Search:  

 
 
   News
newer
story category Vista Flaws Pile Up
One allows bumped user privs...
(old news - 09:44AM Tuesday Dec 26 2006)
tags: security · software
Tipped by tacoma See Profile
The NY Times runs with the amusing headline: "Flaws Are Detected in Microsoft's Vista." Researchers and hackers have come across some serious chinks in the new OS's armor -- finding six major flaws, one of which allows someone to increase a user's privileges on all of the company's recent operating systems, including Vista. "While I know this is a vulnerability that impacts Windows Vista, I still have every confidence that Windows Vista is our most secure platform to date," says Mike Reavey, operations manager of the Microsoft Security Response Center. Last week also saw hackers having their way with Vista's anti-piracy activation system.

Related:
  1. Monday Morning Links
  2. Firefox Add-On Simulates Great Firewall Of China
  3. Zone Alarm Pro Free Just For Today
  4. Microsoft Discontinuing OneCare
  5. Using PS3's To Forge Site Certificates
  6. Wednesday Evening Links
  7. FoxNews.com Serving Up Infected Ads?
  8. Uh, Mom? The Air Force Just Attacked Our PC
Forums » Vista Flaws Pile Up
view: topics flat text 
Post a:
homeshark

join:2001-03-09
Saint Petersburg, FL

I'd still install it

What are the odds of those flaws being used against me

BF69

join:2004-07-28
Camden, TN

Re: I'd still install it

said by homeshark See Profile :

What are the odds of those flaws being used against me
Um slim and none. Most of this crap is overblown. Supposedly XP is so unsecure. No one has ever taken over my computer using any of these alarmist exploits they have announced over the years.

I bet you can find many people that can find ways of breaking out of the most secure maximum security prisons in the US. I'm not expecting a rash of breakouts anytime soon.

DanMan

@comcast.net

Re: I'd still install it

Agree 100%
matrix3D

join:2006-09-27
Deep River, CT

Are you sitting behind a router doing NAT? I think that's a major part of defense -- I'm willing to bet most compromised systems are the result of a direct modem-to-Internet connection. Just as bad as leaving a machine in the DMZ in your router settings.

Subaru
1-3-2-4
Premium
join:2001-05-31
Greenwich, CT
clubs:

Me

I don't seem surprised at all.

exocet_cm
Support Your FOP - Crescent Lodge No2
Premium
join:2003-03-23
New Orleans, LA
clubs:

shafted!

HA! Is this ther first flaw? One and counting...
brianiscool

join:2000-08-16
Miami, FL

hmm

That is some high tech protection for you

bleearg13

join:2001-03-03
Gaithersburg, MD

How is this stuff found?

Reading about one of the vulnerabilities, I'm interested to know how these vulnerabilities are discovered. There are obviously hackers/crackers and researchers alike that spend every waking hour trying to identify vulnerabilities, but exactly how is it done? Most specifically, this exploit regarding the "MessageBox" function:

»www.darkreading.com/document.asp···d=113414

How on earth is this found?

John_W
Premium
join:2000-04-25
Worcester, MA
clubs:

Re: How is this stuff found?

It's the black hats we have to worry about.

It's the white hats MS has to worry about. It's how quickly the software companies respond to the white hat vulnerability discoveries that concern us.

Almost all, if not all, software has some sort of exploitable code in it. It is just how fast those companies fix the problem that makes the difference between a good and bad company. MS has had a habit of ignoring white hat findings, or at best putting off, where other software companies, like mozilla, who who get their patches right out there as soon as they can.
--
Chef says to put a cucumber down my pants for good luck.
rdmiller

join:2005-09-23
Richmond, VA

Re: How is this stuff found?

didn't answer the question!
severach

join:2002-09-12
Jackson, MI

Re: How is this stuff found?

Black hats harm everybody by destroying stuff. The white hats either do something that is unimportant to you or something that is highly desirable to you but highly undesirable to Microsoft. For example, if a white hat found out a way to permanently disable the signed driver protection in Vista, that would be wonderful for everyone in the world except for Microsoft who's sole purpose for that feature is to prevent you and me from modifying the system to our advantage. Noone wants that except for Microsoft.

