Shape-Shifting Malware Hits the Web

Stony Stevenson writes to tell us that in a recent interview, Marc Henauer has revealed that security researchers are falling behind now that malware is starting to be able to change its signature every few hours. "Unfortunately the know-how and construction kits used to create this shape-shifting threat are now readily available and are unleashing a wave of malware based on social engineering techniques. [...] Sweeney believes that a non rules-based monitoring process must be set up to defend all ingress and egress points covering SMTP, DNS, HTTP(s), IM etc."

Comments

This is a GOOD thing

[$RANDOMLUSER]

Maybe now we'll stop pretending that glorified versions of grep can keep us safe.

Re:This is a GOOD thing

[Threni]

> Maybe now we'll stop pretending that glorified versions of grep can keep us safe.

No, we just need to grep for the right string. You know, the code which does the shape shifting. Or is the suggestion that new executable code is somehow created out of nowhere?

Re:This is a GOOD thing

[ka9dgx]

Amen!
Imagine having two broken hands. You would have no way to directly take the money from your wallet and manage it yourself, you'd be forced somehow give your entire wallet to someone each time you wanted to pay. It would be almost impossible to prevent them from slipping an extra $20 unless you happened to see it. You're forced to trust someone completely.
For the foreseeable future, we're all dealing with two broken hands. There's no way to pick which parts of our set of capabilities we want to hand to a program. We have no way of stopping it from taking our personal data and sending it away, holding it hostage, or subtly sabotaging it.
I want my metaphorical fingers back.
--Mike--

Re:This is a GOOD thing

[Anonymous Coward]

BadAnalogyGuy is that you?

Re:This is a GOOD thing

[Anonymous Coward]

Why do you suppose that the shape-shifting code cannot shape-shift itself?

Re:This is a GOOD thing

[AKAImBatman]

Self modifying code is self modifying code. If it changes its signature into a different permutation that contains the same logic (e.g. changing the registers loaded, moving memory locations, inserting no-ops that don't look like no-ops, allocating different stack size, using a different location on disk, etc.) then it becomes nearly invisible to automated tools. I'm sure the next revision of anti-viral software will aim for complex heuristics that attempt to negate this sort of hiding. Which will become the next major arms race between virus writers and anti-virus writers. (Just like spam vs. anti-spam.)

Of course, arms races are usually a bad thing. They waste resources yet deliver very little. We need to start thinking about building a new infrastructure that is not susceptible to such simplistic attacks. e.g. Managed languages, jailed environments, trust relationships for email servers, and other such steps to data security. Unfortunately, there is so much time and money invested in our current infrastructure that there's no chance the market would make such a change unless absolutely forced to do so. Thus we come full circle back to the GPP's point.

Re:This is a GOOD thing

[fatphil]

Bzzzt! In order to do that we have to first solve the Halting Problem.
It is impossible, for arbitrary code, to even tell which parts of the code are code, and which are data. Working out which bits of the code are a morphing routine is unimaginably harder.

Re:This is a GOOD thing

[AKAImBatman]

Oh, and I forgot a particularly nasty option: Compressing or encrypting the code. e.g. A piece of code can use OS services to compress data on disk. This would make it look like any other program with compressed segments. Another option is a variation of One Time Pad based on system information like hostname or MAC address. Again, it's hard to identify the stub as a definite virus header.

Even worse is that most viruses today are part of a Botnet that has Command and Control capabilities. So the hiding ability of the virus can be updated on a regular basis. Version 1 selected between compression and OTP? No problem! Version 2 will add reordering of code segments!

Quite nasty, these bugs.

Re:This is a GOOD thing

[Anonymous Coward]

Damn right.

That's clearly a job for awk.

Re:This is a GOOD thing

[drspliff]

A major pain in the ass is to write a polymorphic bootstrapper that won't be picked up. Most of the bots I've dissected in the past have used off the shelf compressors or encryptors to wrap a fairly standard (badly written) piece of software.

One of the neatest things I've seen so far is a server which gave one-off encrypted executables based on the clients ip address, the boot strapper then had to confirm the ip address before it could decrypt it, or download another version and try again.

Re:This is a GOOD thing

[Anonymous Coward]

Are you kidding? Arms races are the reason we have (relatively) easily accessible and affordable flight to most parts of the world, thanks to the development undertaken to improve the design of fighters in WWs 1 and 2. Sure, they're pretty bad in a lot of other respects but don't discount the potential of groups and individuals to achieve something just to spite another.

Re:This is a GOOD thing

[dvice_null]

> Are you kidding? Arms races are the reason we have (relatively) easily accessible and affordable flight to most parts of the world

We could have had the same technology without wars a lot cheaper. In war we basicly hire some scientists to work with a problem and we use e.g. 1% of less of the resources to this. And 99% of the resources to build machines that will be destroyed very soon on purpose. And in addition we kill educated people who could instead of dieing do someting usefull.

If instead we would just educate and hire a lot of scientist and inventors to investigate and research some areas and then donate all their findings to the public domain, we would get much more done with less money.

Arm race itself usually indicates that there are two groups figting against each other and not sharing the information.

Re:This is a GOOD thing

[Xenna]

This is actually old hat. The older PC viruses (in the early nineties) used polymorphic encryption engines. For each copy of the virus a slightly different decryption algorithm was created, that algorithm was the only unencrypted part of the virus the rest was encrypted (with a different key/algorithm each time). Upon execution of the virus the decryption code would get control first decrypt the rest of it and pass control to the actual 'payload'.

Anti-virus writers beat this scheme by running the decryption code in a 'sandbox' emulation and then checking the decrypted virus body for signatures IIRC and I think virus writers stopped using polymorphism after that.

I love it.

[Anonymous Coward]

The slashdot synopsis is longer than the article.

Re:I love it.

[Anonymous Coward]

So much for I didn't RTFA.

Re:I love it.

[corsec67]

It is a clever plan to get people to RTFA. Now people will stop bothering to read the fine summary.

Re:I love it.

[Snuhwolf]

So essentially this signals the rise of the were-malware.

Re:I love it.

[Drewmeister]

Your comment is the only reason that I bothered to RTFA. I feel like I should be rewarded.

Re:What's the bad news?

[Anonymous Coward]

What's the bad news?

The bad news is that all the users with a clue about protecting their PCs get sent spam, adware, crapware and all the other junk that these zombied PCs churn out until Windows does die.

Enumerating the Bad is not a good idea

[corsec67]

Enumerating the bad is usually a bad idea, since it is to easy to change what is "bad". We enumerate the good with firewalls, why should software security be any different? Distro repository + corperate repository should cover all software necessary, right?

Will we now see true evolution of software viruses?

This is pretty much #1 and #2 in this list of The Six Dumbest Ideas in Computer Security.

Re:Enumerating the Bad is not a good idea

[KDR_11k]

How do you propose enumerating the good for a virus scanner? A list of all harmless computer programs ever? Don't expect the user to fill it in, he bought the scanner to check unknown executables for viruses, not to keep a whitelist of known executables for him (if he knows it's safe he won't need the scanner). Remember that any defense becomes useless if it produces so many false positives that the legitimate positives get drowned out in the noise.

Re:Enumerating the Bad is not a good idea

[corsec67]

I wasn't referring to virus checkers for a list of "good software", I was thinking about the package manager used by many Linux distributions.
I don't know how that would work in Windows, but it generally works pretty well in Ubuntu, with the advantage that you can quickly add a set of applications.

Re:Enumerating the Bad is not a good idea

[DRAGONWEEZEL]

Require comercial software writers to subscribe to a whitelist (free of charge, but phone verification required)
Software becomes Read-only
Data is stored in data files
Owners machines poll for software installed, check against whitelist, everything else = BAD and has to be verified by owner
Switching verification off is a possiblity, but defeats purpose.
Whitelist gets updated nightly with verified "good" software

Donate now to DW's AV Startup w/ Paypal

Re:Enumerating the Bad is not a good idea

[lgw]

Right, because you've never get anything like a compromised version of SSL in a common distro package, compromising security for years undetected, right? And that was just accident, not malicious gaming of the system for millions of dollars reward.

Re:Enumerating the Bad is not a good idea

[KeithIrwin]

There are numerous difficulties in successfully characterizing what good behavior is. Viruses generally attack a program by getting it to execute data as code. This means that what's running, much of the time is the installed software. Making it difficult to install new software would be helpful, but doesn't prevent malicious software from running in memory.

There is research into intrusion detection techniques which is being used to attempt to characterize what "normal" program behavior is and notice when anomalous behavior occurs. However, it is difficult to get the false positive rate low enough for it to be practical.

Re:Enumerating the Bad is not a good idea

[UbuntuDupe]

Computer viruses being redesigned to handle one known precaution against them, is indeed an example of evolution of a meme, Dawkins's generalization of the concept of a gene. Evolution does not merely work across self-replicating amino acid chains.

Re:Enumerating the Bad is not a good idea

[Tweenk]

Package management doesn't guard against security vulnerabilities, it guards against installing malware. Debian SSL was not malware, it was a legitimate program with a severe bug.

Re:Enumerating the Bad is not a good idea

[lgw]

If you're vulnerable to accident, you're quite vulnerable to malice. No one has deliberately gamed a package management system to install malware broadly yet, but only because Windows Update is well-controlled, and the others reach too few targets.

Can someone explain what this means?

[yuna49]

Sweeney believes that a non rules-based monitoring process must be set up to defend all ingress and egress points covering SMTP, DNS, HTTP(s), IM etc.

What exactly is a "non rules-based monitoring process?" I thought I had some clue about security procedures, but I'm be hard pressed to describe what such a process might be. Even more importantly, what would it cost to implement? TFA is no help here, consisting of the usual hand-waving about the never-ending arms race between malware writers and the rest of us.

