Slashdot Mirror
New Malware Report Hits Vista's Security Image
An anonymous reader recommends a Computerworld article on a new report from Australian security vendor PC Tools. The company released figures on malware detection by its ThreatFire product, and in its user base 27% of Vista machines were compromised by at least one instance of malware. From the article: "In total, Vista suffered 121,380 instances of malware from its 190,000 user base, a rate of malware detection per system [that] is proportionally lower than that of XP, which saw 1,319,144 malware infections from a user base of 1,297,828 machines, but it indicates a problem that is worse than Microsoft has been admitting to." Microsoft hasn't responded yet to this report.
Malware is not defined anywhere in the article. I know from experience that some "malware" scanners tend to mark even cookies (such as Doubleclick's) as malware, which will appear on any computer.
I would also like to see how many of these "infected" computers had UAC and automated updates turned off.
Looks like just another Vista bashing article (so it will no doubt be really popular here).
New Malware Report Hits Vista's Security Image
Come again? Does anyone but Microsoft actually believe Vista has an "image" of better security?
Vista has one and only one major security-impacting feature - The "Train users to always click yes" interface to privilege escalation. And I feel confident saying that very, very few of us consider that a "good" thing.
I don't think that works as an excuse for Microsoft.
The trouble with that Windows is supposed to be the operating system of the common man. At least, every time Linux gets a cool feature, the Redmond apologists start roll out their hypothetical Joe Sixpacks and Great Aunt Mildreds and tell us how these ordinary people can never cope with Linux, but windows, focus-grouped to death as it is, has been designed for these exemplars of non-geekiness, and is therefore superior.
But that makes it kind of hard to blame bad security on the users. Windows is supposed to be designed with the click-on-the-dancing-monkey demographic in mind. They can't really throw their hands in the air and say "it's not us, it's the stupid users" without admitting that, really, they haven't a clue how to make a secure operating system.
Don't let THEM immanentize the Eschaton!
Why might "Australian security vendor PC Tools" claim this? Could they have a vested interest in saying this?
So a company that sells security software puts out a press release to say that you still need to buy their software even if you run Vista. I can't think of a single ulterior motive that they might have to do this!
How many of the anti-virus companies don't issue doom-and-gloom style press releases? It is just their way of drumming up business. I would rely on these figures as much as I would rely of Microsoft's "research" that might suggest that Vista is completely immune to any security issue. The truth lies somewhere in between - which shouldn't surprise anybody.
And before anyone jumps down my throat, no Microsoft didn't says Vista was that perfect.
Some other commenter pointed out that being trained to clicking "Yes" was comparable to running everything as super doer. Rightly so. Do you know how tremendously difficult it is to convince Peter average user to have strong passwords, to keep user accounts and administrative accounts separate, and so on? As soon as he finds out how to run programs with administrative privileges, he'll stick to this new "freedom".
So is any other OS with an UI, because they require a user. The user is the problem.
While I agree, I do this because I think an operating system should have user accounts with no rights to install anything, and an administrative account without any GUI. Please explain Peter average user he has to use CLI to install/uninstall software. (This works with my Peters, because I manage their Linux workstations for free. But it won't work with most users.)
But still, the user has to install software on the system. Unfortunately, he wants to do so without any hassle.
Instead of "obnoxious security" as highlighted by the apple commercial, now we have "less effective than advertised obnoxious security that's still better than XP."
Can we possibly bring ourselves to acknowledge that M$ actually brought about an improvement in PC security? It shouldn't hurt too much since it appears to be verifiable.
Invenio via vel creo
I expect Twitter to come rushing out with one of his many sockpuppet accounts and attack you at any moment! How dare you cloud a perfectly good Vista bashing with a few facts! Shame on you!
Vista isn't great and was overhyped, but it's not nearly as bad as most people here seem to think. I'd hazard that the loudest critics haven't even used it.
I've purposedly ran some shady programs, with antivirus disabled on Vista. No WAU prompt, nothing. Yet, my PC was infected and had processes running. It was even harder to clean out then simular virii in XP.
Al these prompts and other crap, it's useless. It's just to "make you feel secure" and "annoy the hell out of you". Effectiveness is ZERO.
... a mile away.
I'm a windows savvy user, and I've never had problems with viruses or malware, mostly because I know when to make sure what I'm about to run isn't malware.
