TELECOM Digest OnLine - Sorted: Microsoft Engaging With Hackers

Microsoft Engaging With Hackers

Jonathan Kent (
Wed, 18 Oct 2006 12:31:17 -0500

By Jonathan Kent
BBC Click reporter, in Malaysia

In a few weeks time Microsoft is expected to launch Vista, its new
operating system, and in January we will all get to play with the
finished version. But how safe will this brave new world be?

Given the number of attacks Windows usually attracts it is not
surprising that Microsoft has been speaking to anyone they think can

A team from Microsoft headquarters went to Malaysia for Asia's biggest
gathering of hackers - not to confront the enemy - but to throw the
hackers a party.

But behind the charm offensive, said Microsoft's Security Programme
Manager Sarah Blankinship, lies a serious purpose.

"We come to conferences like Hack in the Box to engage with the
security researcher community, to deepen our existing relationships,
to understand new technologies, tools and methodologies, and
ultimately to help us make our products more secure and to keep our
customers safer."

Open relationship

Hack in the Box brings together hackers, security professionals and
the companies who rely on their expertise.

Together they may determine whether 2007 is a good or bad year for
Microsoft, because security will probably make or break Vista, its
first new operating system since XP's security-plagued release six
years ago.

"I still don't feel that Microsoft is going to take it very seriously",
said Joanna Rutkowska, Security Researcher.

As Mike Davis from Honeynet explained, there has been a shift of
culture that has led Microsoft to open up and engage with the hackers.

"Everybody sees them as the big evil empire that nobody's ever going
to be able to change, but in actuality they are changing. They're
making a lot of strides to communicate more with researchers, the

"They're inviting people into their home, to the Microsoft campus to
tell them what's wrong with their code, how they can fix it.

"They're asking for help instead of just standing at the top of their
mountain and saying 'we are the best'."

The Microsoft team's top priority is a discussion about an apparent
flaw in Vista security.

They say they are here to listen -- but are they? Joanna Rutkowska, a
security researcher for Coseinc, is not so sure.

"After I presented my findings at the Ciscern conference in Singapore
in July, about how to bypass Vista kernel protection, I still don't
feel that Microsoft is going to take it very seriously.

"I talked to some Microsoft engineers a couple of days ago and they
say they're not sure that they're going to do anything about this."

Competition concerns

At Hack in the Box, Microsoft's Doug MacIver gave an insiders take on
security flaws in Vista. He is an expert in the platform's BitLocker
Drive Encryption.

Integrating tighter security features into the new OS seems a logical
step, but is it fair?

The European Union has already voiced concern that by including
features traditionally bought from independent suppliers, Microsoft is
being anti-competitive.

John Viega from McAfee also seems to think so: "I think it's pretty
unfortunate that Microsoft is here to cosy up to the security industry
when they're working so hard to lock security vendors off their

"With Vista, their new operating system, they're trying to keep
vendors off by putting security technologies on that ensure that they
have control over who can offer protection and who can't."

While the security software firms may feel cold-shouldered, the
hackers are happy to enjoy a drink with Microsoft, especially when the
"evil empire" is buying.

But the question is: will the hackers still respect Microsoft in the
morning? If there was an answer at Hack in the Box it was a resounding

They like the charm offensive, they are just not sure how long it is
going to last.

Story from BBC NEWS:

Copyright 2006 BBC News.

NOTE: For more telecom/internet/networking/computer news from the
daily media, check out our feature 'Telecom Digest Extra' each day at . Hundreds of new
articles daily. And, discuss this and other topics in our forum at (or)

For more news and headlines, please go to:

Post Followup Article Use your browser's quoting feature to quote article into reply
Go to Next message: Lisa Reyes: "IEC's Broadband World Forum Europe Closes in Paris"
Go to Previous message: Reuters News Wire: "Microsoft Opens Virtual Drives for Free"
TELECOM Digest: Home Page