Slashdot Mirror
Windows Is 'Insecure By Design,' Says Washington Post
Circuit Breaker writes "A Washington Post article says Microsoft Windows is insecure by design. Quote: 'Between the Blaster worm and the Sobig virus, it's been a long two weeks for Windows users. But nobody with a Mac or a Linux PC has had to lose a moment of sleep over these outbreaks -- just like in earlier "malware" epidemics. This is not a coincidence.'"
Except the Mac and Linux users in charge of those systems... ;)
There's a large difference between "Windows is insecure by design" and "Windows was not designed to be secure or with security in mind" just as there's a significant difference between saying "Impalas are deathtraps by design" and "Impalas were not designed with safety in mind".
That said, and though the Post's article was a little muddled in general I agree with the spirit of the article in that
1). It's reprehensible that Microsoft apparently didn't have security (a broad term, but the literature to define it is out there) as a guiding design principle when they designed Windows, and
2) As a result of this, Items central to the functioning of Windows do not lend themselves to good security.
On the plus side, if you work as a contractor, it's billable hours. :D GG SoBillable^H^H^H^H^H^H^HSoBig!
"People will pay big bucks for the luxury of ignorance."
Funny how 95% of PC users have Windows, I wonder why a Virus writer would want to target Windows??!? Perhaps that is why so many exploits are found, because people are targeting it religously, start targeting Mac and Linux as much and see who is insecure!
I spent ages trying to think of sig, but never did
The old DOS/Windows had security as a pretty secondary concern, it was just about getting things to run and not crash a lot of the time. NT/2K/XP is much imrpoved, but it still suffers from this legacy. For example, it's still difficult to run users in non-Admin roles because some applications expect the user to have full Admin rights. Only when most of these applications are update will the ability to use real user security settings become practical.
.
If nothing happens then you have a reasonably secure linux box.
In my case, because Virginia Tech's CS department requires us to have XP Pro. The people who don't trust MS use Windows because they have to.
the author makes nice (partial if you may)rebuttal of this myth, and also points to something to back it up like the number of open ports that create potential possibilities for holes,and that are for services that are default enabled, yet shouldn't be used in hostile environment(and how ms does nothing about it, and how xp was supposed to be more secure in matters like this). and frankly i haven't heard of non-hostile environment involving more than 10 people in a deserted island with lots of food and jolly sunshine happiness to keep them away from their computers.
-
world was created 5 seconds before this post as it is.
Perhaps now we should try to get other "mainstream" media entities to cover stories with this sort of angle... such as:
* The New York Times
* CNN
* USA Today
* The Wall Street Journal? (Yeah, it's a long shot, but...)
Does anyone here have contacts with any of these companies?
Honey, I shrunk the Cygwin
I wonder how much money RedHat slipped the Washington post for that one...? *g*
Like a Linux PC owner sleeps anyway....
"Windows is better than most operating systems at easing the drudgery of staying on top of patches and bug fixes"
emerge -u world
how _hard_ is that?
What baffles me is that even with all this evidence for the need for operating system diversity in the corporate realm both corporate America and the US government are eliminating anything non-Microsoft. Lemmings.
What is it going to take? Ships sinking? Trains being derailed? Satellites dropping out of orbit?
"God fights on the side with the best artillery." - Napoleon, Marshal of France - speaking truth to power
Here's a modest proposal: Microsoft should use some of its $49 billion hoard to mail an update CD to anybody who wants one. At $3 a pop (a liberal estimate), it could ship a disc to every human being on Earth -- and still have $30 billion in the bank.
...
Please Microsoft, use CD-RWs. I already have a wall covered with silver AOL CDs
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
Here's a modest proposal: Microsoft should use some of its $49 billion hoard to mail an update CD to anybody who wants one.
The sorts of people that would think to order such a CD in the first place are likely already patching their machines. Others will get the CD and misplace it, forget about it entirely, or mistake it for something like an AOL disc and toss it in the trash.
The coolest voice ever.
It was posted because people have been saying for a long time that windows is insecure, but Joe Shmoe computer user won't know that (you mean there's computers that don't run windows?) until it gets some attention in the mainstream media. This is the media attention a lot of linux geeks have been waiting for.
The only reason these worms can spread is because of the lack of basic computer intelegence of the average user. i have had windows and used the internet religiously for years and have never gotten a worm on my box.
So basically what i'm saying here is that its not always the operating systems fault, even though i think windows is insecure it gets to much shit for it.
There are 10 kinds of people: those that understand binary code and those that dont
Obligatory Response:
The argument sort of breaks down when you talk about webservers, with Apache solidly in front with % usage, yet it's the smaller-target MS offering that is the one hit with exploits.
There's something more fundamental about the differences in security -- yes, MS is a bigger target, but that doesn't mean that it can't also happen to be the easiest target (and it is).
This is a bit unfair. Microsoft identified the problem and offered updates long before the worm hit the streets. Microsoft cares about the security of Windows, but it was the stupidity of the users which led to the compromise of their systems. If a Linux hole is found, nearly ever user would update to fix the change, because the average user of Linux knows what putting it off may entail. The average Windows user does not have the same computer knowledge, and hence, Microsoft gets the blame. Just another MS bashing is what it is!
A blog like any other.
Some of us alternative OS users were actually affected by the virus, even if we weren't infected. In addition to the Net slowdown, the friggin SoBig.f virus forges emails. So if you have any windows using acquantainces, or even people who received a forward with your address on it, the SoBig.f virus will cheerfully send out copies of itself purportedly from you! It doesn't just stop at the address book either, but allegedly scans documents on the drive to harvest addresses. Evil, evil thing. So, no computational loss, but potential harm to reputation, even though it's easy to prove via the headers that it did not originate from you, the vast majority of those windows users who get infected with emails bearing your From: line don't know a header from a hole in the head.
Linux and MacOS users are, let's face it, in the minority compared to Windows users. Granted Windows most likely does have moe security flaws than these other OSes, but the main concern here is that virus writers will target the OS that will cause the most damage (or that they have the most experience with) and that will almost always be Windows.
Even if all the known exploits in Windows were patched, all it would take it one more for another virus to do something like Blaster or Slammer. On the flipside though, something like that could just as easily happen to Linux if an exploit were found, it's just that no one bothers to write viruses that take advantage of it.
If someone emails you an exe, and you run it, and it does something to your computer, that isn't exactly Microsoft's fault.
.pif and so its kinda confusing to some people, but I don't think you can group SoBig in with other security holes that Microsoft has.
I guess sobig is a
I currently run Windows XP (unpatched, no virus-killer) and GNU/Linux machines behind a GNU/Linux firewall/router. I have never been *infected* with anything. If you're stupid enough to set Windows Explorer to "hide the extension of known file types", and to not know that a .scr file is just as executable as an .exe, and to not run a decent firewall then frankly, you deserve to be infected by the latest and greatest virus.
--
Craig
And we certainly see this on the Web, where Apache on Linux greatly outnumbers Microsoft IIS on Windows. Oh wait, no we don't.
http://rocknerd.co.uk
It's be already said, but I'll say it again: Apache is the most used web server on the internet, yet most web server worms are for IIS. Following your logic, Apache should be exploited every couple of weeks.
If you read the article, the author explains why
it's not just the sheer number of windows
users that's the problem. As an example, there's
the number of ports open on Windows XP (5),
vs. OS X (0) by default. You really do have
to take into account the design of the operating system. Windows is just too easy to hack compared
to the other OS choices.
Johnny
And we certainly see this on the Web, where Apache on Linux greatly outnumbers Microsoft IIS on Windows. Oh wait, no we don't!
http://rocknerd.co.uk
I find it much easier to secure a Linux/*BSD box than a Windows one. Even though I use Win 2000 daily as a programmer. I'm pretty sure I'm not alone in that predicament.
Just keep in mind that a large part of the internet infrastructure does not run Windows, but they (the servers) still seems to do okay, apart from the odd sendmail/bind/openssh bug ;-)
The design flaw that the author is pointing out is that administrator-only functions like RPC and the administrator's message boxes are turned on in a default installation, when the world would be better off with such features in the OS but defaulting to an off position and only running the associated software if the user indicates they want the feature on.
This is not a design flaw that Apple and the various Linux distributors are immune from, just that they seem to violate this rule with less frequency. Let's face it, if Windows shipped with RPC turned off by default, Blaster would have a much smaller impact than it has now.
As for SoBig, there's really nothing preventing a SoBig for Mac or Linux. Afterall, all you need to do is trick the user into executing a program that isn't what they think it is, and then read their address book file. The only complicating factor is that there's an overwhelming market share for the Windows Address Book being used, that it's the only place most virus writers bother to check for addresses to use. In order to make such a virus with the same impact on another operating system, they'd have to check the address book location of about a dozen programs... bloatware for virus writers.
And in cases like these (stupiduseritis?), it doesn't matter which operating system you choose to use, you almost certainly won't have configured the machine properly from a security standpoint.
