Michael Howard - How hackers operate
- Posted: Jul 26, 2004 at 2:54 PM
- 19,624 Views
- 10 Comments
How do bad guys work to figure out security holes? Michael Howard, Microsoft's top security guy, talks about how the bad guys go about their work.
This video is from an earlier interview we did. Here's the rest of the clips, just in case you missed them:
What are the top things the average person can do to protect themselves?
When does threat modeling come into play?
What if we had an unattackable system?
What isn't being taught well enough in college? Security!
There are people out there that really want to get you.
This video is from an earlier interview we did. Here's the rest of the clips, just in case you missed them:
What are the top things the average person can do to protect themselves?
When does threat modeling come into play?
What if we had an unattackable system?
What isn't being taught well enough in college? Security!
There are people out there that really want to get you.
Comments Closed
Comments have been closed since this content was published more than 30 days ago, but if you'd like to continue the conversation,
please create a new thread in our Forums,
or
Contact Us and let us know.
More posts in this blog
-
Daniel Fernandez - Your first C# application
-
Michael Howard - How hackers operate
-
Dan Fernandez - Demo of C# Express (pull images…
Follow the Discussion
Oops, something didn't work.
What does this mean?
Following an item on Channel 9 allows you to watch for new content and comments that you are interested in. You need to be signed in to Channel 9 to use this feature.What does this mean?
Following an item on Channel 9 allows you to watch for new content and comments that you are interested in and view them all on your notifications page.sign up for email notifications?
Isn't that Brad Abrams in the grey t-shirt, occupying the corner seat right behind Michael Howard?
Thanks,
Colin.
Cool video. I havent read "Writing Secure Code" yet but, this video makes me want to go grab a copy and definately work harder to keep the "sKrypt Kddyz" away from my work.
-Brian
Heh, I have this book but can barely understand a good 60% of it due to my level of programming comprehension.
mVPstar
Arun
And yet there are thousands of instances of it, sure in simple cases it's easy to spot but in others it's easy to miss. Buffer overflows are the #1 cause of security flaws in any operating system.
Open source is not a silver bullet to protecting against such exploits. Neither is managed code, although it is considerably better in this regard.
90% of the time the answer is "the function will fail in some appropriate fashion."
10% of the time the answer is "the function will fail in this horribly dangerous or overdramatic fashion". For example, a thread might, instead of sensibly dying with an error code, sit forever on an exclusive lock and tie up the rest of the application.
That 10% of the time is what allows hackers in.
Every function should consider its input to be malicious, and take steps to fail intelligently if it is.
It's odd that he mentioned Perl in the context of a hacker tool, because Perl offers one of the few truly useful features for data sanitation - "taint" mode. This makes it very useful for easily writing secure daemon software.
Tick the DEP box and wait for Windows to pop up a dialog when a stack overrun occurs.
Except that you just said open source makes you feel better about security, so you don't bother checking why you need so many updates?
There are no silver bullets.
Remove this comment
Remove this thread
close