When hackers crash their systems while developing viruses, the code is often sent directly to Microsoft (MSFT), according to one of its senior security architects, Rocky Heckman recently told ZDNet Australia.
According to Heckman, when the hacker’s system crashes in Windows, as with all typical Windows crashes, the user would be prompted to send the error details — including the malicious code — to Microsoft. The funny thing is that many say yes Heckman told ZDNet Australia. “People have sent us their virus code when they’re trying to develop their virus and they keep crashing their systems,” Heckman said. “It’s amazing how much stuff we get.”
At a Microsoft Tech.Ed 2010 conference session on hacking Heckman detailed to the delegates the top five hacking methods and the best methods for developers to avoid falling victim to them. According to Heckman, based on the number of attacks on Microsoft’s website, the company was only too familiar with what types of attacks were most popular.
“The first thing [script kiddies] do is fire off all these attacks at Microsoft.com,” he said. “On average we get attacked between 7000 and 9000 times per second at Microsoft.com,” said the senior security architect. “I think overall we’ve done pretty good, even when MafiaBoy took down half the Internet, you know, Amazon and eBay and that, we didn’t go down, we were still up,” he said.
Heckman told ZDNet Australia there were two reasons why the top hacking methods of cross-site scripting and SQL injection had not changed in the past six years. “One, it tells me that the bad guys go with what they know, and two, it says the developers aren’t listening,” he said. Heckman said that developers should consider all data input by a user as harmful until proven otherwise.
Related articles
Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.