Slashdot Mirror

← Back to Stories (view on slashdot.org)

New Malware Report Hits Vista's Security Image

Posted by kdawson on from the cracks-in-the-armor dept.

An anonymous reader recommends a Computerworld article on a new report from Australian security vendor PC Tools. The company released figures on malware detection by its ThreatFire product, and in its user base 27% of Vista machines were compromised by at least one instance of malware. From the article: "In total, Vista suffered 121,380 instances of malware from its 190,000 user base, a rate of malware detection per system [that] is proportionally lower than that of XP, which saw 1,319,144 malware infections from a user base of 1,297,828 machines, but it indicates a problem that is worse than Microsoft has been admitting to." Microsoft hasn't responded yet to this report.

39 of 258 comments (clear)

  1. What kind of malware? by J_DarkElf · · Score: 5, Insightful

    Malware is not defined anywhere in the article. I know from experience that some "malware" scanners tend to mark even cookies (such as Doubleclick's) as malware, which will appear on any computer.
    I would also like to see how many of these "infected" computers had UAC and automated updates turned off.

    Looks like just another Vista bashing article (so it will no doubt be really popular here).

    1. Re:What kind of malware? by Dwedit · · Score: 4, Interesting

      How about Wild Tangent bundled games that come with many PCs? Those trip up the spyware detectors too.

    2. Re:What kind of malware? by Skrynesaver · · Score: 4, Informative

      Malware is not defined anywhere in the article. While incomplete it did say that:

      PC Tools has publicized details of some of the malware types it has found on Vista systems during its scans, including three pages of variants based on Trojan.Agent, a few of which were described as serious. Not a definition of what they classed as malware, but 3 pages of Trojans would seem to indicate that they found something, no?
      --
      "Linux is for noobs"-The new MS fud strategy
    3. Re:What kind of malware? by nozzo · · Score: 5, Interesting

      Yeah this is an extremely valid point. My Vista PC had 100's of 'malware' items on, all were tracking cookies. So from that someone extrapolates Vista has poor security. sheesh.

    4. Re:What kind of malware? by Tim+C · · Score: 4, Insightful

      He didn't say that they didn't find anything, he was merely wondering if there were any details as to what exactly they did find.

      He's entirely correct about the tracking cookie thing, every malware scanner I've used (apart from Windows Defender, I *think*) flags cookies as malware. My ex's new Vista laptop came with Norton pre-installed, and it flags a tracking cookie every time it runs (and only the cookie - so her laptop would possibly contribute to the report's number, despite being clean)

      --
      It's official. Most of you are morons.
    5. Re:What kind of malware? by setagllib · · Score: 4, Interesting

      Because Wild Tangent is spyware.

      --
      Sam ty sig.
    6. Re:What kind of malware? by Jesus_666 · · Score: 3, Interesting

      Spyware that's hard to defend against. Trojan-style malware doesn't need security flaws to enter the system, thus Vista's new security features won't help much against it.

      --
      USE HOT GRITS WITH STATUE OF NATALIE PORTMAN (NAKED AND PETRIFIED)
    7. Re:What kind of malware? by LO0G · · Score: 4, Insightful

      The big thing I found missing from the article is how the machine got infected.

      If I download and install the cool icons for my IM client and malware comes along for the ride, is it Vista's fault that it allowed me to install it?

      As far as I know, all MSFT has claimed is that Vista is more secure than XP, not that it is immune from malware.

      There's nothing that an OS vendor can do to protect the user from their own actions.

    8. Re:What kind of malware? by nschubach · · Score: 4, Funny

      Slightly off topic, but your post reminded me of Dilbert today: http://www.dilbert.com/fast/2008-05-20/

      Not saying there's a correlation to be made...

      --
      Every time I start to have faith in humanity, I ruin it by driving to work between 7 and 8 am.
    9. Re:What kind of malware? by BadAnalogyGuy · · Score: 4, Insightful

      it is immune from malware

      This is key. Any OS which can run 3rd party code is vulnerable to malware. Whether the damage is restricted to the single running user or can damage anything the OS allows it to, software written for the express purpose of breaking something will work correctly given the right privileges.

