Slashdot Mirror
Russinovich Says, Expect Vista Malware
Hypertwist writes "Despite all the anti-malware roadblocks built into Windows Vista, Microsoft technical fellow Mark Russinovich is lowering the security expectations, warning that viruses, password-stealing Trojans, and rootkits will continue to thrive as malware authors adapt to the new operating system. Even in a standard user world, he stressed that malware can still read all the user's data; can still hide with user-mode rootkits; and can still control which applications (anti-virus scanners) the user can access. From the article: '"We'll see malware developing its own elevation techniques," Russinovich said. He demonstrated a social engineering attack scenario where a fake elevation prompt can be used to trick users into clicking "allow" to give elevated rights to a malicious file.'
I'm really quite surprised by this.
with companies like ask.com (who run smileycentral a well know spyware site) nothing will change
just click on setup.exe and you can have this fantastic free screensaver, be the envy of your friends !
In similar news, despite a wide variety of new content, online pornography remains disproportionately popular.
"Physics is to math as sex is to masturbation." -R. Feynman
"He demonstrated a social engineering attack scenario where a fake elevation prompt can be used to trick users into clicking "allow" to give elevated rights to a malicious file.'"
Good thing geeks are anti-social.
Karma police, arrest this man. He talks in math. He buzzes like a fridge. He's like a detuned radio.
So you're telling me I shouldn't have installed these smilies? Here, let me try a typical smiley face. :-@*&^^^ NO CARRIER
Pulp Audio Weekly - Geek News and Reviews
So now you know that Vista can be compromised ... what are you doing about it?
Where's the clean boot disk that I can use to scan a Vista box? How do I validate all the files on it?
What is your answer to AFTER the box has been cracked?
From the "No fucking shit, sherlock" file...
Malware writers will write malware for the latest OS? And they'll try and find ways around the blocks? And in the millions of lines of code, they'll find a weakness and succeed? Holy shit, I never would have guessed!!
Seriously, sometimes when I read Slashdot, a small part of my brain cries out in pain, and then is silent forever.
If I knew the wedgies I gave you back in 6th grade would have resulted in this . . . I might have taken a moments pause.
Vista is Malware!
"You'll get nothing, and you'll like it!"
In Russinovich, malware attacks Vista.
Sheesh, evil *and* a jerk. -- Jade
He demonstrated a social engineering attack scenario where a fake elevation prompt can be used to trick users into clicking "allow" to give elevated rights to a malicious file.
That is the scenario I have been envisioning since I first installed RC1. Microsoft is conditioning users to agree to about anything by having so many intrusive pop-ups. People just want to get on with their computing experience. Maybe they will read the warning a few times at first, but after a short while they just respond without reading because that is how they get to the next step. Of course malware writers will use this method, it is almost as if Microsoft has given them a gift.
"Kittens give Morbo gas!"
The comma isn't extra:
:)
Proper punctuation for a sentence like this is:
Someone said, "Something that they said goes here."
A comma is supposed to precede the quote. If anything, one might ask, why the headline is missing the quotes.
I can boot with a LiveCD and mount the hard drive so that NONE of its files are being run.
Then I simply match each and every file on the hard drive to the package that it should have come from and validate the md5 checksum.
Any file that is NOT accounted is suspect and can be individually evaluated. Most of them should be data files that are not executable.
Remember, in Linux, everything is a file and the boot process is very clearly defined. If something is running on your machine, you can find what it is and why it is running.
Any system that REQUIRES a complete tear down after ANY vulnerability is exploited is NOT a well designed system. There has to be a way to validate each section of the system.
People sometimes talk like strong enforcement of Unix-style permissions is sufficient to provide local security. I find that argument totally unconvincing. Yes, it's nice to have the confidence that with modern OSes like Linux, OS X, and (probably) Vista I won't end up like the old Windows where you have to reformat a disk to try to clear the deeply dug in roots of some spyware crap from the system, but there's still the pretty damn big issue of all my data. Namely, having to reinstall the OS would be a pain, and I'm glad I don't have to waste an hour doing it, but losing all my data (documents, photos, music, and to a lesser extent application preferences) would be devastating. The data on my PowerBook is my life, and the reassurance that at least I don't have to reinstall OS X would be cold comfort at best. True, I do make a monthly backup onto an external drive that is normally unplugged (and thus out of range of rm *ing attacks), but probably most users don't follow this practice. Besides, a subtler virus could just silently corrupt my data over a period of months, so that I don't notice what's going on until my backups are no longer any good!
There is a solution to the problem, but it requires a deep rooted change in how things are done. What I propose is that we shift from permissions by user to permissions by application. Right now, any app that my user launches can erase any of my files. That's ridiculous! Much more logical would be allowing me to decide which subset of my files each app can user and how. So, for example, I would let FireFox write downloads to my desktop and its preferences and caches to subfolders of the Library, but I wouldn't want it to be able to erase any of my other files under any circumstances. In fact, most of the time I don't even want FireFox to be able to read my local files, but I'd be willing to put in a password to let it do on a time limited basis so during uploads and the like.