We all know what the most effective solution to this problem would be. Funny how it's never mentioned in any of these articles.

Re:Can someone explain what this means?

[joshtheitguy]

I think I know what you are hinting at with the solution. I believe it starts with an L, ends with an X, has "inu" between the L and x?

Re:Can someone explain what this means?

[surmak]

Doesn't even need to start with L as long as it contains all the other letters.

Re:Can someone explain what this means?

[yuna49]

Indeed. I don't really care if it's Linux or Open Solaris or OS X or, hell, even HP-UX. It doesn't even have to be *nix if it's built on a sound security model.

The fact that the global computing infrastructure is so homogeneously based an operating system as vulnerable as Windows just never gets discussed in these sorts of articles. Most Windows users I know just accept that virus protection, spyware protection, and the occasional reinstallation of the OS, are all the normal state of affairs in computing. Why would they think otherwise?

While I'm sure that the jump in Mac sales has a lot to do with the success of the iPod, I wonder what fraction of Mac buyers consider the "no-viruses" feature of OS X an important selling point?

Re:Can someone explain what this means?

[InlawBiker]

Linux and Mac to some extent are a solution because they're not targeted as much. Because they don't have the market share.

If the positions were somehow swapped and let's say Apple had the 92% market share, then malware authors would concentrate their efforts against OS X instead of Windows. (You can sub in the name of any OS you want, even the one that begins wih "L.")

It might not be as easy to compromise OS X or "L.", but malware authors are pretty clever. When there's money involved they'll find a way.

Re:Can someone explain what this means?

[ka9dgx]

You're right about needing a sound security model. One that allows the user to express their intent when running a program would be a good start.

Any idea where I can get something like that? I haven't seen a copy of KeyKos, CapROS, or Eros sitting on the shelves at Best Buy lately.

--Mike--

Re:Can someone explain what this means?

[Anonymous Coward]

I have known people whom decided to buy a Mac just based on the myth that there are no viruses for the Mac OS.

Re:Can someone explain what this means?

[ratboy666]

Actually, it is "rules". But, it is not "patterns".

Specifically, http outbound access should be allowed for firefox. The firefox binary is /usr/bin/firefox, and has an md5 signature of 64b6c465f9919e1fa860707fb762cff2. If the signature changes (without having updated the program), a security alert is raised. And that name/hash combination is allowed outbound port 80 access.

Basically, security should be SElinux and Tripwire. Those two tools (or equivalents on alternate Operating Environments) cover most of the threats.

Malware cannot then hide as an existing program. New programs should have strict security profiles that prevent "excess" (network, disk, cpu, memory) usage.

It would be possible to create malware, but it would be worthless, in the sense that the resources that could be misappropriated would be minimal (note that Unix and Unix-like systems have had ulimit for ages -- SElinux expands on the idea). A particular malware COULD attempt escalate to root, but SElinux would prevent the attempt to escalate the "usual" way. Specifically, firefox has NO REASON to gain root, and this can be prevented.

What would the worst malware look like in this senario? A javascript in firefox because it can do almost unlimited port 80 access. Email can be limited to qmail or sendmail (and even further limited by the expected amount).

Unix-like systems (with the exception of MAC OS X, which frightens me a bit) are heading here. Intrusion alert systems coupled with execution limiting, role based security systems (apparmor and selinex).

"AppArmor is an application security tool designed to provide an easy-to-use security framework for your applications. AppArmor proactively protects the operating system and applications from external or internal threats, even zero-day attacks, by enforcing good behavior and preventing even unknown application flaws from being exploited. AppArmor security policies, called "profiles", completely define what system resources individual applications can access, and with what privileges. A number of default profiles are included with AppArmor, and using a combination of advanced static analysis and learning-based tools, AppArmor profiles for even very complex applications can be deployed successfully in a matter of hours."

Of course there is no need for malware detection with this model. Tripwire already does a better job than any "anti-malware" program could, because it snapshots the OK state of all files. *anything* that differs is then suspect. AppArmor/SElinux provides for the expected BEHAVIOR of all programs. If they differ, they are suspect.

As you have probably noted, this protection does not accomodate "rootkits". However, a rootkit cannot be "defended" against, or even detected when running under it (at least if it is a reasonably well done rootkit). But this simple approach will eliminate all, or almost all, malware seen in the wild. With no need for anti-malware updates, or subscriptions, etc.

Re:Can someone explain what this means?

[Drewmeister]

Sweeney believes that a non rules-based monitoring process must be set up to defend all ingress and egress points covering SMTP, DNS, HTTP(s), IM etc.
Specifically, he believes the best defense would be to make pies out of them. :-)

Re:Can someone explain what this means?

[Anonymous Coward]

OK, so let's say that you're going to ridiculously hamper FireFox by only allowing it to access port 80. This will prevent me from using SSL, using my browser as an email or FTP client, or even accessing my router's web admin pages on port 8080. It also means that only proxies on port 80 are available. Of course the browser wouldn't be very useful without being able to access DNS, but let's ignore that.

Regardless, what's to stop a vulnerability in a plug-in (like Flash or QuickTime) from being exploited via a standard port 80 HTTP request? This exploit can then take over the browser, capture the keystrokes from your browser (or just the contents of form fields), and send them via a port 80 HTTP request to some Russian mobster. It could also sit around, waiting for instructions to tell it to start a DDoS attack. It could even send spam by exploiting some poorly written webmail form. Another good use of your zombie browser is to attempt to brute-force passwords on web mail passwords to allow it to send spam.

Do you see how useless your "rules" are now?

dom

Re:Can someone explain what this means?

[atraintocry]

"To some extent"? No, we are talking about unauthorized code here, so running with least privileges is the *entire* solution. There's not much that can be done to help what's between the chair and keyboard, but Windows is botnet fuel because it gets run as administrator, not because it's popular. There's plenty of internet-connected devices out there that don't run Windows, and, last time I checked, cell phones & game consoles aren't usually used to send spam.

Re:Can someone explain what this means?

[Blakey Rat]

Unix-like systems (with the exception of MAC OS X, which frightens me a bit) are heading here. Intrusion alert systems coupled with execution limiting, role based security systems (apparmor and selinex).

Apple realizes that OS X has, as a significant share of its market, this thing called "normal people." "Normal people," in case you've never encountered one before, have no clue how to use any of the stuff you just outlined above.

The real issue at hand here is the following:

1) The OS has to ask the user whether they want to run the code. This is true regardless of the certainty the OS has that the code is unsafe. (There's an exception for items that are known to be 100% unsafe, but of course we're already doing that in every OS.)

2) Because of this, the user can choose to run unsafe code.

Nothing in Linux solves this. Nothing in OS X solves this. Nothing in Windows solves this. It's possible that there's nothing any OS can possibly do to solve this.

Re:Can someone explain what this means?

[ka9dgx]

Thanks for the pointer to AppArmor, it appears to be a very good step in the direction of least privilege execution of program. The "learn" mode makes it easier to configure things, which helps out the novice.

Doing this on the Windows side of the world is, of course, impossible, because you can't patch the kernel there, and there's no equivalent of Linux Security Modules.

I guess the closest we could get would be to run apps in Wine with an AppArmor profile for each one. 8)

Re:Can someone explain what this means?

[ratboy666]

I do like the way you put down the abilities of "normal people". Look, here's a way to secure your house. It's called a "lock". You need to use a key -- no, not just ANY key, but the specific key. Select it, put it in and turn it. Yes, it really is three steps, so I guess the average home owner won't get it...

Tripwire -- or equivalent. Every file that is part of the system or application software is checked. Should happen every day. Any change, the owner is alerted. The approach is VERY specific. The reports generated can be (and are) very readable: a file has been added, deleted, modified in this location, with an estimated security potential of x%. Windows (as an example) ALREADY does this; this being the self-healing implementation. It doesn't extend as a generic facility (not sure why). I don't care about self-healing -- it is more important to simply know what. After all, these ARE personal systems and are easily reloaded (after all, if you DON'T KNOW why it happened, it may have resulted in a rootkit, all bets are off. Either reload with updates, or call in a specialist, meanwhile, keep the machine off the 'net, and disable any local drive writing). I wouldn't trust the systems attempt to recover.

Behavior -- an "authorized" application doesn't need to pop up any questions. After all "This may be bad" is rather stupid. How would the user know? Instead - "This application will use x amount of memory, y amount of your processor, z amount of disk and n amount of network. It promises to limit to WEB, and EMAIL". If, of course, you don't think that EMAIL is appropriate, remove that. If an application DOESN'T have such a signature, pick very low limits. 1 second of CPU, 10MB disk, 1MB memory, and 2MB network (any ports). Or whatever -- but PUBLISH the settings allowed.

The end users aren't stupid. And if you want to dispute this -- remember that you too are an end user.

There really are only two solutions - this one (control) and whitelisting. The reason that this isn't done is more of a development history issue. Microsoft started with DOS, which has a very simple policy: the running application COMPLETELY owned the machine. Thus, the expectation is this holds even today. But, all we have to do is go back to other (historical) control programs -- generally program resource requirements had to be spelled out in detail (I will use this much memory, and I want 2 tape drivers and that printer...). This works. Things like AppArmor and SElinux simply apply the rules to the resource usage of programs.

Note that you could STILL have malware, but the idea is that the resources would be constrained, making it "impotent". Remember, the dialogs "allowing" operations are futile (they can be activated too easily). It helps to begin with a source-visible kernel, simply to verify that there is no way around the OS control provisions. (I believe Windows kernel is now in this category).

It's just the anti-virus companies claiming that.

