SP2 Fails in security

[solarismka]

http://it.slashdot.org/article.pl?sid=04/08/17/2315255&tid=201&tid=1

What a big supries!  Lets see, as I've stated many times before.  Its a pain in the ass to install. Brakes MAJOR applications and sometimes can fail the machine to even come back up!  But besides all that, all the M$ Fan Boys keep touting on the holy grail of SP2.  Well, let me be the first to say I told you so.  Only a zealot would say M$ is going forward when EVERYONE ELSE KNOWS they are going backwards.

[Orethrius]

This actually sounds like SP1 in its early days, believe it or not.  Generally unstable, totally insecure (I mean, a firewall that can be disabled PERIOD?  Oh come on now, how is THAT secure?), and rushed to market once again.  Microsoft fans that may be reading this: let your corporation of choice know that you want QUALITY products, not RUSHED pieces of shit that pass themselves off as the latest patch.  I'm not going to recommend that anybody with a dual-boot system even LOOK at SP2 until they bang out all the bugs.  This is just ridiculous.  Now would this kind of behaviour be acceptable if they DIDN'T have the position they enjoy so freely today?

[Aloone_Jonez]

SP has been overall positive for me, SP was retardedly simple to installl and Windows has been more stable. I can

[solarismka]

quote:Originally posted by Aloone:
SP has been overall positive for me, SP was retardedly simple to installl and Windows has been more stable. I can

[Aloone_Jonez]

You would have to be an idiot for these exploits to affect you.

 

quote:
Attached: access.gif

Hello,

attached you find the copy of your access data you
requested. For security reasons, the file is scrambled
and can only be viewed with cmd. To view it, save the
attached file, execute "cmd" from the start menu,
drag&drop the file into the new window and hit
return. cmd will descramble the file for you.  

http://www.heise.de/security/artikel/50051

[Refalm]

quote:Aloone: You would have to be an idiot for these exploits to affect you.

http://www.heise.de/security/artikel/50051

You'd be surprised. I've had people comming to me with a complaint: "there's some application that won't open". Turns out, they where trying to open an e-mail attatchment called "YourDocument.doc.vbs" by someone called "Mr. V1agra". Luckily for them, the virus scanner stopped their stupidity before I had to get the Norton Ghost diskette (again).

[Orethrius]

...and it's things like this that make me wonder why Microsoft doesn't just include some filename-scanner-icon-viewer thingy in the next incarnation of Outlook.  Nothing big, just five lines of code that scan the last four characters of the file path for ".vbs" and displays an icon to the effect of "THIS IS A VIRUS, DIPSHIT!  DO NOT OPEN IT IF YOU VALUE YOUR DATA!" if they're found.  Shouldn't be THAT HARD to do.

EDIT:  Or better yet, just have it remove the damned things!  I mean seriously, who bothers emailing VBS scripts these days?  Little Timmy trying to be a 1337 script kiddy h4x0r?

[ August 19, 2004: Message edited by: Midnight Candidate/BOB ]

[hm_murdock]

Imagine that. They found a bug in software.

Say it isn't so.

I just love the fatalistic title: SP2 FAILS IN SECURITY. How convenient that you forget that there was once four exploits found for Linux within days after a kernel release. And then, also convenient that you failed to mention the string of holes found in OS X over the course of a week following the release of 10.2.2.

'Tis software, and no software is perfect. All software has bugs. You know what would be cool? If instead of blabbing the details of exploits to the whole world, they only told the people who make the software and then they released a patch.

That would make the world a better place, and I said it so this is how it should be done.

[flap]

quote:Originally posted by JimmyJames: GenSTEP Founder:
You know what would be cool? If instead of blabbing the details of exploits to the whole world, they only told the people who make the software and then they released a patch.

That would make the world a better place, and I said it so this is how it should be done.

No it wouldn't. The idea behind telling people about vulnerabilities before they've been fixed is that they then have a chance of implementing workarounds or turning off affected services.

[solarismka]

quote:Originally posted by JimmyJames: GenSTEP Founder:
Imagine that. They found a bug in software.

Say it isn't so.

There is a big difference between a bug aand an exploit that can take down the whole machine!

 

quote:
I just love the fatalistic title: SP2 FAILS IN SECURITY.

Yep, me too.  Has a lot of truth to it.

 

quote:
 How convenient that you forget that there was once four exploits found for Linux within days after a kernel release.

What exploits.  Alll of them were NOT threats to the end user.  They were fixed imediatly and they didn't threaten the end user in anyway.  

 

quote:
 And then, also convenient that you failed to mention the string of holes found in OS X over the course of a week following the release of 10.2.2.

Whats to mention.  Again.  Mac OSX fixed those sploits and again there was no threat to the end user.  Second the upgrades and implimintation of those programs were FULL upgrades.  Not just shoddy patches.  The patches that fixed those mistakes did NOT take down the whole machine and did NOT open up even more holes.


 

quote:
'Tis software, and no software is perfect. All software has bugs.

