Jump to content

Welcome to MSFN Forum
Register now to gain access to all of our features. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more. This message will be removed once you have signed in.
Login to Account Create an Account


Photo

Are MS Updates for XP really necessary?

- - - - -

  • Please log in to reply
92 replies to this topic

#51
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,212 posts
  • OS:none specified
  • Country: Country Flag

Any logical view of operating system security should show that Windows XP is less secure than 8.

I liked much better the :

/GS is a stack canary that is heuristically attached to functions on compile time.

 

 :w00t:  as an argument to support an opinion.

 

What would be interesting (and this is easily doable, it's only a matter of spending some time) is to see how many of MS patches (which BTW are the actual topic) are issued at the same time for the following Operating Systems:

  • Windows XP
  • Windows Vista
  • Windows 7
  • Windows 8

my memory is quickly  fading, but I seem to remember that usually whenever a vulnerability has been found (and a related patch is issued by MS) the patch is most of the times for ALL of the above OS versions (or more loosely "supported OS versions of the NT family"), I don't remember as "common" that a patch is ONLY for the oldish XP (or ONLY for a given system) :unsure: and NOT for a later OS.

Ideally one could list each month Security bullettin summary, here is an example of the latest:

http://technet.micro...lletin/ms13-jul

and check, bullettin by bullettin, which OS's are affected and for which a patch is issued, example:

https://technet.micr...lletin/ms13-053

seems like a "serious" issue and "hitting" any and all OS's in the above list.

I did a quick check and it seems to me like the patches are for ALL the mentined OS's, exception made for this one, that only affects Windows 7 and Server2008 R2 (and NOT XP and NOT 8)

https://technet.micr...lletin/ms13-058

 

By this tentative metrics, XP and Vista and 8 are seemingly on the same level, whilst 7 (and Server2008 R2) are slightly less secure.

 

jaclaz




How to remove advertisement from MSFN

#52
G8YMW

G8YMW

    Member

  • Member
  • PipPip
  • 111 posts
  • OS:XP Pro x86
  • Country: Country Flag

Charlotte's view is "Why let the problems get that far?"

I look at it like this.

Football (Soccer) match. Who would field a team comprising of only the goalkeeper?

8 might be more secure than XP but XP is tried, tested and above all understood.

I have XP, 7 and 98SE on this machine, I would be still using 98 if my motherboard hadn't gone down about 3 years ago.

 

BTW I have no intention of putting Win8 on this machine. I just dont like the look of it



#53
CharlotteTheHarlot

CharlotteTheHarlot

    MSFN Master

  • Member
  • PipPipPipPipPipPipPipPip
  • 2,054 posts
  • OS:none specified
  • Country: Country Flag

You're both right, and you're both wrong. Neither of you mention UPnP, which allows a router to open ports when requested LAN-side by an application. It should be disabled by default for tighter security "out of the box," but some manufacturers may not follow this philosophy for the sake of "ease of use."


You're right, I didn't mention it here, but I have been railing about it in some other comments with respect to the next wave of hip gadgets, cheap home consumer security devices. The way they are shaping up with automagic configuration to allow these cameras and mics to work will lead to a big problem with neutered security. uPnP, will rise from the grave again.

But in these discussions I almost always mention a "properly configured router" when I bring this up. The user should immediately do some thorough research about the specific brand and firmware and look for forum discussions by sharp commenters that go through and explain all the settings and stuff. Routers I have seen are usually pretty good with defaults after a reset or flashing, but yes there always is some tweaking to be done.

So again ... yes, by all means disable uPnP in the router and the service in Windows. Mine obviously is.
 
EDIT: slimmed down the quote

Edited by CharlotteTheHarlot, 02 August 2013 - 06:47 AM.

... Let him who hath understanding reckon the Number Of The Beast ...


#54
CharlotteTheHarlot

CharlotteTheHarlot

    MSFN Master

  • Member
  • PipPipPipPipPipPipPipPip
  • 2,054 posts
  • OS:none specified
  • Country: Country Flag

One really good example of this is the recent hack of Ubuntuforums.org. That's a "good" website, but for 6 days it was controlled by an attacker. In that time he could have easily put up an exploit page, and no "common sense" would have saved anyone - I'm a security professional and I visit that website, so do many others.


