NYT: Flaws Are Detected in Microsoft’s Vista

[RamboLiberal]

http://www.nytimes.com/2006/12/25/technology/25vista.html?ei=5090&en=49a6ffcc2da87302&ex=1324702800&partner=rssuserland&emc=rss&pagewanted=print

Microsoft is facing an early crisis of confidence in the quality of its Windows Vista operating system as computer security researchers and hackers have begun to find potentially serious flaws in the system that was released to corporate customers late last month.

On Dec. 15, a Russian programmer posted a description of a flaw that makes it possible to increase a user’s privileges on all of the company’s recent operating systems, including Vista. And over the weekend a Silicon Valley computer security firm said it had notified Microsoft that it had also found that flaw, as well as five other vulnerabilities, including one serious error in the software code underlying the company’s new Internet Explorer 7 browser.

The browser flaw is particularly troubling because it potentially means that Web users could become infected with malicious software simply by visiting a booby-trapped site. That would make it possible for an attacker to inject rogue software into the Vista-based computer, according to executives at Determina, a company based in Redwood City, Calif., that sells software intended to protect against operating system and other vulnerabilities.

Determina is part of a small industry of companies that routinely pore over the technical details of software applications and operating systems looking for flaws. When flaws in Microsoft products are found they are reported to the software maker, which then produces fixes called patches. Microsoft has built technology into its recent operating systems that makes it possible for the company to fix its software automatically via the Internet.

Despite Microsoft assertions about the improved reliability of Vista, many in the industry are taking a wait-and-see approach. Microsoft’s previous operating system, Windows XP, required two “service packs” issued over a number of years to substantially improve security, and new flaws are still routinely discovered by outside researchers.

[Andrea]

1. Another good reason to stick with Mac -- nt

[Nomad559]

2. The Mac OS X has had

many more vulnerabilities than Windows XP, and the Mac OS X has also needed far more patches than Windows XP.

OS X
http://secunia.com/search/?search=OS+X&w=1

Windows XP
http://secunia.com/search/?search=Windows+XP&w=1

Apple Mac OS X patch plugs 31 vulnerabilities
http://news.com.com/2100-1002_3-6139117.html?part=rss&tag=2547-1_3-0-20&subj=news

:)

[Moochy]

4. Brand Integrity vs. The Facts

The facts lose out when the marketing is good enough. :)

As a percentage of the desktops sold, Macs only represent at most 10-20% and in some environments like universities perhaps a bit higher. Thus its more useful to figure out hacks for XP and Unix/Linux servers, than it is to try and hack Apple's particular flavor of Unix, OS X.

[Posteritatis]

11. Security through obscurity isn't, though. (n/t)

[SpiralHawk]

29. Whatever you call it, it is real SECURITY. Mac is solid while MS is crap

I've been down both roads. Don't want no crappy buggy vulnerable MS bloatware.

[Maven]

18. Bull.

Windows is a hodgepodge of old code (MS needs backwards compatability to maintain their monopoly) and bad design decisions that make it INHERENTLY more vulnerable than UNIX, UNIX-based OSes like OS X, etc. It was never designed as a multiuser OS and is foundationally more insecure on a network re: attack and infiltration.

"Obscurity" has nothing to do with it. In fact, given the (well deserved) reputation OS X has for security at this point, it's a MORE attractive target to hackers. Everyone already KNOWS Windows leaks like a sieve--there's no real challenge there. And yet, NO known exploits or malware for OS X exist "in the wild" that have posed a credible threat beyond laughable "proof of concept" software that's already been patched. So, sorry, that argument doesn't fly.

[Moochy]

24. Who was defending MS code?

My favorite band is way better than your sucky band. ;-)

[Maven]

25. I didn't say you were defending MS code.

But you did suggest that little or no exploits have been developed for OS X (as compared to the thousands and thousands that exist for Windows) only because Windows is more widely used, not because OS X is more secure as a platform.

This is commonly offered by way of apology for Windows and MS in general. It's false.

Besides, my band is WAYYYY better than your band. I bet my dad could beat up your dad, too! ;)

[Tesha]

32. I agree with you, but...

> {Windows} was never designed as a multiuser OS and is foundationally more
> insecure on a network re: attack and infiltration.

