Channel 9 Forums - Coffeehouse - Microsoft Security Alert, here's where to go http://mschnlnine.vo.llnwd.net/d1/Dev/App_Themes/C9/images/feedimage.png Channel 9 Forums - Coffeehouse - Microsoft Security Alert, here's where to go http://channel9.msdn.com/Forums Channel 9 keeps you up to date with the latest news and behind the scenes info from Microsoft that developers love to keep up with. From LINQ to SilverLight – Watch videos and hear about all the cool technologies coming and the people behind them. http://channel9.msdn.com/Forums en Wed, 22 May 2013 20:30:12 GMT Wed, 22 May 2013 20:30:12 GMT Rev9 61 -61 -1 Coffeehouse - Microsoft Security Alert, here's where to go Microsoft has released a security alert. There is a team at Microsoft that is dedicated to these kinds of crisis situations.

They publish their findings at microsoft.com/security.

If you find a new exploit, or know of some security problem on one of our products, please send email to secure@microsoft.com.

Already this page has been updated a few times in the past 24 hours. If you think you have a security problem with a Microsoft product, please check the security site.

If you just want to make sure you are protected, then visit microsoft.com/protect.

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/10736#10736 Fri, 25 Jun 2004 22:18:24 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/10736#10736 scobleizer 61 http://channel9.msdn.com/Niners/scobleizer/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go A patch is still not available for IE.

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/914651437676481898f89dea011f4c1d#914651437676481898f89dea011f4c1d Fri, 25 Jun 2004 22:53:48 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/914651437676481898f89dea011f4c1d#914651437676481898f89dea011f4c1d ZippyV 61 http://channel9.msdn.com/Niners/ZippyV/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go "A patch is still not available for IE"

Give them some time, ZippyV. Mama mia. You know how much has to happen before a patch is released?

First, the hole needs to be isolated (not always easy). Then a solution designed (not always easy). Then implementation(not always easy). Then testing(not always easy). Then fixing the bugs caused by the implementation(not always easy). Then start the cycle again(easy).

Look at this way: Developers and testers in IE land will be working through the weekend. Should they not be allowed to get any sleep or food or fresh air until the patch is ready to ship? There's only so many hours in a day.

I have tremendous respect for what these guys and gals in patch land are doing. It's one of the hardest jobs at Microsoft and it also gets the least amount of love.



Charles

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/8ff0a2c200a84c00b9339dea011f4c4a#8ff0a2c200a84c00b9339dea011f4c4a Fri, 25 Jun 2004 23:43:16 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/8ff0a2c200a84c00b9339dea011f4c4a#8ff0a2c200a84c00b9339dea011f4c4a Charles 61 http://channel9.msdn.com/Niners/Charles/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go While those diligent, hard working folks work overtime on the patch., some of us surf on...


The patch people DO have the crappiest job at Microsoft, ok except for maybe anyone with an officemate who runs at lunch now that the towels are BYOT, and probably get the least amount of love Smiley  It's probably worse for the IE team than for any other team. At least the Server team can say "they should upgrade to Server 2003". What can the IE team say? "Help!"

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/0f0d82be53c0493889e29dea011f4c7d#0f0d82be53c0493889e29dea011f4c7d Sat, 26 Jun 2004 01:21:45 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/0f0d82be53c0493889e29dea011f4c7d#0f0d82be53c0493889e29dea011f4c7d LazyCoder 61 http://channel9.msdn.com/Niners/LazyCoder/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go Give it a rest already!  Go back to Slashdot.  Sheesh, what with 4 threads on how crappy IE is (or are there more threads now?) and how Blessed-By-God Firefox (or whatever it is) is...

LazyCoder wrote:
While those diligent, hard working folks work overtime on the patch., some of us surf on...


The patch people DO have the crappiest job at Microsoft, ok except for maybe anyone with an officemate who runs at lunch now that the towels are BYOT, and probably get the least amount of love Smiley  It's probably worse for the IE team than for any other team. At least the Server team can say "they should upgrade to Server 2003". What can the IE team say? "Help!"

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/f2edf4f97f7342e4b69c9dea011f4cdb#f2edf4f97f7342e4b69c9dea011f4cdb Sat, 26 Jun 2004 02:20:13 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/f2edf4f97f7342e4b69c9dea011f4cdb#f2edf4f97f7342e4b69c9dea011f4cdb phunky_avocado 61 http://channel9.msdn.com/Niners/phunky_avocado/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go LazyCoder,

Keep in mind that IE, as the most used web browser in the world, will necessarily attract the most bad guys trying to find holes in it to use as means to do bad things to people surfing the web. When Gecko-based browsers increase significantly in usership, you will see an increase in security vulnerabilities in those browsers. Why? Well, if I am a hacker, then I want to hack as many people as possible with a single attack vector... 

IE has certainly had its share of security blunders, but consider what IE does: it enables users to surf aimlessly in the dangerous waters of the Internet. It is necessarily on the front lines when it comes to facing Internet-based attack, because it is an Internet explorer, after all. It is not at all surprising to me. This is exactly why security is the most important focus for IE right now. It simply has to be. 

You want a 100% secure browser, 100% secure operating system, 100% secure Internet? Well, then don't connect to the Internet. That said, in the future this will not necessarily be the case as users will have become more educated and systems made more secure, but the sad fact remains: there will always be bad people out there working tirelessly to figure out ways to hurt as many people as possible, even if only in abstract or virtual ways. 


Charles 

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/d34809e8f937437abf919dea011f4cae#d34809e8f937437abf919dea011f4cae Sat, 26 Jun 2004 03:57:11 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/d34809e8f937437abf919dea011f4cae#d34809e8f937437abf919dea011f4cae Charles 61 http://channel9.msdn.com/Niners/Charles/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go Charles, with all due respect listen to what you are saying. You are providing this forum to us to voice our opinion. To hear the cockpit and also talk back. Now, when you guys open your mouth about another security patch and we respond not so pleasantly - you say more or less to shut up and stop whining.

Hear me out because I am a software engineer and I know what it is to debug something in production and also get all clients updated. My point is MS is a company that I think would be unrivaled in intelligence (at least that is what I would suspect). Wouldn't you listen to these comments and say "hmm, how do we get things done quicker?" or think to yourself this is an interesting challenge and wonder how to attack it? From your replies I would sense you are tired of hearing the "whining" and wanting someone to give you a break. No breaks in software development. This is a job you signed up for, and now you need to take your medicine.

You don't want to hear us challenge MS or it's products - don't participate in your own site.

How does that feel coming from me? Maybe now you can walk in our mocassins a mile.

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/67f9c44ffe534db7bda59dea011f4d09#67f9c44ffe534db7bda59dea011f4d09 Sat, 26 Jun 2004 04:22:17 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/67f9c44ffe534db7bda59dea011f4d09#67f9c44ffe534db7bda59dea011f4d09 clint_hill 61 http://channel9.msdn.com/Niners/clint_hill/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go I have had faster patches for Linux Tongue Out

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/7dc34621e1d74194824d9dea011f4d34#7dc34621e1d74194824d9dea011f4d34 Sat, 26 Jun 2004 04:32:37 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/7dc34621e1d74194824d9dea011f4d34#7dc34621e1d74194824d9dea011f4d34 rjdohnert 61 http://channel9.msdn.com/Niners/rjdohnert/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go You've also had patches for Linux that broke many many applications.

The time spent in a patch is usually not in making the fix, it's spent on running lots of regression tests.

For IE, the regression matrix is literally the size of the internet.

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/be64685e55d3474d98a49dea011f4d5f#be64685e55d3474d98a49dea011f4d5f Sat, 26 Jun 2004 05:44:02 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/be64685e55d3474d98a49dea011f4d5f#be64685e55d3474d98a49dea011f4d5f LarryOsterman 61 http://channel9.msdn.com/Niners/LarryOsterman/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go I think I read that it's fixed with XP SP2 RC2 already.  So I would suspect that a general fix isn't far off.
Just one man's spin of the theory wheel though.

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/1d2d11dfa1a049c08abb9dea011f4de2#1d2d11dfa1a049c08abb9dea011f4de2 Sat, 26 Jun 2004 06:22:57 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/1d2d11dfa1a049c08abb9dea011f4de2#1d2d11dfa1a049c08abb9dea011f4de2 barlo_mung 61 http://channel9.msdn.com/Niners/barlo_mung/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go
I by no means intended my thoughts to cast such a negative shadow. I am just participating in the discussion and by no means am I trying to discourage the continuation of this thread.

