5 ms·

It seems strange to blame the government -- couldn't you see this as self-inflicted damage from creating an insecure OS that runs a vast number of important com

It seems strange to blame the government -- couldn't you see this as self-inflicted damage from creating an insecure OS that runs a vast number of important computers? I actually blame both, but it's not like MS is an innocent victim here -- there's a lot more they could have done on security, and didn't because it was expensive. If that choice being exploited costs them money, how is that anything but an effect of their own choices?

nxc18 9y ago
Microsoft has been investing a lot of effort into security. If they had it their way, you wouldn't even be able to install unverified software. I'm not sure Microsoft has been making the bad "security is expensive" decisions since XP sp2. Note also that they've been ahead of the curve on security since Vista, which was much maligned (partially) as a result. Nowadays both macOS and windows effectively have UAC, but Vista took the heat for it. Same thing with blocking unknown software; Windows took the heat, but just you try to run non-Apple-signed packages on OS x.
- yoz-y 9y ago
  Does UAC and signing belong to the same bucket though? UAC has always been on macOS 10 because of the bsd root/user separation. For me the main problem is that on windows (Vista at least) the UAC seemed to fire on benign operations while letting you do quite dangerous ones without flinching.
  - nxc18 9y ago
    Its true that there are holes and that UAC isn't a particularly strong security barrier (i.e. If an attacker is at the keyboard it won't do shit). But that's the same for OS x and they have some even worse patterns; e.g. I'm pretty sure half the installers I end up using take your password themselves and pass it on to some waiting sudo under the hood. They at the very least don't use the proper system way of doing things; i can tell because some things trigger touch id and some don't. Similarly, there have been many stories about dropbox circumventing system security. I have no doubt that if dropbox can figure it out, malware writers can, too.
  - riskable 9y ago
    Based on the plethora of methods Microsoft has (intentionally) provided to bypass UAC I'd argue that it's the very definition of "security theater". UAC is nothing but a minor annoyance to attackers at this point. An extra step or two they have to add to their payload. Nothing more. It's also trivial to escalate from a regular user to NT AUTHORITY\SYSTEM (which is a higher privilege than Administrator!). There's so many privilege escalation vulnerabilities in Windows it's hard to keep track of them all! A big reason for that is that Microsoft considers privilege escalation vulnerabilities, "medium risk".
13of40 9y ago
I just read the summary, but it sounds like this is a set of tools you use after compromising a system. (It starts at modifying the MBR.) If that's the case it has as much to do with the security of the OS as it does with the physical security of the building where the computer is sitting.
geofft 9y ago
> there's a lot more they could have done on security, and didn't because it was expensive. Well, yes, this is technically true. But it's technically true because there's an infinite amount of work you can do on security. Microsoft could have hired every person on the planet who's good at verifiable systems, or could be trained to be good at it, and rewritten the entirety of Windows as provably correct code (a la seL4), taking many years and lots of money. Microsoft could have hired every cryptographer or everyone who could be good at cryptography and developed digital signature algorithms that are far better than the current state of the art. (Remember that it's been proven that the US government, or someone with aligned political goals and roughly equivalent capabilities, used a previously-unknown attack on MD5 to spoof a Windows Update certificate to Iranian nuclear reactors, and it's not like newer hashes are impossible to collide, just harder.) No matter how much time and effort you spend on security, there's always more you can spend. The engineering decision in security is how to spend enough money to outpace your attackers, but also successfully ship a product. If your own government is becoming one of the attackers and therefore increasing the cost it takes to stay ahead of your best attacker, to the point where shipping a product becomes unprofitable, that's not a sign that you should have been there anyway, that's a sign that your government should get out of the business of being an attacker.

nxc18 9y ago

Microsoft has been investing a lot of effort into security. If they had it their way, you wouldn't even be able to install unverified software. I'm not sure Microsoft has been making the bad "security is expensive" decisions since XP sp2. Note also that they've been ahead of the curve on security since Vista, which was much maligned (partially) as a result. Nowadays both macOS and windows effectively have UAC, but Vista took the heat for it. Same thing with blocking unknown software; Windows took the heat, but just you try to run non-Apple-signed packages on OS x.

yoz-y 9y ago
Does UAC and signing belong to the same bucket though? UAC has always been on macOS 10 because of the bsd root/user separation. For me the main problem is that on windows (Vista at least) the UAC seemed to fire on benign operations while letting you do quite dangerous ones without flinching.
- nxc18 9y ago
  Its true that there are holes and that UAC isn't a particularly strong security barrier (i.e. If an attacker is at the keyboard it won't do shit). But that's the same for OS x and they have some even worse patterns; e.g. I'm pretty sure half the installers I end up using take your password themselves and pass it on to some waiting sudo under the hood. They at the very least don't use the proper system way of doing things; i can tell because some things trigger touch id and some don't. Similarly, there have been many stories about dropbox circumventing system security. I have no doubt that if dropbox can figure it out, malware writers can, too.
- riskable 9y ago
  Based on the plethora of methods Microsoft has (intentionally) provided to bypass UAC I'd argue that it's the very definition of "security theater". UAC is nothing but a minor annoyance to attackers at this point. An extra step or two they have to add to their payload. Nothing more. It's also trivial to escalate from a regular user to NT AUTHORITY\SYSTEM (which is a higher privilege than Administrator!). There's so many privilege escalation vulnerabilities in Windows it's hard to keep track of them all! A big reason for that is that Microsoft considers privilege escalation vulnerabilities, "medium risk".

13of40 9y ago

I just read the summary, but it sounds like this is a set of tools you use after compromising a system. (It starts at modifying the MBR.) If that's the case it has as much to do with the security of the OS as it does with the physical security of the building where the computer is sitting.

geofft 9y ago

> there's a lot more they could have done on security, and didn't because it was expensive. Well, yes, this is technically true. But it's technically true because there's an infinite amount of work you can do on security. Microsoft could have hired every person on the planet who's good at verifiable systems, or could be trained to be good at it, and rewritten the entirety of Windows as provably correct code (a la seL4), taking many years and lots of money. Microsoft could have hired every cryptographer or everyone who could be good at cryptography and developed digital signature algorithms that are far better than the current state of the art. (Remember that it's been proven that the US government, or someone with aligned political goals and roughly equivalent capabilities, used a previously-unknown attack on MD5 to spoof a Windows Update certificate to Iranian nuclear reactors, and it's not like newer hashes are impossible to collide, just harder.) No matter how much time and effort you spend on security, there's always more you can spend. The engineering decision in security is how to spend enough money to outpace your attackers, but also successfully ship a product. If your own government is becoming one of the attackers and therefore increasing the cost it takes to stay ahead of your best attacker, to the point where shipping a product becomes unprofitable, that's not a sign that you should have been there anyway, that's a sign that your government should get out of the business of being an attacker.