Vista Designed to Make Malware Easy

SlinkySausage writes "Trojan horses masquerading as 'cracks for Vista' are starting to appear on pirate boards. More worrying though, Microsoft has confirmed that Vista's image-based install process is designed to allow third-party software to be slipstreamed into the installation DVD. Great for corporate deployment of Vista with software pre-installed, but also a huge benefit for malware writers, who can distribute Vista images with deeply-rooted malware."

Comments

Re:So?

[molnarcs]

This article is troll, especially the "designed to make malware easy" part. This has nothing to do with design - it is an option that I'm quite surprised Microsoft didn't take away from Vista (if they did, you'll have an article complaining about it).

Slipstreaming is essentially remastering Vista (and XP-s) ISOs to include the latest patches/service packs, i.e. in case of XP, this allows you to have a windows install that won't get you rooted in 5 minutes after you go online (with SP2). You can also include drivers or basically anything you have installed. In other words, you can install win XP, firefox, ffmpeg codecs, a viruscanner, openoffice, etc., and then you can make a custom ISO that would install windows XP and all that software in one go! This is good if you maintain a number of PCs in a comp. lab.

This feature makes life of sysadmins a lot easier, and I'm glad MS didn't take this away - I wouldn't be surprised if the control freaks did. To turn this into a "Vista designed to make malware easy headline" is simply trolling, and article should be tagged troll accordingly. Especially since almost all operating systems have this ability (to remaster the ISOs to include updates/security fixes and 3rd party programs. Basically this is what linux distributions are about).

Re:So?

[Ajehals]

*ISPs need to be more proactive at disconnecting people who can't keep their computer clean.*

I agree in principal - but disagree in practice, - I have had a number of calls and even been disconnected by various ISP's due to behaviour that they assumed was viral - simply because their methods of detection were too simplistic - perfect for most people but a pain for many others - the solution in my case was to go for an ISP that was rather more expensive than the norm...

Oh and the reasons for the calls and disconnections -

Your computer has a virus because it is sending and receiving email directly - via ports 25 + 993, - apparently (according to their documentation) I either had a virus or my mail client was incorrectly configured - I should change the SMTP server to smtp.foo.com and my "pop3" server (never mind that 993 is clearly related to IMAP) to pop.foo.smtp. - My return calls to the ISP required escalation to their 3rd level before they understood that I didn't want to use their mail servers.... (I was even told that their servers were incompatible with my servers, and that there was no such thing as an IMAP server...."its POP3 for Post Office Server...")). So real reason for the disconnect was me using a mail client with my own servers - this was before I used a local mail server - more on that later....

Same ISP; I used port 23456 for testing an app I was writing (still am writing - its intended to manage a number of Debian machines apt configs and updates etc creating groups of them etc...) - I was told that I had been detected as a Hacker by technical support. I changed ports - and then left that ISP about am month later.

New ISP was taken over by another ISP after about 8 months of my contract with them. At about this time I had started to use my own mail server and about 2 weeks after that all mail associated ports (for some reason except 587) would return errors - ( Here is a copy of the message received whenever you try to connect to port 25 manually - the same for others...)

server-001:/home/*********# telnet smtp.foo.com 25
Trying 216.234.246.150...
Connected to smtp.foo.com.
Escape character is '^]'.
554 Please check your SMTP server is set to smtp.********.com. Further help is available at http://help.*******.com/sessionBegin.do?solutionId =kb*****
Connection closed by foreign host.

(*'s to protect the innocent - which they are sort of..)

Again major discussions with tech support - first off with them claiming that no ports were blocked or redirected (I recorded that call and played it back to every level of support I got passed to...) Anyway I was finally told that yes they only allowed mail through their servers (but why was I not using either their mail servers or a web mail service? - they even offered to help me set up a hotmail address....). This was apparently due to the sending of spam and due to issues with virus infections so I guess its a fair point. So rather than putting up much of a fight (as in contract terms and TOS etc.. I offered to leave if they terminated the contract without penalty (which they did and let me keep the router that I had never used, a set of cordless dect phones (Which was nice) and a 4 month old sony k800i. Not bad - and no grumbles.

I now have a business account with a major provider - and all is well.

I guess what I am saying is that its all well and good detecting things which could be malicious - but you will miss a lot (there is only so much you can do) and you will block a lot of legitimate users - or identify them incorrectly as viral.

Last point it turns out that the ISP that forces you to use their mail servers will relay any mail from within its network regardless of pretty much anything (including the lack of from addresses or the inclusion of hundreds of recipients) so the blocking of mail there is really part of their solution (presumably they monitor what goes through their mail servers too...) which may have an impact on privacy as well as on the flexibility of service.

Anyway. As I said - I agree with you but I am not sure how the ISP's are supposed to do it. Clearly mandatory virus scans are out of the question.