I do take my medicine: interacting with the ideas presented on this site and honestly and openly adding my thoughts. What I posted is not a representation of what Microsoft thinks, only what I think.

Security holes suck and the blame for them falls squarely on the software where they're found. I would never think otherwise.

Fixing security flaws in software used by millions of people necessarily takes some time since the process required to get a fix out the door can be either simple or really complex depending on the specific vulnerability, but needs to solve the problem and not create new ones, security-related or otherwise, regardless. Either way, this does take some amount of time. I'm not saying this is a good or bad thing. I'm only just saying it.

I want to hear you challenge our products. I want this to be a place that enables and encourages the free excahnge of ideas. And I hope Channel 9 is just this.

Even though I am one of the so-called Channel 9 guys and a Microsoft employee I believe that If I have ideas to add to a discussion I should be able to introduce them freely. I'm here for the conversation too.

My aplogies if I've offended anyone or scared anyone away. It's certainly not my intention.


Keep on posting,

Charles

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/96cecb1307a749d9bddb9dea011f4d93#96cecb1307a749d9bddb9dea011f4d93 Sat, 26 Jun 2004 06:27:20 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/96cecb1307a749d9bddb9dea011f4d93#96cecb1307a749d9bddb9dea011f4d93 Charles 61 http://channel9.msdn.com/Niners/Charles/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go Clint_hill: I usually agree with turning on the negative feedback as must as possible (you've seen me encourage it over and over). It's how we learn to be better. But in some situations a little dialog (er pushback even) is necessary too.

This is a two-way street. Sometimes in the cockpit the pilot has to yell at the passengers and say "sit the hell down." I've heard it happen in a real plane. For their own good.

In this case we have a team who is working 24-hours-a-day trying to do the best they can under extremely tense, and extremely trying, circumstances.

You say "no breaks in software development." That's right. But, remember that there are human beings on this side of the fence too. Cut them a bit of slack, especially when they are working overnight trying to fix a problem that criminals exposed in the first place.

I'd love to give you a tour sometime around the security team and the Internet Explorer team so you can see how they are working.

Right now they are doing everything they can to help customers out. The patch will be out as soon as humanly possible. Can we do it any faster? I wish we could, but we're human and it takes time to make sure you don't cause a bigger mess than the one we're in already.

Keep watching microsoft.com/security. As soon as something new is known, it'll be up there. Last update was at 8:35 p.m. our time on Friday night.

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/5b1d245d93e1432583799dea011f4e12#5b1d245d93e1432583799dea011f4e12 Sat, 26 Jun 2004 06:39:18 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/5b1d245d93e1432583799dea011f4e12#5b1d245d93e1432583799dea011f4e12 scobleizer 61 http://channel9.msdn.com/Niners/scobleizer/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go
phunky_avocado wrote:
Give it a rest already!  Go back to Slashdot.  Sheesh, what with 4 threads on how crappy IE is (or are there more threads now?) and how Blessed-By-God Firefox (or whatever it is) is...


You're my hero man, you're so cool.

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/d73a3e7170724594ae629dea011f4e6f#d73a3e7170724594ae629dea011f4e6f Sat, 26 Jun 2004 07:00:21 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/d73a3e7170724594ae629dea011f4e6f#d73a3e7170724594ae629dea011f4e6f LazyCoder 61 http://channel9.msdn.com/Niners/LazyCoder/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go
Charles wrote:

LazyCoder,

Keep in mind that IE, as the most used web browser in the world, will necessarily attract the most bad guys trying to find holes in it to use as means to do bad things to people surfing the web. When Gecko-based browsers increase significantly in usership, you will see an increase in security vulnerabilities in those browsers. Why? Well, if I am a hacker, then I want to hack as many people as possible with a single attack vector... 



I never claimed that wouldn't happen if Gecko based browsers ruled the world. I implied that you're much safer surfing RIGHT NOW (and for the near future) using a non-IE based browser. Apache IS the most used web server in the world and therefore has the biggest target on it. That will always be a fact. Market share == more targets. But until the IE and Windows teams can rearchitect both the browser and the underlying OS (Windows Server 2003 is a GREAT start). You're better off using a browser with a smaller target on it's chest. Smiley

btw: You can't scare me away. Charles. Provided you state your argument clearly and politely. If you just pop in and tell me to shut up or go back to slashdot , like psycho bunny or whoever, I'll just mock you.  BTW I've been programming on the MS platform since VB 4-32 bit version (no 16-bit thankyouverymuch) and I've got a "Midnight Madness IE 3" t-shirt in my closet that's too small now. Back when Netscape was stuck in 4.X limbo I was arguing with Netscape devs and telling them to get with the program.  My point being I was supporting MS before supporting MS was cool and "anti-/.". I convinced 3 hospitals to port a completed ColdFusion application to ASP.NET last year. I've got a pretty big stake in the MS web platform and I'd  to be able to tell users, "Use whatever browser you want.".  I can't quite do that yet.

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/976506502448400ab6829dea011f4e44#976506502448400ab6829dea011f4e44 Sat, 26 Jun 2004 07:16:55 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/976506502448400ab6829dea011f4e44#976506502448400ab6829dea011f4e44 LazyCoder 61 http://channel9.msdn.com/Niners/LazyCoder/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go Getting to know the IE team and the Security Response Team is the best way we can understand them better. So, please give us a tour of the IE and Security teams, make them talk about their plans for the future, for the next IE version for example. What are they doing to improve IE based on our own feedback?
Also, instead of just giving general answers like, "we need to do a lot of testing for this patch" etc, the Security Team could have a blog or better a wiki here on Channel9, where they can give reports of their progress, share their testing issues with us and generally let us in on their inside work and difficulties. Getting to know them better will make us more cabable of judging them and enable us to appreciate their work.

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/ad6bdca66aa1454b9f609dea011f4e9b#ad6bdca66aa1454b9f609dea011f4e9b Sat, 26 Jun 2004 07:35:36 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/ad6bdca66aa1454b9f609dea011f4e9b#ad6bdca66aa1454b9f609dea011f4e9b nektar 61 http://channel9.msdn.com/Niners/nektar/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go How long does Microsoft now already about these bugs?

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/158021709924430b8bea9dea011f4ec7#158021709924430b8bea9dea011f4ec7 Sat, 26 Jun 2004 13:06:32 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/158021709924430b8bea9dea011f4ec7#158021709924430b8bea9dea011f4ec7 ZippyV 61 http://channel9.msdn.com/Niners/ZippyV/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go Keep in mind that this particular bit of nastyness is the result of some Large web servers Not having all their patches in place. If these fellows had all the patches that were released some time ago in place we would NOT be having this discussion. Of course there is a hole in IE that this is exploiting and I am sure there are other holes also. But this particular vector was made known to the general public just on thursday an IE patch is going to take a bit of time. Untill that time use Firebird if you are so inclined. BTW Channel 9 work well with Firebird.


]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/4f6a1e66d7484a6d886e9dea011f4ef2#4f6a1e66d7484a6d886e9dea011f4ef2 Sat, 26 Jun 2004 13:52:17 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/4f6a1e66d7484a6d886e9dea011f4ef2#4f6a1e66d7484a6d886e9dea011f4ef2 Lwatson 61 http://channel9.msdn.com/Niners/Lwatson/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go
ZippyV wrote:
How long does Microsoft now already about these bugs?

As far as I know, Microsoft learned about the bugs in IE that are being exploited last week, when Jelmer announced them to Bugtraq.

For whatever reason, Jelmer decided to announce the vulnerabilities publicly first, before contacting Microsoft, which puts further stress on the fix process.

Over the past several vulnerabilities (Sasser, MS-Blaster, etc), we've seen a steadily decreasing period of time from the public announcement of the vulnerability to the exploitation of the vulnerability.

It took 18 months for the vulnerability used in SQL Slammer to be exploited in the wild.  It took about 1 week for the vulnerability used in MS-Blaster/Sasser to be exploited.

And it took Jelmer's vulnerabilities about a week.

If someone contacts Microsoft FIRST with the vulnerability, without going public, it gives Microsoft a head start on the hackers to start the fix process. 

This can be the difference between an exploit that devastates the internet and one that is a major annoyance.  Fortunately, for this one, it was neither.


Btw, Jelmer's vulnerability was a way of crafting a URL so that it believes that that the target of the URL is in the Local Computer zone, and not the internet zone.  As a result, since IE believed that the script was in the local computer zone, it was allowed to do much more than normally allowed.

