Slashdot Mirror
Computer Security Still Totally Inadequate
Several news sources are running articles detailing the lack of computer security on all platforms. Symantec foretells a dark future for Firefox and Mac users describing their security as a "false paradise". Kernel developer and Red Hat fellow, Allan Cox stated in his recent interview with O'Reilly that "even the best systems today are totally inadequate". He goes on to say that "We are still in a world where an attack like the Slammer worm, combined with a PC BIOS eraser or disk locking tool, could wipe out half the PCs exposed to the Internet in a few hours," Cox said. "In a sense we are fortunate that most attackers want to control and use systems they attack rather than destroy them."
No agenda here. Move along.
Note to mods: I'm probably being sarcastic.
If everyone programmed everything in Java things wouldn't be this way.
Duplicate stories.....
Don't they mean "Windows" security?
I've been an OSX user for nearly 5 years. Still waiting...
Kiteboarding Gear Mention slashdot and get 10% off!
Comment removed based on user account deletion
With security suites like that you don't need any hackers or viruses. Bloated Symantic software makes your computer unusable and unstable anyway ...
Consider that the one third of bots are now in the UK, where people bandwidth is the best over all. What's it going to be like when all of China is wired? (BTW, that is one of the PRC's goals, even remote farms without running water have DSL!)
A feeling of having made the same mistake before: Deja Foobar
1. No activex
2. Automatic updates
The nightmare IE/windows users have suffered for years is pretty much derived from these two points.
BTW, gotta love how the IE guys are adding a "new" feature to IE7:
Building on the security features released at beta 1, upcoming new features will include ActiveX Opt-in: To reduce the attack surface and give users more control over the security of their PC, most ActiveX controls (even those already installed on the machine) will be disabled by default for users browsing the Internet
I already can read the press: "IE7, with new ActiveX Opt-IN technology which protects you from the threats of the Internets"
it's amazing how they're trying to get rid of one of their major security mistakes by converting it in marketing crap. "IE7 adds activex opt-in". No, IE7 doesn't "add" that feature. It just removes/limites a already existing feature
I am surprised that it has not yet happened that a disgruntled IT worker has not launched such an attack targetted at a specific company. I still think it is a matter of time until a company suffers such a severe attack that it is forced under.
One of the links appears to be new. The other was posted like a week ago. Since the 'editors' don't actually read the site, why don't they just have a short script which checks whether the same link has been posted in another story. That would really cut down on the dupes, and wouldn't take long to implement.
The blurring between Symantec marketing and reporting is more than a little disconcerting. It seems we are now in a round of monthly warnings from them to keep sales high. Security is important, it is critical, it should not be taken lightly. However it would be nice if we could stop pulling our hair out on a monthly basis driven soley on the marketing budget of Symantec. (5 years and still virus free. I'm guess Mac OS X has a little more going for it than just "fools paradise" variety luck)
It's important perhaps to point out here that secure programs, reliable programs and correct programs are all different things. Knowing how to write provably secure programs is very different from saying we know how to write reliable or correct programs.
This is a very important point. How does one prove that software is secure? Reliablity can be checked through unit tests, etc. but security is much harder to test and takes a lot more imagination.Bradley Holt
We are still in a world where an attack like the Slammer worm, combined with a PC BIOS eraser or disk locking tool, could wipe out half the PCs exposed to the Internet in a few hours
Well, actually, I wonder what percentage of PCs are currently infected with malware? I'd guess way more than 50%, and the world hasn't come to an end. Actually, it would probably be a good thing if the hypothetical disk-erasing worm would come along -- it would probably prompt a lot of dumb users to make backups, take some basic security precautions, and maybe consider switching from MS-ware to more secure OSS.
Find free books.
Not good enough he's a kernel developer and Red Hat fellow, now he had to go and add an l to his name?
Try not. Do or do not, there is no try.
-- Dr. Spock, stardate 2822-3.
I have been happily living in a "false paradise" since 1984 using Macs.
P.S. Fair disclosure I was laid off by Symantec when they bought Fifth Generation Systems in the early 90s.
Strange women lying in ponds distributing swords is no basis for a system of government.
Hydrogenous?
Is English your first language? Or do you make them up as you go along?
Who is this delectable creature with an insatiable love of the dead?
"Hydrogenous" Network?!? That would be a network made of hydrogen, wouldn't it? I think the word you're grasping for is "Heterogenous"
I've abandoned my search for truth; now I'm just looking for some useful delusions.
I believe you mean "heterogeneous," consisting of dissimilar elements. The opposite of homogeneous. I won't even touch the rest of your post... where do you come up with this crap?
SecureThe.Net - Practical Resources for Securing Systems
I think advocating for or against a "Hydrogenous" network might cause a flamewar, teehee.
Maybe you were thinking of heterogeneous? or androgynous? Hard to tell because attempting to read a few lines of your post made my face explode. It's 'unpossible' to read your posting.
Didn't you mean:
p irate+day&btnG=Google+Search
This be why the king's law not be the only one. With most the treasure being defensed in one place we 'ave a hearty good chance for the one piece. Me hat off to the scalawags who hide their booty elsewhere. We may knock ya down but at least you won be wearin them red badges. The king be a fool.
http://www.google.com/search?hl=en&q=talk+like+a+
Unless you want to build computers out of hydrogen.
This is why having a Hydrogenous network and/or having a society where no one platform dominates.
I'm guessing hydrogenous is not the word you were looking for. Assuming of course that you weren't proposing that we base our networks on hydrogen.
I'm going to instead assume you meant heterogeneous which is something often proposed on Slashdot and grants the proposer instant karma as people rush to mod them up.
The only problem is having a hetereogeneous environment increases your support costs whether you have a security incursion or not. How many people are security experts in Mac, Windows, Linux, BSD, Solaris, FreeBSD and CPM? Not many. Which means that for every environment your IT staff supports, you need additional admins.
I'm a big tall mofo.
Symantec makes their money by producing an amazingly complex set of tools for patching up a security failure after the fact. It's in tehir interest to convince as many people on as many systems as possible that this is the best way to deal with security problems.
They have been pulling this kind of thing for years, predicting floods of malware on Palms, Pocket PCs, mobile phones, and I'm sure that game consoles and internet connected coffee machines will be next.
I'm glad they're working on the problem, so if it ever happens that Apple pulls a stupid trick like ActiveX they'll be there, but in the meantime more people have lost data due to false positives from antivirus software on these platforms than have lost data to actual viruses... so I'll steer clear and take everything they say about it with a grain of salt.
...we can't even handle dupes : http://it.slashdot.org/article.pl?sid=05/09/13/173 0214&tid=172&tid=106
Our most effective viruses will be the ones that allow the system to live long enough to spread the virus, and as soon as it can't spread it anymore, or the rate of infection drops below a certain level, the self destruct button can be hit. Allowing maximum transfer, and then maximum destruction.
In the time between these two phases human interference should be able to pick up the CPU/network drain. (Or perhaps a software developer can make a program that realises when cpu usage + network activity is uncontrolled.)
According to Symantec, this is an enormous untapped market for them since we are all very attractive targets and living in a security dream world. And those products, particularly for Linux, are where exactly? Actions speak louder than words, and if Symantec really thought there was an enormous threat here, they would be pushing out products to address it, because that is what companies that want to maximize profit do. Instead, of products, they produce press releases. Once Microsoft's lapdog, always Microsoft's lapdog I guess, even after they have decided to have you put down.
Oh, never mind.
Pee on my network and you're in for quite the shock.
I don't want knowledge. I want certainty. - Law, David Bowie
If it was a false paradise it would come with a tropical island, Nicole Kidman and bathtub full of champagne.
That's our life, the big wheel of shit. - The Fat Man, Blue Tango Salvage
The sky would be falling but the bad guys don't really want it too.
