Slashdot Mirror


Sneak Peek At Microsoft Anti-Spyware

Ant writes "Broadband Reports mentions Neowin's sneak peek of Microsoft's upcoming anti-spyware software recently acquired community favorite Giant spyware; Microsoft has code-named their re-hashed version of that software 'Atlanta.' It is currently in an internal beta test. There are screenshots of the application in action."

34 of 440 comments (clear)

  1. Ironic methinks. by grub · · Score: 5, Insightful


    At the risk of sounding trollish... I think it's more than a bit ironic that MS is now going to bundle spyware when a good chunk of spyware is installed thanks to bugs within the present code. Why not deal with existing issues first?

    Oh wait, new bells and whistles are good PR and prompt upgrades.

    --
    Trolling is a art,
    1. Re:Ironic methinks. by confusion · · Score: 3, Insightful
      Part of my thinks the irony is abusrd - they are going to great lengths to fix a problem they created in the first place. But, the reality is that no matter how good they got, there will always be some holes that spyware gets in through, maybe not as many or as frequent. Also, it's hard to keep people from clicking "yes".

      Jerry
      http://www.syslog.org/

    2. Re:Ironic methinks. by Anonymous Coward · · Score: 2, Insightful

      It's the Microsoft Way - Sell the problem, then sell the solution.

    3. Re:Ironic methinks. by ack154 · · Score: 4, Insightful

      Also, it's hard to keep people from clicking "yes".

      I don't think it's so much clicking "yes" for most people (joe user)... it's more of clicking "go away" on things.

    4. Re:Ironic methinks. by dioscaido · · Score: 4, Insightful

      Have you been missing the stream of patches coming from MS? How are they not dealing with the primary issues?

      Even so, please tell me which pieces of spyware exploit legitimate security holes? The "security hole" they exploit is that users run as admin. Hardly a bug in the OS, just a horrifically misguided ease of use 'feature' in the installer. Easily fixed. I've never gotten infected with spyware while running as a Limited user, and neither has my Mom, who has a penchant for running little apps she finds on the web. In the cases where they are malicious, she just gets a protection fault and knows to happily move along to the next little animation.

      http://www.techproblemsolver.com/limited.html
      h ttp://www.dotnetdevs.com/articles/RunningAsNonAdm in.aspx
      http://blogs.msdn.com/aaron_margosis/
      ht tp://www.pluralsight.com/keith/book/html/howto_r unasnonadmin.html
      http://support.microsoft.com/de fault.aspx?scid=kb; en-us;305780

      For the handful that did take advantage of some buffer overflow, please point out those vulnerabilities that remain unpatched through Windows Update.

    5. Re:Ironic methinks. by Ralconte · · Score: 2, Insightful

      I felt the irony too, and here's why. Its the damn cheery Win XP layout that just sort of screams at you. You have to download, install, scan, and then (probably) confirm that you want something with an obscure name copied to some obscure directory on your hard disk.

      If Microsoft can't plug the hole, why's there a dialog box: "Do you want to uninstall the keylogger?" I think its all these layers and cartoons for something that could just be buried in the OS that may just irk some people.

      But those people are all just those wacky Linux/Mozilla geeks, so pay them no mind.

    6. Re:Ironic methinks. by v1 · · Score: 2, Insightful

      It does seem rather silly of them to attack the problem from this end... "An ounce of prevention is worth a pound of cure" fits here well. Stop the spyware from getting installed, rather than trying to pry it out once it's dug in. This merely seems like common sense to me.

      --
      I work for the Department of Redundancy Department.
    7. Re:Ironic methinks. by Anonymous Coward · · Score: 1, Insightful
      Thats the way it USED to be.

      Current infections ride the IE train straight to your registry. No approval or assistance needed.

    8. Re:Ironic methinks. by _Sprocket_ · · Score: 4, Insightful


      They don't do anything, they get blamed, try to do something, they get blamed. Come out of the MS bashing mentality to see that they are trying to resolve the issue. The only reason spyware is so prevalent in IE is because of monoculture, nothing to do with engineering


      Keep in mind that a good amount of Microsoft criticism (call it "bashing" if you want) is due to their engineering choices. Those choices lead to the outcomes critics predicted. Which in turn leads to a wasteland of broadband zombies.

