Microsoft on 'rootkits': Be afraid. Be very afraid.

Discussion in 'NZ Computing' started by BILL bs.xxxxxxxxxx.corn, Feb 17, 2005.

    1. Advertisements

  1. BILL     bs.xxxxxxxxxx.corn

    thing Guest

    thing, Feb 18, 2005
    1. Advertisements

  2. BILL     bs.xxxxxxxxxx.corn

    thing Guest

    I am not afraid (at least of my own systems) but work uses MS so that is
    an ever growing headache.

    Why do you think Firefox is doing 25 million downloads?

    Not just a better user experience but novice users feel safer....

    While it is arguable that in time the scum artists will target Firefox,
    possibly negating its advantage we shall see. Right now it at least
    gives 4~6 months breathing space from IEx problems which lets face it
    has more holes that a swiss cheese.

    What % of calls into Dell support turned out to be viruses, spyware and
    trojans? something huge, mostly all let in via IEx or Outlook.

    What about SP2 for XP becoming compulsory? now just how many things is
    that going to trash......

    Or why is it Linux does so well?.......Real life security capability, no
    theoretical security model, on top of a flaky OS but a simple solid
    proven security model on top of a solid base........

    Then if you want ACL it is available.....

    So pick your nightmare.......I sleep at night......



    thing, Feb 18, 2005
  3. BILL     bs.xxxxxxxxxx.corn

    Gordon Guest

    Yes, MS is popular, but does that explain all the hole discovered to date.

    Ms Penguin has her scanners on full time for security holes and when she
    points out one there is such an interest that the hole is plugged before
    she has finished fishing.

    MS uses the concept we have the people feeding our wallet so who cares?

    The difference in the mind set is what matters, will matter in the end.
    Gordon, Feb 19, 2005
  4. BILL     bs.xxxxxxxxxx.corn

    Steve Guest

    Steve, Feb 19, 2005
  5. isn't it network discovery?
    not sure of the name of the process, but yeah, google it if you're that
    Dave -, Feb 19, 2005
  6. BILL     bs.xxxxxxxxxx.corn

    Enkidu Guest

    DCE endpoint resolution. It's one of the NetBIOS/SMB type
    ports. Used in mapping drives, I think, though I'm not
    entirely sure. 135 through 139 and 445 are used for these
    sorts of services.


    Enkidu, Feb 19, 2005
  7. BILL     bs.xxxxxxxxxx.corn

    Steve Guest

    ....137-139 and 445? all I can find are references to dcom.

    Steve, Feb 19, 2005
  8. BILL     bs.xxxxxxxxxx.corn

    Adder Guest

    doo yuou really believe all the anti ms fud
    Adder, Feb 19, 2005
  9. I always thought that Open source by its very nature would have more holes
    found in it (with open source you get to see the cock ups programmers
    make.. with closed source you are feeling round in the dark)
    One thought that springs to mind on this issue was when Microsoft code
    was stolen and released to the net not too long ago.. very quickly holes
    were found and exploits released ( albeit for outdated programs )
    that example made me wonder just how buggy the code really is behind the
    swaret does for slackware ( cron job to the fore) and I'd hazard a guess
    other vendors have similar update strategies which.. if enough thought is
    given ... could be made fully automatic
    Shane (aka froggy), Feb 19, 2005
  10. certainly they would be better qualified to comment on the code than I
    however this comment was also on the same page
    Despite the above, the quality of the code is generally excellent.

    Well, maybe generally speaking. In instances, though, the programming is just sloppy.

    The first exploit based on the code is in the wild now, and it is a simple
    signed/unsigned coding mistake that will generate a buffer overflow in
    Internet Explorer 5.0 just by it displaying a bitmap image.
    (although this exploit was later claimed to have not been 'discovered' as
    a result of the release of the code)

    also the page you refer to says quite clearly..
    A quick, superficial look at the style and content of the leaked
    Windows 2000 source
    not an audit
    also there was a reference to Microsofts earlier NT4 code (which was also
    Their older code is flaky, their modern code excellent
    one other thing.. I note (with a smirk on my face) you claim Im spreading
    FUD yet you make no mention of the other responses I made to your previous
    Shane (aka froggy), Feb 20, 2005
  11. BILL     bs.xxxxxxxxxx.corn

    Axle Guest

    Axle, Feb 20, 2005
  12. BILL     bs.xxxxxxxxxx.corn

    Max Burke Guest

    Shane (aka froggy) scribbled:

    Using 'advanced static analysis': "cd drivers; grep copy_from_user -r ./* |
    grep -v sizeof", I discovered 4 exploitable vulnerabilities in a matter of
    15 minutes. More vulnerabilities were found in 2.6 than in 2.4. It's a
    pretty sad state of affairs for Linux security when someone can find 4
    exploitable vulnerabilities in a matter of minutes. Since there was no point
    in sending more vulnerability reports when the first hadn't even been
    responded to, I'm including all four of them in this mail, as well as a POC
    for the poolsize bug. The other bugs can have POCs written for just as
    trivially. The poolsize bug requires uid 0, but not any root capabilities.

    The scsi and serial bugs depend on the permissions of their respective
    devices, and thus can possibly be exploited as non-root. The scsi bug in
    particular has a couple different attack vectors that I haven't even
    bothered to investigate. Some of these bugs have gone unfixed for several

    The PaX team discovered the mlockall DoS. It has been fixed in PaX for 2
    years. I have attached their mail and exploit code.