Seriously, how are we "fortunate" that they only wish to take control over your server and not destroy it? If one of my servers are compromised it's as good as destroyed. If they didn't do it, I will as I wouldn't trust any part of the system. (drives wiped and hardware flashed)
I think I'd rather exist in a false paradise than a certifiable hell.
No. No no no no no.
Mixing up your network too much just means you have (Platforms X Security Holes) to worry about.
At least with a homogeneous network as opposed to a HETEROgeneous you only have to worry about deploying patches for one platform.
In order to automatically deploy OS X patches for example, you have to have an OS X server as well (in my experience). Otherwise, you're walking to them one by one and running the packages.
Besides, choosing something because it's less of a target is simply "Security By Obscurity" in sheeps clothing. We all know how well that works huh?
Disclosure: I run a heterogeneous network out of necessity, not choice. It SUCKS.
No, it would be water. Think hydroelectric, hydrolube, hydrophobe, etc. Of course, it's bloody nonsense whichever way you look at it.
Computer Security Still Totally Inadequate
;-)
Of course, if it wasn't I wouldn't have a job.
Slashdot = -1 Redundant, Asperger, kdawson FUD, Libertarian, and Linux
Someone can still get access by offering you a candy bar for the safe combo. You're better off by filling the safe with lead and dumping it in the ocean. It is still possible someone might find it and open it, but I don't think anyone is that desperate to get at your porn collection.
Yes... [clears throat] ahem... The exports of Libya are numerous in amount. One thing they export is corn, or as the Indians call it, "maize". Another famous Indian was "Crazy Horse". In conclusion, Libya is a land of contrast. Thank you.
sig
See above.
Well, I bought Norton for mac and when I ran it, it said:
"Updating Virii Signatures......"
"0 Signatures updated, there are no virii for mac you idiot"
Can I return it?
Isn't this story a dupe?
But yeah, the security situation today is AWFUL.
Unfortunately, nobody has the guts to point out the real sources of the problem:
#1: Incompetent programmers. I would say maybe 90% of the programmers working today (open source or closed source, it doesn't matter, it's the same pool of programmers) simply don't have the skill to write a secure program. Most don't have any training, and they don't write code in such a way that makes it easy to audit (simple, clearly-written, in a high-level language that facilitates clarity).
Bring this up with a programmer and you're likely to get a response like "so what? no software is secure, that's just the way it is." or "oh yeah? let's see how secure YOUR software is."
Basically, the meme is that it's okay to write crap software, because all of it is crap.
#2: no accountability. Nobody punishes software authors when they make a mistake. Microsoft still makes money. phpBB still gets downloaded. Sendmail remains on the hard drive.
This is the second meme: It's okay to use crap software, because all of it is crap.
I really don't know what the solution is. Maybe programmers should have to get licenses before they can buy a computer. I have no idea. Maybe people should just wise the fuck up and not buy software that isn't secure. Maybe the government should refuse to enforce warranty disclaimers (bye bye open source?).
All I know is, it pisses me off continuously.
Don't you mean a bathtub full of hot grits?
It doesn't even matter how secure your "system" is, stupid users will always break the system and allow infections.
Where I live, there was a huge scandal about some company that sent other companies "demo discs" which the employees at the other company obviously ran, trusting some random company. This caused a trojan/backdoor to be installed, eventually costing the companies a lot of data which was viewed by their competitors.
Even in the army, they have a network completely (physically) disconnected from the public internet, with very strict rules on what's allowed to move inside and usually everything is ok. One time there was a large outbreak of a virus, obviously it was disconnected from the outside, but still an outbreak.
The source? A high ranked officer thought he's above the rules and connected his infected laptop to the inside network.
No matter how strong are your means of security, stupidity will always prevail.
^_^
As long as humans are part of it, it will happen no matter how good security is. Heck, spam gets sent because *someone* out there is dumb enough to buy something advertised as\/14gR4
On the other hand, a clued-in user with "commonly recommended security tools of the times" (currently a firewall and AV if they run windows, future who knows?) will typically defeat most things.
Don't blame me, I voted for Kodos
Yet further proof that almost all "security professionals" have about as much intelligence as a gnat.
... please. The "it's not as popular" theory as to the lack of OS X viri and worms has been beaten to death over and over. Simple fact is the difficulty would make the first creator of an OS X virus or worm famous beyond anything another Windows worm would cause -- even if the spread wouldn't be nearly as bad. And yet, here we are, five years after the release, and not a single virus or worm that directly affects the operating system. Surprised?
I'm really tired of mediocre systems guys passing a CISSP exam (thousand miles wide, quarter inch deep) and being declared experts on securing things they don't even understand to begin with.
For one, quantative analysis of the numbers of vulnerabilities doesn't equate to determining if a system is more or less secure than another. It's also meaningless if you don't compare how the systems are configured in what kinds of environments. Even simple things like Linksys routers greatly contribute to additional security on a personal computer (Windows or otherwise).
From the article: "Symantec chronicled 1,862 new vulnerabilities during 1H2005 - an average of 10 new flaws a day - 73 per cent of which it categorises as easily exploitable. The time between the disclosure of a vulnerability and the release of an associated exploit was just six days. Half (59 per cent) of vulnerabilities were associated with web application technologies."
Can anyone tell me where in that statement is a shred of useful, meaningful information? Of course not. Because there is none.
Insofar as Firefox and and OS X being "in for surprises." Sure, Firefox is an evolving application, bugs will be introduced and squashed, and later on more will be introduced. Some of those will be security vulnerabilities. Any application who's sole job is to pull data from untrusted sources and parse it will be vulnerable to security problems resulting from buggy code. Period. End of sentence.
OS X
Despite that incentive, it has yet to be done. A rootkit is being touted as "proof of OS X's insecurity." Give me a break. If you can trick a user to type in their admin password with an application, it doesn't matter if you're running Windows, Linux, BSD, OS X, HP-UX, or Solaris -- you're going to get owned.
Jesus, I hate security people. I just want to choke them.
Hy`droge`nous a. 1. Of or pertaining to hydrogen; containing hydrogen.
I've abandoned my search for truth; now I'm just looking for some useful delusions.
Someone can still get access by offering you a candy bar for the safe combo.
Oh! A candy bar! Sweet deal! Here's my safe combination.
*takes bite from candy bar*
Shoots person who offered the candy bar for the safe combination in the head.
A free candy bar and a guilt free homicide. Life simply doesn't get any better than that.
Not really...viruses replicate by using the host to replicate, sort of recursive replication like this:
void infect(this-host,) {
infect(n-hosts near this-host);
for(int i=0;i < n; i++)
infectHost(n);
}
Java doesn't spread like a virus. I think Flash is a virus because it uses the computer user as a host for the get-flash-now-meme and makes him download it.
Symantec foretells a dark future for Firefox and Mac users...
Whew, good thing I'm running IE 5.5 and Windows 98.
If all the infected machines were erased, there would be no more bots to spam me with e-mail. There would be no more ddos armies either... http://en.wikipedia.org/wiki/Ddos
I don't know the meaning of the word 'don't' - J
Since we are speculating, why don't we just say there is a bleak future for anti-virus software companies because software patches are released at such a high rate and security is such a high priority for software vendors that the future need for anti-virus software is low.
I know we will probably always need AV software but I thought I would make up some FUD conclusion like symantec did.
It should come as no surprise that computer viruses and worms tend to aim for control rather than destruction. This exactly parallels what happens with biological viruses and worms. A virus that destroys its host cannot propogate very far before becoming extinct. Viruses that damage their host but leave it good enough condition to continue transmitting it to other hosts are much more successful. The most successful viruses of all are those that go largely undetected and manage to spread to a majority of the population (think of sexually-transmitted diseases such as HPV).
The Alan Cox story was covered on Slashdot last week.
Bogtha Bogtha Bogtha
It makes me cringe whenever I hear Symantec making these "predictions" about potential attacks on computers.