--
Craig
I agree. The Washington Post is a very well known newspaper that many people get. Even my father(who subscribes to WP) read the article this morning and showed it to me because he thought I might find it interesting. He isnt the type to read stuff like slashdot. Just a note..I saw it at news.google.com this morning.
The Television Wiki
The recent DCE/RPC vunerability exploited MS's DCOM implementation residing on the end point mapper port using raw DCE/RPC over TCP.
This has nothing to do with Unix and certainly isn't a standard (hell, Samba doesn't even support this). This was totally a MS-original.
A lot of the http virii are based on MS-extensions or broken non-standard behavior of the MS clients.
If MS has followed what you refer to as "obscure unix standards", this wouldn't be an issue. Despite what you may thing, Unix systems were designed with security in mind whereas Windows was designed as a user-operating system.
int func(int a);
func((b += 3, b));
If someone succeeded, MS would turn their entire corporate attention towards completely destroying them. They would (mis)use copyright, DMCA, criminal law and anything else they could get their greasy fingers into.
One thing that has saved Linux (so far) is that they can't figure out who to aim at. All they can do is bribe lawmakers and promote FUD. They know that if they take out Redhat, someone else would have the code within seconds anyway.
I'll see your Constitution and raise you a Queen.
Regarding IE and Active X.
Its nothing but a virus delivery system.
That was about 8 years ago. Microsoft destroyed netscape and aside from some humorous footage of Bill Gates lying under oath nothing was done about it.
Now someone in the mainstream press has actually done their homework. Are we supposed to be impressed ?
Not only are the security implications horrendous in the MS products, but servicing them is a nightmare ....
This story just caught me at a bad time ... I have been trying to do a file/printer sharing between 2 computers running Win 2000 Prof and Win XP Prof using a hub. You would think it would be plug and play, and a little bit of configuration - and that is how I set out my cost estimates for a small business that wanted me to do it for them ... big mistake ...
It is 3 days past now. I have read probably 100 + articles to understand the security implications for these windows products .... Used all sorts of keywords in google to get many articles to see how the damn networking is done in the first place. And I am now thoroughly confused, tired, and am spending a lot of unpaid hours getting this damn networking done. FOR GOD's sake I am trying to network two products from the same company ... How could MS screw it up and make it such a nightmare .... and do such dumb stuff as not turning the security features on by default so that I don't even know what I am exposing, all the patches that are being issued faster than I can download ...
To see a world in a grain of sand, and then to step back and see the beach where the sand lies
The article takes a cheap shoot implying that Windows users always run as Administrator, the Windows equal to the all-mighty root, while Mac and Linux users usually get this right and reserve their root use for important stuff, but spend most of their time on a limited user account.
Microsoft had this bad in the entire Windows 9x kernel OSes because there never was any concept of a restricted user... everybody was an Admin on those boxes. Insecurity at its worst, but it was always thought of as a single-user OS, if you wanted a secure user environment you were supposed to pay for the Windows NT-based OS of the time.
Windows XP, afterall, is a Windows NT-based operating system so half of the problem is now solved. Microsoft's consumer product finally has a restricted mode. The problem is, there's still a user problem... most people use an administrator account as their primary, sometimes only, Windows logon. So, even though the software has caught up, the users haven't.
Comment removed based on user account deletion
I didn't have ANY trouble with SoBig.. or Blaster.. why, because I didn't patch my system. Oh a few things like clobbering Windows Scripting Host and setting things so I see the file extensions, but hardly enough to call it "secured". It's insecure. I know it's insecure.
No one sat around a conference table in a code review and said.... you know what.. this isn't insecure.. we need to change that.
But did anyone ever say "this isn't secure.. we need to change that."?
In the design balance between fundamental security and "user experience", has any weight ever been given to security in the design phases? Surely Microsoft does something they call "design" for this stuff.
While it is true that a lot of these things rely on social engineering, the other part is why does the OS allow the user to do these things in the first place? If you don't want users to do something destructive, why offer them the choice?
One of the first rules of design seems to be lost on MS designers. If you don't want users to do something then don't offer it as an option. You can pop up dialog after dialog warning users like this:
Do not click 'yes'. If you click 'yes' will crash the machine. Only click 'no'.
[Yes] [No]
How stupid is it for a user to click "yes"? How stupid was it for the programmer to put the "yes" button there?
Yet in MS program after MS program they tell you something is dangerous and allow you to do it anyway. I guarentee as long as applications allow this some malicious hacker will use a little word play or social engineering to allow them to do something destructive.
I really want to throttle the person at MS who tried to get people to believe computers are as easy to operate as toaster ovens. Computers are complex machines. Hiding the fact from the user is not only dubious but dangerous.
Apache is more deliberately used than IIS. IIS, however, has a very widespread install base amongst clueless users who don't even realise that they're running it, thanks to Microsoft's boneheaded install procedures.
STOP MISUSING APOSTROPHES, YOU MORONS!!!
I strongly advocate mixed platform networks. I consider Linux and/or BSD as the best for most backbone/critical services/systems, but MS Windows to backup the backbone/critical. ...) and platform from Ma-Bell to the user is that the complexity of configuration, security, operation, ... help-desk, network/server admin ... everything would be an expensive pain to support, but (unless power-failure/outage) web/email/ftp/VoIP/VTC/ ... services from Ma-Bell to the user could be maintained during cyber-conflict activities. Someone in the office would always be able to access email, websites, .... .... Just a few critical (maybe one) networks and offices would require this mixed-platform configuration in business and government. .....DB2, My-SQL, MS-SQL, ... other considerations.
In an office environment for the users in the past I could only advocate Apple and MS software OS+Apps. Late last year I added Linux+GNU desktop/workstation OS+Apps for a mixed platform office environment. Businesses and government should consider letting experienced users [AKA: Geeks/Gurus] select their own OS+Appps desktop.
The reason no one ever supports the mixed network devices/switches/... (3Com, Cisco, Lucent,
For critical/emergency business/government systems and offices the complexity should be able to provide critical services for utilities, command-post, emergency agencies,
Strict adherence to protocols, standards, and configuration would allow business and government to communicate and use www/internet/intranet services.
Letting a one version OS attack (frequently MS) cripple your business, critical infrastructure systems, and/or part of a major government agency like NASA or DoD is PPP.
Unaccountable leaders are masters, and unrepresented people are slaves. How do US and EU fare?
Computer industry? WHAT COMPUTER INDUSTRY? The VAST majority of these big viruses exploit who's products? All togerther now: MICROSOFT. This isn't Apple's fault, Macromedia's fault, iD's fault, or anyone else. These things are almost all MICROSOFT's. Finally someone in the media seems to get it.
Comment forecast: Bits of genius surrounded by a sea of mediocrity.
Even some Linux default installs have security holes. It's all in how it's done, not what it's done with. Are we supposed to throw out everything written in C now, too?
You are not the customer.
I think my favorite part in the article is when the author suggests that MS should use their massive cash pile to mail out a CD of updates to every single customer that wants one. Considering how many CDs AOL sends out (and yes, I know they are bleeding money), wouldn't it make sense to partner with AOL, who is already producing discs, and make them multi-session, so that MS could use the already pervasive CD distribution systems in place to get updates out?
I can't believe no one thought to suggest this before. And if MS was REALLY SERIOUS about making security their #1 priority, it would be a pittance to part with and give their customers a much-needed sense that MS actually does care about their customers.
The question is, do they really care more about the customer or the bottom line?
A lot of the recent problems could have been prevented if people had installed the available patches. However, the EULA's that one has to agree to while installing the patches are downright frightening, and Microsoft keeps making them worse.
I wonder how many people skip the patches because the EULA's are so obnoxious?
oh yes. they could call it MSUX.
This is really an awful way to think about a consumer base that doesn't understand some basic tenants of computing. I've known plenty of Windows users that think 3.5" floppies are hard disks because the casing is, well, hard. To expect them to catalog file extensions in their heads as well is ridiculous. Obviously you are a more savvy user as you have Linux based machines and a firewall set up.
Not everyone has the time/expertise/desire to learn that much about computing, and that's OK. If everyone were a geek, you'd have no one to bitch about, would you?
But did anyone ever say "this isn't secure.. we need to change that."?
I don't know, nor do you, or the Washington Post. That's my point. This guy is making this statement without any facts, just assumptions.
In the design balance between fundamental security and "user experience", has any weight ever been given to security in the design phases? Surely Microsoft does something they call "design" for this stuff.
I don't know about MS. Can you say that they don't? I for one know that my non-software company which has an IT department that watches the actions of MS a lot, has an information risk management team that looks for security holes in all in-house and purchased software before implementation. Would you care to assume that MS gives weight, or doesn't give weight to security during the design phase? Or would you care to not assume, since all the facts are not available?