From what I read, both that site and the one at PC Gamer never mentioned any driveby attacks, just compromised stored data and credentials. I'll try to read more about it when I get a chance but it sounds like you are putting it forward as evidence for your security opinions. I don't recall browsers, or Windows itself for that matter being part of the story. Are you asserting that some people browsed to the site and got hosed? Were they attacked successfully without any affirmative user acceptance clicking? If this actually happened, what Browsers, OS, AntiVirus and Router were the victims using? These are significant details I have not heard. You wanna bet that they were much closer to the earlier mentioned scenario #1 than scenario #2?
 
 

Well first of all your router must be screwed up, becuase you should definitely be able to torrent without opening ports on the router.
 
Packets are definitely not just tossed. You're reading this webpage right now, aren't you? That means that, somehow, someone is sending you data to your computer. That's all an attacker needs. They can MITM your connection, hack the website, send you a link, etc. Once you get to an area where they control the content (like opening an email from them) they can attack you. That's all it takes.


I can assure you that my router is anything but screwed up. In fact, "screwed up" is the absolute last description that comes to mind when discussing a hardware firewall that requires manual intervention to open ports 688x in order to use a torrent! That opt-in necessity of forwarding those ports is the whole point here. The alternative which you are describing is a "smarter" router ( I would call it dumber ) that does it automatically. We are clearly approaching the concept of "normal" from two different places.

Packets are definitely tossed. Do you think they are stored somewhere instead?
 
And of course not all packets are tossed. ~sigh~ You must know what ports are open, so I just can't understand this strange statement: "You're reading this webpage right now, aren't you?".

 

Like I said, Windows 8 is better off. Although your 8 services are exposed more directly, getting into the XP box is not going to be hindered much. Of course, I wouldn't recommend either - you should be behind NAT, becuase you don't want to be exposed. But NAT isn't going to make up for an operating system full of holes. MSE isn't relevant, AV is stupid and anyone can bypass it completely.
 
In terms of performance there's a lot more to it than services running. On modern hardware 7/8 will run faster than XP depending on the task. But the reason I'm avoiding discussing performance is because it changes depending on the hardware - an old system will run XP faster than 7, a new one will run 7 faster than XP. That's just how it is.

 
Yep, I can see we're definitely coming at this from two entirely different places.

There is often a huge error made, in fact most of the time, when people "compare" their new OS with a fresh new empty registry and profile against their previous OS dripping with Windows rot and come to the stunning conclusion that the new one runs faster. Unfortunately they are always misled. We have even seen the ludicrous bootup comparisons comparing a shutdown 7 versus a hybrid 8. Control for variables and it's an entirely different story.

The only way that Windows XP, or for that matter any version of Windows is ever faster than it's predecessor is when the latter is new, tweaked and optimized by user configuration and the earlier one is left rotted with all the bells and whistles running, especially disk indexing and other CPU hogging tasks. Microsoft has never ever slimmed down an OS's realtime components going forwards ( pushing services into delay load does not count! ).

Anyway, this is way off topic for this thread but I have to believe that between this comment about performance and some of the router comments that you are not particularly concerned with details, scientifically controlled experiments, and accurate comparisons.

 

The point is, as it has been, that given the same network setup, given the same user, given all things being the same, it is much easier to get into an XP box than 8.x. And it is trivial when the user doesn't patch.


I'm sorry but that is pure evidence-free, wishful thinking. And there's that magic patch again. What is it that Windows update does to Windows XP that makes it secure instead of "trivial" to get in to? I think I know why you are not specifying that, it's because the likely answer is probably some of the MSIE buffer overflow and HTML flaws, and ActiveX registry shims. Sheeple food.

Meanwhile I'll continue along happily in scenario #2.

P.S. I always forget to mention this ( as I did above ), but if you want better to security, in addition to using a different browser than MSIE it is critically important to change the "default" to something else so that you "patch" a hugely stoopid bug / feature of Windows. The bug? Having Windows pop open MSIE because you hit F1 help and suddenly you get sent online to a non-existent webpage and then shuffled over to Bing or Google or your ISP's DNS resolution page already aiming at potentially dangerous links. MSIE, in my opinion should only be used for one thing - Windows Update, when you really need it. MSIE should only be used on purpose, never by accident.

 


... Let him who hath understanding reckon the Number Of The Beast ...