I have run into *countless* numbers of damaged Windows installations, directly attributable to Symantec's own products. Just last week, I struggled for hours with a customer's XP Home Edition because he was "having problems getting any streaming audio to work properly".
Upon closer examination, the XP firewall was in a corrupt state, refusing to allow connections for his Internet radio stations. I was unable to view the advanced firewall properties, etc. After looking up event log error codes and trying several methods that repaired the problem for some people, it became obvious that I was looking at the result of a botched uninstall of a Symantec Personal Firewall or "Internet Security Suite" product.
Not only can these things happen, but you'll often see computers with errors with the "32-bit subsystem" when going to an MS-DOS command prompt, due to Norton products screwing up system registry settings due to an improper/incomplete uninstall or installation/upgrade.
Furthermore, when their anti-virus and "security suite" products do work properly, they still bring older, slower PCs to their knees in many cases. The "on-demand scanning" feature lags far behind the rest of the system when working with large numbers of small files (extracting a ZIP or the like), causing a window to constantly pop up, informing you to "please wait" while it scans them... And their "activation" process they now require for their AV products in Windows is every bit as bad as Microsoft's XP activation procedures! I remember purchasing a 25-pack of OEM Norton AV licenses last year, only to find that 6 or 7 of the key codes refused to work, claiming they were "used too many times" or the like. (I guess pirates with keygens hit upon them already or something?) Thiis is *not* the type of B.S. you want to fool around with when you're on a client site, getting paid by the hour to fix a virus problem for them!
I won't even go into the disk corruption their "Disk Doctor" for Macintosh did to MANY customers after they upgraded to newer versions of OS X and Symantec didn't keep up with needed changes/patches to the product!
Their company went down the tubes ever since Peter Norton quit coding their products and started getting royalties for having his photo thrown on the front of the packages.
Symantec is publishing a self serving press release full of intentional lies as a news item, and idiot news outlets like the Register are publishing it without criticism.
Shame on both!
How about reporting:
"Symantic issued an official sensationist panic warning to Mac users who have not bought their product. It is unclear how Symantec's products will secure the Mac platform from exploits, since they do nothing to secure a system from a user with physical access. The company may also consider selling volcano insurance and eating babies"
From the actual Register story:
"While the number of vendor-confirmed vulnerabilities in OS X has remained relatively constant during the last two reporting periods [12 months], Symantec predicts this could change in the future. Symantec's analysis on a rootkit (OSX/Weapox) reveals it is designed to take advantage of OS X. This particular trojan demonstrates that as OS X increases in popularity, so too will the scrutiny it receives from potential attackers."
So Symantec:
- is shy to report that there are no exploited vulnerabilities
- analyzed a OS X root kit and determined it ran on OS X
- thinks the adware/malware market, driven by demand for easy to zombify PCs, is somehow poised to launch specialized attacks on inherently secured systems via non-replicating trojans that require root access to install.
Which is worse, Symantic's bullshit misinformation, or the Register's uncritical dissemination?
What is to say the guy who designed the safe didn't install a back-door!
Ripping an new rectum in the fabric of spacetime.
From TFA: And that statistic means absolutely nothing. Simply counting the vulnerability ANNOUNCEMENTS does not tell you anything about the vulnerabilities themselves.
Is a vulnerability that causes FireFox to crash the same as a vulnerability that automatically installs an ActiveX control? Nope.Yeah. Whatever. How about you do a survey and find out how many FireFox machines have been compromised via FireFox? Huh? How about that?And he has determined that
Seems to me that IE's still being hit by spyware and such crap. Or didn't he mean those attacks?"We sincerely thank the person who killed our daughter because it makes us appreciate our son so much more now." Does that make sense to anyone?Hmmmm, Symantec sells anti-virus software and the like.
Macs don't seem to be having massive virus/trojan/worm problems.
Something doesn't look right.When "emerging" becomes "successfully attacked and cracked" it will become an issue. Until then, the "threat" is purely theoretical.Again, it isn't the number of vulnerabilities, it's how they can be exploited.
Yet I keep seeing references the the NUMBER of vulnerabilities announced.#!
cd /
rm -R
Oh my GOD!!! It's a trojan that is designed to exploit the bash shell on LINUX!!!As does my example with regards to bash and Linux.
It isn't whether someone can write a virus/worm/trojan. It's whether they can get such onto your box.Why "away from"?
Aren't they also the top target on the desktop?
How about "As well as the desktop, Microsoft's enterprise apps are targets for attack"?
Nothing but more crap from a vendor who's seeing their gravy train getting ready to leave the station on its last run.
This, in fact, should reduce the IE's attack surface several-fold.
.VBS/.JS script stored on the local machine (which is trusted to do anything anyway), yet a lot of MS and third-party components is in CATID_SafeForScripting for no reason at all.
n /fq99-032.mspx n /fq99-037.mspx n /MS02-055.mspx n /MS02-065.mspx n /ms02-055.asp n /ms03-038.asp n /MS03-038.mspx e chnet/security/bulletin/MS03-038.asp
... and many-many-many more of these holes (just search for "kill bit" with the quotes)
MS has made a huge mistake when IE 4.x-6.x relied on CATID_SafeForScripting/CATID_SafeForInitializing COM component categories to make decisions whether it's safe to use the COM component from a JavaScript/VBScript.
CATID_SafeForScripting is not needed when the COM component is accessed from a stand-alone
IE has a kill bit feature which allows disabling certain scriptable COM components based on their GUIDs. And most IE security fixes are, in fact, just registry updates adding more of those "kill bits".
Examples: http://www.microsoft.com/technet/security/bulleti
http://www.microsoft.com/technet/security/bulleti
http://www.microsoft.com/technet/security/Bulleti
http://www.microsoft.com/technet/security/Bulleti
http://www.microsoft.com/technet/security/bulleti
http://www.microsoft.com/technet/security/bulleti
http://www.microsoft.com/technet/security/Bulleti
http://www.microsoft.com/technet/treeview/?url=/t
throw new SuccessException("Sig read successfully");
I'm surprised no seriously mallicious attacks haven't taken place yet. You'd think hardware vendors would perpetrate such things: they'd see huge sales.
~/ssh slashdot.org ssh: connect to host slashdot.org port 22: too many beers
Now that firefox is as much of a security risk as IE, I wonder if you geniuses would care to use gecko in place of mshtml for the GUI on your security products? (Laugh, it's funny)
How about using spidermonkey for your active scanner? Javascript is overlooked as an application language and honestly, it's not going to be any more resource intensive than you're current lameware.
We haven't reached the tipping point yet. The tipping point from "blacklist" to "whitelist". People's computers still trust transmissions unless they are explicitly told not to. After the tipping point, on the other side of whatever puts us into the new track, we'll all accept traffic only from people we know, according to degrees of membership in our validated "web of trust". When an associate's own risk goes up, either through proximity through intermediaries with another associate that's not demonstrated uncompromised, or through failing vulnerability tests, or matching profiles vulnerable to newly identified threats, our systems will quarantine transmissions from them. Tainted info that's interacted with their transmissions will not be depended upon for any writeable operations. All our updated mitigations and responses will be brought to bear on the threat's local extent of transmissions. But the big difference will be that every system's default will be "distrust", and all systems will communicate their trustability as status changes.
This change will be as important to infosystems as was the transformation of life on earth from "prokaryotes", cells without a defined nucleus within a nuclear membrane, into prokaryotes, nucleated cells. Their DNA and other infosystems are compartmentalized from the other machinery of the cell, including those that interact with signal-carrying chemistry from the extracellular environment. That change is the basis for most of life on Earth, for most of the lifetime of the world. The changes in infosystems will likely be as epochal. And until the infodynamic boundary between humans and machines is no longer mediated by non-nervous tissue (like typing fingers and seeing eyes), it will primarily define our machines, as well as ourselves.
