Comments on: Security Alert for Windows XP Users http://krebsonsecurity.com/2010/06/security-alert-for-windows-xp-users/ In-depth security news and investigation Sat, 11 Feb 2012 19:29:31 +0000 hourly 1 http://wordpress.org/?v=3.3.1 By: InfoSec Pro http://krebsonsecurity.com/2010/06/security-alert-for-windows-xp-users/comment-page-1/#comment-6896 InfoSec Pro Thu, 17 Jun 2010 13:38:27 +0000 http://krebsonsecurity.com/?p=3552#comment-6896 @Bill, no Ormandy did not "open the door to criminals to attack users", that was Microsoft's doing when they shipped flawed code. Ormandy did users a valuable service by alerting them to the fact that the door was open, and not letting Microsoft keep that fact hidden from their customers. The criminals find the open attack vectors without needing security warnings to direct them! @Bill, no Ormandy did not “open the door to criminals to attack users”, that was Microsoft’s doing when they shipped flawed code.

Ormandy did users a valuable service by alerting them to the fact that the door was open, and not letting Microsoft keep that fact hidden from their customers.

The criminals find the open attack vectors without needing security warnings to direct them!

Like or Dislike: Thumb up 3 Thumb down 1
]]> By: Bill http://krebsonsecurity.com/2010/06/security-alert-for-windows-xp-users/comment-page-1/#comment-6890 Bill Thu, 17 Jun 2010 07:19:40 +0000 http://krebsonsecurity.com/?p=3552#comment-6890 I don't agree with Google's Ormandy's action. He may self-righteously justify his action by pretending to urge MS into action. In fact, he opened the door to criminals to attack users. I would suggest that instead, he publicize the fact that such an exploitable hole exists, via the many web sites and blogs (such as this one) that discuss such matters, so that users can take remedial action. He should also warn MS that he will publish the code by a certain date - giving them time to craft a fix. Then he could, with perhaps a better conscience, publish the exploit. Personally, I don't think it's ever justified to publish the details of how to exploit holes, since that only benefits criminals, not users. I don’t agree with Google’s Ormandy’s action. He may self-righteously justify his action by pretending to urge MS into action. In fact, he opened the door to criminals to attack users. I would suggest that instead, he publicize the fact that such an exploitable hole exists, via the many web sites and blogs (such as this one) that discuss such matters, so that users can take remedial action. He should also warn MS that he will publish the code by a certain date – giving them time to craft a fix. Then he could, with perhaps a better conscience, publish the exploit. Personally, I don’t think it’s ever justified to publish the details of how to exploit holes, since that only benefits criminals, not users.

Like or Dislike: Thumb up 1 Thumb down 3
]]> By: Dave Dows http://krebsonsecurity.com/2010/06/security-alert-for-windows-xp-users/comment-page-1/#comment-6886 Dave Dows Thu, 17 Jun 2010 01:39:13 +0000 http://krebsonsecurity.com/?p=3552#comment-6886 @xAdmin That's why I prefaced my mention of Drop My Rights with the phrase "If it’s too inconvenient to run XP as a non-admin". I'm one of those who spends almost as much time doing Admin tasks as anything else. Before Drop My Rights, all I could do was install the best FW/AV/AS available, work in a VM whenever possible and use products such as Sandboxie, BufferZone or DefenseWall. I find most HIPS products to be too cumbersome and chatty, but DMR or one of the three mentioned above seems more acceptable to me. Please note that I also limited my claim for DMR to say "this offers *SOME* [new emphasis mine] of the protection of a Limited User Account", and prefaced it with the thought that some malware writers may find a way around DMR, if they haven't already. @xAdmin

That’s why I prefaced my mention of Drop My Rights with the phrase “If it’s too inconvenient to run XP as a non-admin”.

I’m one of those who spends almost as much time doing Admin tasks as anything else. Before Drop My Rights, all I could do was install the best FW/AV/AS available, work in a VM whenever possible and use products such as Sandboxie, BufferZone or DefenseWall.

I find most HIPS products to be too cumbersome and chatty, but DMR or one of the three mentioned above seems more acceptable to me.

