PDA

View Full Version : More proof Microsoft's operating systems are compromised [MUSTREAD]




mdh
05-06-2008, 02:19 PM
This is a must-read for anyone using Microsoft's windows operating system. I've previously reported on NSA code included in Vista, and the DUAL_EC_DRBG as reported on by Bruce Schneier, proving that the NSA has included code in Windows Vista and that no one was talking about what that code actually did, where in the kernel it hooked into, etc.

Now comes proof that a signifigantly larger compromise exists in all of Microsoft's systems, one that allows anyone with a small USB device to simply walk up to a computer running Windows, attach the device, and gain immediate access to all of the data in RAM as well as on the hard drive, via a simply user-friendly interface. And these devices are being distributed to law enforcement agencies worldwide. Apparently the entire system was developed by a Chinese law enforcement agent, who later went to work for Microsoft's "Internet Safety Team".

For more details, see this - it looks like the cops in the US aren't talking about it, but those in New Zealand are.
http://www.stuff.co.nz/4507443a28.html

Kludge
05-06-2008, 02:24 PM
[Retracted]

torchbearer
05-06-2008, 02:27 PM
This is a must-read for anyone using Microsoft's windows operating system. I've previously reported on NSA code included in Vista, and the DUAL_EC_DRBG as reported on by Bruce Schneier, proving that the NSA has included code in Windows Vista and that no one was talking about what that code actually did, where in the kernel it hooked into, etc.

Now comes proof that a signifigantly larger compromise exists in all of Microsoft's systems, one that allows anyone with a small USB device to simply walk up to a computer running Windows, attach the device, and gain immediate access to all of the data in RAM as well as on the hard drive, via a simply user-friendly interface. And these devices are being distributed to law enforcement agencies worldwide. Apparently the entire system was developed by a Chinese law enforcement agent, who later went to work for Microsoft's "Internet Safety Team".

For more details, see this - it looks like the cops in the US aren't talking about it, but those in New Zealand are.
http://www.stuff.co.nz/4507443a28.html

If the program reads ram, and all OSes use RAM for files, I don't see how this jump drive program would be OS specific.
It could pull raw data from your RAM even if you using Linux.

What am I missing here?

Also, another thing techs are going to hate/love. I have a jump drive with windows xp on it.

I can pop it onto just about any workstation on any windows networks and have a real good time.
I'm not a huge microsoft fan, but if everyone was using Linux, like they are using Microsoft, Linux would have just as many viruses written for it, and would have just as many hackers finding cracks in its armor.
With so few people using Linux, and most of those Linux users being the hackers/coders,there is no incentive to create programs to compromise that particular OS. there is no advantage to it.

I believe, any OS under enough scrutiny, will surface many ways it can be broken into.

mdh
05-06-2008, 02:30 PM
Funny how these devices are being distributed to law enforcement agencies worldwide, but nary a peep about it from US agencies. I'd say that given MS hiring a former Chinese agent, that MS likely took the initiative on their own, as they know what kind of power they wield and want to earn the good graces of governments. They will be less likely to see anti-trust problems, especially in the increasingly surveillance-state EU where they've traditionally had problems, given this sort of thing. Governments will be afraid to push more users towards open source systems which they have no control over and which often offer a very high level of security and data encryption out of the box, plus verifiable source code to allow each and every single user to be 100% sure he or she is running a clean system.

In a police state, uncontrolled computers are dangerous. Be dangerous. ;)

hayeksrevenge
05-06-2008, 02:30 PM
Yeah. You have no privacy in America and we do have Fascism.

RonPaulVolunteer
05-06-2008, 02:33 PM
Affects everything, please do more research.

lucius
05-06-2008, 02:34 PM
Blantant Corporatism!

mdh
05-06-2008, 02:37 PM
If the program reads ram, and all OSes use RAM for files, I don't see how this jump drive program would be OS specific.
It could pull raw data from your RAM even if you using Linux.

What am I missing here?

Clearly the device relies on action by the Windows operating system kernel to get such access. That level of sophistication is not provided by the USB itself, or anything at the hardware level. So unless one loaded a kernel module for it into their Linux kernel, it would not work, and I doubt anyone will be developing that kernel module anyways... ;)


I'm not a huge microsoft fan, but if everyone was using Linux, like they are using Microsoft, Linux would have just as many viruses written for it, and would have just as many hackers finding cracks in its armor.
With so few people using Linux, and most of those Linux users being the hackers/coders,there is no incentive to create programs to compromise that particular OS. there is no advantage to it.

I believe, any OS under enough scrutiny, will surface many ways it can be broken into.

The difference is what one can do about it. No code is perfect, and for every 100 programmers, only one of them writes secure code. That said, you or I or anyone can verify that Linux or FreeBSD or any other open source OS doesn't have these sorts of back doors built into them by simply looking at the code - nothing's hidden from the user. This post isn't about malicious compromise attempts, it's about the maker of a system deliberately inserting back doors into their system which they market to the general public and to businesses as being secure.

So yes, I can compromise an awful lot of Linux boxes hanging out on the net, mostly because their admins are idiots and don't update the software for security patches. I can't, however, expect the developers of that software to leave a back door open for me, nor can I expect that any of those security flaws were created on purpose to begin with.

In the end, the track record of open source developers beats the crap out of microsoft's in terms of getting actual inadvertent security flaws fixed and new versions or patches released in a timely manner, too.

torchbearer
05-06-2008, 02:45 PM
Clearly the device relies on action by the Windows operating system kernel to get such access. That level of sophistication is not provided by the USB itself, or anything at the hardware level. So unless one loaded a kernel module for it into their Linux kernel, it would not work, and I doubt anyone will be developing that kernel module anyways... ;)



The difference is what one can do about it. No code is perfect, and for every 100 programmers, only one of them writes secure code. That said, you or I or anyone can verify that Linux or FreeBSD or any other open source OS doesn't have these sorts of back doors built into them by simply looking at the code - nothing's hidden from the user. This post isn't about malicious compromise attempts, it's about the maker of a system deliberately inserting back doors into their system which they market to the general public and to businesses as being secure.

