Slashdot Log In
Microsoft to Publish Blue Hat Findings
Posted by
Zonk
on Thu Mar 16, 2006 02:29 PM
from the stylish-chapeau dept.
from the stylish-chapeau dept.
An anonymous reader wrote to mention an InfoWorld article about Microsoft's plan to publish some of the findings from last week's Blue Hat conference. From the article: "'Everything was fair game,' wrote SQL Server engineer Brad Sarsfield in a blog posting. 'Hearing senior executives say things like: 'I want the people responsible for those features in my office early next week; I want to get to the bottom of this' was at least one measure of success from my point of view for the event.' The Blue Hat name is a play on the Black Hat conferences, which have occasionally been criticized by IT vendors. The 'Blue' part comes from the color of badges that Microsoft staffers wear on campus." They have descriptions of some of the sessions up on the site for your perusal.
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Blank passwords (Score:5, Insightful)
Re:Blank passwords (Score:5, Funny)
Only Microsoft can bring you incredible innovation like this.
Parent
Re:Blank passwords (Score:2, Insightful)
I enjoy a good Microsoft bash (oh lololo m$ nevar innovates!!1!) but your comment tells me you have probably no idea how commercial software works.
I think the blank password "feature" is supremely stupid, and yes, it was probably there because one of their big clients asked for it. A lot of functionality in Microsoft products come from big business feedback and most of the time it's appropriate because enterprise clients are the ones that real
Re:Blank passwords (Score:5, Interesting)
Good to know.
but your comment tells me you have probably no idea how commercial software works.
I'm not quite sure how this statement follows from your first. Do you like a joke or not? Maybe, just maybe, I was only joking?
The key is that it's an option that you (as the DB admin) can choose to turn off. The MySQL root account will also run with a blank password when you first install it from, say, Synaptic. It's up to you to tighten it down.
The reason why the root/sa passwords start blank is so you can configure the server immediately after installation. Using a default username/password of some sort (ala Oracle) wouldn't change the security situation to any appreciable degree, and only serves to force the DB administrator to look up the default every time he does an installation. (Which is likely to be rare enough to prevent him from memorizing it.)
Yeash. Way to spoil a joke.
Parent
Posturing (Score:5, Interesting)
This is a pretty standard way for companies to handle lynch mobs of unhappy people: Put an exec up on a stage and have everyone yell their guts out and promise to investigate it thoroughly. This is not done just for software security, but just about everything.
Undoubtedly one or two simple, yet highly visible, things (eg. the password check) will be fixed to show that some action was taken.
Parent
Re:Posturing (Score:2)
Re:Blank passwords (Score:5, Funny)
-Scott Tiger
Parent
Re:Blank passwords (Score:3, Interesting)
Could it be...? (Score:4, Interesting)
Naaahh...
I'm sure this was a very interesting conference - nice to see names like Johnny Long there ( Google Hacking for Penetration Testers ) http://books.slashdot.org/article.pl?sid=05/04/11
All the same, I'm sure the findings will be taken back, discussed among those who know and forgotten or buried by marketing executives.
Re:Could it be...? or why Blue Hat is useless (Score:2)
the reality is that the attackers will be Black Hats. Blue Hats may be useful, but they aren't the ones attacking you.
Re:Could it be...? (Score:4, Interesting)
Yes - yes they are.
You see - MS's customers are demanding it - and MS is trying to deliver - after all, their competition [distrowatch.com] (mostly) is delivering. (See, this is why F/OSS is good for you even if you dont use it:)
Anyway, I do think MS is making an attempt to take security seriously, but security needs are ultimately outshadowed by their marketing needs.
Anyway, to bring things (mildly) back on topic, I'll repeat myself: [slashdot.org]
Note to Microsoft
We have more then enough hat colours as things stand.
Blue Hat hacker sounds like an IBM employee anyway (or an Anti-Fedora agent?)
