New Malware Report Hits Vista's Security Image 258
An anonymous reader recommends a Computerworld article on a new report from Australian security vendor PC Tools. The company released figures on malware detection by its ThreatFire product, and in its user base 27% of Vista machines were compromised by at least one instance of malware. From the article: "In total, Vista suffered 121,380 instances of malware from its 190,000 user base, a rate of malware detection per system [that] is proportionally lower than that of XP, which saw 1,319,144 malware infections from a user base of 1,297,828 machines, but it indicates a problem that is worse than Microsoft has been admitting to." Microsoft hasn't responded yet to this report.
What kind of malware? (Score:5, Insightful)
I would also like to see how many of these "infected" computers had UAC and automated updates turned off.
Looks like just another Vista bashing article (so it will no doubt be really popular here).
PR != Security (Score:5, Insightful)
Come again? Does anyone but Microsoft actually believe Vista has an "image" of better security?
Vista has one and only one major security-impacting feature - The "Train users to always click yes" interface to privilege escalation. And I feel confident saying that very, very few of us consider that a "good" thing.
Re:What kind of malware? (Score:5, Insightful)
He's entirely correct about the tracking cookie thing, every malware scanner I've used (apart from Windows Defender, I *think*) flags cookies as malware. My ex's new Vista laptop came with Norton pre-installed, and it flags a tracking cookie every time it runs (and only the cookie - so her laptop would possibly contribute to the report's number, despite being clean)
Re:the problem is combining ... (Score:5, Insightful)
I don't think that works as an excuse for Microsoft.
The trouble with that Windows is supposed to be the operating system of the common man. At least, every time Linux gets a cool feature, the Redmond apologists start roll out their hypothetical Joe Sixpacks and Great Aunt Mildreds and tell us how these ordinary people can never cope with Linux, but windows, focus-grouped to death as it is, has been designed for these exemplars of non-geekiness, and is therefore superior.
But that makes it kind of hard to blame bad security on the users. Windows is supposed to be designed with the click-on-the-dancing-monkey demographic in mind. They can't really throw their hands in the air and say "it's not us, it's the stupid users" without admitting that, really, they haven't a clue how to make a secure operating system.
They would, wouldn't they? (Score:5, Insightful)
Consider the source (Score:5, Insightful)
So a company that sells security software [pctools.com] puts out a press release to say that you still need to buy their software even if you run Vista. I can't think of a single ulterior motive that they might have to do this!
How many of the anti-virus companies don't issue doom-and-gloom style press releases? It is just their way of drumming up business. I would rely on these figures as much as I would rely of Microsoft's "research" that might suggest that Vista is completely immune to any security issue. The truth lies somewhere in between - which shouldn't surprise anybody.
And before anyone jumps down my throat, no Microsoft didn't says Vista was that perfect.
Re:Windows is basically a wrong architecture (Score:3, Insightful)
Some other commenter pointed out that being trained to clicking "Yes" was comparable to running everything as super doer. Rightly so. Do you know how tremendously difficult it is to convince Peter average user to have strong passwords, to keep user accounts and administrative accounts separate, and so on? As soon as he finds out how to run programs with administrative privileges, he'll stick to this new "freedom".
So is any other OS with an UI, because they require a user. The user is the problem.
While I agree, I do this because I think an operating system should have user accounts with no rights to install anything, and an administrative account without any GUI. Please explain Peter average user he has to use CLI to install/uninstall software. (This works with my Peters, because I manage their Linux workstations for free. But it won't work with most users.)
But still, the user has to install software on the system. Unfortunately, he wants to do so without any hassle.
Re:PR != Security (Score:5, Insightful)
In a social engineering attack where you download some program (malware) and run it -- the malware could spoof a UAC prompt -- if you are foolish enough to click "Allow", well, nothing really happens because the program didn't get elevated privileges (since it was a fake UAC prompt). In the sudo case, the equivalent level of foolishness has you entering your password instead of merely clicking "Allow". Result is that the malware has your password now, so it's basically Game Over.
Of course, this is probably a moot point because a better social engineering attack would actually do something causing a genuine UAC prompt (instead of bothering to spoof it). The level of foolishness required to click "Allow" is probably the same in both cases.
I guess where UAC becomes valuable is when an attacker has managed to exploit a hole, to execute code remotely without requiring you to fall foul of a social engineering attack. This way you know you haven't done anything to deserve the UAC prompt that just popped up, so you know that you should click "Deny" here. This might still fail to protect users that have absolutely no clue, but honestly they shouldn't be running an admin account anyway (and hence should not be able to elevate a process).
Big Impact on Opinions (Score:4, Insightful)
Instead of "obnoxious security" as highlighted by the apple commercial [apple.com], now we have "less effective than advertised obnoxious security that's still better than XP."
Can we possibly bring ourselves to acknowledge that M$ actually brought about an improvement in PC security? It shouldn't hurt too much since it appears to be verifiable.
Re:What kind of malware? (Score:5, Insightful)
If I download and install the cool icons for my IM client and malware comes along for the ride, is it Vista's fault that it allowed me to install it?