--
make install -not war
Totally. You have zero security. Zilch. None. Seriously. That firewall you have? Nada. It doesn't protect you at all. That unprivileged user you're using? Nope, not gonna cut it. There is no security. Seriously. Nothing is adequate. Nothing. Your security, regardless of what system you run, is Totally Inadequate.
*yawn*
Sure... whatever.
If you have a Windows or Linux box connected to the Internet this is almost certainly the case.
Bit of a stretch for a site like slashdot.
My apologies. I thought he'd written the non-word hydrogeneous (like heterogeneous or homogeneous), in which case water would be a more likely interpretation.
First I saw them talking about Mac... then I thought well - it's BSD based now, which has been around practically forever.
... not "hack into" and "gain")
Then I saw them mention a root kit for OSX and wondered to myself what good that would do without actually having a way to gain control in the first place.
(See definition of rootkit from wikipedia: "A root kit is a set of tools used by an intruder after cracking a computer system. These tools can help the attacker maintain his or her access to the system and use it for malicious purposes."
Note the words "after cracking" and "maintain"
Sounds like a bunch of malarky disguised as solid information to scare people who aren't aware of more advanced computer concepts.
You didn't auto-link the URL (hint:instructions below the Post Comment window) And its Foresight is at 0.9 release stage, not yet 1.0.
There are PPC Linuxes you could've recommended, but you didn't have the Foresight!
If you really want security, try http://openbsd.org/ for powermacs:
http://openbsd.secsup.org/3.7/macppc/ or for serious stability and security http://openvms.org/
Clam Anti-Virus is available for Mac OSX
http://www.markallan.co.uk/clamXav/
You know, there's nothing like the sight of a young illiterate buck trying to impress random strangers on a computer bulletin board with a wild-ass guess about how to decline Latin words.
It's a good thing Fox news told all the /.ers that computer security is inadequate. I might not have ever heard this!
My Aunt who runs OSX knows nothing of viruses, only thing she knows is what she was told "you cant get viruses in MACs, its a Windows issue"
Now lets just say a MAC virus was circulating, and she got it... how would she ever know? That virus would reside on her machine forever!
Seems you need a haircut.
Oh, and Symantec says you aren't safe, and some guy in England who competes with open source software says it is going to ruin his industry without government help.
Anyone see a pattern?
Do you have ESP?
I think what is trying to be said is that our computer industry as a whole isn't thinking the correct way when it comes to applications and OS's and hardware level security.
Look at the basic home computer connected to the internet. All ports open. Why was the OS designed this way? Why was the network hardware designed this way? Ease of use over security. Marketing over security. Cost over security.
Why doesn't my computer question allowing an app to run? So the user can be a moron and still use it.
Until just recently, we have been living in a world of "allow all, deny selectivly" when we should have been a little bit more security savvy with "Deny all, allow selectivly"
Everyone in the industry is to blame for this, not just the big security leakers.
The small coding errors that lead to the everyday buffer overflows are much more apparent when you are reading C++ rather than a disassembly of IE. Sure, it seems like Firefox is getting some flak lately about it not being secure, but consider, friends, that said coding errors are found and fixed many times faster for the same reason. ...and Apple has Darwin. Close 'nuff.
You just keep a hashtable of all your executables, make sure the first thing that loads after the kernel is the module that checks them all out, and run a TSR that blocks write-access to those files, or allows it and updates the tables instead if given an override. Same thing I used to do on DOS. Sort of goes back to the earlier discussion about 'default deny' and 'enumerating badness.'
=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Friends don't let friends enable ecmascript.
4. Watch as theives take your computer because you forgot to close the safe door.
Rod Taylor
Splunk has a new search engine which allows you to examine your log files for either security or troubleshooting related issues. The server (free) uses GoogleSuggest-like type-ahead and dynamic graphs to allow you (a sysadmin) to view all the different logs that are in your system (or datacenter) occuring in real time. It uses Ajax and a lot of javascript to make the experience of flipping through log files and finding specific events very fluid. While it won't prevent security issues, it will certainly help make them more detectable.
When I first replied to jellomizer with what I thought was a reasonably tactful correction of his use of the word "hydrogenous", his signature said something to the effect of "Waiting until I get a root post with +10 Yea!" (paraphrasing).
Well, after I posted my response to him (read it for yourself here, he changed his sig to:
--
Insult me if you feel you must, Ill just mod down your other messages.
Out of curiosity, I checked my user page. Several of my comments in the last couple days have been modded down. Of course, nobody would have any reason to mod them down - they're long since off the first page.
Karma is so ridiculously easy to come by that I wouldn't imagine anyone would care enough to do such a thing. I think this qualifies as the most assinine use of mod points in quite some time. Congratulations, asshat!
I'm a big tall mofo.
Computer Security Products by Symantec Still Totally Inadequate
Even assuming firefox has as many vulnerabilities as IE, there is still a matter of design that is advantageous to firefox (and detrimental to IE): Firefox is relatively isolated from the rest of the system, while IE is fully integrated. That allows a vulnerability in one part (say IE) to affect others (like Office or Outlook). It's not the first time a vulnerability in IE can be exploited via malicious e-mail. In the case of firefox, most of the damage tends to remain in the same place (firefox). Even if you somehow use firefox applied to incoming mail, a vulnerability would mostly leave the intruder/malware with firefox's capabilities and usually not with the MUA's.
It's just a matter of modular design.
GPG 0x1B479C78
See why computer security is so crappy?
Here we have a fine example of sloppy security design, where for wanting to speed things corners get cut, and the system turns out to be much less effective than it should be (namely because of the lack of concrete and ocean bottom).
GPG 0x1B479C78
It's not security through obscurity, it's just plain secure.
Defending Microsoft is a symptom of the disease "Stockholm Syndrome"
...an attack like the Slammer worm, combined with a PC BIOS eraser or disk locking tool, could wipe out half the PCs exposed to the Internet in a few hours... Got some base code to help get us started? I'm all for re-use of code. ;-)
Wouldn't this also take out most of the machines that are now available for bot attacks, spam relays and phishing websites? Sounds like this attack of this nature would greatly improve internet security.
4. Use supplied scissors on the network and power cables.
The living have better things to do than to continue hating the dead.
I secured an old laptop of mine recently, now I fear no viruses, worms, spyware, adware, or anything any cracker wields! Haven't had a single problem since. It was easy. I took out its networking card.
And that, my liege, is how we know the Earth to be bannana-shaped.
Riddle me this, how does one infect a Linux/BSD based system through the browser? Bad syscall(), been fixed. New syscall() maybe, we need to be diligent. Open ports, not on by default. Brain dead user, possibly leeds to a DOS compromised system (Easily fixed if the browser runs at a different level and cannot modify the users environment). A BSD/Linux system can be compromised by any running service (daemon) that hasn't been audited. I hope even the newest Linux/BSD users knows how to install from trusted sources.
Symantec/Norton used to provide great system utilities/compilers (Think C), now they only sell services that any decent OS should provide by default. Its a good company but lacking any forward revenue stream vision.
IMHO a suggestion would be for symantec to setup a repository for closed/open source programs. Charge a subscription fee for security audited/certified programs for users to downlowd. Sort of like UL labs only for programs. I would be willing to spend a reasonable yearly amount for hassle free certification for binaries. Think (Symantec Certified Labs) Wesnoth, Glest, Scribus, Blender etc. binaries. It'd be a bitch to manage if they didn't settle on only supporting the big three (SuSE, Mandrake, and Redhat).
Just a thought,
Enjoy.
It's just the normal noises in here.
Think the "almost certainly the case" is going a bit far. You can never be 100 % certain that your machine has not been compromised, no matter what the OS, and just because there are no "published to the masses" exploits does not mean that there are no exploits.