The scary thing about this exploit is not this particular exploit.  It's the ones that are going to be coming in the future that use it.  This particular exploit was fairly ham-handed, it required defacement of vulnerable web sites.  I believe that there are other ways this can be exploited that don't require hosting on external web sites.

The good news (as others above have said) is that the vulnerability was identified internally during the XP SP2 review process.  Which means that we probably know how destabilizing the fix will be.

On another related tact...

The security response team is on the 3rd floor of my building.  When an incident occurs, they shut down all the conference rooms on the floor, and effectively turn them into C&C centers.  They effectively live in the room from the start of an incident until it's over.  This is a REALLY big deal.

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/19ddf170f9cc42d28fbf9dea011f4f34#19ddf170f9cc42d28fbf9dea011f4f34 Sat, 26 Jun 2004 15:35:11 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/19ddf170f9cc42d28fbf9dea011f4f34#19ddf170f9cc42d28fbf9dea011f4f34 LarryOsterman 61 http://channel9.msdn.com/Niners/LarryOsterman/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go Karim,

Good point. I am sending this thread to the security team, and we'll do better in the future.

One thing that we've had internal arguments about is transparency. Some people believe that you should only communicate when you have something to announce. I am in your camp.

I have a ton of excuses, but we all know what those mean.

--Robert

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/d94dad9fd2fa4433af8f9dea011f4fa9#d94dad9fd2fa4433af8f9dea011f4fa9 Sat, 26 Jun 2004 18:02:26 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/d94dad9fd2fa4433af8f9dea011f4fa9#d94dad9fd2fa4433af8f9dea011f4fa9 scobleizer 61 http://channel9.msdn.com/Niners/scobleizer/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go [quote user="scobleizer"]Keep watching microsoft.com/security. As soon as something new is known, it'll be up there. [quote]

Ok, here is where I'd like to bust the chops of the Channel 9 Team a little.

On Sunday 6/13, I sent an email to some customers, with a subject of "New Internet Explorer vulnerabilities."  I mentioned the problem with IE and said Microsoft was looking into it and that I hoped to see a Critical Update for IE within the next few days.  (Admittedly, this was my optimism.)  I also added a warning about visiting unsolicited or untrusted URLs, which I felt somewhat sheepish about providing, given the hyperlinked nature of the Internet.

I thought about starting a thread on Channel 9 at that point asking about the status of the IE security patches.  To use the Channel 9 airplane analogy, at this point I have told my customers fellow passengers, in my calmest voice, that they might be seeing what looks like smoke coming from one the engines, but it is nothing to worry about because we have very smart and capable people in the cockpit and they have the situation completely under control.  So now I'm seeking some information that this is in fact the case.

I checked Channel 9 over the next few days as well as microsoft.com/security.  Nothing.  I thought it was weird that Microsoft didn't even mention the vulnerabilities on the Security page.

Instead of starting a thread, I thought I'd just wait until someone else started one.  After all, you see a little smoke coming from the engines, probably everyone wants to push the little stewardess button flight attendant call button and point out the window.  Best just to hope they've noticed and they're taking care of it.

Days pass and the "chatter" about IE exploits starts to pick up in the industry press.  Now people are reporting plumes of flame streaking from the engine that was formerly smoking.  Someone came back from the rear lavatories and said the back of the aircraft smelled like something was burning.  Still no word from the "pilots" on Channel 9, and based on the content of microsoft.com/security, the only thing I need to worry about is a thunderstorm that passed us a couple of months ago ("Sasser").

Last Wednesday some of my customers fellow passengers had their antivirus alarms go off.  They'd been somehow infected by something called "Backdoor.Berbew.F," which does all kinds of nasty things, like turn your computer into a proxy server and (depending on who you ask) either steals cached passwords or installs a keystroke logger.  They've started to freak out.  So now I'm in that Twilight Zone episode ("Nightmare at 20,000 Feet") starring William Shatner in a bug-eyed cold sweat, grabbing my lapels and screaming, "THERE'S SOMETHING OUT ON THE WING!!!"

Of course I tried to figure out how they got infected.  Did they install some bogus software?  Download any warez from Kazaa?  Click on a link someone sent them via email?

No, it turns out that they had all merely visited the home page of a Fortune 500 company.

So I load up "Wfetch" from the IIS Resource Kit and view the HTML from this Fortune 500 company.  The server is running IIS 5.0 and sure enough, there's some interesting Javascript tacked on the end of the home page, which seems to be pulling up content from an IP address... that's located in Russia.

That's right, Fortune 500 company, home page pulls up content on obscure IP address in Russia. 

Golly, Mr. Shatner, there is something out on the wing.  And it's ripping pieces of sheet metal off the plane.  (As Mr. Spock would say, "Fascinating.")

So I check Channel 9 and there's some video about what snack foods were consumed during the creation of the .NET CLR and a poll on whether there should be any more polls.  No warm fuzzies there, so I check microsoft.com/security and I'm still getting dire warnings about... Sasser.  Hmmm.

So now I'm thinking that the view into the cockpit isn't really working for me.  The plane is going down in flames and (as I joked earlier) all I can get is a pre-recorded selection of soothing music.  Please God don't let me die while listening to Kenny G....

Of course yesterday Microsoft announced "Download.Ject," which is how that particular Fortune 500 server (and possibly others) managed to infect untold numbers of people -- it was missing a single patch.  Which was somewhat encouraging, because when you see people dropping dead of a mysterious new disease all around you, it is comforting to know that the experts (while unable to offer detection, cure, or prevention) at least know how the disease is spread.

I checked Channel 9 for fun today (Kenny G starting to grow on me!) and mirabile dictu, there's a thread at the top about the IE security vulnerabilities.  And it tells you to check microsoft.com/security.  So I load up the security page again and there's a snazzy new graphic for "Download.Ject: What you should know."  The graphic features a guy staring at his laptop, who is probably blissfully unaware that he has just been backdoored out the wazoo.  Still nothing specifically about the IE vulnerabilities, though.  Threat number two?  Good old Sasser. 

I hope I've made my point.

I have nothing the least bit bad to say about the folks who are actually working on patching IE.  I'm sure they actually are very smart, dedicated people who are working around the clock under very difficult conditions.

I do fault the communications from MS on this subject, though.  The information on Download.Ject suggests that IIS servers missing patch 835732 are "are possibly being compromised and being used to attempt to infect users of Internet Explorer with malicious code."  POSSIBLY being compromised?  ATTEMPT to infect users?  Please.  This isn't a court case, and you don't have to say "alleged" perpetrator/victim until the DNA tests come back.  Servers are being hacked.  Fully patched systems running IE are being backdoored.  People need to understand this is not a theoretical threat.

There needs to be some acknowledgement from Microsoft about the problems with IE.  Right now my links on this issue come from Reuters, Forbes, News.com -- NOT Microsoft.

There needs to be some kind of regular (as in daily) update from Microsoft on an issue of this importance.  What is the point of this (besides giving your customers warm fuzzies)?  Well, let's say that a patch for IE is "almost there," but there is some problem getting it to work on 64-bit systems (as recently happened with XP SP2 RC2).  If the security team posts for three days straight that the patch will be RTM as soon as the 64-bit issues are fixed, I guarantee that you will hear from a LOT of customers saying, "Screw the five people using 64-bit systems, I need to patch IE now!!!"  I know MS coders take pride in their work and have a craftsman-like approach to their software -- it's done when it's done, and they'll get it right the first time -- but in some cases (e.g. security issues) I think they need feedback from their customers saying "It's good enough -- ship it!"

Channel 9 has given me lots of entertainment and insight into Microsoft "behind the scenes."  But I can't say I've felt that it has been all that useful.  For useful, I still turn to sites like Neowin, Bink, MSDN, and the rest of the industry press. 

Channel 9 has the potential to be so much more than an admonition to "keep watching microsoft.com/security."

My apologies for such a long rant.

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/dcf5e0eb64f7415f90df9dea011f4f7f#dcf5e0eb64f7415f90df9dea011f4f7f Sat, 26 Jun 2004 18:03:41 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/dcf5e0eb64f7415f90df9dea011f4f7f#dcf5e0eb64f7415f90df9dea011f4f7f Karim 61 http://channel9.msdn.com/Niners/Karim/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go "What he said"

Also, big kudos for a really great riff on the Channel9-as-airplane idea.  Makes it hit home -  although hopefully not in a "controlled flight into terrain" kind of way...

