In Test, Windows 7 Vulnerable To 8 Out of 10 Viruses 843
As Windows 7's market share passes 3.6%, up from 1.9% the day before launch,
llManDrakell notes an experiment they did over at Sophos. They installed Windows 7 on a clean machine — with no anti-virus protection — with User Access Control in its default configuration. They threw at it the next 10 virus/worm samples that came in the door. Seven of them ran; UAC stopped only one baddie that had run in the absense of UAC. "Lesson learned? You still need to run anti-virus on Windows 7."
Not suprising (Score:3, Informative)
For one, they watered down UAC. Second, UAC won't do anything if the virus simply attaches itself to your user account, instead of the whole system. UAC is supposed to help keep malware gaining admin rights and infecting your system, not to stop it from running.
Re:Not News!! (Score:5, Informative)
Anyone who uses any computer (including Mac AND Linux) without anti-virus is asking for what they get.
Yep, I've been "asking for what I get", and getting what I ask for, by running Macs without anti-virus for almost 25 years now.
I use Avast Home Edition. It's free (just registration required), fast, and small-footprint.
Yeah, I'll pop that right onto my Macs, especially after reading these five-star reviews [cnet.com]. Five reviews with one star each makes five stars, right?
Re:Not suprising (Score:3, Informative)
For one, they watered down UAC
I did in fact RTFA, and they did NOT "water it down"; they ran it in its default configuration.
Actually, that is sort of news (Score:4, Informative)
Over the past 5 years, that's the only time I've ever run a virus check. It came up with 0 viruses. I conclude that the likelihood of me getting a virus on a mac is still small compared to my XP box, which every time I run a virus check flags *something* new as wrong/suspicious. Sometimes I can even tell if the something is innocuous or dangerous...
Slashdot likes to say that anecdotal evidence is meaningless (which of course it is), but when a sufficiently large collection of anecdotes all say the same thing, we call that consensus. The general consensus is (I believe) that Macs are a lot less likely to be infected than Windows boxes, so your 'Anyone who uses any computer (including Mac AND Linux) without anti-virus is asking for what they get' statement is in fact news to me.
Simon
Re:Not suprising (Score:2, Informative)
Testing Methodology (Score:0, Informative)
Re:Not suprising (Score:2, Informative)
Re:32 or 64? I guess 32 (Score:2, Informative)
Bullshit. Microsoft made the same claim when they made the switch from 16-bit to 32-bit - "Viruses will be a thing of the past." 64 bits is not "magic pixie dust" - it's just the size of a native integer or memory pointer on your cpu.
no, majorme is right... 64-bit does make a big difference since you're not allowed (even as an admin with elevated privileges) to run kernel level code that's unsigned. 64-bit Vista/Win7 is more resilient to malware than 32-bit Vista/Win7.
MS did by default (Score:4, Informative)
So in Vista, UAC had only two settings: On and off. When it was on the system functioned with real separate privileges. You had to escalate to perform administrative actions. Ok well people bitched and whined and bitched and whined about that since you had to do it for things like changing file permissions or accessing system control panels. Thus Microsoft relented and watered it down for 7, having two settings in between on and off. It is set to one of those by default. More or less it asks for permissions for a program trying to get admin access, but not a user initiated operation.
Re:Not News!! (Score:3, Informative)
Yeah? Can you point to ONE virus in the wild that has ever bitten any Mac or Linux user?
Yes, I know it's from 2006. But it answers your question: http://www.internetnews.com/dev-news/article.php/3601946 [internetnews.com]
Re:Not News!! (Score:5, Informative)
Re:Not News!! (Score:2, Informative)
Yeah? Can you point to ONE virus in the wild that has ever bitten any Mac or Linux user?
Well, here's one: Ramen [wikipedia.org]. Got that about 8 years ago when I was pretty inexperienced with Linux. I placed an unpatched RedHat system on the internet with no firewall, and picked up a worm and rootkit for my trouble.
There's actually a number of malware programs, worms, etc out there for linux:
Linux Malware [wikipedia.org]
There are bound to be people out there that have been bitten by these guys. Oh, and while my family members have gotten viruses on their windows machines, I never have. I don't even run anti-virus. I'm just a lot more careful now....