Where you are wrong, and the Washington Post is correct is that Windows doesn't have to be intentionally flawed to be 'flawed by design'. Something can be flawed by design as far as security goes just in neglecting to design a proper security model to begin with. Windows is flawed because it wasn't designed to be secure from the beginning, and newer versions, even those written after Microsoft started to become more aware of the need for security, have been hamstrung by their need to retain backwards compatibility with older versions and for software written for older versions which in many cases just won't install and/or run correctly on a properly locked down installation of Windows. Whether Microsoft intentionally designed in security flaws isn't what matters, what matters is Windows, as it is currently designed and implemented has some inherent design flaws which make it less secure than it needs to be. Among them are the fact that so much Windows software relies on being able to write to system directories (to add DLLs, etc) to be installed, which leads most people to allow too many users to be able to access too many files. Another is the fact that Microsoft built in scripting which allows too much access to low-level functionality (in other words, it doesn't run everything in a restricted sandbox) into just about everything, including the email clients and office software most Windows users depend on. Another is the fact that executability is based on file extension and not by permissions, if it wasn't, then people wouldn't be able to accidently execute malicious downloads so easily. This problem is compounded by the fact that by default most Windows facilities and software likes to hide the file extension.
The Washington Post article is not a troll or flamebait, it is a very necessary wake up call to the average Joe Windows users. If more of them had patched their systems and used mail clients other than Outlook or Outlook Express as you have, then these viruses/worms wouldn't be such a big problem. Without the mainstream press letting these people know, they will not get the message.
Actually that's incorrect. the reason most email/address book viruses spread so fast and cause so much havoc is because of Outlook and Outlook express -- which are ENTRENCHED in the business sector. I told my boss the other day that there's an email client that doesn't have these problems (Mozilla Mail) and his first question was how much does it cost to license. Managers think nothing is free, and if it is it's too good to be true -- and that, just isn't true.
If companies made it a rule to stop using outlook/outlook express, and properly instruct people to never open email attachments from people they don't know, and file extensions that aren't safe (pif, scr, exe) then that alone would stop most viruses in their tracks. But alas, 90% of the office workforce is comprised of mindless drones who barely know how to use outlook in the first place.
- tristan
A family member of mine got a new Windows XP system, installed it, and tried to download the security patches. Before the XP system managed to download the patches, it had already been 0wned by Blaster. It's really hard to keep a Windows system up-to-date when you can't connect to the Internet to update it.
My solution?? I used Red Hat Linux to download the patch, and wrote it on some media. Of course, he can't really completely wipe his hard drive to be sure he's safe from any other attacks. Why? If the drive is fully wiped, Windows XP can't be installed any more - on his system, the CD doesn't contain the entire OS!
Of course, I'm writing this from a Red Hat Linux system that has a nice built-in firewall, a "root" account that's not normally used, no externally-accessible ports, and lots of other designs that make it far more resistant to attack in the first place. Yum.
- David A. Wheeler (see my Secure Programming HOWTO)
I suppose it was more a rhetorical point than a literal one. You are of course right... I am just trying to figure out how to strike a balance between limiting my exposure to liability in this networked world (because everyone is happy to sue these days) and still participating in society in normal ways.
This balance is an increasingly difficult one to find and maintain.
STOP . AMERICA . NOW
Yes, but you have to admin that the MSBlaster/LuvSan worm would not have been possible if RPC hadn't been disabled in an OS that doesn't require it, i.e. XP Home, or Internet Connection Firewall was on by default rather than requiring user intervention, when half the users out there don't know what a firewall is, let alone how to turn one on.
Also, Linux users are on the most part more tech savvy than windows users, which I think plays a big part (I bet you 9 out of 10 linux users know not to open every attachment they receive).
I am NaN
Fact: File extensions are still hidden by default.
Mozilla Mail in fact is subject to a Sobig-style attack, all that's missing is a virus that reads Mozilla's address book and goes. If your business installed Mozilla Mail, it'd still meet the mindless drones who will still open up the pif, scr, and exe attachments.
We are switching over to the Linux based system on our "sponsored" tables, however for our pay-per-use system, we have no choice. None of the bill collecters work on the Linux version as of yet. Until then, one some of our terminals, we have no choice.
Security is a problem, because for starters the kiosk program we have will not run on NTFS, only Fat 32 so we have to swap out harddrives with at least 1 terminal out of 10 a week and reghost it because dispite blocking software, people DL things they shouldn't be.
At work, I have a Powerbook and my boss now has a dual boot system with Windows XP pro and RH 9. He's trying to get used to Linux and Openoffice so that we can have all future employees either use Macs (for those needing photoshop/DW) and everyone can do billing and accounting from Linux terminals.
"The problem with socialism is eventually you run out of other people's money" - Thatcher.
these virii were created by people - people create virii for windows because that's what people use, not because it's more insecure than other OS's. When linux gets more popular people will start making virii for it.
Because this text is clearly nonsense. None of the protocols you mention have inherent security flaws Maybe you should have noticed ftp instead, which does have some quirks.
:)
RPC has been targeted due to a defunct implementation on MS side, and the fact that it was open to the internet by default. This has nothing to do with security of the protocols an sich.
To make your point completely moot: when MS does develop it's own protocols (SMB, PPTP etc) they are inferior to the standardised protocols concerning security.
One can safely say that the MS record on implementing secure protocols up till now is not that great.
Only the XBox seems to be quite secure. Of all things, a game console is the current MS flagship
Warper
The claim of the author is bogus.
The author claims that windows is insecure by "Design" but he fails to talk at all about the actual design of the system. Design goes to the core of system design and I know security was definatly designed into NT from the start unlike Windos9x.
I dont consider buffer overflows to be particularly a design issue but generaly a coding faults. Every OS has had buffer overflows exploits and design can not prevent them unless automatic protection agains them is designed in which most OS's dont implement.
The author should do a bit of research and not write fluffy articles that have no merit!!
Pegoraro has a point about users not patching their systems, but unfortunately I can understand why: the updates are causing huge problems.
;)
On one of my desktop systems, the latest Windows XP driver updates trashed my Hercules Game Theater XP setup. Lots of error messages and no sound!
On my Laptop, the latest Windows 2000 service pack blew away support for the Netgear MA401 WiFi card.
The first problem is easily dealt with. Roll back the upgrade. Sound worked before and it wasn't a critical update--just recommended.
For the laptop, I now have a choice between gaping security holes or WiFi support. Thankfully it dual boots to Linux
I wonder how many people are in the same boat. Plug and pray, or plug and pay!
I run probably the only Linux machine on a residential LAN with a shared internet gateway. Since last week sometime, the virus has so infested the XP/2000 machines on the LAN that all my upstream requests are dreadfully slow. DNS queries and HTTP GET requests, etc. Downstream transfer speeds are just fine. This is the curse of the Slammer virus - 10 to 15 port scans per second per machine on a largely M$ LAN leads to practically no internet access. The sorts of users who refuse to update their machines even weeks after a virus advisory is issued are the bane of their LAN neighbors. How can you just not care that your machine is randomly shutting down with 60-second warnings?!?!
So, Linux helps, but only in as much as I myself cannot become infected.
Hopefully this will post...
The question is, do they really care more about the customer or the bottom line?
The bottom line, obviously.
I rememeber reading an article in Dr. Dobbs about a great piece of file indexing code that Microsoft wrote.. it was a great system, bounded resource use, bounded worst-case performance, a nice piece of CS. By the end of the article I learned that it was written TEN YEARS ago and Microsoft sat on it because they didn't need it from a marketing point of view.
That made me think about how Microsoft operates. They just give out enough to keep customers from leaving. Not one ounce more. That's why Windows is a crappy OS (captive audience, everybody has it on their PC) but the desktop programs are a little higher quality (there is some competition, however tiny).
Another example: C# is a completely open language, not because MS is generous, but because it's a selling point over Java.
MS is calculating and ruthless. You'll get security from Microsoft when it starts to be a problem for the bottom line. Not a day sooner.
And judging by my friends and co-workers nonplussed reactions to these worms/viruses, that day is a long day off...
Sure Windows has bugs that lend themselves to security problems. But nowheere in the article does he prove that Windows is more insecure than Linux or MacOS. All he can claim is that the default settings on Windows aren't the best choices for security, and that Red Hat and MacOS do a better job. I'd call relying on default settings user error, not a problem with the Windows code itself. You might as well say Solaris is insecure by design since (with Solaris 8 anyway), the default install runs sendmail, allowing spam relaying and leaves the telnet and ftp ports open, which can result in stolen passwords.
Vote for Pedro
Users running NT based versions of Windows are effectively forced, or annoyed, into running as admin. This happens for a number of reasons:
* Old software runs as admin only. Stuff that came out during the DOS/Windows days, much of it pretty recent, simply won't run as anything but admin. This is a nasty legacy thing, and is a vestige of the horrendous design of Win95/98/ME.
* Too much new software runs as admin. For example, if you want to run Microsoft's own Age of Empires, it only installs as admin, and only runs as admin. This is a new application made by the mothership, and clearly, fits into the home scenario as the article. I'd guess that at least 20% of the apps on my Win2k box require admin rights.
* Too many housekeeping functions require admin.
* It is a relative hassle to run a program with admin rights when not admin. The most common way is to -right click on the program's icon, and then select Run As, and then enter the admin password. Ugh.
* Even for the disciplined, quick user switching allows admin to stay logged in, most likely still running OE or some other security nightmare.
The upshot is that if a user even understands the concept of not running as admin, they are forced to, or get lazy and do so.
I've set up several users on Win2k, and taught them about security, and why they really, really don't want to run as admin. Months later, they all are.
This will be a problem if Linux ever becomes widely adopted by home users, and why Lindows runs as root by default.
Didn't Apple get this figured out? Why haven't everyone else copy them as usual?
Jonathan
Actually, OS X does have (in most systems) some ports/services open by default. Here's a sample portscan with no user-services (ssh,httpd, afp, etc) running. 1033 is assigned to NetInfo
427 is "server locator"
631 is "IPP (Internet Printing Protocol)"
--- Kicking the Cheat since late 2002
Uh, hate to tell you, but unless you're sueing somebody you're not participating in society in normal ways.
Stop the Slashdot effect! Don't read the articles!
A few years ago there were a few rants because Linux (redhat) wasn't secure out of the box. It shipped with a few packages that had a few exploits- yet the fault fell on the user for not updating their package. ...
My grandmother hasn't updated anything on her computer- she's 81 and more concerned with knitting and talking to her grandchildren. I just walked her thru an update.
Can you imagine if I had to tell her how to do that on linux ?? (without a subscription mind you) - Yeah grandma, type wget -?
Windows Update did- and worked- and fixed it. But it's easier to bash MS for the people whom didn't patch their systems in a timely manner than to target the blame where it ought to be.
In the past 3 years, since my Grandmother got her computer, how many new Redhat versions have rolled out? How many of those versions would seamlessly install over the other one? I believe the answer is 3 versions and none, Bob.
Lay off the MS bashing- most of my software I have to use is closed source and several $K per seat- I'm not going to stop using MS until.... well, never. If they move to a different system then I move. I'm tied to the company that writes the code I need to do my job, as are many people in the engineering fields. Leverage one, move the other.
I wonder how many people read the EULA's? I bet the numbers are related (and small).
Little Brother, watching the watchers
Okay, maybe I should have turned on the firewall before connecting to the Intenet. I didn't realize the virii were scanning so relentlessly and quickly. I also thought that the idea of turning on a software firewall on a brand-new install seems a little dumb. All the firewall does is prevent incoming connections to insecure ports. If Microsoft knew when they shipped the OS that the ports would likely be found insecure, why wouldn't they just turn them off by default? I mean it is one thing to buy Norton Firewall on the presumption that they are fixing Microsoft's broken security model but why would I use a "security fix" that comes on the same CD as the program that introduced the security hole in the first place! It seems totally illogical to me.
I now have a new signature on my emails:
*In light of the ability of some email viruses (eg SoBig.F) to spoof this address regardless of whether my machine is infected or not (for instance, pulling my address from a Windows user address book to use as a fake return address), if this statement is not included, consider a message from me to be a virus*
I figure that will be good, going out a few dozen times a day. I urge everyone to pen something similar. Cause, ya know, MS can never have too much bad press... erm, room to innovate.
Also fact: System relies on file extensions to differentiate between executable and non-executable files, which in my mind is a bit worse.
Anyway, as for your requirement for "INTENT." Back when the CodeRed came out, work gave me the responsibility of locking down our IIS servers. Back then I didn't have any experience with IIS so I did the smartest thing I could come up with - started reading and convinced work to send me to a one day SANS seminar. Well, the instructor told a story from an MS employee of how MS figured it was cheaper enable crap like Internet Printing and the like by default than it was to eat the cost of projected support calls they would get from people who wanted the feature but couldn't figure out how to enable it.
IOW, enabling everything in IIS was done because it saved MS a few bucks. That is a design decision. It was intentional and most importantly it was insecure.
You still want to mince words on this?
I don't want knowledge. I want certainty. - Law, David Bowie
True, but far worse: Microsoft quite intentionally continues to make Windows and Office etc insecure on PURPOSE, as a side effect of offering full programmability of email, Excel, etc.
There wouldn't be any email viruses nor spreadsheet viruses nor Word document viruses if these apps were lobotomized -- if they could not be programmed.
But Microsoft continually makes the business decision that adding the power of programmability to every app is much more important than the resulting insecurity.
The vast majority of Linux apps do not allow that kind of programmability -- even when extension languages like Guile/elisp/etc are available in Unix apps, programs aren't automatically and blindly run whenever some hapless user receives email or views a spreadsheet or whatever.
Conversely, whenever that kind of programmability is added to Unix apps, if it is triggerable just by receiving/viewing a file, then Unix viruses will become far more rampant. (A small saving grace is that the Unix viruses mostly, but not always, will run as some user rather than as root, but this is really only a small issue.)
This should be a wake-up call to teams like Gnumeric; just yesterday on Slashdot Gnumeric was criticized for not supporting every single MS Excel feature, and Jody Goldberg replied that hopefully it would include those by next year. But any Unix app that is 100% compatible with a MS app will be virus prone!
Quote from a poster on that story:
Mmm-hmm, and there goes security.
(Story link: Gnumeric Now Supports All Excel Worksheet Functions )
The really sad thing is that the marketplace clearly agrees with Microsoft about this tradeoff: corporate and personal users are far more concerned with having the power of macros/Visual Basic/etc built in to everything than with even basic security.
Professional Wild-Eyed Visionary
With write priviledges only to their own sandbox, then, none of this would be happening. Instead, you've got IE and Outlook running as a user's account, so, despite the prevalance of a workable user based access control list based security system in Windows, Microsoft does not use it where it really counts. Dumb dumb dumb.
This is my sig.
But my friend said to patch it by doing
Sure hope that works....
All's true that is mistrusted
Today I sat down at my computer when I got a MSN message from a friend. That friend is complete noob with computers and now he had a problem.
.... After awhile, me trying to explain him how to scan for viruses. Yeah! It found a virus named blaster and I THINK he got it removed...
.... I, after awhile, get him pointed to the windows update and the patch for blaster. Again I think he got it installed ....
.... I try to explain him how to use windowsupdate but is almost giving up since he just dont get he just gotta press scan for updates and then install updates. Well in the end he gives up and says he dont care ....
This is pretty much what was said:
Friend: Hey. I got a problem with my computer. It has shut itself two times today, without me doing something. What do you think is wrong? I heard something about a virus.
Me: Yeah there is a few major virus's flowing around the net right now. Have you patched your system?
Friend: Patched ? ?
Me: Yeah. You know downloaded updates for windows.
Friend: No..
Me: Oh well. Here is a link to a virus scanner try and run that first.
Me: Good now to update your system.
Me: So, Now I suggest you update your system with patches from windows update.
Friend: Why? What should I waste time download all that? What good does it do me ?
Me: Well... It secures your system, give you updates to windows programs and IE and new drivers. You know. Makes it upto date.
Friend: But how do I do it ?
And there is the entire windows Security problem. Users that just come to their computer to surf abit and download a few programs like kazaa or emule just dont feel the need for updates. And they end up spreding the viruses to the entire net. Oh.. And it dont help that MS dont allow pirate versions of windows to be updated fully. I can see why it would in sense suck for them to give free updates to people that havent payed for the system. But people dont get updates when its all blocked. Which in end leads to viruses like this to run wild.
Outlook Express 6 SP1 now comes with a setting to "read all messages in plain text" Which is how I have my system configured and which gets rid of approximately 100% of email viruses. But unless you happen to be fiddling around with the configuration of OE, you'd never know this setting exists. If anything, Microsoft should be prominently advertising this "new, free" feature (which is of course ain't new, it's elm-level functionality) as a way to protect your system, but they won't.
Sure, but most people like their email with pretty colors. Then, fine, they should do what Poco Mail does, automatically "sanitize" email by stripping potentially harmful HTML coding and external image downloading (i.e. webbugs) while allowing basic HTML formatting to be read. This is not rocket science, but MS seems to be irresponsibly holding back on such basic safety improvements.
There are two kinds of people: 1) those who start arrays with one and 1) those who start them with zero.
From the article:
I use mutt to read most of my mail (years ago, I used pine.) Opening strange attachments isn't an issue for me, and shouldn't be for anyone else. If there is executable code in an attachment .. my client will show me executable code, it sure as hell won't run it. That's common sense.
it's dorm move-in weekend at the university where i work. after looking at a sample of the machines brought to school by students given the privilege of early move-in (ra's, mainly), we found that less than 5% of our students were patched for both blaster/lovesan and welchia/naichi. as such, it was decided that shutting off the entire residence hall network would be easier than shutting off ~95% of the ports once they got infected (typically takes 3-5 seconds in this environment). so our student workers and a few full-timers like me get to make our way to every single student machine (~8,000 students in the dorms) and analyze, clean, patch, and install a current virus scanner.
overtime is great.
