Why 'Sasser' does not affect Win2003

re: Why 'Sasser' does not affect Win2003

Ilya — Mon, 03 May 2004 07:23:00 GMT

Are there any chances to have the same for XP?

Perch

Daniele Bochicchio — Mon, 03 May 2004 10:38:00 GMT

Why 'Sasser' does not affect Win2003

Dana Epp's ramblings at the Sanctuary — Mon, 03 May 2004 18:50:00 GMT

Michael had a quick blurb on his blog on the fact that with the latest 'Sasser' worm, Windows Server 2003 was not infected. Why? As he says, "Because the RPC interface, which is accessible to anyone (ie; anonymous) on Windows XP and Win2000, was changed in Win2003 so that it requires a local admin to access. Not a remote admin, a local admin using the server's keyboard." Here is where Microsoft's change in stance in applying infosec principles to the design, defaults and deployment of their operating systems start to show real benefits. The rule of least privilege applies a harness to the RPC interface and lessens the attack surface by explicitly knowing the difference between local and remote admins and confining the abilities of such foreign bodies of code. In this way, attack patterns built into Sasser are useless against Microsoft's latest OS. This is where their policy of "Secure by Default" limits new unknown attack vector such as this. Are we beginning to see a change? Time will only tell....

New and Notable 52

Sam Gentile's Blog — Mon, 03 May 2004 22:51:00 GMT

Why 'Sasser' does not affect Win2003?

Shaitan's Blog :-) — Tue, 04 May 2004 00:26:00 GMT

re: Why 'Sasser' does not affect Win2003

Michael Howard — Tue, 04 May 2004 04:28:00 GMT

For XPSP2 we've done a number of things, all in the interest of reducing attack surface. First, RPC endpoints require authentication, and because the firewall is on by default you can't get to the ports anyway. Next we simply removed that code from LSASS in XPSP2!

Sasser, no Effect on Win2K3

Gary Short — Tue, 04 May 2004 10:55:00 GMT

Why 'Sasser' does not affect Win2003

Donna's SecurityFlash — Tue, 04 May 2004 15:37:00 GMT

Sasser Doesn't Impact Windows Server 2003

IlluminatiLand — Wed, 05 May 2004 07:23:00 GMT

Michael Howard has a blurb on why the Sasser worm does not affect Windows Server 2003. This is because Microsoft made a change to the RPC interface that requires local admin access instead of remote admin....

re: Why 'Sasser' does not affect Win2003

Ilya — Wed, 05 May 2004 05:44:00 GMT

Thanks. It's great to see such SP2 features indeed.

'Sasser' does not affect Win2003 and WXP SP2

Sergey Simakov blog — Wed, 05 May 2004 08:55:00 GMT

'Sasser' does not affect Win2003 and WXP SP2

Sergey Simakov blog — Wed, 05 May 2004 09:10:00 GMT

Sasser ?

Server: Microsoft-IIS/6.0\r\n — Wed, 05 May 2004 09:43:00 GMT

re: Why 'Sasser' does not affect Win2003

Anonymous — Sat, 08 May 2004 16:50:00 GMT

If security to you means removing bloated features that should have never been implemented, that's saying a lot!

re: Why 'Sasser' does not affect Win2003

Michael Howard — Sat, 08 May 2004 17:35:00 GMT

There's a little bit more than removing code!

re: Why 'Sasser' does not affect Win2003

Kenji Yamamoto [MVP] — Sat, 08 May 2004 22:08:00 GMT

Lots of efforts of everyone involved, right?

Not only removing peaces/hardening the defaults there are much more of challenges, you know. I think Microsoft is now proactively taking actions to make things secure.

Microsoft is now hearing what we are saying in all aspects. It is not limited to security, though.
If you have opinions write down in newsgroups, blogs, and so on. They are looking and taking our feedbacks. Or, pls rely on us MVPs. Pls tell us. ;-)

Well, another thing which I want to express that is more important is that security is not an independent piece of puzzles of computer system, but a component (which should be )integrated into design, dev, deploy, management, support, and all the other scenes of computer life in general.

Microsoft is a software vendor and they are doing what they are expected to do, acting proactively. I mean this applies to Michael and people around security within Microsoft.

I am looking forward to seeing more of the results of their effort in the future. ;-)