Slashdot Mirror
The Cost of Computer Naivete
wiredog writes "What happens when you put an unprotected Windows 98 box on a broadband connection? Two perspectives from two reporters for the Washington Post (frr,yyy): The User's " an odyssey that has taken $800 and roughly 48 man-hours over nearly three weeks" and Digital Doctor's "Her PC was in such bad shape, it required 10 1/2 hours of surgery to restore it to working condition.""
(Yeah I know, fair to Microsoft... on Slashdot!)
Windows 98 is 6 years old and isn't sold with computers anymore. This test just shows remaining Windows 98 users they should keep up to date or upgrade to XP.
It is bad enough with 98, but what if the same experiment where conducted with XP, considering all the wild RPC attacks?
"Here's a spoiler: You're will die alone."-Triumph the Insult Comic Dog
Whatever happened to:
Format, fdisk, re-install do da, do da?
Pull all the useful data off onto a spare disk and clean the machine. Just don't be like my neighbor, and wipe, then install your new os on the spare disk.
=================
Unix is very user friendly, it's just picky about who its friends are.
I wanted to take a 98(non-second edition) box, no patches, no firewall, and no updates and visit a frew pr0n sites with IE, and see how much I could get it to be 0wned with spyware, plugins, popups, etc before it was rendered unsuable. Make it a competition to see how quickly it would bring the system down.
The screenshots would have been hilarious. If I only had VMware.
'Surgery' is a little misleading since it suggests hardware damage was incurred. If I was determined to use a metaphor, I'd go for 'therapy' :)
Prosperity is only an instrument to be used, not a deity to be worshipped. Calvin Coolidge
I find it interesting (and a little frightening) how otherwise educated people (reporters, for instance) can be so clueless in critical areas. Is this inevitable for people?
And yes, I do consider basic computer literacy a critical skill; your computer is not just an appliance. Letting your computer get 0wned is much like letting your car run out of oil.
----
"Ours was a free culture. It is becoming much less so."-Lawrence Lessig
Consider a hypothetical Win98 user. For the sake of argument call her 'my mum'. She runs a Pentium II-450 and uses it for email, word processing, web browsing and very occasional other bits of office. The computer runs all these tasks fine, but it really isn't powerful enough to run XP. Windows 2000 would make life better, but it will go out of support soon and if you worry about getting legal copies, it's not available in a home edition so it's very expensive. Windows ME can hardly be called an improvement.
So you're saying people in this position need to spend money to upgrade their hardware despite the fact that the current computer runs all the software they want to run at a speed they find acceptable.
Yes I know; install Linux.
In soviet russia stale jokes recycle you!
..of my initial days of tinkering around with RedHat 6.x.
My old office had two RH boxes on a static IP. There was no such thing as an administrator. As a programmer, I was supposed to install all applications, configure them and also *ensure* it was up and running.
Got a call from the ISP two days later. They had shut down the machine because of complaints from other users - apparently some application from these machines were flooding the network (I never did find out what they were doing though). Got the ISP to restart them. Frantic googling and few "security guide" downloads later, I started exploring what was wrong with them (incidentally, I was *still* accessing those machines remotely - my office wouldn't pay for me to go to the site to check the machines). Turned out there were THREE rootkits installed on one of thsoe machines. Found the traces of one of the possible three attackers - was some IP space in netherlands. Later found that that range of IP addresses was actually under contention and was thought to be not allocated and probably belonged to some malicious/rogue ISPs (I haven't understood this part yet).
Not knowing much, I got them to reinstall the OS. Of the three, two rootkits appeared within 2 days. Another re-install, this time with the Linux security guide implementations for securing the box. Things were ok for about 2 weeks or so. I then had yet another attack and someone was using my box as a IRC relay host (or something) and I was still in trouble.
Finally, after some RH updates and more tweaks (and ipchains and iptables install/config), I was able to have reasonably secure machines.
Trial by fire, but I learnt a lot!
*shiver. I hate to think how it would have been, had those been '98 machines
http://efil.blogspot.com/
I bet he didn't check the hosts file. I bet that was null routing the liveupdate DNS records.
Once the infections were removed, LiveUpdate still could not retrieve the latest virus-targeting data. So I gave up on that and uninstalled and reinstalled the entire Norton AntiVirus program, hoping that its update system would work afterward -- but it did not. I again tried to access Microsoft's Windows Update Web site, but IE still failed to respond.
