Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email email@example.com
Re: [Full-Disclosure] Who's to blame for malicious code?
From: Paul Schmehl (paulsutdallas.edu)
Date: Tue Jan 20 2004 - 23:53:35 CST
--On Tuesday, January 20, 2004 9:31 PM +0100 Tobias Weisserth
> The two examples I gave in my initial answer to you actually contain
> that. I wonder why you didn't comment on them. What's your opinion on an
> enabled RPC port by default in consumer OSs?
Precisely the same as my opinion of shipping the OS with inetd running and
chargen, finger, et. al. enabled. It's stupid. But we know that *now*,
don't we? We obviously didn't know that a few years ago, or all the *nix
vendors wouldn't have done that years ago, right?
> Don't you think the simple
> measure of shipping Windows XP Home without such a service enabled would
> have stopped the spread of Blaster cold? I do.
Of course it would have, but so would have appropriate OS maintenance. The
only machines we had that got infected by Blaster and friends are those
that ignored my many warnings *and* refused to participate in our
push-patching program (either through ignorance or belligerence.) So,
while Microsoft may be criticized for shipping RPC on by default, you
really can't blame them for the results of the Blaster worm, simply because
it was possible to be unaffected by it by updating properly. We have
thousands of Windows machines running RPC, and none of them are infected
because they've all been patched.
It's high time for us to stop making excuses for stupid behavior simply
because Microsoft is an easy target. *None* of the famous exploits and
worms (Code Red, Nimda, Slammer, Blaster, Nachi, et. al.) would have ever
happened had people simply updated their machines in a timely and regular
We expect people to change the oil in their cars regularly. Why don't we
expect similar behavior in the computer world?
Would you blame OpenBSD if a user got hacked because he hadn't bothered to
I'm not arguing that Microsoft has done the right thing or even that their
OS is secure. (It isn't, and I refuse to use it as a server unless forced
to. I prefer to use FreeBSD whenever possible.) I'm arguing that you
can't blame Microsoft for malicious code that takes advantage of weaknesses
for which they have already issued patches, sometimes 12 months in advance
of an outbreak. *That* is a problem directly attributable to users.
What you're trying to argue is that, if OS vendors would simply do the
right thing from the start, users would be protected despite their lack of
patching, and I am saying that is preposterous. *No* OS is so secure that
you can simply leave it on the Internet, never patch it, and still be
Paul Schmehl (paulsutdallas.edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
Full-Disclosure - We believe in it.