Russinovich Says, Expect Vista Malware 193
Hypertwist writes "Despite all the anti-malware roadblocks built into Windows Vista, Microsoft technical fellow Mark Russinovich is lowering the security expectations, warning that viruses, password-stealing Trojans, and rootkits will continue to thrive as malware authors adapt to the new operating system. Even in a standard user world, he stressed that malware can still read all the user's data; can still hide with user-mode rootkits; and can still control which applications (anti-virus scanners) the user can access. From the article: '"We'll see malware developing its own elevation techniques," Russinovich said. He demonstrated a social engineering attack scenario where a fake elevation prompt can be used to trick users into clicking "allow" to give elevated rights to a malicious file.'
Actually (Score:5, Funny)
Re:Actually (Score:5, Interesting)
(I was slightly confused by the statement that programs "can still hide with user-mode rootkits", though -- surely if a rootkit is running with LUA privs, it wouldn't be able to hide itself? I thought the whole point of a rootkit was that it allows malicious programs to maintain root (i.e. highest privilege) access undetected, which would make "user-mode rootkit" a bit of a contradiction in terms, unless I'm misunderstanding somewhere...?)
(And whilst I'm posting, "...a social engineering attack scenario where a fake elevation prompt can be used to trick users into clicking "allow" to give elevated rights to a malicious file"? If it's a prompt that will give a malicious program elevated rights when the user clicks 'allow', what part of it is fake? Surely a fake/spoofed dialogue box wouldn't *actually* be able to grant elevated rights (pretty much by definition); and the text in the *real* elevation prompts can't be changed, since they run in 'secure desktop' sandbox mode, no?)
Re: (Score:3, Insightful)
The GP was being extremely sarcastic. I'm sure most of the people who read this summary, or even just the title, thought "Duh" and wondered why an expert like Russinovich didn't have anything more insightful to say.
> "surely if a rootkit is running with LUA privs, it wouldn't be able to hide itself?"
Well it wouldn't be able to hide itself from the root
Re: (Score:2)
Re: (Score:2, Informative)
"User-mode" usually refers to everything other than the kernel. N
Re: (Score:2, Informative)
As long as people literally refuse to learn anything more than the bare minimum necessary to quickly read their email, nothing will change, especially with totally incompetent systems like windows vista, which is qu
Re: (Score:3, Insightful)
Even if you know almost nothing a about your car, you certainly know when something wrong is with your engine. I've seen people do things with computers that would roughly be equivalent to driving with the engine on fire. Not only people don't bother to learn the most basic things about computers, they also ignore any problems they see and keep going like nothing is happening.
Using a co
Re:Actually (Score:5, Interesting)
Too bad there are lazy software companies pulling this kind of shit [chessok.com]. The developer's link to this piece of shit "patch" is listed under the headline "Convekta's products are compatible with Windows Vista !!!" (just disable the single most important security feature of the OS). I'd bet that over half of all Vista boxes will have LUA disabled within 12 months of installation. What do you have then? A new OS with the security enhancements removed and untested code running in "every user is a superuser" mode, just like XP without the 6 years of bugfixes. Don't tell me XP has limited accounts; using XP under a limited account takes more effort than using Linux ever did.
The only thing keeping the malware writers away from Vista so far is its piss-poor market penetration, not its security enhancements.
Re: (Score:2)
Re: (Score:3, Interesting)
Re: (Score:3, Insightful)
By definition, the user base of Windose will always wallow in mediocrity. Microsoft needs to take responsiblity for this, if it wants to dominate the OS marketplace.
"Wants to dominate" ? What _have_ they been doing then ?
I think that MS missed their opportunity to make Vista really secure. They could have developed a brand new API, and sandboxed the old API in a virtual machine environment, to maintain backwards compatibility.
Way, way too many negative tradeoffs. 99% of software would not be native a
Re: (Score:2)
Sure, they don't have any excuse, but MS lets them get away with it, simply because badly designed software will still work.
That's because they don't have any practical way of stopping them. Anything that doesn't involve "force" is a waste of time, because it is easily ignored. Anything that does involve "force" is an antitrust violation.
