3 ms·

I'm with you right up to the "infinitely more competent" line. The big thing that Microsoft and Windows have against them, is the crapshow that is all that the

by taeric 4y ago

I'm with you right up to the "infinitely more competent" line. The big thing that Microsoft and Windows have against them, is the crapshow that is all that they include on a standard installation. That said, from what I'm seeing, this is not really unique to Windows anymore. Seems everyone wants everything on the machine. So, yes, it is theoretically possible to setup all access rules correctly. But it is essentially a lines of code problem, at this point. Given a mountain of things to setup, you will make a mistake somewhere.

nradov 4y ago
What specifically does a modern Windows installation include that is inappropriate or insecure in terms of default services or access rules?
- taeric 4y ago
  Certainly a fair question, but a big part of the problem is I don't know the specifics of what is on a new installation anymore. Worse, I'm not sure where to find such a list. Just scanning on the things they are proud to list at https://learn.microsoft.com/en-us/windows/whats-new/windows-11-overview https://learn.microsoft.com/en-us/windows/whats-new/windows-..., I'd be worried about Teams, Windows 365, and Widgets. I'd also be worried about all trial software that is on the machine. I could not find a list of that, though. And again, this is not unique to Windows. It used to be OEM bloat that was added to all things. In linux land, it would have been all of the "power tools" included by default.
  - nradov 4y ago
    Do the popular Linux distributions for both desktop and server environments provide such a list? Have Teams, Windows 365, or Widgets been used as attack vectors against real systems? Generally users in most enterprises are going to need instant messaging and online meeting tools, so if it's not Teams then it will be something else with an equivalent attack surface area. Windows 365 appears to be highly secure. I'm not trying to defend Microsoft here. They have had many security flaws and there will be more to come. It's just not clear whether the alternatives are significantly better.
    - taeric 4y ago
      I already said this is not unique to Windows. Such that I don't see the point of the first question. On whether those have been source of attacks, I don't have numbers. I do remember getting hacked through Office back in the day. The whole "open this document" crap college students did to each other. To that end, I fully cede this could just be a false view from my side. I'd expect most attacks are still of the "what is your password" variety. That along with a giant shared drive that everyone just dumps everything into. And I don't mean this as an offensive against just Microsoft. They are/were somewhat unique in the success they had with embrace/extend. That said, the blame almost as surely rests on typical "growth at all costs" mental model that is modern business.
    - galleywest200 4y ago
      > Do the popular Linux distributions for both desktop and server environments provide such a list? Yes, this is common. You are generally given the option at install how "minimal" you wish to go (do you even want a GUI installed, etc). These are often listed on the distributions website. For example here is a few from Arch: - Base (bare minimum) install: https://archlinux.org/packages/core/any/base/ https://archlinux.org/packages/core/any/base/ - Base-devel (what you need to run makepkg): https://archlinux.org/packages/core/any/base-devel/ https://archlinux.org/packages/core/any/base-devel/
- mr_mitm 4y ago
  Just exposing SMB on port 445 by default is a huge issue. The vast majority of systems does not need to provide this service, yet there have been two catastrophic RCE vulnerabilities (MS08-067 and MS17-010) in this service. Also, it's basically like an SSH service for attackers to move laterally within the network. If it's not a file server, domain controller or print server, it should probably be turned off or at least severely restricted for a whitelist of hosts. Next, the NTLMv2 authentication protocol is on by default and vulnerable to relay attacks and offline password guessing attacks. Plus: pass-the-hash vulnerable. Huge problem in corporate networks. I'd argue the broadcast domain name resolution protocols like NBNS or mDNS are unsafe as well. Disclaimer: if you were just talking about Windows on your home desktop PC, then yeah nevermind.
alephnerd 4y ago
It's generally professional services that set up these deployments at scale. MS's PS team is extremely competent and does push best practices in my experience. The issue is organizations that cheap out and decide to have an IT Service Desk guy manage everything from deployment to network architecture to security - these are extremely hard problems that require a large team of SME, not a single guy doing the best he can. City of Oakland is one of those kinds of organizations IME.
- taeric 4y ago
  I expect that pricing has made it so most all smaller places are these kinds of organizations. And the incentives are to keep it that way. As long as MS's PS team can make more money from one whale of a customer than they can supporting local districts, expect that this will remain. Such that I don't think it is excusable to say "if only they had paid the professional services."
  - alephnerd 4y ago
    You don't need professional services all the time, assuming you make sure to hire a large enough team of SMEs of your own, but a lot organization simply view tech as a cost center and try to spend almost nothing on it. That is the kind of issue City of Oakland faces (for everything btw - for example, starting salary for teachers in OUSD is $50k compared to $70-80k in the rest of the Bay Area). Also City of Oakland does 100% engage with Microsoft PS, but they don't have the requisite staff and budget to finish building out best practices.
    - taeric 4y ago
      I clearly don't know all the specifics of their case. Such that, if you have closer information, I am not trying to gaslight you on what you know. I am concerned with "best practices" in our industry, though. Too many of them are not geared to wide adherence and have fantastically bad failure cases.
      - 4y ago

by taeric 4y ago

nradov 4y ago

What specifically does a modern Windows installation include that is inappropriate or insecure in terms of default services or access rules?