      So it doesn't matter if you're on Mac, Windows, or Unix, if you run code that is intent on deleting something and you give it the right permissions, it will do it.

      There are various levels of protection you can offer here.

      0. Let the malicious code run wild without any permission barriers
      1. Run the malicious code as root
      2. Run the malicious code as current user
      3. Run the malicious code as special unprivileged user
      4. Run the malicious code for privileged APIs and stop the malicious code on unprivileged APIs
      5. Run the malicious code in a sandbox
      6. Run only "signed" code
      7. Do not run non-preinstalled software

      As the levels go higher, the more hassle it is for users to install new software. Obviously we don't want to go back to DOS and level 0. And we've seen what happens when we run with level 1 restrictions. Running code at level 2 is a possibility, but it also leaves the user open to localized damage, specifically damage to their own accounts and data.

      Microsoft decided that for their systems, a compromise between level 2 and level 1 was necessary. And in order to do anything to the system as a whole, UAC was implemented to request a means to elevate user privileges temporarily.

      It's an ugly, annoying dialog, but what is the alternative? If you (the general 'you') think that another system does this better, in what ways specifically do you feel the system provides an adequate amount of protection and flexibility?

    10. Re:What kind of malware? by Dekortage · · Score: 3, Informative

      To quote TFA:

      "It is important to highlight that all systems used in the research pool were at the very least running PC Tool's ThreatFire and that because the technology is behavioral-based, the data refers to threats that actually executed and triggered our behavioral detection on the client machine", said PC Tools' CEO, Simon Clausen.

      I don't use ThreatFire, but "behavioral-based" and "threats that actually executed" doesn't sound like a cookie. They could mean it, but it doesn't sound like it.

      --
      $nice = $webHosting + $domainNames + $sslCerts
    11. Re:What kind of malware? by sm62704 · · Score: 4, Interesting

      If these games are spyware and are bundled with the computer, then your computer itself is malware.

      Computing must be based on trust unless you have your own chip factory, and even then you have to trust your employees.

      If you buy a Dell with Linux on it, Dell can preinstall any rootkits they want and there's no way anyone could find them. You would have to boot from a CD or floppy and repartition the drives and reinstall the OS. Hell, they could install a hardware rootkit and even that wouldn't work.

      I'm glad I build my own PCs. I'm going back to vaccuum tubes. Where's my tinfoil hat?

      --
      mcgrew's razor: Never attribute to stupidity that which can be explained by greedy self-interest
    12. Re:What kind of malware? by Blakey+Rat · · Score: 3, Insightful

      I think we all agree about that.

      But the point is, if HP puts it there when you buy the computer (and yes I'm calling out HP by name: my HP laptop had orders of magnitude more of that shit installed than any Dell I've ever bought), the user's not going to remove it unless they're pretty technical. And technical users probably aren't running this anti-spyware tool, anyway. So suddenly every single HP PC sold it marked as having spyware, giving their numbers a huge boost.

      Of course it complicates things, seeing as Wild Tangent is actually spyware. But you can't necessarily blame the user for it being on there, and you certainly can't blame Microsoft if their OEMs pre-load spyware on the machines. In this case, it would say absolutely nothing about Windows security, since the OEM purposefully bypassed the security to load it on.

      (Microsoft could try a campaign to get more control over what software is shipped with Windows computers, and then you could watch Slashdot go crazy about how evil they are. It's a no-win for them.)

      P.S. Why the hell is HP still in business? Their computers are loaded to the gills with so much crap that they take 3 hours to boot the first time (I wish that was an exaggeration!). And when you put in the Windows CD to restore a clean system, HP slipstreamed the crap on the Windows CD too! And these guys are selling more computers than Dell? Do customers just like abuse?