      When Microsoft attempts bandaid solutions, there is more criticism. That isn't bashing. It's pointing out that Microsoft has issues - much of their own doing.

      Sure - they're doing something. But is "doing something" really solving the problem?
    9. Re:Ironic methinks. by drsmithy · · Score: 2, Insightful
      Why should a browser EVER make it that easy to run arbitrary code off the net at the user's priviledge level in the native OS?

      Because "the net" is not always the inherently untrustworthy, malcious code-laden Internet, but is often an inherently trusted, managed and private *Intra*net. Making stuff on said Intranet easily and/or transparently usable/installable/upgradeable is an ease-of-use feature.

      And you wonder how people reflexively hitting "OK" to Active X warnings get infested with spyware and insist it's not MS fault?

      It's not Microsoft's fault people deliberately install malicious Active X controls any more than it would be their fault if customers deliberately ran something called "iamavirusinstallmeandloseallyourdata.exe" they got from download.com, or it's RedHat's fault if some Linux user installs an arbitrary RPM that adds their system to a botnet.

    10. Re:Ironic methinks. by Cabriel · · Score: 2, Insightful

      Actually, it's easier for them to remove the spyware than to track down every instance of vague exploits in their code to prevent unwanted spyware.

      Even so, say it were easier for them to fix the bugs, what about the spyware that people agree to? When they download a program, a great number of users don't read what's being installed because they assume it's just what they wanted or that it won't ruin their system. These don't occur because of bugs, so how do you fix that in code? As above, Anti-spyware tools are the most efficient method of removal/prevention.

  2. Oh, that's rich. by philovivero · · Score: 1, Insightful

    Anti-spyware software. From a company that has a proven track record of putting "phone home" code into their software. I'll be sure to run out and install my copy over the already known-good open alternatives.

    How much is a license of SCO/Linux again?

  3. Re:Hate to break it to Microsoft... by zbyte64 · · Score: 5, Insightful

    Yes.... just tell that to the normal users that simply use their computer for pr0n or for simple searches
    Most people dont know where to get software like firefox or spyware removal - let alone even know it exists
    Microsoft will either bundle it for free, increasing the value of their OS (again most people don't know about alternatives) or MS will charge for it, making more $$ - in the end, average joe will think MS is their hero for saving them from spyware (o the irony)

  4. Available through Windows Update? by REDSECTOR1 · · Score: 3, Insightful

    Surely this will be available though Windows Update? If not ... Microsoft fix your damn code first instead of making us pay for your mistakes. *groan*

  5. admitting defeat? by OmniVector · · Score: 2, Insightful

    i think the worst part about microsoft of all people releasing antispyware software, is that they are admitting their OS is easily hijacked. spyware is a worse problem than viruses now a days (since every machine i've cleaned up for friends has 200+ pieces of spyware littered around their machine), and for the most part it is easier to prevent! stop using IE, and stop installing random software off the web.

    --
    - tristan
    1. Re:admitting defeat? by bnenning · · Score: 2, Insightful

      Anything that requires awareness or discipline on the part of the bulk of users is doomed to fail.

      100% correct. Spyware doesn't *need* insecure-by-design features like ActiveX to spread, that just makes it easier. Social engineering is always going to be available, and if Linux or Mac OS X became sufficiently mainstream then will be problems there as well (probably not to the same extent, but they will exist). The only solution I can see is sandboxing with fine-grained access permissions. The spiffy cursor pack you downloaded has no business looking at your address book or opening any network connections.

      --
      How to solve most of our problems: 1.Lots of nuclear plants. 2.Cure aging.
  6. Why MS has the advantage by SamMichaels · · Score: 2, Insightful

    They wrote the operating system. They already know about the next security flaw....they already know about the next big worm. They just won't act upon it until someone on the outside discovers it and/or exploits it. This opens the door to preemptive protection against the spyware that exploits the security flaws.

    Besides, the problem with the hijack stuff is that it's increasingly complicated to figure it out inside of MS's nonsense. Who better to offer protection than the people who invented the complexity?

    1. Re:Why MS has the advantage by domukun367 · · Score: 2, Insightful

      I don't think they know about the security flaws or possible worms - it's not a big conspiracy at MS. They're programmers like the rest of us, fighting fires as they come up.