Its almost like The Register equates negativity with objectivity. Maybe they don't. Maybe they just enjoy publishing the drivel that comes out of the back end of a camel or a buzzard.
Are we still talking about that stupid rootkit that actually requires root privileges to install?
Why is it that people can't accept that Windows simply has the unenviable position of being the most popular and the most insecure OS around?
I'd rather live in fear of a dark future than live in darkness now, thank you very much.
"No problem. I have the capacity to do infinite work so long as you don't mind that my quality approaches zero."-Dilbert
If there are so many bots out there, why don't we make up some monitoring software (Microsoft could distribute it as an automatic update) that will locate them, and report them. Then, Microsoft could put a little icon on everyone's start menu to check if they have been used as a bot. Better yet, send out a message to that annoying IP Messager to notify people.
Andy Out!
It's Skynet...don't any of you ever watch movies?
The sky, scientists report today, is still blue. More on both these late-breakings stories as we get it...
Why don't they just tell us when security is adequate?
On Linux systems, patched daily with the latest security updates, running behind two different firewalls (and different brands of firewall too), with only encrypted connections for authentication, you'll understand if I'm skeptical that the systems have been hacked into?
you can still pass on viruses to other vulnerable systems.
so it doesn't matter that you aren't infected, it's still not safe to be promiscuous because it can potentially harm others.
linux/mac/fbsd/etc people still need to virus scan files, just not on a real-time basis (unless you feel that's warranted).
being a good net citizen requires people look out for each... though how many people really try to do good, no matter how small...
Science : Proprietary , Knowledge : Open Source
Hydrogenous sounds like more fun, though. At least you could put a match to it when you're feeling bored... :-D
Sounds like another good argument for turning off viewing of sigs. You might as well, they never contain anything germane to the topic in question anyway.
This is phase one of a FUD style advertisment campaign. Be prepared to see very soon on the shelves : - Norton AV for Mac - Norton Firewall for Firefox
No, you couldn't wipe out half the computers on the internet. Just like with real viruses there is a trade off between how infectious you can be and how damageing you can be. If you kill the host it can't keep spreading your payload.
If you liked this thought maybe you would find my blog nice too:
...What I can't seem to not think about when I read articles on security is the fact that systems with a small following have a tremendious level of security in only the fact that its typically to small a target to hit.
....
Though a Diebold voting machine provides extra incentive to hack
No what if each system was unique enough that nobody had the full map of which systems are alike enough to really know or target effectively?
Like how system are different enough that they are immune to the viruses and such targeted for other systems.
Though this might seem impractical from the stand of what has been generally practiced in the software industry, that is perhaps only due to proprietary system.
The key difference is the use of OSS in the practice of machine specific compiliation, where the user can alter their machines fingerprint or DNA with some sort of unique code or seed value.
A value that is applied in teh compiliation process.
And what of script kiddies and the likes?
you can't hurt a system that is Read Only, such as on a CD.
And data, user data, how to protect it from illegal access or wrongful manipulation?
Simply don't have any possible connection between the online system and the information. Where transfer storage is getting to be the size smaller than a key. Where only such information/data you want to connect to the internet can only be done with some level of intent or direct human physical transfer of it.
Of course the solution directions greatly nullify proprietary software, because such is typically not unique enough...
No one thought the Unix systems of yesteryear were so vulnerable. They were. No thinks the Unix systems of today are as vulnerable. They are. In years past it was naive lack of understanding of the basic nature of the user base. These days, naive lack of fear.
I've seen people have that same attitude before someone draws down and leaves them a crumpled mess on a bar rooom floor. It didn't help them and doesn't help the OSX, BSD, and Linux crowd. You cannot underestimate the danger of the average users' whimsy and inexperience, the truly committed crackers, and the legions of script kiddies who learn their tools from the first two. It isn't Windows that is insecure and dangerous. Windows does nothing it isn't told to by people stupid enough to tell it so by accident or on purpose.
The future is pointed at self-contained encrypted containers of both interpreted and compiled code objects flitting about the global net and this future will be embraced by Microsoft and the only way that Microsoft will not entirely control it is if the major vendors arrayed against them co-opt the paradigm with standards themselves. The law of unintended consequences being what it is, there is no way that the non-MS community can say credibly that the sheer combinatoric explosion of possibilities for system interaction in this future will not affect them, no matter what their safeguards. It's like trying to guess the outcome of a mating based on a glimpse of a few genes of one parent.
Assume the worst or the worst will happen to you. Hold true in survival on the streets, in the jungle, or on the Internet. Blowing off the very idea is foolhardy in the extreme. The only option for Linux for its part to avoid it is to remain a sado-masochistic wrong and hard is better than right and easy platform which scares away the average user. In that case, Microsoft's hegemony is assured simply through the incompetence of their opponents, not that it isn't close to that already.
If my grammar and spelling are off, I am [distracted/tired/careless] (take your pick)
I prefer this method of security http://www.uoe.dk/csworld/security-.html
https://www.gnu.org/philosophy/free-sw.html
We are still in a world where an attack like the Slammer worm, combined with a PC BIOS eraser or disk locking tool, could wipe out half the PCs exposed to the Internet in a few hours
Except for the fact that if anyone ever actually did that, they would be hunted down in record time, arrested, imprisoned, raped, beaten, shot, stabbed, then released into the woods, only to be hunted down again by vicious dogs and torn to shreds before finally being set on fire. And then sentencing will commence. The sentence will likely be something to the effect of one million consecutive one-year sentences, with the chance of parole after 6 months. Each time.
Anyone smart enough to implement such a virus is smart enough to know what's coming.
"No problem. I have the capacity to do infinite work so long as you don't mind that my quality approaches zero."-Dilbert
Water is wet...film at 11
Typical useless /. post, and I'll probably get modded down, but my fingers are now operating independently of my mind and I can't stop typing.
4. ???
5. Profit!
I suspect it is for one of two reasons: Either doing physical damage to the PC (BIOS/MBR wipes) isn't that easy; or the machines are better protected than we think. Many people have hardware firewalls as part of their home routers. AOL can't be trusted to pass any packets..
IE's fundamental problems have been with ActiveX and the porous security barrier between security zones. Firefox also has a security barrier that could be as porous-- the barrier between Chrome and web documents. I would expect most of the security issues to exploit this barrier (which indeed many of the spoofing attacks have).
If you want the best security, go with a non-XUL Mozilla-based browser, like Epiphany. But Mozilla/XUL is a very great RAD environment. But a secure web browser, it is not.
LedgerSMB: Open source Accounting/ERP
Home/Professional versions of Windows should:
(1) Not allow new Local Users to be in the Administrators group, and
(2) Force the Administrator account to logout after five minutes.
Having Microsoft onboard as a major shareholder I am not surprised if Symantec has received the order to spread FUD about Firefox and Mac OS while defending Internet Explorer. It is sad to see them resort to this kinds of methods and attacks below the belt but, as always, the truth will prevail.
Your analogy fails when you realize that not all computers will be vulnerable to the same virus/worm. A good worm can reach every vulnerable host on the Internet within hours. Once you've reached this saturation point, there's no way to reproduce without injecting new exploits. In the real world, everyone is vulnerable, but the transmission rate is much slower.
LOAD "SIG",8,1
obvious sarcasm
But sounds about right for slashdot modding lately.
I usually waste 2 or 3 mod points when they run out I guess maybe some people just use them up randomly.
The real problem with computer security today is the attitude of programmers.
People say it's impossible to write bug-free software, and that is simply not true.
It is difficult to write bug-free software, and may be virtually impossible to prove that it is bug-free, but it can be written.
10 PRINT "Perfect code"
20 END
Yes, I know it's a simplistic example, but at what level of complexity does perfect code become impossible?
Is it possible to write a perfect stack? a perfect text box widget? a perfect video player?
From a few simple perfect pieces it should be possible to construct a bug-free web browser.
Is it impossible to build a full-feature bug-free operating system?
