Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Microsoft Update mechanism has been used to spread malware

f-secure.com

Post reply on HN
Print view View original

51–60 of 64 posts

Re: The Microsoft Update mechanism has been used to spread malware

#51

Post by zvrba »

MiguelHudnandez wrote: post #25
jcdrepair wrote: post #19

Earlier quoted context omitted.

Microsoft has over 90,000 employees, and no doubt some of those people were hired specifically to protect their software licensing. They're probably not pulling their top OS developers to work on this. So the idea that they should have been "spending more of their resources on making software work..." is not really valid. In fact, there is no company or software community anywhere that writes highly complex and bug f…

I agree with you that they are not necessarily removing developers from other projects to work on licensing. However, a percentage of code in Windows is dedicated to validating licensing and preventing piracy. > In fact, there is no company or software community anywhere that writes highly complex and bug free software. It's not possible. I agree with this point. For this reason, the point I'm trying to make is that…

But having updates cryptographically signed and checked against a list of (presumably) trusted certificates is in my best interest.

The "bug" here was in key management, not in SW that's running in my computer.

Re: The Microsoft Update mechanism has been used to spread malware

#52

Post by gaius »

Achshar wrote: post #46
debacle wrote: post #4

This is like finding out the zombies have made it into the compound. I wonder how big this hole is to fix. I also wonder, as many have, if this was written by an Intelligence agency and, if so, if they had access to Windows' source code.

The idea of Microsoft willingly giving windows source code access to government does not make alot of sense. What could have however happened is that the said "Intelligence agency" first created a malware to infect MSFT engineers' computers and get access info of the code repository and then spoofing themselves as MSFT employees to download the source code. This is alot more plausible considering what stuxnet and fla…

Nah, anyone can get hold of Windows sources http://www.microsoft.com/en-us/sharedsource/default.aspx

Microsoft licenses product source code to qualified customers, enterprises, governments, and partners for debugging and reference purposes

Drop 'em an email if you're curious.

Re: The Microsoft Update mechanism has been used to spread malware

#53

Post by mxyzptlk »

Achshar wrote: post #46
debacle wrote: post #4

This is like finding out the zombies have made it into the compound. I wonder how big this hole is to fix. I also wonder, as many have, if this was written by an Intelligence agency and, if so, if they had access to Windows' source code.

The idea of Microsoft willingly giving windows source code access to government does not make alot of sense. What could have however happened is that the said "Intelligence agency" first created a malware to infect MSFT engineers' computers and get access info of the code repository and then spoofing themselves as MSFT employees to download the source code. This is alot more plausible considering what stuxnet and fla…

It makes sense to someone.

Microsoft shared source initiative

http://www.microsoft.com/en-us/sharedsource/default.aspx

In 2003 MS gave China access to their source

http://www.microsoft.com/en-us/news/press/2003/feb03/02-28gs...

Re: The Microsoft Update mechanism has been used to spread malware

#55

Post by m_for_monkey »

gaius wrote: post #52
Achshar wrote: post #46

Earlier quoted context omitted.

The idea of Microsoft willingly giving windows source code access to government does not make alot of sense. What could have however happened is that the said "Intelligence agency" first created a malware to infect MSFT engineers' computers and get access info of the code repository and then spoofing themselves as MSFT employees to download the source code. This is alot more plausible considering what stuxnet and fla…

Nah, anyone can get hold of Windows sources http://www.microsoft.com/en-us/sharedsource/default.aspx Microsoft licenses product source code to qualified customers, enterprises, governments, and partners for debugging and reference purposes Drop 'em an email if you're curious.

It would be cool if the Wine project could use it for reference. Currently they are working by reverse engineering, AFAIK. I wonder if they are "qualified".

Re: The Microsoft Update mechanism has been used to spread malware

#56

Post by rbanffy »

rosstafarian wrote: post #36
rbanffy wrote: post #20

Earlier quoted context omitted.

Yes. But you can always get the source and build the package yourself. Can you do that with Windows?

Yes but some one can break into whatever server is hosting the source and add a backdoor withought anyone noticing for quite a while, do you go through all the code you compile? Can't think of any specific examples right now but i remember this happening a few times

You can rather easily see the deltas. It's not perfect, but it's at least possible. That's another line of defense Windows users lack (and, usually, don't care about)

Re: The Microsoft Update mechanism has been used to spread malware

#57

Post by parktheredcar »

m_for_monkey wrote: post #55
gaius wrote: post #52

Earlier quoted context omitted.

Nah, anyone can get hold of Windows sources http://www.microsoft.com/en-us/sharedsource/default.aspx Microsoft licenses product source code to qualified customers, enterprises, governments, and partners for debugging and reference purposes Drop 'em an email if you're curious.

It would be cool if the Wine project could use it for reference. Currently they are working by reverse engineering, AFAIK. I wonder if they are "qualified".

Probably not. Microsoft is 'sharing' their source code with select partners because it's in their best interest to be accommodating to organizations that are building complex systems on top of their product. Wine is closer to a competitor than a partner.

Re: The Microsoft Update mechanism has been used to spread malware

#58

Post by mindstab »

m_for_monkey wrote: post #55
gaius wrote: post #52

Earlier quoted context omitted.

Nah, anyone can get hold of Windows sources http://www.microsoft.com/en-us/sharedsource/default.aspx Microsoft licenses product source code to qualified customers, enterprises, governments, and partners for debugging and reference purposes Drop 'em an email if you're curious.

It would be cool if the Wine project could use it for reference. Currently they are working by reverse engineering, AFAIK. I wonder if they are "qualified".

I think in cases like what Wine is trying to do (reimplement/reverse engineer) you want "clean" engineers, not "tainted" ones. So I think that having their devs look at the windows source code might be the last thing they want.

http://en.wikipedia.org/wiki/Clean_room_design

Re: The Microsoft Update mechanism has been used to spread malware

#59

Post by gaius »

mindstab wrote: post #58
m_for_monkey wrote: post #55

Earlier quoted context omitted.

It would be cool if the Wine project could use it for reference. Currently they are working by reverse engineering, AFAIK. I wonder if they are "qualified".

I think in cases like what Wine is trying to do (reimplement/reverse engineer) you want "clean" engineers, not "tainted" ones. So I think that having their devs look at the windows source code might be the last thing they want. http://en.wikipedia.org/wiki/Clean_room_design

Also see http://oldcomputers.net/compaqi.html

Compaq couldn't just copy IBM's BIOS to make their new machine guaranteed IBM compatible, this would be illegal, and easily proven by IBM.

Solution: Reverse-engineer IBM's BIOS. Compaq used two sets of programmers - one group analyzed the original code and made notes of exactly how it responded.

The second group took these notes, and wrote their own BIOS that performed exactly the same.

Re: The Microsoft Update mechanism has been used to spread malware

#60

Post by Spooky23 »

MiguelHudnandez wrote: post #5

Here we have an example of complexity arising from copy protection/licensing. It so happens that this complexity caused a security vulnerability which, when exploited on any one computer, affects close to a billion computers. Is anyone else infuriated that a vulnerability like this exists in what is analogous to copy protection code? In other words, if Microsoft had been spending more of their resources on making sof…

This sort of thing (certificate compromise) has happened with open source projects as well.

The downside of trusting certificates is that you're abstracting trust to a point that you (where you == the IT industry) stops questioning who can do what. You trust something absolutely, but that trust is based on lots of people whom you don't know doing the right thing without making mistakes.

Post reply on HN