Slashdot Mirror
Desktop Search Tools Will Help Virus Writers
An anonymous reader writes "With desktop search tools all the rage, ZDNet is reporting that virus writers could take advantage of the technology to produce more efficient malware. "Any software that can index and capture data on a users PC will be subject to virus and Trojan exploits. It is just a matter of time," said an analyst at Frost & Sullivan. "
Don't shoot the messenger. Desktop search is only exposing a weakness that is already there as it can only index stuff it has permission to index.
As always, Schneier is particularly lucid on this issue, see his essay here
Simon.
"It sounds like great technology but don't deploy it without considering the security implications. With any new product area there is a need to consider security," said Campbell.
How about we not worry about userland programs being "insecure" when the real issue is that the malware was installed on the machine in the first place. Just because the desktop search features can index a large amount of personal data does not mean it's a security issue... The security issue is something entirely different and needs to be treated as such.
Are we supposed to just suffer through computer-use because Microsoft and its users are lax about security so that life is easier?
Dimension Data's Campbell said that if companies do choose to deploy desktop search tools, they should take extra care to ensure viruses do not get a chance to execute on the desktop.
Companies like who? Microsoft right? Oh wait, we are supposed to just live with how shitty Windows is at userlevel security right?
This article was a bunch of trash and really was speculation more than anything else. Move along, there's nothing to see here...
Athletic Scholarships to universities make as much sense as academic scholarships to sports teams.
Don't give them any ideas! =)
Right is wrong when left is right.
While also increasing the ability for anti virus software to patrol and protect the computer, surely? Allowing more sweeps of the system to be performed, most often?
"more efficient malware"
Do virus writers really care that much about efficiency? It's not their PC that's gonna run the thing. They could just as easily make the thing continually grep for documents containing 16 digit Luhn-validated numbers and send them off someplace when they're found.
Unknown host pong.
So tell me, is there any technology that virus writers can't take advantage of?
And don't say Fire Walls. It wasn't so long ago that a well-known fire wall itself proved to be the vulnerable chink in the system.
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
Generally, bash is superior to python in those environments where python is not installed.
Technology can be applied for either good or evil.
Who'd have thunk?
Click here or here.
I have always found "grope" to be a much more effective and fun exploit. Whether you're in the office, or on-the-go, grope gets results !
or maybe it will be easier to track down the malware since it will be indexed along with everything else?
No matter if people use the various desktop services or not, there's always going to be attacks from viruses and related stuff. I don't think people need to spread the virus scare any further than it is. What do you think virus senders want? Personal information, perhaps, but even more the attention. Why give it? Skipping out on helpful applications isn't the way to avoid these things. Nothing can replace an increased safety from people
Filesystems!
We must eliminate these horrors from operating systems or we will never be rid of all this nonsense. And after we get rid of filesystems, executables should be the next thing to go.
already happens, a misconfigured Kazaa will share your entire drive :)
Try firing it up (or an adware light version) and looking for "inbox", then select any individual one and you can then search for all that persons shared files.
Nosey, who me...?
CJC
So lets all agree for the moment that in the area of security (well, in most areas, really) Microsoft sucks.
On the other hand, the fact they make no guarantees about suitability of their products is a red herring. I believe the OpenBSD people _do_ actually care about security. Have you seen the BSD license (under which OpenBSD is licensed)? It uses exactly the same verbiage.
The terrorists have won. Any new power of people over our environment now spawns fear that another person will hijack it, and use it against us. "We have too much freedom, too much openness - we can't handle it".
The hell with that. While that fear is multiplying across the world, the politicians charged with protecting us are exploiting and expanding it, while we give them more power without accountability: WHERE'S OSAMA? The corporations smell the money, and are switching their propaganda machines over to fearmongering, rather than fanning the flames of greed. As long as the actual threats are left to fester profitably, we'll suffer with the poison they ooze into our lives.
We need to stop trusting these sources of FUD. When someone tosses more poison like this at you, challenge them - what are they doing about it? How are they standing up for their freedom, and yours? When they cop out with "it's not my job", "it's too hard", or "I don't know", just cut them out as a source. And get on your own way to protecting yourself and others. Not with innuendo that just makes the threat worse, but by installing firewalls on Windows, circulating anti-spam and anti-phishing warnings to your friends, and remaining calm. Our society is growing painfully through our dependence on our media. If we handle it well, we'll have qualified our traditional trust with verification. Otherwise, we won't have anything: freedom, peace, calm, or a civilization at all - just back to cowering in terror in caves.
--
make install -not war
Please stop innovating new software products. Don't you know they can be exploited.
Always keep in mind that for everything you think it good, it is always twice as bad.
If you don't believe me, just ask Internet tech writers and bloggers.
Let me know when they invent the knife you can't cut a person with.
Imagine having a job where you're paid big money to state the obvious. The dream of all useless people is to become an analyst.
Undoubtedly someone will point out that one tool is more useful for nefarious deeds than another, but then how many people get killed by staplers? This is not news!
Stand back. I've got a brain and I'm not afraid to use it.
it is so true. Windows just sucks. Its not good for productivity at all. The code is a pure mess. If they want to be a worthwhile platform they might as well just rewrite the entire OS from the ground up.
Abandon all hope ye who enter here...
This is a completely useless article. Why blame the Desktop searches??? Once they're in, they have control. If a Sys Admin let the user have enough permissions to index the file with the vital data, surely that is the Sys Admin's fault.
On UNIX the old adage was that once an intruder had a shell access to the box, you had to assume they could escalate their priveleges. This may not be possible in reality, but makes you focus on shoring up the ways in instead.
[% slash_sig_val.text %]
My solution to this problem is iron-clad. I keep all my banking accounts empty and have nothing of value on my computer, or in life.
but have you considered the following argument: shut up.
The problem is that these programs can be the method by which the malware gets on the machine.
Example: Google Desktop Search contains a buffer overflow. You visit a malicious web page. Nothing happens. Later that day, when GDS is indexing your web browser cache, it processes the malicious page, and infects your system.
We dont need to worry about writing secure systems, becasue only bad people will attack us regardless of how secure the systems are.
Right.
Security is about layers. Every layer should be built with security in mind. Lets take a walk down memory lane...
The Internet was initially a collection of sites who were all friends. Only "honourable" people had access, so security wasn't much of an issue. So things like the r* UNIX tools were created. Systems were not built with security in mind, because security was not a problem. As the internet becomes larget, with more access, security becomes more problematic. The Morris worm wasent even a directed attack, but an experiement gone bad. But directed attacks started to happen. Sendmail started its bug-of-the-month club. The Internet/Unix/C communities started thinking about security, and eventually things got better. (not perfect, but better).
The Microsoft community (that is, MS reared programmers, not to mention (some of) MSFT itself) attitude is "how dare you attack our systems?! We dont need to worry about security, because the problem is with the attacker, not with us!" And things are bad. Exploits are discoverd and exploited by the bad guys as frequently as they are published on sites like bugtraq.
Notice a pattern? Good.
The problem here is blistfull ignorance. The Internet/Unix community of the 80s had a good excuse, nothing comparable came before them. The MS community does not. Security is Job #1. Unfortunatly, as you have proven, the pattern breaks down at the most important step "learn from your mistakes".