Thoughts on Microsoft's Latest Security Bulletin

Microsoft's October 2004 security bulletin was released today. Some of the guys in #snort-gui were shocked that the bulletins ranged from MS04-029 to MS04-038. An astute Slashdot post notes that only one vulnerability, MS04-038, affects Windows XP SP2. The XP SP2 weakness is referred to as the drag-and-drop vulnerability as it allows intruders to install programs through malicious Web pages rendered by Internet Explorer.

This reminds me of a saying that I wish I could attribute to someone: "Q: What's the best security patch for Windows 2000? A: Windows XP." This is more than a joke. I have a difficult time being sympathetic to enterprises that continue to operate Windows NT 4 systems. I am beginning to lose faith in organizations that have no plans to upgrade their servers from Windows 2000 to Windows 2003. Let's remember that Windows NT was released in 1996 and Windows 2000 in the year 2000. An organization relying on an 8 year old Microsoft OS is not showing the proper appreciation for security, given Microsoft's track record.

I tried to imagine a situation where I've seen similarly old operating systems running in the free UNIX world. For comparison, FreeBSD 2.1.5 was released around the same time in 1996 and 4.0 just appeared in mid-2000. While the FreeBSD 4.x tree is just barely still marked STABLE (about to be replaced by the 5.x tree), I know of no one running FreeBSD 2.x or 3.x. For my Linux friends, the helpful Red Hat history site shows Red Hat 4.0 appearing in late 1996 and 7.0 in late 2000. While I know of no one running Red Hat 4.x, some people continue to run 7.0 (and should migrate probably migrate to 9.0, at least).

On the commerical UNIX side (ignoring Red Hat Linux), consider Solaris. This history shows 1996 as the year of Solaris 2.5.1 and 2000 as the year of Solaris 8. I imagine many organizations still run Solaris 2.6 and 7, and haven't given much thought to 8, 9, or the upcoming Solaris 10. The Solaris release page shows 2.5.1 is in the very last stages of support, while newer versions get better treatment.

Running an OS that can be kept current is one of the characteristics of what I call a defensible network in The Tao of Network Security Monitoring. A look at the Product Lifecycle Dates - Windows Product Family shows Windows NT 4 "extended support" will be "retired" on 31 Dec 2004. "Mainstream" support for Windows 2000 ends 30 Jun 2005 with extended support expiring 30 Jun 2010. According to Microsoft's Lifecycle Policy FAQ:

"Mainstream support includes all the support options and programs that customers receive today, such as no-charge incident support, paid incident support, support that is charged on an hourly basis, support for warranty claims, and hotfix support. After mainstream support ends, extended support will be offered for Business and Development software.

Extended support includes all paid support options and security-related hotfix support that is provided at no charge. Hotfix support that is not security-related requires a separate extended hotfix support contract to be purchased within 90 days after mainstream support ends. Microsoft will not accept requests for warranty support, design changes, or new features during the extended support phase."

I find it hard to believe Microsoft will extend security-related hotfixes for Windows 2000 for another five years. We've already seen concerns that security features introduced in XP SP2 will not appear in older versions of IE, despite Microsoft's spin of the issue. I expect to see more security enhancements to mainline Windows releases like XP and its successors, without concern for older versions of Windows, wherever Microsoft can get away with it.

If you're looking for a way to deploy Windows XP with SP2 integrated, check out AutoStreamer. It's a GUI which makes creating a custom .iso of Windows XP with SP2 very easy. I tested it this weekend and deployed Windows XP with SP2 on a new system without any problems. My deployment provided AutoStreamer with a Windows XP CD-ROM, a copy of xpsp2.exe obtained via CD-ROM from Microsoft, and plenty of hard drive space on an existing Windows system. When I was done I burned the new .iso to CD and used it to install Windows XP.

Comments

Anonymous said…
Certainly best patch for Windows 2000 - Windows XP :)
6:06 AM
Post a Comment

Popular posts from this blog

Zeek in Action Videos

Image
This is a quick note to point blog readers to my Zeek in Action YouTube video series for the Zeek network security monitoring project .  Each video addresses a topic that I think might be of interest to people trying to understand their network using Zeek and adjacent tools and approaches, like Suricata, Wireshark, and so on.  I am especially pleased with Video 6 on monitoring wireless networks . It took me several weeks to research material for this video. I had to buy new hardware and experiment with a Linux distro that I had not used before -- Parrot .  Please like and subscribe, and let me know if there is a topic you think might make a good video.
Read more

MITRE ATT&CK Tactics Are Not Tactics

Image
Just what are "tactics"? Introduction MITRE ATT&CK  is a great resource, but something about it has bothered me since I first heard about it several years ago. It's a minor point, but I wanted to document it in case it confuses anyone else. The MITRE ATT&CK Design and Philosophy document from March 2020 says the following: At a high-level, ATT&CK is a behavioral model that consists of the following core components: • Tactics, denoting short-term, tactical adversary goals during an attack; • Techniques, describing the means by which adversaries achieve tactical goals; • Sub-techniques, describing more specific means by which adversaries achieve tactical goals at a lower level than techniques; and • Documented adversary usage of techniques, their procedures, and other metadata. My concern is with MITRE's definition of "tactics" as "short-term, tactical adversary goals during an attack," which is oddly recursive. The key word in the tacti...
Read more

New Book! The Best of TaoSecurity Blog, Volume 4

Image
  I've completed the TaoSecurity Blog book series . The new book is  The Best of TaoSecurity Blog, Volume 4: Beyond the Blog with Articles, Testimony, and Scholarship .  It's available now for Kindle , and I'm working on the print edition.  I'm running a 50% off promo on Volumes 1-3 on Kindle through midnight 20 April. Take advantage before the prices go back up. I described the new title thus: Go beyond TaoSecurity Blog with this new volume from author Richard Bejtlich. In the first three volumes of the series, Mr. Bejtlich selected and republished the very best entries from 18 years of writing and over 18 million blog views, along with commentaries and additional material.  In this title, Mr. Bejtlich collects material that has not been published elsewhere, including articles that are no longer available or are stored in assorted digital or physical archives. Volume 4 offers early white papers that Mr. Bejtlich wrote as a network defender, either for technica...
Read more