Internet Worm Alert

[MichaelM]

I was reading the Signs yesterday and saw the featured article "Blair Government Concocts Terror Threat - Scares British People Into Silence" with a clip from the V for Vendetta movie.

Then I came across this article from a computer industry newsletter that I'm subscribed to:
***********
Windows Worm Warnings No Joke

The 'big one' is coming. A major worm attack may be just days away, say security experts. On Wednesday, the Department of Homeland Security called out a rare warning, and Microsoft acknowledged that the patch should be at the top of every computer user's or administrator's to-do list.

http://newsletter.varbusiness.com/cgi-bin4/DM/y/eyeZ0GuOMV0Elt0EiFh0EY
***********

Coincidence? I think not. With the heightened terror alert, increased airport security and then this, it seems like the PTB are working overtime lately.

Looking through the article, it says:
***********
As the spotlight on a dangerous Windows vulnerability grows brighter by the hour, security analysts Thursday said that it's not hype driving the alarms, but genuine fear that a major worm attack is just days away.

"This is no drill," said Mike Murray, director of research at vulnerability management vendor nCircle. "And no, this isn't an overreaction. We've always said that some day there would be another big, serious vulnerability.

"Well, this is the one."

The bug in question is one of 23 patched Tuesday by Microsoft, and one of 16 tagged by the Redmond, Wash. software developer as "critical." It affects all currently-supported versions of Windows, can be exploited without end users lifting a finger, and in some experts' eyes, rivals the bug that led to 2003's destructive MSBlast attack.
***********

Everyone together now: "I want everyone to remember WHY they need us!"

I have two theories:
1) The government and Microsoft are in bed together and this is one of the 'open windows' in Windows
2) It is a marketing ploy; Microsoft is planning to release a new OS that goes by the name Vista which is being marketed as being _the_ solution for the numerous vulnerabilities in their current line-up of OSes in the market.

Well, there is also the possibility that Windows is just really poorly designed security-wise and is therefore an easy target for attack.

 

[rs]

Time for some simple math.

In Windoze XP there are estimated to be something like 40 million lines of code. Now I don't want to get into a discussion of the semantic meaning of a "line" of code, only to say that this represents a standard industry metric of overall complexity. (Wikipedia has a reasonable discussion about this: "source lines of code".)

The only point is that 40 million is a Really Big Number, and clearly well outside of what a single individual can grasp. Personally I start to lose track of things after the high side of thousands of lines. [Not that I can't figure it out, its that I look at the code and it seems "strange", like someone else wrote it.] What do those 40 million lines of code *do*? What about the compilers that convert those lines of code to executables?

Is it possible that someone could sneak capability into the source code without Microsoft's knowledge? Does the bear s*** in the woods? Could someone mess with the whole binary distrubution by inserting executables that actually came from a different source file and so have hidden functionality? Is the Pope Catholic? All it would take for A Government Agency to take control of Microsoft operating systems is to insert a few key people into the "manufacturing" arm of the company (i.e. someone who takes the source code, converts it into a package and distributes that package).

I might accept the idea of the marketing ploy except that Microcrush isn't particularly motivated by quality. They have never made money by selling quality, only by selling new features and forcing the upgrade cycle. That VISTA is a magic silver bullet for vulnerabilities is just a real laugh. The only reason that VISTA has not been shown to be full of holes is because it is not released yet.

Now that everyone has essentially given control over their computers to Microsoft via the automatic update facility, does anybody *really* know what is happening in their computer? Recall that there is also precedent for a Microsoft supplied update to actually increase vulnerability.

The adoption of automatic update is not necessarily universal. Perhaps the populace needs a few I.T. scares to move this process along to higher levels of acceptance and to get the stragglers to be absorbed into the body.

Remember the goal is to get individuals to voluntarily give up their rights.

 

[paulnotbilly]

The only reason that VISTA has not been shown to be full of holes is because it is not released yet.

Apparently it keeps getting delayed due to it being full of exploitable holes!!!

 

[MichaelM]

Hi rs,

Yup, valid point. And considering that Microsoft is a company, there is the chain of command to deal with, the right hand not knowing what the left hand is doing, etc.
Inserting a few key people, even if strict quality controls are in place, would result in shipping a product with exploitable holes.

Unlike in other 'free' linux-type OSes, though the code size may be somewhat on par (I'm not sure since I haven't looked at linux-type OSes myself), the difference is that everyone can see the whole code and can see if a hole is in the code. The open source community has the advantage of transparency, i.e. everyone can know everything about the OS.

When you remarked about people not knowing what goes on in their computer, I'm remineded about the conversation Neo had with Councillor Hamman (played by Anthony Zerbe) where the councillor remarked that there are a lot of things that work and that we don't know the details of how they work and just assume to work. Which is a gaping hole of vulnerability for attack. Who knows how and where he gets his water from the tap? Does he know that monosodium glutamate (MSG) comes under different names (by way of being an ingedient of an ingredient listed on the produt he is buying)?

Most of us have voluntarily given up our rights with most other things in our life. (Just making an observation and not condoning the ignorance of people who don't know what exactly is happening to their computer when they are using it. Not knowing what your computer is doing is not a special case given that there are other things in a person's life that he knows little to nothing about. But then again, the government can't 'tap' your tap to know what your political leanings are.)