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/4ab7775e29a24895b8579dea011f4fd4#4ab7775e29a24895b8579dea011f4fd4 Sat, 26 Jun 2004 18:26:05 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/4ab7775e29a24895b8579dea011f4fd4#4ab7775e29a24895b8579dea011f4fd4 jonathanh 61 http://channel9.msdn.com/Niners/jonathanh/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go I just got a reply back from the security team. There are literlly hundreds of people who haven't slept more than a couple of hours since Thursday night. Every statement they put out has lots of thought behind it. The guy who replied to me said "hundreds of hours."

Their pushback on me (we were talking about crisis communications last week, ironically) is that they need to make sure that anything they say is 1) Accurate. 2) Doesn't cause more harm than what's being caused already. 3) Consistent.

Anyway, the security team (and many others) are aware of this thread and hopefully they'll jump in with more info.

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/39c5e369883046179dc39dea011f5002#39c5e369883046179dc39dea011f5002 Sat, 26 Jun 2004 18:36:30 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/39c5e369883046179dc39dea011f5002#39c5e369883046179dc39dea011f5002 scobleizer 61 http://channel9.msdn.com/Niners/scobleizer/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go Nektar: I already have plans to tour the IE team. That'll happen soon.

I'd love to do a Channel9 tour of the Security Response team too.

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/2159c397aa184e2180059dea011f502c#2159c397aa184e2180059dea011f502c Sat, 26 Jun 2004 18:38:18 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/2159c397aa184e2180059dea011f502c#2159c397aa184e2180059dea011f502c scobleizer 61 http://channel9.msdn.com/Niners/scobleizer/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go Hey guys the linux comment was a joke and not inteded to be taken seriously, I was just qoting what a user said on /. If I offended, my apologies.

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/dfe416abd6ab45288add9dea011f5056#dfe416abd6ab45288add9dea011f5056 Sat, 26 Jun 2004 18:50:20 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/dfe416abd6ab45288add9dea011f5056#dfe416abd6ab45288add9dea011f5056 rjdohnert 61 http://channel9.msdn.com/Niners/rjdohnert/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go Karim,

You are right on target. Let's see if we can get some sort of almost-real time patch status data up on Channel 9 going forward ("Fix has been designed. Currently implementing... Major regressions uncovered...Need more time").

Why keep people guessing about the status of our security patches? It just adds confusion and creates skepticism. I'm thinking this type of transparent mechanism would be quite useful. 

Keep on ranting,

Charles 

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/09f595b6ad464ff5923b9dea011f5091#09f595b6ad464ff5923b9dea011f5091 Sat, 26 Jun 2004 19:06:57 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/09f595b6ad464ff5923b9dea011f5091#09f595b6ad464ff5923b9dea011f5091 Charles 61 http://channel9.msdn.com/Niners/Charles/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go
rjdohnert wrote:
Hey guys the linux comment was a joke and not inteded to be taken seriously, I was just qoting what a user said on /. If I offended, my apologies.


No need to apologize, but thanks for being respectful!

Nobody has an easy time with this type of mess. Whenever you fix something, there's always the possibility that you end up breaking something else, regardless of platform. Solid patches take time to make (since there is so much testing required), but there is certainly an upper limit for acceptable time to market and I know we are trying to figure out how to be more agile when it comes to hole filling. In the meantime, we can do a better job of communicating patch status and I think you will see us get better at this going forward.


Keep on posting,

Charles

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/183b4340204649fca02c9dea011f50bf#183b4340204649fca02c9dea011f50bf Sat, 26 Jun 2004 19:14:19 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/183b4340204649fca02c9dea011f50bf#183b4340204649fca02c9dea011f50bf Charles 61 http://channel9.msdn.com/Niners/Charles/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go Btw, as an example of a fix that broke something, consider what happened when the IE team fixed the username/password in an HTTP url problem.

This was a case where IE (and most other browsers) clearly were not following the HTTP standard (which explicitly stated that usernames were not allowed in HTTP urls).

When we pulled support for this because it was a security risk (and was being actively exploited for phishing schemes), we heard nothing but screams of anguish from customers who were using this feature.

I'm actually really happy that Microsoft has stood by its guns and NOT caved in to put in a variant of the problem back in.

This is a case where IE was made MORE standards compliant than its competitors and we got flack for it Smiley

When you're IE, you can't make ANY changes without being REALLY REALLY REALLY careful.

I think that Charles is right, that some kind of a "yes, we know about it, we're working on it" thing is a good idea.

But it has to be tempered by the fact that we can only do this if there's an active exploit in the wild - if there's no exploit in the wild, just the knowledge that we're working on the fix can tip the bad guys to where to start looking for the exploit.

That's why it's so important that every word published about this on official channels be carefully scrutinized.  You don't want to give the bad guys any more information than you can.

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/1bf2665029b1492099cc9dea011f50ee#1bf2665029b1492099cc9dea011f50ee Sat, 26 Jun 2004 19:29:21 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/1bf2665029b1492099cc9dea011f50ee#1bf2665029b1492099cc9dea011f50ee LarryOsterman 61 http://channel9.msdn.com/Niners/LarryOsterman/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go
LarryOsterman wrote:
ZippyV wrote: How long does Microsoft now already about these bugs?

As far as I know, Microsoft learned about the bugs in IE that are being exploited last week, when Jelmer announced them to Bugtraq.

[snip]

And it took Jelmer's vulnerabilities about a week.



The CERT vulnerability note for this goes back to 9-JUN-04.  See http://www.kb.cert.org/vuls/id/713878

Jelmer's posts are dated 6-JUN-04.  See http://archives.neohapsis.com/archives/fulldisclosure/2004-06/0104.html

In that post Jelmer references an "0day exploit" which was mentioned on 14-MAY-04 (See http://www.securityfocus.com/archive/1/363338/2004-05-11/2004-05-17/0)

And in Jelmer's analysis of the vulnerability (http://62.131.86.111/analysis.htm), he says that it uses the "adodb.stream" vulnerability he reported on 26-AUG-03, going so far as to add the comment, "Microsoft where's the patch?"

Good question.

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/2c1a5cb38eea441098ff9dea011f511f#2c1a5cb38eea441098ff9dea011f511f Sat, 26 Jun 2004 22:22:39 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/2c1a5cb38eea441098ff9dea011f511f#2c1a5cb38eea441098ff9dea011f511f Karim 61 http://channel9.msdn.com/Niners/Karim/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go Many thanks to everyone who replied.  I feel like at least someone is listening.  Smiley

If crisis communications improves even a little bit as a result of this thread, Channel 9 will have truly proved its worth.

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/e7185eaf3ca443a591489dea011f5149#e7185eaf3ca443a591489dea011f5149 Sat, 26 Jun 2004 22:33:57 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/e7185eaf3ca443a591489dea011f5149#e7185eaf3ca443a591489dea011f5149 Karim 61 http://channel9.msdn.com/Niners/Karim/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go You're welcome, Karim. Thanks to you and everyone else for the excellent feedback. As I type, there are folks from Microsoft Security Land reading this thread.

We are listening, not just hearing. There is a big difference.

Keep on posting,

Charles

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/4a31beb3b3f042fea1a59dea011f5173#4a31beb3b3f042fea1a59dea011f5173 Sat, 26 Jun 2004 23:27:24 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/4a31beb3b3f042fea1a59dea011f5173#4a31beb3b3f042fea1a59dea011f5173 Charles 61 http://channel9.msdn.com/Niners/Charles/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go So Karim, IF Internet Explorer wouldn't render/execute anything that comes before or after the <html></html>-tags this script would have never worked?
Why should I bother placing those tags when IE just renders his own way?

Guys (from ms), don't let this be a repetition of last summer.

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/4d1aeb10d7874b14b9189dea011f51a4#4d1aeb10d7874b14b9189dea011f51a4 Sun, 27 Jun 2004 00:08:32 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/4d1aeb10d7874b14b9189dea011f51a4#4d1aeb10d7874b14b9189dea011f51a4 ZippyV 61 http://channel9.msdn.com/Niners/ZippyV/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go Dude, that was John Lithgow on the plane (his movie debue). 

Though you if you want to stick with Shatner, I think Airplane II The Sequel should provide a good story.

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/0f7ba80528ad4ed79b049dea011f51d3#0f7ba80528ad4ed79b049dea011f51d3 Sun, 27 Jun 2004 17:14:44 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/0f7ba80528ad4ed79b049dea011f51d3#0f7ba80528ad4ed79b049dea011f51d3 pacelvi 61 http://channel9.msdn.com/Niners/pacelvi/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go This is good to know.  More people should post on what Microsoft does right because most of the time the only things people post are complaints and what Microsoft does wrong. 