#55
enxz

enxz

    Newbie

  • Member
  • 41 posts
  • OS:Windows 8 x64
  • Country: Country Flag

@The Finder,

 

 

my memory is quickly  fading, but I seem to remember that usually whenever a vulnerability has been found (and a related patch is issued by MS) the patch is most of the times for ALL of the above OS versions (or more loosely "supported OS versions of the NT family"), I don't remember as "common" that a patch is ONLY for the oldish XP (or ONLY for a given system) :unsure: and NOT for a later OS.

Yes, a vulnerability in XP code that's used in vista, 7, and 8, would work on all of them potentially. So they all have to be patched. But exploiting that vulnerability is a whole other story on newer operating systems thanks to the mitigation techniques I've mentioned.

 

So while all of them could have the same number of vulnerabilities (or newer ones could even have more) exploitation of those vulnerabilities can range from significantly more difficult to impossible - stack overflows, for example, are going to be much more difficult to exploit on 8.

 

 

@CharlotteTheHarlotte,

 

 

From what I read, both that site and the one at PC Gamer never mentioned any driveby attacks, just compromised stored data and credentials. I'll try to read more about it when I get a chance but it sounds like you are putting it forward as evidence for your security opinions. I don't recall browsers, or Windows itself for that matter being part of the story. Are you asserting that some people browsed to the site and got hosed? Were they attacked successfully without any affirmative user acceptance clicking? If this actually happened, what Browsers, OS, AntiVirus and Router were the victims using? These are significant details I have not heard. You wanna bet that they were much closer to the earlier mentioned scenario #1 than scenario #2?

I wasn't clear, I'm not saying that a driveby attack was used. I'm saying that a legitimate website was compromised and an attacker had control of the website for 6 days. In that time the attacker could easily have put up an exploit page, and any person who visited would have been subjected to it - router or not. That is how typical attacks work, they don't care about routers.

 

 

And of course not all packets are tossed. ~sigh~ You must know what ports are open, so I just can't understand this strange statement: "You're reading this webpage right now, aren't you?".

I'm sayin this because the router isn't relevant to security anymore. If you're running a browser that's all the attack surface necessary.

 

In terms of performance stuff, I'm not really interested in discussing it. It's not what I came here to talk about, and it's not important to security.

 

 

 

I'm sorry but that is pure evidence-free, wishful thinking.

Except I've posted multiple times now about mitigation techniques that make attacks harder.

 

https://blogs.techne...Redirected=true

 

http://j00ru.vexillium.org/?p=690

 

You can google for more information on the effectiveness of these techniques.

 

 

nd there's that magic patch again. What is it that Windows update does to Windows XP that makes it secure instead of "trivial" to get in to? I think I know why you are not specifying that, it's because the likely answer is probably some of the MSIE buffer overflow and HTML flaws, and ActiveX registry shims. Sheeple food.

It's very simple.

 

I'm an attacker. I want into a system. I see two XP boxes. One of them has an unpatched service running, the other has a patched service running. 

 

I can attack the patched service, but it requires a 0day attack. Or, I can just modify the latest Metasploit for the unpatched service and cut my work by 90%.

 

That's why patching is important.

 

Of course, if I see a Windows 8 box on there, I know I need a 0day, and I need an information leak, and I potentially need a local kernel exploit that itself will potentially require an information leak.

 

It's just math. Vuln + Vuln + Vuln + Vuln > Vuln

 

In the case of Windows update, there are exposed services, media players, linkers, etc. The entire operating system is attack surface, especially the kernel. If you have a local kernel vulnerability and you don't patch it it becomes a matter of googling to get into your system.

 

MSIE is nothing. It's not important - it's a couple million lines of code and you've got hundreds more within the operating system. You can run Google Chrome and it will make little difference, because it's just one kernel exploit to get out of the sandbox. You can look at the latest MWR Labs attack on Chrome to see evidence of this (and that the attack had to be modified for 8 to become reliable).

 

 

Anyway, this is way off topic for this thread but I have to believe that between this comment about performance and some of the router comments that you are not particularly concerned with details, scientifically controlled experiments, and accurate comparisons.

 

What I'm concerned with is principals of security, operating system security, network security, how attacks work, and how we defend against them. It's what I do at school as a computer science and security major, it's what I've been hired to do by defense contractors, it's what I do at competitions where we hack into systems for points, and defend from actual hackers to win. I'm not going to try arguing from authority on the internet, no one has to take me at my word, but if you think that a systems security is defined by menial details of a router I think your perception is way off.


Edited by enxz, 02 August 2013 - 03:13 PM.