Please note that I also limited my claim for DMR to say “this offers *SOME* [new emphasis mine] of the protection of a Limited User Account”, and prefaced it with the thought that some malware writers may find a way around DMR, if they haven’t already.

Like or Dislike: Thumb up 2 Thumb down 0
]]> By: Rick http://krebsonsecurity.com/2010/06/security-alert-for-windows-xp-users/comment-page-1/#comment-6883 Rick Wed, 16 Jun 2010 08:27:37 +0000 http://krebsonsecurity.com/?p=3552#comment-6883 'Google's Ormandy, who has privately alerted Microsoft to a large number of security flaws he found in the company's products over the years, indicated he was releasing the details of this bug publicly just five days after alerting Microsoft in an effort to force Microsoft to patch the flaw more quickly than it would have otherwise.' I'm OK with that. Ormandy's one of the good guys too. ‘Google’s Ormandy, who has privately alerted Microsoft to a large number of security flaws he found in the company’s products over the years, indicated he was releasing the details of this bug publicly just five days after alerting Microsoft in an effort to force Microsoft to patch the flaw more quickly than it would have otherwise.’

I’m OK with that. Ormandy’s one of the good guys too.

Like or Dislike: Thumb up 4 Thumb down 2
]]> By: xAdmin http://krebsonsecurity.com/2010/06/security-alert-for-windows-xp-users/comment-page-1/#comment-6866 xAdmin Tue, 15 Jun 2010 19:16:12 +0000 http://krebsonsecurity.com/?p=3552#comment-6866 While I agree that Drop My Rights can provide a level of security, it is by no means a match for actually running as a limited user. Because, if some nasty does get past your limited run application, it still has complete full administrator access to do what it wants on the OS. The same cannot be said when logged in as a limited user where system wide changes cannot be implemented and the only possbile impact is to the currently logged in limited user. :) While I agree that Drop My Rights can provide a level of security, it is by no means a match for actually running as a limited user. Because, if some nasty does get past your limited run application, it still has complete full administrator access to do what it wants on the OS. The same cannot be said when logged in as a limited user where system wide changes cannot be implemented and the only possbile impact is to the currently logged in limited user. :)

Like or Dislike: Thumb up 2 Thumb down 2
]]> By: David http://krebsonsecurity.com/2010/06/security-alert-for-windows-xp-users/comment-page-1/#comment-6852 David Tue, 15 Jun 2010 16:52:43 +0000 http://krebsonsecurity.com/?p=3552#comment-6852 Maybe Tavis Ormandy was within the box of acceptable behavior with this disclosure? A case for it adhering to one type of long established disclosure policy is made at my blog: http://sharpesecurity.blogspot.com/2010/06/was-tavis-ormandys-disclosure.html Maybe Tavis Ormandy was within the box of acceptable behavior with this disclosure? A case for it adhering to one type of long established disclosure policy is made at my blog: http://sharpesecurity.blogspot.com/2010/06/was-tavis-ormandys-disclosure.html

Like or Dislike: Thumb up 2 Thumb down 1
]]> By: jerry http://krebsonsecurity.com/2010/06/security-alert-for-windows-xp-users/comment-page-1/#comment-6840 jerry Tue, 15 Jun 2010 14:10:45 +0000 http://krebsonsecurity.com/?p=3552#comment-6840 Nice post XAdmin. I've disabled the security and help center on my 2 pcs. Never used it anyway.

Nice post XAdmin. I’ve disabled the security and help center on my 2 pcs. Never used it anyway.

Well-loved. Like or Dislike: Thumb up 5 Thumb down 0
]]> By: AJNorth http://krebsonsecurity.com/2010/06/security-alert-for-windows-xp-users/comment-page-1/#comment-6837 AJNorth Tue, 15 Jun 2010 12:51:24 +0000 http://krebsonsecurity.com/?p=3552#comment-6837 Hello Brian, Just a minor suggestion: rather than your alerts having the Subject of "[Krebs on Security] Once Hourly Digest Email," might you instead replace the portion following the bracket with the descriptor, which in the case of this alert is "Security Alert for Windows XP Users"? Your Post columns continue to be missed (along with the monthly chat sessions). Regards, AJ Hello Brian,

Just a minor suggestion: rather than your alerts having the Subject of “[Krebs on Security] Once Hourly Digest Email,” might you instead replace the portion following the bracket with the descriptor, which in the case of this alert is “Security Alert for Windows XP Users”?