Suspecting a problem with Internet Explorer itself, I tried to repair IE using the Add/Remove Programs control panel. That didn't work either, producing an error message that indicated some file or files necessary for IE were damaged or inaccessible. Trying to restore the previous version of IE, 5.5, yielded no benefit, either.
Finally, I abandoned ship, reinstalling the entire Windows 98 operating system to repair the damage to Internet Explorer and allow Kathleen's computer to access the Internet and update the Norton AntiVirus definitions.
I always check that file. It always gets hijacked. I'd be willing to bet that was his problem.
From the article:
"What a revelation: Four programs -- one a firewall and three to combat spyware -- I downloaded FREE worked better than one I paid through the nose for. Why would anyone create these terrific programs for free? Often, as in the case of ZoneAlarm, they hope people will like the product so much they will buy an upgrade or, in the case of the spyware, pay to subscribe for upgrades."
She was right in the middle of the trees, and couldn't see the forest... yes, free software, even WINDOWS free software, works better and does what it says it does.
Talk about leading horses to water...
It's now a major pain to install a windows system from scratch, using the original CD.
You now have to
- think about getting the latest service pack first
- think about getting a firewall with its license key (love it when the firewalls ask to be registered before working, and need an internet connection to be registered!),
- think about getting an anti-virus (same story)
- then install the system (disconnected from the network, of course, so forget about "configuring an internet account" during the install)
- install the service pack
- install the firewall and the anti-virus and make sure that they're running
- go to windows-update and patch your system
- start to play.
This is an impossible task for 99% of the regular windows users, who don't even know what a firewall is and how to configure it. There have been improvements in the installation process of OSes and applications, in order to make it possible for reg. users, but all these efforts have been ruined by virus and worm writers.
And I'm not even talking about spyware, adware and spam...
You don't need any stinking non-Free software to make ghost images.
/path/to/image.gz
/path/to/image.gz | dd of=/dev/hda bs=128K
Here's how you do it:
0. Set up a recipient (either a second hard disk, a machine on the network - whatever - I do it over the network)
1. Boot Knoppix on the machine you want to ghost.
2. Mount the destination.
3. dd if=/dev/hda bs=128K | gzip >
To restore:
0. Set up the source.
1. Boot Knoppix on the machine you want to install.
3. Mount the source.
4. gzip -dc
Tips: Overwrite any free space on the machine you want to ghost with a huge file filled with 0x00, then delete the file. The disk image will compress much better as you've scrubbed the deleted files.
I use a system like this to ghost many machines at a time (an image server can easily deal out 30+ images at once). It'd cost a fortune to license many copies of ghosting software - with Knoppix and a very small shell script, I've got an automated system which will do many machines at once. (A typical 40GB fresh WinXP install with our apps compresses to under 1GB with gzip).
If you're doing WinXP, remember to either make a Sysprep build or use something like System Internals free (open source but not truly free) tool to change the SID and hostname of the machine when it's booted the first time. (This is the approach we use due to the limitations of sysprep).
Oolite: Elite-like game. For Mac, Linux and Windows
I saw this in the Washington Post yesterday and thought it interesting enough to send the reporter (Kathleen Day) a note, which follows, summing up my thoughts on the matter. I haven't heard anything back yet (and I don't necessarily expect to).
-Phil
Ms. Day:
I find it absolutely fascinating that problems such as the one you encountered are treated primarily as a user education issue. It's true that there are some things that everyone needs to know in order to use a computer. It's also true that savvy users can often avoid security mistakes. But one wonders, "Why is it that users *have* to be security-savvy in order to effectively use their computers?" I'd submit that the problems you wrote about are mostly the result of design flaws and not naivete. In many ways, I think the computer industry has set the bar far too low by blaming users for problems it has created. Put another way: what would you think if you had a car that would sometimes break down without warning if you drove it on the highway without first buying additional parts?
As I see it, there are two design weaknesses that contributed to the problems that you wrote about. First, basically anything you do on a machine running Windows is done with full administrative privileges. In one way, this makes sense: you own the machine, so you should be able to do anything you want with it. The problem, however, is that this blind trust allows malicious software to do pretty well whatever it wants. Most other operating systems (Mac OS X, Linux, and Unix) require you to take some special action (usually typing a password) in order to install software or alter the operating system. While this can't prevent you from choosing to install malicious software, it makes it quite difficult to do so unknowingly. To stretch the car analogy a little further: people can't modify your car's engine without your knowing about it because you have to open to hood in order to reach it. Computers should work the same way.