In Test, Kdawson Posted 10 out of 10 FUD Stories (Score:5, Informative)
Seriously, this guy is almost pathological in his determination to distribute as much FUD as possible about Windows.
Taco: Fire this retard. The stuff he posts is NOT news for nerds. It is thinly veiled, and ineffective, smear pieces. Real stories about OS problems are interesting. Kdawson's FUD isn't.
Re:Not News!! (Score:5, Informative)
When you have little or no say in what software gets selected for use but are required to maintain local support for the same software as well as maintain the security of the network, it is not a waste of time at all. You do not give users Admin privileges. You give them the permissions they require to do their job and no more. That's basic best practice.
It's really not even that difficult to figure out. Nine times out of ten, the program either wants to write to HKLM\Software\$appname or wants to write to two or three configuration or log files in %programfiles%\$appname. About a quarter of the time (IMX) the documentation contains detailed information about what permissions are necessary. After that it's merely a case of using the various SysInternals monitors to figure out what's causing the problem. Between Xcacls and regini it's not difficult at all to script the changes. I typically maintain a single script which checks for the presence of each application and, if found, applies the necessary permissions changes.
Re:Not News!! (Score:5, Informative)
Exactly.
From GP:
Well there go the vast majority of Windows viruses, too.
In fact, from the test they did...
- didn't run
Troj-Bredo-M
W32/Autorun-ATK
Troj/Banker-EUT
-- Ran
Troj/FakeAV-AFY
Mal/EncPk-KY
Mal/EncPk-KP
Troj/Agent-LIW
Troj/FakeAV-AFX
Troj/Zbot-JN
W32/Autorun-ATC
So 6/10 were definite Trojans (Troj/). I.e. some piece of software saying it's all sorts of good stuff, but in reality is a virus.
Then there's the Autoruns - last I knew, autorun, even on Vista, by default doesn't open a darn thing. So I guess either they changed Autorun settings, or they simply told Windows to run the program (a virus).
Lastly, the Mal/EncPk ones. They're deemed malware because they're packaging and encryption signatures that often get used by malware authors (even though they have legitimate uses, blabla). What do they envelop?
Mal/EncPk-KY: sadly sophos' site doesn't detail, but other sites will tell you that this, too, is a Trojan with Bredolab blargh.
Mal/EncPk-KP: "About this threat: The Trojan arrives as an attachment in fake e-card messages, with text as follows"
So that's 8/10 trojans, and 2/10 that might as well be classified as such unless I'm wholly mistaken about autorun.
Again GP:
That's the real issue - and one that applies to any operating system.
Not saying Windows isn't less secure.. on the other hand, I don't remember Microsoft suggesting that UAC was a 100% solution against viruses. Just against those that try to do admin-y things when you yourself aren't running as admin. That's usually the thing people point out with Linux "it can't infect the rest of the system". Well that's great - but that won't stop it from, for example, turning your machine into a spam zombie as long as the user is allowed to send e-mail.
Re:Not News!! (Score:3, Informative)
Please remember that the vast majority of hardware and peripherals are designed from the ground up to work with Windows and that most computers are sold with Windows preinstalled and preconfigured.
If you want a similar experience, I suggest buying a computer with Linux preinstalled and preconfigured. I recommend System76 [system76.com]
Re:MS did by default (Score:5, Informative)
That's why some things still require two steps. The 'first click' causes explorer (or whatever part of Windows you're dealing with) to automatically elevate and switch to a high integrity level. But since that click could have been injected by unprivileged malware, rather than an actual mouse click, the program then requires a 'second click' confirmation. Since it's running at a high integrity level now, that second click can only come from other high privilege programs or drivers. One special case is the UAC settings control panel... that places itself into a high integrity level immediately so that malware can't inject keystrokes to turn off UAC.
Re:Not News!! (Score:2, Informative)
Pro-tip: Windows security has changed a little in the 13 years since NT 4.0 was released.