So yes, I can compromise an awful lot of Linux boxes hanging out on the net, mostly because their admins are idiots and don't update the software for security patches. I can't, however, expect the developers of that software to leave a back door open for me, nor can I expect that any of those security flaws were created on purpose to begin with.

In the end, the track record of open source developers beats the crap out of microsoft's in terms of getting actual inadvertent security flaws fixed and new versions or patches released in a timely manner, too.

True.
Makes you wonder about the Linux distributions that have borrowed from MS.
Didn't linspire and others have code from MS?

Vista is the picture of nanny state. I hate it. But use it to learn it, for my business.
Microsofts screw ups keep me in business. ;)

Ever thought about what really motivates the government to go after these big companies like MS?
Imagine having the power to leverage billions in "anti-trust" penalties on a successful company. Keep harrassing them... and then offer them a lil' relief if they allow a lil' backdoor access. If ya know what mean. (sorry bad joke)

No private company would willing put its product rep on the line to allow government spying. They are coerced and bribed to do so.

mdh
05-06-2008, 03:36 PM
http://www.wvlibertarian.info/?p=10


Furthermore, since this device enables quick, on-site forensic analysis very easily, it would seem to fit in very well with the US government’s new strategy of “no knock” searches, allowing government agents to quick and easily drop in, grab your data, and get out without you even knowing they’d been there and done so. Forensic analysis of a hard drive can be quite a difficult or at least a long procedure, especially when dealing with sophisticated disk and file encryption, however since this device is not only sanctioned but developed and distributed by Microsoft, it most likely includes push-button circumvention of Microsoft’s own encryption technologies. Whether third party technologies will be affected depends on how they work. The sad fact is that a lot of applications leave things laying around in memory, including symmetric encryption keys, and that this device enables access to data in memory, so it seems likely that at least some third-party encryption products will be compromised as well.

http://www.wvlibertarian.info/?p=10

FunkBuddha
05-06-2008, 03:48 PM
I'm not sure this thing will bypass the security measures on a windows box. I think it just collects data once the drive is mounted and the scripts are run. I have a similar set of scripts that I run to collect all sorts of data when I do a live forensic analysis of a box.

You know as well as i do that you can crack a windows password in seconds if you have physical access which an investigator would. This would be a MAJOR issue for M$ if this thing allowed someone to just walk up with a USB and suck data off of it. Microsoft should know better than anyone that hackers are looking for these types of backdoors. If it DOES allow that type of access and someone figured it out, M$ would be devastated.

I'm watching the torrent sites for this thing, I'm sure it'll show up.

Hook
05-06-2008, 04:00 PM
Clearly the device relies on action by the Windows operating system kernel to get such access. That level of sophistication is not provided by the USB itself, or anything at the hardware level. So unless one loaded a kernel module for it into their Linux kernel, it would not work, and I doubt anyone will be developing that kernel module anyways... ;)



The difference is what one can do about it. No code is perfect, and for every 100 programmers, only one of them writes secure code. That said, you or I or anyone can verify that Linux or FreeBSD or any other open source OS doesn't have these sorts of back doors built into them by simply looking at the code - nothing's hidden from the user. This post isn't about malicious compromise attempts, it's about the maker of a system deliberately inserting back doors into their system which they market to the general public and to businesses as being secure.

So yes, I can compromise an awful lot of Linux boxes hanging out on the net, mostly because their admins are idiots and don't update the software for security patches. I can't, however, expect the developers of that software to leave a back door open for me, nor can I expect that any of those security flaws were created on purpose to begin with.

In the end, the track record of open source developers beats the crap out of microsoft's in terms of getting actual inadvertent security flaws fixed and new versions or patches released in a timely manner, too.

USB doesn't allow direct memory access, but FireWire does. A FireWire device can be made that reads directly from RAM at the hardware level. In fact, some vendors have made console redirectors with FireWire that periodically reads the text buffer memory and sends it to a KVM-like switch.

Peer review certainly is helpful for weeding out questionable code. But it has been proven that back doors can be sucessfuly hidden in peer reviewed code. Such as code that intentionally allows buffer overflows.

ARealConservative
05-06-2008, 04:04 PM
one that allows anyone with a small USB device to simply walk up to a computer running Windows, attach the device, and gain immediate access to all of the data in RAM as well as on the hard drive, via a simply user-friendly interface.

This is pure sensationalism.

Nowhere in the article does it claim such a thing.


Overseas, experts in computer forensics have said the preconfigured, automated tool can carry out in 20 minutes, with the click of one button, 150 complex commands that previously required a manual process taking three to four hours.

freelance
05-06-2008, 04:05 PM
This is a must-read for anyone using Microsoft's windows operating system. I've previously reported on NSA code included in Vista, and the DUAL_EC_DRBG as reported on by Bruce Schneier, proving that the NSA has included code in Windows Vista and that no one was talking about what that code actually did, where in the kernel it hooked into, etc.

Now comes proof that a signifigantly larger compromise exists in all of Microsoft's systems, one that allows anyone with a small USB device to simply walk up to a computer running Windows, attach the device, and gain immediate access to all of the data in RAM as well as on the hard drive, via a simply user-friendly interface. And these devices are being distributed to law enforcement agencies worldwide. Apparently the entire system was developed by a Chinese law enforcement agent, who later went to work for Microsoft's "Internet Safety Team".

For more details, see this - it looks like the cops in the US aren't talking about it, but those in New Zealand are.
http://www.stuff.co.nz/4507443a28.html

So this is how they're downloading entire hard drives at the border. I read an article about it yesterday, and the Customs (or whatever they're called this week) have the right to check your computer and/or download the entire contents at the border. Hint: don't travel with your notebook, or clean it up, stash your files online, and download what you need at your destination. No more security of trade secrets or even client/lawyer confidentiality--not a hint of it.