As far as I know, all MSFT has claimed is that Vista is more secure than XP, not that it is immune from malware.
There's nothing that an OS vendor can do to protect the user from their own actions.
Re:PR != Security (Score:3, Insightful)
I have no trouble with my OS X, BSD, or Linux software installs affecting security. Heck, I know some MS users who have no trouble with that.
So I guess it's like driving. Everyone thinks they can do it, but in fact maybe one in five of us can actually do it without causing problems. So incompetent people wreck their cars and have problems with the computer. Big deal. Besides, there's lots of money in that.
Re:What kind of malware? (Score:4, Insightful)
This is key. Any OS which can run 3rd party code is vulnerable to malware. Whether the damage is restricted to the single running user or can damage anything the OS allows it to, software written for the express purpose of breaking something will work correctly given the right privileges.
So it doesn't matter if you're on Mac, Windows, or Unix, if you run code that is intent on deleting something and you give it the right permissions, it will do it.
There are various levels of protection you can offer here.
0. Let the malicious code run wild without any permission barriers
1. Run the malicious code as root
2. Run the malicious code as current user
3. Run the malicious code as special unprivileged user
4. Run the malicious code for privileged APIs and stop the malicious code on unprivileged APIs
5. Run the malicious code in a sandbox
6. Run only "signed" code
7. Do not run non-preinstalled software
As the levels go higher, the more hassle it is for users to install new software. Obviously we don't want to go back to DOS and level 0. And we've seen what happens when we run with level 1 restrictions. Running code at level 2 is a possibility, but it also leaves the user open to localized damage, specifically damage to their own accounts and data.
Microsoft decided that for their systems, a compromise between level 2 and level 1 was necessary. And in order to do anything to the system as a whole, UAC was implemented to request a means to elevate user privileges temporarily.
It's an ugly, annoying dialog, but what is the alternative? If you (the general 'you') think that another system does this better, in what ways specifically do you feel the system provides an adequate amount of protection and flexibility?
Re:PR != Security (Score:5, Insightful)
Key difference - Using sudo represents an active request by the user for privilege escalation. Telling UAC to continue approves apassive request that the user might not actually have made (or known they made). When enough of them pop up at random times, it conditions the user to just say okay to make it go away - By comparison, no one would ever just randomly sudo a command for the hell of it.
Oh no, now you've done it (Score:3, Insightful)
Vista isn't great and was overhyped, but it's not nearly as bad as most people here seem to think. I'd hazard that the loudest critics haven't even used it.
Well (Score:2, Insightful)
Al these prompts and other crap, it's useless. It's just to "make you feel secure" and "annoy the hell out of you". Effectiveness is ZERO.
I saw it coming (Score:2, Insightful)
I'm a windows savvy user, and I've never had problems with viruses or malware, mostly because I know when to make sure what I'm about to run isn't malware.
That means I know generally what's already in my computer, and when I'm about to install or run something new, I either know it's from a legitimate source, and thus don't worry about it, or I scan the file before using it.
that's why I applaud things like the firefox virusscanner, it's actually combating the risk of infection at the point-of-entry rather than scanning everything all the time, over and over and over again, and hogging your resources while it's at it. In this regard, current virus software only helps when you've already gotten a virus and you need to clean it, which in my opinion is too late. the solution should be at the point of entry.
It's also why I hate UAC, UAC doesn't help people to understand where the point of entry of malware is, and it only teaches people to click yes to everything, or to google how to disable it.
Re:100% of Vista machines affected with malware (Score:5, Insightful)
Re:the problem is combining ... (Score:3, Insightful)
And that, my friends... (Score:5, Insightful)
-- Posted from my Vista machine
Re:What kind of malware? (Score:4, Insightful)
But the point is, if HP puts it there when you buy the computer (and yes I'm calling out HP by name: my HP laptop had orders of magnitude more of that shit installed than any Dell I've ever bought), the user's not going to remove it unless they're pretty technical. And technical users probably aren't running this anti-spyware tool, anyway. So suddenly every single HP PC sold it marked as having spyware, giving their numbers a huge boost.
Of course it complicates things, seeing as Wild Tangent is actually spyware. But you can't necessarily blame the user for it being on there, and you certainly can't blame Microsoft if their OEMs pre-load spyware on the machines. In this case, it would say absolutely nothing about Windows security, since the OEM purposefully bypassed the security to load it on.
(Microsoft could try a campaign to get more control over what software is shipped with Windows computers, and then you could watch Slashdot go crazy about how evil they are. It's a no-win for them.)
P.S. Why the hell is HP still in business? Their computers are loaded to the gills with so much crap that they take 3 hours to boot the first time (I wish that was an exaggeration!). And when you put in the Windows CD to restore a clean system, HP slipstreamed the crap on the Windows CD too! And these guys are selling more computers than Dell? Do customers just like abuse?