Point of fact:  In this thread Microsoft is getting bashed because they have not put out a patch fast enough after the exploit was released; yet, in the not-so-distant-past when it is discovered after a patch is released that Microsoft has known about the exploit that the patch fixes for a couple of months, guess what?  People scream and complain about "how could you let this thing go on for so long without letting anyone know?"!

Damned if you do, damned if you don't.

LarryOsterman wrote:
Btw, as an example of a fix that broke something, consider what happened when the IE team fixed the username/password in an HTTP url problem.

This was a case where IE (and most other browsers) clearly were not following the HTTP standard (which explicitly stated that usernames were not allowed in HTTP urls).

When we pulled support for this because it was a security risk (and was being actively exploited for phishing schemes), we heard nothing but screams of anguish from customers who were using this feature.

I'm actually really happy that Microsoft has stood by its guns and NOT caved in to put in a variant of the problem back in.

This is a case where IE was made MORE standards compliant than its competitors and we got flack for it Smiley

When you're IE, you can't make ANY changes without being REALLY REALLY REALLY careful.

I think that Charles is right, that some kind of a "yes, we know about it, we're working on it" thing is a good idea.

But it has to be tempered by the fact that we can only do this if there's an active exploit in the wild - if there's no exploit in the wild, just the knowledge that we're working on the fix can tip the bad guys to where to start looking for the exploit.

That's why it's so important that every word published about this on official channels be carefully scrutinized.  You don't want to give the bad guys any more information than you can.

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/3e9e3280e4db4ce9973d9dea011f520b#3e9e3280e4db4ce9973d9dea011f520b Sun, 27 Jun 2004 18:02:26 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/3e9e3280e4db4ce9973d9dea011f520b#3e9e3280e4db4ce9973d9dea011f520b phunky_avocado 61 http://channel9.msdn.com/Niners/phunky_avocado/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go
Charles wrote:

You want a 100% secure browser, 100% secure operating system, 100% secure Internet? Well, then don't connect to the Internet.



This is the comment that sent me down the road I went. And to be very clear, I am in no way trying to be the ungrateful end-user. I was simply trying to point out that comments like the one above can get really twisted (obviously as I am victim). Even scobleizer mentions all the time how ASCII can get twisted.

More to the point, I really like hearing from the MS folks especially from behind the curtain. This site is exactly what I would want to see and hear. I am a fan of MS tools and products. But when I see comments like the one above it makes me think MS (and yes Charles I am picking on you) folks are just tired of us "stupid users" wanting our cake and eating it too. And I know there are humans behind the curtain scobleizer, I wouldn't have thought otherwise, yet it is the caliber of human that I would expect. I know it takes time as I said I am a developer too. To reiterate my thoughts from earlier, it seems to me you should be considering solutions, and if nothing else saying "we're working on it." Don't tell us to not use the internet.

And you guys are allowed to be informal, please do. But you have to realize you're sitting in the castle and we don't know what goes on back there behind the walls.

Lastly, Charles, scobleizer I would like to say that the responsiveness of MS from this site is truly a credit to you channel 9 guys. I consider you the gatekeepers and appreciate your efforts to put together this site. Just be easy on the "stupid end users" because we pay the money to use the products that your company sells to be able to pay your checks.

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/5776943370bc47d1b8679dea011f523d#5776943370bc47d1b8679dea011f523d Mon, 28 Jun 2004 00:28:30 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/5776943370bc47d1b8679dea011f523d#5776943370bc47d1b8679dea011f523d clint_hill 61 http://channel9.msdn.com/Niners/clint_hill/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go >But you have to realize you're sitting in the castle and we don't know what goes on back there behind the walls.

Yup, I was on the outside until a year ago. I always wondered what it was like on the inside. I'm trying to build relationships with the security team so that we can bring our cameras over there and show you more. They are pretty great guys who have to work under stressful situations.

Heh, thanks for the kind compliments. Just remember, I'm a stupid end user too!

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/20c446acd4a245578b1b9dea011f5269#20c446acd4a245578b1b9dea011f5269 Mon, 28 Jun 2004 00:48:20 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/20c446acd4a245578b1b9dea011f5269#20c446acd4a245578b1b9dea011f5269 scobleizer 61 http://channel9.msdn.com/Niners/scobleizer/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go I heard that the version of IE in Windows XP SP2 RC2, damn that was a mouthful I challenge you all to say it 20 times really fast, is immune to this type of attack.  Is this true or is it false.  I was wondering if any of you MS guys could confirm or deny it.

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/28a89e7cbe14489696839dea011f5294#28a89e7cbe14489696839dea011f5294 Mon, 28 Jun 2004 05:29:32 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/28a89e7cbe14489696839dea011f5294#28a89e7cbe14489696839dea011f5294 rjdohnert 61 http://channel9.msdn.com/Niners/rjdohnert/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go

"Customers who have deployed Windows XP Service Pack 2 RC2 are not at risk."

(from http://www.microsoft.com/security/incident/download_ject.mspx)

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/3fad7a341c6143d58cd89dea011f52c0#3fad7a341c6143d58cd89dea011f52c0 Mon, 28 Jun 2004 05:46:05 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/3fad7a341c6143d58cd89dea011f52c0#3fad7a341c6143d58cd89dea011f52c0 jonathanh 61 http://channel9.msdn.com/Niners/jonathanh/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go
phunky_avocado wrote:
Point of fact:  In this thread Microsoft is getting bashed because they have not put out a patch fast enough after the exploit was released; yet, in the not-so-distant-past when it is discovered after a patch is released that Microsoft has known about the exploit that the patch fixes for a couple of months, guess what?  People scream and complain about "how could you let this thing go on for so long without letting anyone know?"!

Damned if you do, damned if you don't.


The other thing that happens if MS release a patch like MS04-011 and an incompatibility with some drivers is found, people (and the gutter press) panic and don't apply it. This current problem is occurring partly because website administrators didn't apply 04-011, because they were scared off from doing so by extensive reports of failing servers. Microsoft are then condemned for not doing enough testing!

MS04-011 is accused of being too large. However, the fixes to different vulnerabilities affected the same binaries. Modifying the kernel (Windows 2000 and NT 4.0 needed new NTOSKRNL.EXE builds) can require the libraries and processes which interface directly with the kernel to be rebuilt and rereleased. Example: win32k.sys, the kernel side of the Win32 USER and GDI stack directly exports system services through user->kernel traps (rather than through device-driver interfaces) was rebuilt for Windows 2000, presumably because the kernel modules need to be kept as a matched set.

04-011 has had a knock-on effect in another direction: PSS is backed up. It took a couple of weeks for us to get a hotfix for another 'security' issue: the Telephony server in Windows Server 2003 is a bit too secure for Windows XP clients, it won't allow them to connect. The hotfix changes how the clients connect. We submitted an online support request to the UK support website, having identified the hotfix required (824692). Our request ended up in a queue in China, got batted back to the UK queue, which was backed up, got redirected to the US queue and finally officially got the hotfix from UK 10 working days after asking for it - for Windows 2000, not XP.

What was worst about this incident was the complete silence from PSS on the issue, and when I tried phoning, I got very little help (getting an engineer who said he couldn't help because the case wasn't assigned to him!). However, I have a contact in Exchange PSS who helped a lot, getting me the right hotfix unofficially within four working days (actually only a day after escalating it). Support shouldn't rely on personal favours! I found out about the constant queue movement through my contact, not through official channels.

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/b3d6d9914adc4224af679dea011f52f5#b3d6d9914adc4224af679dea011f52f5 Mon, 28 Jun 2004 10:12:58 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/b3d6d9914adc4224af679dea011f52f5#b3d6d9914adc4224af679dea011f52f5 Mike Dimmick 61 http://channel9.msdn.com/Niners/Mike Dimmick/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go
Charles wrote:

You want a 100% secure browser, 100% secure operating system, 100% secure Internet? Well, then don't connect to the Internet. That said, in the future this will not necessarily be the case as users will have become more educated and systems made more secure, but the sad fact remains: there will always be bad people out there working tirelessly to figure out ways to hurt as many people as possible, even if only in abstract or virtual ways. 