[khasim]

That way they can keep selling you "updated" "signature files" every hour / day / week / month / year.

The correct way to handle this is to set up your system so that the user cannot ACCIDENTALLY execute any external code.

There's no way to solve the issue of some idiot clicking on everything and putting in the root password whenever asked. So don't bother bringing that case up.

For everyone else, lock the OS files so that it cannot be infected and set the user writable portion to not execute any code. There, the majority of that problem is solved.

Then, ship the default installation without any open ports and you've pretty much solved the worm issue.

But that approach means that the anti-virus companies cannot keep selling you new signature files. So don't expect any of them to support it.

It won't end until there is extreme violence

[erroneus]

Until the people who are putting this stuff out there are seriously and literally beaten either within inches of their lives or to death, this sort of thing will get worse and worse.

These assholes call themselves "marketers." They have gotten away with it for so long, they often call a great portion of this "legitimate business." It's not enough to criminalize this stuff... especially when law enforcement generally has no idea how to prosecute or make a case against any of it.

There should be a series of web sites built that creates a "hit list" of people responsible for this crap. That's where the end of this should begin.

Re:It won't end until there is extreme violence

[maxume]

That's stupid.

Look how well playing wack-a-mole has worked for drug enforcement. Rather, look how it hasn't worked at all.

Re:It won't end until there is extreme violence

[InlawBiker]

Yeah, but still. Having had to clean up some catastrophic messes that have been created by malware I still fantasize about one day beating the pulp out of one of those bastards.

Re:It won't end until there is extreme violence

[erroneus]

Is there a "whack-a-mole" game going on against drug makers and distributors? I'm talking about vigilante justice. There isn't any large-scale information availability on the identity and whereabouts of drug people. Do you know of any?

Re:It won't end until there is extreme violence

[maxume]

Most people who care to, especially the police, know who the drug dealers are. Anyone who has never met a drug dealer has led a more sheltered life than I have, and that is an accomplishment.

Anyway, the point is that as long as there is financial incentive to create malware, there will be people doing it, regardless of the consequences, just like drug dealing. That the consequences come from different directions is immaterial.

Re:It won't end until there is extreme violence

[Nullav]

Not like drug dealers aren't killing each other daily. When's the last time you heard about a spammer shootout over a bad deal? When hijacking machines and flooding disks around the world ceases to be easy money, I predict that a lot of these parasites will simply move on to something else. Yes, I am advocating the idea that we legalize spammer hit-lists. Opt-out, of course. =p

Re:It won't end until there is extreme violence

[DavidTC]

People want drugs, so have an incentive to do the deal secretly.

People do not want malware on their machine. Most of them don't know they have malware, but that's not the same thing as wanting it.

It's not the same thing at all. The analog to malware would be hundreds of very good pickpockets that steal a few dollars at a time wandering around a city:
50% of the victims not knowing they were robbed but know they have to go by an ATM every day or so and don't know where their money goes. (People not running antivirus, have to continually reinstall)
35% of the people carrying loud money monitoring devices that usually go off and allow the victim to snatch their money back, although sometimes it fails. (People running antivirus)
15% not carrying their fucking money taped to the back of their shirt like everyone else, although annoying that's the only way to pay for things at 60% of the stores, so they only get ripped off occassionally. (People not running Windows)

Anyway, it would be completely trivial for an organization with the FBI's resources and the ability to get warrants to stop all the felony computer misuse out there.

Re:It won't end until there is extreme violence

[maxume]

There is a financial incentive to provide drugs. There is a financial incentive to create and push out malware. That's the analog I was using, because it's the financial incentive that drives both drug dealers and malwarers to do what they do.

The FBI could go to work in the US, but they probably wouldn't get much done outside of the country.

Is I told you so a meme?

[zappepcs]

All my posts about malware and virus software for some time have been doom and gloom. Seems moderators don't like that. This is nothing but the tip of the iceburg of what might be coming, and what is probably already in the wild, we just don't know it yet. I could probably think of a dozen scenarios where malware could already be hiding on your equipment, silently waiting to be signaled.

It's possibly in your router's flash by now, or your motherboard's flash, or sitting on a CD or CE player's flash, or an MP3 player. It only has to wait till it needs to start spreading, and be dormant there too, then one day you notice missing files, or there is an outbreak of serious malware globally. Yes, tinfoil hat stuff, but it is possible, and as time ticks on it is becoming more probable.

Nobody wants to believe it, but it is possible. If it is possible, it will only be a matter of time...

Re:Is I told you so a meme?

[ka9dgx]

It's possibly in your router's flash by now Especially if you recently got fake routers from China. ;-)

Re:Is I told you so a meme?

[Walter Carver]

Yes it is possible. Anything is possible. But the point is, what makes you think that there is malware on all these places? Just because something is possible doesn't mean it will happen. A nuclear war between USA and USSR was possible in the 60s and 70s but didn't happened.

All I am saying is I need something more than just a suspicion.

Re:Is I told you so a meme?

[zappepcs]

The difference, and what makes that argument invalid, is that once you start a nuclear war things only get worse. With malware your chances of getting rich with no negative results are increasingly getting better. Apples and oranges.

It is the lack of negative results like nuclear winter, global destruction, and unimaginable loss of life etc. that make the probability of malware an ever increasing threat. It's not at all like a cold war. Having that kind of optimism about things is what I would call a bit naive. Mind you, you're in good company. Look at all the people that voted to put Bush back in the Whitehouse?

Re:Is I told you so a meme?

[Walter Carver]

And things don't get worse with malware? It's been getting worse for at least 15 years.

Anyway, you didn't like the analogy with the nuclear war? Well, then omit it and keep only the point: just because something is possible doesn't mean it is going to happen. Anything is possible but I need facts, not suspisions.

Work Uniform

[WindowlessView]

I thought shape-shifting malware was the official business attire of geeks everywhere.

Re:Work Uniform

[Phroggy]

That's "shape-shifting malwear"; note the spelling distinction.

Re:Work Uniform

[Anonymous Coward]

Note the capital L on your forehead, not forhead or fourhead.

More like Everything Old is New Again

[WinPimp2K]

Or am I the only one old enough to remember that brief time when DAME was considered the unholy terror?

Re:More like Everything Old is New Again

[idontgno]

Ah, Dark Avenger Mutation Engine. Sheesh. That brings back memories of frisk and Vesselin Bontchev holding forth on VIRUS-L. The good ol' days.

Dang. It's been at least 1 1/2 decades that experts have been warning that signature-based malware detection isn't gonna cut it. Heck, Fred Cohen warned us in 1987. So what do we get? Nothin' but signature-based antivirus. Sucks bad to be us. Great time to be an antivirus vendor though.

Re:It's just the anti-virus companies claiming tha

[davester666]

But there is no way to uninstall Internet Explorer. Sure you can delete the icon, so it doesn't appear to be installed, but it still is always available.

Re:It's just the anti-virus companies claiming tha

[ka9dgx]

That doesn't fix the confused deputy problem. Even if the user never makes a mistake, their system can still be compromised. You should NEVER have to trust an application to contain itself to a set of capabilities. That's what Operating Systems are supposed to do for you.

--Mike--

Re:It's just the anti-virus companies claiming tha

[Anonymous Coward]

You can remove it, but it's nasty.

A Blast from the Past....

[NullProg]

1991
        Tequila is the first widespread polymorphic virus found in the wild. Polymorphic viruses make detection difficult for virus scanners by changing their appearance with each new infection.


Sweeney believes that a non rules-based monitoring process must be set up to defend all ingress and egress points covering SMTP, DNS, HTTP(s), IM etc."

Its called heuristics and its been in use for a while.

Enjoy,

Re:A Blast from the Past....

[ka9dgx]

Sorry, take your magic bullet home, and try again. Heuristics only catch the obvious, and not the subtle nor patient.

Re:A Blast from the Past....

[Kingrames]

Admit it. If tequila is a virus, you don't want to be virus free.

Re:A Blast from the Past....

[Anonymous Coward]

Its called heuristics and its been in use for a while Not by his product!

Regards
Tier-3 customer

Re:What's the bad news?

[ka9dgx]

That doesn't help the situation. If windows goes away, the problem with just migrate to Linux.
Until we get to the point where you can assign permissions to every single program for every single role you expect that program to fulfill, it's not going to get much better.
--Mike--

Re:It's just the anti-virus companies claiming tha

[KDR_11k]

How would a user be able to install anything then? Malware would just use the regular installation procedure.

Besides, the click-everything user is unfortunately the default and the resulting bot-nets can hurt you no matter how good your security is.

Re:It's just the anti-virus companies claiming tha

[Anonymous Coward]

If you have Internet Explorer on your computer, the OS is a bigger problem.

Re:It's just the anti-virus companies claiming tha

[nbert]

The correct way to handle this is to set up your system so that the user cannot ACCIDENTALLY execute any external code.

Would be rather trivial to implement in XP or Vista (and I'd love it, because it would reduce the number of calls off duty. On the other hand every employee would hate it and they might call me even more because they can't download "useful" stuff). But in the end this is not the most common source of malware/virii anymore. Cross-site-scripting accompanied by security holes in common plugins causes way more compromised systems. Bugs in Flash or quicktime in earlier versions make it extremely easy to infect a system without the user noticing. When I look at the stats of my website I could infect 50 visitors by week without much effort, because they run old versions of Flash (I'm not talking about the website I list in my profile). The so called "Russian Business Network" offered $ 0.10 per infected user last year. Might be just 5 bucks per week for my small site, but in the end I must say that it has never been easier and more profitable to infect IT systems (and no, I didn't take the money).

a possible solution

[FudRucker]

If you take a snapshot of your harddrive/OperatingSystem, and as long as you don't do anything to change it (no writing to disk anywhere, no launching applications) then take another snapshot a few minutes later and another and another, soon this shape/shifting malware will reveal itself, get enough glimpses of it and a picture will emerge so you will know what to look for then know how to eradicate it from your computer, I doubt the kludge like mcaffee & norton are capable but somebody has to rise to the occasion to build something good enough to do this, it would be worth it to leave your PC alone while some anti-malware runs that can deal with this shape/shifting malware and catch it so it can be removed, or reveal a method & list of files so you can manually remove it...

