 |
 |
Expert Says Windows XP Aids Vandals June 4, 2001 - The Internet is sustaining a growing plague of attacks that overwhelm Web sites by flooding them with data, and an Internet security expert is warning Microsoft that the planned consumer rollout of its Windows XP operating system for personal computers could make the global network even more vulnerable. The software, which Microsoft plans to begin selling in the fall, adds some powerful Internet-connection capabilities that the security expert has urged the company to remove before putting the product on the market. The new features, he says, makes server computers more susceptible to a type of Web intrusion known as a distributed denial of service attack, in which attackers remotely commandeer hundreds of personal computers connected to the Internet and use them to release a disabling deluge of data against a specific Web site. Such attacks gained visibility last year when popular commercial Web sites like Amazon, CNN, Yahoo and eBay were briefly knocked out of service by streams of hostile data. The attacks have continued this year, with the victims including Microsoft's corporate Web site and its MSN.com service. And a recent study by the San Diego Supercomputer Center indicates that this method of attack, whose blueprint is readily available in the computer underground, is alarmingly on the rise. The security expert, Steven Gibson, said he feared that widespread use of Windows XP in its current form would create a powerful network communications standard that attackers could widely exploit, particularly as more consumers use high-speed phone lines or cable modems and keep their computers almost continuously connected to the Internet. "Nothing more than the whim of a 13-year-old hacker is required to knock any user, site or server right off of the Internet," said Mr. Gibson, who warned Microsoft after a denial- of-service attack recently disabled his company's Web site for 17 hours. He said the attacker in fact identified himself as a 13-year-old who had decided to cripple the company's site after reading derisive comments about young hackers that he believed Mr. Gibson had made. Microsoft executives responded that they respected Mr. Gibson's opinions but that the network security features of Windows XP were strong enough to deter widespread attacks of the kind he feared. Mr. Gibson, a longtime software designer, heads the Gibson Research Corporation in Laguna Hills, Calif., a publisher of Internet security software. His Web site, grc.com, provides a colorful account of the attack, which began on Friday evening, May 4 and continued into the next day. He said that he and his Internet service provider were finally able to stop the attack by filtering out the malicious packets of data, which they determined were coming from various unsecured Windows-based PC's on the Intenet that the hacker had commandeered without their owners' knowledge. Newer versions of Windows, including Windows 2000, designed for office PC's, and Windows XP have enhanced programming to link computers to the Internet. That software can potentially give mischievous or malicious programmers greater flexibility to send out torrents of fake data streams with false addresses. Mr. Gibson said the identifying characteristics of the data that had enabled him to filter out the packets would be far more difficult to detect in the newer versions of Microsoft's operating systems. "When those insecure and maliciously potent Windows XP machines are mated to high-bandwidth Internet connections," he wrote on his Web site, "we are going to experience an escalation of Internet terrorism the likes of which has never been seen before." Microsoft argues that Mr. Gibson is misplacing the blame. "We had an exchange with him two or three weeks ago," said Steve Lipner, manager of Microsoft's Security Response Center. "We feel he's focused on mechanism rather than effect. The more fundamental issue is whether I can get hostile code running on your machine. If I can't, then there isn't a problem." Mr. Lipner said the enhanced security features also included in the new versions of Windows would make the machines more difficult for attackers to remotely commandeer. Some other security experts questioned whether the remedies Mr. Gibson is seeking from Microsoft would solve the problems. Peter G. Neumann of SRI International, a research firm in Silicon Valley, said that the network vulnerabilities go far deeper than the enhanced communication features of Windows XP. "This is just one more example of how flaky our computer-communication infrastructures are," Mr. Neumann said. He asserted that more robust hardware and software must be designed from the ground up with defense against denial of service and other attacks in mind, instead of dealing with the issues as an afterthought. Few would dispute, however, that there is a growing Internet security threat, particularly as more users have high-speed network connections that encourage them to keep their computers almost continuously online, whether they know it or not. In three weeks of observation in February, researchers at the San Diego Supercomputer Center at the University of California at San Diego, recorded nearly 13,000 attacks against 5,000 Web sites. At any one time, there were some 40 attacks under way. The attacks tended to be brief, with 90 percent lasting less than an hour. But 2 percent of the attacks spanned a period of days, or even weeks, said the authors of the report. And the researchers noted that they believed their methods probably missed many variants of denial of service attacks, and so the estimates were conservative — perhaps only half of the actual total. "So-called denial of service attacks are a growing problem, and are particularly difficult to fight," said Stefan R. Savage, an author of the report and professor of computer science at the University of California at San Diego. "It undoubtedly has grown," he said. "Nobody had heard of denial of service attacks three or four years ago." A distributed denial of service attack involves a network intruder's breaking into a wide number of machines connected to the Internet and then directing them to send streams of data packets at a target computer. The owners of the hostage computers most likely will not know that their machines are being subverted. Such an attack floods the target system with millions or even billions of messages that tie up its resources, keeping legitimate users from gaining access to the site. Strategies for countering such attacks are limited, Mr. Savage said. He said he was skeptical about the proposed Microsoft approach, which involves improving Internet security and its many machines worldwide to prevent their being used as zombies. "Ultimately, I'm pessimistic about that approach," he said. "There are hundreds of millions of machines out there, and getting everyone to secure them is a hopeless task." Another approach involves automating the steps that Mr. Gibson took during the May 4 attack: figuring out which incoming packets of data are linked to the attack and filtering them out. That approach is being tried by a company Mr. Savage co-founded, Asta Networks, and also by companies like Mazu Networks in Cambridge, Mass. But those approaches succeed or fail on the quality of the filter used to distinguish the digital babies from the bath water, and Mr. Savage described it as a daunting task. "Unfortunately, there's nothing in these packets that says, `Hi, I'm a bad packet.' " By JOHN MARKOFF and JOHN SCHWARTZ Copyright 2001 The New York Times Company http://www.nytimes.com/2001/06/04/technology/04FLAW.html?pagewanted=print janet paterson: an akinetic rigid subtype, albeit perky, parky . pd: 54/41/37 cd: 54/44/43 tel: 613 256 8340 email: [log in to unmask] . snail mail: 375 Country Street, Apt 301, Almonte, Ontario, Canada, K0A 1A0 . a new voice: the nnnewsletter: http://groups.yahoo.com/group/janet313/ . a new voice: the wwweb site: http://www.geocities.com/janet313/ . ---------------------------------------------------------------------- To sign-off Parkinsn send a message to: mailto:[log in to unmask] In the body of the message put: signoff parkinsn