The second problem is that Windows doesn't make a strong distinction between programs (the applications that you run) and data (documents and the like). This makes several attacks a lot easier, as malicious programs can sneak onto your machine by masquerading as data when you are browsing the Internet. For most non-Windows operating systems, there's something that you have to do explicitly to say, "This is a program and it's OK to run it." If Windows has these protections, there still wouldn't be anything to stop someone from maliciously sending you data you didn't want--but your computer wouldn't be able to then run that data as if it were one of your programs.
It's a mistake to say that anything is totally secure. There have been (and will continue to be) successful attacks on operating systems other than Windows, of course. But I think it's a mistake to think that Windows has so many (and such severe) attacks just because of its dominant market position. True, it's low-hanging fruit for those with a malicious bent. But it's also so much easier to attack Windows because of the way it's been designed.
The very concept of a computer virus depends on both of these two factors. Take away the administrative powers, and the virus has little if anything to infect. Remove the confusion between programs and data, and it becomes much more difficult for malicious software to spread. Many regard it as unnecessary to run antivirus software at all on non-Windows systems. While I'm personally not sure that's a good idea, it does give one an idea of the relative security levels involved.
I think these security problems may ultimately threaten Microsoft's market position. The bad design decisions that are part of Windows weren't made because Microsoft is dumb (quite the contrary: they employ a lot of very smart developers and architects). They were made for market-driven reasons. Lots of old software (dating back to old versions of Windows and the even older days of MS-DOS) simply won't run in a more secure environment. As
I maintain computers for a set of Curves for Women gyms owned by a couple of friends of mine. I run into the spyware/malware problem all the time.
Each gym uses DSL to connect to the internet. While working on one of the computers this weekend, I noticed that McAfee Personal Firewall (I stopped using Norton a while ago) wasn't seeing any inbound events, unlike the other gyms where it sees 10,000 to 20,000 events per week. A little investigation showed that the DSL modem at this site has a built-in DHCP server/router/firewall/NAT function. Seems like the DSL providers are getting a clue and building necessary capabilities into the hardware that the customer has to have just to connect to the Internet.
Don't underestimate the power of The Source
In his case, he needed
- a CD with all of the relevent tools and updates
- a windows boot disk with CD support
- an understanding of the windows command line in order to copy a subset of these tools to a convenient folder on the hard drive from the CD
- The knowledge to run these tools from Safe mode, and how to get there in the first place
- Include in the subset of tools one that can fix the broken LSP setup.
tips - I deal with this stuff all of the time. The best data on this stuff can be found in articles at spywareinfo.net - the forums are not bad either, although spywarewarrior.com also has good forums. also good to have is this list of known rogue spyware cleaners, along with this list of Anti-Spyware Orphans & Outcasts[LSP or Layered Service Provider is a piece of software that can be inserted into the Windows TCP/IP handler like a link in a chain. However, due to bugs in the LSP software or deletion of the software, this chain can get broken, rendering the user unable to access the Internet. Spyware is good at this, and some cleaners leave a broken LSP behind.
With the correct tool, the fix takes seconds. Without the tool, you need to uninstall and re-install the winsocket, or else the same with the entire network support. Otherwise you fall into the trap this poor bloke got into.]
My current recommended free antivirus is Avast! Home Edition, which is very low maintenance for the home user, and requires registration for the free license. It also protect a number of common Instant Messenger clients, as well as several common P2P clients. It is better than AVG in my opinion, and detects many trojans as well as spyware.
You can get a system that is so hosed that it will not boot, not even into safe mode, even under XP. The solution there to remove the hard drive, drop it into an external drive enclosure, and hook it up to another system where you can use scanning software to do a basic clean so you can boot in the original configuration. Once it boots you can install cleaners from safe mode, and then run cleaners from inside every user account.
"It is a greater offense to steal men's labor, than their clothes"
What I think is shocking is the fact that the PC tech apparently did not feel it necessary to wipe the OS and start from scratch. Both these articles perpetrate the dangerous notion that being r00ted is recoverable. Once a system has been compromised, there's no telling what other nasties reside therein.
This bit of info was sorely lacking from both articles.
A Pirate and a Puritan look the same on a balance sheet.
Anybody whose data is worth less than their computer is just using it as a toy. Regaining access to your data is of far greater value than making the stupid hardware run. If it was one of my computers, I'd happily pay the $800 (or even $8000) to get my data back, and *then* I'd ditch the "ancient piece of crap machine" and buy a new one.
(Well, actually, I keep distributed backups to avoid this problem, and use almost exclusively ancient piece of crap hardware since the machines themselves are irrelevant. So if it were my computer, I'd probably just spend the $800 on women and beer.)