#56
dencorso

dencorso

    Adiuvat plus qui nihil obstat

  • Supervisor
  • 5,842 posts
  • OS:98SE
  • Country: Country Flag

Donator

:boring:  /GS is the default for MSVC++ since MSVS .NET 2003... That means it's already used from right before XP SP2 times... :whistle:



#57
enxz

enxz

    Newbie

  • Member
  • 41 posts
  • OS:Windows 8 x64
  • Country: Country Flag

Read the previous PDF on /GS improvements as well as http://j00ru.vexillium.org/?p=690

 

Pre-8 /GS used 1bit of entropy. Pre VS 2012 /GS was used on fewer functions. The new toolchain applied on 8 improves the heuristic application of it, protecting more function returns.

 

/GS and ASLR improvements are just two examples. I use them because they're the easiest to point to. There are many others, many of which are detailed in the links provided.


Edited by enxz, 02 August 2013 - 03:52 PM.


#58
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,212 posts
  • OS:none specified
  • Country: Country Flag

I don't get it. :(

 

If some code can initiate an exploit through a stack overflow, then the code may need to be patched and the OS is vulnerable (and the patch has a very high priority , or "Critical").

If some code can initiate an exploit through a stack overflow BUT *something else* in the OS SURELY prevents stack overflows, then there is NO need to patch anything as the OS is NOT vulnerable, or at least the patch becomes very low priority or "Not Critical".

 

The former is "less secure" than the latter.

 

But while the patch is issued with the same priority level, at least here it means that it is needed on both systems and at the same time and with the same intensity in the minds of those that produce the patch.

 

You are saying that because of the big changes in the way the OS works, a same vulnerability has less chances to be exploited in practice.

 

 

The concept of "probability" of making use of a known vulnerability , which Charlotte The Harlot introduced through the use of "intelligent" and "safe" settings of the setup of the machine is very similar.

A well made setup (and intelligent use of the PC ) lowers the probabilities that an existing vulnerability can be used by a malicious attacker.

 

So, we are into "weighting" the efficiency of the "automatic internal mitigation factors" introduced  in the OS against the efficiency of "manual external mitigation factors" suggested by Charlotte, right?

 

If this is the case, then the only (anyway approximated) meaningful data we can get is statistical and can only be obtained by a test similar to the one dencorso hypothised:

http://www.msfn.org/...-2#entry1046197

 

jaclaz



#59
enxz

enxz

    Newbie

  • Member
  • 41 posts
  • OS:Windows 8 x64
  • Country: Country Flag
If some code can initiate an exploit through a stack overflow, then the code may need to be patched and the OS is vulnerable (and the patch has a very high priority , or "Critical").
If some code can initiate an exploit through a stack overflow BUT *something else* in the OS SURELY prevents stack overflows, then there is NO need to patch anything as the OS is NOT vulnerable, or at least the patch becomes very low priority or "Not Critical".

 

Imagine it like a castle. You have wall after wall. An attacker needs to break through each wall. Windows 8 has a lot of walls, and breaking through them is harder. Windows XP doesn't have many walls and the ones it does have a lot of cracks in them.

 

CVSS CVE scores aren't based on whether it's a stack or heap overflow, or the mitigation techniques available. They're based on potential impact. So even if an attack is mitigated partially or near entirely by a mitigation technique, an overflow in a critical component is still considered critical.

 

Mitigation techniques also don't always prevent an exploit 100%, so a patch is always necessary, especially because an attacker can chain together vulnerabilities. For example, I could get a heap overflow, but DEP would prevent execution of code. I then use ROP, but ASLR prevents the ROP. I then use an information leak to get ROP. Those are separate vulnerabilities being used.

 

You are saying that because of the big changes in the way the OS works, a same vulnerability has less chances to be exploited in practice.

 

I'm saying more work is involved. That's just a fact. If I want shell in a program it is harder to do on Windows 8 for most vulnerabilities. I have to do all of the work I would do on XP and then I would have to expend further energy bypassing the mitigation techniques.

 

 

So, we are into "weighting" the efficiency of the "automatic internal mitigation factors" introduced  in the OS against the efficiency of "manual external mitigation factors" suggested by Charlotte, right?

 

What I'm arguing is that Windows XP is not a secure operating system, that Windows 8+ is a more secure operating system, and that attacking unpatched systems is much easier than attacking patched systems.