For most of my life, I've heard people say that every complex peice of software must have bugs in it, and these are inevitable. I believe that is current attitudes and results about development continue, within 10 years new coders will be hearing that "It is impossible to write complex software that isn't subject to running arbitrary code."
This would give a big boost to the cyberpunks and authors of emergent AI sci-fi, but I don't think things need to be that way.
Maybe you can't write perfect code, but you can at least try.
Abolish Copyright. Restore Freedom.
The only problem I've had with my Mac came, surprisingly, not from some unknown and undiscovered internet vulnerability, but from Symantic.
That would be the "Norton Utilities" for Mac OS X they wrote and sold, that corrupts your hard drive because Symantic didn't bother to figure out how our filesystem works. Wonderful. I had to buy Diskwarrior to sort it out.
If you go to the Amazon page for the Norton Utilities they sold, it's still there, but along with the dozens of one-star reviews, there is a suggestion that Symantic has quietly stopped shipping it.
It will be a long time before Mac users trust Symantic again.
Protect your liberties. Donate to the ACLU
I just crapped my pants for reading this article. Oh wait, no I didn't. Going to play Darwinia now.
When are we ever going to have adequate security? The term adequate is subjective. An unpatched, unfirewalled, virgin copy of WinXP could be adequate for any novice user, on the other hand, some would argue a computer with no external drives, nothing on the hard disks, locked inside of an Iresali safe, with welded chains on the outside, then sent into orbit in the outer parts of our solar system is still not secure!
There will never be adequate security. This is for one small reason. There is no such thing as a pefect system. The more advanced they become, the higher our standards will get. Adequate security is relative to our standards, thus is subjective.
Do what I say, cuz I said it.
-Meatwad
They talk about Firefox and the Mac being insecure because they *want* them to be...it's wishful thinking.
They're a company that have always made a living out of Windows being so poorly designed. If end users move to operating systems that were designed by people who actually had half an idea what they were doing, business for Symantec is going to dry up.
It's exactly like the pharmaceutical companies and the medical industry...they don't make money from people being healthy. They make money from people being sick.
Symantec trying to give people FUD that other systems are insecure is entirely predictable...they won't make sales unless people believe such things.
Still, don't miss this important note, that those were lucky circumstances, viruses authors were "civilized" enough so far to not yet target heavy destruction ways. Exploit, abuse - those are gentle words. We get dependant. Very dependant with plenty of those mostly unified economy boxes. What leads to the point, that diversification is one of natural cures - message in favor of those different boxes, even if they are similarly vulnerable.
As far as you know. Not all malware announces its presence.
I don't care if it's 90,000 hectares. That lake was not my doing.
If more people move to osx or linux, I guess Symantec and all the others will have to move to writing all these viruses for the new platform, to sustain business. You don't really think all the malware comes from pimply-faced adolescents, do you?
But he can't do that to me cause I quit on having an account a long time ago!!!!
All my posts are AC and unattached so I can slander whomever I please(as long as no Big Secrets are revealed in the process)
Alan Cox commented on the fact that Java made insecure programs hard to write.
/. seems to hate Java, perhaps this indicates a clue gap between those who know wtf they're talking about and the slashbot anti-java brigade?
Given that
... often. That's why Apache is such an exploit ridden viri host. Oh, wait, ...
We suffer more in our imagination than in reality. - Seneca
Honestly, even if you cared about Karma (though beats me why would you), as you've said, it's ridiculously easy to come by anyway.
And it's not like he'd be the first one anyway. There's a whole category of people insecure enough to throw that kind of kindergarten revenge fit. If only now you see 3 day old posts starting to get unexplained attention, eh, you haven't paid attention. If anything I find it funny that someone would be that immature.
But, really, why would you care about it anyway? Does it really matter if your groupthink score... err... I mean "karma", goes up or down? Just say what you think and don't care about such prom-queen scores.
If anything, that "karma" hurts more than it helps. It spawned a whole class of karma-whore prom-queens repeating the same idiocies on topics they don't even understand, just because it's what gets them points. Which is just pollution.
A polar bear is a cartesian bear after a coordinate transform.
With a board saying the "EOF is nigh!".
Hahahahah I am so scared. The problem is, a well configured firewall, and a mime filter on downloads and emails will solve all but the biggest problem.
Internal sabotage.
I hate how Symantec et al have gained enough money and power to fuel a self fulfilling prophecy of doom and gloom.
#hostfile 0.0.0.0 primidi.com 0.0.0.0 www.primidi.com 0.0.0.0 radio.weblogs.com
Well, I won't disaggree with you on the whole. It in fact mirrors my own thoughts and observations.
I once got a computer virused intentionally. (That was the only Windows virus I ever got, btw, so if anyone wants to start with the canned "Windows has viruses, use Linux instead" answers, spare your breath.) I was installing Windows 2000, had no firewall handy, and thought I'm too lazy to go buy a firewall or go burn Zone Alarm on a CD on someone else's computer. Also, I didn't know yet that I could just activate the built-in poor-man's firewall (yes, you can tell Windows 2000 to not allow incoming connections) to stay safe until I download the updates and a firewall. So, anyway, I thought I'd let it get virused while I download the firewall, then format and reinstall. It's not like 20 minutes extra are a major catastrophe.
So predictably it does catch an RPC buffer-overflow virus while downloading Sygate Personal Firewall. Then I block it from connecting to the network and play with it a little. It got me curious.
You know what was sad? It actually slowed the computer a lot less than Norton. You know what's sadder? Installing Norton and running a full scan didn't catch it anyway. It just slowed down the computer some more.
But still, Symantec isn't _the_ worst. Try McAffee sometime if you're masochistic. Not only it was even less efficient and slower, but also had such gems as:
- needed IE to download its updates, because it used some ActiveX crap, but it was too stupid to just launch IE, then. It launched the default browser, in this case Opera, and then couldn't get itself updated. That sad.
- it was installed on D: but the updates proceeded to install themselves in the default directory on C:. Worse yet, I wasn't just left with just an extra copy on the hard drive, but had two versions running in RAM at the same time.
- this got even funnier later when I uninstalled it, because one of the two versions remained installed and auto-loaded. I had to edit the registry to stop it. (If you thought only spyware has to be removed that way, McAffee is obviously the counter-example.)
- their "privacy" protection basically did nothing but try to protect me from cookies, including temporary login cookies on web sites. I suddenly couldn't use any sites that required login. Not even in a consistent and predictable way. E.g., Gamespy's Fileplanet got terminally confused and different pages thought that I was logged in and not logged in at the same time.
And so on and so forth. That was a rather non-funny experience.
A polar bear is a cartesian bear after a coordinate transform.
Biological virus don't know if they have propagated, a computer virus could be written to count sucessful infections
Consider a virus that can count its generation and progeny and also knows the date
Set it to just propagates till 27th September (mostly using system time, but also polling NTP servers just to check). After that when it when it has finished scanning the area. If it has infected more than three machines it goes into kill mode, trashes the hard disk and zeros the BIOS, if it has failed to reproduce enough it keeps scanning and passes the time introducing single bit errors into documents and images.
Your analogy fails when you realize that not all computers will be vulnerable to the same virus/worm.
So does yours, as not all humans are vunerable to the same viruses/worms.
A good worm can reach every vulnerable host on the Internet within hours.
Not with NAT's and private networks they wont.
Betcha can't give me a virus. G'ahead - erase my boot drive.
GOOD LUCK! : )
They're missing the point that IE is an integral part of the desktop on Windows. It's very hard to get away from IE flaws.
IE is largely a Windows app now (Mac support was cut off). With Firefox you get to choose the most secure platform to run it on since it is available for many operating systems.
Many of the flaws in Firefox were discovered by the Firefox developer community and patched rapidly.
Most medium and up have a backup copy of the bios on a second chip, most the time not accessible unless you yourself flip the lil jumper on the motherboard...