    I'd really like to know what's being done about this pitiful trend of Linux
    security, where it's 10x as easy to find a vulnerability in the kernel than
    it is in any app on the system, where isec releases at least one critical
    vulnerability for each kernel version. I don't see that the 2.6 development
    model is doing anything to help this (as the
    spectrum of these vulnerabilities demonstrate), by throwing experimental
    code into the kernel and claiming it to be "stable". Hopefully now these
    vulnerabilities will be fixed in a timely manner.
    <end quote>


    Just playing the crap my OS is better than your OS infantile 'game' so loved
    by *nix users you understand.....
    Max Burke, Feb 20, 2005
  13. you're not wrong.. when you posted this story the first time I quietly
    agreed.. and the second time you posted this same story.. and .. well yeah
    the real point I was trying to make was.. I (and anyone that chooses to)
    can rip through and see the cock-ups made (incorrect malloc() calls etc)
    in fact thats exactly what you posted.. someone audited the code ( and
    showed it was rather poor)
    however.. with closed source products such as windows we cant,
    for all I and anyone knows there could be deliberate trojan like modules
    that report back to Microsoft what my and my familys browseing habits
    are.. what games we like to play.. what my best pickup lines in a chatroom
    are.. etc etc etc. (Im not saying their is.. although there have been some
    underhanded goings on that I recall in the news from years gone by )
    The point is we dont know .. how buggy the code is.. whats really in
    there.. nothing.
    We as end users are expected to 'trust' Microsoft.. take them at their
    word.. beleive carte blanche (sp?) that we are safe in their hands
    we could use the.. whats been found yardstick.. but thats a minefeild in

    heres an interesting story carried by /. on thursday
    it would appear the former white house cybersecurity and counter terrorism
    advisor would agree with my ramblings

    a quick look at some of your past posts would seem to indicate Micrososft
    users arent immune from playing that silly game themselves... you
    Shane (aka froggy), Feb 20, 2005
  14. Oh and an addednum.. 'better' is a loaded word.. linux is better for some
    things .. windows is better for others.. bsd is better yet more things..
    apples are better for some things... its been my experience what really
    makes the difference sits between the keyboard and the chair ( ie the user)
    Shane (aka froggy), Feb 20, 2005
  15. BILL     bs.xxxxxxxxxx.corn

    Max Burke Guest

    Shane (aka froggy) scribbled:
    The problem with OSS/Linux people are NOT auditing the code. That much is
    obvious from the huge number of bug patches require for RELEASED code.
    If the code was bieng audited then then there would be far less 'patching'

    You just have to visit several OSS\Linux support websites and subscribe to
    several OSS\Linux daily\weekly email lists to see that there is very little
    if any auditing of 'the code' prior to release....

    Then there's the myth that they get fixed quickly, but on examining the 'bug
    fix' you'll find MOST of the time that the bugs have existed in the in ALL
    prior releases up until the 'bug fix' release.... Sometimes/often that
    months and years befor the bug is discovered and fixed..

    IOW the many eyes on the code' yet another Linux myth that we (the users of
    OSS/Linux) are expected to trust when using the OSS/Linux, and that any bugs
    that do exist will be discvered and fixed 'quickly'....
    So how do the bugs in Windows get discovered??????
    Do those that discover the bugs just make them up?????

    Microsoft is the most wathed software company in the world; Microsoft
    products and services are the most 'picked apart' products and services in
    the world...

    Yet another OSS/Linux myth that we're expected to believe and trust as a
    'valid' reason for swapping to OSS\Linux....

    snip rest of the OSS\Linux myths....
    Not at all; But then neither should we be expected to believe all the myths
    and crap that's spouted about OSS\Linux....
    You're just as safe in 'Microsofts hands' as you are in the 'OSS\Linux
    communities hands' but that's not saying much at all about Microsoft OR the
    OSS\Linux community.

    The only thing worse than the millions of Windows user that are unaware of
    the need to protect their computers from attack on the internet, are the
    millions of Linux users that believe they're immune from attack because
    they're running Linux.....

    The only thing wrong with Linux are the myths and legends (about Linux) that
    so many of it's users believe in...

    Max Burke, Feb 20, 2005
  16. BILL     bs.xxxxxxxxxx.corn

    Adder Guest

    bullcrap i is obvious from your posts you are just troling with most of
    these messages
    good ridance
    Adder, Feb 20, 2005
  17. BILL     bs.xxxxxxxxxx.corn

    Drudge Guest

    Max posts idiotic rhetoric advocacy like Devine ... they should both post
    their crap in COLA where it belongs..
    Drudge, Feb 21, 2005
  18. BILL     bs.xxxxxxxxxx.corn

    simondo Guest

    I think Drudge is saying that arguing with Max (and Divine) is like arguing
    with Creationists and Holocaust Deniers: There's no point in trying to
    refute their argument -- you might try and discuss the issue rationally
    using logic but there ain't no way they're going to.

    simondo, Feb 21, 2005
  19. BILL     bs.xxxxxxxxxx.corn

    Max Burke Guest

    simondo scribbled:
    OK I'll play your 'game...'

    Do you think your response is rational and logical in any way at all??????
    Why dont you try offering a rational and logical response or refutation to
    the *points* in my post....

    Or is that someting you cant do?

    All the crap said about how bad Windows can and is as easily applicable to
    Linux and OSS.

    When Linux 'advocates' like post their 'advocacy' for linux they/you just
    hate being shown that what they're claiming is wrong with Windows, is just
    as much wrong with Linux/OSS...

    Care to disprove that fact?


    Didn't think you could....

    Again remeber that I'm just playing your 'game...'
    Max Burke, Feb 21, 2005
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.