Here's the article:

http://www.mirror.co.uk/news/topstories/2008/05/05/exclusive-tougher-security-checks-to-enter-us-as-laptops-and-mobile-phones-searched-89520-20405885/

ARealConservative
05-06-2008, 04:09 PM
So this is how they're downloading entire hard drives at the border. I read an article about it yesterday, and the Customs (or whatever they're called this week) have the right to check your computer and/or download the entire contents at the border. Hint: don't travel with your notebook, or clean it up, stash your files online, and download what you need at your destination. No more security of trade secrets or even client/lawyer confidentiality--not a hint of it.

If I have a hard drive in my physical possession, I can get the data off of it. I don't care what O/S you ran, or what you tried to do to lock me out.

Hook
05-06-2008, 04:25 PM
So this is how they're downloading entire hard drives at the border. I read an article about it yesterday, and the Customs (or whatever they're called this week) have the right to check your computer and/or download the entire contents at the border. Hint: don't travel with your notebook, or clean it up, stash your files online, and download what you need at your destination. No more security of trade secrets or even client/lawyer confidentiality--not a hint of it.

Here's the article:

http://www.mirror.co.uk/news/topstories/2008/05/05/exclusive-tougher-security-checks-to-enter-us-as-laptops-and-mobile-phones-searched-89520-20405885/

That is why everyone that goes across the border or has to deal with TSA should download and run TrueCrypt at ww.TrueCrypt.org. It is open-source and allows you to encrypt your entire hard drive, even the boot drive. It uses Bruce Schnier's Twofish as well as AES and Serpent encryption.

It also allows you to mount encrypted volumes hidden in the free space area.

They can copy what they want, but unless they have the key, all they will see is a bunch of noise.

pcosmar
05-06-2008, 04:54 PM
I believe this is a feature(bug) of Window$ ReadyBoost.
http://www.microsoft.com/windows/products/windowsvista/features/details/readyboost.mspx

It allows a storage device to act as added ram. I would guess that when removed it could retain whatever ram memory that it accessed.

Linux does not have this bug/feature, it uses the swap partition as added ram if needed.

It seems to be yet another built-in security flaw.

http://www.linuxformat.co.uk/covers/101-big.jpg

IPSecure
05-06-2008, 04:56 PM
Sure am glad my Amiga does not have USB...

pcosmar
05-06-2008, 04:57 PM
That is why everyone that goes across the border or has to deal with TSA should download and run TrueCrypt at ww.TrueCrypt.org. It is open-source and allows you to encrypt your entire hard drive, even the boot drive. It uses Bruce Schnier's Twofish as well as AES and Serpent encryption.

It also allows you to mount encrypted volumes hidden in the free space area.

They can copy what they want, but unless they have the key, all they will see is a bunch of noise.

SHhhh!!
Let them think they can get into anything.

hypnagogue
05-06-2008, 05:04 PM
Encrypt (http://www.truecrypt.org/) your shit. At least make them work for it.

american.swan
05-06-2008, 05:48 PM
I'd like to see someone head through customs with like 10 200gig hard drives full of family photos encoded, just to enjoy them spending hours and hours and hours of man hours just to crack the code so they can SEE family photos hahahahahahahaha

mdh
05-06-2008, 06:58 PM
USB doesn't allow direct memory access, but FireWire does. A FireWire device can be made that reads directly from RAM at the hardware level. In fact, some vendors have made console redirectors with FireWire that periodically reads the text buffer memory and sends it to a KVM-like switch.

Yes, but it seems to me like there must be some kernel level back door in windows to provide the tools on the usb stick that level of access. The firewire thing is bad, but this is worse, since it's intentional and, lets face it, a lot more systems have usb than have firewire.


Peer review certainly is helpful for weeding out questionable code. But it has been proven that back doors can be sucessfuly hidden in peer reviewed code. Such as code that intentionally allows buffer overflows.

Finding buffer overflows is often non-trivial, but it also isn't all that difficult the majority of the time, especially ones which were designed to be pegged by intruders. There are even tools around to automate the process.


If I have a hard drive in my physical possession, I can get the data off of it. I don't care what O/S you ran, or what you tried to do to lock me out.

Yeah, you can get what's on a physical storage medium off it. If it's encrypted sanely, have fun spending the next few years trying to brute force an AES256 key on a data set of that size. :p
Bonus points for double encrypted stuff (I usually go for Camellia256 or AES256 on top, and Twofish underneath).

Of course, that becomes trivial if the vendor of the cryptographic software has builtin a back door of some sort.


I'd like to see someone head through customs with like 10 200gig hard drives full of family photos encoded, just to enjoy them spending hours and hours and hours of man hours just to crack the code so they can SEE family photos hahahahahahahaha

Or pictures of random barns from across America.

ARealConservative
05-06-2008, 07:04 PM
Yes, but it seems to me like there must be some kernel level back door in windows to provide the tools on the usb stick that level of access. The firewire thing is bad, but this is worse, since it's intentional and, lets face it, a lot more systems have usb than have firewire.

Sorry, but this is ridiculous.

The article claims of no such back door and you have no reason to think there is outside of your obvious contempt for non open source software.



Yeah, you can get what's on a physical storage medium off it. If it's encrypted sanely, have fun spending the next few years trying to brute force an AES256 key on a data set of that size. :p

These algorithms are not O/S specific.

mdh
05-06-2008, 07:16 PM
Sorry, but this is ridiculous.

The article claims of no such back door and you have no reason to think there is outside of your obvious contempt for non open source software.

I'll start by ignoring the whole silly "obvious contempt" strawman. (In fact, I have no such contempt whatsoever, and am rather fond of a variety of software from reputable vendors with established reputations for excellence in the security field.)

Now go on and explain how the device accesses what they claim it can access in the source article without such a back door.


These algorithms are not O/S specific.

Who said they were? The question is, might some implementations of disk encryption contain back doors for law enforcement. The answer is that it's absolutely possible that some such implementations might contain a back door for law enforcement. Fortunately for the security minded, some "open source" software is available for this purpose, offering anyone with even a little savvy the opportunity to peruse the code themselves and verify whether or not such a back door exists. TrueCrypt from Bruce Schneier is one example which has been pointed out in this thread.

