Breaking Windows for better security
Published: 21 Jun 2005 12:55 BST
To the researchers, Microsoft's motivation was less important than the opportunity to meet in person with those who hold the keys to the kingdom and explain why they do the things they do.
"It is rare that I can present to the people who are both responsible for and capable of fixing the issues that I cover," security researcher HD Moore said, adding that he doesn't plan to change his practice of giving companies 30 days before going public with issues. "I still have no desire to play email tag with the (security response team) for a year for every bug that I find."
But Moore did gain a better understanding of why it takes Microsoft so long to create patches and said his impression of the people who create the products have changed. "I still may not agree with their security policies and how they handle bug reports, but at least I know they actually believe what they are saying," he said.
Others agreed. "They are taking this subject seriously. It was really cool to see," said Kaminsky, a security researcher who does work for telecommunications company Avaya. "At some point, there was a shift at Microsoft."
That shift began in earnest with a well-publicised memo written by Gates on the concept of "trustworthy computing" in 2002. Security had long been a concern at Microsoft, but the issue became imperative after several high-profile attacks exposed the degree of its vulnerabilities.
"The security faults we are seeing could end up bringing an end to the era of personal computing," Kaminsky said. "The ability to customise our computers is under attack from those who are customising it against our will."
It was this kind of impassioned rhetoric that won respect even among some of the more wary Microsoft participants.
Noel Anderson, a wireless networking engineer on Microsoft's Windows team, became suspicious as soon as he walked into the hacking demo — and saw the giant wireless antenna at the front of the auditorium.
Anderson decided that he should leave his laptop turned off, an instinct that saved him the embarrassment of falling into the hackers' trap, even though the hackers focused on a demo laptop. But under different circumstances, he thought to himself, "I might have even fallen for that."
Previous
Did you find this article useful?
258 out of 532 people found this useful
- Share this article:
Full Talkback thread
2 comments