Re:a possible solution

[ka9dgx]

Wouldn't it be simpler (but by no means easier) to allow the user to specify what side effects they are willing to allow a program to create before they run it?

System updates would be allowed pretty much any side effect (but not the user folders).

Web browsers could only connect to the net, and their local folder, but nothing else.

etc, etc.

Re:a possible solution

[FudRucker]

thats exactly why I don't use ms-windows anymore, everything is just too open to attack, open Windows Explorer file manager and type in a URL - it does not launch IE, it is IE or morphs in to IE, open Internet Explorer and type in C: hit enter and you can use it as a file manager and change & delete files, if that is not asking for trouble I don't know what is, knowing this and how many users run their PCs 24/7/365 with admin privileges because managing a multi-user system with admin & users privileges kept separate is just too inconvenient...

when Linux becomes too popular and if it becomes the target of malware like windows is I will move to something else, maybe some flavor of BSD or Solaris...

Re:a possible solution

[ka9dgx]

Sounds like a prudent strategy to me, not perfect, but apparently good enough.

Re:a possible solution

[mikechant]

when Linux becomes too popular and if it becomes the target of malware like windows is I will move to something else, maybe some flavor of BSD or Solaris...

The important thing is that Linux cannot and will not "become like Windows" because the whole development process automatically leads to multiple versions composed of different combinations of individual software packages compiled with different options, and makes it much more difficult to target large numbers of systems with (say) a single malware binary. It's like the difference between pedigree cats (look very pretty but can have serious inbreeding problems) and 'moggies' (who are the product of random breeding but are much more robust).

Re:a possible solution

[DavidTC]

Plus it has had fucking user accounts built in from the very start.

I have to run Windows for work. I tried, for six months, to run as a non-admin. I couldn't do it. Everything would just fail.

To run any admin stuff, I'd have to modify the shortcut, which isn't bad, but then, on every single launch, I'd have to tell it I wanted to run it as a different user (For some reason the fucking box defaults to running it as the 'Current User'), and then type the admin username, and then type the password. Instead of just typing the password.

And to run any of the admin tools, or control panel, I had to launch explorer that way, and then navigate around.

You want to see what I mean by that, right click on a shortcut and choose 'Run as' and count how much to takes to switch. Oh, and on top of that, I couldn't use 'Administrator' because I had scheduled tasks using that so didn't have a password on it...but you can't 'Run as' a user without a password for no logically conceivable reason. I had to make a new account and use that. (Looking back, it might have been easier to move all my cron jobs to another user and put a password on 'Administrator' so I could have skipped typing the user name, but this is just getting into the realm of utter stupidity at this point.)

And, of course, when I switched to that user...well, everything was 'su -' instead of 'su', if you grasp what I'm saying. My Documents directly was totally wrong, for some reason all my network drives weren't there anymore(?!), it was a mess. I eventually had to set up shortcuts on the admin's desktop to all the important places like my actual user's 'My Documents', and the network paths that were my mounted drives.

And I had to go and give myself write permissions on several program directories.

And absolutely nothing would prompt me and say 'You can't do that as this user. Would you like to switch to an admin user? Here they are, pick one, type the password.' like Linux GUIs were doing in 2000.

Re:a possible solution

[yuna49]

open Windows Explorer file manager and type in a URL - it does not launch IE, it is IE or morphs in to IE, open Internet Explorer and type in C: hit enter and you can use it as a file manager and change & delete files

Sounds a lot like Konqueror to me. Having the ability to treat local and remote files equivalently seems like a good thing to me. In fact, one of the features I like best about Konqueror is its ability to handle all sorts of URLs like smb:// and fish://. I don't use it routinely to browse the Internet; I use Firefox for that. But I certainly have used it as a file manager and a web browser from time to time.

Re:a possible solution

[Anonymous Coward]

It may be a small improvement but Vista seems to ask for an admin password when you do something that needs admin priviledges. It's still a pain but that improvement (which is an obvious one IMO) is welcome.

Re:a possible solution

[DavidTC]

I thought so at first, I assumed that was some sort of 'sudo' system, but I hear that there are way to get around it.

Plus, more importantly, it doesn't actually work with broken apps. If an application needs write permissions to its own program directory to operate, and hence can't operate under a normal user account in Windows XP, it's not going to work in Vista either...it doesn't know how to trigger UAC. It could easily be rewritten to do so, but if it hasn't been fixed in the half a decade XP's been out, it's obviously not going to get fixed now.

UAC is, indeed, like the GUI 'sudo' system that Gnome and KDE have had forever, but, just like them, it needs applications to actually ask for elevated privs, as far as I know. There are certain things that are taken as 'implied' requests, but writing to bad places isn't one of them. If I'm wrong someone correct me.

The reason it's not 'as good' as the system on Linux isn't because it doesn't work, it does work and it's a good idea. It's not as good because, simply, a lot of windows applications are used to writing wherever they want, and UAC doesn't and can't fix that. (There are, however, some interesting things being done to make normal applications run on USB drives that could help here...basically you emulate the entire filesystem and let applications write whereever they want.)

Comment removed

[account_deleted]

Comment removed based on user account deletion

My Solution

[Archangel Michael]

Public Executions.

public torture and maiming are also acceptable solutions.

Re:My Solution

[ka9dgx]

Ok.. you kill the author of a piece of malware... does that magically remove it from all the places it's gone to?

It might make us feel better, but it's not a solution.

--Mike--

Re:My Solution

[Archangel Michael]

SO, what is the acceptable penalty/deterrent for this crap? Because whatever we got now, it isn't working.

Funny thing, most people say "that won't work", but are unwilling to even try. I'm sorry, but I guarantee you that if we get a couple of dozen hackers hacked up, machete style, it will be a deterrent.

Guaranteed!

Re:My Solution

[Builder]

Yeah, but what are the odds on him writing a second piece of malware if we kill him after the first one? See - there IS an upside to this model of enforcement :)

Re:My Solution

[Phyrexicaid]

Ok.. you kill the author of a piece of malware... does that magically remove it from all the places it's gone to?

It might make us feel better, but it's not a solution.

--Mike--

It's written into the code:
if news(myDeath) then remove(malware)

Shellcode polymorphism

[Ceriel Nosforit]

Shellcode polymorphism has been known for years. Here's a good article from Phrack on it.
Any AV vendor who isn't prepared for it by now has grossly failed their customers.

Re:It's just the anti-virus companies claiming tha

[Joe The Dragon]

The correct way to handle this is to set up your system so that the user cannot ACCIDENTALLY execute any external code.
and you do that by asking cancel or allow for each app.

Re:It's just the anti-virus companies claiming tha

[Bryansix]

I'm pretty sure that deleting all the shortcuts and then putting firefox as the default browser is a way better solution then actually trying to yank IE out of Windows.

Who is this "security pro" anyway?

[flattop100]

The source for the article is "Marc Henauer, head of the cyber-crime division at the Swiss Justice and Police Department." Anyone actually heard of this guy? Doesn't he have more important things to do than make paranoid press releases? Maybe chase down the pirate bay or something?

Re:It's just the anti-virus companies claiming tha

[ka9dgx]

The user has two options... click or don't.

How about giving the user more choices? You might want to let them run it in a sandbox, or run it without internet access, or chroot it.

If they had a way to express their intent, and actually control how much they give away when they click... it would go a VERY long way towards fixing things, probably 99%.

--Mike--

Re:It's just the anti-virus companies claiming tha

[Anonymous Coward]

How many users that just run malware in the first place will use these options? More options won't change the habits of users who aren't security minded in the first place.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:It's just the anti-virus companies claiming tha

[Anonymous Coward]

With real OS you certainly mean WinNT right?
'cause UNIX is so 70s

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:It's just the anti-virus companies claiming tha

[idontgno]

As long as you can avoid every piece of software that uses IE's integrated libraries and services for its own web access and rendering. Good luck with that.

Really, "iexplore.exe" is the least of your problems. The real evil is in the half-assed DLLs and associated components.

Re:It's just the anti-virus companies claiming tha

[Ihmhi]

You can remove it, but it's necessary for Windows Update. Not a total loss IMO.

Trying to wikipedia your way to a +5, eh?

[Anonymous Coward]

This is what the GP said:

For everyone else, lock the OS files so that it cannot be infected and set the user writable portion to not execute any code. There, the majority of that problem is solved. This is what you said:

You should NEVER have to trust an application to contain itself to a set of capabilities. That's what Operating Systems are supposed to do for you. So, he said that we should control executables at the OS level, and your response is "no, we should control executables at the OS level (plus a wikipedia link to a sort-of but not really related problem)." Hold on, your brilliance is hurting my eyes.

Come on mods, this guy didn't even read the parent! I know he has a wikipedia link, but follow the damn conversation!

Re:Trying to wikipedia your way to a +5, eh?

[ka9dgx]

It's like structured code vs assembler.... you can do the same thing in either, in theory.
The difference is that the USER should get to pick which side effects they want to let a given random piece of code get away with, regardless if it was written in Redmond or somewhere else.
There's currently no way for a user to specify what a program can/can't do other than to create an account, set the permissions on EVERYTHING it might touch, and then hope it doesn't somehow do something bad anyway due to a bug somewhere in any of the code currently running on the system.
This is true in pretty much any popular OS.
I realized the difference is subtle, but it's very important.