Parent
Anyone ask why SSL still doesn't do AES? (Score:2, Insightful)
Re:Anyone ask why SSL still doesn't do AES? (Score:2)
Microsoft SSL already does do 3DES. (Score:5, Informative)
HHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Cont
Parent
NSA asked Microsoft to not put AES in? (Score:2)
Not so weird (Score:5, Interesting)
Not that weird. Yes, every other browser/client/server supports it. IE still has comfortably more than half [hitslink.com] of the browser market, even though it's in decline. So, if the NSA can't break AES, they ask M$ not to put it in, and a large chunk of the traffic remains readily readable.
"But," you may say, "anyone who knows what they're doing will use something more secure." True. However on one hand, crooks and terrorists are often (albeit not always) stupid, and might not always do so; and on the other hand, the easily broken traffic can be quickly sorted out, leaving a smaller quantity of harder-to-break traffic where content analysis is neglected but traffic analysis [wikipedia.org] approaches become profitable. Limiting the capabilities of the drooling-luser set is helpful, because it makes it easier to pick out the bad guys who hide by leaving a smaller set of both the good and the bad guys who can hide. Rather than struggling to separate all the good from the bad, they can first quickly separate the smart from the stoooopid.
Of course, there's no proof the AC's assertion is true... but it doesn't matter much for the sake of arguement.
Parent
Yeah, AES went into core crypto, but not SSL. (Score:3, Informative)
obligatory (Score:5, Funny)
Someone had to say it, folks!
- Andrew
Black Hats or...? (Score:4, Interesting)
MS plays that sort of game a lot.
Parent
Re:Black Hats or...? (Score:2)
- Andrew
Re:Black Hats or...? (Score:3, Insightful)
Putting an Axe to Innovation (Score:5, Funny)
With quotes like that, it's no wonder Vista's long list of features has been dwindled down to a new Media Player and better video drivers.
Re:Putting an Axe to Innovation (Score:3, Insightful)
The message shouldn't be: Don't implement new features. It should be: Think about security when implmenting new features. Remember that attacks come from below your level of abstraction as well.
Re:Putting an Axe to Innovation (Score:4, Funny)
You mean, like video drivers that won't crash if you visit certain web sites [bluescreen.org.lu]?
Parent
Confusion cleared up here. (Score:5, Funny)
OK, it's time to have mercy on you guys who haven't figured it out.
There is no Microsoft.
It's all a MMOG/interactive fiction thing where geeks pretend to be code monkeys in service to the evil empire. C'mon, the Gates was a bit subtle, I admit; you could almost believe he existed. But Ballmer should have clued you in. No real board would hire a guy like that unless they were running a side show and needed a "Wild Man of Borneo".
The coolest part of the hack was when they started sending out boxes of their "product", complete with CDs and manuals (look closely -- a lot of it's just "ipsum lorem"). That was sheer brilliance. I picked one myself as a souveneir, I'm looking at the box up on my book shelf right now, it's very well done. Just the other I had to keep my elderly father-in-law, who was an engineer back in the day and no dummy, from "borrowing" my copy. Boy would he have been surprised.
Oh... God Gad.
You didn't actually install any of that shit, did you?
Parent
Pretty optimistic, isn't he? (Score:4, Funny)
Server engineer Brad Sarsfield in a blog posting. 'Hearing senior executives say things like: 'I want the people responsible for those features in my office early next week; I want to get to the bottom of this' was at least one measure of success from my point of view for the event.'
I'd be a little more worried if I was Brad. That feature your boss wants to know who's responsible for..what if it's 'Clippy'???
F/OSS Replies (Score:2)
"Badges?"
"We don't need no stink'n badges!"
Re:F/OSS Replies (Score:3, Funny)
"We don't need no stink'n badges!"
Badges, badges, badges, mushroom! mushroom! Snaaake!
Nobody Expects (Score:5, Funny)
Re:Nobody Expects the Seattle Inquisition! (Score:2, Funny)
Fear
Torturous OS
and a distinct desire for coffee, preferably espresso con lattee, although I'll settle for a mocha
Which is it? (Score:4, Insightful)
Does that mean domesticated or tame?
