Gibson Research

Well... this is computer related.

Quote:

---

Windows XP:

The experience with Windows-based denial of service attacks
focused my attention on Microsoft's planned release of Windows XP
with its planned inclusion of "Full Raw Socket" support. Full raw
sockets are a powerful and dangerous Internet API that exists in
all Unix-based operating systems. But under Unix they are
deliberately protected by the rigorous requirement for "root"
privilege. (Similar to Microsoft's "Administrative" privilege.)
However Microsoft has done away with this distinction in the Home
Edition of Windows XP which threatens to populate the world with
a needlessly dangerous capability.

Microsoft and I have been arguing about this quite a lot
recently. Last Thursday, this culminated in an eight-way
telephone conference:

My page explaining the XP threat: http://grc.com/dos/winxp.htm

About our phone conference: http://grc.com/dos/xpconference.htm

-Steve Gibson
www.grc.com

---

~Betazep

so what? why would you want to hack a WinXP Home Edition Computer? Computers worthy of being hacked are only big Unix Servers which handle extremely large amounts of data (or similar)

Oskilian

>>>so what? why would you want to hack a WinXP Home Edition Computer? Computers worthy of being hacked are only big Unix Servers which handle extremely large amounts of data (or similar)



You are kidding right?

well, a little bit, but think about it, Microsoft wants over 10 million computers running XP, it's not likely that you will be hacked, and if you do, most people won't have vital data and it won't be that bad...

Oskilian

..unless you're the person who's been hacked.

I don't have Home Edition, and will never have it. I currently have Pro, and I want to have Server

Oskilian

Lucky you.
I want Xp Pro. I currently run MS Windows 2000 Pro which suits my purposes for now. Maybe when I decide to stop being a student I'll get Xp though by then I suspect MS would have released their new OS. Goddammit!

Before you discuss this any further, please read the articles Betazep provided. You will see that the threat is not you being hacked if you run XP. It's other people ( maybe you, too ) being hacked and subsequently their computer is at the hackers command. A so called Zombie. And XP offers hackers a means to make their Zombies as effective as if they had hacked a *nix system.

Your unix server will succumb to any attack by XP Zombies. Earlier windows versions weren't able to be used this effectively in attacks and the new feature has no practical use. But Microsoft insisted on implementing it.

Yep.... DOS and SYN attacks.

There are counterclaims to this arguement as well, and the link to that is provided in Steve Gibson's page (where he talks about his meeting with Microsoft execs and developers).

It is a bit of reading, but I found it kinda interesting.

~Betazep

Quote:

---

...

With a bit of horror, I learned that Microsoft's
developers have no understanding of security.

I know this statement comes as no revelation to seasoned security professionals who have watched Microsoft stumble over security time and time again. It's certainly something I've heard said often enough. But to be confronted by seven very smart guys, who quite literally hold the future of the Internet in their hands, and to listen to them rationalize the decision they have already made by explaining why less security in Windows XP does not really matter was nevertheless unnerving.

These smart Microsoft techies did not argue about the power for malicious exploitation of full raw sockets in Windows XP, they know it well enough.


Microsoft's argument for full raw sockets' inclusion was
that since there were other — admittedly more difficult —
ways for malicious hackers to achieve the same thing,
there was no point in making things harder for them.

...

--Steve Gibson

---

It is worrying that hackers can use our PC's so easily, even having a firewall dosen't garantee 100% protection as malicious code can be hidden in any software YOU choose to download. I for one would be very upset if the FBI came knocking on my door because a zombie program hidden on my PC had been attacking goverment sites or something.

I would too. Especially after they confiscated my computer and I didn't get it back for six months or something.

Gibson is talking simplistic bollocks.

Its good that XP is finally allowing raw sockets to be used, it will help make XP a more grownup OS.

The condition he is worried about can already be carried out by Script kiddies using Linux anyway .. and as for Zombies, well, there is a simple solution - use a firewall on ur system that allows u to check the packets going out as well as in .. as u might find as standard in most versions of .. um .. Linux!

Considering that most decent sized organisations in the UK at least will not upgrade to XP for at least another 6 months if not longer, its all a hypethetical storm in a teacup.

The big story of the week as far as security is concerned is the way that the big Antivirus companies are NOT checking for certain trojans known to be used by the FBI and similar law enforcement agencies.

The is more on this story on www.securityfocus.com.

Now this is scary!

I din't read the article yet, but it is nice to have someone with an actual opinion about the one I posted.

What if people do not get personal firewalls, though? If it is really easy to do, why wouldn't people just do it?

You see I do not fully know the benefit or danger of raw sockets other than what I read.

I do know that I would rather have things more secure that less secure, and I am tired of people screwing stuff up for the rest of us.

Many people have a genuine hate for microsoft.... and now it will be easier for them to do what they had to work for before.

I have virus software that detects most trojans (your article sound interesting). And I have a personal firewall... so I feel a little bit more secure and I even feel pretty good when I have my firewall down... but I do not think that I would if I ran XP.

That is my opinion on the subject...

XP is a piece of cr@p. Microsoft doesn't know the most basic thing about writing an O/S. They've never mastered the concept that "stability is the hallmark of quality".

Of course, lack of stability is almost a foregone conclusion because they have lots of C++ coders who just really a) can't write code, and b) don't know how to debug it either, and c) have not a clue what effecient, performance-related code is.

I just wish they'd work on making their O/S stable before they push out the _next_ version.

Greedy b@stards...