Microsoft says that their bitlocker software contains no back doors, but we're expected to simply take their word for it, as there's no means whatsoever to obtain independent verification. I consider this somewhat akin to the notion of buying a used car from a used car salesman who is notorious for selling lemons and taking him at his word that the one he's selling you is in mint condition.

ARealConservative
05-06-2008, 07:19 PM
Now go on and explain how the device accesses what they claim it can access in the source article without such a back door.

How about you point to the relevant section of the article to back up something....anything you are saying.

mdh
05-06-2008, 07:24 PM
How about you point to the relevant section of the article to back up something....anything you are saying.


The tiny device also eliminates the need to seize a computer itself, which typically involves disconnecting from a network, turning off the power and potentially losing data. Instead, the investigator can scan for evidence on site.

This implies that it can get to data which is not stored to the physical media, ie in memory. So I ask again, since you chose not to answer, how does the device access the system's memory without a kernel level back door enabling it to do so?

pcosmar
05-06-2008, 07:39 PM
How about you point to the relevant section of the article to back up something....anything you are saying.

How's this.
http://seattletimes.nwsource.com/html/microsoft/2004379751_msftlaw29.html

Microsoft has developed a small plug-in device that investigators can use to quickly extract forensic data from computers that may have been used in crimes.

The COFEE, which stands for Computer Online Forensic Evidence Extractor, is a USB "thumb drive" that was quietly distributed to a handful of law-enforcement agencies last June. Microsoft General Counsel Brad Smith described its use to the 350 law-enforcement experts attending a company conference Monday.

The device contains 150 commands that can dramatically cut the time it takes to gather digital evidence, which is becoming more important in real-world crime, as well as cybercrime. It can decrypt passwords and analyze a computer's Internet activity, as well as data stored in the computer.


Smith acknowledged Microsoft's efforts are not purely altruistic. It benefits from selling collaboration software and other technology to law-enforcement agencies, just like everybody else, he said.

Fortunately those "tools" will not work on my system. It does not even recognize .exe

ARealConservative
05-06-2008, 07:39 PM
This implies that it can get to data which is not stored to the physical media, ie in memory. So I ask again, since you chose not to answer, how does the device access the system's memory without a kernel level back door enabling it to do so?

talk about assumptions.

If I have administrator level access to a computer, I have no problems obtaining memory data.


Overseas, experts in computer forensics have said the preconfigured, automated tool can carry out in 20 minutes, with the click of one button, 150 complex commands that previously required a manual process taking three to four hours.

So rather then unplug a computer - wiping out memory forever, they have a bunch of tools preloaded so less knowledgeable agents can do some work without unplugging the computer.

you are making gigantic assumptions with nothing to back it up.

ARealConservative
05-06-2008, 07:40 PM
How's this.
http://seattletimes.nwsource.com/html/microsoft/2004379751_msftlaw29.html




Fortunately those "tools" will not work on my system. It does not even recognize .exe

nope - as I addressed twice now.....

mdh
05-06-2008, 07:52 PM
Fortunately those "tools" will not work on my system. It does not even recognize .exe

You're not running VMS on your workstation? Weirdo.


talk about assumptions.

If I have administrator level access to a computer, I have no problems obtaining memory data.

OK, so how does the tool obtain administrator level access? Is it a back-door that gets the tool administrator level access, then? I'm not sure what you're claiming here, or why you see my statement as an assumption. I'm simply reading something that makes a statement as fact and coming to logical conclusions based on that fact.


Overseas, experts in computer forensics have said the preconfigured, automated tool can carry out in 20 minutes, with the click of one button, 150 complex commands that previously required a manual process taking three to four hours.

So rather then unplug a computer - wiping out memory forever, they have a bunch of tools preloaded so less knowledgeable agents can do some work without unplugging the computer.

you are making gigantic assumptions with nothing to back it up.

I disagree. I am making logical conclusions based upon facts as presented in the original article. Unless you're claiming that the original article contains factual errors? Seriously, I see you lobbing a lot more accusations my way than actual analysis... and...
You still haven't answered my question at all, I notice.

pcosmar
05-06-2008, 08:01 PM
You're not running VMS on your workstation? Weirdo.




Nope. I played around with VM some. I dislike Micro$oft business practices and stopped using their crap a couple years ago.

I prefer to support those that show me respect.

Conza88
05-06-2008, 08:05 PM
I'd like to see someone head through customs with like 10 200gig hard drives full of family photos encoded, just to enjoy them spending hours and hours and hours of man hours just to crack the code so they can SEE family photos hahahahahahahaha

An added message of "Hahah! Suck shit! How many hrs wasted was that?" ROFL..

or "Ron Paul for President!" "Truth is Treason in the empire of lies!" lmao.:D

Thanks for the truecrypt site fellas. I am very UNknowledgeable (ignorant) when it comes to coding, for what I consider high end stuff (more than html) <-- hehe.

Vista can lick my balls.

Quick question:

I have a 100g portable harddrive.. which I store music, dvd's, files etc.. can I true crypt that?
Also how easy is it to use? is there a danger, I'll screw everything up and delete all the files / corrupt them?
is there an easy user interface, or do I need some above average tech skills?

Thanks

ARealConservative
05-06-2008, 08:20 PM
OK, so how does the tool obtain administrator level access?
Is it a back-door that gets the tool administrator level access, then? I'm not sure what you're claiming here, or why you see my statement as an assumption. I'm simply reading something that makes a statement as fact and coming to logical conclusions based on that fact.

You assume plenty.

For instance, you assume they aren't being provided enough information to log into a user account on the machine by co-workers, roomates, etc, etc., or that the machine wasn't already logged in when they proceed to use this time saving tool.

for memory to be at all useful, the machine had to be running - hence the concern for turning off the machine and relocating it. So while you claim a backdoor must exist to access this memory, I see how the computer is likely already vulnerable - thus the desire to see the memory inside.



I disagree. I am making logical conclusions based upon facts as presented in the original article.

The article does not lend itself to a logical conclusion - only assumptions.



You still haven't answered my question at all, I notice.

