Windows and Security: Setting the Record Straight

http://windowsteamblog.com/windows/b/bloggingwindows/archive/2010/06/01/windows-and-security-setting-the-record-straight.aspx

by px • 16 years ago

34 63 16 years ago

windowsteamblog.com

tptacek11• 16 years ago

It's going to be very hard for people here to take, especially after wading through the tone of this article or the bogus reference to the Yale GMail story, but this guy is right. Hold your nose and suck it up, Microsoft is in fact doing a better job with software security than any other large company in the industry.

eli2• 16 years ago

Agreed. All I could think when reading the Google article was, "They really think OS X is inherently more secure?" Surely it just benefits from having fewer attackers bother to target it.

thwarted2• 16 years ago

Sometimes that's all it takes. I don't need to run faster than a hungry bear, I just need to be able to run faster than you.

waterlesscloud• 16 years ago

OS XI ain't done til Android won't run. :-)

naner• 16 years ago

They don't really have a choice.

fname• 16 years ago

are you implying that other companies do?

btilly• 16 years ago

Of course OpenBSD does better still. (If Google offered OpenBSD as an option, I'd take it. Just because.)

Niten5• 16 years ago

This is true. However, I'll settle for Microsoft following OpenBSD's lead and implementing ASLR and DEP in the world's most widely used desktop operating system.

alecco12• 16 years ago

  > Microsoft is in fact doing a better job with software security
  > than any other large company in the industry

No.

They did some good changes with Vista+, sure. But their code base for most of their products is still a huge pile of crap, security-wise. IIS, Exchange, Outlook, and even Windows itself. Not all remote exec bugs are mitigated by the new OS features.

Also, with typical Microsoft attitude, usability is neglected and many users just end up opening security settings permanently after being hassled dozens of times. That's counter-productive.

A great example recently on their legacy of bad code is Hernan Ochoa's vulnerability find:

Vulnerable systems practically every Windows OS including 2000, XP, Vista, and 7.

http://www.hexale.org/advisories/OCHOA-2010-0209.txt

  > Impact: An unauthenticated remote attacker without any kind of
  > credentials can access the SMB service under the credentials
  > of an authorized user. Depending on the privileges of the authorized
  > user, and the configuration of the remote system, an attacker
  > can gain read/write access to the remote file system and execute
  > arbitrary code by using DCE/RPC over SMB.

EDIT: Formatting.

alecco12• 16 years ago

Would the down-voters at least state why? Is it forbidden to have a different opinion with examples?

Sure, the "pile of crap" was a bit juvenile. But that doesn't invalidate my point.

ErrantX5• 16 years ago

You will find bad code in, say, the Linux Kernel that goes back through the ages.

It's somewhat irrelevant.

What is important is how the problems are addressed once found. Generally Microsoft are quite quick at it (as are other OS vendors)

tptacek11• 16 years ago

The only bit of evidence you have marshalled for this argument is Hernan Ochoa's NTLM challenge advisory, which may be one of the most clever attacks published this year, after Juliano's Java Server Faces CBC padding oracle. But unlike Juliano's attack, which busted up a whole huge class of Java web applications because of a Sun bug, Ochoa's finding required knowledge of a proprietary challenge-response scheme and the reverse-engineering of its implementation.

I find that evidence exceedingly weak.

Meanwhile: what vendor is doing a better job on security than Microsoft is? That being, you know, my whole argument and all.

acqq3• 16 years ago

Tthe parent article complains:

"The Financial Times article states that:

'Windows is known for being more vulnerable to attacks by hackers and more susceptible to computer viruses than other operating systems.'

The facts don’t support the assertion."

Both parent article and parent post switch the topics: Though Microsoft did a lot of work to improve security, Windows as a platform (when you include anything installed on Windows like Adobe Flash and Reader) is certainly "more vulnerable to attacks by hackers and more susceptible to computer viruses."

I don't think I have to provide examples, anybody is able to count.

That's why I actually like that iPhone and iPad don't allow "anything goes" with the native apps. That's the biggest improvement in approach to the security in the last decades.

desigooner2• 16 years ago

As far as your platform argument goes, Flash and Reader are as inherently insecure on Mac OSX as on Windows ... maybe even worse as exploited at Pwn2Own. That Platform argument kind of falls on its face.

wooster• 16 years ago

  With Windows 7, we added improvements to BitLocker 
  for disc encryption (we also introduced BitLocker-to-Go
  for external USB devices), and added enhancements to the 
  built in Windows Firewall for better protection.