Generally, I agree with everything you said but I
want to quibble one nit.

What you said is certainly true about classic Windows.
But the Windows/NT *OPERATING SYSTEM* ws designed, from
the ground up, by Dave Cutler and his very capable
design team with two major, well-respected, secure
operating systems (RSX-11M and VMS) under their belts.
There's nothing in the basic new-age Windows/NT operating
system that is inherently single-user and there's not
much that was inherently insecure.

Where the main failing comes in (and as you correctly
observed) was with Microsoft's desire to maintain
backwards-compatibility to all the crap classic Windows
applications software in the world. Maintaining this
compatibility required opening up huge security holes
in the Windows "presentation layers" (above the
operating system). It's primarily at these layers
that the unfixable security disasters occur. At some
point, Microsoft will eventually have to break their
backwards compatibility with all those decades of
crappy applications software that's out there, and
force people to adopt newer versions of the apps
that are designed to inter-operate in a disciplined,
well-controlled fashion using *ONLY* the interfaces
that are supported (and secured!) by the operating
system.

Apple bit that bullet with the conversion to OS/X.
Microsoft is still grappling with facing that pain,
although Vista takes a few more baby steps in that
direction.

Tesha

[truthisfreedom]

22. Hahahahahahaaaaaaa. Merry Christmas, Microsoft!

Look what you got in your stocking!

[Kablooie]

15. or could it be that Apple is more efficient at addressing vulnerabilities?

[alfredo]

21. Because their core is open source they can't hide

any potential vulnerabilities. If someone finds a problem with zlib, all UNIX variants could be affected so all parties will find a solution and post it so the maintainers of Debian, NetBSD, RedHat, and OSX can test and apply the fix. Though OSX is not completely open, the UNIX core is open.


If your system is closed you can hide behind that proprietary wall. If anyone finds a flaw and publishes it, they could be opening themselves to a suit or a visit from Fatherland Security or some other enemies of information.

[Maven]

17. Here we go again...

Your blatant disregard for the truth is almost comical at this point.

[Tesha]

31. "many more"? You have *NO IDEA* what you're talking about.

> The Mac OS X has had many more vulnerabilities than Windows XP,
> and the Mac OS X has also needed far more patches than Windows XP.

You obviously have *NO IDEA* what you are talking about.

Tesha

[reprobate]

16. Every time Microshaft releases software, more switch to Macs.

I did it two years ago and never looked back.

My dog is happier now. She no longer has to hide under the bed while I scream at the Gates Folly.

Peace in the home at last.

[regnaD kciN]

19. Maybe that's why Macs continue to be a niche machine only?

:eyes:

This notion of Mac making a comeback against PCs is less plausible than the notion that "the South will rise again." At this point, if the iPod starts to lose its trendiness appeal, Apple as a company will be in deep, deep trouble.

[Maven]

20. And yet, their marketshare continues to rise.

Just like Michael Dell said Apple should shut its doors in the 90s and now his shitbox company is in serious trouble. Apple has now surpassed Dell in market value. And, P.S., the iPod isn't going anywhere but up.

Frankly, most Mac users don't care if Macs remain a "niche" product--we still enjoy using them and will continue to enjoy using them. Have fun with your BSOD!

[Tesha]

33. And that Porsche company, they're doomed too.

(I don't think Apple is a "niche product), but just for
the sake of argument, let's grant that thought for a
moment...)

People always seem to think that a computer company
can't survive by filling a niche (where "niche" always
seems to be conveniently defined as "whatever market
share Apple is holding today").

This always strikes me as funny. I think about the
auto industry, and such "niche" vendores as Porsche,
Ferrari, Maserati, Lamborghini, Lotus, and Aston-Martin
Lagonda. *THESE* are companies filling niches. Porsche
has far less market share than Apple, yet no one talks
about shutting the doors in Zuffenhausen, and essentially
nobody would turn down a Porsche Carrera GT in favor of,
say, a Chevy Cavalier.

