There were rumors that the NT kernel was originally called Mica at DEC and that the code was in fact brought bodily to Microsoft, having been originally designed to be a VMS followon. If that is true you could say that the security design was in fact that of VMS V1, which dates from about 1975, old enough to qualify. There was an ARPAnet before there was an Internet. I recall seeing THAT around that time frame but it was considered amazing to be able to telnet cross country at all then, so people didn't worry too much about fancy security. Remember the flow problems with the imps? Just getting things working at all was issue enough.
-----Original Message----- From: Ng, Kenneth (US) [mailto:[EMAIL PROTECTED] Sent: Friday, February 27, 2004 8:46 AM To: [EMAIL PROTECTED] Subject: RE: [Full-Disclosure] And how long have buffer overflows been around? What quantum universe is this guy coming from? I don't know the start of the internet, but the date on the telnet RFC 318 is April 3, 1972 ( http://www.faqs.org/rfcs/rfc318.html ) According to Microsoft's own time line ( http://www.microsoft.com/windows/WinHistoryProGraphic.mspx ) Windows NT started in 1993. Maybe they consider the start of the internet in Al Gore terms? -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Edward W. Ray Sent: Thursday, February 26, 2004 7:51 PM To: [EMAIL PROTECTED] Subject: [Full-Disclosure] And how long have buffer overflows been around? A lot longer than just before Windows 2003 release, but not according to Security Architect and Chief Technology Officer of Microsoft's Security Business Unit David Aucsmith: "Windows 95 was written without a single security feature, he said, as it was designed to be totally open to let users connect to other systems. Furthermore, the security kernel of the Windows NT server software was written before the Internet, and the Windows Server 2003 software was written before buffer overflows became a frequent target of recent attacks..." The rest of the article can be found at http://www.infoworld.com/article/04/02/24/HNunderattack_1.html A little levity for today's discussion. Edward W. Ray _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html ***************************************************************************** The information in this email is confidential and may be legally privileged. It is intended solely for the addressee. Access to this email by anyone else is unauthorized. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful. When addressed to our clients any opinions or advice contained in this email are subject to the terms and conditions expressed in the governing KPMG client engagement letter. ***************************************************************************** _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html ********************************************************************** This transmission may contain information that is privileged, confidential and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is STRICTLY PROHIBITED. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format. Thank you ********************************************************************** _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