OS X equivalent is encrypted disk images and FileVault (and the firewall, but whatever).

  Windows 7 has Parental Controls built in that can be 
  combined with Windows Live Family Safety to create a 
  safer experience on the PC for children.

Yeah, OS X has that too. I wrote large parts of it.

His most compelling point is ASLR. It'd be nice if OS X had that.

Niten5• 16 years ago

> OS X equivalent is encrypted disk images and FileVault

Calling FileVault an "equivalent" of BitLocker is too generous. BitLocker provides several important things currently lacking from OS X's built in disk encryption facilities:

* Strong encryption: If you use FileVault, you're essentially gambling that your hypothetical attacker can't break a 1024-bit RSA key. That isn't such a good bet these days.

* Trusted boot path in conjunction with a TPM; defense against the "evil maid" attack

* Support for full disk encryption, not merely encryption of home directories

* Enterprise key management and recovery, so that full disk encryption can conceivably be used within a large organization

You'll want to buy PGP or similar if you're on a Mac and you want good disk encryption. (But that still won't give you anything like BitLocker's boot path verification.)

But yeah, the whole parental controls thing is not only a moot point (didn't OS X actually have that first?), but pretty much irrelevant to security in the sense intended in this discussion...

blasdel• 16 years ago

Apple can't use a TPM without people going apoplectic, even now years later. After the first couple shitstorms when the Intel Developer Preview Mac and a few other early models had TPMs, they just stopped including them with any of their hardware, despite (or perhaps because) they're essentially the only outfit that could pull that off.

Only a few models had them, and Apple doesn't like to ship features like that, especially with the way they'd get shat on over it.

tptacek11• 16 years ago

I think your argument about 1024-bit RSA being too weak is pretty much nonsense, and nothing defends against the "evil maid" attack, which kind of misses the point of full disk encryption anyways.

TPM support would be nice, though.

tptacek11• 16 years ago

OS X has address randomization, though last time I checked it was ineffective.

Thank you for Parental Controls, for what it's worth. Turning them on was the single most effective thing I did to fix my son's homework problem.

grandinj• 16 years ago

Microsoft started from a point of having such terrible security that was practically impossible __not__ to improve.

The point is that, despite all of the work they have done (and they have done a lot) they still have a very long way to go to make up for 20 years of completely ignoring security engineering.

sid02• 16 years ago

They're ahead of Apple, and Google isn't stopping you from using OS X, therefore Google's view is inconsistent with reality.

shadowsun7• 16 years ago

Scenario: Google runs Microsoft software, is attacked by hackers. Google has to wait on Microsoft for knowledge/patches to security holes, even though Windows has great security. Logical reaction: move away from Microsoft products due to nature of platform.

That I get.

Google runs Linux, is able to patch things up whenever holes occur due to the open source nature of the OS. A move to Linux makes sense to me. What I don't get, however, is the bit where OSX is allowed.

My theory is that Google made the switch not because OSX and Linux have better security per se (that is, as compared to Windows - because tctacek is right, Windows is rather good with security) but because having a userbase of so many different flavours of Linux and a spattering of OSX is going to be hell for future hackers. Does this make sense?

peter01• 16 years ago

Hey this peter.Would the down-voters at least state why? Is it forbidden to have a different opinion with examples?

Sure, the "pile of crap" was a bit juvenile. But that doesn't invalidate my point. ================= peter011 <a href="http://in.linkedin.com/in/croissancesystems1rishiagarwal " rel="dofollow">CROISSANCE SYSTEMS</a>

motters• 16 years ago

> The facts don’t support the assertion.

Unfortunately, the facts do support the assertion. I've been involved with computers since the early days of Windows 3.1, and if I tally up the number of times I've had to deal with Windows security flaws compared to security flaws on Linux or Macs there's really no doubt at all that Windows is less secure by design, and also more expensive and complex to maintain an adequate level of security.

sid02• 16 years ago

Windows 3.1 (or 9x or XP) is quite irrelevant to the discussion. Do you say the same about modern Windows (Vista/7)? Many people will disagree with you if you do.

seabee• 16 years ago

Even NT is a better starting point, being a separate kernel to the 3.1/9x days.

norswap• 16 years ago

Windows is less secure than other OS. But windows is better secureD than other OS. The only difference is that having 95+% market share, they are targeted by an awful lot more attacks.

Windows and Security: Setting the Record Straight

Related Stories