Niche markets live as long as there's enough economic
activity to keep them rolling along. besides being
immensely desireable, Porsches generate lots of economic
activity, both in sales and service as well as after-market
(accessory) products and marketing tie-in products.

Macintosh computers generate lots of economic activity
as well, both in sales as well as after-market products.
And unlike the case with Porsches, thanks to industry
standards like USB, ATA, SATA, and others, Macs are
perfectly happy using most of the same accessories and
add-on products that PCs use, so there's almost no
cost-of-entry for a vendor to sell into the Mac market-
place along with their PC business. This is even true
in software; it simply isn't that hard to design appli-
cation software that is universal between Macs and PCs.

There's one more thing to be learned from the car
example: Even though Porsche is still a free-standing
company, I'll grant you that some of the marques that
I mentioned have rich parents. The same thing could
someday be true for Apple as well. If things really
did start to look bleak some Christmas in Cuppertino,
Apple would still be a very attractive acquisition
target for any of several big-name players in the PC
and larger computer world, for example, IBM, Sony,
or HP.

Apple, niche or not, isn't going to disappear.

Tesha

[Ezlivin]

23. The Mac will die

I've been buying and using Macs since 1985 and I swear that is the oldest line in the business.

Every time it's a "big problem" that will bring down the Mac. You think once the iPod loses its appeal, "Apple as a company will be in deep, deep trouble."

Since I've been hearing this for over 20 years, I think it's time for people who say this to put up or shut up.

You want to bet $1000 that Apple will be out of business next year? The year after? The year after that?

How about it? I don't mind taking money from suckers....

[Sherman A1]

26. With all due respect,

I find your opinion to be a bit of Horse Hockey. MS's Zune is pretty much Dead in the Water, from what I understand. As far as PC's, I get regular updates from Microsoft requiring me download and reboot my PC using Windows XP, but surprisingly few for the iMac running OS X Tiger. Mac may never have the market share of Windows, but then it really doesn't need to do so. OS X is simply an elegant system that works and does so with tremendous ease for those that really don't want to know how it works, just that it does, as far as Windows, well........

[Jim Sagle]

3. But...but....but THAT would mean MS s/w is (gasp!!!) DEFECTIVE!!!!!!!

:scared::boring:

[RC]

5. DUH! It's Microsoft.

Of course it has flaws. MS is long over do on finding out how the real world does things before they write any code for their bloated software. I usually find 3rd party software is easier to use and works better.

[JohnyCanuck]

6. Vista's content protection mechanism could cause problems

I just don't know enough about computing and multimedia etc. to count myself qualified to comment on this following, but I'd be interested in reading the feedback from others who might have more experience and knowledge in this area.

A Cost Analysis of Windows Vista Content Protection
===================================================

Peter Gutmann, [e-mail]
http://www.cs.auckland.ac.nz/~pgut001/pubs/vista_cost.txt
Last updated 23 December 2006


SNIP

Disabling of Functionality
--------------------------

Vista's content protection mechanism only allows protected content to be sent
over interfaces that also have content-protection facilities built in.
Currently the most common high-end audio output interface is S/PDIF
(Sony/Philips Digital Interface Format). Most newer audio cards, for example,
feature TOSlink digital optical output for high-quality sound reproduction,
and even the latest crop of motherboards with integrated audio provide at
least coax (and often optical) digital output. Since S/PDIF doesn't provide
any content protection, Vista requires that it be disabled when playing
protected content. In other words if you've invested a pile of money into a
high-end audio setup fed from a digital output, you won't be able to use it
with protected content. Similarly, component (YPbPr) video will be disabled
by Vista's content protection, so the same applies to a high-end video setup
fed from component video.

Indirect Disabling of Functionality
-----------------------------------

As well as overt disabling of functionality, there's also covert disabling of
functionality. For example PC voice communications rely on automatic echo
cancellation (AEC) in order to work. AEC requires feeding back a sample of
the audio mix into the echo cancellation subsystem, but with Vista's content
protection this isn't permitted any more because this might allow access to
premium content. What is permitted is a highly-degraded form of feedback that
might possibly still sort-of be enough for some sort of minimal echo
cancellation purposes.