That means I know generally what's already in my computer, and when I'm about to install or run something new, I either know it's from a legitimate source, and thus don't worry about it, or I scan the file before using it.
that's why I applaud things like the firefox virusscanner, it's actually combating the risk of infection at the point-of-entry rather than scanning everything all the time, over and over and over again, and hogging your resources while it's at it. In this regard, current virus software only helps when you've already gotten a virus and you need to clean it, which in my opinion is too late. the solution should be at the point of entry.
It's also why I hate UAC, UAC doesn't help people to understand where the point of entry of malware is, and it only teaches people to click yes to everything, or to google how to disable it.
I've used Vista since it was in beta. The DRM hasn't stopped me from doing anything. The only software I use that does get in my way is Apple's iTunes. But we can't hate on Apple, /. loves Apple because it's not MS. That's why /. can never be taken seriously. It's a humor site.
I'm not not licking toads.
... is a +5, "Telling Slashdot what it likes to hear" moderation.
;)
-- Posted from my Vista machine
Help poke pirates in the eyepatch, arr.
Windows has never been nor never will be designed for the "common man". The entire Windows experience is designed entirely to be put on corporate networks. It's designed to be set up and maintained by a geek. The corporate market is the base of income for Microsoft. The users are non-technical, so there are attempts at "ease of use", but when it comes down to it, features make it into Windows because the corporate market is moving in that direction. Every now and then home users get features too, but they account for such a small amount of computer purchases that Microsoft can ignore them and rely on the network effect to force them to use Windows at home.
Linux suffers the same kind of mentality, but in a difference direction. Desktop Linux is designed for it's user base, which is programmers, network admins, and more technically inclined users. They find, on the whole, "Linux" (insert favorite distribution here) to be on par with Windows. From their point of view, they are right. My mother would highly disagree. When it comes to generic operating system environments, Linux has a STRONG advantage. The level of customization possible due to the availability of the source has allowed manufactures to created smaller integrated products that are easy to use, but generally trade a degree of functionality for that (Nokia and Asus come immediately to mind)
OS X is designed for environments where administration cost is a very big concern and for people doing design work. On the whole, Apple ignores a large part of the development community and relies on making tools that encourage specific practices. This is done under the philosophy that any developer that wants more Windows like dev environment will just end up messing up OS X, via the user and this will reflect poorly on Apple. Hence their reportedly large market share on the home user market, "it just works" when compared to its competitors is a valid comparison. Because of how they treat developers, their market will never grow outside of it's established core base.
Burn Hollywood Burn
I don't know that it was a troll. There are a lot of people (myself, included) who think that a large part of Window's malware comes from trojans. Between the Windows firewall/NAT (helping to prevent worms from spreading) and Windows Update being on by default (somewhat mitigating exploits in Internet Explorer), non-trojan malware infections are really dropping. They're still there--from people who don't upgrade, who have older systems, etc. but they're decreasing. What's left is trojans and pre-installed malware.
But people continuously slam Windows for being insecure while touting OS X and Linux as secure alternatives. Secure? Sure, the code is good and secure, but there's no patch for gullibility.
I suggest the possibility that there are simply other factors that account for the almost total lack of malware on these systems.
First and foremost (and to get it out of the way, because it's so commonly presented) is the market share--virus writers want their viruses to run, so they target the largest markets.
Second is user education. Even with Ubuntu bringing Linux to the common man, the vast majority of Linux users are more knowledgeable about computers, and will not be as likely to fall for trojan traps. While the same cannot necessarily be said about OS X, both Linux and OS X have a history of better security architecture, which means that most operations do not require any sort of administrative access. While malware can run without administrative access, it's much harder to hide. Antivirus running as administrator will easily detect malware running as a user, and because of the history of these two operating systems (not needing administrative privileges that often) it's going to be harder to trick the user into giving up his password. That's not to say that it's impossible--and certainly there isn't a push to use antivirus on these systems anyway, but it would ultimately be a losing battle for malware authors even if the marketshare situation were different.
The upshot of all of this is that I think that if some magic happened and all Windows installations were turned into Linux installations overnight, malware authors would start targeting Linux, and the new (and largely uneducated) Linux users would fall prey just as easily, despite what OS X and Linux fans would have you believe (that somehow using the OS inherently makes you more secure.)
Of course, I'll probably be modded down into oblivion, as a troll, or flamebait, or just as overrated, but I've never seen someone post a valid counter-argument to this type of post.