First off, let me say that I KNOW that Linux and BSD are a lot more stable than Windows...but in the real world...where family and associates need to be spoon fed, Windows is what is in use. I have had absolutely no problems with any of the recent outbreaks. BECAUSE, I ensure that the computers under my care are current with updates (afer I evaluate them) and that firewalls are properly configured.....and yes, I even talk to the users and ensure that they know that the is some new bad thing out there. Nothing personal, but do not whine about Windows if the real problem is that you expect your users to take care of everything themselves. I don't expect them to, and I am happy to help them without making them feel stupid. That is why I am still employed and happy at my job.
Why does that lag exist at all? I realise Microsoft has built its fortune by masquerading software as a tangible good, but we're talking like one CD to each vendor. They're just copying an install onto hard drives and pushing them out the door, so why aren't they kept up-to-date? Couple the in-factory lag with that on already-boxed inventory and the OS that first boots up can be ages-old - and it's probably already attached to a hostile wire.
Your reply is the best so far; however, just take a step back and listen to my point.
Do you think we should write an article that claims that Henry Ford invented the automobile as a device to kill people 'by design'?
People get in vehicles drunk and run into families of four, killing them all. Do you think that this unintentional side effect was, 'by design' when the engineers created the vehicle? Was it 'by design' when man created beer or wine?
I think I'm being treated VERY unfairly by most responses here.
I give you one more example.
When the hammer was designed, do you think the designer intended it to be used to kill people? Or how about the baseball bat?
This is being over-analyzed by so many techies, that I think the clear facts are being missed. That which is, the article is misleading and doesn't contain a fair wording of facts. Put yourself in the shoes of others. Take a breath and look at my point.
If Windows is attacked because it's popular, then why isn't Apache spreading more worms than IIS since it has 60% of the webserver market?
You want QA on your kernels done by a QA team, you go to a distro vendor. The kernel was released by Linus, not by any vendors. That's the rough equivalent of doing a beta release.
Search for IIS on SecurityFocus's vulnerability database if you want a list of IIS holes. There are many.
May we never see th
I'm late to the party with this reply, but I'm posting it anyway for posterity. Someday I'll find this message and link back to it.
Windows IS insecure by design. The Virii and worms that are happening now are pissing people off. In the future, Microsoft will bring the 'security' scheme from the XBox to Windows... code will have to be signed by Microsoft in order to run on Windows. the press will love it, and you will see tons of articles saying things like "Microsoft gets Security Right" and "Microsoft Announces the End of Virii".
And in the end, you and I won't be allowed to fire up a compiler and write a trivial little 'Hello World' program without buying a runtime license from Microsoft, which will be embeded in every program you write.
Innovation will be stifled... I doubt Microsoft will be very license-friendly to Sun, or Apache, or Cygwin, etc.
Microsoft's own lax security is a plan to pave the way to their heavy handed takeover of your computer.
mark my words.
It has been recently discovered that the Pope is Catholic. Who knew?!
I'm not an XP lover, but it's the OS that's on my computer. It just is. I play games and run Photoshop and other programs...so I use XP because my favorite programs all run on this OS on fairly cheap hardware.
Now, I may be doing something wrong here, but I've NEVER had a virus. I've never had a problem with a worm or anything really. XP hasn't even crashed on me before....ever. I've had programs hang up or crash...but the OS itself hasn't crashed.
And this has been the same on the 2 different machines that I've run XP on.
But yet, I always hear about everyone raking XP and Windows across the coals all the time. Yet I've never ever experienced nor do I know anyone anyone that's ever had major problems with XP. Oh, I know people out there have problems...but it's just that I personally have never known any.
Why is that? Now, as I said, I'm not an XP zealot at all. I could take it or leave it. But after reading here on Slashdot the evils of Windows and XP it would seem that my machine should have burst into flames months ago, yet it's going on day after day, never turned off, always hooked to the net...and chugging right along.
And I'm not really doing anything special. I keep up with all the updates to XP...which takes about 2 minutes out of my week. And I have basic Norton Antivirus running. I have Seti@home running when I'm away from the machine and I do a disk clean up and defragment maybe once a month or so.
So again, I must be doing something wrong (or right) to where XP doesn't give me one iota of problem.
I'm not praising XP...at least I don't mean to be praising it. You only see people bashing Windows, never praising it. To praise it would mean being thrown out of geekdom. So I think if XP or NT is working for you, you keep your mouth shut or just talk about how great Linux is.
I guess your mileage may vary.
"Music is everybody's possession. It's only publishers who think that people own it." - John Lennon.
In a response to a recent story, someone mentioned that UNIX standards were generally based upon specifications which had been made publically available for comment.
This is something that many take for granted, but it is quite important. RFCs are discussed publicly, and people review protocols independently of specific implementations. This means that the protocols themselves are refined, and implementors only have to worry about correctly coding to a given specification.
Under Windows, the specification is often "whatever works with this code is fine". This invites much less review of the protocols, and since the protocols are ill-defined, it's difficult to determine whether the protocol has been implemented correctly.
Somebody get that guy an ambulance!
Windows patches come in both a Windows Update version (downloaded through an ActiveX control through windowsupdate.microsoft.com) and a "redist" version (downloaded through any graphical web browser).
Will I retire or break 10K?
I love Microsoft bashing as much as the next Linux user, but this article doesn't make much sense. Linux machines are targetted very often in security issues. If you have an unsecured Linux machine on the internet, it will either succomb to a worm, or be hacked by script kiddies. Most admins don't even usually notice script kiddie hacks (think monitoring thousands of servers..). Yes, Windows is insecure by design. So is Linux. So is *gasp* OpenBSD. Software written by humans is insecure by design.
Right on. My experience was the same. I was immunized from BLASTER on July 17th according to the log from MS Update. It's very hip and au courant to ignore MS Updates, because they're a pain, and their Service Packs don't have a great reputation. But updating early and often has kept me out of trouble.
When I started getting Sobig emails on Tuesday, I even took the time to call two of my friends (who subscribe to some of the same lists I do) to warn them not to trust emails with attachments. I had to explain the whole concept to them, but they got it. I got 40 the first day, 20 the second and only a handful since. And I had no desire to open any of them.
The biggest threat that Windows poses is that from users who are totally clueless... they turn on their machine thinking it's some kind of "email machine" and nothing else. Not a clue there are threats or risks out there. And no indication from Windows, or Outlook, or IE that anything they do could be unsafe. Windows update works, at least this time it did. They're not going to get more saavy, so there's no harm in telling people to use windows update.
Tell your friends:
1. Don't preview email
2. Delete email you don't know or trust
3. Don't open attachments if they're not absolutely known and expected
3. Update early and often
The article is right, Windows is dangerous. MS isn't going to tell the consumer, because that would threaten their (considerable) cash flow.
I'll shut up now.
Everything I've ever learned the hard way was based on a statistically invalid sample.
Agreed that developers aren't IT support (well, unless they're developing apps for IT). But they ought to know how to keep their desktops running.
Heck, I used to develop in a shop where any developer above "junior programmer" was expected to know how to reinstall the OS (Solaris, Ultrix or AIX), configure it for Oracle, install Oracle, install our software (a GIS system), and generally manage their own workstations. Ditto for the sales support guys'n'gals and the trainers (although the latter might need some phone support).
Would you have automotive engineers or even car salesmen that don't know how to drive, check the oil and put gas in the car?
-- Alastair
Never got a single virus in five years of using Outlook - I only just recently moved to Mozilla Thunderbird for the spam filtering.
.vbs attachment? Don't run the attachment! Simple enough...
Honestly, any user with an ounce of common sense can use Outlook perfectly safely. That e-mail with the pidgin English and the
It's not a magic bullet, but mandatory security just went mainstream.
What this all means is the ability to put programs into levels and compartments from which they can't escape. Security breaches in the mail handler or the web server can't propagate to the rest of the system.
The code is open source, GPL, and written by the United States Department of Defense's National Security Agency. It looks like Microsoft's attempt to shut down that project failed.
In other news, really, really smart scientists that spent a lot of grant money determined that: living people breath (air), fish generally live in water, Battlefield Earth was a mindwitheringly bad movie, and cutting down a tree with a herring is inherently impractical.
Windows Insecure By Design? a world of ***!!DUH!!*** It's nice to see the general public starting to wake up to this fact. Expect to see the standard ports (135, 445, etc) closed when Longhorn comes out... maybe And even then, I doubt MS will make any other changes. Or, if they do, they'll open up five or six more ports in the process. :-P Not that I'm bitter... oh no.
Let's never forget the conversation between a fictional Steve Jobs and Bill Gates in "Pirates of Silicon Valley":
fictional Steve Jobs: We're better than you are. We have better stuff.
fictional Bill Gates: You don't get it, Steve--that doesn't matter!
Furry cows moo and decompress.
I just took my son to college this weekend and set his pc up for him. (Ah yes, dad knows FAR more about computers that jr...)
We dropped his stuff off in his dorm and discovering there was only one ethernet jack in his room we left for Best Buy to grab a cheapy hub so he could plug his LINUX box, his PS/2 and his roommate all into the single lan jack.
Well, we blew off the hub because his roommate called his cell phone and said he was "bringing a *thing* from home to hook both of *them* up at once"..
So, assuming he was talking about a hub we blew that off. Well, we got back and discover the roomy had plugged a cordless phone into the lan jack. I pulled the cord and announced that they were lucky system security didn't come up and billy club someone for crashing planet earth into the mooon by plugging the phone into the lan jack. The roomy was sitting there looking like he had crapped his pants.
I plugged my son's pc into the lan and fired it up to make sure it was configured properly with the college system and it was fine.
My son is using Mandrake 9.1 w/KDE 3.1.3tex.
Now, when you fire up Linux *MOST* people are going to say something, it's different you know and if a NORMAL person has a few brain cells functioning, they will notice something is different and not only ask questions but come over to watch..
Nope. Roomy sat there waiting for his chair to blast off, he could have been watching me pilot the starship Enterprise as far as he knew.
I very quickly drew the conclusion that this kid was not only dead in the head, his computer skills are less than ZERO.. I asked him what he has, he told me he has a laptop with Windows 98. Whee! How fun can that be??!!
There were hundreds of kids lugging brand new Compaq and Dell boxes in and they *ALL* had big fat, "WINDOWS XP installed" stickers on them.
You can bet your ass that those kids will be ate up with that shit, probably already, if not for sure by the coming weekend.
Those kids, by dragging all those XP boxes in were building a big petri dish for the script kiddies to play...
I can say this. I'm damn glad my kid is using Linux, I don't have to worry about him getting caught up in all these childish virus/worm/trojan games. This shit has gone way, way too far.
I'm not going to pump all my money into repairing his PC (600+ miles from home) every few days, dumping money down the toilet on anti-virus crapware that does not work, and paying $200 for an OS that just brings you constant headaches.
I told my son that if he wants to stay in that school then the Linux stays on his PC and M$ is forbidden on his machine. If he changes it or let's someone change it, that's it. He goes to local community college with the local idiot beerheads..
I find the article's amusing suggestion that MS could send update CDs to everyone on the planet scary. Its bad enough that I get my monthly AOL CD. I don't want a quarterly MS CD either.
Did anyone else notice this, or was it just me?
No Not Again! Its whats for dinner.
Some of us developers working for smaller businesses need to handle EVERYTHING.
"Hey, Dave, make our fundamentally different, colocated e-commerce sites securely share all their data amongst each other and seemlessly integrate it with this new proprietary MRP solution. Upgrade our computers when we're not using them. Find a legal way to install this one copy of Office onto all these computers. Make our computers faster and better. Don't touch my computer. Upgrade our Norton Antivirus server and all our clients. None of us want login passwords, but we do want security. This one mid-90's era server ought to be enough for all our needs. We want video conferencing on all our sites. We don't want to buy anything."
I do almost as much IT support as I do development.
The best feature of non-Outlook email programs is the inability or difficulty that they have running activex, java, or javascript.
To this date I have yet receive a single email that has ever needed to use any script or programming language to deliver the message so why the heck is it still in and ON by default?
Ah well, all I can do is my part. I patch and have a linux based firewall protecting me. That firewall has had nearly 3000 hits on 135,137, or 139 in the past two days. A month ago it would have had no more than 12 in the same period.
Mac and Linux not targeted? Taking the view of a malicious hacker, why would you bother coding a virus that only affected a minority of computer users? If Linux ever really makes it mainstream, you may find it's just as susceptible.
Well, checking the oil I'd put more akin to checking free resources. Same for most of the other fluids in the car, short of fuel. fuel's akin to turning the thing on in the first place. Do these people need to know how to operate the turn signals, trunk release, windshield wipers, domelight, etc? I'd rate them as your basic intelligent car owner.
As for changing fluids out, the computer equivalent would be to a backyard mechanic, who handles oil and antifreeze coolant. Maybe checks the tranny fluid and takes it somehwere if it doesn't look right. Changes out burned out lights, etc. Stuff that is mostly covered in the owner's manual, or at least has stuff like fluid quantities. In computers, I'd equate that with being able to hook up external devices and get them to work, being able to remove stuff from C:\WINDOWS\START MENU\PROGRAMS\STARTUP, configure basic network settings from instructions for something like DSL or Cable. Calls for support or a technician when something out of this range goes wrong.
A+ certified techicians would equivalently handle basics, like replacing alternators, starters, draining transmission fluid, replacing water pumps, checking differential gear oil, lubing the suspension or steering parts, replacing obviously bad water hoses, and the like. Stuff that stands out. By comparison to computers the person would be able to replace hard disk drives and CD-ROMs, install video cards, install the OS from scratch for the default configuration, configure sound support, and the like. Maybe even dig into the registry a smidgeon.
And above that you'd have your power-technicians, who would be up there with not being afraid to remove stuff like engines, axles, transmissions, steering columns, dash boards, interior parts, etc. These people would be able to play with advanced networking, deal with driver and IRQ conflicts, handle tweaking of the OS, dig into the registry a bit, etc.
Beyond that, you find different people who can rebuild engines or transmissions in their sleep, modify sheet metal artistically, handle advanced upgrading of suspension, and the like. They would in computer equivalents be specialized, but very talented. They probably wouldn't even do much of the lower-level work unless they had to, because they would be more valuable higher.
Well, that was quite long enough of a ramble...
Do not look into laser with remaining eye.
Is it possible that Windows was never designed with security from the start because it was not designed for a network from the start? MS entered the networking and Internet game pretty late and with it came all the worms, trojans and other stuff. Of course, this assumes that the constituents of present-day Windows have a lot in common with the pre-TCP/IP Windows of old. Still, I think it could be one way of looking at the fundamentally insecure design of Windows.
I thought it was amusing when I surfed over to the Post to read the article there was an ad for "Windows 2003 Server" on the page. I had to take a screen shot. If you want it it's here --> http://johnford.net/images/windows_ad01.jpg
...Or, "The Tecn Commandments of Windows Security."
I run Linux on my servers, but for compatibility, certain programs I need, etc., etc., my workstations use XP. I haven't patched anything. I don't trust the patches and especially not the Service Packs. They can break things and slow things down. If my box is working, why tempt fate? There are a few, very simple things to do that will keep Windows almost entirely secure:
1 - No scripting host. If you don't need it, kill it.
2 - No Outlook. Outlook is bad. IE is almost as bad. Everyone should know this by now. And if you must use it...
3 - Don't open file attachments from anybody unless you know what the hell they are! Why is this so difficult? Well, it's because people never...
4 - Unhide the file extensions. You wouldn't eat something from a package simply labled "food" without having some clue what's in it, so why double-click an icon without knowing what it will do? Learn what these extensions are, and Google it if you're not sure what a given one means.
5 - Don't use IE if you don't have to. Mozilla's now advanced and stable enough that you should almost never have to use IE to properly view a site. I never have a problem with popups, and I've never had my browser hijacked. Using IE tempts people to break #6...
6 - Read the question before you answer "Yes." Do you walk around at work slackjawed and answering "yes" to every question you're asked without listening? If you weren't specifically looking for what a site wants you to install, chances are you don't need it.
7 - Firewall. Buy a $30 broadband router, build a Linux gateway, enable XP's own, built-in, pre-installed firewall, or get something like Zone Alarm, depending on your needs and/or level of computer literacy.
8 - Don't download software without knowing exactly what it is. Read the license agreement. Sure, I like to check out neat toys on Download.com too, but not if I have to install Gator or GAIN to use them. See #6. Read!
9 - Check your processes. and read what's going on in there. Google each one. This is a pain in the ass the first time, but do it once and then you'll know when something's not supposed to be there.
10 - Watch who gets your email address. Get two. One for ordering/registering things, and one that you only give to real people.
That's it. I run no antivirus software and my system thanks me for it with good performance. I have not loaded a Service Pack, a patch, anything. None of this is difficult. These rules are simple enough for almost anyone to follow, and the major ones are extremely easy.
This is what grabs me: a new vunerability with MDAC announced on 8/20 is rated as 'Important'. Same buffer overflow problem as 026.. same potential for damage.. most/all corporate customers have MDAC running.. but it doesn't rate a 'Critical'. Are they waiting for exploit code to appear or are they waiting for the sh!tstorm to die down?
While Microsoft certainly has its problems, this attitude is pretty much, in my opinion, bullshit. If the statistics were reversed and Apple or Linux had 95% of the market you'd see just as much trashing on those systems as you see now on Windows. Script kiddies are going to attack what ever gets them the most attention. And attacking something that only has 3% of the market does not get them that attention.
Its the same philosophy of why more Corvettes get stolen than Yugos. Nobody wants a Yugo.
Yes, Windows has internal problems. All OSes do. Its a fact of life.
I want a new quote. One that won't spill. One that don't cost too much. Or come in a pill.
And I think that goes for "conspiracy" too.
Though I do expect that MS will happily exploit their laxness in building their systems if they can do it in such a way as to make their monopoly permanent and legally required.
Umm...I didn't read people's posts, but what about the fact that Mac and Linux make up only a small percentage of the OS used today? Who would want to create worms with a target of ~5% of computer users?
There are some unlucky people who practiced due dilligence and thought they were patched, but were not.
Windows Update had (and still has) a flaw in that it checks registry keys to determine if you have patches installed, rather than the files themselves. Sometimes the registry key is inserted but some or all of the actual patch files are not, for one reason or another. This happened to many people on July 17th, and they were probably really surprised when they got hit by the MS Blaster worm.
One particularly noteworthy victim of this flaw is the US army.
How long ago was that?
There's Bochs, which is free and will emulate an x86 on almost anything, including the Mac, but it's not very fast.
And since about 1994, there have been Macs that can run Windows using a built-in x86 compatible processor, like having two computers in one. You could switch between them by pressing a simple key combination, and it came with software to help you do things like copy and paste between them. The high school I attended had one.
My bosses generally don't believe in "can't", but most of the time they're right.
In the past week, the Merc has been running articles quoting Microsoft authorities as saying, essentially, "Honest Injun we WANTED to require automatic updates, but we thought people would be paranoid of our intentions, so we made updates optional! Now look at the chaos!"
My prediction: There WILL be an attempt by Microsoft, probably successful, to make sure all future Windows versions automatically check for and download updates -- not only bug fixes, but also updates for furthering their own inimical combinations of big brother and forced marketing.
- Wendy
It's so nice to see Microsoft finally get something right.
--Rick "If it isn't broken, take it apart and find out why."
What the article talks about is merely "insecure by configuration", not "by design".
OK, MSFT could and should improve in creating a more secure default configuration, but I expected the article to be more interesting regards the "design" of windows:
Graphics in the kernel, no true multi-user system and filesystem permissions. That, IMO, is what makes Windows insecure by design. And those are issues that won't be so easy to fix without large rewrites and without breaking a lot of backwards compatability. The configuration in contrast can be fixed quite easily. It is on a deeper level where the real trouble is.
To see the magnitude of the problem, go to download.com and check the user opinions of the software listed there.
Lets say you go to see the user opinions of Mailwasher Pro or Disruptor OL.
These programs integrate with Outlook Express and are very easy to configure.
Now half the people who gave these programs negative reviews did so because they couldn't fsking understand what to do.
Who's fault is it then? When they can't understand easy programs like Mailwasher or Disruptor then how do you expect them to figure out stuff in Linux?
For these dumb heads, there is nothing you can do.
Its a known fact that the easier a firewall is to install and configure, the more insecure it is.
A good firewall should be one where you need to configure many of the options yourself.
Is somebody going to tell that to the users of Zone Alarm which pretty much needs no configuration?
Linux is more secure because a lot of stuff is configurable.
Bush is on fire and its not good for my lungs.
Coming late to this discussion but I still have to say this even if nobody reads it...
(emphasis mine).The quote from this article in a highly visible magazine is:
This is the one question. Why are there so many technical people that, knowing all the risks and odds, still don't dare patch the systems for fear that the cure will be worse than the dissease?
I know that the writer is mostly concerned with all the ignorant people at home, but when Microsoft itself tells people to not connect to the Internet because of security concerns, then logic fails. How should these people get their updates then?!
Enough ranting since chances of this being read are small anyway. No sense in wasting time.
Karma? What's that again?
As someone who works in security, "insecure by design" has a precise meaning to me, which I've not seen mentioned here yet. The developer's intentions have nothing to do with it. "Insecure by design" means every implementation of a given system will share a common set of security vulnerabilities. In other words, the design (think API or protocol) itself is flawed. No implementation is safe.
Example: The design of the http protocol does not provide any method of running arbitrary code from the client on the server. A perfectly implemented web server will contain no remote vulnerabilities of this type. Flaws in particular web servers like IIS are caused by mistakes in the implementation, not the http protocol itself. The protocol is secure by design with regard to this attack.
Contrast this with a protocol whose design is insecure. Nothing in the SMTP spec addresses the issue of spam. High-volume anonymous message injection is allowed by the protocol. Solutions to spam have to be implemented externally with things like blacklists and filters (which are considered external even when run during the SMTP transaction as they aren't part of the SMTP protocol itself). No SMTP server, no matter how perfectly implemented, can both completely follow the SMTP spec and reject all spam. Thus SMTP is insecure by design with regard to spam.
Nebulous terms like "windows" and "secure" mean next to nothing by themselves. What is "windows"? The NT kernel? The win32 API? The set of programs and services enabled by a default install? Secure against what types of attacks?
For reasonable definitions of the above, the statement "Windows is insecure by design" certainly makes sense. Take "windows" to mean the win32 API and "secure" to mean enforcement of access control. Remember the shatter attacks discovered last year? That's a flaw in the design of the win32 API. No implementation is safe. It fits the definition of "insecure by design" perfectly. And Microsoft has alluded to more such vulnerabilities lurking in the win32 API (remember when they said they couldn't reveal all the APIs for security reasons?).
Democracy is two wolves and a sheep voting on lunch.
I'm runnning windows update now, and hey whaddya know.. 17Mb... that's gonna take a while on my 56k dialup. Hmmm... Maybe I won't run it after all..
I'd like to know if this is really true.
When the NT kernel was being designed it had security in mind. There are varying levels of privelige, access control lists for the file system and system objects etc. Some of these features are only appearing in Linux now with 2.6
Sure there have been flaws in the implementation, services turned on, running with system level priveleges with ports exposed to the internet. So Windows the system is not secure out of the box. But is it insecure by design?
A lot of people run windows as an administrator because programs written in the 9x era were not designed with the security model in mind. Programs want to access system level files or registry settings. Windows XP brough the two product lines together but in order to maintain the backwards compatibility they had to sacrifice the security.
Also people hate hitting security barriers whenever they want to reconfigure something.
I would like to see some evidence that a box running NT can NEVER be secure due to its design, rather than just not being currently secure due to its implementation.
All the trolls about MSLinux seem to assume that NT is a terrible cludge that MS ought to abandon and just build a Windows GUI over Linux like Apple did over BSD.
Is NT really flawed in its design or is it just the layers of services, APIs and backwards compatibility fixes that make the current implementations of NT vulnerable.
If all Win32 apps were sandboxed the way win16 apps are and MS migrated to a new API would this solve a lot of the problems?
I would welcome links to articles about this.
"Taligent is still pure vapor. Maybe they'll be the last who jumps up on Openstep... "
> Tell your friends: Don't preview email. Delete email you don't
> know or trust. Don't open attachments if they're not absolutely
> known and expected Update early and often
No. Tell them go to www.pmail.com and get Pegasus Mail, and read
email with that. "Don't use Outlook. It's too dangerous."
Cut that out, or I will ship you to Norilsk in a box.
"The chance of a patch wrecking Windows is dwarfed by the odds that an unpatched PC will get hit."
Yet my workplace has had several problems directly caused by Windows updates. It's not frequent, but it's happened far more often than it should. It would be different if the problems were intentional and documented (see Red Hat example below), but they weren't. We had to roll back the patches and intentionally leave ourselves vulnerable until the next patch that fixed the prior patch was released.
I have had only one Red Hat security fix that caused (minor) problems with one of the Linux systems (the web server). An Apache upgrade was made in which the configuration format for one option (I can't remember which one) was changed, making the current configuration non-functional. However, this was planned by the Apache Group and was documented in the upgrade RPM. A simple tweak to the configuration file brought the service back, and life went on.
"And for those saying they don't trust Microsoft to fix their systems, I have one question: If you don't trust this company, why did you give it your money?"
This is a bone-headed question. They gave Microsoft their money because they had to. Most people still don't know anything but Microsoft. They blindly hand over their money year after year because, thanks Microsoft's abuse of its monopoly position, they don't have a choice.