Re:Trying to wikipedia your way to a +5, eh?

[datapharmer]

Nah, just setup a very restricted user account and run it under the other user. Then you don't have to restrict everything on you normal account. There is no reason you should have to limit the system, just limit the user and run the program that way.

its easy

[Anonymous Coward]

its easy just cut your internet cable remove all your cd and floppy drives cover your usb ports and bingo no way to ever get infected.

Re:its easy

[ka9dgx]

Too late, it's already in the BIOS. ;-)

No, it's not freakin' Unix

[Anonymous Coward]

Thinking that using Unix is the solution to getting 0wned is like thinking that heterosexuality is the solution to getting AIDS. The only general solution is education.

As the article states, this malware is all based on social engineering. If you can convince somebody to run a program because it will show them the latest celebrity sex tape, it doesn't matter what OS they're running. Right now it only works on Windows because the malware authors know that they can get 90% of the market by doing only 10% of the work and it's very difficult for virus-type malware to spread when hosts that are susceptible are hard to find. If any other OS took over perhaps 25% of the market, that OS would become a target also.

The answer, of course, is to educate users that they should be very skeptical of offers to view some celebrity sex tape or dancing bunnies, and that they should ignore such things.

The fact that Unix doesn't have many naive desktop users simply means that it gets attacked in different ways than typical Windows machines. Quite frankly, the first worm ever took advantage of the insecurity of Unix machines, and the term rootkit obviously comes from the Unix world.

dom

Re:No, it's not freakin' Unix

[Nullav]

Keep in mind that a lot of Windows malware only works because everyone runs as root.

Re:No, it's not freakin' Unix

[X_Bones]

Thinking that using Unix is the solution to getting 0wned is like thinking that heterosexuality is the solution to getting AIDS. The only general solution is education.

I'm sorry, but this is Slashdot. I'll need an automobile analogy, please.

Re:No, it's not freakin' Unix

[Anonymous Coward]

Thinking that using Unix is the solution to getting 0wned is like thinking that driving an SUV is the solution to dying in a car accident. The only general solution is education.

Is that better?

Re:No, it's not freakin' Unix

[jabberw0k]

The only general solution is education. Even Education can't beat Abstinence, which is effective 100.00000% of the time.

Re:No, it's not freakin' Unix

[Anonymous Coward]

I don't know about that whole abstinence thing.

It didn't work out so well for Mary...

Re:It's just the anti-virus companies claiming tha

[HisMother]

Good luck with that.

Last I checked, neither my MacBook nor my Linux desktop used a single DLL.

Re:It's just the anti-virus companies claiming tha

[idontgno]

What, no VM or Boot Camp?

Anyways, a clever answer, and in the final analysis, the correct one. But, violates the implied constraint of GP's question: While running Windows, how do you avoid using Internet Explorer?

My answer was "not as easily as it seems". Your answer was "mu". Very Zen.

Re:It's just the anti-virus companies claiming tha

[Missing_dc]

Ok, so we set a cancel/allow feature for every app. that may work for skilled or intelligent users, and most slashdotters would be OK.

The REST of the users out there are not as program/os/security savvy and would tell their PC to allow the app so they can watch that adult video or so they can have that pretty screensaver. They become so trained to just click allow that it defeats the purpose. As a sysadmin and a former helpdesker, I can tell you that the majority of computer users are a bunch of crack-tards who barely understand the mechanics of their machines. They would have no clue if a program asking for access is legit or not.

We as a community CANNOT use ourselves as a standard to base security(or perceived common sense) against. really, just look at society as a whole and ask yourself, do you consider yourself part of the norm, or are they just a bunch of petty, mindless sheep. Look at what they consider entertainment as a clue. Lost and American Gladiator- one gives them excitement and watercooler talk and the other allows them to imagine themselves doing better on those challenges so they feel good about themselves. Fabricated dreams.
What would you say the average slashdotter IQ is and what is the world average?

You are just wrong, stud.

[Anonymous Coward]

Linux and Mac to some extent are a solution because they're not targeted as much. Because they don't have the market share. Bullshit. Bullshit. This argument has been fully debunked and it is utter bullshit. I can't believe I still see it on /. of all places.

Malware writers go for botnets of puny windows desktop machines because that is low hanging fruit. One decent server with an always-on fiber connection to the net is worth thousands of times more than your dinky little ADSL gaming machine for just about anything that you would a botnet for. You know what the market share looks like on the server side? Most of the biggest and best machines on the net run *nix.

Macs have around 5% market share and are much more likely to be left on and connected all the time. By the market share argument, they should be getting having at least a few folks trying to get in.

You know why they don't? Sane privilege defaults, no activeX and clear separation between user data and and system applications, usually on entirely separate partitions.

Sorry dude, but windows really is just that bad.

Re:You are just wrong, stud.

[Anonymous Coward]

Do you not understand how botnets work? If you start spewing spam from some huge Unix box sitting on a fiber backbone, you'll get blacklisted in 15 minutes and discovered no more than an hour later. This technique is still in use, but deprecated.

Consider the DoS attack. You have a few big servers spewing out packets as fast as you can at some target and what happens? The target notes the IP addresses of the few sources and blocks them, then contacts their owners to get them fixed. Your DoS attack lasts at most an hour.

Now consider the DDoS attack. You have a million PCs all sending out a few packets per second at a target. How does that target manually block a million PCs? How do they even detect which PCs are part of the attack and which ones are legit? There's certainly no way to contact the owners of the millions of PCs to get them fixed. In this case, your attack could last for days.

It should now be obvious why the types of attacks you suggest went out of style years ago in favor of the botnet.

dom

Re:You are just wrong, stud.

[jez9999]

Bullshit. Bullshit. This argument has been fully debunked and it is utter bullshit. I can't believe I still see it on /. of all places.

You must be new here.

Re:What's the bad news?

[mikechant]

That doesn't help the situation. If windows goes away, the problem with just migrate to Linux.

Linux, by its very nature allows and encourages diversity - the structure of the FOSS community means that there will always be various distros and if any particular distro gets overwhelmed by security problems then it's not just possible but easy to switch to a new distro.

Re:It's just the anti-virus companies claiming tha

[Anonymous Coward]

What would you say the average slashdotter IQ is and what is the world average? Well ... by definition the world average is 100.

Average slashdotter IQ? As measured using a paper test that doesn't involve going out into the sunlight or successfully interacting with an available female? ... I'm thinking way high.

Re:It's just the anti-virus companies claiming tha

[ka9dgx]

That's true, but then again safety belts save lives in many cases regardless of the ones who refuse to use them.

Sweeney

[Anonymous Coward]

In other news:

Sweeney would like to know if you want to try a meat pie. They are very good.

Re:It's just the anti-virus companies claiming tha

[Kartoffel]

I don't know. Back in the day, IE for Solaris was a pretty decent alternative to Netscape.

Re:It's just the anti-virus companies claiming tha

[techno-vampire]

How about giving the user more choices? You might want to let them run it in a sandbox, or run it without internet access, or chroot it.

And how many users, pray tell, do you think would understand what those options are, or which one to pick for any given program. If your answer is > 1 %, you have a much higher opinion of the average computer user's understanding of what they're doing than I do.

Attention Mods! Parent is karma whoring

[an.echte.trilingue]

His posts have absolutely no coherence with the posts he is responding to. He is throwing in keywords that he knows will get him attention here on /. and I think using a sock puppet with mod points to give himself that all-important first plus to get the plus five.

Seriously:

It's like structured code vs assembler.... you can do the same thing in either, in theory. Sounds smart until you read the gp. Just throwing in the name of a couple programming languages is not insightful.

written in Redmond or somewhere else The GP never made a comparison between any two methods. This is just pandering to the "well, I like to use the software best for the job, closed source or not" crowd.

I realized the difference is subtle, but it's very important. Again, there was no comparison made in the GP

This guy is trying to game the system. Don't let him get away with it.

Re:Attention Mods! Parent is karma whoring

[ka9dgx]

I'm not trying to game the system... I hit the karma cap a few years ago, and really don't care about it. I do care very much about making a what is a subtle distinction a bit more clear.

I'm sorry if my writing wasn't up to snuf.

A lot of people will tell you that an Object Capability System can't do anything more than one based on Access Control Lists. This argument is much like the ones posed against Structured programming when it came out... the opponents to change all said "well.. it doesn't really do anything new"... and if you picked enough nits, you could technically say they were right, in terms of the expressiveness of the program.

However, in practice it's not just about the types of computation your code you can express, but rather the programmers productivity. Structured programming made it easier to get things done. It saved programmers time.

In theory, in an ACL based system, you can run a program inside of a sandbox. You first create a new account for a program to run inside of, and then lock down the permissions of the rest of the system to make it safe. This is a non-trival task, which must be done perfectly if your program you wish to run turns out to be malicious.

A capabilities based system is designed from the start to enforce a policy of least privilege. That means that a program should given only the capabilities it requires to execute the task at hand, and nothing more. To run a program in a "sandbox" requires no more action that only giving it a sandbox to play in, the system enforces the rest. Not only that, it makes it possible for an end user to decide what rights to give a program without having to check all of the rest of the system.

The lack of awareness of the Capability Object Model severely constrains the possible futures that can be imagined by most of us, and we're making bad choices because of that ignorance.

I'm just trying to shine some light into the darkness.

--Mike--

Re:What's the bad news?

[Anonymous Coward]

I'm not an expert but I thought that that was pretty much what SELinux and Apparmour did.