Charles 



Some days I can't believe these arguments even happen.  To run against the grain and risk a lot of wrath, my only reply to the above comment is "how true".  Why?  Well, hackers have been around for decades.  And so has software piracy.  And so have people who are intent on breaking things or breaking into things.  You can put up a hundred types of defense, but as long as there is somebody out there intent on breaking in, they are probably going to find a way.  Nobody wants to reinstall an operating system after an attack or spend hours hunting down and removing malicious files.  But like it or not, that is the inherent risk you take by connecting to the internet in the first place. Funny, nobody seems to remember that even back in the eighties, well before IE, a big issue was software piracy...every time a game manufacturer would try to come up with a new technique to protect their games from being copied (by using half tracks, missing disk sectors, whatever) somebody would come up with a way to break in.  Odd, too, was the fact that makers of certain copying programs would figure this out and add it to their list of programs you could copy with their software (Copy II Plus comes immediately to mind).  Of course the copy programs would clearly state this was for "personal use" only.  Oh, wait, that was an APPLE issue, not a PC problem (yeah, right).  But Apple never has problems, or so some people would like to believe.

The targets are now much more visible, much more public (and personal), and yes, the risks are more substanital when you are talking about stolen credit card numbers.  I've had my checking account hit before (not through online banking), so yes, I know what it is like to deal with identity theft and affidavits of forgery, etc.  I was angry when it happened to me, and my perception at that time was that the bank could not move fast enough.  But anybody who believes that software is going to ultimately protect them 100% of the time is kidding themselves.  And there is always going to be somebody out there to complain that this company or that company is not reacting fast enough.  Nobody is going to like it when they connect up to a trusted site, only to find themselves getting attacked. Plain and simple it is theft--and it has been there since the beginning of time, except now it manifests itself in a different, more widespread form.

Just my $.02.

P.S. Oh and be sure to send the IE staff several cans of coffee and some chains so they can shackle themselves to their desks until everything is fixed.  I'm sure their families will completely understand.

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/00f44064ed604203844f9dea011f532b#00f44064ed604203844f9dea011f532b Mon, 28 Jun 2004 14:38:27 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/00f44064ed604203844f9dea011f532b#00f44064ed604203844f9dea011f532b jsrfc58 61 http://channel9.msdn.com/Niners/jsrfc58/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go
jonathanh wrote:

"Customers who have deployed Windows XP Service Pack 2 RC2 are not at risk."

(from http://www.microsoft.com/security/incident/download_ject.mspx)


This is a perfect example of a security fix, which Microsoft thinks is not ready for public consumption (DO NOT INSTALL SP2 RC2 ON PRODUCTION SYSTEMS!!!  CAUTION, BETA SOFTWARE!!!  DANGER WILL ROBINSON!!!) but which turns out to be perfectly acceptable to most non-Microsoft people who just don't want their computers hacked.

I don't understand why Microsoft hasn't even published a simple utility or .REG file that closes up the vulnerability.  (See http://www.eeye.com/html/research/alerts/AL20040610.html)

Sure, it might break .HTAs or the Help System, but you can tell people that when you offer it to them.  More choices about how to react is almost always better than less choices, and there will be a lot of people who will choose a temporarily broken Help system over having to worry about whether each and every URL they visit is going to instantly infect their computer.

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/04729819e2524bd8b6389dea011f535b#04729819e2524bd8b6389dea011f535b Mon, 28 Jun 2004 14:58:01 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/04729819e2524bd8b6389dea011f535b#04729819e2524bd8b6389dea011f535b Karim 61 http://channel9.msdn.com/Niners/Karim/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go
Charles wrote:
You want a 100% secure browser, 100% secure operating system, 100% secure Internet? Well, then don't connect to the Internet.


Clint_Hill said:
This is the comment that sent me down the road I went. And to be very clear, I am in no way trying to be the ungrateful end-user. I was simply trying to point out that comments like the one above can get really twisted (obviously as I am victim).

That comment is actually a general truth, an axiom even, in the software security field. It's most certainly not a slam on end users of Microsoft products. Again, my apologies if I offended or misled. It was not my intention.

As to the notion of "stupid end users", I'm not a big fan of such thinking. I've actually not met anybody around here who thinks of our customers in this way. If I do hear somebody expressing that sentiment, I'll be sure to pass a long a "up yours!" for you. 


Keep on posting,

Charles

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/11c7badca9174d6ca3169dea011f53b6#11c7badca9174d6ca3169dea011f53b6 Mon, 28 Jun 2004 17:48:05 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/11c7badca9174d6ca3169dea011f53b6#11c7badca9174d6ca3169dea011f53b6 Charles 61 http://channel9.msdn.com/Niners/Charles/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go
Karim wrote:


I don't understand why Microsoft hasn't even published a simple utility or .REG file that closes up the vulnerability.  (See http://www.eeye.com/html/research/alerts/AL20040610.html)

Sure, it might break .HTAs or the Help System, but you can tell people that when you offer it to them.


I agree that it's mystifying as to why patchs take to long to be released...but a super compelling reason would be to avoid litigation.  Patchs that fix holes can't go around breaking other things... 

...which is why I majorly disagree with your concept of patchs being released that may cause other components to fail, but informing people of the failure.  That's not how commercial software works...not anything remotely good anyways...

The bigger they are, the slower they are...5,000 people or 5...the patchs will take longer than you or I think they should.

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/0bc871ef002a47f2a6059dea011f53e3#0bc871ef002a47f2a6059dea011f53e3 Mon, 28 Jun 2004 19:41:05 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/0bc871ef002a47f2a6059dea011f53e3#0bc871ef002a47f2a6059dea011f53e3 amg 61 http://channel9.msdn.com/Niners/amg/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go
amg wrote:


I agree that it's mystifying as to why patchs take to long to be released...but a super compelling reason would be to avoid litigation.  Patchs that fix holes can't go around breaking other things... 

...which is why I majorly disagree with your concept of patchs being released that may cause other components to fail, but informing people of the failure.  That's not how commercial software works...not anything remotely good anyways...


I don't have any problems with how long "patches" take to be released.  They take as long as they take, and I know some folks in Redmond are busting their asses trying to get this one out the door.

The reason why I specifically did not use the word "patch" is because releasing a utility or .REG file (such as the one provided by eEye) does not "patch" (i.e. replace source code in) Internet Explorer.  In this case, it could simply eliminate a huge vulnerability, at the cost of breaking some things that not everyone uses every day.  This would be a temporary measure until the "patch" for IE is released.

I think a sense of perspective needs to be maintained about this.  This vulnerability allows execution of ANY SOURCE CODE, ANY APPLICATION on your PC, simply by loading a web page into your browser.  Think about that.  You don't think that lots of people would choose to temporarily break the Windows Help System in order to close that hole?

Sure, lots of people need the Windows Help System, and they don't have to install the utility.  Anyone who values compatibility over security doesn't have to install the temporary fix.  My point is that Microsoft should be offering people the choice.

Your point about "avoiding litigation" only made me laugh.  You do realize we are talking about Microsoft?  They could change the colors in the Windows logo from red/green/yellow/blue to red/yellow/green/blue and some dickhead somewhere would file a billion-dollar class-action lawsuit as a result.  The amount of money and human effort that goes into suing Microsoft probably exceeds that of the Apollo Moon Program and I don't see that changing any time soon.

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/baa0c123e39e4acd9c3d9dea011f5415#baa0c123e39e4acd9c3d9dea011f5415 Mon, 28 Jun 2004 20:42:39 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/baa0c123e39e4acd9c3d9dea011f5415#baa0c123e39e4acd9c3d9dea011f5415 Karim 61 http://channel9.msdn.com/Niners/Karim/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go
pacelvi wrote:
Dude, that was John Lithgow on the plane (his movie debue). 

Though you if you want to stick with Shatner, I think Airplane II The Sequel should provide a good story.

Dude that was so NOT John Lithgow on the original television series airing of the episode, which happened in 1963, which was probably before you were born.  (Kids today!  Sheesh!)  It was William Shatner before he became Captain Kirk.

http://karimalim.com/shat-ie2.jpg

The movie was a rehash of some of the better TV episodes.  You really should see Shatner in the "Nightmare at 20,000 Feet" role... words cannot describe it.

LOL Shatner was in Airplane II: The Sequel?  Surely you must be joking....

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/83a8586c31f844cfbc839dea011f5388#83a8586c31f844cfbc839dea011f5388 Mon, 28 Jun 2004 23:36:57 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/83a8586c31f844cfbc839dea011f5388#83a8586c31f844cfbc839dea011f5388 Karim 61 http://channel9.msdn.com/Niners/Karim/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go Ah.. I was thinking of the Twilight Zone movie.. they must have remade the episode you were talking about into the last segment they did, as you say.

And I'm not and dont call me Shirley.