 

Saying "Oh, but you can put a router outside an XP box" doesn't really matter. You can do the same with 8. And, on top of that, routers don't add nearly as much security as people seem to think. Neither does being intelligent.

 

Like I pointed out earlier, that test would prove very little. You could just as easily ask 1,000 hackers if it's easier to hack Windows XP or Windows 8 and the vast majority would say "XP, duh". There's a statistic.



#60
dencorso

dencorso

    Adiuvat plus qui nihil obstat

  • Supervisor
  • 5,842 posts
  • OS:98SE
  • Country: Country Flag

Donator

You could just as easily as 1,000 hackers if it's easier to hack Windows XP or Windows 8 and the vast majority would say "XP, duh". There's a statistic.

 

As it's written, the above sentence actually makes no sense. Please do correct and elaborate it.

In any case, if I got right the gist of it, if the vast majority (of hackers? of invaders? of Venusian Incas? of Borg drones?) would say "XP, duh!", that surely *is* an added layer of security XP has, which the newer 7 & 8.x don't.



#61
G8YMW

G8YMW

    Member

  • Member
  • PipPip
  • 111 posts
  • OS:XP Pro x86
  • Country: Country Flag

In my opinion, Win8 is more secure because of its low usage.

If it was a popular OS, I bet the hackers and malware writers would be going after it but being as it is not, the malware writers will be saying "Whats the point?"

Face it  XP has around 37% Yum,Yum

Win7 (I could look it up) around 50%

Vista 5%   If I'm going after 7, take Vista with it

Win8 5.5%   Not worth it



#62
enxz

enxz

    Newbie

  • Member
  • 41 posts
  • OS:Windows 8 x64
  • Country: Country Flag

 

As it's written, the above sentence actually makes no sense. Please do correct and elaborate it.

What doesn't make sense? Ask 1,000 hackers which operating system is easier to hack, they will say XP.

 

I left out the 'k' in 'ask', that's it.

 

I don't know how hackers saying XP is easier to hack is somehow a layer of security.


Edited by enxz, 03 August 2013 - 03:39 PM.


#63
dencorso

dencorso

    Adiuvat plus qui nihil obstat

  • Supervisor
  • 5,842 posts
  • OS:98SE
  • Country: Country Flag

Donator

Sorry, enxz! I'm not a native speaker, and although I usually can fill the gaps one inadvertently leaves on writing, that missing "k" was too much for me. :blushing:
 

I don't know how hackers saying XP is easier to hack is somehow a layer of security.


For those who do it for the kicks (and those use to be the ablest invaders), an easy pwn is of no interest.

#64
enxz

enxz

    Newbie

  • Member
  • 41 posts
  • OS:Windows 8 x64
  • Country: Country Flag

No problem.

 

Most hackers do it for money, not fun. Any hackers I know who do it for fun love the easy ones too, they'll take down a website with SQL injection and have plenty of fun with it. I wouldn't rely on hackers being disinterested in a system because it's too easy to hack as a security measure.



#65
JorgeA

JorgeA

    FORMAT B: /V /S

  • MSFN Sponsor
  • 3,086 posts
  • OS:Vista Home Premium x64
  • Country: Country Flag

Without taking sides in this discussion, I'm wondering what folks think of this report and how it might impact the discussion:

 

Researchers demo new IPv6 attack against Windows 8 PCs

 

Although the team tested in against Windows 8 clients, it would work against any PC that helpfully enables IPv6 support by default, which includes many business and all consumer systems using Windows 7 onwards.

 

--JorgeA


Edited by JorgeA, 03 August 2013 - 10:13 PM.


#66
enxz

enxz

    Newbie

  • Member
  • 41 posts
  • OS:Windows 8 x64
  • Country: Country Flag

Just as some attacks will only work on XP, some will only work on 8. They share a lot of the same code, but some code from XP is removed, some code in 8 is added (a lot I'd bet). It doesn't really change much.



#67
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,212 posts
  • OS:none specified
  • Country: Country Flag

Just as some attacks will only work on XP, some will only work on 8. They share a lot of the same code, but some code from XP is removed, some code in 8 is added (a lot I'd bet). It doesn't really change much.

OK, can we say that specifically, and limited to IPv6 exploits, an OS that DOES NOT have IPv6  is less vulnerable than one that has the IPv6 stack? (while it lasts)

 

I don' t know 1,000 hackers.

it seems like you do.

