Related Chapters:

• Chapter 5: Attacking and Defending Windows 2000

Introduction

During his keynote speech at Comdex 2001, Larry Ellison, CEO of Oracle, made the broad statement that his database technology, Oracle 9i, was "unbreakable." Mr. Ellison then went on to say that users could "keep their Microsoft Outlook and we will make it unbreakable; and unbreakable means you can't break it, and you can't break in." Later on in his presentation, he went to talk about the significant resources had been spent and focused on research and development and security defenses within the database code itself in addition to its revamped clustering capability. Soon after, David Litchfield, a database security expert, announced that he had found numerous bugs in Oracle thereby allowing him to add an administrative account remotely in an unauthorized manner. What does this tell you? Nothing is "unbreakable," and don't ever challenge the hacker community.

Another example of a gutsy initiative that had an opposite outcome was Bill Gates's XP statement. In cooperation with his marketing executives, Gates stated that "Microsoft Windows XP is Microsoft's most secure operating system, ever." Soon after the declaration, vulnerabilities in Windows XP were discovered. According to statistics from the annual CSI/FBI Computer Crime Surveys, when measured by frequency of vulnerabilities and release time, XP doesn't even come close to the few initial bugs released for Windows 3.1. The point:...