This is news?

[Anarke_Incarnate]

Every few years the malware comes out newer, shinier and costs about $100-400 depending on if you get the Home Basic or Ultimate versions.

It's beginning to look like...

[rickb928]

...this is the first step towards a 'solution':

SELinux
Firefox
???
Security for a while
Profit!
Repeat as necessary.

Windows is so blown up, security is pointless.

Better website design/security doesn't help. The nasties will create their own malware sites quicker than you can say 'globals off'. And detection in Windows is pretty much like your oil light on the car dash - 'you are hosed, just letting you know it's bad.'

I'm thinking my wife's next machine is running Kubuntu. Mine at home too. All I need is a way to feed my Windows-based MP3 player, some Windows Media Player replacement, and I'm gone.

Or a Mac. They have a few years before the kids target them.

Re:It's beginning to look like...

[Cywiro]

I'm thinking my wife's next machine is running Kubuntu Ah yes. I had one of those machines back in 1991. Until Tim came along and grabbed it to use as a server for his world wide whatever he called it.

Re:It's beginning to look like...

[rickb928]

Wow. I got this CD in a book back in '93 or '94. Had a program called Slackware. Really interesting. Something called 'kernel 0.91' was in it.

I wuz huked.

It was a couple of years later when I was down to the Novell branch that one of the guys shows me a web server running on his lab NetWare server. It was something he called NAMP.

I waz huked agin. Nobody else believed me. Then, they didn't care. Feh. Of course, I gave up on NetWare.

Funny the stuff we think is cool, new, or just plain fun.

Re:It's beginning to look like...

[visible.frylock]

If you haven't heard of it:
rockbox
Has somewhat limited compatibility though.

Re:It's just the anti-virus companies claiming tha

[adisakp]

How about giving the user more choices? You might want to let them run it in a sandbox, or run it without internet access, or chroot it.

If they had a way to express their intent, and actually control how much they give away when they click... it would go a VERY long way towards fixing things, probably 99%.

Have you ever tried Comodo's free firewall or free antivirus???

Both of them use whitelisting / safelists. Anything not whitelisted needs explicit permission from the user before they're able to read/write/delete/create a file or directory or access the internet. These two FREE (as in beer) products literally give you a similar level of control over what runs on your computer.

The Comodo antivirus doesn't work on Vista right now but will soon. Then again, this is Slashdot so we're all running XP right ?!?

For sandboxing, you can use VMWare Server (free as in beer) to generate an image to run in VMPlayer (also free as in beer) which you can then use within Windows. If you get VMWorkstation (not free but well worth it), you can get fine-grained control over snapshotting.

Not to sound like a dick

[pembo13]

But my Linux desktops and servers seem just fine. And I don't trust my WindowsXP laptop with important data. At some point, there needs to be personal responsibility. In the same way that I need to make sure that the brake pads on my vehicle are in good order, people need to make sure that their software, whatever they choose, is also in good order.

Re:It's just the anti-virus companies claiming tha

[Anonymous Coward]

.dll = .Framework, .bundle, .dylib,.so

How about a ring security model? ala Intel ISA?

[master_p]

The system runs at ring 0, the local applications at ring 1, the intranet applications at ring 2, the internet applications at ring 3. Thus no malware can do anything, unless there is a bug in the software interfaces between the rings.

Re:How about a ring security model? ala Intel ISA?

[ka9dgx]

Secure hardware is an essential foundation for a secure operating system, but secure hardware doesn't do anything useful if the OS is junk.

Re:How about a ring security model? ala Intel ISA?

[azgard]

Are you sure it will help? It would only be easy if the ring n would have read-only access to ring n-1. But the applications need to share data, so ring n-1 sometimes needs write access to ring n. So this simple idea would quickly turn into privilege maintenance nightmare.

Re:It's just the anti-virus companies claiming tha

[lgw]

Does it work with Windows Server 2003? Most XP products do, it they don't explicitly check that they're unning on XP.

Re:What's the bad news?

[lgw]

If all the Wonows user moved to Linux, then this would no longer be the nature of the community. One distro would rule them all and in the darkness bind them, and the spam would continue unabated.

Nothing about our industry makes sense any more

[bill_kress]

There are some very sane and easy ways to fight these things, and not a single entity (except perhaps tripwire which is out because of how hard it is to use/configure, and java which works pretty well in limited situations) even tries.

We need per-app permissions. This doesn't have to be obvious, but when you install an app, the system needs to pop up a box before a single line of code is run giving options that the software is asking for.

Net access, write to own directory, write to system directories, use APIs to interact with other program, take control of various devices such as the keyboard and screen, communicate over the internet to one host or to any host... The list could be quite long..

But the use would be simple--a box pops up and has checkboxes by the services it needs. I review this and possibly deselect some. It either installs or refuses because it can't run without the ones I deselect.

This seems obvious and not all that hard to implement (I mean, as in compared to as much work as going from XP to Vista, or creating OS X)...

The other thing that would fix a lot of these things--put a bounty on finding & solving new viruii and on hacking into systems.

If you were to "Register" people for these bounties, you could even include a clause that they can be monitored to ensure they aren't the ones creating a virus and that they don't do anything to hurt the public computers they are hacking.

Even something like finding a missing patch in a web server should be worth a few bucks--like a "Ticket". Charge the company $100, pass $50 on to the person finding it, use the other $50 to go towards virus bounties.

For a new flaw that gives access to a common, important device like a Cisco router, you charge the company $300,000 or so, give the finder $100,000, put 100k away and slap Cisco around for a while with the other $100k just for fun.

Another bounty for identifying and disassembling bot-nets. a $30 ticket for the botted computer (Just a warning, really), and a Major Award for the identity of the person running it. Then you take all the money that guy has on hand and split it between the fund and the finder.

This is no more extreme a concept than bounty hunters or the "Consultants" in Iraq...

Re:Nothing about our industry makes sense any more

[99BottlesOfBeerInMyF]

We need per-app permissions.

Agreed. We (sort of) have them. Vista, OS X, and Linux are all shipping with Application level access control frameworks, by default, these days. The problem is getting it applied and getting a workable UI and workflow.

This doesn't have to be obvious, but when you install an app, the system needs to pop up a box before a single line of code is run giving options that the software is asking for.

I think this is too cumbersome and too complex for the average user. Rather, I think we need to go further. Apps should ship with an ACL that specifies what it should need. Anti-malware companies and organizations should verify these and provide white lists and checksums. That way pre-installed and mainstream software will all run just fine without the user having to do anything. You can ask them about any applications missed by these whitelists, but while giving the user granular controls is great for power users, novice users should be given simpler templates for sandboxing apps and apps should be able to run in a very restricted sandbox without the user being bothered at all, only being asked if it wants to do something, like read/write existing files.

The other thing that would fix a lot of these things--put a bounty on finding & solving new viruii and on hacking into systems.

This may or may not be a good thing. Each OS vendor should have some serious people working on this though. Also, this is the kind of thing that users can help out with. There is no reason users should not be able to report suspicious software to the OS vendor for review/blacklisting.

Really, I think a lot of the problem here is one of motivation. Microsoft doesn't want to put any work in because malware probably nets them more sales than it loses them (people buying new computers with a new copy of Windows to replace their infected machine). Other OS vendors have motivation to keep users happy, but for the most part users don't have a malware problem yet, so haven't done the hard work of developing the GUI and adapting applications to be better behaved and more self contained (which MS could then copy).

Re:Nothing about our industry makes sense any more

[gujo-odori]

I agree with all of that WRT people who use computers and have at least some clue. However, most people with computers today are more like my wife. She's what I call "Willfully computer-stupid." She doesn' want to read a manual (for anything, not just computers) and finds even the most ridiculously obvious (to me) stuff to be hard. Googling the solution to a computer problem has never crossed her mind. She's the only person in my family who doesn't use Linux (even our 4 year old and 5 year old kids use Linux). And yet, for all that, some of her friends *ask her* for computer advice, because they're so computer-stupid they make her look like tech support. Your solutions only work for people like us. They don't work for people like my wife and her friends.

I don't know what the ultimate answer is, but I know it's not asking technical questions to ignorant people when software is installed.

Maybe arms race is a good thing

[jhoger]

Actually the arms race may be a GOOD thing. Viruses and spam could be the "key driver" the market needs to force progress on artificial intelligence.

Re:It's just the anti-virus companies claiming tha

[drspliff]

Will Comodo run in Wine? :)

Re:What's the bad news?

[Cajun Hell]

That doesn't help the situation. If windows goes away, the problem with just migrate to Linux.

It's true! Just a few minutes ago I was sorely tempted to type "sudo apt-get install shapeshiftvirus". If Linux gets more popular, it's just a matter of time until shapeshiftvirus gets ported to it. Then, assuming the virus is GPLed, Debian will enthusiastically put it into their repository. It'll trickle down to Ubuntu. When that happens, users all over the world are going to choose to install it, type in the installation command, and enter their password.

Re:It's just the anti-virus companies claiming tha

[zoips]

You should probably have that ego checked out; it might lead to your head spontaneously exploding if left unchecked.

Re:What's the bad news?

[Anonymous Coward]

Uh, you pretty much just described exactly how selinux works.

Re:It's just the anti-virus companies claiming tha

[Anonymous Coward]

I hear what you're saying ... Define the list of "good" software, not the "bad", but here's a monkey-wrench at you ...