Fundamentally, it is the application vendors who beat the drum. The operating system is the chicken of the software world - it's just there to carry the flavoursome s
Re: (Score:2)
it is the application vendors who beat the drum. The operating system is the chicken of the software world - it's just there to carry the flavoursome software that the end user actually wants
And these days Microsoft is the single most important application vendor out there. Microsoft Office is the only "must have" application for the average home user. And MS is doing a lot of work to make sure that ISVs and competitors are left in the dust with Office2007's totally new UI that is not part of .NET and not
Security through obscurity (Score:5, Funny)
Re: (Score:3, Interesting)
Re: (Score:3, Funny)
Re: (Score:3, Funny)
IBM would probably take custody of it after their partnership with Microsoft dissolved, and it would become the OS of choice for ATMs and financial workstations for years to come.
Free screensaver !! (Score:2, Insightful)
just click on setup.exe and you can have this fantastic free screensaver, be the envy of your friends !
Re: (Score:2)
Well, no shit (Score:5, Funny)
The "anti" strikes again. (Score:2, Funny)
Good thing geeks are anti-social.
Vista malware (Score:5, Funny)
Smilies (Score:5, Funny)
And ... ? (Score:5, Interesting)
Where's the clean boot disk that I can use to scan a Vista box? How do I validate all the files on it?
What is your answer to AFTER the box has been cracked?
Re: (Score:2, Interesting)
Nuke it from orbit, reinstall.
The only difference is the hope they don't deny your registration after doing that too many times.
I suppose they could have a "Boot from CD and validate" option, but, because of subsequent system changes as the user installs drivers and other legitimate software (which could still include bogus stuff), it would probably be tricky to implement except for a few key system files that don't (or sho
Re: (Score:2)
I kno
Not necessarily. (Score:5, Interesting)
Then I simply match each and every file on the hard drive to the package that it should have come from and validate the md5 checksum.
Any file that is NOT accounted is suspect and can be individually evaluated. Most of them should be data files that are not executable.
Remember, in Linux, everything is a file and the boot process is very clearly defined. If something is running on your machine, you can find what it is and why it is running.
Any system that REQUIRES a complete tear down after ANY vulnerability is exploited is NOT a well designed system. There has to be a way to validate each section of the system.
Re: (Score:2, Interesting)
Read what I had posted, okay? (Score:5, Insightful)
I had already addressed that.
I had said:
"Any file that is NOT accounted is suspect and can be individually evaluated. Most of them should be data files that are not executable."
Again, you should be able to automatically validate the system files, then you manually check the others. Those others include the config files, user files and so on.
If that were correct than your newly installed box would be cracked as soon as those user files were restored.
And, yes, they will need to be restored.
So, in EITHER case those files will have to checked for "all things evil".
But in my scenario, the box is validated FASTER and you can identify the files that were added/replaced.
More importantly, you can validate whether the box WAS compromised.
I take it that you don't work on Linux boxes much.
There are a finite number of files on the box. And EVERYTHING is a file.
The more of them that you can automatically validate, the smaller the number of files that you have to search through. This isn't magic. It's something called "Computer Science".
In your scenario, you rebuild the box, restore the users' files
Re: (Score:2)
Re: (Score:2, Insightful)
As much as moving to a binary patch system would save bandwidth, I find the
Re: (Score:2)
Flash BIOS exploits (Score:2)
Something I'm suprised doesn't actually happen more often.
But even if it ever does, I'm as ready as I can be for it. I write protect the BIOS whereever possible and it is usually possible.
I really like the Gigabyte DualBios feature as well, for a belt & suspenders approach. You can't write the BIOS without keyboard intervention during POST and even IF you screw up or opt to enable writes (I guess the Windoze folk prefer the GUI update util) you
Re: (Score:3, Interesting)
Re: (Score:2)
Re:And ... ? (Score:5, Insightful)
Re: (Score:3, Insightful)
Re: (Score:3, Funny)
Re: (Score:2)
Your duct tape has been hacked. Duct tape does not come in blue. The blue tape is masking tape for painting. Yes, it does stick very goodly...but by that fact alone it is not duct tape. Real duct tape is gray or silver and DOES NOT stick nearly as goodly to some surfaces.
Re: (Score:2)
It's more likely to be electrical insulating tape. Masking tape is usually made of paper, and isn't particularly sticky because it's manufactured for easy removal after painting without leaving adhesive on the surfaces it was applied to.
Re: (Score:2, Funny)
Re: (Score:2, Informative)
Link [theregister.co.uk]
The height of stupidity from Microsoft.
Will they be able to top it?
