LSD discovers what Microsoft couldn't
Polish researchers find flaw in latest Windows products
By Kamil Tchorek
An informal Polish IT research group has notified software titan Microsoft about a critical security flaw in its its most recent products. The four Polish researchers, who go by the risqué name of The Last Stage of Delirium (LSD), have co-operated with Microsoft on the critical patch solution to the flaw.
This comes amidst the announcement that Microsoft's cash holdings now amount to $49 billion. It has now been three months since the launch of Microsoft's "safest ever" Windows Server 2003 software, which until LSD's findings was not seen to have major problems.
The flaw also affects NT-based Windows variants, including Windows NT 4.0, NT Terminal Services edition, 2000 and XP. It allows an opportunistic hacker to enter an open port and run applications on a victim's machine without detection. On its website, Microsoft now warns users that, without downloading the new patch, a malicious hacker could attain "complete control over a remote computer."
A spokeswoman for Microsoft Polska said: "On behalf of the Microsoft Corporation I would like (to say that we are) cooperating with the IT specialists at the LSD group regarding one of the security aspects of our operating systems. On July 16, 2003, in our web Microsoft Security Bulletin MS03-026, we expressed our thanks to the LSD group for their cooperation, and explained how to avoid possible hacker attacks, including the suitable software patch. From our side, we sent the appropriate information to our customers."
The LSD group is based at the Poznań Supercomputer and Networking Center (PSNC), which services the public and private sectors and employs around 80 people. The PSNC's raft of networking solutions already services several leading banks, manufacturing firms, transport companies and administrative agencies. Norbert Meyer, manager of the PSNC's Supercomputing Department, sees LSD's high-profile assistance to the world's software leader as a major public relations coup.
"With proposals to the State Committee for Scientific Research being considered," Meyer says, "and participation in the EU-funded Fifth Framework Program for creating a pan-European net, PSNC will be able to make a stronger pitch thanks to LSD's work. The safety issue is always changing, but it is now famously our strength, and international interest knows about it."
"If it was not discovered by us, this flaw could have been discovered by a malicious hacker at any time," LSD's Adam Gowdiak said. "In the wrong hands, this information would enable a criminal to effectively sit at a target computer, spying on private documents, deleting them, moving money - really anything that you can conceive of doing on a computer. There are so many possibilities, only limited by the skill and imagination of the hacker."
In the inevitable bandwagon following LSD's findings, similar groups around the globe have been working overtime over the past week using LSD's clues, "discovering" the flaw for themselves, only to irresponsibly go public with the details. Starting with the Chinese group Xfocus.org, the potentially destructive exploit code was also posted to Metasploit.com, the Full Disclosure mailing list, and over the course of this week will continue to spread, ever increasing the chance of Gowdiak's fears being realized.
Scott Blake, chairman of the communications committee at the U.S.'s Organization for Internet Safety (OIS), was quoted as saying that "(LSD) followed the OIS guidelines for reporting the vulnerability by holding onto its exploit code. But since this vulnerability was particularly 'juicy,' several groups of coders rushed to discover their own exploit code."
Asked if there was any personal commercial incentive to his work, Gowdiak said that The Last Stage of Delirium was a non-profit organization. "We conducted research into the levels of security in Microsoft products," he added. "It was Microsoft this time, but we have done something like 30 similar vulnerability tests in the past, on UNIX for example. The only thing we get out of it is credit and a thank-you letter from Microsoft. But that is the way these things work. There are many research groups like us around with equally unusual names, who try to head off the hackers, to the free benefit of software firms and their customers."