taeric 4y ago
Certainly a fair question, but a big part of the problem is I don't know the specifics of what is on a new installation anymore. Worse, I'm not sure where to find such a list. Just scanning on the things they are proud to list at https://learn.microsoft.com/en-us/windows/whats-new/windows-11-overview https://learn.microsoft.com/en-us/windows/whats-new/windows-..., I'd be worried about Teams, Windows 365, and Widgets. I'd also be worried about all trial software that is on the machine. I could not find a list of that, though. And again, this is not unique to Windows. It used to be OEM bloat that was added to all things. In linux land, it would have been all of the "power tools" included by default.
- nradov 4y ago
  Do the popular Linux distributions for both desktop and server environments provide such a list? Have Teams, Windows 365, or Widgets been used as attack vectors against real systems? Generally users in most enterprises are going to need instant messaging and online meeting tools, so if it's not Teams then it will be something else with an equivalent attack surface area. Windows 365 appears to be highly secure. I'm not trying to defend Microsoft here. They have had many security flaws and there will be more to come. It's just not clear whether the alternatives are significantly better.
  - taeric 4y ago
    I already said this is not unique to Windows. Such that I don't see the point of the first question. On whether those have been source of attacks, I don't have numbers. I do remember getting hacked through Office back in the day. The whole "open this document" crap college students did to each other. To that end, I fully cede this could just be a false view from my side. I'd expect most attacks are still of the "what is your password" variety. That along with a giant shared drive that everyone just dumps everything into. And I don't mean this as an offensive against just Microsoft. They are/were somewhat unique in the success they had with embrace/extend. That said, the blame almost as surely rests on typical "growth at all costs" mental model that is modern business.
  - galleywest200 4y ago
    > Do the popular Linux distributions for both desktop and server environments provide such a list? Yes, this is common. You are generally given the option at install how "minimal" you wish to go (do you even want a GUI installed, etc). These are often listed on the distributions website. For example here is a few from Arch: - Base (bare minimum) install: https://archlinux.org/packages/core/any/base/ https://archlinux.org/packages/core/any/base/ - Base-devel (what you need to run makepkg): https://archlinux.org/packages/core/any/base-devel/ https://archlinux.org/packages/core/any/base-devel/
mr_mitm 4y ago
Just exposing SMB on port 445 by default is a huge issue. The vast majority of systems does not need to provide this service, yet there have been two catastrophic RCE vulnerabilities (MS08-067 and MS17-010) in this service. Also, it's basically like an SSH service for attackers to move laterally within the network. If it's not a file server, domain controller or print server, it should probably be turned off or at least severely restricted for a whitelist of hosts. Next, the NTLMv2 authentication protocol is on by default and vulnerable to relay attacks and offline password guessing attacks. Plus: pass-the-hash vulnerable. Huge problem in corporate networks. I'd argue the broadcast domain name resolution protocols like NBNS or mDNS are unsafe as well. Disclaimer: if you were just talking about Windows on your home desktop PC, then yeah nevermind.

alephnerd 4y ago

It's generally professional services that set up these deployments at scale. MS's PS team is extremely competent and does push best practices in my experience. The issue is organizations that cheap out and decide to have an IT Service Desk guy manage everything from deployment to network architecture to security - these are extremely hard problems that require a large team of SME, not a single guy doing the best he can. City of Oakland is one of those kinds of organizations IME.

taeric 4y ago
I expect that pricing has made it so most all smaller places are these kinds of organizations. And the incentives are to keep it that way. As long as MS's PS team can make more money from one whale of a customer than they can supporting local districts, expect that this will remain. Such that I don't think it is excusable to say "if only they had paid the professional services."
- alephnerd 4y ago
  You don't need professional services all the time, assuming you make sure to hire a large enough team of SMEs of your own, but a lot organization simply view tech as a cost center and try to spend almost nothing on it. That is the kind of issue City of Oakland faces (for everything btw - for example, starting salary for teachers in OUSD is $50k compared to $70-80k in the rest of the Bay Area). Also City of Oakland does 100% engage with Microsoft PS, but they don't have the requisite staff and budget to finish building out best practices.
  - taeric 4y ago
    I clearly don't know all the specifics of their case. Such that, if you have closer information, I am not trying to gaslight you on what you know. I am concerned with "best practices" in our industry, though. Too many of them are not geared to wide adherence and have fantastically bad failure cases.
    - 4y ago