The requirement to disable audio and video output plays havoc with standard
system operations, because the security policy used is a so-called "system
high" policy: The overall sensitivity level is that of the most sensitive data
present in the system. So the instant any audio derived from premium content
appears on your system, signal degradation and disabling of outputs will
occur. What makes this particularly entertaining is the fact that the
downgrading/disabling is dynamic, so if the premium-content signal is
intermittent or varies (for example music that fades out), various outputs and
output quality will fade in and out, or turn on and off, in sync. Normally
this behaviour would be a trigger for reinstalling device drivers or even a
warranty return of the affected hardware, but in this case it's just a signal
that everything is functioning as intended.

Decreased Playback Quality
--------------------------

Alongside the all-or-nothing approach of disabling output, Vista requires that
any interface that provides high-quality output degrade the signal quality
that passes through it. This is done through a "constrictor" that downgrades
the signal to a much lower-quality one, then up-scales it again back to the
original spec, but with a significant loss in quality. So if you're using an
expensive new LCD display fed from a high-quality DVI signal on your video
card and there's protected content present, the picture you're going to see
will be, as the spec puts it, "slightly fuzzy", a bit like a 10-year-old CRT
monitor that you picked up for $2 at a yard sale. In fact the spec
specifically still allows for old VGA analog outputs, but even that's only
because disallowing them would upset too many existing owners of analog
monitors. In the future even analog VGA output will probably have to be
disabled. The only thing that seems to be explicitly allowed is the extremely
low-quality TV-out, provided that Macrovision is applied to it.

The same deliberate degrading of playback quality applies to audio, with the
audio being downgraded to sound (from the spec) "fuzzy with less detail".

Amusingly, the Vista content protection docs say that it'll be left to
graphics chip manufacturers to differentiate their product based on
(deliberately degraded) video quality. This seems a bit like breaking the
legs of Olympic athletes and then rating them based on how fast they can
hobble on crutches.

Full article posted at:
http://www.cs.auckland.ac.nz/~pgut001/pubs/vista_cost.txt

[ChairmanAgnostic]

8. mikrosopht is kutting their own throats with BS like this.

As a happy Macuser, some of my clients require me to run windoze based software. With my older machines, I used an emulator program. With the dual chip macbook, I can actually install MS OS on it, but I have been delaying, avoiding and dreading putting their OS on my machine.

Who woulda thunk that the latest MS OS woulda stunk?

[Commie Pinko Dirtbag]

7. Use Linux. No Copyright Sturmtruppen in your computer. Nuff said. -nt

[Occulus]

9. Not only that, but

virtually all the "new" features in Vista already exist in linux- and have for quite some time. Additionally, Vista's "new" Aero visual scheme does not perform as smoothly as Compiz running with xgl in linux. Granted that is only eye candy; however, it is a touted feature of Vista, and it simply does not keep up with Compiz and xgl. These, by the way, come standard in Fedora Core 6.

And Compiz has yet to reach release 1.0. Its latest release per the Wiki is 0.3.4.

Also per the Wiki, here are Compiz's featured plugins:

* annonate: draw things on top of all windows
* cube: each virtual desktop becomes a face on a cube
* decoration: a decorator for GNOME or KDE can draw window edges
* fade: windows fade in and out
* gconf: settings come from GNOME
* minimize: windows minimize(and maximize) with an animation effect
* move: window moving
* place: placement of new windows
* resize: window resizing
* rotate: the desktop cube can be rotated
* scale: an overview of all open windows (similar to OS X's Exposé)
* switcher: active window can be chosen with Alt-Tab
* water: ripples trailing mouse and rain effect
* wobbly: windows ripple while they move
* zoom: magnifies a part of screen
* clone: duplicate output on two screens

Community Plugins (distributed in compiz-extra)

* animation: animation effects for window events
* benchmark: plugin to gauge performance
* bs: brightness and saturation control
* crashhandler: crash handling through gdb and recovery
* dbus: dbus interfacing
* negative: inverts color of a window or screen
* put: moves windows using key binds
* reflection: watermarks window decorations, similar to Aero-Glass by default
* screenshot: mode to capture screen regions with the mouse
* state: set default opacity and other options for types of windows
* trailfocus: unfocused windows fade with time
* mousegestures: advanced mouse gestures to control effect
* scripting: allows scripters to take advantage of compiz effects
* wallpaper: different wallpapers on different side of the 3D cube

And you DON'T have to pay an arm and a leg for all this. It's free. Just like linux. :)

No, I don't think I'll be buying Vista for quite some time. In fact, if someone tried to give it to me, I'd think they were trying to hurt my PC...

