Microsoft's hacker bounty: Help or hurt?

I think it's a Microsoft strategy to divert attention away from there security riddled software and - "The Trustworthy Company" - until they (if ever) get it fixed.

They are hopping to reduce attacks by putting a bounty on the heads of the creaters. That is like hiding a bone to a hungry dog. It will now be a challegne to these folks to create an untracable version. It will increase the series of attacks on Microsoft software, and release of numerous versions of the same attack.

Jonathan Yarden is probably a Democrat in the mold of Tom Daschle. Cower in the corner "the hackers are coming"!
The only way to deal with an attack is to counter attack.
You cannot build a wall while the enemy is shooting the bricks out of your hands.

Like all Microsoft bashers, Yarden needs to get a clue. You don't blame the victim for the crime. Do you think it's a coincidence that his title is "senior UNIX system administrator". I would expect the same garbage from the "senior Linux system administrator".

I'll tell you what. Let Yarden get a group of programmers together and develop an operating system with millions of lines of code, that runs on over 90% of consumer PCs and see how long it takes his OS to get hacked to pieces. If then he is willing to say "Whoops my bad" I'll join his Microsoft blame game. Till then, save it for your Unix/Linux fanboys.

-Neo

I have often wondered ,if everyone was using some other operating system. would there still be a problem?
or is the real reason that there are just people out in the world that are compelled to find exploits and take advantage of them!
I have no real opinion on rewards or bounties, and wont defend a company if they are truely releasing an inferior product and know it!
but I don't beleave that M$ is the reason for virus writers and hackers.

Bravo to you Yarden! The fact of the matter is that Microsoft products are not secure. Has anyone noticed nearly all the vulnerabilities exist in not only win2k and win2k3 but also winnt4? These problems have existed for years and Microsoft doesn't care enough to fix its own software until someone externally finds a problem with it.

Microsoft is using one of the worst management flaws with the hacker issue: THROW MONEY AT IT AND IT WILL FIX ITSELF.

I noticed a couple other posts where people are insulting "Microsoft Bashers" and Yarden for being a Unix administrator. WAKE UP PEOPLE! It's very similar to a theoretical CDC team working with ebola without containment and wondering why the staff keeps on dying within 7 days of taking the job!

We are removing ALL microsoft products from our servers across the enterprise because we can't justify the risk anymore. In a 24x7 shop, we can't reboot everytime microsoft comes out with a patch.

The quote "The only way to deal with an attack is to counter attack." is childish. Remove the source of the problem and you won't have the problem. I prefer not to wait until I have a broken nose to swing back. We are taking a defensive posture by removing the source of the problem. Don't put yourself in a vulnerable situation and play the victim.

This is for the microsoft lovers: http://support.microsoft.com/default.aspx?scid=http://support.microsoft.com:80/support/kb/ARTICLES/Q172/6/53.asp&NoWebContent=1

Now do you understand?

Quite frankly, an easier solution would be to have Microsoft update their default passwords and policies to comply with the recommendations of the various security organizations. If the default passwords would expire within 30 days after installation, then that would eliminate many problems by itself. I have given up hope that they will resolve the rest of the bugs.

Bravo to you Yarden! The fact of the matter is that Microsoft products are not secure. Has anyone noticed nearly all the vulnerabilities exist in not only win2k and win2k3 but also winnt4? These problems have existed for years and Microsoft doesn't care enough to fix its own software until someone externally finds a problem with it.

Microsoft is using one of the worst management flaws with the hacker issue: THROW MONEY AT IT AND IT WILL FIX ITSELF.

I noticed a couple other posts where people are insulting "Microsoft Bashers" and Yarden for being a Unix administrator. WAKE UP PEOPLE! It's very similar to a theoretical CDC team working with ebola without containment and wondering why the staff keeps on dying within 7 days of taking the job!

We are removing ALL microsoft products from our servers across the enterprise because we can't justify the risk anymore. In a 24x7 shop, we can't reboot everytime microsoft comes out with a patch.

