Microsoft: Who do you want to 0wn today?

by Dkr. Armand Geddyn

2003-08-17 12:19:03

Software Jihad

Microsoft Knowledge Base article 826369 describes a free tool from Redmond that enables criminals, terrorists, and hackers to quickly identify 0wnable computers around the world.

According to the article, the poetically named KB826369Scan.exe is designed to "scan remote host computers without requiring authentication [...] to identify host computers that do not have the 823980 security patch (MS03-026) installed." MS03-026, FYI, is the awful, awful RPC DCOM vulnerability, for which there are plenty of sploits available (most of which much quieter and more useful than W32.Blaster).

In other words, Microsoft is offering a quick, reliable, and unlimited targeting system to any old criminal-terrorist-hacker who comes around looking for details on the Worst Microsoft Security Problem Ever.

Heck, not even no-no-notorious eEye Digital Security included such broad functionality in their early RPC DCOM vulnerability scanner, released weeks before Microsoft's. eEye's Retina scanner (like all other free eEye products) limits s'kiddies to one Class-C scan at a time -- if you want to 0wn the world, you need to pay up first. Microsoft's tool also outperforms ISS's Scanms command-line scanner in terms of both speed and stealth.

If you ask me, Microsoft's utility sure looks, walks, and quacks like a "technology, product, service, device, component, or part thereof, that is primarily designed or produced for the purpose of cicumventing a technological measure that effectively controls access" to a copyrighted work -- specifically, Microsoft Windows, and all the copyrighted stuff that's sitting around on all those Winders machines. Free Dmitry!

Check it out yourself

jared@pigdog.org