72276539
Premium
join:2001-01-19
Atlanta, GA


1 edit
said by John_W See Profile :

MS has had a habit of ignoring white hat findings, or at best putting off, where other software companies, like mozilla, who who get their patches right out there as soon as they can.
It's a hell of a lot fuckin easier to edit code on a browser then an entire OS. How bout comparing apples to apples instead of apples to porcupines.

PS- Answer the OP's question while you are at it.
--
RIP Dimebag- August 20, 1966 to December 8th, 2004.

Hi

@comcast.net

For buffer overflows, you can just try dumping a long, long string of data into every function that takes strings of data and see which ones crash.

If a long, long string of data causes your OS to crash (in one way or another, not necessarily requiring a complete reboot), then you've overwritten something and maybe you can use this to your advantage to overwrite executable code.
SD6

join:2005-03-26

Not as bad as before

"While I know this is a vulnerability that impacts Windows Vista, I still have every confidence that Windows Vista is our most secure platform to date..."

That's not saying much.

Jameson
10-8
Premium
join:2004-05-28
Fallbrook, CA
clubs:

Re: Not as bad as before

Look, there are vulnerabilities in ever OS. People freaking out about one vulnerability is retarded.

Kevin83165

join:2002-03-31
Herrin, IL

Re: Not as bad as before

If it were just one vulnerability and not six then perhaps. ^

When you steal from OS X, steal the whole thing including it's security, not just tidbits and ideas.

(ouch may the flames roll now)

LeftOfSanity

join:2005-11-06
Felton, DE

Re: Not as bad as before

Is OS X really that much more secure?? Or is it the fact that no one really cares about OS X? Windows is on more machines.

M A R K
St. Ides Heaven
Premium
join:2001-06-15
Long Island
clubs:

Re: Not as bad as before

said by LeftOfSanity See Profile :

Is OS X really that much more secure?? Or is it the fact that no one really cares about OS X?
Horse shit...
--
'Posthumously Young'
pabster

join:2001-12-09
Waterloo, IA
Take your Mac fanboy attitude elsewhere.

Mac practices security through obscurity. Nothing less, nothing more.
bmn
? ? ?
Premium,ExMod 2003-06
join:2001-03-15
hiatus
·Packet8

Re: Not as bad as before

said by pabster See Profile :

Mac practices security through obscurity. Nothing less, nothing more.
BZZZT ! Wrong. Please at least know what you are talking about before posting. Mac OS X is a Unix-like OS and there is nothing obscure about it.
--
Prove it...

N3OGH
Bear patrol must be working like a charm
Premium
join:2003-11-11
Philly burbs
·Verizon Online DSL

said by Kevin83165 See Profile :

(ouch may the flames roll now)
ASBESTOS JAMMIES, 2 for $10.

You're gonna need 'em

insomniac84

join:2002-01-03
Schererville, IN
Very sad. You must be drinking Steve Jobs's iKoolaide.
houselog442

join:2005-10-05

1 edit

Re: Not as bad as before

You must be sucking Bill Gates's Windows Small Penis Edition!

insomniac84

join:2002-01-03
Schererville, IN

Re: Not as bad as before

I'm sorry but Bill Gates isn't a cult leader like Jobs. Jobs is a nutcase.

Lumberjack
Premium
join:2003-01-18
Newport News, VA
·Cox HSI

Uh, lets not forget where OS X came from Mac lovers. Mac didn't' do shit for security, they inherited a good model from BSD.

Microsoft may have bought ideas but for the most part their work is theirs and theirs alone. Given that they rule the enterprise and consumer market even with several variants of Linux, BSDs and Macs around, give them some credit.