The quote "The only way to deal with an attack is to counter attack." is childish. Remove the source of the problem and you won't have the problem. I prefer not to wait until I have a broken nose to swing back. We are taking a defensive posture by removing the source of the problem. Don't put yourself in a vulnerable situation and play the victim.

This is for the microsoft lovers: http://support.microsoft.com/default.aspx?scid=http://support.microsoft.com:80/support/kb/ARTICLES/Q172/6/53.asp&NoWebContent=1

Now do you understand?

I think Microsoft is taking the wrong angle here. While we question the motives of people that spend much time and effort writing viruses and worms the result is that Microsoft end up with robust and secure operating systems - tested to the limits at no cost to Microsoft. Perhaps Microsoft should spend the cash offering rewards for coders that can find weaknesses in their systems!

Perhaps the majority of virus writers and hackers do it for fun or some anti-establishment motive but probably couldn't be classed as 'cyber terrorists' in an international organised sense. Maybe it is time to get operating systems really secure before well funded organisations use cyber terrorism to really cause havoc (or is it too late).

While I agree with Mr. Yarden that Microsoft's action may encourage some hackers to attack back (and possible cause us all to suffer the fallout), I don't think the bounty idea is a bad thing. It may not sweep up the most skilled or most dangerous hackers, but it may serve to somewhat thin the ranks, at least for a while.

Where I part ways with Microsoft is that this should have been a side-note to a MAJOR effort to secure their software. Can we all at least agree on this: Microsoft has the money to fund a major across-the-board security fix and (while they're at it) general bug fix, if they choose to spend their money that way.

I believe the RESPONSIBLE thing for Microsoft to do would be to take some time off from pumping out new releases, and focus their entire efforts on producing the most bug-free software that has ever been seen, then release it to current licensees free of charge. After that, go back to new products, new features and upgrade releases. At least they would have finally given their customers what the customers paid for in the first place.

I've stopped wondering why hackers write their malicious code; I figure it's for the same reason dogs pee on fire hydrants ... it's just what they do!

"Before you cheer Microsoft for setting up a reward to apprehend malicious coders, consider that Microsoft's buggy software is the reason there's such a problem in the first place."

Uh, yeah, and the reason that there is terrorism in the world (e.g., 9/11) is because there are soft targets -- God, can thinking get any sloppier?

Just curious because I haven't read more about this..but what exactly is the 5 million for? Is it to find the culprits so they can be punished? Or is it offered to anyone who finds out Microsoft's security holes thus finding out how the virus authors are able to do what they do...If this is the case...wouldn't you, if you were a hacker or virus author, step up and take the 5 million dollars showing Microsoft how they were able to get into their systems and do harm? You could just present yourself as someone who found out how it was done rather than the person who did it! 5 million is a lot of money!!

Your anti-microsoft rhetoric is load and clear, as always.
So, using another analogy, are you saying that parents who post a reward for the return of their missing children regardless of the reason are vigilanties? Hmmmmm?
Let's just do nothing, Ok. Maybe Microsoft will go out of business (you hope)and all of out users in Accounts Payable and Purchasing will have the latest version of Red Hat on their computer next week. I agree that MS's code needs massive work, but whay can't we attempt to do ALL that we can to make computing safer.
It seems to me that if their products weren't the target, someone else's OS would.

Will the MS bounty help security? I think it will help some - the reward is pretty tempting. But yes, a reward gives hackers a bigger thrill, as it did another criminal, Billy the Kid, who commited more crimes than he would have otherwise to deliberately drive up the reward on his head. And yes, of course, MS should fix their buggy software. Their Achilles Heal is not focusing on security while going after their noble (and profit-driven) goal of creating an OS that is easy to program for, and easy for most people to add new programs and features. That's made it easy to hack.

And while Unix/Linux/Mac users sit back and ridicule MS for their unsecure software, they should all be VERY thankful that MS presents such a big, easy target to distract hackers from focusing on breaking into Unix, Linux and OS X. That's where the real challenge is, and if hackers had any _real_ balls they would take up that challenge. Think it can't be done? Thank BG that you can afford to live that fantasy.