Well, I for one (Score:2)
Duh! (Score:5, Funny)
Malware writers will write malware for the latest OS? And they'll try and find ways around the blocks? And in the millions of lines of code, they'll find a weakness and succeed? Holy shit, I never would have guessed!!
Seriously, sometimes when I read Slashdot, a small part of my brain cries out in pain, and then is silent forever.
Re:Duh! (Score:5, Funny)
This was only the first in a sequence of articles, the next being "Hackers can break into unsecured wireless routers."
The Jedis are going to feel this one.
Re: (Score:2)
Malware writers will write malware for the latest OS? And they'll try and find ways around the blocks? And in the millions of lines of code, they'll find a weakness and succeed? Holy shit, I never would have guessed!!
The only "weakness" the majority of malware succeeds against is the weakness of the user to do whatever it asks them to so they can watch porn, get new smileys, win an ipod, etc.
Uuuuhh? I thought... (Score:2)
Re: (Score:2)
Hey, Russinovich (Score:3, Insightful)
Standard plug-in joke #3: (Score:4, Funny)
Re: (Score:2)
Is it me or is something wrong with the world when the punchline of the "in Soviet Russia" jokes is not in the "in Soviet Russia" line?
An Expected Approach (Score:5, Insightful)
That is the scenario I have been envisioning since I first installed RC1. Microsoft is conditioning users to agree to about anything by having so many intrusive pop-ups. People just want to get on with their computing experience. Maybe they will read the warning a few times at first, but after a short while they just respond without reading because that is how they get to the next step. Of course malware writers will use this method, it is almost as if Microsoft has given them a gift.
Re: (Score:2)
Re: (Score:2)
Basically, the behavior you are seeing is that you are taking a shortcut and running as root all the time. Any time you actually need to be an admin it'll ask for your permission, but not require a password, since you already
Re: (Score:2)
However, I assume that in a sane environment, the user should be asked when it install software ( at least the one that register some system-wide stuff - which is pretty much everything in windows world ), change firewall/antivir settings, network config,... unless it runs in administrative mode of course
When people talk about confirmation box, I suppose they run in user mode where that makes sense to elevate a process priviledge when running 'admin' stu
Re: (Score:2)
Many of my son's games only run correctly when you are logged in as an administrator (under XP, not Vista). I assume that he'd need to enter a password or click OK to make them work under Vista.
Utilities like Net Stumbler require administrative rights to run properly under Vista.
One of the language training programs at a school that I support requires admi
Re: (Score:2)
Maybe there's a good reason why these programs need administrative access, maybe not...but they need it. And under Vista you'll be prompted.
Sorry, but that's just wrong. Pretty much everything that "needs" admin rights in XP does so because the app wants write access to either the systemwide branch of the registry (i.e. HKLM) rather than current user branch, or, more often, their own folder in \Program files rather than \appdata in the current user's home folder (ini files etc.). Neither of these will need admin privs in Vista due to file & registry virtualization, which redirects writes (and subsequent reads) to a per-user location with
Re: (Score:2)
Re: (Score:2)
Re: (Score:2, Insightful)
Instead of making a better, more secure OS, they just shifted the culpability for weak security to the user.
Re: (Score:2)
By making it the user's responsibility to approve/disapprove just about every freakin' thing that runs on the Vista box, they can then go back and say "Gee, too bad you got that virus/spyware/malware infection, but it's not our fault, you clicked Allow".
I've seen this comment quite a few times on Slashdot, and it continues to be completely senseless. Someone has to decide whether any particular piece of software is permitted to be installed. Either it's you, or its Microsoft. If you'd be happy for Microsoft to decide for you what programs you're allowed to install on your own computer, if you'd be happy to download and run a program only for a prompt to say "Sorry, Microsoft has forbidden the installation of this program on Windows PCs", if you'd be ha
Insecure, yes... (Score:2)
Why is this news? (Score:2)
I had a bit of a disagreement with a client today over spam on her computer. She freaks out if there is more than one in her inbox. Every time I am at her machine she has webshots or smily cent
Unix-style permissions are not enough. (Score:5, Interesting)
There is a solution to the problem, but it requires a deep rooted change in how things are done. What I propose is that we shift from permissions by user to permissions by application. Right now, any app that my user launches can erase any of my files. That's ridiculous! Much more logical would be allowing me to decide which subset of my files each app can user and how. So, for example, I would let FireFox write downloads to my desktop and its preferences and caches to subfolders of the Library, but I wouldn't want it to be able to erase any of my other files under any circumstances. In fact, most of the time I don't even want FireFox to be able to read my local files, but I'd be willing to put in a password to let it do on a time limited basis so during uploads and the like.