The biggest thing Microsoft has going for them, as with most big (and more or less success full) is business practices. They've been bullies at times but that's what you get when your king of the hill.
--
»www.fairtax.org

Titus Pullo
I came, I saw, I slept

join:2004-06-26
·Embarq

Re: Not as bad as before

said by Lumberjack See Profile :

They've been bullies at times but that's what you get when your king of the hill.
And we all know what slides downhill
--
"I am not young enough to know everything."
Oscar Wilde

Jameson
10-8
Premium
join:2004-05-28
Fallbrook, CA
clubs:
·HughesNet Satellit..
·Time Warner Cable
·Sprint Mobile Broa..

said by SD6 See Profile :

"While I know this is a vulnerability that impacts Windows Vista, I still have every confidence that Windows Vista is our most secure platform to date..."

That's not saying much.
I'm a mac guy :\ I prefer mac over windows any day but I will just say that people complaining about vulnerabilities in a beta release of a product is stupid.
--
DirecWay | DW6000-CE |SM5, 117 West, 970 MHz |3.2GHZ Intel|BFG GF 6800 OC |Win XP Pro SP2/98SE/ Macbook Pro OSX Tiger |PCs connected via Linksys WRT54G | DD-WRT firmware: dd-wrt.v23 SP1

Lumberjack
Premium
join:2003-01-18
Newport News, VA
·Cox HSI

It will be a long while before Microsoft looses a significant amount of market share. Their products are too damn good. Granted they did release crap like Windows Millennium Edition but the 2007 versions of Office, Windows XP are all excellent releases.

No I don't give Bill head, but I do give credit where it's due. I buy my software and want to like what I get for the money and I think besides the games I buy, and iTunes for music, MS has everything I need in one or two purchases.

For a while I was huge into Unix'ish operating systems. Now my preference is NetBSD vs. Linux. I see extreme value and performance in the web server market for those platforms and that's where MS has to catch up. Right now their market is for Windows enterprises where everything is Windows instead of mixed, but who knows how that will evolve.
--
»www.fairtax.org

DanMan

@comcast.net

Major??

These bugs are being overhyped. If you read them carefully you will find that some of them need physical access to exploit, while others are just "possible exploits".

There is nothing abnormal about finding bugs in over 50 million lines of code, humans wrote them. What is abnormal is the concerted effort by some to bring down this product before MS has a chance to respond.

captokita
Premium
join:2005-02-22
Calabash, NC

At least it took awhile.....

Well, Vista has been in Beta tests for some time now, and it's only just now been discovered? Sure, it's just the start, but really, no OS is 100% foolproof. There are plenty of fools out there after all.

cwy1980
Premium
join:2004-08-10
New London, CT
clubs:

Re: At least it took awhile.....

LOL I wonder if Microsoft has come up with a patch to take care of the biggest flaw in the world yet---the uninformed user.
--
Beer is proof that God loves us and wants us to be happy

Titus Pullo
I came, I saw, I slept

join:2004-06-26
·Embarq

Re: At least it took awhile.....

said by cwy1980 See Profile :

LOL I wonder if Microsoft has come up with a patch to take care of the biggest flaw in the world yet---the uninformed user.
Maybe "Vista Me" edition will do it?
--
"I am not young enough to know everything."
Oscar Wilde

Fatal Vector

join:2005-11-26


1 edit

And so, it begins.


Just like I said it would. More swiss for the hacker sandwich. This is Microsofts best effort "signifigant progress"?

It's sad, really, because we didn't even need Vista. There isn't really anything in it worth the time, trouble and expense to "upgrade" to it. They will, of course, end up shoving it down our throats, since the OEM's have all jumped on the bandwagon and see a excuse to jack up the prices on computers with those whiz bang vidcards and RAM.

I'm sure the makers of those cards and RAM are ecstatic as well. Dont forget the DVD drive so you can run the friggin install disk, IF you even get one, of course and not some lame assed "restore" disk to keep it "factory fresh".

Never mind the expected explosion in bloat and the doubling in price. The only reason they pursued this thing is because they wanted to follow their tried and proven marketing. XP is mature and the profits are falling off. The Windoze OS is their cash cow.

Now they can say Windoze is "new" and, gee, you get a new eye candy GUI-IF, of course, you have a super whiz bang Vid card, 2 Gig of ram and a new mother board for them-And, gee! 64 bit for the true geek too!