Maybe you could do a poll among them and present a proper report :unsure: (that would be anyway statistical work, not entirely unlikely  the experiment dencorso suggested, which would have however provided objective data, as opposed to opinions of people that you shouldn't trust by definition).

 

@JorgeA, JFYI:

http://www.zdnet.com...-to-switch/2444

and double flip :w00t::

http://www.zdnet.com...ned-7000003055/

http://ipv6friday.or...ther-with-ipv6/

 

 

jaclaz


Edited by jaclaz, 04 August 2013 - 12:56 AM.


#68
enxz

enxz

    Newbie

  • Member
  • 41 posts
  • OS:Windows 8 x64
  • Country: Country Flag

I don't know 1,000. Closely, maybe a dozen or so who really know how to whip up attacks, definitely more people who at least know how to breach system. Actual blackhats who do illegal attacks, just a few. I have no need to ask them, I was joking with a security researcher about this very conversation earlier, it doesn't really need to be said - they all know that XP is easy to crack. I don't think they'd ever bother having the conversation of whether patches make people more or less secure lol I can't even imagine asking them.

 

You can try not trusting hackers opinions, but that's a bad policy. They often love to talk about security, and they're not going to bother lying, they usually have too much of an ego for that.

 

 

OK, can we say that specifically, and limited to IPv6 exploits, an OS that DOES NOT have IPv6  is less vulnerable than one that has the IPv6 stack? (while it lasts)

Definitely not. You can say that IPv6 provides attack surface, and that's it. IPv6 certainly does not define the security of the operating system.


Edited by enxz, 04 August 2013 - 01:15 AM.


#69
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,212 posts
  • OS:none specified
  • Country: Country Flag

I don't know 1,000. Closely, maybe a dozen or so who really know how to whip up attacks, definitely more people who at least know how to breach system. Actual blackhats who do illegal attacks, just a few. I have no need to ask them, I was joking with a security researcher about this very conversation earlier, it doesn't really need to be said - they all know that XP is easy to crack.

Then, you cannot cite 1,000 as source.
You can cite at the most a dozen (+ a handful), and as said - once excluded the good guys or "ethical hackers" - I would not particularly trust the word of someone that "by trade" and for money deceives people compromising their PC's.
Basing your statements on second-hand opinion expressed by a very limited number of unreliable people is not a particularly convincing way to support a thesis. 
 

Definitely not. You can say that IPv6 provides attack surface, and that's it. IPv6 certainly does not define the security of the operating system.

Ah, well.
I thought that a castle with one less door was more secure when it came at ways of access through doors...

jaclaz



#70
enxz

enxz

    Newbie

  • Member
  • 41 posts
  • OS:Windows 8 x64
  • Country: Country Flag

 

Basing your statements on second-hand opinion expressed by a very limited number of unreliable people is not a particularly convincing way to support a thesis.

Yes, we only have the word of me, a security professional, and various other security professionals and hackers. 

 

 

I thought that a castle with one less door was more secure when it came at ways of access through doors...

Why would IPv6 change the argument? It's an attack vector. I can name attack vectors unique to XP, but that's just listing things. The number of attack vectors isn't enough.

 

If you want proof, you're not getting it. That's how it works. If you want principals of security, those are there, but you're not going to find a 'proof' for something like Kerschoff's principal, or the effectiveness of least privilege. 

 

It's really obvious to anyone who actually breaks into systems that XP is a breeze compared to 8. The security community at large knows this.



#71
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,212 posts
  • OS:none specified
  • Country: Country Flag

 

Basing your statements on second-hand opinion expressed by a very limited number of unreliable people is not a particularly convincing way to support a thesis.

Yes, we only have the word of me, a security professional, and various other security professionals and hackers.

 

Well, no. :no:
We have much less than that. :(
We have your word, and you are merely claiming to be a security professional.
 And we have the reported (by you) opinion by various security professionals and hackers.
 
BTW, being a security professional does not necessarily means that you are infallible.
 
We are now evaluating  a single (i.e. anecdotal) evidence (Charlotte's) against an apodictical one (yours).
 
Neither are in any way worth anything when it comes to support a scientific theory, data may.
 
Your opinion is much respected :), but it remains an opinion.
 
And no, a theory being "popular" does not particularly means it is true, JFYI:
 

Oh, people can come up with statistics to prove anything, Kent. 14% of people know that.