I agree with the MS bounty and it's intended targets. The counterattack is aimed at the head of the beast, the smartest and most dangerous. Good. But even a failure of the counterattack on just these two attackers may tell us something about how well they are protected. Are they getting backing?

Mr. Yarden. If you have a list of compromised computers available, how have you personally used that list? Have you attempted to contact any of the owners? Have you ever lifted a finger to fight back? I think not.

Part of the reason for the successes of the hackers, virus authors and spammers is an unwillingness to get involved in fighting back. Mr. Yarden, if you were to fight back, where would you begin?

I fight back a little each day. I gather documentation and send it to ISP's each time I identify a malicious port scan or even a spammer. Once in a while, it helps.

Some of these Tech Republic authors should take a deductive logic course, or at least brush up on the fallacies of argument.

Now before people start spouting off that I'm a Microsoft groupie, let it be known that I've supported VMS, UNIX, Linux and Windows. That said, I think there's a need for a reality check in this forum. Do people really believe that if *NIX replaced Windows as the major OS on servers and desktops that all network security vulnerabilities would disappear? Would hacking, virus writing, and cyberterrorism cease?

Might I remind everyone that the first Internet distibuted virus (worm) propagated via Sendmail in the late eighties and infected nearly 6000 UNIX machines. Sendmail is STILL subject to buffer overflows and privilege escalation. I can think of at least 3 CERT advisories this year on Sendmail. In addition, SNMP, BIND, SSH, Apache, RPC, and a host of other *NIX software and services have holes that need fixing. Many vulnerabilities are platform independent. Let me post another rhetorical question to illustrate my point: Are there *NIX networks containing accounts with weak or nonexistent passwords?

The truth is that there will always be lazy, untrained, unknowledgeable, and/or overworked system administrators. There will always be companies with weak network security policies. There will always be companies that sink very little money into security.

Ditching Windows will most certainly not solve all network security woes, so please let us all stop talking as if that is the end-all solution. If the king of the hill loses his position, another king will replace him as the central target.

P.S. - Kudos to all diligent and hard working system administrators of any flavor.

Ever heard of Trusted Computing ? Ever worked in a corporation where they offer you a piece of candy today so that you will feel better when they kick you in the behind tomorrow ? Confused ? Microsoft's hacker reward is the first attempt to push Trusted Computing on the consumer. Instead of fixing their software they will use the current situation,i.e.: the need for rewards, to justify harsher, more restrictive methods to control software and your PC....Trusted Computing.....

I find this to be one of the most intriguing conversations in a long time. My view is that M$ has a problem with their go to market plan. They would rather make money than put out secure and stable software. I believe they have a decent development to production cycle, but their problem lies in testing. How could you not catch the rpc exploit?? That would have been easy. M$ has had some pretty easy hacks done to them. I do not view any of the malicious code as intelligent or hard to code. M$ has left gaping holes in their code.

I do not see M$ stopping this problem with money either. I agree that they are opening themselves up for retaliation. The best way to stop malicious code is to prevent it. This may not be M$'s problem, we need better intrusion detection, malicious code scanners and better education. That is another point, don't blame M$ for the inability for some to implement M$ products properly. Who in their right mind would make a M$ server available on the Internet without some NATing appliance or server that can examine the packets and help prevent an infection.

Remember, your security is only as good as your weakest layer. Fix those layers or add helper layers and stop blaming M$ for bad implementation and/or administration.

It is 100 percent to agree with your point of views on this matter.
Remember that there is no pot smoker if there in no weed.

Ok Guys, Instead of looking at all the faults with Microsoft (which I agree can be many), lets look at the progress that has been accomplished with the Microsoft products over the last couple of years. I rely on Microsoft applications heavily in my job. I can tell you that more things work than not. The free support I recieve from the Microsoft website is exceptional. If all software had this support I would be a very happy women. I feel that Microsoft cops the hackers more than other companies because their products are more widely used. It's not that the other programs can't and don't get hacked, it's just it's not as much fun to bag them out as it is Microsoft. I for one have a mind of my own. I use the Microsoft products everyday. I don't mind saying that I am very happy with the job they do and am happy that Microsoft continually strive to improve.