Basically, what I'm proposing amounts to sandboxing every app. This may seem harsh, but why not do it? What's the advantage of letting any app destroy any of my files? Make them at least beg me for permission first, I say!
So, that's what's on my wishlist for the future of OS level security.
From the summary:
"malware... can still hide with user-mode rootkits"
Did that strike anyone else as odd? User mode rootkits... wouldn't that be "userkits", or just trojans/viruses/malware? If it doesn't have root access, I don't think you can call it a rootkit.
"I like systems, their application excepted", George Sand (French)
malware tends to only be available for popular OS's! I am sure that Vista will remain safe from such attacks.
The basic sleazeware produced in a drunken fury by a bunch of UCBerkeley grad students was still the core of BIND. --PV
I had already addressed that.
I had said:
"Any file that is NOT accounted is suspect and can be individually evaluated. Most of them should be data files that are not executable."
Again, you should be able to automatically validate the system files, then you manually check the others. Those others include the config files, user files and so on.
If that were correct than your newly installed box would be cracked as soon as those user files were restored.
And, yes, they will need to be restored.
So, in EITHER case those files will have to checked for "all things evil".
But in my scenario, the box is validated FASTER and you can identify the files that were added/replaced.
More importantly, you can validate whether the box WAS compromised.
I take it that you don't work on Linux boxes much.
There are a finite number of files on the box. And EVERYTHING is a file.
The more of them that you can automatically validate, the smaller the number of files that you have to search through. This isn't magic. It's something called "Computer Science".
In your scenario, you rebuild the box, restore the users' files
Oh, that's easy: because it takes a lot longer to type " ... " than it takes to type " ... " into the <title> tag. (Though that's still not as long as it took me to type this comment.)
Funny how it's all happy-talk before release, and it's only afterwards that they start to "lower expectations."
Remind me again, what was supposed to be so good about Vista? Oh, yeah, all the stuff like WinFS that somehow never happened.
And when people pointed that out, the answer was "but the really important thing is security, which Vista does have."
"How to Do Nothing," kids activities, back in print!
I was trying to print some online coupons recently and special software had to be installed. On the installation instructions, it said to run the intstaller than answer "yes" to the question it asked (obviously whether it should be allowed to modify system files). What's the use of OS security if users regularly install software which requires admin access? (due to some kind of Digital Restrictions Management scheme of course)
Well, to hack/infect/trojan a Vista system you first have to find one. Considering the high switchback rate to XP that's going to be harder than previously expected.
Engineering is the art of compromise.
Hmm.. wonder if you could flash a CD-ROM drive to run arbitary code on start-up.. presumably yes.
How we know is more important than what we know.
And, how would that be pronounced in Russian? Where Vista infects you.. er, I mean where you infect Vista.. er..
http://blogs.zdnet.com/Apple/?p=422
boycott slashdot February 10th - 17th check out: altSlashdot.org
I'm guessing that Duke Nukem Forever is dependent on some unique feature of the WinFS filesystem...
FATMOUSE + YOU = FATMOUSE
Let's put this simple. You're right, permissions by user isn't enough. But if we set permissions by app, eventually, Windows users will become accustomed to clicking "Accept" to every app permission that occurs, creating the same state we're in now. Do I read all of the XP pop-ups? Yes, I do, as well as all my Spybot pop-ups, as I don't want a randow BHO installed on my system. Does everyone read those pop-ups? Hell no!!! And that's the reason why I have to clean out my girlfriend's computer on a monthly basis. I can't expect her and children to read every pop-up and understand what's going on. As any sysadmin knows, it comes down to the average user. We can try to educate them as much as possible, but until they do learn, we have to have some permissions-based system so that we can try to keep average users out of their computer enough to stop zombied boxen from happening everywhere. Am I trying to educate my girlfriend? Yes, but it's not a simple process.
"The only constant in the universe is change." - Unknown author
I have yet to be convinced that Vista itself isn't actually malware. Here is my reasoning:
1. Usually malware comes bundled with something that I am interested in actually using. I was kind of interested in trying the aero interface of Vista, so I installed it. After doing that I noticed weird things with my computer (lockups, hard drives failing to read and write) -- a sure sign of malware.
2. After installing Vista, my system tends to be slower. This is a clear indication of malware being on my system.
2. Strange windows keep popping up telling me messages I am not interested in. This tends to happen also when malware is installed on a computer.
There are several other issues, but these are the main ones. I looked at some websites describing malware, and according to security experts, these are key factors indicating that its highly likely I have some malware on my computer. I think I will have to get rid of Vista becasue not only will it eventually allow for malware to run inside of it, in fact, it IS malware!!!