Red Hat vs. Blue Hat (Score:5, Funny)
You put on the blue hat - the story ends, you wake up in your bed and believe whatever you want to believe.
You put on the red hat - you stay in Wonderland and I show you how deep the security-hole goes.
The People Responsible (Score:5, Funny)
Re:The People Responsible (Score:4, Informative)
This is why Apple won in court against Xerox. It is a urban legend that Apple stole it from Xerox.
Parent
Re:The People Responsible (Score:4, Informative)
Also, Apple didn't win in court. When Apple sued MS for theft Xerox sued Apple for the same thing. Once Apple lost the suit against MS they simply settled out of court w/ Xerox.
Parent
Re:The People Responsible (Score:3, Insightful)
ignoring the noise this is good... (Score:2, Interesting)
yes we can all feel cynical based on many other similar stories.
but every now and again a company will surprise it and attempt to actually <i>solve</i> problems.
A lot of Microsoft's problems date from interesting "for the user" support features. This could be interesting to follow...
And The Big News Is.... (Score:3, Interesting)
(can you tell I've just been watching Red Vs Blue [roosterteeth.com]?
I do hope that nobody actually paid for this news.
guh.Blame to Go Around (Score:5, Insightful)
Ah, good to know the culture of blame is still a backbone of American industry. Likely that those senior executives are the ones that requested said features originally. But that's okay, I'm sure they'll find some scapegoats.
Re:Blame to Go Around (Score:4, Informative)
Parent
Careful what you wish for (Score:5, Funny)
"I want the people responsible for those features in my office early next week"
The features with security issues? Isn't he risking a fire hazard by doing this? I thought buildings had maximum occupancy ratings?
*ducks*
Corporate Goonspeak... (Score:5, Insightful)
Microsoft's site will not have the kind of controversial material that has popped up at Black Hat. "All researchers at the BlueHat are responsible," Kornbrust said.
Translation: All presenters know what side of their bread is buttered and by whom.
Let's celebrate our new openness by censoring ourselves!
Somebody kick me in the shin please. I must be asleep and dreaming that I'm stuck on that Moron Planet again.
Re:Corporate Goonspeak... (Score:3, Funny)
Before you wake up, please tell us how you managed to leave it. Please?
What Blue Hat Means... (Score:5, Funny)
Actually the Blue Hats are a symbolic salute to their employer's greatest technical accomplishment: The Blue Screen of Death
Poor executives. (Score:3, Insightful)
Im sure the staff at Redmond is eagerly awaiting the executives bitchslapping eachother and themselves to the next monday. Im sure most of the marketing department will call in sick.
Re:Poor executives. (Score:5, Insightful)
Oh it's very typical for management to put the heat on individuals, but problems like this come about because of an extremely poor process. While one may argue that an individual has a responsibility to follow standards, it is also management's responsibility to ensure everyone else does, too.
So when something like this leaks, you can blame management, not the programmer. He made the mistake, but the even larger mistake is that the process didn't catch it. There will be no success when the course of action is for an executive to call out a programmer, but it is strongly indicative that these problems will be repeated.
Parent
In the Office..For Target Practice (Score:2, Funny)
Somebody is going to practice throwing chairs during the weekend..and many others are gonna practice ducking them...
Reminds me of a story... (Score:3, Interesting)
I recall maybe 8-9 years ago at my large former employer. There were some screw-ups going on coming from an IT subdepartment at corporate headquarters. After trying in vain to work around things on my end I finally picked up the phone and called up the person in charge. Before I could launch into my tirade the person said, "I'm in charge, but I'm not responsible." Reminds me of what will happen Monday morning amidst the chair-littered corridors of Redmond. Lots of finger pointing and ducking...
Irresponsible responsibility (Score:5, Interesting)
People do things for reasons. Hammering them for things that turn out badly just produces CYA, fear and paralysis. Red in tooth-and-claw management always devours itself.
Re:Description please? (Score:5, Funny)
We could tell you, but we'd have to throw a chair at you.
(It's really a conspiracy against Red Hat)
/ducks chair
//adjusts tinfoil hat.
Parent