We already have the whitelist technology. And have had it for years - the "x" execute permission bit in the file system.
Only one minor flaw, what happens to the revenue stream from perpetual updates?
Andrew Yeomans
So it seems like Symantec really wants to release a Mac virus, by the way they're speaking.
That would be extremely lame of them, and I hope it doesn't happen, but I wouldn't put it past them (if it's possible). This is the company that stopped making Utilities for the Mac when Panther came out instead of updating it. They will not put in any extra work to get their products working right on a system, instead allowing them to make a mess of most people's hard drives. (and sometimes making matters worse) Myself, I had to pay CA$500 to get my data back after Norton crashed in the middle of repairing. Needless to say, it didn't leave the drive in any sort of usable state. Live and learn, I use Alsoft's DiskWarrior and Micromat's TechTool Pro now.
The other reason Macs are usually more protected is that Mac users tend to be a little bit smarter than the average computer (Windows) user, and most Mac users know better than to click blindly through dialog boxes or try to open or run something they didn't request, never mind the fact that Apple is constantly updating major system components, which makes their OS somewhat of a moving target. I like run-on sentences.
Here's a short article on Macs Kill entitled Don't Buy Norton. from a little while ago.
Symantec r t3h 5uxx0rz.
Only if you have a monoculture of windows, do you risk a Darwinian event.
Evidently, the decision not to build dual boot images, plus wifi, decided by executives, over-rode real security considerations.
O/S's not network connected seem to operate OK, and OpenBSD connections seem to be solid. Systems like this ARE safe, and you have the option of running knoppix direct of dvd too.
Symantec is in a unique position to blow the whistle on flaws that presumably the have sourcecode and talent and capability for, but they don't seem to make waves, other than spread fud.
BSD's, or linux with propolice or NSA probably are good enough. Maybe this EAL security rating stuff needs and overhaul.
A big problem with the traditional software distribution is that if you were to fill up your PC with legitimate commercial software from trusted (non-malicious) sources for all your purposes, you would most likely end up with a total software bill approaching a thousand dollars (Operating system, office pack, proper CD burner software, games, security software, graphics software, etc.)
Rather than making use of free software, people have gotten used to just pirating commercial software. I have yet to see a Home PC without at least a certain degree of pirated software on them.
The software vendors have started becoming increasingly anal about copy protection, trying to force people to purchase the software rather than pirate it. It is actually getting hard to just borrow a CD off a friend and install it.
The result? People will either switch to free software or download dubious chinese cracks off the Internet. Sadly, most seem to go with the last option.
The result is a sad state of affairs and it is not all down to security holes in Windows, IE or Outlook.
The first realisation for people should be that their Windows machine can be filled with nicely working and adequate free software rather than pirated commercial software. A nice security boost just there.
This works fine, but it is soooo much easier with a Linux system. The huge security boost of a newer Linux systems is NOT that they are inheritly more secure, but rather that people can get pretty much all the software they need from nice, friendly sources. Sure, they may have some security holes like all software, but they are not actively trying to screw you over.
Moreover, they are actually all updated from the Linux distributor. You do not have to chase down individual updates yourself.
If more people switched to Linux, they would simply not have to resort to crackz.com or something for their software needs. Most of it would either already be installed or require just a few mouse clicks to install.
Sure it's entirely possible that OsX and Firefox could be exposed to potentially harmful risks going forward. But that in no way means that the vendors or communities responsible for them will respond in the same kind of highhanded way that MS makes its business model either. Let's face facts, MS code problems don't spawn just from bad design choices. They spawn from poor change management, poor development techniques and a business model that puts bells and whistles above basic reliable functionality. Everyday day some wonks at MS look over a portfolio of 'must-dos' for Windows and for the most part address the security issues that people scream about and that's it. Tomorrow there will be more fires to fight more snakes to kill.
But there is no guaranty that everyone else will respond this way. So far there is no indication that Apple for example has chosen this business model. It may very well be that companies decide that better security is a real value add. After all companies like Argus exist for a reason. It's possible that a company the size of Apple could put its weight into making an Argus like system as easy to use as a Mac.
Certainly, the kind of hassles which various malware cause all over the place don't seem to be convincing anyone that security is an important thing that they need t obe aware of.
I can't count the number of people who've let their computers go to shit, paid me several hundred dollars to get those computers back to a usable state, and actively ignore what I've told them they need to do to keep their computers from getting messed up. It's too hard to remember to use Firefox, or to remember to run AdAware, or to remember to keep paying the subscription on their virus scanner, or move to a safer operating system (either MacOS or Linux would do) or whatever.
Maybe if these worms, viruses, etc, started making hardware unusable people would take this shit a bit more seriously. Maybe I don't care in the end, because their ignorance is to my profit, just like their ignorance is to Symantec's. Or rather, their general ignorance, punctuated with health doses of fear, so they'll run out and obtain my services, or buy Symantec's crappy software.
At Georgia Tech, there was a breach several years ago in a computer that housed lots of personal data for our performing arts center. Our IT department responded by segregating the machines that housed that information and building a large metal "room" around them, within the machine room, which was only accessible with separate credentials. Granted the "cage" was part of a larger security audit, but when you looked at the two events separately, it was a pretty hilarious response to the problem.
Well, actually, I wonder what percentage of PCs are currently infected with malware? I'd guess way more than 50%, and the world hasn't come to an end.
This is only because the writers aren't interested in releasing the kind of viruses we had, say, 10-15 years ago, where corrupting data/erasing files was the norm. Nowadays, they all seem to want the same things: owner access to a PC, and/or the user's confidential information.
I suppose you could argue that this isn't as bad as having your drive wiped, but it seems to me to be even worse, since these users really have no idea that their important info may be compromised, and essentially can be taken advantage of indefinitely.
If the zombie PC masters did at some point decide to wreak havoc instead of being stealthy, I'm sure it would be pretty destructive.
Yes, yes.. God forbid we waste so much time spellchecking that we didn't get f1rst p05+. Ass.
In any event, if you had read beyond the first paragraph, it would have been clear your actual "argument" wasn't "ignored"..
>The only problem is having a hetereogeneous >environment increases your support costs whether >you have a security incursion or not. How many >people are security experts in Mac, Windows, >Linux, BSD, Solaris, FreeBSD and CPM? Not many. >Which means that for every environment your IT >staff supports, you need additional admins.
Your most excellent rhetoric reminds me of one of my favorite Strong Bad e-mails!
Come on guys, that is the funniest post I have seen in quite a while.
Actually, it would probably be a good thing if the hypothetical disk-erasing worm would come along -- it would probably prompt a lot of dumb users to make backups, take some basic security precautions, and maybe consider switching from MS-ware to more secure OSS.
I know he's an arrogant prick, but esr points out exactly why that wouldn't be a good thing here.
C17H21NO4
I never use gui tools that ask for root. On the local system, I ctrl-alt-f1, login as root, and do it cli. I'll also do f2 for a login as myself so I'm not burning up excessive memory and cpu with an xterm for something that doesn't need it.
up2date -u works great with no X.
Not to mention of course eliminating 90% of productivity as a bonus.
Last attempt at running as an unpriveledged windows user lasted about 2 weeks. I even knew about runas. Couldn't run my favourite mozilla because it stored its profile in the wrong place (no idea if this was fixed).
Respect copyright - the GPL relies on it.
Yeah, all of your posts should've been modded to oblivion just with your sig alone.
In any community, some people make positive contributions, others negative, and many a mixture of the two.
I wish you good luck in making positive contributions in the future. In any case, you've made a name for yourself. I have to wonder if it's the type of reputation that you want?
And the plural of clod is clod. Right.
While blowing off the idea or possibility of an attack is stupid, your sky is falling routine is just as bad. You're first paragraph makes general assertions without any evidence of truth. Though Unix systems today are vulnerable (what isn't?) that is nothing compared to Windows.
