Message-Id: <939D8085-7A36-495A-BC4B-5C9C57314673@mtu.edu>
Date: Sat, 15 May 2010 16:50:17 -0400 (EDT)
From: rdsears@....edu
To: "noloader@...il.com" <noloader@...il.com>
Cc: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: Re: Windows' future (reprise)

And what of the pass the hash group of attacks, not to mention the  
insecure hashing to begin with? Combine that with token manipulation  
and process migration and you have a very deadly combination to almost  
any windows network that you don't see anywhere else. Exploiting  
windows networks in this way is trivial at best, and is built in to  
the operating system as a set of 'features'.

That's not to say the *nix platform doesn't have it's own security  
problems, but at least they're a.) dealt with in a more timely manner,  
and b.) easily analyzed by anyone. Even if 99/100 people that looks at  
it is 'uneducated' as you put it i'd rather have the one set of eyes  
on it going 'hey this needs to be fixed' and educating eveyone else on  
how to manage it, a la the Debian PRNG SSH bug a couple years ago.  
Imagine how that wouldve gone if Microsoft had dealt with a similar  
issue.

Having said that I have to say even though some people may not find  
Stuart's research interesting, he's simply trying to report his  
findings. He's doing this to help paint a picture of security in the  
state it's ACTUALLY in, and try to predict where it's progressing to.

Everything in nature can be modeled with mathematics, why not threat  
trends?

On May 15, 2010, at 4:22 PM, Jeffrey Walton <noloader@...il.com> wrote:

>> My main reason for claiming that Windows is inherently insecure is
>> because it's closed source.
> As opposed to crowd sourcing, which some claim is inherently more
> secure because more [uneducated] eyes review the source code? This is
> along the lines of, 'Linux does not get viruses' argument. Give me a
> break...
>
> On Sat, May 15, 2010 at 4:06 PM, lsi <stuart@...erdelix.net> wrote:
>> Is that you, Bill?
>>
>> I think you misunderstand.  9 months ago, I measured the growth rate
>> at 243%, using Symantec's stats.  9 months ago I posted that number
>> here, together with a prediction of this year's stats.  Recently, I
>> got this year's stats and compared them with that prediction.  I
>> found that this prediction was 75.4% accurate.  I am now reporting
>> those results back to the group.  And this is trolling how?
>>
>> My point is that the prediction was not wildly wrong, and so that
>> leads me to wonder if anything else I said, 9 months ago, was also
>> not wildly wrong.
>>
>> My main reason for claiming that Windows is inherently insecure is
>> because it's closed source.  However it's also because of the sloppy,
>> monolithic spaghetti code that Windows is made of.  If you're
>> claiming Windows is in fact inherently secure, I assume this means
>> you don't use AV on any of your Windows machines, and advise everyone
>> you know to uninstall it?
>>
>> I never said migration would be free or easy.  That is why I am
>> posting this data here, because I see it as a vulnerability, a very
>> big vulnerability that many companies have not woken up to.  The very
>> fact that migration is hard, lengthy, and expensive, means that the
>> vulnerability is larger than ever.
>>
>> Stu
>>
>> On 15 May 2010 at 14:40, Thor (Hammer of God) wrote:
>>
>> From:                   "Thor (Hammer of God)" <Thor@...merofgod.com>
>> To:                     "full-disclosure@...ts.grok.org.uk" <full-
>> disclosure@...ts.grok.org.uk>
>> Date sent:              Sat, 15 May 2010 14:40:29 +0000
>> Subject:                Re: [Full-disclosure] Windows' future  
>> (reprise)
>>
>>> I am constantly amazed at posts like this where you make yourself  
>>> sound like some sort of statistical genius because you were "able  
>>> to predict" that since last year was %243, that this year would be  
>>> %243.  Wow.  Really?
>>>
>>> And for the record, these claims of 'inherent insecurity' in  
>>> Windows are simply ignorant.  If you are still running Windows 95  
>>> that's your problem.  Do a little research before post assertions  
>>> based on 10 or 20 year old issues.
>>>
>>> This smacks of the classic troll, where you say things like  
>>> "nothing that Microsoft makes is secure and it never will be" and  
>>> then go on to say how easy it is to migrate, and how it's free,  
>>> with only a one off cost, and how to move off of .NET.
>>>
>>> Obvious "predictions," ignorant assumptions, and a total lack of  
>>> any true understanding of business computing.  Yep, "troll."
>>>
>>> t
>>>
>>> [SNIP]
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists