4 ms·
Leaked cables suggest China Access to Microsoft source used for cyber attacks
- deleted 16y ago[deleted]
- tptacek 16y agoMeh. No doubt someone in the US government thinks this is a serious issue, but lack of access to Windows source code is little more than a speed bump for professional exploit developers.
- alecco 16y agoBut it's a major speed bump for non-elite exploit developers. In particular for an organization with a big cyber-army of them. Not proficient with tools like disassemblers but proficient with basic techniques with source code.
- roel_v 16y agoThe question is then if that particular 'organization' has a large enough number (let's say 50? or 100?) highly skilled exploit developers. I have no problem to believe that a country of that size, regardless of its technical sophistication overall, can produce without much effort an institute like that. Don't forget that 'professional exploit developer' was a concept largely unknown until well into the 2000's. That never stopped a whole slew of exploits to appear since the mid 1990's, many of the early ones from the bedrooms of at best amateur security aficionados.
- jjguy 16y agoEverything's open source, it's just written in assembly.
- tptacek 16y agoI might say "control flow graphs" instead of "assembly". Not to be pedantic, but to dispel the notion that reversers are literally reading every opcode in the program.
- eru 16y agoBeing able to read source is not the same as open source. (That's where the term `free software' and it's conotations are useful.)
- daeken 16y agoWe've heard these claims ever since MS started releasing source to certain institutions/governments, and my reaction has always been the same: Reverse-engineering non-obfuscated code is absolutely trivial, and can be automated 99% of the way. If you can find vulnerabilities in source code, you can find vulnerabilities in a binary. For some reason, no one ever seems to understand this...
- tptacek 16y agoThe funny part of this is that a good chunk of the vanguard of vulnerability researchers aren't even bothering to piece through basic blocks anymore; they just capture a small library of inputs and throw bit-flipped variants of them at the target, like particles from a neutron gun, until something blows up. Why bother with the source code when you can find vulnerabilities with dumb fuzzer farms? (Hey, Cody, build one of those for us!)
- SkyMarshal 16y agoI always assumed Windows binaries are heavily obfuscated, is that not the case?
- daeken 16y agoSome are, but outside of DRM stuff, nothing in Windows itself. And even when obfuscation is in play, it's usually trivial.
- tptacek 16y agoThe opposite is mostly the case; Microsoft even makes the PDB debugging symbols available for many of its core components.
- daeken 16y agoEven for the bootloader, where the signature checks for the driver signing chain occurs. The MS symbols database is a goldmine.
- GHFigs 16y agoFrom reading the cable itself, it doesn't sound like anyone in the US government thinks it's a serious issue, but that The Guardian thought it made a nice headline. The source-access bit is a single line a 7-paragraph section of a 64-paragraph daily report whose own sectional 'key highlights' don't mention it. http://www.guardian.co.uk/world/us-embassy-cables-documents/214462 http://www.guardian.co.uk/world/us-embassy-cables-documents/...
- wooster 16y agoThat doesn't mean you have to build them a racetrack and give them a jet car.
- daeken 16y agoThe dangers in giving a select few organizations access to the Windows source is far, far outweighed by the benefits. Should evil people have access to the Windows source? Probably not, but the fact is that if you give it to some people, some of them are going to be bad.
- deleted 16y ago[deleted]
- dlsspy 16y agoI hope the Chinese never get access to the Linux or BSD source code that runs my computers.
- sixtofour 16y agoThe difference is that Windows code is closed. Microsoft has given access to that code to allegedly hostile individuals, but not to friendly individuals. Bad guys can reverse engineer and read code. Good guys can only reverse engineer. With *nix it's a level playing field, because both sides can reverse engineer and read code, and contribute code.
- deleted 16y ago[deleted]
- smallblacksun 16y agoHis point (I think) is that white-hat security experts don't have access to the Windows source.
- deleted 16y ago[deleted]
- sixtofour 16y agoPretty much my point. Everyone who could possibly help has open source access to *nix code. Not everyone who could possibly help has access to Windows code.
- dlsspy 16y agoI wanted to give you a non-anonymous +1 on this. Your point about the level playing field is a great one. My preference is obviously to just avoid the black boxes where I can, but it's not particularly surprising to think that the true color of the box is the inverse of the color of the hat.
- wladimir 16y ago
- sp332 16y agoWhen source code review is outlawed, only people outside your jurisdiction will review your source code.
- trotsky 16y agoThis could apply to any of the other state actors with NT source trees, it's not like Israel, France, US etc don't develop their own. China just does it a lot louder. Much of it probably gets bought from third parties anyway, it's just cheaper than developing your own. And microsoft isn't going to be able to sell into any sensitive state platforms without providing source code, for obvious reasons.
- est 16y agoprevious discussion http://news.ycombinator.com/item?id=1054791 http://news.ycombinator.com/item?id=1054791
- sitmack 16y agoBack in 1997-1999 it was fairly easy to get access to MS source code on the corp net. Esp if you were in Visual Studio or Windows NT (2000, XP, etc) team. Meaning pretty much anyone could get it. I had a local copy on my workstation I would study. Very readable code the NT 4 codebase. Everyone who wants a copy of codebase X can get a codebase X with a concerted amount of work. It will be impossible to stop this. Having access to the source can give you insights into the various ways you can attack a system. It saves months if not years of hacking. Yes you can make exploits w/o the source. With the source it is a whole new ballgame. Firewalls, MAC, separation of concerns, etc. With the proper virus one can bring the whole system down (pick your system).