I'm not sure what you are asking for, and you obviously haven't defended your assumptions adequately.

mdh
05-06-2008, 08:53 PM
Nope. I played around with VM some. I dislike Micro$oft business practices and stopped using their crap a couple years ago.

I prefer to support those that show me respect.

Uhh... VMS has nothing to do with microsoft. :p

It just happens to use .exe as a file name ending for executables...

mdh
05-06-2008, 08:59 PM
You assume plenty.

For instance, you assume they aren't being provided enough information to log into a user account on the machine by co-workers, roomates, etc, etc., or that the machine wasn't already logged in when they proceed to use this time saving tool.

for memory to be at all useful, the machine had to be running - hence the concern for turning off the machine and relocating it. So while you claim a backdoor must exist to access this memory, I see how the computer is likely already vulnerable - thus the desire to see the memory inside.

OK, let's imagine that no social engineering took place (nowhere in the article mentioned anything of that nature whatsoever, so you're really just grasping at straws with the idea anyways, as it has no real relevance in the context of this discussion based on the article I referenced in the original post) beforehand, and that the user *is* logged in to the system. So what? The tool still shouldn't be able to access all of the system's memory even if the user is logged in!
Either there's a back door enabling it to do that, at the kernel level, or... microsoft allows any execution thread run by any user to access the entirety of the system's memory?
Now, the latter could be the case, and feel free to put this to rest by simply saying so, if indeed it is... but that's a pretty assinine model to begin with, at that point, and an even greater argument for dumping that OS than the existence of such back doors.


The article does not lend itself to a logical conclusion - only assumptions.

I'm not sure what you are asking for, and you obviously haven't defended your assumptions adequately.

Your tirade of straw men is quite silly. If you don't see what my question is, I suggest you browse the thread until you find it. If you're having trouble, you may specifically wish to look within the context of posts by me in this thread.

The article lends itself to logical conclusions just fine. If you can't reach them, maybe you're lacking in logic.

pcosmar
05-06-2008, 09:27 PM
Uhh... VMS has nothing to do with microsoft. :p

It just happens to use .exe as a file name ending for executables...

OOps,
I was thinking of the Vitural Machine Server. I had used it but have no real need. I am on my Laptop most of the time. ("Honey" is on the house box, playing games).
VMS, btw, can be many things.
Voice Mail System
Visual Memory System
Virtual Memory System
Vessel monitoring system
Variable-message sign,etc

I am now guessing you mean OpenVMS.

The only .exe on my system is in wine.

mdh
05-06-2008, 09:36 PM
OOps,
I was thinking of the Vitural Machine Server. I had used it but have no real need. I am on my Laptop most of the time. ("Honey" is on the house box, playing games).
VMS, btw, can be many things.
Voice Mail System
Visual Memory System
Virtual Memory System
Vessel monitoring system
Variable-message sign,etc

I am now guessing you mean OpenVMS.

The only .exe on my system is in wine.

I have wine installed as well, but never really used it. Actually, I also have mono which sometimes uses .exe filenames as well for C# apps that mcs compiles.

Doktor_Jeep
05-06-2008, 09:42 PM
The device is like a portable rootkit. Nothing more.

If you use encryption like Blowfish, or IDEA and use the ENTIRE KEY, not some 4 letter password that cane be brute-force hacked in 10 minutes, they will need a supercomputer to crack it.

But I suspect this is more for sneek and peek no-warrant jobs. If they take your computer into a forensics, they will deploy a digital throw-down gun anyway if they don't find anything.

A throw-down gun is what cops keep in their cruisers for "throwing down" near the bodies of people they murder, be it an accidental shooting or a hit job. A digital throw down gun is usually kiddy porn. If they get your computer at all for any length of time, they will simply say they decrypted your drive and found kiddy porn.

I know of only one case where that DID NOT work. But many more rot in jail for this.

What, did you think your government followed rules? I am surprised they even bother with this hack device.

Conza88
05-06-2008, 09:52 PM
Thanks for the help guys, much appreciated :rolleyes:

mdh
05-06-2008, 09:58 PM
If you use encryption like Blowfish, or IDEA and use the ENTIRE KEY, not some 4 letter password that cane be brute-force hacked in 10 minutes, they will need a supercomputer to crack it.

Errrr. I've never seen software that uses the passphrase as the key. You hash the passphrase out to the key, if you're using a passphrase at all.

Also, IDEA is no longer considered to be even of good quality and has patent restriction issues. Blowfish is still pretty good, but Twofish supercedes it, so if you're going to use Blowfish, just use Twofish instead if at all possible. My advice is to encrypt twice, once with either AES or Camellia, and the second time with Blowfish or (preferably) Twofish. It does annoy me that OpenSSL lacks Twofish.


But I suspect this is more for sneek and peek no-warrant jobs.

Hahah... I agree with the part quoted above, though.

ARealConservative
05-06-2008, 10:54 PM
Your tirade of straw men is quite silly. If you don't see what my question is, I suggest you browse the thread until you find it. If you're having trouble, you may specifically wish to look within the context of posts by me in this thread.

Your question was answered again and again.

What has not been demonstrated, is the proof you claim in the subject title.

And the term straw man has an actual meaning - not the one you use to flail wildly around when someone actually takes a minute to question your hyberbole and sensationalism.


The article lends itself to logical conclusions just fine. If you can't reach them, maybe you're lacking in logic.

:rolleyes:

I think I've wasted enough of my time on this nonsense.

Conza88
05-06-2008, 11:02 PM
http://i22.photobucket.com/albums/b346/a429MySpace/Funny/Comments/thanks-for-nothing.jpg

:confused:

mdh
05-06-2008, 11:10 PM
Your question was answered again and again.

Really? What was your answer to my question other than to attack how I came to my conclusions rather than the conclusions themselves? You're the only one here questioning my methods for coming to the conclusions I have, and you simply have been either unwilling or, more likely unable, to refute the conclusions in any manner so you simply make statements like that I am assuming things when clearly I am simply drawing logical conclusions based on facts as they are reported.


What has not been demonstrated, is the proof you claim in the subject title.