      It's like the "UFO conspiracy" that the US government has been executing for the last 50 years - do you really think they're that organised???

      --
      Please don't send a Word document when a text file will do the job.
  7. Re:wow... good job at nothing by superpulpsicle · · Score: 3, Insightful

    No need to get disappointed. That's the concept of OEM. They always just slap a new label on it. Do you think Dell does anything beside slapping their name on the product!? M$ would be stupid to fiddle with any code.

  8. MS's grad plan? by SirTalon42 · · Score: 2, Insightful

    I know how MS is going to eliminate ALL malware. I figure that they plan to raise attention to the serious issues with just anybody being able to write software, so then they can try and make a licensing program where companies can pay to have their software certified as legit, and the binaries signed (creating a new revenue stream for MS), then once some big companies start following along, keep applying pressure to the ones that don't go along (like them showing up as 'spyware' in their anti-spyware software), then as slowly keep tightening to noose, and eventually require ALL software to be signed by MS.

    Ok well this won't actually affect malware, spyware, and adware and viruses, trojans, and worms. ... I need to get myself a tinfoil hat! *goes off and buys one*

  9. Re:wow... good job at nothing by MoralHazard · · Score: 4, Insightful

    Did it ever occur to you that they might have modified code other than the UI? Maybe there are non-visible changes to the scanning engine or something, perhaps to enhance the integration with the Windows OS?

    Imagine for a moment that the computer is doing more than painting pretty pictures on your monitor (that's the TV-thing on top). Could we agree that a program intended to detect spyware could be substantially modified without altering the appearance to the user?

    How did this get modded as "informative"?

    Oh, that's right--he bashed MS. Sorry.

  10. treating symptoms? by jnf · · Score: 3, Insightful

    Well at first glance it seems somewhat silly- as if they are treating the symptoms instead of the problem. Everyone can pretty much agree switching to another browser can alleviate a lot of the problems, or even just mutilating IE so that it becomes a pain in the ass to use (i.e. prompting for confirmation before allowing activex/etc), and thats what happens in 2003 by default (IE becomes a pain the ass to use), but agreed- that doesnt cure all of the problems. For instance, I know I've seen some spyware piggyback in on files played by media player or winamp, or p2p programs (contrary to popular belief kazaa lite appears to be spyware as well, fire up a sniffer and watch the local network). But when you really look at it, solving the problem hardly seems to be the point. Contrary to what a lot of us would like to think, microsoft isn't full of idiots- and a lot could be learned from the 'failure' that is most anti-virus software, namely that signature based detection is not the best way to detect malware. So then you have to sit back and ask yourself why a corporation would follow such tactics if the elimination of spyware/adware was their goal? Money, just like it always is- You don't want to cure the problem because then you start pinching your paycheck. Plus you have the advantage of testing/(further) conditioning the public to subscription based payment methods, and they will thank you for it because you are 'helping' them. IMHO, it just seems like another wolf in sheeps clothing, but thats just my take on it.

    1. Re:treating symptoms? by dioscaido · · Score: 1, Insightful

      They are certainly treating the symptoms. Not only are vulnerabilities patched as soon as they are found, but MS is taking a proactive approach to keeping their OS secure. Not only through things like SP2, but also many of the vulnerabilities found and disclosed are done so by Microsoft itself, which is something I appreciate (they don't *need* to be telling us about all the vulns they find during code sweeps).

      But the fact is, most of the spyware out there makes it onto the computer not through a vulnerability, but because the user presses 'accept' or 'OK' when most prompts come up. So some sort of pro-active measures have to be taken in these cases, similarly to how anti-virus software does to try and thwart the user's innate urge to open the 'superhappyfunball.exe' attached to their e-mail message.

      --

      Run as limited user, stop getting spyware.

      http://www.techproblemsolver.com/limited.html
      h ttp://blogs.msdn.com/aaron_margosis/

  11. Re:Sample by macdaddy357 · · Score: 2, Insightful

    Microsoft wasted their money. Pest Patrol, the only one worth paying for, already got gobbled up by Computer Associates. I hope CA doesn't screw it up.

    --
    How ya like dat?
  12. Re:Sample by Michael+Hunt · · Score: 4, Insightful

    One would hope that if somebody actually took the initiative in installing Firefox, or similar, that they would know that the MS tool is, in fact, lying.