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/454b098a0e6f4895b7439dea011f5441#454b098a0e6f4895b7439dea011f5441 Tue, 29 Jun 2004 04:12:29 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/454b098a0e6f4895b7439dea011f5441#454b098a0e6f4895b7439dea011f5441 pacelvi 61 http://channel9.msdn.com/Niners/pacelvi/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go I am very happy to announce that the Microsoft Security Response Center has just updated the www.microsoft.com/downloadject web page to reflect some of the feedback they have received from this thread and other internal threads as well as some of the results of their own investigations. It's a start and will only get better going forward.

Thank you all for the outstanding feedback. Please keep it coming. We are listening.


Keep on posting,

Charles

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/cdec1da538184b01ba219dea011f546e#cdec1da538184b01ba219dea011f546e Tue, 29 Jun 2004 21:55:35 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/cdec1da538184b01ba219dea011f546e#cdec1da538184b01ba219dea011f546e Charles 61 http://channel9.msdn.com/Niners/Charles/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go

"Microsoft teams have confirmed a report of a security issue known as Download.Ject affecting customers using Microsoft Internet Information Services 5.0 (IIS) and Microsoft Internet Explorer, components of Windows."

We confirmed this by reading all the press from AP, Reuters, the New York Times, Forbes and CNN, who had actually confirmed this last week.

"The second [issue with Internet Explorer] is a recently discovered issue that Microsoft is currently investigating in order to provide a solution."

Mostly, we are stymied because we still haven't come up with a good name for this issue yet.

"Customers who are already following our safe browsing guidance significantly reduce their risk from this type of attack."

In this particular case, "safe browsing" means not typing the URL of a well-respected Fortune 500 company in your browser.  We would direct you to the URL of our safe browsing guidelines, but doing so would actually violate our safe browsing guidelines.

"Microsoft has established with its partners that this attack is not a "worm" or virus-in other words, this attack is a targeted manual attack by individuals or entities towards a specific server."

Of course, if you happen to visit that infected server using IE, you would be instantly infected as well, along with everyone who visited the site.  But you can rest assured knowing that when the Russian Mafia starts using the credit card numbers that you've typed into your computer, it was not the result of a "worm" per se.

Also, we checked the dictionary, and turning your computer into a open proxy server so that it can be used to deliver spam or break into your corporate network -- well, that really isn't really a "virus" either.  So rest easy!

"Microsoft also has confirmed that this attack exploited a vulnerability in Internet Explorer to deliver malicious code to visitors of an affected Web site. Microsoft has been working with Internet service provider partners to shut down the malicious URLs."

Some have suggested that we also repair the vulnerability in Internet Explorer.  But we're having much more fun playing whack-a-mole shutting down malicious URLs as they pop up across the Internet.

"In addition, MSN is scanning for and blocking malicious URLs."

If you don't use MSN, though, you're kind of screwed.

"Customers using Internet Explorer should be sure that they have installed the latest security updates by visiting Windows Update at: http://windowsupdate.microsoft.com."

Not that it will help protect you from this threat, though.

"Customers running Windows XP SP2 Release Candidate 2 are already protected from this threat."

We hope the other 99.9995% of you are using MSN.

Oh, and you can ignore all those dire warnings about not installing SP2 RC2 on "production" systems.  We were only joking about that!


]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/174c0f336e4b47a0aa7a9dea011f54a7#174c0f336e4b47a0aa7a9dea011f54a7 Tue, 29 Jun 2004 23:37:17 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/174c0f336e4b47a0aa7a9dea011f54a7#174c0f336e4b47a0aa7a9dea011f54a7 Karim 61 http://channel9.msdn.com/Niners/Karim/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go Damn, Karim. You're harsh, but honest. Gotta love that.

This update is only the beginning. MS Security et al are open to changing their ways and they are trying.  We'll get better at this. In the meantime, keep up the great feedback. It doesn't go unnoticed... 

EDIT: I do think that MSRC deserves a little slack here. They made a change to their status delivery process in about 72 hours. Not that shabby given how hard it is to develop effective messaging not to mention the challenge of getting a large and vocal team to come to a reasonable consensus. I'm not making excuses or playing PR. I Just wanted to get that off my chest.

Love your comments, Karim. Keep 'em coming. 


Charles

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/049ccd1eb332451ebbd99dea011f54d3#049ccd1eb332451ebbd99dea011f54d3 Wed, 30 Jun 2004 00:03:07 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/049ccd1eb332451ebbd99dea011f54d3#049ccd1eb332451ebbd99dea011f54d3 Charles 61 http://channel9.msdn.com/Niners/Charles/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go Yeah, looks like we're back to KB article # 833786 _ "The most effective step that you can take to help protect yourself from malicious hyperlinks is not to click them. "

I wrote some about it here

Who else but a large corporation would come with the a solution like that?

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/8cebef38ebc74b6ea45f9dea011f5505#8cebef38ebc74b6ea45f9dea011f5505 Wed, 30 Jun 2004 01:13:18 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/8cebef38ebc74b6ea45f9dea011f5505#8cebef38ebc74b6ea45f9dea011f5505 LazyCoder 61 http://channel9.msdn.com/Niners/LazyCoder/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go The most effective step that you can take to help protect yourself from malicious hyperlinks is not to click them.

I'm not sure a counter argument can be made against this statement. It's certianly always the case that you can't be harmed by something if you never spend any time with it...

That said, yeah, give me a little more.


Keep on posting,


Charles

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/81d611a4060b4b5387fb9dea011f5531#81d611a4060b4b5387fb9dea011f5531 Wed, 30 Jun 2004 02:41:14 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/81d611a4060b4b5387fb9dea011f5531#81d611a4060b4b5387fb9dea011f5531 Charles 61 http://channel9.msdn.com/Niners/Charles/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go
Karim wrote:
jonathanh wrote:

"Customers who have deployed Windows XP Service Pack 2 RC2 are not at risk."

(from http://www.microsoft.com/security/incident/download_ject.mspx)

This is a perfect example of a security fix, which Microsoft thinks is not ready for public consumption (DO NOT INSTALL SP2 RC2 ON PRODUCTION SYSTEMS!!!  CAUTION, BETA SOFTWARE!!!  DANGER WILL ROBINSON!!!) but which turns out to be perfectly acceptable to most non-Microsoft people who just don't want their computers hacked.

I don't understand why Microsoft hasn't even published a simple utility or .REG file that closes up the vulnerability.  (See http://www.eeye.com/html/research/alerts/AL20040610.html)

Sure, it might break .HTAs or the Help System, but you can tell people that when you offer it to them.  More choices about how to react is almost always better than less choices, and there will be a lot of people who will choose a temporarily broken Help system over having to worry about whether each and every URL they visit is going to instantly infect their computer.


It is not Beta software or even Gamma software, it is Release Candiate software and is almost ready to be declared Gold.

Edit: Infact, I used to run RC1. That was before Microsoft sent me a patch via Autoupdate that completely destablized Windows. I had to "upgrade" to Windows XP to fix the problem. But I can say that it was as stable as a rock until that point.

Charles wrote:
I am very happy to announce that the Microsoft Security Response Center has just updated the www.microsoft.com/downloadject web page to reflect some of the feedback they have received from this thread and other internal threads as well as some of the results of their own investigations. It's a start and will only get better going forward.

Thank you all for the outstanding feedback. Please keep it coming. We are listening.


Keep on posting,

Charles


That is great news.

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/5761db8d101c440a82f19dea011f5568#5761db8d101c440a82f19dea011f5568 Wed, 30 Jun 2004 02:49:40 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/5761db8d101c440a82f19dea011f5568#5761db8d101c440a82f19dea011f5568 Shining Arcanine 61 http://channel9.msdn.com/Niners/Shining Arcanine/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go As I have indicated elsewhere, I have found the Eeye solution my best course of action at the moment by deploying the IESecurityRegFixer to client workstations to disable the adodb.stream linkage.

This does not disable Windows Help or more importantly, Windows Explorer (a fact that was not mentioned in the MS suggestion for Local Machine Zone restrictions). I do appreciate the Microsoft suggestion though, 'cause it has led me down another interesting path...

I am not so concerned with the current exploit, it is the next one that may take down our 911 system (and yes, it is "sandboxed", but still part of our AD..so)

Hey.. for some really great videos go to www.thebroken.org

...thermite in a laptop, now that is data protection;)

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/af957933552b410eaf7a9dea011f5595#af957933552b410eaf7a9dea011f5595 Wed, 30 Jun 2004 02:58:27 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/af957933552b410eaf7a9dea011f5595#af957933552b410eaf7a9dea011f5595 manickernel 61 http://channel9.msdn.com/Niners/manickernel/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go Hi Robert. I love this thread, and something happened where I can now get in to comment, even though I now have even trusted zones running in high security and I have to keep giving permission for the Channel 9 scripts to run. 