      --
      Comment of the year
    13. Re:What kind of malware? by Necrobruiser · · Score: 4, Funny

      ...Vista's new security features won't help much against it.
      Why is it that only malware writers can write software that is Vista compatible?
      --
      "I planned within my means and got a fixed rate mortgage, so where's MY bailout?" -cafepress
    14. Re:What kind of malware? by D+Ninja · · Score: 4, Insightful

      Do customers just like abuse? No. The customers just don't know any better.
    15. Re:What kind of malware? by T.E.D. · · Score: 3, Interesting

      Trojan-style malware doesn't need security flaws to enter the system, thus Vista's new security features won't help much against it.


      Actually, I got Vista specificaly to stop that kind of malware, and its worked like a champ.

      See, I'm generally sharp enough not to put malware on my own system. The problem is that my kids use the computer while I'm at work, and they like to install "free" stuff they find online. Since you can't do a damn thing in XP w/o running as admin, there was no stopping this.

      With Vista UAC you can run as an unprivelged user. If a program wants to install something, it will prompt for the admin password. If its me and I really want that install to happen, I enter the admin password and it proceeds as normal. If its one of my kids running, they call me at work begging for the password, and I tell them to go jump in a lake.
  2. I don't think this article will be popular by patio11 · · Score: 5, Funny

    After all, the survey missed classifying Vista as malware -- how accurate could it possibly be?

    --
    Help poke pirates in the eyepatch, arr.
  3. Re:the problem is combining ... by J_DarkElf · · Score: 5, Informative

    No need to slam Vista (or Windows in general) -- the problem is combining a dumb user with /any/ OS he can get admin rights on.

    No matter how good your antivirus/antispyware/OS, once an idiot user figures out that by closing a certain app or clicking "yes" somewhere he can run the funny application he got by e-mail, he will do so, and the system is potentially infected.

  4. PR != Security by pla · · Score: 4, Insightful

    New Malware Report Hits Vista's Security Image

    Come again? Does anyone but Microsoft actually believe Vista has an "image" of better security?

    Vista has one and only one major security-impacting feature - The "Train users to always click yes" interface to privilege escalation. And I feel confident saying that very, very few of us consider that a "good" thing.

    1. Re:PR != Security by Kalriath · · Score: 5, Informative

      Vista has one and only one major security-impacting feature - The "Train users to always click yes" interface to privilege escalation. And I feel confident saying that very, very few
      of us consider that a "good" thing. Get users on Linux, and we'll be seeing the "Train users to always click yes (or in CLI mode, prefix with "sudo") approach to privilege escalation"

      Wait, that sounds familiar. Oh, wow! Both my post and yours are virtually identical!

      Seriously, people bash UAC, but it's pretty much identical to sudo.
      --
      For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
    2. Re:PR != Security by dhavleak · · Score: 4, Insightful

      Seriously, people bash UAC, but it's pretty much identical to sudo. In fact, I can think of a scenario in which UAC is actually better than sudo:

      In a social engineering attack where you download some program (malware) and run it -- the malware could spoof a UAC prompt -- if you are foolish enough to click "Allow", well, nothing really happens because the program didn't get elevated privileges (since it was a fake UAC prompt). In the sudo case, the equivalent level of foolishness has you entering your password instead of merely clicking "Allow". Result is that the malware has your password now, so it's basically Game Over.

      Of course, this is probably a moot point because a better social engineering attack would actually do something causing a genuine UAC prompt (instead of bothering to spoof it). The level of foolishness required to click "Allow" is probably the same in both cases.

      I guess where UAC becomes valuable is when an attacker has managed to exploit a hole, to execute code remotely without requiring you to fall foul of a social engineering attack. This way you know you haven't done anything to deserve the UAC prompt that just popped up, so you know that you should click "Deny" here. This might still fail to protect users that have absolutely no clue, but honestly they shouldn't be running an admin account anyway (and hence should not be able to elevate a process).

    3. Re:PR != Security by JasterBobaMereel · · Score: 4, Interesting

      Users should be prevented from installing programs blindly - Full stop

      Users should be informed the program is trying to run as an admin and so has been killed

      Users should ask to install a program, be asked for admin password to continue and then go ahead without repeated warnings ....!