I think Microsoft should focus on both issues. Hacking is a criminal act, regardless of the reason or outcome. True, hackers uncovered some truly embarrassing vulnerabilties, but the end doesn't justify the means.

Microsoft is trying to make their software more secure, but its not good enough. There are too many patches and it adds many hours of maintenance to a net admins job.

I like the idea of a bounty on hackers. They should be using their talents in a more positive way. I'm sure that Microsoft got a good amount of tips after offering a bounty. Money is always an incentive.

i agree with jonathan yarden.microsoft should fix the problem.do something so computers don't get these viruses,worms,or trojan horses.they should do something so these things can't get past.if they do get past at least give the people a FREE FIX, so people don't have to pay to get rid of them.after all we didn't ask for this,so why should we have to pay to get rid of it and make someone else rich.

Only 5 Million? Now I'll just have to go killin' so it makes me worth more!
I guess history is bound to repeat itself!
(so are virii)

Unix Rules!

Microsoft fixing their security, frankly I find this statement amusing. I think the reason they offer $5 million is merely because of the fact that it will cost them $500 billion to "improve" (Note: I did not say fix) their own code. Frankly I think they should can the idea and stick to donating funds to malaria reseach in mid-africa.

As far as the reward goes, this makes me feel like crashing that IIS thingy just to prove a point, and I have not done an illegal hack in my life. I'm yet to see a secure product from this software giant. Other than banking MS is probably the biggest con this planet have ever seen. Remember the statement 640K will be enough for everyone? Well, Microsoft security probably falls in the same category.

Best of luck to the MS clan, You've just unleashed the gates of hell on yourselves. Now you have one option, install Unix!

Way back during the browser wars, MS was giving away IE with WindoZE. Threatened with lawsuits by Netscape, IE was given kernel access so MS could claim IE was an integral part of the OS. Though shown that IE could be removed and WindoZe would still 'work' this ploy was successful.
This deliberate effort to destroy a tival was the can of worms that has lead to the myriad of holes found in IE and their intertwined products.

The investment required to 'fix' the problem is at least an order of magnitude greater than the total reward budget. This strikes me as a 'bean counter' solution!

The main point is that MicroSoft is assisting those folks intent on "hacking" by issueing these "bugged" platforms for them to exploit. I'd like to make claim on part of the reward by turning in the MicroSoft folks responsible for allowing this to happen in the first place. So how much do I get? I have first dibs on making this assertion and I'd like to donate MY reward money towards getting THEM to straighten OUT the "fixes" so that I can use my peripherals without having to find and install a "fix" because of XP-'nuff said.

Microsoft should concentrate on making a better product and get off the witch hunt.

Without hacking we wouldn't have the Internet or PC's to protect. Not to mention no NTBugtraq (oh I'm sure Bill & Steve would be ok with that). ISS wouldn't exist, in fact, I'm willing to bet that many, if not most, major IT Security companies wouldn't exist.

Hacking is as much a part of the IT industry as so called "legitemate" businesses. And yes occasionally a disgruntled geek goes on a rampage...However, the inconveniance caused by this beats the hell out of a semi-automatic on top of a water tower. Not to mention it also helps the economy. Seriously what if there were no "Evil Hackers"? There be no Symantec, McAfee, or TrendMicro...actually a lot of companies would not exist. And a lot of people wouldn't have jobs as a result.

Besides Bill Gates is a jerk...read "Fire in the Valley"

Anyone who uses microsoft firewall protection is an IDIOT. Hackers know how to get in and even use your activation of windows protection to get themselves in. Food for thought. I ran Longhorn for a while and it will resolve a lot of issues concerning hacking, but not to be released for a few years... It is nice, security wise with the new file system, but a memory hog.

Throwing money, and other resources at the problem is not the solution.
Everyday, in some University, School, or basement, there will be someone who learns that one little bit of code that can lead to access to another system, regardless of the OS.
Secure your system? Yes. But just like your fancy new car, if they want it they'll take it... no matter how you protect it.
Focus on strategies to handle a breach and the impact on your business won't be surprising. Damage control will be much easier.

my $0.02 CDN