I wanted to confirm that, with my raised threat defenses (until the patch is out and confirmed), channel 9 works better under condition orange than it seemed to the other day.  I don't know if the site update caught it or what, but I am pleased that it is safer to contact Microsoft and Channel 9 (though MSDN is a * right now, accessing with shields up) under conditions of heightened IE threat precautions.

With regard to the new Button problem, disclosed last night, I and my pals in the Security Engineering class just had a "oh, oh" about all of the security software and anonymizing software that puts buttons and menu bars in software that would allow them to see password entries before they hit SSL/TLS. Time to get some more transparency from those guys.  Now I even worry about NewsGator, which basically has access to my Outlook and an independent access to the internet. Geez, who can a girl trust these days? [;<).  And how can we tell that the guy really is safe?   

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/bdfa79a04f4e4d009b2c9dea011f55c5#bdfa79a04f4e4d009b2c9dea011f55c5 Wed, 30 Jun 2004 18:01:50 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/bdfa79a04f4e4d009b2c9dea011f55c5#bdfa79a04f4e4d009b2c9dea011f55c5 orcmid 61 http://channel9.msdn.com/Niners/orcmid/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go I've spent this whole weekend looking at my system (XP Pro SP2 RC2), trying to figure out what's legit and what isn't and have come to the conclusion it's a complete *-up.

One tool will find crack A but not B. another will find B but not A, none of them will see Crack's C through XXY.

Task manager is completely useless, Tasklist is useless. The Zones theory might be nice but the implentation sucks. Having to retype portions of domain names and putting the * there, complete waste of my time (plus it's not so easy to do).  The registry is like that crazy woman's house in San Jose.

Domain accounts and NTFS are basically useless as security measures.

I'm going to assume that if Linux or Mac or whatnot had the market share that MS does that their stuff is probably just as vulnerable but since I'm using MS's stuff I'll have to be pissed at them.

For the amount of time I waste making sure i'm not being victimized I am now very offended by product activation.. as far as i'm concerned, i'm owed a few free copies of an OS.

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/f79d608449d8407daf7a9dea011f55f3#f79d608449d8407daf7a9dea011f55f3 Wed, 30 Jun 2004 21:29:58 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/f79d608449d8407daf7a9dea011f55f3#f79d608449d8407daf7a9dea011f55f3 pacelvi 61 http://channel9.msdn.com/Niners/pacelvi/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go Oh I left parts out of my rant.

I truely mean the words in the next sentence.

What idiot approved the dialog box that basically says "This web site you haven't added to your Trusted Sites is at the moment wanting to get onto your network and write and read files.  We're not going to tell you which ones.  Will you let it"?

Now I think I"ve scoured my zone settings for three days and dont think I have one remaining option at "Prompt"   will it ever go away?

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/b3888f55e0864d5eaff79dea011f561f#b3888f55e0864d5eaff79dea011f561f Wed, 30 Jun 2004 21:36:14 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/b3888f55e0864d5eaff79dea011f561f#b3888f55e0864d5eaff79dea011f561f pacelvi 61 http://channel9.msdn.com/Niners/pacelvi/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go Ok, I kinda hoped someone might discuss this but I now ask of you humbly with hat in hand....

What ARE the implications of following the Eeye registry modifications on workstation clients as follows:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{00000566-0000-0010-8000-00AA006D2EA4}]
"Compatibility Flags"=dword:00000400

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/hta]

I know that this unlinks the adodb.stream function (if I am saying that right) on the local machine from IE, and removes the mime type for hta, but what are the possible ramifications?

I have already done this for about 900 desktops, and no issues yet, but would like more information.

or am i just beta testing out here?? Tongue Out

and this may have been reported elswhere, but SecFocus has news of a second vector for the recent vulnerablilty in this link


]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/f428ad689d3b4d5090b79dea011f5652#f428ad689d3b4d5090b79dea011f5652 Thu, 01 Jul 2004 09:23:08 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/f428ad689d3b4d5090b79dea011f5652#f428ad689d3b4d5090b79dea011f5652 manickernel 61 http://channel9.msdn.com/Niners/manickernel/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go
pacelvi wrote:


What idiot approved the dialog box that basically says "This web site you haven't added to your Trusted Sites is at the moment wanting to get onto your network and write and read files.  We're not going to tell you which ones.  Will you let it"?



LOL!

My favorite (and I have only this on Microsoft sites so far, including microsoft.com/security), is the XP SP2 dialog that says,

The current site is trying to open a file that can have different security restrictions.  If you trust this site, proceed by clicking OK.

The first time I saw this, I was like "WHAT file?!?!" and "Different security restrictions from WHAT?!?!"

There's a point at which dumbing down the technical content of an error message makes it completely useless.  I call this the "Sad Mac" syndrome, after the little Sad Macintosh icon that comes on whenever the Mac has one of 27 billion possible hardware problems.  It's similar to the "Check Engine" light on some cars.

Error message we can expect to see in the future:

"The current site is trying to do something that may or may not be malicious.  If you would like to proceed, click OK."

"The server has sent content that could have ambiguous security ramifications for you, or possibly for those on your network.  If you believe the owner of this website to be an honest and forthright person of integrity, click OK to continue."

"This web page contains content that could sometimes possibly be considered harmful, though not always.  Click Cancel to navigate away from this page, or click the 'I'm Feeling Lucky' button to proceed."

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/2fd7740107184dbaa46b9dea011f5695#2fd7740107184dbaa46b9dea011f5695 Fri, 02 Jul 2004 00:00:39 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/2fd7740107184dbaa46b9dea011f5695#2fd7740107184dbaa46b9dea011f5695 Karim 61 http://channel9.msdn.com/Niners/Karim/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go Just reading Karim above, and hoping someone might have replied to my post, and I got to thinking..(always dangerous)

Now this is way, way out there. But at this point maybe way out is needed....

Why couldn't Microsoft generate "trusted keys" similar to SSL keys. Any website that wants to take ActiveX beyond "safe" methods would need to register and get a key before IE would grant those methods. The critical thing here is keys could be revoked, so this is more than just "signing" them as is done currently.

This takes part of the burden of determining a "trusted site" off the user.

Ok, I have probably made an idiot of myself, but no more so than "open a file that can have different security restrictions" 

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/56f46ef839a0482a8bfb9dea011f56c5#56f46ef839a0482a8bfb9dea011f56c5 Fri, 02 Jul 2004 00:36:58 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/56f46ef839a0482a8bfb9dea011f56c5#56f46ef839a0482a8bfb9dea011f56c5 manickernel 61 http://channel9.msdn.com/Niners/manickernel/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go As PeterF posted over in the coffeehouse, Microsoft has released a critical update 870669 that essentially makes the same modifications removing adodb.streams from IE functionality as recommended by Eeye.

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/30869b631b504014a16e9dea011f56f1#30869b631b504014a16e9dea011f56f1 Fri, 02 Jul 2004 16:20:36 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/30869b631b504014a16e9dea011f56f1#30869b631b504014a16e9dea011f56f1 manickernel 61 http://channel9.msdn.com/Niners/manickernel/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go
an·ti·cli·max [ àntī kl màks, àntee kl màks ] (plural an·ti·cli·max·es)
noun 
1. disappointing end after big buildup: an ordinary or unsatisfying event that follows an increasingly exciting, dramatic, or unusual series of events or a period of increasing anticipation and excitement

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/1d9c893ab49e4306a27c9dea011f571e#1d9c893ab49e4306a27c9dea011f571e Fri, 02 Jul 2004 20:07:55 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/1d9c893ab49e4306a27c9dea011f571e#1d9c893ab49e4306a27c9dea011f571e Karim 61 http://channel9.msdn.com/Niners/Karim/Discussions/RSS Coffeehouse - Microsoft Security Alert, here's where to go
Karim wrote:

I call this the "Sad Mac" syndrome, after the little Sad Macintosh icon that comes on whenever the Mac has one of 27 billion possible hardware problems.


LOL

/Lars.

]]> http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/4d6f7aae908f445a80649dea011f5748#4d6f7aae908f445a80649dea011f5748 Sat, 03 Jul 2004 01:45:55 GMT http://channel9.msdn.com/Forums/Coffeehouse/10736-Microsoft-Security-Alert-heres-where-to-go/4d6f7aae908f445a80649dea011f5748#4d6f7aae908f445a80649dea011f5748 lars 61 http://channel9.msdn.com/Niners/lars/Discussions/RSS