I am hating Microsoft right now. I have just had a long battle with Windows 2003 Server, WSUS and Microsoft Virtual PC 2005. Some of the low blows consisted of badly named KB with worse named .exe's, inconsistent and sometimes contradictory error messages (I both had .NET framework v1.1 installed and I didn't?!). It got to a high when I couldn't resize the dynamic virtual hardrive and hit new lows when the rescue console refused to make my new harddrive bootable, it happily gave it an MBR however. I realise much of this is due to my unfamiliarity with the Windows environment, but surley the point and click goodness is supposed to make it easier?

It appears that Microsoft has disabled raw sockets completely when the new MS05-019 (kb, exploit) patch is applied. This originally only affected XP SP2 but now affects SP1. Windows 2003 is still unaffected. The quote from the SP2 page is:

Restricted traffic over raw sockets

A very small number of Windows applications make use of raw IP sockets, which provide an industry-standard way for applications to create TCP/IP packets with fewer integrity and security checks by the TCP/IP stack. The Windows implementation of TCP/IP still supports receiving traffic on raw IP sockets. However, the ability to send traffic over raw sockets has been restricted in two ways:

• TCP data cannot be sent over raw sockets.
• UDP datagrams with invalid source addresses cannot be sent over raw sockets. The IP source address for any outgoing UDP datagram must exist on a network interface or the datagram is dropped.

Why is this change important? What threats does it help mitigate?

This change limits the ability of malicious code to create distributed denial-of-service attacks and limits the ability to send spoofed packets, which are TCP/IP packets with a forged source IP address.

Thsi doesn't make sense to me or others (Fydor of nmap fame). First, I don't think disabling a useful feature to prevent it from being used maliciously is a good way to do things. Second, if the Windows TCP/IP stack wasn't broken this wouldn't be a particularly big problem. Finally, almost every other OS allows the use of raw sockets, which means that the 'malicious behaviour' they discuss can still be pursued. Then in a bizzarre twist, Microsoft allows W2K3 to still use raw sockets? I think they are hoping to reduce the amount of malicious traffic coming from unpatched home machines. If this is the case it would be nice if they could provide an optional 'allow raw sockets' patch.

In an earlier conversation, Tristan pointed me to a Mozilla extension called Petname. Here is a snip:

The petname tool will be enabled anytime you visit a site using SSL strong encryption. Initially, the petname tool will display the text "untrusted". If you decide to form a relationship with the site, overwrite this text with a reminder note describing the new relationship. The petname tool will remember this reminder note and display it every time you visit the site. Be sure to always check that the petname tool is displaying the expected reminder note before sending personal information to a site. If you have the misfortune to land on a spoof site, you'll know it because the petname tool will be displaying the text "untrusted", instead of your expected reminder note.

I will be gone for a couple of days to say goodbye to someone who has made an enormous impact on my life.

I got this from yesterday's ISC handler's diary. Is it better to release a patch as soon as possible after a vulnerability, mark it as unstable until it can be properly tested, then move it to stable when it is, or to release them all once a month?

There are problems with both models, not the least of which is how much information you are releasing to attackers as most exploits we are seeing are reverse engineered from the patch. However, is it better to deal with one or two exploits over a month or deal with them all for a day or two (or three), and does not releasing the patch for a month actually prevent people from coding exploits?

If you have been reading this blog for much time at all you would know my answers to these questions. I would like to hear yours however.

The SANS ISC has a great write-up of Microsoft's patch tuesday. There is already PoC code for the Internet Explorer DHTML vuln.

Tonight I attended the first of a 3-part lecture series by Dan Wylie. Apart from being a top poet, he has also published a book, based on his PhD, entitled "Savage Delight: White Myths about Shaka" and will be publishing another book based on his current work. He is the first historian (along with Dr. Julian Cobbing, also from Rhodes) to perform a proper critical analysis of the life of Shaka.