Here's what was installed on my XP machine at work: .NET Framework version 1.1 .NET Framework Service Pack 2, English Version .NET Framework version 1.1
Successful Thursday, August 21, 2003 Security Update for Microsoft Data Access Components (823718) Web site
Successful Thursday, August 21, 2003 August 2003, Cumulative Patch for Internet Explorer 6 Service Pack 1 (822925) Web site
Successful Wednesday, July 30, 2003 Windows Error Reporting: Recommended Update (Windows XP) Web site
Successful Thursday, July 24, 2003 Q322011: Recommended Update
Read more... Web site
Successful Thursday, July 24, 2003 Recommended Update for Windows XP SP1 (817778) Web site
Successful Thursday, July 24, 2003 DirectX 9.0b End-User Runtime
Read more... Web site
Successful Thursday, July 24, 2003 Security Update for Microsoft Windows (819696) Web site
Successful Thursday, July 17, 2003 821557: Security Update (Windows XP) Web site
Successful Thursday, July 17, 2003 Security Update for Windows XP (823980) Web site
Successful Friday, July 11, 2003 817606: Security Update (Windows XP) Web site
Successful Friday, July 11, 2003 823559: Security Update for Microsoft Windows Web site
Successful Friday, June 27, 2003 Hp Printer Driver Version 4.20.4100.430 Web site
Successful Friday, June 27, 2003 Q282010: Recommended Update for Microsoft Jet 4.0 Service Pack 7 (SP7) - Windows XP Web site
Successful Thursday, June 26, 2003 327979: Recommended Update Web site
Successful Thursday, June 26, 2003 DirectX 9.0a End-User Runtime
Read more... Web site
Successful Tuesday, June 24, 2003 Microsoft
Read more... Web site
Successful Tuesday, June 24, 2003 814995: Recommended Update Web site
Successful Tuesday, June 24, 2003 331953: Security Update (Windows XP) Web site
Successful Tuesday, June 24, 2003 329170: Security Update Web site
Successful Tuesday, June 24, 2003 811630: Critical Update (Windows XP)
Read more... Web site
Successful Tuesday, June 24, 2003 Q329048: Security Update
Read more... Web site
Successful Tuesday, June 24, 2003 Q323255: Security Update (Windows XP)
Read more... Web site
Successful Tuesday, June 24, 2003 Microsoft
Read more... Web site
Successful Tuesday, June 24, 2003 814078: Security Update (Microsoft Jscript version 5.6, Windows 2000, Windows XP) Web site
Successful Tuesday, June 24, 2003 817787: Security Update Windows Media Player for XP Web site
Successful Tuesday, June 24, 2003 810577: Security Update Web site
Successful Tuesday, June 24, 2003 810833: Security Update (Windows XP) Web site
Successful Tuesday, June 24, 2003 810565: Critical Update Web site
Successful Tuesday, June 24, 2003 328310: Security Update Web site
Successful Tuesday, June 24, 2003 Q329115: Security Update (Windows XP) Web site
Successful Tuesday, June 24, 2003 Q329390: Security Update Web site
Successful Tuesday, June 24, 2003 Q329834: Security Update (Windows XP)
Read more... Web site
Successful Tuesday, June 24, 2003 814033: Critical Update Web site
Successful Tuesday, June 24, 2003 Q329441: Critical Update Web site
Successful Tuesday, June 24, 2003 Q815021 XP: Security Update Web site
Successful Tuesday, June 24, 2003 816093: Security Update Microsoft Virtual Machine (Microsoft VM) Web site
Successful Tuesday, June 24, 2003 Q817287: Critical Update (Catalog Database Corruption in Microsoft Windows XP) Web site
Successful Tuesday, June 24, 2003 811493: Security Update (Windows XP) Web site
Successful Tuesday, June 24, 2003 330994: April 2003, Security Update for Outlook Express 6 SP1 Web site
Successful Tuesday, June 24, 2003 818529: June 2003, Cumulative Patch for Internet Explorer 6 Service Pack 1 Web site
Canceled Monday, June 23, 2003 Microsoft
Read more... Web site
Failed Monday, June 23, 2003 DirectX 9.0a End-User Runtime
Read more... Web site
Successful Thursday, November 01, 2001 Windows XP Update Package, October 25, 2001 Web site
S
Not that I am a Windows fan but if Mac or Linux was the most popular OS wouldn't most viruses and worms target these systems? Window's might have it's security problems but I see new updates and security patches on my RedHat boxes all the time. Couldn't these explots be used for viruses if virus creators targeted Linux or Mac?
I never liked you
It's simple. No end user control. Ever try to read the news on a Yahoo page that has all options missing except about macromedia flash?
The only way to turn off the noise was remove the player. Until they fix the problem of no user control, it won't run on my systems.
A simple always functioning stop and play buttons are all that are needed but are lacking in many in your face blinking wiggiling distracting ads. Even if ESC would work like animated GIF's stop, but even this is non-functional on FLASH. The stop button does nothing, right clicking to uncheck play does not work, only removal works 100% of the time. It's the same reason the blink tag was so hated.
Since I don't need to see all the trivial stuff to read the news, I just do without the player as it's the easiest way to kill the video noise.
The truth shall set you free!
You obviously didn't RTFA.
You
people create virii for windows because that's what people use, not because it's more insecure than other OS's. When linux gets more popular people will start making virii for it.
Rob Pegoraro
The usual theory has been that Windows gets all the attacks because almost everybody uses it. But millions of people do use Mac OS X and Linux, a sufficiently big market for plenty of legitimate software developers -- so why do the authors of viruses and worms rarely take aim at either system?
Even if that changed, Windows would still be an easier target. In its default setup, Windows XP on the Internet amounts to a car parked in a bad part of town, with the doors unlocked, the key in the ignition and a Post-It note on the dashboard saying, "Please don't steal this."
As to why this was posted on Slashdot? For the bashers. It's good to wake up in the morning and feel righteous. But seriously, it's a good summary for those that keep arguing this point, that is if people would bother to RTFA. It also puts a little more credibility into it than the average slashdot troll.
"Last one in is a rotten goblin!" - Kepp
As an ex Windows admin, the thiing that I found most difficult about Windows was not a lack of security by design. Downloading the patches and keeping the AV up to date will suffice normally. No, the problem of windows, to me, lies in that it is a fucking mess.
/bin, /usr/bin, /usr/local/bin etc, confusing for a newbie), but the fact that Windows has literally tens of dozens of directories that belong to the system, that are both undocumented and not self explanatory, as well as the registery, which is an inconsisten fucking mess if there ever was one are things that make windows a pain.
This may sound ludicrous in view of the jungle that one faces when one moves through a *nix directory tree on the command line (e.g. why is there
On top of this there are so many design decisions that are superficially a good idea, but make things hell when one goes beneath the hood. An example is the desktop. From a visual point of view it might make sense to only store data in my documents and below that, which is also encouraged by the open/save dialogue, but the My Documents sits in a deep sub folder in the real directory tree. The actual dialogue boxes of so many system controls are anything but friendly. While the wizards make things simple in a linear way, they are a stop gap measure screwed on top of a system that is anything but consistent and visually well though out otherwise.
To me it seems that MS designs it's system in that the core OS team has first go at making the bitch work, and after they are done, the mess is passed on to the UI team which then has the pleasure of slapping crap like wizards and My Documents and tons of irritating marketing reminders (passport, messanger bla bla bla, hide those icons so you can't find them again) on top of the system so that MS can call it "User friendly".
Fucking bullshit.
Read the rest of this comment...
That, in and of itself, is funny.
Zodiac Survey
One of the things that I fear the most is an actual terrorist attack using viruses to completely disrupt our financial system. It could be pretty simple and still be successful simply because the countries that have the money are the same countries that the terrorists are targeting! While countries like Iran would be "hit" they would not suffer nearly the damage that countries like the U.S. and Great Britan would. Because of this possibility, I think it is very important that the free countries of the world take immediate steps to harden themselves against computer based terrorisim, worms, viruses, and other security issues.
I think that there is poor security designed into Windows. Microsoft knows how to design adequate security, as proof of that look at the X-box. It is quite secure. This probably means that a future generation operating system is going to take the "lessons learned" from the X-box and apply them to that new O/S. This will be the PR story at least. The truth will be closer to MS obtaining a software monopoly on the Windows platform. They will control licenses for it and will require your source code for evaluation before you get the key that will allow installation.
Perhaps poor security is better than the alternative that M$ will dream up. They are driven by profit (every company is) and will take full advantage of any opportunity that they control (as they have already demonstrated).
After the past couple of weeks, it is obvious that there is a business opportunity out there for someone OTHER THAN MICROSOFT to offer a product for Windows that is a full featured security system for desktops (and servers).
I'm wondering what this kind of system would entail? How could you provide exceptional security to everything from a home PC to an enterprise level network? There are some obvious things like firewalls, anti-virus protection, automated patches, controls for security and permissions, and so on. But there are other things that could be done too. How about a key system for executing software? If the key does not exist then the software (exe, process, driver whatever) simply does not get permission to run. What about software that monitors network traffic and when certain limits are set human intervention is required of the PC is taken off line?
I am also wodering about the ethical issues associated with all of this. If Ford puts a car on the road that they know is insecure and an accident happens, they have liability. If I drive a car knowing that it is unsafe, I have liability. If the state allows a road to go unrepaired, they have liability. Isn't the same thing true for a software product? In today's world, in this litigious society, isn't M$ opening themselves up to a great deal of liability when their software is a swiss cheese of vunerabilities?