Define "execute". Are you referring to files on disk being treated as executable code? What about cases where an authorized application is buffer overflowed and patched in RAM? Your suggestions won't stop that. What about code that is interpreted, such as scripts or macros? Noscript for FF is great and all (I'm using it right now), but how many sites are 100% broken when scripts are turned off? We see countless examples of scripts today that can automate delivering a browser exploit, overflowing/patching a valid running browser process' memory and running arbitrary code. Who cares if the browser is sandboxed if everything the attacker wants is already in the browser (e.g. credit card numbers, passwords, etc.)? Don't say "same origin policy" because: A) if the browser's pwned all bets are off, and B) modern web apps (and therefore modern web malware) throw objects from several different domains into a single page in the browser. HTTP & HTML were pretty much designed to defeat Same Origin Policy.

But I agree, it's a separation of code and data problem.

There is research on this area

[KeithIrwin]

It is definitely the case that metamorphic and polymorphic malware is becoming more commonplace, but there is research being done on how to characterize it and detect it. My friend Qinghua Zhang is finishing her PhD thesis on just this topic. There are lots of open research problems, but we shouldn't pretend that static signature matching is the only solution just because it is the most widely deployed one.

Re:It's just the anti-virus companies claiming tha

[Anonymous Coward]

Or, people can use a platform that is immune to these bugs. MacOS has never, in its history, been able to be exploited via a web browser, nor can it be.

Re:It's just the anti-virus companies claiming tha

[chunk08]

Then again, this is Slashdot so we're all running XP right ?!?

Umn, no. You will find a great deal more variety than that. So far, I've seen people say that they are reading /. using Solaris, BSD, Linux, Windows (98 onwards) and even an old HP-UX box with a graphical terminal. Browsers i've seen mentioned include Opera, Firefox, Netscape, and several others. (No one wants to admit to using IE).

Me? I use Ubuntu/Firefox.

Re:It's just the anti-virus companies claiming tha

[HisMother]

Ummmm... yeah. Way to miss the point.

Re:It's just the anti-virus companies claiming tha

[DarkEmpath]

I agree in principle, but why hasn't your proposal happened yet?

There are plenty of free anti-virus products around that require you to update with the latest signatures, so money is not the issue. (I know most "free" anti-virus products have a paid corporate version, but what about others such as Clam-AV?)

If people can write free and open office suites, development platforms, database applications, and even whole operating systems, why hasn't anyone written an anti-virus application such that you're proposing?

I'm not a programmer, but I'm guessing it's harder that it sounds.

Re:It's just the anti-virus companies claiming tha

[ozmanjusri]

You can remove it, but it's nasty.

We know it's nasty, that's why we want to remove it.

Re:It's just the anti-virus companies claiming tha

[ScreamingCactus]

Not so. Not with Vista anyway. That's precisely what I did, yet for some reason, from time to time IE randomly opens up to an ad page. AVG doesn't know why, AdAware, Windows Defender (joke), and other programs couldn't figure it out either. I think it started when I installed itunes and quicktime. The weirdest thing is, it seems to occur when they system *sees* certain files, like when explorer opens the folder they are in. I don't know what kind of files though. It's rare and inconsistent, so I can't trace the cause. But without the IE executable, this wouldn't be a problem. I thought about accessing the HD from another computer and replacing IE with another executable, but that would probably brick windows. Oh, the humanity!

Re:What's the bad news?

[Anonymous Coward]

Then everyone switches to Linux, and WE all get targeted!

Computer Immune Systems

[VoidEngineer]

What exactly is a "non rules-based monitoring process?" I thought I had some clue about security procedures, but I'm be hard pressed to describe what such a process might be. Even more importantly, what would it cost to implement? TFA is no help here, consisting of the usual hand-waving about the never-ending arms race between malware writers and the rest of us.

He's talking about computer immune systems. Here's a link to an IBM research paper from the top of the Google results for "virus immune system computers":

http://www.research.ibm.com/antivirus/SciPapers/Kephart/VB97/

The basic idea is that computers and viruses are so advanced, that it's time to implement immune systems. Instead of comparing one's system against a large list of fairly static virus signature rules, an immune system could evolve and build the "rule" dynamically as it encounters and interacts with the virus. The semantic ambiguity in the statement is that he's referring to a "rule" as a state-based virus signature. In a "non rules-based system", such as an immune system, there would be behavioral standards, such as "only send out traffic on one port at a time, and send it out consistently on the same port". There might also be structural standards (ie. digital signatures on executable code) or functional standards (i.e. return an application manifest upon request that can be compared to a reference site). If an application doesn't conform to the behavioral, structural, and functional standards, then the immune system has leeway to gobble it up and dispose of it. One might argue with his semantics, and claim that the behavioral, structural, and functional standards in an immune system are also 'rules'. The thinking behind computer immune systems, however, is more along the lines of activation networks and neural nets which implement behavior standards as functional evaluations of code performance, rather than lists of static state-based virus signatures (which are called 'rules' in the jargon).

Put another way, instead of having a long list of 'rules' such as "foo.exe is a virus" or "any file with signature xyz is a virus", there would be standards such as "a process should communicate consistently on the same port and not port hop" or "a file shouldn't try to access certain areas of OS memory if it doesn't have a certain type of application manifest registered to OS developers". Yes, you could call those 'rules' also. But that's not what he's referring to in the article. In the article, when he says 'rules', he's referring to state-based virus signatures. A "non rules-based monitoring process" wouldn't use state-based signatures; instead, it would monitor the behavior of code against performance standards.

(yes, a 'standard' might be considered a "rule", if you want to argue semantics. They just happen to be using the term 'rule' in a jargon-specific manner.)

Re:Computer Immune Systems

[yuna49]

Thanks to you and ratboy above for these excellent responses.

However aren't you both really talking about a solution whose implementation, if if ever happens, is decades into the future? We have hundreds of millions of computers in the world running operating systems and applications that represent the current state of technology. Wouldn't these approaches literally require all those computers switch to entirely new operating systems and applications than are installed today?

If so, I don't see this as a realistic approach to the problem for years to come.

Re:Computer Immune Systems

[VoidEngineer]

These things mostly exist in laboratories already. It's really just a question of distribution to the masses. And, I dare say, that companies like Norton and Symantec are already investing in these technologies. Before long, the copies of Norton 2010 or Symantec 2012 are going to include immune systems. If not 2010 or 2012, then some other date in the future. So, getting it to market and getting it to early adopters won't be that difficult. Getting it to the masses, however, will be a bit more complicated. Unfortunately, open source software tends not to come with any support agreements; so, the difficult part of the process is going to be working with the big vendors, particularly Microsoft and Apple, and to get immune system technologies included in the OS builds. In the end, it's already technically feasible. It's a question of corporate policies, market financing, and politics.

Personally, having watched the evolution of viruses, worms, botnets, firewalls, spam, filters, rootkits, and trojans over the past 15 or 20 years, I think we're about two or three years away from seeing immune systems widely distributed. Things need to get a little worse before people start taking action to change policies, but we're almost at that point, I think. IBM's "Digital Immune System for Cyberspace" project shows that the market is actively developing these systems, they already exist in the labs, and they've been designed with the marketplace and commercialization in mind. This makes me think that we're going to be seeing this technology all over the place soon. IBM is going to shoot for the enterprise mainframe market (as always), and companies like Norton and Symantec are going to go for the mass-consumer distribution. I suspect they're already competing to see who's going to be first to the market.

So, I don't think it's so much decades in the future, as three to five years in the future.

Re:Computer Immune Systems

[yuna49]

I guess I'm still a bit confused. You're saying these technologies could be bolted on to existing platforms in the way anti-virus programs are now? Won't they have to be supported by operating system and applications programmers as well? Even if they're included in the next generation of software, it'll take many years before that generation of software replaces the infrastructure we have now.

I'd also wonder what the user interface would look like. Popups that say "application X has tried to use port Z and has been disabled?" What's an uninformed user supposed to do in that case if they need to use application X? That's a lot different from saying "file Q has a virus; delete or quarantine?" False positives would also seem rather deadly in this case.

I'm not doubting any of what you report. I'm just trying to imagine how it might be applied to a global universe of computers running very disparate operating systems and collections of applications. I also suspect it's going to be very difficult to develop reporting and control interfaces that will be meaningful and useful to uninformed users. I remember how totally befuddled most people were when Windows firewall software started popping up those "program X has attempted to access the Internet" kind of warnings. I'd be shocked if most ordinary users chose any other response to such notices other than "Fine, go for it!"

I still think we're talking at least a decade before this might be the norm on even half the world's personal computers.

Re:Computer Immune Systems

[VoidEngineer]

Good questions. I would imagine that an immune system would be built as an application service layer. In of itself, that doesn't pose too many challenges, and is fairly straight forward. Getting the operating system support and application programming support can be provided by the developers who program the immune system in the first place, by conforming to the standards that vendors provide. If you wanted the immune system to be an application framework, which other applications could build on top of, then you would need to publish standards, get them adopted by vendors and committees, and that would take a much longer time.

I agree that the it takes many years for one generation of software to replace it's predecessor. It's a rather steady march, however. And, while it may be 5 or 10 years away, I see it as only one or two upgrades away. Unlike, say, exocortex software agents, quantum computing coprocessors, visual-cortex neural-interface, or superconducting mag-lev monorails; which, while they exist in the laboratory, are many more years away, I believe.

It's one of the benefits of modular object-oriented design. People have already built a lot of infrastructure to include and distribute anti-virus solutions. They'll continue using the Norton and Symantec application branding; will continue using an anti-virus layer; etc. They'll just recode the internals of the current anti-virus software in the next couple of upgrades, and add more application behavioral standards. I'm not sure the interface will change all that much; and if it does, there will probably be incremental steps. I would bed that, yes, there will be pop ups that say "Application X has been port-switching and communicating to servers we cannot get a security certificate from; application X has been sandboxed and marked for deletion. Would you like to look at the sandbox or continue with deletion?" I'll admit that coherent workflow and a good user interface will be important to the success of this technology. That being said, I don't think this is revolutionary, as much as it is evolutionary. They will leverage a lot of the existing sales, marketing, distribution, and technology infrastructure.