Oh, or maybe you simply haven't read the article at all? I'm not sure how something so simple escapes you. :rolleyes:


And the term straw man has an actual meaning - not the one you use to flail wildly around when someone actually takes a minute to question your hyberbole and sensationalism.

And here we go again with you criticizing my methods, etc, rather than actually discussing my conclusions on some sort of intellectual foundation. Listen, if you're incapable of arguing on that level, don't be ashamed to just admit as much. The vast majority of people are not technical to that degree, and it's not something to be ashamed of! I do ask that you stop with the silliness, though, as your statements only serve to confuse others who don't understand these complex topics. My original point is very much valid, and needs to be taken seriously by security-concious computer users reading this forum.

ARealConservative
05-06-2008, 11:30 PM
Really? What was your answer to my question other than to attack how I came to my conclusions rather than the conclusions themselves?

The best way to attack your conclusions is to point out the flaws in reaching them.

how does the tool obtain administrator level access?

The article never claims the tool can always obtain memory access all. It claims to be a tool that makes a previously tedious job, much faster. Anything else you suggest requires a ton of speculation.



You're the only one here questioning my methods for coming to the conclusions I have, and you simply have been either unwilling or, more likely unable, to refute the conclusions in any manner so you simply make statements like that I am assuming things when clearly I am simply drawing logical conclusions based on facts as they are reported.

Your conclusion is actually quite illogical.

Creating a back door into a product and allow the hack to leak onto the market voluntarily is about as illogical of a business decision as I can think of. It would ruin any tech company.

And since you offer no proof, I think it's safe to say your ideas aren't credible.

Maybe get back to us with some evidence first - an article about magic isn't going to cut it.

Conza88
05-06-2008, 11:59 PM
http://kairosnews.org/files/Ilikewherethis.jpg

Conza88
05-07-2008, 12:00 AM
http://cache.bordom.net/images/ba1c8cf1553955352def95c659544c9d.png

LMFAO :D

mdh
05-07-2008, 12:50 AM
The article never claims the tool can always obtain memory access all.

Oh? Why else would it make the statement I've previously quoted then? Are you claiming that storage media contents are lost when a system is powered off now? :p

mdh
05-07-2008, 12:52 AM
Creating a back door into a product and allow the hack to leak onto the market voluntarily is about as illogical of a business decision as I can think of.

What are you talking about? No one has claimed that Microsoft allowed the hack to leak onto the market, voluntarily or otherwise. Someone I spoke to even mentioned that he checked torrent sites, etc, and couldn't find it, so it's probably safe to assume that it has not been leaked at this time. That said, it probably will sooner or later, but I seriously doubt Microsoft would wish that or "allow it voluntarily".

Please don't put words in my mouth. Thanks.

Conza88
05-07-2008, 01:07 AM
http://www.geekologie.com/2007/10/04/microsoft-sign.jpg

But yea, back to my question.. anyone able to help?

mdh
05-07-2008, 01:32 AM
I have a 100g portable harddrive.. which I store music, dvd's, files etc.. can I true crypt that?
Also how easy is it to use? is there a danger, I'll screw everything up and delete all the files / corrupt them?
is there an easy user interface, or do I need some above average tech skills?

Not sure about truecrypt's interface, I just use openssl on the command line for file encryption... but yes, if you somehow lose or forget the key or the passphrase from which the key is derived, you will have effectively lost your data. There's no simple recovery from strong encryption.

Conza88
05-07-2008, 01:43 AM
Not sure about truecrypt's interface, I just use openssl on the command line for file encryption... but yes, if you somehow lose or forget the key or the passphrase from which the key is derived, you will have effectively lost your data. There's no simple recovery from strong encryption.

Thanks.. Openssl? LoL. Does anyone know if its easy to setup?
Or if the chances of my computer... never getting 'breached' are pretty high, should I bother? Cheers:)

mdh
05-07-2008, 02:17 AM
Why don't you download truecrypt and try it on some empty or bs files or whatever to learn the interface? OpenSSL is not used-friendly.

Conza88
05-07-2008, 02:39 AM
Why don't you download truecrypt and try it on some empty or bs files or whatever to learn the interface? OpenSSL is not used-friendly.

True! I have a 128mb usb key.. I should have thought of that. Ok, will tell how it goes... :) Thanks

freelance
05-07-2008, 05:38 AM
No, the article doesn't give away their secrets. I never said it did. I read several articles that day, and I can't find the others right now. One other thing that it said was that if the contents were encrypted, you didn't get to leave. I like the idea of a hidden encryption that they can't "see," but I still like the idea of uploading whatever important data you need and accessing it remotely and then wiping it. They are looking for trade secrets and lawyer/client information. How do you think that big corporations get so big?

ARealConservative
05-07-2008, 06:47 AM
What are you talking about? No one has claimed that Microsoft allowed the hack to leak onto the market, voluntarily or otherwise. Someone I spoke to even mentioned that he checked torrent sites, etc, and couldn't find it, so it's probably safe to assume that it has not been leaked at this time. That said, it probably will sooner or later, but I seriously doubt Microsoft would wish that or "allow it voluntarily".

Please don't put words in my mouth. Thanks.

The entire premise of your rant is that this is a back door hack that is now being distributed on a thumb drive.

It is moronic to claim microsoft would willingly distribute such a thing, yet that is where we now stand.....................

Conza88
05-07-2008, 06:53 AM
The entire premise of your rant is that this is a back door hack that is now being distributed on a thumb drive.

It is moronic to claim microsoft would willingly distribute such a thing, yet that is where we now stand.....................

Do you know what Fascism is?
Do you think America is already Fascist or getting there / heading in the general direction?
Do you know the guy that coined the term, later said it was better termed as Corporatism.
The thing described here is pretty much Corporatism / Fascism.

Now if you reject the notion America is heading towards fascism... I think THATS moronic. However, should you conceive that it is - then this shouldn't be any surprise to you. Yet that is where we now stand.....................

pcosmar
05-07-2008, 06:56 AM
No, the article doesn't give away their secrets. I never said it did. I read several articles that day, and I can't find the others right now. One other thing that it said was that if the contents were encrypted, you didn't get to leave. I like the idea of a hidden encryption that they can't "see," but I still like the idea of uploading whatever important data you need and accessing it remotely and then wiping it. They are looking for trade secrets and lawyer/client information. How do you think that big corporations get so big?

