Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft, Once Infested with Security Flaws, Does an About-Face

nytimes.com

Post reply on HN
Print view View original

91–100 of 185 posts

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#91

Post by tedunangst »

tptacek wrote: post #66
mtgx wrote: post #46

Earlier quoted context omitted.

Yes, I think that was the first event that pushed Google to focus much more on security. The second one was of course in the summer of Snowden, when Google found out NSA had full access to its network. Since then it has taken quite a few measures to improve security and now it treats its own network as the "untrusted Internet". https://www.usenix.org/conference/lisa13/enterprise-architec... Unfortunately, other than…

Cite a source that demonstrates that NSA had full access to Google's network, please.

I generally agree with you about claims regarding full (root) access to Google's servers, but in this case it's a weaker claim about the network. One might quibble whether tapping without injection counts as full access, but that's a reasonable claim without too much hyperbole. Maybe the NSA didn't have hooks into every switch, but Google's network design also meant a lot of data was flowing beyond the boundaries of any one physical site.

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#92

Post by blinkingled »

tim333 wrote: post #86
blinkingled wrote: post #78

Earlier quoted context omitted.

I would not read too much into 'reports' by companies trying to sell you security products. If you want to talk impacts - both iOS and Android have been similarly impacted - big name apps getting into App Store that were compiled by hacked XCode, Ad SDKs using forbidden APIs etc. Likewise most Android malware is due to rooting and side loading apps from questionable sources.

So Android getting about 100x as much malware as iOS is not significant? That's from all reporting I've seen, not just that one. Just because iOS has problems too doesn't make the numbers the same.

It would be significant if the statement was "There are 100x more infected Android phones than iOS phones."

Remember that Android is a lot of things - there are Nexus phones, there are OHA OEM phones (majority of them), there are Chinese no name phones that use open source Android etc. So if most Chinese people use AOSP build provided by their phone maker and they all sideload apps and get infected - that's different. Even considering all this nobody is making the above statement.

Just having malware written for an OS means nothing. It only suggest that it is targeted more due to market share. If people jailbreak their iPhones and install random apps from untrusted sources there is hardly anything Apple's security can do to prevent it. Same goes for Android. Nothing in that reflects the security of the underlying platform.

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#93

Post by tptacek »

blinkingled wrote: post #89
protomyth wrote: post #81

Earlier quoted context omitted.

"That problem is unfixable easily due to the way ObjC works" Can you explain that?

You should listen to the podcast for details but the gist of it is that "The Objective-C model of object-oriented programming is based on message passing to object instances. In Objective-C one does not call a method; one sends a message." So let's say you have an app that uses a runtime. The runtime in turn may use private/internal calls that your app is not supposed to use. Well there is no reliable way to prevent…

This is extraordinarily silly. In modern systems security, real security boundaries aren't enforced at the language level. No amount of ObjC message-sending trickery is going to change your UID.

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#94

Post by blinkingled »

tptacek wrote: post #93
blinkingled wrote: post #89

Earlier quoted context omitted.

You should listen to the podcast for details but the gist of it is that "The Objective-C model of object-oriented programming is based on message passing to object instances. In Objective-C one does not call a method; one sends a message." So let's say you have an app that uses a runtime. The runtime in turn may use private/internal calls that your app is not supposed to use. Well there is no reliable way to prevent…

This is extraordinarily silly. In modern systems security, real security boundaries aren't enforced at the language level. No amount of ObjC message-sending trickery is going to change your UID.

Yeah, I have been around long enough to know you can't change to UID zero by message passing. That is just preposterous to assume. I was talking at the Runtime level - I even cited an app that was calling a runtime method to get list of running apps. Essentially they have no reliable runtime permission model - they rely on obscurity and static scanning to prevent you from passing message to some receivers that they don't want you to.

I would have thought you will research it a bit before asserting silliness - but oh well.

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#96

Post by delish »

quanticle wrote: post #84
hackuser wrote: post #55

Earlier quoted context omitted.

> UAC was one of the biggest security improvements I assumed it was just an interface stapled onto the old system, and something underneath that allowed changing permissions without logging off. It might have had a big effect, but it doesn't sound like a significant change in the system. But maybe my assumptions are wrong ...

The entire concept of UAC and programs not running by default was introduced in Vista. It was such a big change that it pretty much ruined the reputation of the OS, single-handedly. I remember that one of the major complaints about Vista was the number and intrusiveness of UAC prompts, which occurred because programs were doing things like keeping settings in C:\Program Files, rather than the user's application data…

I've used Linux for many years, but I've always defended Vista. The other complaint about Vista was excessive resource use. I tell people that When XP came out, Intel released the Pentium 4. When Vista came out, Intel released the Core 2 Duo.

I'm conflating processor date with date-you-could-buy-a-computer-with-that-chip, but still: Pentium 4 is a world away from Core. Windows Vista does a lot more than XP.

The complaints went away because people gradually bought computers with Core architectures.

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#97

Post by rdl »

ChuckMcM wrote: post #57
tptacek wrote: post #7

This is a weird story, since professional security people would have told you the same thing back in 2007. Windows wasn't originally designed to be secure. Even NT, which is a serious multi-user kernel, was a product of 1990s C programming style. And while that's true of the Unices of the time as well, none of them had Microsoft's absurd user base, and so none of them had the same terrible malware incentives. This al…

Not that weird. Illustrative perhaps. So you and I would have agreed in 2007 that Windows was much better at security than they had been, but we are both pretty tightly connected to the technology market. Today, 8 years later, my Mom and Dad think Windows is a "secure" system as they haven't had any issues for long enough that their opinion of it has changed. The final leg of this journey will be when Windows + Windo…

Google internally, especially post Chinese misadventure, has pretty great security. It isn't necessarily in Android, but their cloud services are great, and internal security is great.

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#98

Post by wsxcde »

At least part of the secret is formal verification. MSR throughout the last decade made some big advances in software verification technology. These resulted in more than just academic papers, they were used to find tons of real bugs in MS and external (as part of the driver development kit) source code. There was a point at which all of the biggest names in software verification were either academics or at MSR or at both.

SLAM, Z3, DART were all tools that came out of MSR and have been incredibly influential on the whole field of software verification.

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#99

Post by mikestew »

renownedmedia wrote: post #50

> company’s co-founder, Bill Gates, once ordered all of Microsoft engineers to stop writing new code for a month Source?

Valentine actually dictated it, but it did actually happen. Brian's mail was something along the lines of, "I'm tired of reading about the latest security vulnerability in the NYT, so...". And I think it was six weeks, not a month.

Source: me, who worked there (in VS, not Windows) at the time.

EDIT: oh, yeah, forgot about the Gates mail. References are buried in this link: http://www.microsoft.com/security/sdl/story/#chapter-1

I stand by the B. Valentine version, just can't find a link.

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#100

Post by tootie »

tim333 wrote: post #79
tootie wrote: post #60

Earlier quoted context omitted.

I don't know. My father-in-laws Windows PC is routinely bogged down with malware/adware. It's not the same kind of security holes that used to be rampant, but it's still too easy for malicious software to cause trouble.

Though Microsoft have improved their computers still often come laden with crapware much of the time unlike Apple or I think most Chromebooks. You then end up with stuff like Superfish if you're not lucky.

I buy the PCs for him and personally remove the crapware. He just clicks on random stuff. If it tells him to buy something, he buys it.
Post reply on HN