Re:Not News!! (Score:2, Informative)
Yeah? Can you point to ONE virus in the wild that has ever bitten any Mac or Linux user?
I can't, but google can:
http://www.google.nl/search?q=linux+virus+in+the+wild [google.nl]
http://images.google.nl/search?q=osx+virus+in+the+wild [google.nl]
More than one, actually.
So yeah, thinking you're safe from virusses simply by using a different OS is still as stupid as it ever was.
newsflash... (Score:3, Informative)
Or you can just continue trolling. The choice is yours.
Re:Not News!! (Score:2, Informative)
And MS pays heavily in terms of $, time, and raw manpower to get hardware vendors to create Windows drivers. And MS creates their own generic drivers for millions of hardware devices.
What's your point?
Re:Not News!! (Score:5, Informative)
The funny thing is the article you cite doesn't mention any virus for Linux or OS X that is in the wild. It talks about malware, which it claims is increasing, but does not list any specific item. It doesn't say if any of the malware is a virus or if any of it is propagating in the wild. You've failed in that regard.
Re:Not News!! (Score:1, Informative)
So all those critical remote execution vulnerabilities that Microsoft patches every month are a figment of our imaginations?
Hell, anyone else remember when Windows machines started rebooting themselves due to an RPC exploit?
Re:Not News!! (Score:3, Informative)
Re:Not News!! (Score:2, Informative)
Re:Not News!! (Score:1, Informative)
Prettymuch the same story here. I consider myself to be fairly computer literate, and spent the last 3 years or so without getting any viruses on my machines. I knew what to avoid, knew how to sandbox anything questionable etc... and about a month ago I picked up a virus anyway. It's not that interesting of a story really, but the way I got infected may be of interest. The virus got on through a compromised advertisement on a torrent site. Now, normally I wouldn't get hit with such attacks since I'm wise enough to use firefox with Adblock Plus and Noscript. However, I unwittingly found out that the browser that Azureus uses for its "search" function provides no such protection. Hell, I didn't even know it used a browser interface for searching. I just clicked "search" and all of the sudden it switches to an in-app browser with ads flashing everywhere and Avast warnings popping up like back in the Win98SE days. I had been using Azureus (vuze) trouble-free for over a year at that point; I just hadn't used their search function before. A week of trying out various solutions failed to remove it and I ended up backing up everything and reformatting (installed the RC of win7 as replacement OS) to get rid of the thing (installed utorrent instead of Azureus).
Captcha: plotted
Re:Not News!! (Score:5, Informative)
Been running AVG for years, but ever since I installed SE it's caught shit in video files before they've even finished downloading. As well as a couple JavaScript attacks from websites I wouldn't think twice about visiting. I can't even remember the last threat AVG found aside from cookies.
Re:May require admin privileges anyway (Score:5, Informative)
So you are somewhat right, but mostly wrong. Malware could trick a trusted program into bypassing UAC and autoelevating, but after elevation the malware won't be able to interact with the trusted program anymore. And since all the trusted programs require a second user interaction before doing anything after elevation, tricking a part of Windows into auto-elevating doesn't help malware at all.
Re:Why blacklist instead of whitelist? (Score:3, Informative)
The facilities are there, in Windows registry and group policy for instance (Software restriction policy, I believe it is called). Some networks might even use those settings, but in general it's FAR FAR too much hassle (especially for a home user). Some software firewalls even work this way already too - I know that pay-for versions of ZoneAlarm come with signature checking of the most popular apps and allow users to black/white list them from accessing the Internet/local network.
The problem is that people would still authorise the same crap as they do now to run because they just click yes when they see a security dialog. And every time that software is updated (as specified by good network practice), you have to update all the signatures again (and query the user again, who gets bored/annoyed and just keeps clicking Yes). And most viruses on home machines are because people *chose* to run a program that they didn't know the origin of, either by downloading, clicking I Agree or turning their security settings off. And viruses still get through program exploits (macro viruses would be one old example - they appear to be Microsoft Word, which would obviously be "allowed" on the whitelist).