If you can access it remotely then someone else could access it remotely.

Though I am not all that paranoid, I am security conscious. I keep track of what my computer is doing. That is one reason I switched to Linux. It gives me full access and complete control over my computer.

I had heard of TrueCrypt a while ago, but had never installed it.
This thread has caused me to look into it as one more handy tool in my box.
I installed it, and it seems fairly user friendly. The 'Wizard" helps with the set-up. I am still reading the information on their site.
http://www.truecrypt.org/

As to whether there are backdoors in windows. When I used it ( and tried to secure it) it kept trying to make connections WITHOUT my permission. Call it what you will.
Read the EULA,
http://www.microsoft.com/windowsxp/home/eula.mspx
http://www.securityfocus.com/columnists/420
YOU DON"T OWN YOUR SYSTEM

This is reason enough for me.

Conza88
05-07-2008, 07:06 AM
Q: What is the maximum possible size of a TrueCrypt volume?

A: The maximum possible size of a TrueCrypt volume is 8589934592 GB. However, due to security reasons, the maximum allowed volume size is 1 PB (1,048,576 GB), as the amount of data that is considered secure to be encrypted using a single key depends, among other factors, on the block size of the encryption algorithm. In addition, you need to take into account other limiting factors. For instance, file system constraints, limitations of the hardware connection standard and of the operating system, etc.

I'm above the maximum :(

pcosmar
05-07-2008, 07:17 AM
The entire premise of your rant is that this is a back door hack that is now being distributed on a thumb drive.

It is moronic to claim microsoft would willingly distribute such a thing, yet that is where we now stand.....................

Whether it is a "Back door" or a "handy hacker kit" is not relevant. That is semantics.
That they produced this tool is one more reason NOT to give them my business.

More on this.
http://www.betanews.com/article/Microsoft_slowly_seals_its_lips_about_its_police_t oolkit/1210007124

pcosmar
05-07-2008, 07:19 AM
[b]

I'm above the maximum :(

Really?
Kewl. :D

Got pic's?

Conza88
05-07-2008, 07:27 AM
Really?
Kewl. :D

Got pic's?

Hehe, was kiddin around. Only the NSA would have that much? err right? lol.
I have got tcrypt sorted so far. :D

DealzOnWheelz
05-07-2008, 07:35 AM
just out of curiousity would a degousing loop built into your front and back door frame erase any thing they download onto the flash drive when they walk through it??

If so then everyone should build one into their door frame

JUST IN CASE YA KNOW

ARealConservative
05-07-2008, 08:52 AM
Do you know what Fascism is?
Do you think America is already Fascist or getting there / heading in the general direction?
Do you know the guy that coined the term, later said it was better termed as Corporatism.
The thing described here is pretty much Corporatism / Fascism.

Now if you reject the notion America is heading towards fascism... I think THATS moronic. However, should you conceive that it is - then this shouldn't be any surprise to you. Yet that is where we now stand.....................

There is no way to say this without sounding condescending – but I don’t see how I would benefit at all from a dialog with you so I won’t be wasting my time.

PeterWellington
05-07-2008, 12:49 PM
Assuming all of this were true, why are some of you blaming Microsoft? Have you seen how different governments have gone after them throughout the years for perfectly acceptable business practices (if you believe in a free market)? Do you think this is something they would really want to do with their OS? How would they profit at all from this? Ah, maybe it makes more sense that they faced a threat of more legal trouble if they didn't "voluntarily" comply with the government.

FrankRep
05-07-2008, 12:52 PM
Did Apple fall to the same pressure yet? I may just become a MAC user.

mdh
05-07-2008, 01:51 PM
The entire premise of your rant is that this is a back door hack that is now being distributed on a thumb drive.

It is moronic to claim microsoft would willingly distribute such a thing, yet that is where we now stand.....................

The entire premise of my warning to our security-minded readers is that Microsoft seems to likely have built in a backdoor in one of their flagship products, the Windows operating system, and distributed the tool which can access it to law enforcement agencies. That is completely different from them giving it to every Tom Dick and Harry, and you know they'd feel justified in such action for the same reason that they include NSA code in Windows Vista, but won't say what it does, or where in the kernel it hooks into! That last bit is a proven, indisputable fact, which Microsoft's top brass has admitted to.

I firmly believe that it is moronic to claim that they would not, given the existing track record.

But of course, since Microsoft does not open their entire codebase to peer review, no one can really know exactly what lurks in it. The simple fact is that it could include any number of things, and you no one here can prove either way.


Assuming all of this were true, why are some of you blaming Microsoft? Have you seen how different governments have gone after them throughout the years for perfectly acceptable business practices (if you believe in a free market)? Do you think this is something they would really want to do with their OS? How would they profit at all from this? Ah, maybe it makes more sense that they faced a threat of more legal trouble if they didn't "voluntarily" comply with the government.

Who knows? The fact is though that people need to consider themselves warned about yet another intentional outstanding issue in the Windows codebase, as if the unspecified code from the US National Security Agency wasn't enough already.


There is no way to say this without sounding condescending – but I don’t see how I would benefit at all from a dialog with you so I won’t be wasting my time.

Such an intellectual response.


Did Apple fall to the same pressure yet? I may just become a MAC user.

Again, no one can really say, since Apple won't open the entirety of their codebase to peer review. Macs are still overpriced though. :p

pcosmar
05-07-2008, 02:12 PM
Assuming all of this were true, why are some of you blaming Microsoft? Have you seen how different governments have gone after them throughout the years for perfectly acceptable business practices (if you believe in a free market)? Do you think this is something they would really want to do with their OS? How would they profit at all from this? Ah, maybe it makes more sense that they faced a threat of more legal trouble if they didn't "voluntarily" comply with the government.

First, I don't "blame' Micro$oft for anything but their business practice, which I despise.

