Image
 
linkedin_logo.png rss_logo.jpg
twitter_logo.png youtube_logo.jpg
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 45 guests online
 
Advertisement

You are here: Home arrow Resourcesarrow News from the Outside Worldarrow Microsoft release "secure" XP to the government
EH-Net
May 21, 2013, 06:50:13 AM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Go back to The Ethical Hacker Network Online Magazine Home Page
 
   Home   Help Calendar Login Register  
Pages: [1]   Go Down
  Print  
Author Topic: Microsoft release "secure" XP to the government  (Read 8740 times)
0 Members and 1 Guest are viewing this topic.
Ketchup
Hero Member
*****
Offline Offline

Posts: 1021



View Profile
« on: May 01, 2009, 05:38:21 PM »


Quote
It’s the most secure distribution version of Windows XP ever produced by Microsoft: More than 600 settings are locked down tight, and critical security patches can be installed in an average of 72 hours instead of 57 days.  The only problem is, you have to join the Air Force to get it.

http://www.wired.com/threatlevel/2009/04/air-force-windows/

How can they call it secure if they can't remove Internet Explorer from it?  How long before a torrent of a copy pops up?   How long before someone pwns it?

I am wondering if they will release a template at some point.
Logged

~~~~~~~~~~~~~~
Ketchup
BillV
Hero Member
*****
Offline Offline

Posts: 1892


View Profile WWW
« Reply #1 on: May 01, 2009, 05:59:19 PM »

Hmm...

From the sounds of the article, I don't think there's anything really special about it. It just comes pre-configured as being locked down to DoD standards. Stuff you can do on your own if you really want to - just takes a little bit of time.
Logged
Ketchup
Hero Member
*****
Offline Offline

Posts: 1021



View Profile
« Reply #2 on: May 02, 2009, 03:52:24 AM »

I thought that too, that it's just a few templates they applied to it.  Yet, whenever I deal with PSS, I learn something new.   They have access to so many undocumented registry entries and such, it's ridiculous.   But I agree, I don't think that the kernel is going to be any different for example.
Logged

~~~~~~~~~~~~~~
Ketchup
UNIX
Hero Member
*****
Offline Offline

Posts: 1235


View Profile
« Reply #3 on: May 08, 2009, 12:01:31 AM »

Well, i think it is a good thing. Maybe not really necessary for someone who is doing computerstuff on a regular basis and interested in it-sec but for people who are not very familiar with computers it may reduce the possibility of getting hacked.
Logged
sgt_mjc
Sr. Member
****
Offline Offline

Posts: 294


View Profile
« Reply #4 on: May 08, 2009, 07:34:26 AM »

If you are looking for what they used to lock it down, look at teh DISA web site. You are looking for the STIGs. If you don't start from the get go with the STIGs you are in for a long haul trying to meet them.
Logged

Mike Conway
CISSP
CompTia Security +
C|EH
BillV
Hero Member
*****
Offline Offline

Posts: 1892


View Profile WWW
« Reply #5 on: May 11, 2009, 07:40:40 AM »

Further from that, download the public version of Gold Disk and run that on a fresh 2003 install. You'll see all sorts of fun registry edits Undecided
Logged
sgt_mjc
Sr. Member
****
Offline Offline

Posts: 294


View Profile
« Reply #6 on: May 11, 2009, 07:46:45 AM »

And if you are on a .mil domain, you can get the full version. I just recomend against letting it do the remediation. If you let it at it, you will have a "secure version" of XP that you can't use. But you are right on there Bill, it does come up with some registry edits.
Logged

Mike Conway
CISSP
CompTia Security +
C|EH
BillV
Hero Member
*****
Offline Offline

Posts: 1892


View Profile WWW
« Reply #7 on: May 11, 2009, 08:02:49 AM »

LOL! Yeah, forgot about that. I was going to add that and got sidetracked while posting. Definitely do not click that 'remediate all' or whatever it's called button.

Funny story on that.. a guy I was on a project with had hardened his server down and had only a few findings left. He wasn't quite sure about fixing them and had asked for help from one of the security "experts." While they're on the phone talking about it the expert pressed that button and his response was "oops." Yeah.. the server had to be completely rebuilt (didn't have a backup at the time and they couldn't figure out how to get it operational again). Luckily, it wasn't in production yet and didn't have any "real" data.. just a staged application.
Logged
sgt_mjc
Sr. Member
****
Offline Offline

Posts: 294


View Profile
« Reply #8 on: May 11, 2009, 10:59:53 AM »

Yup, That'll ruin your day Wink
Logged

Mike Conway
CISSP
CompTia Security +
C|EH
Pages: [1]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.18 | SMF © 2013, Simple Machines
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.07 seconds with 22 queries.
 
Exclusive Deal

sansfire13_245x90_cw90.jpg
SANSFIRE 2013
June 15 - 22

5% Off w/ Code: EHN_5

SANS Deals 4 EH-Netters
5% OFF Any SANS Course in Any Format!
Coupon Code: EHN_5 Including SANS Rocky Mountain 2013 & SANS Boston 2013
Polls
Compared to this year, 2013 will be:
 
Recent Forum Topics
EH-Net News Feeds
Latest Additions
 
         
Advertisement

© 2013 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.