Your Post columns continue to be missed (along with the monthly chat sessions).

Regards,

AJ

Like or Dislike: Thumb up 3 Thumb down 2
]]> By: Dave Dows http://krebsonsecurity.com/2010/06/security-alert-for-windows-xp-users/comment-page-1/#comment-6827 Dave Dows Tue, 15 Jun 2010 03:09:04 +0000 http://krebsonsecurity.com/?p=3552#comment-6827 If it's too inconvenient to run XP as a non-admin, there is another relatively easy way to browse and read email without administrative rights. You just start ALL browsers, email clients or any other internet enabled apps from specially modified shortcuts that invoke "Down My Rights" which then invokes the target app with limited rights. The following link is for a user group's page with links to the Microsoft download page for DMR and a zip file with shortcuts already modified to use DMR. http://cybercoyote.org/security/drop.shtml However, to be protected, you must not use any desktop URL shortcuts, because they would circumvent the solution. Favorites or Bookmarks should only be opened from within a browser invoked by "Down My Rights". Another slight adjustment is that any Setup executable, which would require Admin rights, cannot be "Run" from the internet. It must be "Saved", then run from a folder opened in Windows Explorer, not directly from within IE or any other browser running from DMR. If you use DMR with Firefox, it will even block you from running an installation from DownThemAll, but it's easy enough to right-click and "Open (the) directory". Because Windows Explorer is already running with your full rights, you can then install the downloaded item from within its folder. Unless the bad guys have figured out how to write their malware to invoke themselves from Windows Explorer instead of the browser's context, this offers some of the protection of a Limited User Account. Does anyone know of any malware designed to get around DMR this way? If it’s too inconvenient to run XP as a non-admin, there is another relatively easy way to browse and read email without administrative rights.

You just start ALL browsers, email clients or any other internet enabled apps from specially modified shortcuts that invoke “Down My Rights” which then invokes the target app with limited rights.

The following link is for a user group’s page with links to the Microsoft download page for DMR and a zip file with shortcuts already modified to use DMR.

http://cybercoyote.org/security/drop.shtml

However, to be protected, you must not use any desktop URL shortcuts, because they would circumvent the solution. Favorites or Bookmarks should only be opened from within a browser invoked by “Down My Rights”.

Another slight adjustment is that any Setup executable, which would require Admin rights, cannot be “Run” from the internet. It must be “Saved”, then run from a folder opened in Windows Explorer, not directly from within IE or any other browser running from DMR.

If you use DMR with Firefox, it will even block you from running an installation from DownThemAll, but it’s easy enough to right-click and “Open (the) directory”. Because Windows Explorer is already running with your full rights, you can then install the downloaded item from within its folder.

Unless the bad guys have figured out how to write their malware to invoke themselves from Windows Explorer instead of the browser’s context, this offers some of the protection of a Limited User Account. Does anyone know of any malware designed to get around DMR this way?

Like or Dislike: Thumb up 2 Thumb down 1
]]> By: Michael http://krebsonsecurity.com/2010/06/security-alert-for-windows-xp-users/comment-page-1/#comment-6826 Michael Tue, 15 Jun 2010 02:18:15 +0000 http://krebsonsecurity.com/?p=3552#comment-6826 As a non-geek, I always (try to) surf the net on a user account because security blogs say so. If you drive XP and haven't created a user account for surfing the net, please do so. It's like seatbelts - they came with the car but to get the protection, you have to exercise the option (put them on) every(!) time you get in the car.

As a non-geek, I always (try to) surf the net on a user account because security blogs say so. If you drive XP and haven’t created a user account for surfing the net, please do so. It’s like seatbelts – they came with the car but to get the protection, you have to exercise the option (put them on) every(!) time you get in the car.

Well-loved. Like or Dislike: Thumb up 8 Thumb down 3
]]>