This is the thing we've seen over and over again - the attitude that says to hell with security, make it do more shit and we'll figure out the rest later. Or hey, maybe we'll get lucky and it'll never come up - our source is closed; who's gonna find it?What are you talking about? All software has security vulnerabilities. I don't think there's any indication that microsoft today has an attitude of "to hell with security", it sounds like this may be a very hard bug to fix -- one that's not widely known, and one that can't be used remotely, so most people aren't going to be affected. And anyone who runs the free Microsoft Security Essentials AV software should be safe, assuming Microsoft is one of the "Many" AV software vendors who have updated the definition files.
And they ask me why I, a Windows admin, use a mac at home.As far as Mac Os, there was apparently one open vulnerability as of June 10th and probably others. Apple and Microsoft both do security updates all the time. Generally they are security updates (I guess) that aren't known by malicious hackers, but in this case it was (apparently) a proprietary hack, not something that was widely know and exploitable.
the malware [has] a valid digital signature from Realtek Semiconductor, a legitimate company. Security researchers are anxious to learn how attackers got their hands on the digital signature [....] "Recalling a certificate from a company like this simply isn't feasible — it would cause an enormous amount of the software which they've released to become unusable," said Gostev.It is interesting that Microsoft goes the PKI route for security (despite its problems) but is unwilling to do the one thing that PKI is intended to allow you to do for damage control, that is, detect and revoke a compromised key.
No. Windows is insecure because it adheres to outmoded security models. There are a ton of *nix and Mac sploits out there, but very few of them have any impact... simply because Unix/Linux managed to get it rightWhat exactly is the "outmoded" security model windows uses? It certainly isn't the case that windows makes users administrator or 'root' by default anymore. So what are you talking about?
Mmm... yeah, but bugs and exploits in the dynamic linking architecture? That's day one stuff, innit? I mean, it's sort of the very first route anybody'd go (I imagine) to break admin controls and go nuts in a lot of contexts.I'm not really sure how to respond to that, since it's mostly just a mismash of computer terms, by "dynamic linking architecture" you could mean either DLL loading or how the shortcut system works, since it's kind of a vauge non-specific phrase and both are involved here.
I hate to say this, but I think OSX is more secure in general, simply because these things don't happen there.The problem here is that you're wrong and they do. This is an example of a security flaw. Security flaws are found in OSX all the time. I linked to some examples. To say otherwise is just counterfactual. This is not an example of spyware/malware which does target windows more often, unfortunately. As far as individually crafted attacks (which is what this was) Apple machines are just as vulnerable.
They did happen to base their whole operating system on code from one of the more secure and rational OSes on the planet (FreeBSD) which, for one thing, does dynamic linking in a secure way that actually makes sense.Yeah. This is also wrong. OS-X was based on the Match kernel and it has a BSD comparability layer, which is like saying Windows is based on Unix because cygwin exists.
At this point, having a secure OS requires as many human beings working as many hours maintaining the system as possible. The notion that Microsoft could ever employ as many people as BSD or Gnu/Linux evaporated in the late 90s; at this point, there are Linux hackers all over the place maintaining and developing and building securityI'm pretty confident in the security of the Linux Kernel. But you see security problems crop up in user-mode software all the time. Anyway, the security of the Linux kernel has no impact on OS X. So the rest of your comment about how awesome Linux is is kind of irrelevant.
"F-Secure also believes that this malware is designed for industrial espionage, because it looks for Siemens WinCC SCADA systems. Supervisory Control And Data Acquisition (SCADA) systems are used to monitor and control mission critical operations at power- and water-distribution plants, gas and oil refineries or manufacturing facilities."Fascinating. It wouldn't surprise me if this was done by the Russian government, which just got a copy of Window's source code, probably to spy on Gazprom's rivals. (Or it could have been any oil company, trying to get measurements on other oil companies reserves and production rates.)
Better to ask what it does not use: Least user access, aka LUA. Accountability, auditibility, access, aka AAA. Man, I could go on... but! Unix does this well, hardened Unix does it better. Windows can't even compete here, ask any CISSP...Are those technologies or just practices? Why can't you use them on windows? Certainly you can create restricted accounts.
Hey that's a pretty cool idea- doing shit in user mode. Maybe that could make systems more secure.Yeah, which is probably why windows works that way. Explorer runs as a regular user process (which means that this exploit couldn't theoretically do anything a regular user couldn't do, actually).
Yep. And if OS X was really as badly vulnerable as the bloggers say, the number of affected machinesHow many machines were "affected" by this hack? As far as we know, just one. It was a one off hack designed for a specific target. Whoever did it would have probably had the resources to target macs just as easily, if the critical systems had been running on Mac OS. But how common is that? (but I would imagine that for high level espionoge the personal machines of high level machines are targeted)
I guess for some ridiculous reason I've always called them "dynamic links" – which is frankly a pretty important subsystem, right?No. Windows has "real" hard and soft links now and they work the same was as in Unix. But when you're talking about a "Windows shortcut" they're really just text files with some meta data and the path of the target file in plane text. You can literally opent them up in notepad and edit them if you want. They actually end in .lnk.
and since they're necessary to build any kind of modern filesystem they're sort of an important place to look for security problems, no?As I said, this has nothing to do with actual file system level links.
So there's a sense in which this is bound to be a Windows-specific exploit (and it's not Microsoft's fault to that extent).Well, right, but you would never see security bugs caused by X-Windows or by window managers or whatever on windows. Different ways of doing things are going to cause different security problems.
We'll update this blog posting in the event another winner emerges today for the Vista or Ubuntu laptops that remain standing.Both the 2009 and 2010 events had Android as one of the targets in the mobile device part of the contest, so Linux was represented there too, if not so heavily.
« Older Bear with jar on head... | Photos of Irish Travellers at ... Newer »
This thread has been archived and is closed to new comments
posted by DZack at 8:53 PM on July 22, 2010