to opt out of the feature.
  • Timeline is wrong (Score:5, Informative)

    by mdb31 (132237) on Thursday September 07, 2006 @03:47PM (#16061616)
    The KB891122 patch wasn't developed in response to FairUse4WM 1.0 -- MS started working on it after seeing an earlier bunch of tools (drmdbg and friends) that were released on the cover CD of a Japanese magazine a few months ago, but were too cumbersome in operation to gain widespread use.

    FairUse4WM "merely" wrapped up the techniques used by these tools in a neat package, and got to the frontpage of Engadget. It was pure luck that MS had a patch available at the time, even though it took extraordinary effort on the behalf of its DRM partners to implement, and denied "legacy" OS users, as well as users of the latest Media Center version, the use of new DRM-protected tracks.

    A patch for FairUse4WM 1.2 still isn't available, even though the tool was released last weekend.

    BTW, if you think MS is getting screwed by class breaks like this, think again. Content providers (think: RIAA members) will call in their non-refundable advances (usually over $25K per label!) received from distribution partners (think: music stores) for "material breach of contract". MS will fix the issue, the RIAA gets richer, and the guys that actually try to get music to you get screwed. Oh, well, they're used to it...

  • Shocking (Score:5, Informative)

    by Effugas (2378) * on Thursday September 07, 2006 @03:51PM (#16061652) Homepage
    First of all, the DRM code is most likely pretty self-contained, and is only interfaced with by a limited amount of code. (All the files run through some version of the Windows Media Encoder engine, remember?). So on that front, it's a hell of alot easier to patch an issue contained to DRM-land than it is to deal with something like IE, which has to interact with a much messier set of incoming files (the Web).

    Even then, the reason you don't release a patch in three days is that you're probably going to screw it up and not actually fix the problem. Amazingly enough, that appears to be exactly what happened.

  • by tomz16 (992375) on Thursday September 07, 2006 @03:52PM (#16061661)
    First of all, it's been cracked again. Look up FairUse4WM 1.2.

    Second of all, from what I've seen, it's not pushed out via windows update, but rather the client you are using for music. For instance, Napster pushed out the new version via a tiny patch when I launched the client. There IS a way to trick your client into believing that you already have the latest version (thus preventing the forced update). Look it up in the doom9 forums.

    This should keep the crack working until Napster pushes out a completely new version of the client that explicitly checks the version, or Micrsoft issues a regular update.

    -T

    P.S. Napster provided free of charge by my university. Hell, as a grad student, I guess I get paid to use it...

  • by c0d3h4x0r (604141)
    Not all fixes pose the same risks or require the same amount of testing.

    A patch for a DRM component surely involves much less code churn, risk, and testing than a change to a core OS component (such as network stack or IE) would require.

    Furthermore, as the original post indicated, no end-users are going to care about this patch or badmouth it in the press if it doesn't perfectly close the hole. And partner businesses aren't going to abandon their deep investments in Microsoft's platform just b/c of one hol
  • by dustwun (662589) on Thursday September 07, 2006 @04:09PM (#16061770) Homepage
    People seem to be overlooking who the customer REALLY is here. The bottom line lies in corporate back scratching for multi-$$$$ contracts and agreements

    One business contract with a large label, Dell, or Sony is worth more than the mutterings and begrudging updates from Windows consumers. Most of us are not the customers, we're the consumers. Most people don't buy windows from microsoft, they buy it from Dell, or Gateway, or whoever else sold them their computer. The Dells, Gateways, etc are the customers. The game companies writing for xbox 360s, the phone vendors embedding wince, they're the customers.

    Bottom line, If you're bitching about this update, you're a consumer. If you think it's a good thing, then you're the customer.
  • Not quite accurate (Score:3, Informative)

    by neokushan (932374) on Thursday September 07, 2006 @04:11PM (#16061786)
    That article is completely misleading. This "Vulnerability" has been known about since January 2005, the tools to bypass it were available since then, they just didn't have a fancy GUI to make it easier. This is actually one of the LONGEST periods Microsoft took to patch something.
  • by rubberbando (784342) on Thursday September 07, 2006 @04:20PM (#16061839)
    Just like the bozos in congress that attach totally unrelated garbage to a bill trying to get passed, Microsoft will probably just attach it to another update that people will actually install...

The flow chart is a most thoroughly oversold piece of program documentation. -- Frederick Brooks, "The Mythical Man Month"

Working...