Yes I have seen other governments "go after"them for breaking monopoly laws. They have been found in violation of the laws of several countries including this one.
http://www.usdoj.gov/atr/cases/f3800/msjudgex.htm
http://www.usdoj.gov/atr/cases/f3800/msjudgex.htm#findings

411. Many of the tactics that Microsoft has employed have also harmed consumers indirectly by unjustifiably distorting competition. The actions that Microsoft took against Navigator hobbled a form of innovation that had shown the potential to depress the applications barrier to entry sufficiently to enable other firms to compete effectively against Microsoft in the market for Intel-compatible PC operating systems. That competition would have conduced to consumer choice and nurtured innovation. The campaign against Navigator also retarded widespread acceptance of Sun's Java implementation.

This campaign, together with actions that Microsoft took with the sole purpose of making it difficult for developers to write Java applications with technologies that would allow them to be ported between Windows and other platforms, impeded another form of innovation that bore the potential to diminish the applications barrier to entry. There is insufficient evidence to find that, absent Microsoft's actions, Navigator and Java already would have ignited genuine competition in the market for Intel-compatible PC operating systems. It is clear, however, that Microsoft has retarded, and perhaps altogether extinguished, the process by which these two middleware technologies could have facilitated the introduction of competition into an important market.

412. Most harmful of all is the message that Microsoft's actions have conveyed to every enterprise with the potential to innovate in the computer industry. Through its conduct toward Netscape, IBM, Compaq, Intel, and others, Microsoft has demonstrated that it will use its prodigious market power and immense profits to harm any firm that insists on pursuing initiatives that could intensify competition against one of Microsoft's core products. Microsoft's past success in hurting such companies and stifling innovation deters investment in technologies and businesses that exhibit the potential to threaten Microsoft. The ultimate result is that some innovations that would truly benefit consumers never occur for the sole reason that they do not coincide with Microsoft's self-interest.

And that is just one.

Micro$oft has never shown any respect for the user.
If you think you have any right to privacy while using window$, go read the EULA.

LIMITATION ON REMEDIES; NO CONSEQUENTIAL OR OTHER DAMAGES. Your exclusive remedy for any breach of this Limited Warranty is as set forth below. Except for any refund elected by Microsoft, YOU ARE NOT ENTITLED TO ANY DAMAGES, INCLUDING BUT NOT LIMITED TO CONSEQUENTIAL DAMAGES, if the Software does not meet Microsoft's Limited Warranty

I have two copies that came with computers that I bought, Both are set up dual boot and I use Linux. I retain the copies because I paid for them, but seldom boot them up.
I will keep them in case Micro$oft does somehow gain a complete monopoly.

There are much better systems, They just have great marketing of an inferior system.

freelance
05-07-2008, 02:23 PM
I have to stick my neck out here for mdh. I had a business relationship of sorts with MS for a decade. Nothing that he warned about is beyond the pale. He was simply trying to warn you. I found an article that MAY indicate one way the technology could be used. You've all been warned. What you do with the information is for you to decide.

Yes, MS was involved in an anti-trust lawsuit during the Clinton administration. I can't tell you how many hard drives they subpoenaed during that time. Goodness only knows what the govt. learned from those hard drives. Doesn't anyone here wonder how and why the lawsuit was suddenly dropped?

P.S. You know how we often see debates on this board about whether or not the Mormon religion is a cult? Anyone spent any time on the MS campus?

Disclaimer: This is simply my OPINION, and it doesn't make it true in the literal sense.

ARealConservative
05-07-2008, 02:48 PM
Such an intellectual response.

you wouldn't recognize an actual one.

I've played around in your boy who cried wolf must read thread long enough though. :rolleyes:

mdh
05-07-2008, 02:50 PM
you wouldn't recognize an actual one.

I've played around in your boy who cried wolf must read thread long enough though. :rolleyes:

Someone who obfuscates so much without any facts or substantive arguments must have a horse in this race. How much Microsoft stock do you own, ARC? ;)

PeterWellington
05-07-2008, 03:08 PM
mdh, I hope you didn't think I was saying you were playing the blame game, I have no problem at all with the reasons you started this thread.

pcosmar, If you notice in my post I carefully worded what I said. I never said Microsoft wasn't found guilty of breaking laws. And to be blunt, I don't care if they break certain laws just as I don't care if someone smokes pot. I think we have a lot of terrible laws on the books. What I said was I haven't seen anything (and if you have any evidence to the contrary I'd genuinely appreciate you pointing me to it) that could be deemed as force/fraud, which are really the only "laws" in a free market. People have always had the option of choosing not to use their products.

torchbearer
05-07-2008, 03:31 PM
To be honest, the only reason I use MS is for gaming.
If developers actually made games for linux, i would probably use it.

FOr a straight business machine, I use linux. Ubuntu is the best. The KDE is fun too. Kubuntu.

pcosmar
05-07-2008, 04:24 PM
To be honest, the only reason I use MS is for gaming.
If developers actually made games for linux, i would probably use it.

FOr a straight business machine, I use linux. Ubuntu is the best. The KDE is fun too. Kubuntu.

That seems to be the reason for a lot of people sticking with it.
I am not a big gamer, but I have installed some for my wife.

I have a PopCap game on my laptop, (Zuma) what a time waster there. I am stuck on level 8.
http://www.popcap.com/
I prefer simulations.
I've got FlightGear. a flight sim.
http://www.flightgear.org/
Danger from the Deep a submarine comander.
http://dangerdeep.sourceforge.net/
And Torcs. a race car sim.
http://torcs.sourceforge.net/
http://www.youtube.com/watch?v=un1zKktVm3s

There are a lot of games that can be run on Linux.
http://www.linuxgames.com/

I just prefer to do business with those that respect me, and don't treat me as a criminal.

mdh
05-07-2008, 04:37 PM
There're plenty of console emulators for linux, too. ;)

Conza88
05-07-2008, 07:38 PM
There is no way to say this without sounding condescending – but I don’t see how I would benefit at all from a dialog with you so I won’t be wasting my time.

Aka. "You're so right, I ain't got a comeback" ;)

Thanks! :D Ah well, your loss. :cool: