So I read about this huge security hole MS have found in basically all Windows machines prior to XP. Even if you apply the patch to these machines, they can be silently reinfected through a trusted MS-originated ActiveX control. So the MS solution is to remove Microsoft itself from your list of trusted providers. What’s really scary about this bug is that it affects servers and clients (browsers). This is exactly the kind of dual vulnerability that allowed Code Red and NIMDA to be so successful.
I note from the Microsoft press release itself how best to secure your Windows PC: The simplest way is to make sure you have no trusted publishers, including Microsoft. This was and is the whole beef MS claim to have with Sun’s Java-based approach to distributed computing. In Java, programs are assumed to be hostile until the JVM checks them rigorously for safety. Only then does it let them out of the “sandbox” to gain access to critical system functions. But the old ActiveX (and new-but-same .NET) approach was to use crummy code, weird-ass programming, and generally stinky and cheap quality control but allow organizations to digitally sign the programs. And so Windows machines will just blindly run any signed COM/.NET object,which gives them a 20-30% speed increase over Java objects. And this whole silly “trusted source” paradigm is what they are trying to use to take over the home entertainment and leisure markets with Palladium.
But now MS seems to be saying that no COM objects should be trusted, even ones direct from Microsoft. Actually, it strikes me that a perhaps ulterior motive here for MS recommending that everyone should distrust all COM objects, from all sources, is that MS doesn’t want to appear as the only crappy publisher. They could have told people just to distrust MS-signed objects, and left everyone else’s alone. But then they’d appear singly incompetent, so instead of blaming the organization and the people, they decide to blame the technology instead. It must be tough to spin the truth working for Microsoft PR.
Tags: Uncategorized by mike
No Comments »