Basically, what I'm proposing amounts to sandboxing every app. This may seem harsh, but why not do it? What's the advantage of letting any app destroy any of my files? Make them at least beg me for permission first, I say!
So, that's what's on my wishlist for the future of OS level security.
Re: (Score:2)
It's not new either. And it does what you want it to do. However, it's a royal pain in the ass to configure, because you need to figure out what every application should be able to do. It's definitely not something for a newbie, and probably it will be long before such a thing is usable by normal people.
Also, I doubt it'll work well for Windows. For Linux sure, distributions would just have to provide the SELinux security settings for the packages. But for Windows? Who provides the list of
Re: (Score:2)
Re: (Score:2)
Malware writers are not interested in corrupting your data, what do they have to gain from that?
Actually, while malware writers may not be interested in specifically corrupting data they do have motivation to mess with it. There has been malware that mined use machines for online account info and credit card numbers. There has been malware that deleted chunks of data and used disk space for temporary data storage of illicit materials. There has been a lot of malware that hides among data, making your data unsafe. There has been an enormous number of malware infections that unintentionally destroy da
Why You're Wrong (Score:2, Insightful)
Why You're Also Wrong (Score:2)
You're right, permissions by user isn't enough. But if we set permissions by app, eventually, Windows users will become accustomed to clicking "Accept" to every app permission that occurs, creating the same state we're in now.
You're right that just adding application level privileges isn't enough either, but no one said we have to only add application level privileges and not the rest of what is needed to make them useful as well. First, the UI needs to be fixed to eliminate all the current, spurious pop-ups. Then you need to build in good default settings. Right now users are clueless about firewall configuration, and yet many machines ship with one running out of the box without being prompted all the time. This is the resul
Re: (Score:2)
Why is she running Administrator at all? My wife runs as Limited user (just as my father, my mother, my brother and my sister, and some other family I manage computers for) Now, I do realise that it take quite some work to set up a computer in such a way that all applications run under Limited User.
Holy crap! You actually waste time sorting out permissions to get everything running for a normal user under WinXP? Even most corporate places I've worked with centrally managed installations give up on that eventually and give a significant number of users admin rights. What an enormous waste of effort.
Of course, they cannot install applications themselves, but that is actually a good thing.
It is a good thing that your wife can't install applications? Do you let her wear shoes? This is why my mother has a Mac. She can run as a regular user and install applications and I've spent about an h
Re: (Score:2)
Why is it a waste of time, when it saves me time in the long run? The parent poster said he had to reinstall or clean his wifes machine every two months!
Because both of those are huge wastes of time made necessary by MS's design choices. Compared to doing no work and getting the same result because software runs and installs fine as a regular user, spending a lot of time to manually investigate, edit, and test the permissions for each application seems like a waste to me.
Yes, it's a good thing my wife cannot install anything. That way I protect her from herself. She doesn't know that those smilies advertised are in fact spyware.
It is sad that the state of computing has gotten to such a bad state on some platforms that a normal adult can't install and run software without a great likelihood of being compromise
SE-Linux (Score:2)
Actually, the problem is even deeper. (Score:2)
Another approach is to use a software ring system like the 80x86 p
Re: (Score:2)
What I propose is that we shift from permissions by user to permissions by application.
If you're in a hurry to add this functionality, it is freely available from the port of TrustedBSD to OS X which you can get here [trustedbsd.org]. It is still pretty difficult for everyday use, however, because applications are not designed to accommodate it very well. In other news Apple had posted mention on an application signing framework and a mandatory access control framework on their public facing developer pages for leopard, but it was pulled with no explanation at the end of 2006. Keep your fingers crossed as t
Re: (Score:2)
Running a full desktop environment and expecting your computer to be secure... ...doesn't really add up, when you get down to it.
Is that you Mr. Gates?
At present that probably means binary drivers, that wont load into your hardened kernel or X...
