Re: [Full-Disclosure] Web sites compromised by IIS attack

From: Paul Schmehl (pauls_at_utdallas.edu)
Date: 07/01/04

  • Next message: Denis Dimick: "Re: [Full-Disclosure] Web sites compromised by IIS attack" 
    To: FULL-DISCLOSURE@lists.netsys.com
Date: Wed, 30 Jun 2004 21:08:27 -0500

    --On Wednesday, June 30, 2004 6:27 PM -0500 Frank Knobbe <frank@knobbe.us>
    wrote:
    >
    > Instead of requiring the consumer to install patches, Microsoft should
    > be required to fix their own, broken products. That means that they
    > should send their army of engineers (a lot of which are now carrying the
    > CISSP certification) to the consumers and have their engineers correct
    > the flaws in their products. They sold flawed products, they should fix
    > it.
    >
    I'm right there with you, Frank, on one condition. You hold *every*
    software vendor to the same standard. IOW, "Apache should be required to
    fix their own, broken products"..."RedHat Linux should be
    required"......"Oracle should be
    required"....."sendmail"....."wuftpd"....."php"..."mysql"...etc., etc.,
    etc., ad infinitum, ad nauseum.

    Be careful what you wish for. You may actually get it.

    I just upgraded my workstation from RedHat 9.0 to Fedora Core 1. I then
    ran up2date and found that there were 142 software packages that needed to
    be updated. Just before I did that, I run portupgrade on one of my FreeBSD
    boxes. It had 17 programs that had to be updated.

    If we're going to require that software vendors produce flawless products,
    we're not going to have many software products. Even Postfix, which *to my
    knowledge* has never had a security issue, has had numerous bug fixes.
    (And I think so highly of Postfix that the first thing I do when I install
    a new OS is replace sendmail with Postfix.)

    I attended a presentation yesterday for a security product in the
    application firewall field. During the presentation, the CISSP stated that
    "in every 1000 lines of code there will be 15 errors". I don't know if I'd
    agree with that - I suspect most coders are a bit better than that - but I
    had to chuckle, because, of course, I immediately thought, "So you admit
    that your code is riddled with holes!"

    We need better methodologies for finding bugs in software. We need better
    training of programmers. We need established standards for coding that
    would define things like bounds checking. We need a *lot* of improvements
    in software development, and those improvements need to be *industry-wide*,
    not just Microsoft.

    Every time I read about a security vendor with a remote hole in their
    products, I think, "How in the world can they identify attacks, if they
    can't even see them in their own code?"

    Clearly the problem is a *lot* bigger than Microsoft alone.

    Paul Schmehl (pauls@utdallas.edu)
    Adjunct Information Security Officer
    The University of Texas at Dallas
    AVIEN Founding Member
    http://www.utdallas.edu

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: Denis Dimick: "Re: [Full-Disclosure] Web sites compromised by IIS attack"

    Relevant Pages

    • MICROSOFT has to take RESPONSABILITY for the emails
      ... >unstable they might fix it with a good old security ... I think that Microsoft are liable for any damage ... the emails made to look like they come from ... >it, we test it, u then fix the bugs WE find with updated, ...
      (microsoft.public.security)
    • Re: Problem with KB951748 XP Update
      ... Perhaps if Microsoft designed its operating systems with better security in ... wasting their time trying to fix the damned thing up. ... Security setting. ...
      (microsoft.public.windowsupdate)
    • Re: [Full-disclosure] Office 0day
      ... when they can probably make the sale offering only $25K? ... Or would I rather Microsoft trump their offer by much ... have little to no motivation to actually *fix* it. ... But compared to a Security team of 50 people at $250,000 a year for 7 years. ...
      (Full-Disclosure)
    • Re: New KB835732 weirdness
      ... Wait a bit on this Sasser fix. ... The fix also breaks IE history it looks like. ... > The security update that is described in Microsoft Security Bulletin ...
      (microsoft.public.win2000.windows_update)
    • Re: New KB835732 weirdness
      ... Wait a bit on this Sasser fix. ... The fix also breaks IE history it looks like. ... > The security update that is described in Microsoft Security Bulletin ...
      (microsoft.public.win2000.general)
    • Quantcast