      Asking for permission to do something means the program was not installed properly (when installed it should request all permissions it will need), or should not be doing it

      Windows Vista does all the wrong things
          Prompts for permission on both installed and uninstalled programs repeatedly
          treats an install the same as running a program

      Linux/OSX are not perfect but seem to have got the balance more correct (mainly due to a legacy of doing the right thing and so not having to support user programs that assume full admin rights)

      --
      Puteulanus fenestra mortis
    4. Re:PR != Security by pla · · Score: 5, Insightful

      Seriously, people bash UAC, but it's pretty much identical to sudo.

      Key difference - Using sudo represents an active request by the user for privilege escalation. Telling UAC to continue approves apassive request that the user might not actually have made (or known they made). When enough of them pop up at random times, it conditions the user to just say okay to make it go away - By comparison, no one would ever just randomly sudo a command for the hell of it.

  5. Wait a moment... by hyperz69 · · Score: 5, Funny

    Vista Had a Positive Security Image?

  6. Re:Self-selection bias? by joelstobart · · Score: 5, Informative
    Seriously,

    27% of all the machines were owned by a marketing company. Its sunk in.

    Sudo copied Windows - hmmmm ... "Sudo was originally written by Bob Coggeshall and Cliff Spencer "around 1980" at the Department of Computer Science at SUNY/Buffalo".

    As for the virus remark - Its more difficult to write Linux viruses. User level permissions are more rigorous. The browsers don't have ActiveX. People who use Linux tend to know what a firewall is; and don't click yes in reply to "would you like to install" dialogues so much.

  7. Re:the problem is combining ... by NickFortune · · Score: 4, Insightful

    No need to slam Vista (or Windows in general) -- the problem is combining a dumb user with /any/ OS he can get admin rights on.

    I don't think that works as an excuse for Microsoft.

    The trouble with that Windows is supposed to be the operating system of the common man. At least, every time Linux gets a cool feature, the Redmond apologists start roll out their hypothetical Joe Sixpacks and Great Aunt Mildreds and tell us how these ordinary people can never cope with Linux, but windows, focus-grouped to death as it is, has been designed for these exemplars of non-geekiness, and is therefore superior.

    But that makes it kind of hard to blame bad security on the users. Windows is supposed to be designed with the click-on-the-dancing-monkey demographic in mind. They can't really throw their hands in the air and say "it's not us, it's the stupid users" without admitting that, really, they haven't a clue how to make a secure operating system.

    --
    Don't let THEM immanentize the Eschaton!
  8. They would, wouldn't they? by Harold+Halloway · · Score: 4, Insightful

    Why might "Australian security vendor PC Tools" claim this? Could they have a vested interest in saying this?

  9. Consider the source by Gadget_Guy · · Score: 5, Insightful

    So a company that sells security software puts out a press release to say that you still need to buy their software even if you run Vista. I can't think of a single ulterior motive that they might have to do this!

    How many of the anti-virus companies don't issue doom-and-gloom style press releases? It is just their way of drumming up business. I would rely on these figures as much as I would rely of Microsoft's "research" that might suggest that Vista is completely immune to any security issue. The truth lies somewhere in between - which shouldn't surprise anybody.

    And before anyone jumps down my throat, no Microsoft didn't says Vista was that perfect.

  10. technical limitation by CarpetShark · · Score: 5, Funny

    After all, the survey missed classifying Vista as malware -- how accurate could it possibly be?


    This was my first thought too. But then I realised that they've obviously omitted that fact on purpose, to solve an infinite recursion paradox:

    Vista is malware
    Vista can host malware
    Therefore vista is self-hosting

    Vista is unstable
    Therefore, vista can't host a stable OS
    Therefore Vista can't host itse..

    Oh, never mind. It works out just fine.

    1. Re:technical limitation by CarpetShark · · Score: 3, Funny

      Don't be lazy: do your own research. Just press a few keys, then refer to the blue screen.

  11. Re:Windows is basically a wrong architecture by Anonymous Coward · · Score: 3, Insightful

    Blaming the user for running as Administrator and exposing loopholes is like blaming the car driver for driving with the windows down.

