Programming Languages

[moetheman]

The Windows security problems stem from the fact that its codebase dates back to the days before the web became prevalent, therefore, you are looking at an architecture that was not designed with security in mind. Attempting to secure a Windows system is similar to trying to bail out a boat with a sieve. For proof of that, Google is Your Friend.

[deviant]

Originally Posted by moetheman

Attempting to secure a Windows system is similar to trying to bail out a boat with a sieve. For proof of that, Google is Your Friend.

This isn't entirely true. I work in security and a majority of web based vulnerabilities over the last couple of years have been found in linux based systems and not windows. There have been numerous vulnerabilities found in PHP itself over the last couple of years that lead to all kinds of privilege escalation issues (and some famous incidents). Microsoft has done a much better job with locking down it's more recent product lines (2003 on). It is also a lot easier to over look input sanitisation in PHP applications which lead to SQL Injection, Remote File Includes, Null byte attacks, and cross site scripting. Here's a list of vulerabilites found in PHP ITSELF during may of this year alone.

PHP 5 'php_sprintf_appendstring()' Remote Integer Overflow Vulnerability
2008-05-28
http://www.securityfocus.com/bid/28392

PHP Multiple Input Validation Vulnerabilities
2008-05-28
http://www.securityfocus.com/bid/19582

PHP 5.2.5 and Prior Versions Multiple Vulnerabilities
2008-05-28
http://www.securityfocus.com/bid/29009

PHP cURL 'safe mode' Security Bypass Vulnerability
2008-05-28
http://www.securityfocus.com/bid/27413

PCRE Character Class Buffer Overflow Vulnerability
2008-05-23
http://www.securityfocus.com/bid/27786

PHP 5.2.4 and Prior Versions Multiple Vulnerabilities
2008-05-20
http://www.securityfocus.com/bid/26403

PHP .Htaccess Safe_Mode and Open_Basedir Restriction-Bypass Vulnerability
2008-05-20
http://www.securityfocus.com/bid/24661

PHP 5.2.3 and Prior Versions Multiple Vulnerabilities
2008-05-20
http://www.securityfocus.com/bid/25498

PHP Chunk_Split() Function Integer Overflow Vulnerability
2008-05-20
http://www.securityfocus.com/bid/24261

PHP Glob() Function Arbitrary Code Execution Vulnerability
2008-05-20
http://www.securityfocus.com/bid/24922

PHP EXT/Session HTTP Response Header Injection Vulnerability
2008-05-20
http://www.securityfocus.com/bid/24268

T1lib intT1_Env_GetCompletePath Buffer Overflow Vulnerability
2008-05-13
http://www.securityfocus.com/bid/25079

GD Graphics Library PNG File Processing Denial of Service Vulnerability
2008-05-13
http://www.securityfocus.com/bid/24089

PCRE Regular Expression Heap Overflow Vulnerability
2008-05-05
http://www.securityfocus.com/bid/14620

There hasn't been a vulnerability found in ASP.NET since 2007 and even then there were only two found that year both relatively minor issues.

Let me be clear, I'm actually a linux guy and I hate using windows as an operating system outside of certian tasks. Internet Explorer and other items not included, Windows severs have actually become a very easy platform to secure especially in relation to the IIS/.Net webapp world in comparison to the alternatives.

I could also go into linux kernel vulns vs windows OS vulns but which is much the same story.

I still use linux and PHP for webapps, but I have to stay on top of it like a hawk.

[moetheman]

Originally Posted by deviant

This isn't entirely true. I work in security and a majority of web based vulnerabilities over the last couple of years have been found in linux based systems and not windows.

There hasn't been a vulnerability found in ASP.NET since 2007 and even then there were only two found that year both relatively minor issues.

I could also go into linux kernel vulns vs windows OS vulns but which is much the same story.

I still use linux and PHP for webapps, but I have to stay on top of it like a hawk.

Well, how many vulnerabilities do you think would be found in Windows if everyone had access to the source code? Seriously. The very permissions model windows uses is flawed.

From the user's point of view, the inability to see the source code is a security flaw in and of itself.

Now, about programming languages being insecure, I find that it is the programmer's skill that determines whether software is secure, not the language itself, if it were totally a language issue, then Ada would be the only safe language to write applications in, period.