It isn't a "naive lack of fear" to use a system that has more secure foundations and then be happy for it.
On the other hand, waiting for a bad exploit to occur before taking even the most basic precautions is equally absurd. Reactionary security is worthless security. For example, after the Khobar Towers bombing in Dhahran the military mandated a 1,000m standoff. Why? Because they figured that would be the required standoff to have protected from the last attack.
And what was the next attack? Small arms and vehicular assault in Riyadh. Basically, a perimeter rush using multiple, agile components. The 1,000 meter perimeter just went out the window.
Its so easy to stick your head in the sand and claim "all systems are vulnerable, lalala" or "no known remote exploits for mine, all is fine lalala" that the proper middle ground gets lost.
Someone where I work is setting up to secure a lab. They have checked and are looking to use a product that will provide limited capability logins (sounding very similar to OS X's limited user) -- but when I suggested to take the additional precaution of setting the bios password and turning off the ability to boot from anything but the hard drive the response I got was "why go to all that trouble?"
Here you have a sufficient concern to investigate and purchase a product, but no interest in taking the most basic steps to secure the hardware. Security isn't about patching some specific problem (the Windows approach), its about design, concept and approach (which FireFox is attempting, the unix-style operating systems take a stab at). To ignore the efforts in this regard is not just stupid, but counterproductive.
But I have a feeling you either lack any real depth of security understanding or are wearing MS blinders -- just like those poor fools who will wait for armageddon before taking any precaution.
First off, the Slammer worm is a buffer overflow exploit for MS SQLServer, it hampers the internet, but if you are not running SQLServer... Basically, while there are plenty of vulnerable areas, this is incorrect.
More importantly, buffer overflows are due to unchecked C string copy calls: Java has size limits to Strings, making this harder to do. Java also looks different on the execution stack. C can be disassembled to find these vulnerabilities. So the parent actually has a point, because Java does not go down to assembly, it is harder to see the weaknesses AND since Strings are bound, you don't get buffer overflows in the execution stack.
We've got some of the tech. The tipping point comes when our minds have changed to orient by the new bias. Then the revenue streams multiply as we interdepend for continuous trust info subscriptions.
--
make install -not war
I don't ever recall auto-execution of applications on floppy disks on any version of Mac OS (or System x.x).
c /data/autostart.9805.html
I suspect your thinking of the Hong Kong Virus outbreak of 1998 that piggybacked on the behaviour of QuickTime 2.5 and later's AutoPlay feature.
[let's use Symantec as they're topical]
http://securityresponse.symantec.com/avcenter/ven
Most of the vulnerabilities in 'Classic' Mac OS were to do with System Extensions and Control Panels which loaded up at boot time. Since they were analogous to kernel extensions, they had deep access into the heart of the OS.
If Microsoft was smart they would have expert witnesses who will appear in court for you, to testify that running as administrator is bad practice. Thus the program that requires the user to run as administrator is defective, and in violation of various state laws.
Of course Microsoft would have to fix their own software first, so they are unlikely to do it. Still they should. Software needs administrator and isn't designed for administrator use only is defective.
Yet further proof that almost all "security professionals" have about as much intelligence as a gnat.
I'm really tired of mediocre systems guys passing a CISSP exam
Wow - it looks like someone is bitter because he a) couldn't pass the CISSP exam, b) couldn't get a job in the security field, or c) both. My money is on c).
I want to drag this out as long as possible. Bring me my protractor.
Security is not given as much attention as it deserves. Most wireless networks are unencrypted. some people do not apply patches, use firewalls, or have good security practises. This site proves my point because they do not use SSL for the login. This means that someone can obtian your username and password. The polls should require login to stop people from changing their ip addresses. In my opinion wireless is usually not setup properly. Wireless access points should not use WEP and should use WPA intead. I have a video clip from the news about wireless security from my site.
Regarding, the speed of speading, it's true that the initial spread of an electronic virus tends to be much faster than any biological virus. However, I would argue that there is a large population of hosts which are powered down (asleep) and/or unplugged (abstinent) 95% of time, as well as a constant stream of new hosts being created (born) into the world each day. It takes time to spread to the sleeping/abstinent hosts and the newborn hosts can provide an long stream of new victims, until a vaccine against the virus becomes widespread.
I would still argue that there exists an incentive to keep hosts relatively healthy to ensure that the virus spreads as far as possible and survives as long as possible. Viruses with no ill side effects or no detectable side effects at all tend to get less attention than viruses which make their hosts drop dead. Viruses which attract too much attention tend to get actively erradicated.
The other critical difference between biological viruses and electronic viruses is that, unlike biological viruses which rise out of random evolution, electronic viruses are still[1] created by intelligent designers who often have ulterior motives above and beyond maximizing survival of the virus. Electronic viruses are able to turn their hosts into zombies which the virus creator can enslave towards his own ends (usually some form of criminal financial gain).
[1] It's unclear whether we will ever see electronic viruses created by something other than humans. It seems unlikely to happen anytime soon, but if you believe in a future like Ghost In The Shell, then who knows!
Around that time, after the restoration effort had succeeded, there were several "infrastructure terrorist" shows and articles "fearmongering" the public. Even though they were a feeble attempt to get ratings/hits, they did contain some interesting data. For instance, a large portion of our automated infrastructure is made out of standard windows boxes, controlled via the Internet. Or, at least they were at the time.
What I am afraid of is a malicious virus being able to assault these boxes and take them out. Forget the damage to OSS. What kind of frenzy could occur if our infrastructure fails us? That is scary.
::Removes tinfoil hat::
Dude? I don't know what you're talking about. 'Dude' is a pronoun, dude. It's like if I were to call you "You" or "He" or "I". You know... like "Hey! Dude!" or "Dude! Over here!" or "Dude, I am sooo completely wasted".
Well, here's just one example of what I was talking about (and this isn't the AUTOEXEC.NT and/or CONFIG.NT issue).
k b.nsf/9b60813077fffd2385256ee60055ac57/87712b45887 8809c85256edf00520ef4?OpenDocument&src=bar_sch_nam
http://service1.symantec.com/SUPPORT/sunset-c2002
The truth about non-mainstream products is that there are not security bugs in them because there is no enough of a reason to look for bugs in them -- if you take into account attack surface.
Attack surface is also extensibility. IE has a lot of attack surface, it is very extensible. The same is true with Firefox.
Macs have plenty of attack surface. It is just when you are out there hacking you do not often come across a Mac, so you do not need security bugs for them. The same is often true for Linux systems -- usually the person you are targetting is running Windows.
Security bugs in more popular products mean more press for you.
FireFox has gotten a lot of attention as an alternative to IE, but the incredible claims of better security all over the media for a year have made it a huge target -- breaking it gets you news reports even though the userbase remains pretty small.
Functionality. Attack surface. The two go together. The most secure Window's apps? Calc and Notepad.
People say things like "Firefox does not have activex so it is more secure". Like activex is some great evil. Firefox is extensible. It accepts the major plug-ins out there. Call it "activex" or whatever, it is the same difference: and this is one of the things that adds a lot of functionality to the web. Shock games anyone?
There are always a lot of people who go through a lot of trouble to run obscure products... and they like to believe because of this they are smarter and better protected then everyone else. These people are often "smart", but they simply are not nearly as smart as they think they are.
How about terrorists, religous nuts and rogue goverments? Virus development can be done on the cheap. All they would need is a 100 PC network to simulate the internet and some good programmers (and a good sysadmin to reimage the system after it dies). This sort of thing would be pretty easy to hide (PC's are not hard to get hold of, or transport, the number of people in the know could tiny (6 or less)). To the terrorist mind would be really, really attractive (Potential for massive damage, using the great Satans power against them and the chance to overwrite impure data with copys of their manifesto and/or holy book)