But to answer your question: I think that the internet is becoming something of an ecosystem of sorts. A lot of software is like plants and grass and trees and stuff; but some of it is being developed to behave like herbivores, carnivores, viruses, and the like. I think that the computer immune systems are going to gobble up and eat virus infected software, without much regard for the end user. If the application was infected and gobbled up, download a fresh copy (hopefully, virus free). That will be the way of things. When people are sick and tired of constantly worrying about zombie-botnets, invisible rootkits, keylogging worms, and backdoor trojans, they're going to say 'hell with it... yes, if it looks like an infection, kill it'. And the computer immune system is simply an extension of that mindset.

If you're interested in a Hugo and Locust award-winning book, which discusses some of these topics (amongst many others), check out accelerando, by Charles Stross. You can get the creative commons version here. The main character, Manx, uses a number of advanced technologies, ranging from software agents and reputation markets, to computer immune systems and AI neural nets. Very interesting read.

You may be right about a decade time frame, although I think it will be sooner. Things are speeding up.

AV is so dead to me

[istartedi]

I never run it. I've only been hacked a few times, and knew it almost right away. It's the ones you don't see that worry me; but if you can't see them, what makes you think the AV companies can see them? Before the AV companies will write signatures for them, somebody has to notice them, and if "noticing them" is automated, then that implies that polymorphism is not a problem--but it's common knowledge that it IS a problem for AV vendors. Besides, you have to *pay* for AV, and it slows your machine down. If you pay for AV and let it slow you, "the terrorists win".

I use XP; but I don't click on "dancing bunny" attachments. I have very tight controls (no Flash, no Javascript, etc.) on all except my trusted web sites (*.goole.com, etc.). I back up data if it really matters to me. If I'm doing nothing on the network and the router starts flashing, I immediately get suspicious and check my processes.

Granted, my approach towards security is not for everybody. I have to be more vigilant; but I don't pay the AV penalty in CPU cycles or $$$, and that suits me just fine.

What I'd really like to see is secure defaults for IE, exploits patched more quickly, and fewer web sites that want you to drop your pants and bend over from a security standpoint. Hint, hint: if your web site wants me to run ActiveX, I am going to go someplace else if I can.

Re:AV is so dead to me

[prshaw]

>> but I don't pay the AV penalty in CPU cycles or $$$

That is true, but you are paying the AV penalty in time and effort.

So part of the decision is what is the 'best' way for someone to pay the AV penalty.

So some it will be with time and effort and for others it will be with dollars and CPU cycles. Sadly for most of us it takes both to stay reasonable safe and secure.

I will say that I would find being 'hacked a few times' totally unacceptable and would find a better solution. If I was paying with $$$ I would change who I was paying, if I was paying with time and effort I would find a better way to spend my time checking. Something you are doing isn't working.

Re:AV is so dead to me

[istartedi]

Something you are doing isn't working

The first time was nimdA. It was an exploit that affected Outlook Express. AFAIK, it was one of those rare occasions when you didn't have to be looking at HTML mail, or execute an attachment. I don't use OE anymore. The other times have been before I got agressive with the Internet Explorer security settings. Now that I've clamped down, so far so good. So. It's a learning process, true; but I like it better than learning which AV products are good and bad.

Point taken--I still pay an AV penalty; but at least I don't pay it to cops who have an inherent conflict of interest in solving the problem.

Re:It's just the anti-virus companies claiming tha

[Sfing_ter]

And by WinNT you mean OS2/Warp right?

Re:What's the bad news?

[tuomoks]

I think you are right. Now, as in some systems I know they follow the rules, every initiation of a program or transaction is based on authorization of the initiator AND program/transaction (authentication is already done by default - the program is already starting). The execution rights, the database access on field level, the network access, etc are also based on same authorization. Might not help if the person granting the authorizations is totally clueless but might help when the OS asks the permissions for an unknown (to the user) program to access an unknown (to the user) node in network or asks if it is allowed to read your documents, overwrite or rename a program or a library, turn the microphone or the camera on, read or modify the register, to change to supervisory (sorry, root) access, to use a service, to create an executable, to install a hook, etc. If the warnings would be written in clear (and polite) language I think most users would think twice before allowing all that. And once one of the privileges would be disallowed, all the privileges could be taken away from that program or process.

Honestly, I think MS tried that with Vista but took shortcuts and didn't think the whole picture but did it in piecemeal - will not work, too many places, too many products, not very clear warnings, etc, the authorization functionality has to be deeper in OS, totally independent of any program or application. Linux may have an edge but even SELinux, etc are immature, too complicated for a "normal" user. OSX is friendlier but not perfect, needs something like Little Snitch and other add-ons for more control.

Re:It's just the anti-virus companies claiming tha

[Anonymous Coward]

The so called "Russian Business Network" offered $ 0.10 per infected user last year. Might be just 5 bucks per week for my small site, but in the end I must say that it has never been easier and more profitable to infect IT systems (and no, I didn't take the money). So you gaven them the compromised hosts for free?

Not so fast...

[Anonymous Coward]

Real-life is against your idea. If something is spreading, it will be leaving signatures everywhere. If it is dormant, then it is not spreading, it will be getting old hat, while also _waiting_ will only increase its chances of discovery.

ItÂs not all such doom and gloom, because real-life is against it, here as also in biology. Adding to that, security firms are actively injecting their sandboxes into the wild, to sample the stuff, making detection even easier for most of the stuff.

The only doom and gloom scenario is with inferior security systems such as Windows and Mac OS X (closed, proprietary systems that takes security as a second class citizen instead of a first priority one). Even in Linux, SE Linux, snort, AppArmour etc. are second-class projects, not covering entire distributions. ThatÂs why I call these *NIX-OSes server-OSes, because they fail so miseraby in all aspects on the desktop. They need to outclass Windows and OS X in every aspect, and security can be a top aspect, but not by lulling into the "no-virus" hype. Think encrypted memory and so on. WhoÂs working on that? Microsoft.

You should check your bias towards doom and gloom, because objective study needs to be without any bias. Yes, we can _never_ truly know, but you can quantify to what degree you donÂt know and take your chances. ThatÂs life..

Re:It's just the anti-virus companies claiming tha

[Missing_dc]

Awwww, did I insult your precious "Lost" or did someone simply piss in your frosted flakes this morning?
It's not an accurate reflection of my ego, it's an observation I made and continuously re-evaluate, secretly hoping that the world will spontaneously get smarter or the general public will suddenly die off but fail to take us with them.

Damn, I guess you are still here, maybe we'll have better luck tomorrow.

Re:It's just the anti-virus companies claiming tha

[TheRaven64]

How about giving the user more choices? You might want to let them run it in a sandbox, or run it without internet access, or chroot it.

Right idea, wrong UI. Let it run, by default, in a severely restricted environment - no access to the network (other than possibly one remote address, which is the site from which it was originally downloaded). No ability to access the filesystem outside a private, per-application component. If a process needs more than this, then pop up an irritating box asking for elevated permissions and remember the setting. Make the box look scary so the default response is to click 'no' (and if this happens let the app keep running, but with parts that depend on the elevated privilege fail).

Also, put the warnings in plain English (or whatever the locale is set to). Something like this: "Application %s wants to be able to access your documents. Some applications may need to do this in order to open documents created with other applications, but malicious programs might gain access to your personal data."

If the user wants to download and play a random game, then it can work fine without accessing their documents and (in many cases) without connecting to the Internet. Give an option for an installer to pop up a permissions box for a different application, so users get used to the idea that, for well-behaved applications, the permissions will be set correctly at install time and the correct thing to do when a runtime privilege escalation box appears is almost always to click deny. If the user chooses to suppress the display of these boxes, make the default action deny.

The Java security model is nice from a systems perspective. It lets you allow and deny all sorts of things in a very fine-grained way, but it also lets you reference named policies. If a system included a sensible set of default policies (with sensible names) then an installer could simply request one of these and the user could make an informed decision. If your game is requesting the 'Privileged Network Server' policy instead of the 'Multiplayer Game' policy then you know something is wrong.

Re:It's just the anti-virus companies claiming tha

[Ed Avis]

There's no way to solve the issue of some idiot clicking on everything and putting in the root password whenever asked.

There is. Just don't give that idiot the root password.

Re:It's just the anti-virus companies claiming tha

[AmiMoJo]

You can do this quite easily on Windows.

Start->Run... "gpedit.msc" -> Windows Settings -> Security Settings -> Software Restriction Policies. If there is nothing in there create a new policy, then under Addition Rules create a path rule for your data and download folders. It then becomes impossible to execute anything in these directories.

Locking the OS files and registry is as simple as running as a normal user account instead of admin.

beats AARD by 2 years

[Anonymous Coward]

That beats AARD by two years.

Re:What's the bad news?

[The -e**(i*pi)]

I had a server that ran Windows for a year with no AV or anything and I was not even that careful with it, I would browse the web occasionally and install stuff.
It had ZERO viruses after over a year.
I don't think geeks have anything to worry about viruses if you are careful.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:It's just the anti-virus companies claiming tha

[adisakp]

I meant running XP compared to Vista. Heck if we were talking Solaris, BSD, Linux, etc. we wouldn't be having a discussion on the fact that most major commercial antivirus companies sell a product that is essentially a glorified binary grep.

Legislation is the answer

[StikyPad]

Clearly the solution is to follow Zimbabwe's lead by outlawing shape-shifting.