bugtraq - Re: Microsot DID DISCLOSE potential Backdoor

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20080506183533.GA26718@infiltrated.net>
Date: Tue, 6 May 2008 13:35:33 -0500
From: "J. Oquendo" <sil@...iltrated.net>
To: Ken Schaefer <Ken@...penStatic.com>
Cc: bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk
Subject: Re: Microsot DID DISCLOSE potential Backdoor

On Tue, 06 May 2008, Ken Schaefer wrote:

> I'm not sure the facts in evidence support the conclusions reached here (sorry, not posting inline as I don't want to address each conclusion built upon some other shaky conclusion.
> 
> From http://support.microsoft.com/kb/890830
> 
> ======
> 
> Either I am missing the point of J. Oquendo's post, or the conclusions I think he reaches are speculation rather that established.
> 
> Cheers
> Ken
> 

Unsure if this made it to the list the first time, therefore I will re-take.
Outside of technical quoting I will lay it out in understandable terms.
Microsoft DOES NOT NOTIFY THE END USER THAT INFORMATION TAKEN FROM THEIR
MACHINE WILL BE FORWARDED TO ANYONE OUTSIDE OF MICROSOFT.

This *IS NOT* speculation but fact. Since you provided the link for us,
please go back and specify where Microsoft is telling us the information
they gather from Windows Malicious Software Removal WILL BE sent to
LAW ENFORCEMENT AGENCIES inside or outside the United States.

Please read the article and the wording:
http://www.pcworld.com/businesscenter/article/145257/microsoft_botnethunting_tool_helps_bust_hackers.html

/QUOTED
The software vendor is giving law enforcers access to a special tool that keeps tabs on botnets, using data compiled from the 450 million computer users who have installed the Malicious Software Removal tool that ships with Windows.
/ END QUOTE

Please find me anything in the EULA for WMSR tool that specifies they
will do as they see fit with data from my machine?

Now what's to stop them from using the same principle in the future:
We obtained information before, no one cared. RIAA cares to get a
baseline of how many Windows users have MP3's. Farfetched? I think
not. What happens a-la AT&T wiretaps where Microsoft decides to say
obtain whatever information they'd like regardless of telling you
what they're doing with that information.

So you argue... "Reporting is optional..." It sure is, but what do
you think the response would be from MS users if MS stated "We will
send your information to Law Enforcement agents anywhere..."

/QUOTED:
In February, the Sûreté du Québec used Microsoft's botnet-buster to break up a network that had infected nearly 500,000 computers in 110 countries, according to Captain Frederick Gaudreau, who heads up the provincial police force's cybercrime unit.
/ END QUOTE

Missing the part? Its black and white. If MS wasn't using information (flawed
since it's relying on IP) then how did they correlate IP information
back to law enforcement... OUTSIDE the United States...