Also most "whitelists" can usually be hacked / added to by the virus itself if it gains the permissions of the user (how else would the user authorise it to run?) so they again become useless. There are ways around this but they all annoy the user.
Basically, either these schemes stop everything working (and users cry foul every time they want to run something new or update their software) or throw so many "Do you want to allow this?" dialogs at the user that they quickly disable it or just click Yes to everything when they want run their spiffy new download from disreputable sites.
Network admins find it far too much hassle to exercise this level of control because of the problems it can cause (basically, users want to be able to run arbitrary code under their user accounts).
The problem is not viruses, or the whitelist/blacklist, the problem is providing glaring holes in the OS, running as administrator (or making privilege escalation trivial) and running programs that you don't know the origin of. Stop those three things (the easiest of which is just to stop people wanting to run every program they download) and you stop the problem of computer viruses. Whitelists just make that a little trickier, but always provide an avenue to either bypass the whitelist (by the program itself inserting itself into the list, like Windows Firewall allows in some Windows versions) or piss the user off with so many dialogs that they turn the security off / click Yes to everything each time (Windows UAC).
Re:Missing the point of the article (Score:3, Informative)
I could write a virus attached to an executable that deleted your favorites file or all of the documents in your user's document folders. This would still be a nasty virus and would not be classified as an administrative activity, thus not triggering UAC. This would not indicate any flaw in the OS or it's level of security. This is no different from any other platform, running as admin or not, if you run untrusted code, it will be able to do anything your logged in user can do.
It's not a virus if it doesn't replicate, it's a Trojan. Virii often using administrative functions and/or OS bugs to spread and hide. UAC should at least make some difference but it's unclear if it makes any.
Re:NEWSFLASH! (Score:3, Informative)
A machine without AV is vulnerable to viruses!
News at 11!
Talk about a useless piece of FUD...
My Linux, Solaris, HP-UX, and OpenBSD machines don't run antivirus software. Yet they have never had a virus.
It's not the 'machine' that gets the virus, it's the badly written operating system.
Lesson learned? (Score:3, Informative)
"Lesson learned? You still need to run anti-virus on Windows 7."
Or you could start by turning up the UAC level.
People complain that UAC in Vista was too intrusive, so MS turned it down by default. Now people are complaining that it doesn't do enough.
Re:Not News!! (Score:4, Informative)
Re:MS did by default (Score:3, Informative)
Also, on this topic...
http://www.istartedsomething.com/20090611/uac-in-windows-7-still-broken-microsoft-wont-fix-code-injection-vulnerability/ [istartedsomething.com]
You can elevate arbitrary code in Windows 7 to admin privileges with the Windows 7 default settings, no UAC questions asked, and MS won't fix that.
But UAC works perfectly fine at frustrating me! (Score:3, Informative)
Just recently had to edit the Host file. (Local DNS file).
Could not save it because of UAC, and didn't get a UAC prompt either, had to give up and disable UAC first.
Re:Firewall? (Score:5, Informative)
The things "non-admin" stops are the important things, like installing drivers, installing rootkits, installing LSPs, hooking system files, patching system files, etc etc etc. THOSE are all that matters. If you have a computer set up for the family to use with a non admin account (on XP), the point isnt that you think itll prevent them from getting crapware, its that the crapware wont affect other parts of the system (hopefully).
Its also a hell of a lot easier to remove viruses installed with non-admin priveleges-- the difference is night and day. Non admin viruses usually just stick a single entry (maybe 2) in the startup list, and SysInternals Autoruns or HijackThis cleans that in about 15 seconds. Admin-installed viruses tend to take on the order of 15-30 minutes of manual removal, or booting into linux, or running combofix, or some combination of the 3, and if you screw up once and miss a file the whole thing reinstalls.
FWIW Im an IT consultant (part of my job is helpdesk) and I have yet to deal with a nasty virus / rootkit on Vista. XP on the other hand, I've seen viruses that took 45 minutes to remove even with tools like SDFix, the SysInternals suite, and launching ubuntu to manually remove the infected DLLs sorting by date.