It really is funny that you claim M$FT products are more secure than open source - when was the last time the world witnessed one of the many security disasters we have all seen (do I really need to list them?) in the M$FT camp in relation to FOSS? Seriously man, please enlighten me, because I seriously can't remember the occasion.

If you truly have to constantly watch something like a hawk, you are doing something wrong friend. Software security is not something which you implement by watching over something at all times.

Funny, this is the only board I have ever seen on the web where M$FT products are safe (and powerful) and MAC addresses do not exist, or behave according to the whim of whatever jackass is posting.

Laughable.

[gonzo]

Oh hell its about to be on now.

[moetheman]

Originally Posted by gonzo

Oh hell its about to be on now.

lol

Actually, I will clarify, I don't find the board laughable, I find some people's ignorance to be laughable.

I mean, seriously, some things are simply too obvious.

Remember how I offered those characters some software that would, if they chose to use it in that manner, allow them to engage in their board shenanigans anonymously and they did not even reply? So much for all that dough they claim to make, I offered them a deal.

[Toby]

Originally Posted by gonzo

Where's the bar maid, I want to run a tab.

[deviant]

Originally Posted by moetheman

Well, how many vulnerabilities do you think would be found in Windows if everyone had access to the source code? Seriously. The very permissions model windows uses is flawed.

From the user's point of view, the inability to see the source code is a security flaw in and of itself.

Now, about programming languages being insecure, I find that it is the programmer's skill that determines whether software is secure, not the language itself, if it were totally a language issue, then Ada would be the only safe language to write applications in, period.

It really is funny that you claim M$FT products are more secure than open source - when was the last time the world witnessed one of the many security disasters we have all seen (do I really need to list them?) in the M$FT camp in relation to FOSS? Seriously man, please enlighten me, because I seriously can't remember the occasion.

If you truly have to constantly watch something like a hawk, you are doing something wrong friend. Software security is not something which you implement by watching over something at all times.

Funny, this is the only board I have ever seen on the web where M$FT products are safe (and powerful) and MAC addresses do not exist, or behave according to the whim of whatever jackass is posting.

Laughable.

Your post makes it obvious that what you understand in relation to security and what you think you understand are two different things.

I'm not holding security class today.

If you admin all your boxes and haven't been applying a shitload of updates over the last year to your linux boxes (in reference to watching things like a hawk.) then LOL @ you. I hope you're not storing any credit card data. If you're in a shared hosting environment, you better hope that the hosting provider is doing more than just updating cpanel.

I'm not new to the internet, I know what kind of situation this is. It's kind of like a political debate where one side digs in to argue their point with out really understanding the issue. It doesn't matter what you tell that person, they're still going to try and argue their side. Participating in those kinds of arguments are a big waste of time.

Based on your post it is obvious that you have a very very rudimentary understanding of security and what leads to vulnerabilities. When I made the post above, I was simply stating facts (which you're obviously not interested in, or unable to understand), not trying to get into an "z0mg which OS is bettar!?!?!" flame war.

Now, about programming languages being insecure, I find that it is the programmer's skill that determines whether software is secure

So, the long and short of it is. I'm not here to teach security class and there are some huge gaps in your understanding that would take a lot more time than I'm willing to give in order to fill them in.

[moetheman]

Originally Posted by deviant

Your post makes it obvious that what you understand in relation to security and what you think you understand are two different things.

Interesting that you would say that, I stated the obvious - not an opinion or interpretation.

Originally Posted by deviant

I'm not holding security class today.

Good. I certainly don't need one from you.

Originally Posted by deviant

If you admin all your boxes and haven't been applying a shitload of updates over the last year to your linux boxes

Right, because we ALL know that security is simply all about applying patches, therefore, a large number of patches implies the absence of security (when it is actually the opposite!!!!!!!! this means that vulnerabilities are BEING FOUND AND ADDRESSED) and - as you implied in your earlier post - if vulnerabilities aren't found by an EXTREMELY LOW number of people (the group that the source code is available to) THAT MEANS THOSE SIMPLY DON'T EXIST. Right. Nevermind, the history of the code base in question . . . nevermind the track record involved, with scriptkiddy teenagers wreaking havoc on a global scale . . . once again, I invite you to please cite an analogous example on another OS.

Originally Posted by deviant

(in reference to watching things like a hawk.)

