Re: Who's to blame for malicious code?

[Paul Schmehl <pauls () utdallas edu>]

--On Tuesday, January 20, 2004 9:31 PM +0100 Tobias Weisserth 
<tobias () weisserth de> wrote:
> The two examples I gave in my initial answer to you actually contain
> that. I wonder why you didn't comment on them. What's your opinion on an
> enabled RPC port by default in consumer OSs?

Precisely the same as my opinion of shipping the OS with inetd running and 
chargen, finger, et. al. enabled.  It's stupid.  But we know that *now*, 
don't we?  We obviously didn't know that a few years ago, or all the *nix 
vendors wouldn't have done that years ago, right?

> Don't you think the simple
> measure of shipping Windows XP Home without such a service enabled would
> have stopped the spread of Blaster cold? I do.

Of course it would have, but so would have appropriate OS maintenance.  The 
only machines we had that got infected by Blaster and friends are those 
that ignored my many warnings *and* refused to participate in our 
push-patching program (either through ignorance or belligerence.)  So, 
while Microsoft may be criticized for shipping RPC on by default, you 
really can't blame them for the results of the Blaster worm, simply because 
it was possible to be unaffected by it by updating properly.  We have 
thousands of Windows machines running RPC, and none of them are infected 
because they've all been patched.

It's high time for us to stop making excuses for stupid behavior simply 
because Microsoft is an easy target.  *None* of the famous exploits and 
worms (Code Red, Nimda, Slammer, Blaster, Nachi, et. al.) would have ever 
happened had people simply updated their machines in a timely and regular 
manner.

We expect people to change the oil in their cars regularly.  Why don't we 
expect similar behavior in the computer world?

Would you blame OpenBSD if a user got hacked because he hadn't bothered to 
patch?

I'm not arguing that Microsoft has done the right thing or even that their 
OS is secure.  (It isn't, and I refuse to use it as a server unless forced 
to.  I prefer to use FreeBSD whenever possible.)  I'm arguing that you 
can't blame Microsoft for malicious code that takes advantage of weaknesses 
for which they have already issued patches, sometimes 12 months in advance 
of an outbreak.  *That* is a problem directly attributable to users.

What you're trying to argue is that, if OS vendors would simply do the 
right thing from the start, users would be protected despite their lack of 
patching, and I am saying that is preposterous.  *No* OS is so secure that 
you can simply leave it on the Internet, never patch it, and still be 
secure.

Paul Schmehl (pauls () utdallas edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html