    Some other commenter pointed out that being trained to clicking "Yes" was comparable to running everything as super doer. Rightly so. Do you know how tremendously difficult it is to convince Peter average user to have strong passwords, to keep user accounts and administrative accounts separate, and so on? As soon as he finds out how to run programs with administrative privileges, he'll stick to this new "freedom".

    By Design Windows is flawed.

    So is any other OS with an UI, because they require a user. The user is the problem.

    One should not need UAC to install software, and the registry concept should be thrown out.

    While I agree, I do this because I think an operating system should have user accounts with no rights to install anything, and an administrative account without any GUI. Please explain Peter average user he has to use CLI to install/uninstall software. (This works with my Peters, because I manage their Linux workstations for free. But it won't work with most users.)

    It will be great if Windows adopted Linux [kernel] as a base and bolted WINE as a backward way to run Windows Apps and Games.

    But still, the user has to install software on the system. Unfortunately, he wants to do so without any hassle.

  12. Comment removed by account_deleted · · Score: 5, Interesting

    Comment removed based on user account deletion

  13. Big Impact on Opinions by FurtiveGlancer · · Score: 3, Insightful

    Instead of "obnoxious security" as highlighted by the apple commercial, now we have "less effective than advertised obnoxious security that's still better than XP."

    Can we possibly bring ourselves to acknowledge that M$ actually brought about an improvement in PC security? It shouldn't hurt too much since it appears to be verifiable.

    --
    Invenio via vel creo
  14. huh? by Peter_The_Linux_Nerd · · Score: 4, Funny

    "New Malware Report Hits Vista's Security Image" -- Vista had a security image?

  15. Solutions? by cluge · · Score: 4, Funny

    27% of Vista machines were compromised

    This is indeed troubling (notice position of tongue and cheek). How can we fix this? I propose a five step program

    5. Electro shock all users the click "install now" without thinking
    4. Remove the fingers of users that follow the links on penis enlargement spam
    3. Publicly flog all users that attempt to install that "special media player" to get to "free p0rn" from a any site in the former communist block.
    2. Revoke all credit card, debit card, home depot card and sears charge cards for those that purchase a fake Rolex based on an email they got
    1. Remove any and all computers from folks that say "My computers running slow, you know about computers, can you look at mine"

    Respectfully,
    Cluge

    PS - A more meaningful less painful solution would be an OS lock down - IE think a live image distro where the Hard Drive is only used to store user data. Every reboot takes you back to square one - a heavily locked down environment with basic abilities allowed, but little else.

    --
    "Science is about ego as much as it is about discovery and truth " - I said it, so sue me.
  16. Vista and UAC .. by rs232 · · Score: 4, Interesting

    "Vista suffered 121,380 instances of malware"

    I thought Vista with UAC didn't get malware. Didn't Allchin say Vista didn't need any anti-virus software.

    --
    davecb5620@gmail.com
  17. Re:100% of Vista machines affected with malware by OhPlz · · Score: 4, Insightful

    I've used Vista since it was in beta. The DRM hasn't stopped me from doing anything. The only software I use that does get in my way is Apple's iTunes. But we can't hate on Apple, /. loves Apple because it's not MS. That's why /. can never be taken seriously. It's a humor site.

  18. Re:the problem is combining ... by j79zlr · · Score: 3, Insightful

    The fact of the matter is that Microsoft is king because Linux software isn't even there yet when it comes to quality. Whenever you have new hardware you probably can't even use linux because the drivers haven't come out yet or are beta and/or a bitch to install. So I take it you haven't used Vista then? My scanner doesn't have working Vista drivers, it works in XP and Linux just fine. When Vista decided that my network is "local only" with no way to resolve it, I removed Vista and haven't looked back. You can argue some positive points with respect to Vista, but quality and driver support are not two of them.
    --
    I'm not not licking toads.
  19. And that, my friends... by patio11 · · Score: 5, Insightful

    ... is a +5, "Telling Slashdot what it likes to hear" moderation.

    -- Posted from my Vista machine ;)

    --
    Help poke pirates in the eyepatch, arr.