Re:What kind of malware? (Score:4, Insightful)
Re:What kind of malware? (Score:2, Insightful)
Funny that you say this. Too many times on Slashdot I see people saying, "So-and-so company took that technical idea from someone else." However, just like art, no technology is ever created in a vacuum either...
Re:What kind of malware? (Score:3, Insightful)
That said, Microsoft has a history of trying to prevent competition by restricting what can be installed by OEMs. Remember the Netscape debacle? So there's a very good reason to be concerned if they tried to do this again, even if there were good intentions.
Ultimately, it's difficult to determine whether malware got onto the machine by the OEM, through phishing (which isn't easily stopped by the OS), or through a vulnerability. This is something I've alluded to before (that a high percentage of current Windows malware is almost certainly phishing), but I always get modded down for not flaming Windows.
Re:the problem is combining ... (Score:3, Insightful)
Linux suffers the same kind of mentality, but in a difference direction. Desktop Linux is designed for it's user base, which is programmers, network admins, and more technically inclined users. They find, on the whole, "Linux" (insert favorite distribution here) to be on par with Windows. From their point of view, they are right. My mother would highly disagree. When it comes to generic operating system environments, Linux has a STRONG advantage. The level of customization possible due to the availability of the source has allowed manufactures to created smaller integrated products that are easy to use, but generally trade a degree of functionality for that (Nokia and Asus come immediately to mind)
OS X is designed for environments where administration cost is a very big concern and for people doing design work. On the whole, Apple ignores a large part of the development community and relies on making tools that encourage specific practices. This is done under the philosophy that any developer that wants more Windows like dev environment will just end up messing up OS X, via the user and this will reflect poorly on Apple. Hence their reportedly large market share on the home user market, "it just works" when compared to its competitors is a valid comparison. Because of how they treat developers, their market will never grow outside of it's established core base.
Re:Self-selection bias? (Score:3, Insightful)
But people continuously slam Windows for being insecure while touting OS X and Linux as secure alternatives. Secure? Sure, the code is good and secure, but there's no patch for gullibility.
I suggest the possibility that there are simply other factors that account for the almost total lack of malware on these systems.
First and foremost (and to get it out of the way, because it's so commonly presented) is the market share--virus writers want their viruses to run, so they target the largest markets.
Second is user education. Even with Ubuntu bringing Linux to the common man, the vast majority of Linux users are more knowledgeable about computers, and will not be as likely to fall for trojan traps. While the same cannot necessarily be said about OS X, both Linux and OS X have a history of better security architecture, which means that most operations do not require any sort of administrative access. While malware can run without administrative access, it's much harder to hide. Antivirus running as administrator will easily detect malware running as a user, and because of the history of these two operating systems (not needing administrative privileges that often) it's going to be harder to trick the user into giving up his password. That's not to say that it's impossible--and certainly there isn't a push to use antivirus on these systems anyway, but it would ultimately be a losing battle for malware authors even if the marketshare situation were different.
The upshot of all of this is that I think that if some magic happened and all Windows installations were turned into Linux installations overnight, malware authors would start targeting Linux, and the new (and largely uneducated) Linux users would fall prey just as easily, despite what OS X and Linux fans would have you believe (that somehow using the OS inherently makes you more secure.)
Of course, I'll probably be modded down into oblivion, as a troll, or flamebait, or just as overrated, but I've never seen someone post a valid counter-argument to this type of post.
Re:What kind of malware? (Score:3, Insightful)
Why the hell not? As somebody else pointed out, MS was able to force OEMs not to install Netscape and other media players. Its in MS's best interests to stop OEMs adding crapware to PCs as it harms their image. They could easily force this by threatening to stop advantageous pricing for OEMs that do install bad software. I realise that most OEMs & system builders operate on very small margins to any extra money they get from adding the crapware is income but installing the crap hurts their image as well as Microsoft's.
It wouldn't be hard for MS to start a 'crapware free' programme like all the Vista Ready stuff they seem to do. It might get lost among all the dozens of other stickers that get plastered all over PCs these days but as more and more people are victims of identity theft & other security issues they will begin to look for these kinds of things.. or try other operating systems that are perceived to be safer.
Re:What kind of malware? (Score:3, Insightful)
Got a Trojan called Velemonde or something like that. Nasty bugger. Took hours to get rid of it (if I even did, popups stopped anyway).
However I am pretty sure it wasn't vista's fault. A more likely scenario is that when I passed out from a hard nights drinking my idiot friends that crashed the night before decided to go on the internets to some dubious websites and download everything and then run everything.
Am I going to go out and get Norton or something like that? No, I am going to set a password, and tell my friends to %$^@! off when they want access (at least when I am not there watching).
Just because you know where to go, what to download and what not to, and particularly what to run and not run, doesn't mean people that access your computer do.
I was not a happy camper yesterday. Not only did I get hosed with the Trojan, but when fixing it I did a System Restore which then nerfed my WOW install and wouldn't allow yesterdays patch... Which took almost as long to fix... what a pain in the ass.
Anyway moral of the story is no anti-virus software can protect you from drunken idiot friends.