Spat over MS 'flaw' gets heated

NEWS

A security company's assertion that a feature in Microsoft's latest software tools has a flaw morphed on Friday into an argument over whether the giant is doing enough to secure its code. The crux of the debate is now focused on whether the feature -- a software switch known as the 'GS flag' that turns on additional security -- has sacrificed protection for performance, said Crispin Cowan, chief scientist at WireX Communications -- a maker of secure Linux applications -- and the co-founder of open-source security site Sardonix.org. Cowan likened the GS flag to a flak jacket that protects against certain calibers of bullets. "Now, the disagreement is over the size of the bullets that can penetrate the jacket," he said. In 1998, Cowan and graduate students from the Oregon Graduate Institute published a paper describing just such a software flak jacket, called StackGuard, that has since been utilised by thousands of open-source developers. Many contend that Microsoft largely held to Crispin's design in creating the GS flag. The debate heated up on Friday, a day after Microsoft dismissed as "unfounded and patently false" allegations that applications built with its newly announced software tools are more vulnerable to attack. Microsoft launched its Visual C++.Net and Visual C++ Version 7 on Wednesday and wasn't pleased when, just a few hours later, software-reliability company Cigital stated that a feature of those programs is "flawed." "In its current form, the Microsoft feature leads to a false sense of security because it is easily defeated," stated a technical note published by Cigital on the issue. A program built using the GS flag option runs additional instructions that can catch some of a class of security flaws known as buffer overruns. While the statement implies the existence of a vulnerability that makes the feature ineffectual, in reality the flag works against some buffer overruns and not against others. Rather than a vulnerability, both companies acknowledge that Cigital has identified a limitation to the design that Microsoft has chosen to implement. Microsoft argued that, to add more security, too much code would have had to be added to new applications, slowing them down to an unacceptable degree. Yet, with the current design, at least some buffer overflows can be avoided, said Brandon Bray, program manager for Microsoft's Visual C++ compiler team. "We maintain the opinion that fixing source code to eliminate buffer overruns is the best and only solid approach to securing software," Bray wrote in a statement. "However...buffer overruns are not always simple to find. Thus, anyone truly interested in writing secure code would not hesitate to use the (GS flag) for their builds." Microsoft maintains that any additional security that can be added to a program is a good thing. Cigital, on the other hand, argues that Microsoft has only given a slight nod to security with its implementation of the GS flag. "I stand by my claim that that security mechanism is incorrectly designed," said Gary McGraw, chief technology officer for the firm. "Microsoft's claims about what the GS flag could protect are overstated." The two sides seem unlikely to relent, but many security experts agree with Microsoft that some security is better than none. "At least they are putting run-time checking for buffer overruns, which you don't find in other (Windows) compilers," said Chris Wysopal, director of research and development for digital security firm @Stake. "They are trying to do the right thing but are limited by the technology, so you can't blame them for not catching everything."

See the Software News Section for the latest headlines on everything from peer to peer clients to Office software and beyond. Have your say instantly, and see what others have said. Go to the ZDNet news forum. Let the editors know what you think in the Mailroom.

Post your comment

In order to post a comment you need to be registered and logged in.

You can also log in with Facebook. Log in or create your ZDNet UK account below

By signing up for this service, you indicate that you agree to our Terms and Conditions and have read and understood our Privacy Policy. Questions about membership? Find the answers in the Community FAQ

ZDNet UK Live

ike fuelband is great for every healthminded person ! to work out! theres this website called textme4free.com that you can use to text anywhere in...

6 hours ago by bordero on Nike's FuelBand wristband gamifies exercise

> I'm told it's somewhat annoying when people have their Macs stolen > and Apple stores treat the thief as the owner, but there you go. Ouch,...

8 hours ago by BrownieBoy on AMD Ultrathins to challenge Intel Ultrabooks

@kevinmchapman. OK, I acknowledge that 'most' was a gratuitous throwaway comment as an afterthought and too presumptuous. As to proof, as you...

13 hours ago by Moley on A tale of two distros: Ubuntu and Linux Mint

@BrownieBoy > Works really well for thieves.... >> Nice attempt to deflect the argument by tossing in a point that's totally >> irrelevant, even...

14 hours ago by Jack Schofield on AMD Ultrathins to challenge Intel Ultrabooks

fantastic that the so called piracy bills have been withdrawn. however, these anti-democracy supporters are still in the shadows so lets be alert...

15 hours ago by raskolnikof on SOPA, Protect IP support wavers in face of online protest

Please God no; teach them anything you like - thinking rationally, the uses and misuses of data, what data is and what it's not - but leave the...

17 hours ago by Tony Douglas via Facebook on Kids are the future. Teach ’em to code.

@Jack, > Works really well for thieves.... Nice attempt to deflect the argument by tossing in a point that's totally irrelevant, even it were...

1 day ago by BrownieBoy on AMD Ultrathins to challenge Intel Ultrabooks

Make that 13 people now - I got refused today at Manchester airport. I thought I was up to date on this legislation - I knew of the EU ruling from...

1 day ago by bootlegger on UK airport body scans will not be opt out

Don't forget to check out apps like GoodReader or SlideShark either, they're indispensible for people on the go in presentation situations. Best...

2 days ago by tinycg on Four top iPad apps for people on the move

Well it seems there is something a number of us agree on. Why is the Ubuntu Unity launcher so ugly? I thought perhaps it was something to do with...

2 days ago by TerryRK on A tale of two distros: Ubuntu and Linux Mint

Duplicate comments are not made intentionally. Its very good to know that now you are keeping check on this problem because sometimes a commenter...

2 days ago by Freebies202 on Microsoft fixes blog comments, speeds up blogs with open source

"the very significant number of users" and "many (most) of us" - you have no evidence for these statements. It is a fact that most users are saying...

2 days ago by kevinmchapman on A tale of two distros: Ubuntu and Linux Mint