Most desktop users are concerned about malware and trojans and the like. They are less concerned about commercially supported applications and binaries which they have a more reasonable expectation of. A reasonable person might be willing to trust a binary driver from HP in order to get their Webcam working, while that same user might not be willing to trust SpaceBlast45.exe with their machine's security just to play a game. The goal of a reasonable security system is to allow the
Expect ??!?!!? (Score:2)
see, you cant cram in crapload of control mechanisms (DRM and other shit) that can affect operation of entire computer (and permission wise, at even hardware level too !) and then expect it to be only as vulnerable as previous oses (or any os, in fact) that did not contain that much shit in them.
malware producers, virus makers are going to exploit the hell out of the mechanisms microsoft put in vista.
User Mode Rootkits? (Score:5, Insightful)
"malware... can still hide with user-mode rootkits"
Did that strike anyone else as odd? User mode rootkits... wouldn't that be "userkits", or just trojans/viruses/malware? If it doesn't have root access, I don't think you can call it a rootkit.
Re: (Score:2)
Re: (Score:2)
The hell with that, all most of them want to do is use your box as a zombie spam/DoS mule. You don't need root (or its Windows equivalent) to do that.
Re: (Score:2)
they usually only do directory stealth.. the most trivial form..
although I suppose there have been a few rootkits that did full stealth.. actually hiding modifications that have been made to a file.
Full stealth comes in two forms:
* remove info to be hidden on open / replace info to be hidden on close; or
* direct updates of the buffers returned
Social engineering (Score:2)
Your computer is broadcasting an IP address! Click here to download the fix!
Re: (Score:2)
pfffft.. (Score:5, Funny)
So, why weren't they saying this BEFORE release? (Score:5, Insightful)
Remind me again, what was supposed to be so good about Vista? Oh, yeah, all the stuff like WinFS that somehow never happened.
And when people pointed that out, the answer was "but the really important thing is security, which Vista does have."
The real role of WinFS (Score:2)
A) A teaser. A compelling "new age in computing" to get some hype going.
B) A feature to cut when projects run late.
Likely, WinFS will make 20 years old without ever shipping.
Re: (Score:3, Funny)
I'm guessing that Duke Nukem Forever is dependent on some unique feature of the WinFS filesystem...
But the website said to answer yes (Score:5, Informative)
malware controlling apps (Score:2)
Just a dare, or a double-dog dare? (Score:3, Informative)
http://blogs.zdnet.com/Apple/?p=422 [zdnet.com]
I'm puzzled. (Score:2)
Re: (Score:2)
If you are an admin you get a prompt to allow priv escalation.
Not surprising, but.... (Score:3, Insightful)
1. Usually malware comes bundled with something that I am interested in actually using. I was kind of interested in trying the aero interface of Vista, so I installed it. After doing that I noticed weird things with my computer (lockups, hard drives failing to read and write) -- a sure sign of malware.
2. After installing Vista, my system tends to be slower. This is a clear indication of malware being on my system.
2. Strange windows keep popping up telling me messages I am not interested in. This tends to happen also when malware is installed on a computer.
There are several other issues, but these are the main ones. I looked at some websites describing malware, and according to security experts, these are key factors indicating that its highly likely I have some malware on my computer. I think I will have to get rid of Vista becasue not only will it eventually allow for malware to run inside of it, in fact, it IS malware!!!
Re: (Score:2)
1. Did you check your drivers? Try booting another OS and see if you get the same problem. In other words, instead of just crying into your pillow at night, try and fix it. You're on Slashdot, you're supposed to be a geek for crying out loud.
2. Yes, we're all aware that Vista requires higher system requirements than XP or Linux to run smoothly. Whoop-de-do. However, they're not as high as people pretend and Vista works well on my ex-boyfriend's 3 year old Sempron.
2 (again).
Vista raises the bar. The possibility remains (Score:2)
Given the amount of "allow or deny" request the average user gets during his life with Vista, he is no longer able to make a qualified decision. Take any kind of "personal firewall" and let it go to berserk levels. A request for pretty much anything when you install something.
So the average malware will not come along as s
Re: (Score:2)
Re: (Score:2, Informative)
Proper punctuation for a sentence like this is:
Someone said, "Something that they said goes here."
A comma is supposed to precede the quote. If anything, one might ask, why the headline is missing the quotes.
Re: (Score:2)
I never said it was.
Re: (Score:3, Funny)
Re: (Score:2)
Dude...you are so way behind teh times...Shouldn't you like be living under a ROCK! Living under a log has been out of date for like evar...
Re: (Score:2)