And in other news . . . (Score:3, Informative)
You still need seat belts in cars with airbags, fire departments for neighborhoods with fire resistant code compliance, and ambulances even if a doctor lives next door.
I mean, really . . . this is stupid.
Re:Missing the point of the article (Score:3, Informative)
Valid point but......the plural of virus is viruses. No need to capitalize trojan either, unless you're referring specifically to The Trojan Horse or the brand of condom.
http://en.wikipedia.org/wiki/Plural_form_of_words_ending_in_-us#Virus [wikipedia.org]
why is this news though? (Score:3, Informative)
Re:I'm shocked! (Score:3, Informative)
Depends on what you mean by "self propagating"? There are a number that run on macs with MS office. There were quite a few for OS9 and earlier.
Ah... Found a few references for os x virus's.
http://www.sophos.com/virusinfo/analyses/osxleapa.html [sophos.com] (spreads via ichat)
http://www.sophos.com/virusinfo/analyses/osxinqtanaa.html [sophos.com] (spreads automatically via bluetooth)
http://www.sophos.com/virusinfo/analyses/shrenepoa.html [sophos.com] (spreads to other macs on the same network)
http://www.sophos.com/virusinfo/analyses/osxinqtanab.html [sophos.com] (spreads automatically via bluetooth)
http://www.sophos.com/virusinfo/analyses/macamphimixa.html [sophos.com] (spreads as an mp3 file)
Re:More data needed (Score:3, Informative)
And another thing the "article" (and by "article" I mean "infomercial") didn't mention was how many of those malware apps successfully *infected* the machine.
Out of the 10, 2 threw an error and crashed, 8 "ran". Whats his criteria for "ran". I'm betting that means "didn't crash and burn horribly with an error message shown to the user."
I looked up the details on the first virus sophos listed (troj/fakeAV) here [ca.com] and apparently one of its actions is to add a link to the all users start menu folder here:
%Documents and Settings%\All Users\Start Menu\Programs\XP_Antispyware\Uninstall.lnk
I know for a fact you can't write to this folder without UAC elevation on vista/7, so I'd say it is more likely than not that when the malware ran it tried to write to this folder, failed, and *caught the exception*. The machine was NOT infected.
I'm not going to check each of the 8 malware apps he ran "successfully" but I'd be surprised if any of them were able to "infect" the pc in any meaninful way with UAC enabled, or if the user was running as non-admin.
In other words 8/10 malware apps are probably well written enough to have some sort of error handling that eats any errors that may occour without alerting the user.
Re:MS did by default (Score:3, Informative)
The Mac threat is non-zero but overblown. (Score:4, Informative)
Hitting Google is apparently easier than doing research. I went through the articles on your "osx+virus+in+the+wild" link, and what I found on the first pages was...
None of these (except possibly Inqtana-A) would be a threat to semi-competent users, and the only article that isn't from 2006 is the garbled wiki page.
Now if you want some actual research on Mac OS X viruses, you can check a vendor's site:
http://www.sophos.com/security/analyses/viruses-and-spyware/search-results/?search=OSX&action=search&x=0&y=0 [sophos.com]
Interestingly, what the site won't tell you is that most (if not all) of these viruses are phantom menaces; you have to Google each one yourself for that kind of detail. Many are proof-of-concept never seen in the wild, and most exploit holes already patched in the OS. All are trojans that require serious PEBKAC to run, even the only two known "worms" for the plantform -- Inqtana and Tored.
Inqtana [macworld.com], a virus one that got some notoriety and media attention is an example of all three -- a proof of concept (with an expiration date) that attacked an old hole in the Bluetooth stack and which required victims to consent to accept the download from an infected machine. Tored [ca.com] was an email worm that required you to execute an attachment on a very stupid looking spam email payload. Both are basically glorified trojans -- nothing on par with Conficker.
Now, trojans aren't complete non-issues, but savvy computer users currently have very little to fear from running a Mac w/o AV software since there are currently no self-instantiating viruses for the platform in the wild. Don't download pirated software (and risk something like iWorkS which hides itself in installers for certain programs), and don't trust installers where none should be present.
Re:High quality! (Score:0, Informative)