Of course.  I agree.  But there is a difference when a bulti billion dollar company, that has been around for a long time, keeps making the same mistakes.


 

quote:
 You know what would be cool? If instead of blabbing the details of exploits to the whole world, they only told the people who make the software and then they released a patch.

Hence why M$, I think is in trouble.  At least when an exploit is released in the wild.  It has full disclosure, so they have the understanding of the workings of the exploit, thus they can fix it.

 

quote:
That would make the world a better place, and I said it so this is how it should be done.

I disagree.

[ August 19, 2004: Message edited by: kn0wn / BOB ]

[solarismka]

quote:Originally posted by Aloone:
You would have to be an idiot for these exploits to affect you.

 

http://www.heise.de/security/artikel/50051

You no longer even need to open up an attachment to infect windows.  OE can infect a box just by resiveing a virus.  Windows just being on the net can get infected without ANY user itervention at all!  The service pack is supposed to protect them and as you and others here have touted.  It is the holy grail of windows security.  Yet look again.  The same mistake.  Rather than fixing the actual problem I see holes opening up with the same exuse being repeated.  Its the enduserbadhardwaresoftware fault!

  :rolleyes:

[Aloone_Jonez]

quote:Originally posted by kn0wn / BOB:

You no longer even need to open up an attachment to infect windows.
 

Under SP2?
How?

 

quote:Originally posted by kn0wn / BOB:

 OE can infect a box just by resiveing a virus.  
 

Under SP2?
How?

 

quote:Originally posted by kn0wn / BOB:

Windows just being on the net can get infected without ANY user itervention at all!
 

Under SP2?
How?

 

quote:Originally posted by kn0wn / BOB:

The service pack is supposed to protect them and as you and others here have touted.

How are the can this happen when the two expliots in SP2 require user intervention?

 

quote:Originally posted by kn0wn / BOB:

It is the holy grail of windows security.  Yet look again. The same mistake.  Rather than fixing the actual problem I see holes opening up with the same exuse being repeated.  Its the enduserbadhardwaresoftware fault!

Yes, two holes, and you would have to be retarded to be exploited. Please post facts to support your claims.

 

quote:Originally posted by kn0wn / BOB:

   :rolleyes:  

If your gonna point a finger at someone then at least have the proof to back you up!

[solarismka]

quote:
Under SP2?
How?

better question.  How is the user to blame for those exploits?

did the end user code SP2?

SP2 does not protect against auto infections where a virus can use an active x or java script process to execute a file via IE.  Because of the tight intergration of windows.  a virus only needs to invoke the same hole with slight changes in the command and the same result will happen.  You can gain control of windows just by going through WMP!  To me thats pathetic!

No user intervention.  The user does not need to click anything.

       

quote:  
Under SP2?
How?

   read above.

     

quote:
Under SP2?
How?

read above
   
 
SP2 is supposed to fix the holes that are present in windows.  Blaming the end userbadhardwaresoftware is not the answer.

Like I have said before.  No one cares about the technical aspect of things.  exept us.  People, if they install the patch, expectthat problem(s) to be solved.  This is not happening.

Even with virus scanners and firewalls.  We see the same results.

     

quote:
Yes, two holes, and you would have to be retarded to be exploited. Please post facts to support your claims.

I have!  See original link!

and.....


http://www.heise.de/security/artikel/50051/1


   

quote:This might even deceive some of the more experienced users, because they do not expect files with extensions like "gif" to carry executable content and to be executed in such a simple manner.

You cannot blame end users.  This sort of thing should not happen if SP2 is all so great.  If M$ is said to be improving then then above would not be so evedent.

     

quote:
If your gonna point a finger at someone then at least have the proof to back you up!

-> You state the exuse

->    

quote:
and you would have to be retarded to be exploited.

and As my sig states:


If your gonna point a finger at someone then at least have the proof to back you up!


stop with the endless same unorginal exuses.  of its theendusersbadhardwaresoftwares fault.  Nobody but you buy's into that!

M$ is not perfect and or GOD!  They do not make a perfect OS.  Far from it.  Concidering after what has been learn't from the past.  Coupled with how SP2 was touted on here even.  You would think that SP2 at least solved these problems.  you can't use the same exuses all the time.  especially when there is only one vairable that has not changed through the whole thing.  Microsoft

Calling people stupid because they got infected.  is arrogent and beyond stupid!  The end user installs the patch.  They have their fire walls and virous scanners.  They want their shit  to just work and this is not happening! People, usres and admins work hard and they do not need the added stress that M$ and their fanboys keep bringing.  It is Microsoft that makes the OS.  It is they who makes the patches.  Not the end user.

   

quote:
"We have investigated your report, as we do with all reports, however in this case, we don't see these issues as being in conflict with the design goals of the new protections. We are always seeking improvements to our security protections and this discussion will certainly provide additional input into future security features and improvements, but at this time we do not see these as issues that we would develop patches or workarounds to address."

     :rolleyes:    

http://www.heise.de/security/artikel/50051/1

[ August 19, 2004: Message edited by: kn0wn / BOB ]