 
If you want some good reference about the matter, you can use this one:
http://www.techradar...ed-1156705#null

Windows 7 is six times more likely to get infected than Windows 8 and Windows XP is 21 times more likely to be exploited.

And of course, 8.1 is much more secure than Windows 8:

But that was still all defensive reactions; for Windows 8.1 Microsoft is going on the offensive with better malware protection, new ways of checking the security certificates web sites rely on - and with a plan to add encryption and biometric security to every PC.


I just got back my crystal ball from the tuning shop :yes: and I can see the similar statement that will be provided in the imminence of the release of Windows 9 :thumbup:.
But I can also see at fast forward Chris Hallum's nose growing in length. :whistle:

Spoiler
 
jaclaz


Edited by jaclaz, 04 August 2013 - 02:15 AM.


#72
enxz

enxz

    Newbie

  • Member
  • 41 posts
  • OS:Windows 8 x64
  • Country: Country Flag

Opinions are all you're going to get in the computer security field. You have papers, but they're typically on the effectiveness of attacks and defenses in specific lab scenarios. There are a million of them. I've linked to a few in this topic alone on the effectiveness of techniques only available or improved in Windows 8. Is this not evidence? I've posted a few papers now.

 

Keep in mind that these techniques are not new. ASLR has been around for over a decade, and has been tested and prodded for that time - it's well worn territory. Same with stack cookies. There are many papers (like the ones posted) detailing how they make things harder.

 

My claims of being a researcher are nothing, I'm not going to post my linkedin or something, and I'd have to update it to reflect work experience anyways. I don't expect anyone to go "Oh, he says he's X therefor I should believe Y". What I'm saying is that these opinions are reflected in the security field - ask someone who hacks systems whether a patch for a vulnerability makes things harder, whether XP is easier to hack than Windows 8, etc. You'll get a similar response.


Edited by enxz, 04 August 2013 - 02:09 AM.


#73
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,212 posts
  • OS:none specified
  • Country: Country Flag
Yeah, sure, the consensus of the people working in the security field is good enough proof.
 
Go back in time.
Around 1630.
Ask all the Astronomers about the earth revolving around the sun.... :ph34r:
 
And here is an opinion on security people:

So LSM stays in. No ifs, buts, maybes or anything else. When I see the security people making sane arguments and agreeing on something, that will change. Quite frankly, I expect hell to freeze over before that happens, and pigs will be nesting in trees. But hey, I can hope.

 
jaclaz

Edited by jaclaz, 04 August 2013 - 02:23 AM.


#74
enxz

enxz

    Newbie

  • Member
  • 41 posts
  • OS:Windows 8 x64
  • Country: Country Flag

Linus is not a security professional. He actually has consistently awful views on security that have caused significant harm to the project. I'm sure his ideas on "security people" are just as warped as his opinions on security (he's called out security professionals who know far more than him on the subject before, and gotten shut down for it- see pwnie awards).

 

Again, I've posted a few papers now. So far no one has responded (except someone mistakenly thought that XP's /GS toolchain was the same as 8's) much, only to me saying that the security community at large agrees with this.

 

The papers contain facts - demonstrable facts. There are many more on the necessity for ASLR. There are many on the SDL that was implemented after XP. I can link you a bunch of them, but then we get to the problem I talked about earlier - they get technical.



#75
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,212 posts
  • OS:none specified
  • Country: Country Flag

Linus is not a security professional.

I did not present him as such, I merely cited him, Chris Hallum is also not - AFAIK - a security professional.

However, most probably you are posting in the wrong place.

It is possible that noone here will be able to understand the mindboggingly complexity of the technical papers that you fail to provide, but it is not nice of you highlighting this assumption of yours about the technical inadequacy of the members of this board every two or three posts. :(

 

To recap:

  • You expressed your opinion, which - as said - is much respected.
  • You backed up your take on the subject (over and over) with reported opinions, "general consensus" and other meaningless (scientifically) "fluff", besides the fallacious argument "I am a security professional, hence I know the truth".
  • You by now twice or thrice hinted - not so covertly - how this audience is not at a sufficient level of  technical knowledge to understand the "real stuff".

 

There is nothing more to say, your opinion on the higher level of security of both Windows 8 and Windows 8.1 over Windows XP has been duly set on records, you cannot provide further real material (as according to your opinion it won't be understood by the undereducated members of this board), there is no point in going on with this discussion.  :hello:

 

jaclaz






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users



How to remove advertisement from MSFN