    That said, dollars to donuts that nobody who'd install FF or its ilk would pay Microsoft for something they can get for free off Lavasoft/Spybot.

  13. Re:Sample by LO0G · · Score: 3, Insightful

    They already did that with IE - it's call XP SP2.

    With XP SP2, modulo security holes, the defaults on downloading code are all NO - the user has to decide that they want the rubbish or not.

    After that, it's a question of user education.

  14. This is insane. by SoupIsGood+Food · · Score: 1, Insightful

    This is insane. Spyware stems directly from Microsoft's inability to engineer a secure computing architecture... something =every single one= of its competitors can do. Buying a single anti-spyware product isn't going to fix the problems that make spyware possible in the first place. It will merely offer a false sense of security to the foolish.

    It's like tossing a half-full Dixie cup onto a raging housefire you set in the first place. A half-assed placebo to gull the gullible.

    Any Mac or Linux user can tell you: Spyware isn't a problem. Windows is a problem.

    SoupIsGood Food

  15. Re:Sample by __aatgod8309 · · Score: 5, Insightful

    Fixing IE would involve such a substantial change to both itself and windows that it won't happen. You've seen how long it took to provide the 'fixes' in SP2 for XP, and in the end it diverted staff from development of Longhorn. Imagine that applied to something even more fundamental to windows, like redesigning ActiveX to be easier to manage, or making IE an optional windows component.

    That kind of work would be probably be even harder than writing Longhorn, and we've seen how long that's taking. And that would most likely require a development team as big as that of Longhorn, if not bigger. And they wouldn't be getting paid for it - so what do you thing the chances are of MS doing that?

  16. Sounds like the stuff the mob does by bruns · · Score: 1, Insightful

    This sounds an awful lot like what the mob does.

    "Pay us protection money, and we'll make sure you no unfortunate accidents happen."

    --
    Brielle
  17. If I don't trust MS now.... by spamfiltertest · · Score: 2, Insightful

    why would I trust them for Anti-spyware?

    Just off the top of my head, I can see their version of "anti-spyware" software telling me that the following are spyware:

    Firefox
    Google Tool Bar
    AIM
    Spybot Search and Destroy
    Ad-Aware
    Sun Java Counsole
    Adobe Acrobat
    iTunes

    Then, after clicking on an option NOT to remove these items, it does it anyway OR makes the MS verions the default on the system.

    They are the giant, yes, but some company needs to take back marketshare to prevent MS from doing what they want, when they want, to the "dumb" user's machine... Some company needs to step up and provide a user friendly, wide-distro OS. (All Mac OS not apply - I love them, but they already made their niche)

  18. Re:This is kind of stupid... by lachlan76 · · Score: 2, Insightful

    In a system where it is IMPOSSIBLE to remove the web browser? Methinks not ;)

  19. Re:Sample by Errtu76 · · Score: 2, Insightful

    That said, dollars to donuts that nobody who'd install FF or its ilk would pay Microsoft for something they can get for free off Lavasoft/Spybot.

    They would, if the tool provided by Microsoft detected everything (and more) that the 2 programs combined detect.

    Some say Ad-Aware is better than Spybot. Others claim vice-versa. Only yesterday i first ran Spybot (detected 19 objects correctly) and then Ad-Aware, which still detected 39 objects (that Spybot somehow missed). Other people may tell you the same story, only with Ad-Aware running prior to Spybot.

    Fact is now that you need _several_ programs to remove spyware from a computer (CWshredder anyone?), and i personally would like to have one program that does everything the seperate programs do. That the tool is provided by MS doesn't really matter (to me).

  20. Re:Sample by danheskett · · Score: 2, Insightful

    The moving target is emulating IE's handling of broken Javascript.


    If Moz tried to implement this, they'd be climbing uphill.

  21. Re:If it works.. by illtud · · Score: 2, Insightful

    If it works, is free and can be deployed and controlled via Active Directory GPOs I am going to be a happy man for the enterprise.

    Anyone know if it IS going to be free?


    Having a GPO aware anti-spyware would be good, but I doubt if MS would be allowed to make it free. Certainly I don't think they could bundle it with the OS, because they'd kill the anti-spyware industry at a stroke. Leveraging a monopoly, anybody?