Oh, ok, that must mean that buffer overflows in the code - for example - are fixed by applying patches . . . no need to get it right in the first place, right man, right. As I said, it is like trying to bail out a boat with a sieve.

Originally Posted by deviant

then LOL @ you. I hope you're not storing any credit card data.

Yeah, because if I were storing CC data, I would rely on other people's patches, I wouldn't ENCRYPT it all to begin with. Right.

Originally Posted by deviant

If you're in a shared hosting environment, you better hope that the hosting provider is doing more than just updating cpanel.

Oh sure . . . because I would not simply get my own dedicated server running OpenBSD, sitting behind a hardware firewall with some tight filtering rules AND an IDS (to begin with) . . . no, I would RUN WINDOWS! RIIIGHHHHTTTTT

Originally Posted by deviant

I'm not new to the internet, I know what kind of situation this is.

Yeah, that. I can tell. Sure.

Originally Posted by deviant

It's kind of like a political debate where one side digs in to argue their point with out really understanding the issue. It doesn't matter what you tell that person, they're still going to try and argue their side. Participating in those kinds of arguments are a big waste of time.

Sure, because I haven't made reference to several obvious facts related to the question at hand. No, I just . . . made it up, yeah, I admit it man, it's not true, yeah, the windows code base does not date back to the pre-web era and thus was designed with network security in mind, and no, Mr. Mitnick (who is a friend of Oprano btw) did not know what he was talking about when he found that a Windows SBS 2003 server was compromised EIGHT HOURS after being on the net . . . what would HE know about security right? RIGGGHHHHTTTTT

Originally Posted by deviant

Based on your post it is obvious that you have a very very rudimentary understanding of security and what leads to vulnerabilities.

So I just need to apply patches, RIGHT?

Originally Posted by deviant

When I made the post above, I was simply stating facts

Just repeating what you read someplace, you most certainly don't UNDERSTAND IT . . . that.is.obvious . . . I can't imagine how someone could ever possibly conclude that a closed source system, the security of which was designed before the web became widely used, is CAPABLE of being secure. That's beyond me.

Originally Posted by deviant

(which you're obviously not interested in, or unable to understand)

Right again, because I did not provide LINKS to stuff, therefore, that means that what I made REFERENCE to never happened, yeah. Oh yeah, and I am unable to understand that applying patches is the way to implement security. Right.

Originally Posted by deviant

not trying to get into an "z0mg which OS is bettar!?!?!" flame war.

Do you realize that I never made a comparison to ANY other operating system when I commented on the lack of proper security in Windows? Do you? Please read my initial post on this topic. So. Who attempted to kick off a flame fest?

Originally Posted by deviant

So, the long and short of it is. I'm not here to teach security class and there are some huge gaps in your understanding that would take a lot more time than I'm willing to give in order to fill them in.

You are not qualified to teach security bud, so don't even go there . . . please . . . I most certainly do not need information from you, your understanding of the topic is limited to applying patches anyway, friggin' home users can do that . . . but I know what kind of a "security" guy you are. Your world is limited to a very narrow, fenced off segment of it, one where the core concepts, the fundamental, architectural facts are not an issue, you just read some bulletins, apply some patches, and call it good. Please. I am amazed that you are actually convinced.

You know, I don't even care that you disagreed with my post, I simply find it outrageous that anyone would make the claims you have made, in face of years of history, thousands of pages written on the topic, and the experiences and opinions of MOST technology professionals (and by professionals I don't mean former construction workers with MCSEs) along with a gargantuan number of available examples. I find it incredible. Outlandish. Unreal. In other words, you can't possibly be serious.

[gonzo]

Originally Posted by moetheman

yeah, I admit it man, it's not true, yeah, the windows code base does not date back to the pre-web era and thus was designed with network security in mind, and no, Mr. Mitnick (who is a friend of Oprano btw) did not know what he was talking about when he found that a Windows SBS 2003 server was compromised EIGHT HOURS after being on the net . . . what would HE know about security right? RIGGGHHHHTTTTT

I can hardly contain myself for the pending rebuttal.

[deviant]

Originally Posted by gonzo

I can hardly contain myself for the pending rebuttal.

You're like the referee, I know you have to be laughing your ass off. I'm tempted to print it out, frame it, and hang it on my wall. This is the funniest shit I've seen in a while.