Other than that, betcha it's the same thing as before, as shown by at least one "flaw" mentioned here that also affects previous versions. I wonder why...

Run, little lemmings, run...Only $400 this time around for super whiz bang...dont forget $300 for the vidcard and another $200 for RAM...Run!

See 12 replies to this post

orion940
Paralyzed By Confusion
Premium
join:2001-12-23
Windsor, CT
·AT&T Yahoo

This is never-ending

No matter what the product, be it a browser, OS, hardware...if someone doesn't like it, they will find a hole in it.

If I am marketing something, I will poke holes in the competition.

Bottom line to me, who gives a ...

O.
--
New avitar may be paid for out of Excise Tax Return.
rdmiller

join:2005-09-23
Richmond, VA

Half-baked article

After ignoring anything about Vista for months, Karl settles on a speculative, slow-news-day article from the NYT, based on research from an unknown California firm.

Karl's lost his groove! Long weekends will do that.

N3OGH
Bear patrol must be working like a charm
Premium
join:2003-11-11
Philly burbs
·Verizon Online DSL

Re: Half-baked article

said by rdmiller See Profile :

After ignoring anything about Vista for months, Karl settles on a speculative, slow-news-day article from the NYT, based on research from an unknown California firm.

Karl's lost his groove! Long weekends will do that.
The NYT article was also on the "Drudge Report" this weekend....
--
Never ask what sort of a computer a guy drives. If he's a Mac user, he'll tell you. If not, why embarrass him? -Tom Clancy
rdmiller

join:2005-09-23
Richmond, VA

Re: Half-baked article

nuf said.

insomniac84

join:2002-01-03
Schererville, IN

Finding bugs is part of the process

The OS where flaws aren't being found is the OS to stay away from. It most likely has as many flaws as windows(probably more) but no one is actively look for them, so they go unfounded and unfixed. And the more unknown bugs out there for an OS, the greater chance someone will find one and be able to exploit it for years before it gets fixed.

See 7 replies to this post

FEATURESyeah

@comcast.net

Those aren't FLAWS those are FEATURES...

... or so MICROSUCKS would like you to believe.

I mean come on, even if this were your first day on earth, if you can turn on a PC then you can find out in less than 10 seconds with a web search that MS has no clue and never will. It's all about making money. Bug Free and secure products are the farthest thing from Bill Gates mind.
markopoleo

join:2003-04-02
Bonne Terre, MO

Re: Those aren't FLAWS those are FEATURES...

Do you buy crack on the street corner or just make it yourself at home?
Timmn

join:2000-04-23
Tinley Park, IL

Here is some light reading....

This has some interesting facts in it:

»www.cs.auckland.ac.nz/~pgut001/p···cost.txt
Geebo

join:2004-10-18
Fort Wayne, IN

Re: Here is some light reading....

funny Timmn after you post you link exposing M$
Its gets strangely quite

cork1958
Cork

join:2000-02-26
Fruitport, MI
·Verizon Online DSL
·Charter Pipeline


1 edit

Vista

C'mon! Does anybody really think Vista or the next, or the next OS, is going to be any different than previous ones, as far as bugs, holes, flaws, patches, whiners,, gripers, praisers, etc.............?

There's just to many people working against MS!!
--
Do the walk
Zenwalk Linux 4.0

X_Digit
Binary Enhanced
Premium
join:2003-06-12
Mansfield, TX

Amazes me!

It amazes me how fast the topic goes into 100 different directions! If you just accept that fact that EVERYTHING built by man will have flaws and vulnerabilities... then everything will be just fine! If you're one of the many ([clear throat] apple lovers) that think otherwise; well, I hope the cloud you're willowing on one day doesn't turn into a thunderhead!
Forums » Vista Flaws Pile Up


Sunday, 05-Jul 07:33:24 Terms of Use | Privacy Policy | Hosting by www.nac.net - DSL,Hosting & Co-lo | feedback | contact
over 9.5 years online! © 1999-2009 dslreports.com.