[sendero]

10. Saying that flaws are found in a ...

... Microsoft product is like saying there are some Republicans who are liars.

Microsoft has never, not one time, released a significant product without serious bugs. Even now, products that are over a decade old, like Word and Excel, still have annoying and sometimes work-losing flaws.

Microsoft is doing what they have done from day one, foist shoddily written crap created by people working long hours under impossible (to go good work) conditions and making a lot of money doing it.

[Neshanic]

12. I can't defend MS much longer. It's a horrible mess.

I have to run Autocadd and the entire Abobe Creative suite to do my job.

I installed the Vista beta. It's awfull. Absolutely horrifyingly bad. Looks pretty, and it should, it looks just like Apple.

Problems too numerous to mention, and the administrator rights things is maddening.

They will release this crap, and nothing will work with it. I will need new drivers for two plotters, a scanner, AutoCadd, Adobe, and everything else under the sun. Not only that, the computer will not play movies as the last insult, the Vista program wiped that previledge away. Office 2007 beta is now on this machine, and to upgrade and get LESS, like not getting Outlook with the new version, but having to buy it separately is beyond belief. Office without Outlook. Unfuckingbelievable.

They are driving their defenders like me away.

I will not buy Vista until 2009 if at all.

[Occulus]

28. I have one single question for Mr. Bill Gates:

Why should I accept an operating system from your company which does less than previous iterations of your software, and why should I be comfortable with you asking for even more money for it?

[Sherman A1]

13. Well,

this will be entertaining as MS trys to sort out the code and the potential damage to the image of this long overdue release. "Oh, it's really secure, except fot the parts that aren't.... Please feel free to buy it and anything that you have currently will no longer be supported after ________ Date" And have a nice day!!!

[rucky]

14. I'm tired of paying big bucks to beta test for Microsoft.

could you imagine any other consumer product going to market with as many flaws in it as Microsoft products?

[Vidar]

27. It would be news if there weren't.

[Zech Marquis]

30. In a somewhat related story on my end

I've had an 360 since they launched last year, and after the last Dashboard Update, mine began tolock crash and is now dead. The good news is that MS is going to repair (morelikely replace) mine,but with the ongoing stroies about these software problems and now Vista having alot of securti holes already...I think I'm going to switch to a Playstation 3. I love Xbox Live, Gears of War, the Marketplace, but now I just dont want any part of M$.

[NickB79]

34. Yours is locking up too?

I just bought one less than 2 months ago, and purchased Doom 3 a month later. I downloaded the update package required to play this game on the 360, and now it freezes up at least once every hour of gameplay. The machine itself doesn't seem to be overheating, as I can play Gears of War for hours without a lockup. The screen freezes and my controller begins to vibrate like crazy. Does that sound like what happened with yours?

[Zech Marquis]

35. It did!!!

I'm trying to remembr which game it was, but mine froze up and kept the rumboing buzz on my controller once or twice..I think it was Call of Duty 2(I know it was a shooter title fro the get-go). Even worse man--mine won't even start up anymore :-( I got that update after the fall dashboard download, and it just started dying each day. This is one kick ass system, but i'm NOT going to put with with the typical M$ sloppy ass software issues. Once i get my replacement 360, I'm going to either sell it to my co worker for $150, or simply trade it in at my local gamespot for a 60 gb PS3...i never thought I'd see the day when I owuldn't care about old Master Chief and Halo 3 anymore :-( Oh well, I should be playing eyond in about a month.

[NickB79]

36. Oh crap

Good thing I purchased a 2-yr extended warranty from Best Buy, and I'm going to be buying a PS3 in the next year anyways (my significant other is loyal Final Fantasy fan, so a PS3 is a must for her). Thanks for the heads-up on what to expect though.