Slashdot Mirror
Security Threats 3 Levels Beyond Kernel Rootkits
GhostX9 writes "Tom's Hardware has a long interview with security expert Joanna Rutkowska (which is unfortunately split over 9 pages). Many think that kernel rootkits are the most dangerous attacks, but Joanna and her team have been studying exploits beyond Ring 0 for some years. Joanna is most well known for the BluePill virtualization attack (Ring -1) and in this interview she chats a little bit about Ring -2 and Ring -3 attacks that go beyond kernel rootkits. What's surprising is how robust the classic BluePill proof-of-concept is: 'Many people tried to prove that BluePill is "detectable" by writing various virtualization detectors (but not BluePill detectors). They simply assumed that if we detect a virtualization being used, this means that we are "under" BluePill. This assumption was made because there were no products using hardware virtualization a few years ago. Needless to say, if we followed this way of reasoning, we might similarly say that if an executable makes network connections, then it must surely be a botnet.'" Rutkowska says that for her own security, "I don't use any A/V product on any of my machines (including all the virtual machines). I don't see how an A/V program could offer any increased security over the quite-reasonable-setup I already deployed with the help of virtualization." She runs three separate virtual machines, designated Red, Yellow, and Green, each running a separate browser and used for increasingly sensitive tasks.
i was gonna write something about [o]ver[k]ill but I'm not in the mood anymore. 3 VMs??? ahahahahahahahhahahahha ROFL ahahahahhahahahah (sorry, I can't help it) .. ahahahahahhahahaha
* burn karma, burn *
mov ax,4c00h
int 21h
I don't use any A/V product on any of my machines (including all the virtual machines). I don't see how an A/V program could offer any increased security over the quite-reasonable-setup I already deployed with the help of virtualization.
This seems a touch... idiotic. I could see how it could offer more. AND I don't see how it could offer less.
For what its worth, I don't use an A/V product either.
And Like her, I also have a "pretty reasonable setup" and a dose of "common sense". But I'm still balancing the increased responsiveness and hassle-free experience vs the extra security. Its a trade-off that's worth it to me, but I recognize that it is still a trade-off.
She runs three separate virtual machines, designated Red, Yellow, and Green, each running a separate browser and used for increasingly sensitive tasks.
And in the article:
I totally don't care about a compromise of my "Red" machine--in fact I revert it to a known snapshot every week or so. I care much more about my "Yellow" machine. For example, I use NoScript in a browser I have there to only allow scripting from the few sites that I really want to visit (few online shops, blogger, etc). Sure, somebody might do a man-in-the-middle (MITM) attack against a plaintext HTTP connection that is whitelisted by NoScript and inject some malicious drive-by exploit, but then again, Yellow machine is only semi-sensitive and there would not be a big tragedy if somebody stole the information from it. Finally, the "Green" machine should be allowed to do only HTTPS connections to only my banking site.
And as long as your bank is never hacked and serving up malware, that probably works well...
Advice: on VPS providers
"...interview with security expert Joanna Rutkowska (which is unfortunately split over 9 pages)"
Why oh why did they split Joanna into 9 pages?! Thats so cruel!
Also, First Post
There's careful, there's paranoid, and there's three separate virtual machines.
Security is: 386 dx 40 (my first computer), BSD kernel, and Lynx non-graphical web browser. Only down side.... ascii-art porn (sigh).
If you run a recent, patched version of Linux or OS X, fine. But if you run a win32 or win64 variant, you shouldn't make the choice to place all of us at risk by running around without antivirus. It's irresponsible, and selfish.
> The problem is, however, that all current popular OSes, like Vista, Mac OS X, or even
> Linux, do not provide a decent isolation to its applications. This is primarily a result
> of all those systems using big monolithic kernels that consists of hundreds of
> third-party drivers that operate at the same privilege level as the rest of the kernel.
Sounds like she wants the Hurd.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
My partner, who is a totally non-tech person, also uses a similar setup on her Mac, and she finds it usable. So, I guess it's not as geeky as it might sound.
It is idiotic for three reasons:
1) The vast majority of attacks out there are simple programs that install in the OS. They are not some uber VM root kits or the like. As such, a virus scanner running in the OS is perfectly capable of dealing with them. So no, it doesn't give you 100% defense but I bet it stops 99.99% of the attacks out there and that is worth something.
2) Even in the case of low level root kits, they still have to get to your system in the first place. That in general means they have to get downloaded form the net or transferred from a CD or flash drive. Guess what? A virus scanner in the OS can stop that. It can scan the program coming in, before it has a chance to run, and block it. Even if the program would set itself up on a level below what the scanner could detect, the scanner can notice it as it is coming in before it can execute and do that.
3) Defense in depth is ALWAYS a good idea. In the real, physical, world you have to accept that no security is unbreakable. Anything you can make another person can unmake or circumvent. Thus security does not come from having one impassable layer, it comes from having multiple layer of different kinds. Should one layer be bypassed, security over all is not compromised. Well, a virus scanner on the system is another layer. Should be the only layer, but it helps.
Personally, I've never been impressed with her as a security researcher. She seems to be rather paranoid, and living in a theoretical world. In part this is because for all the chatter about Blue Pill, I haven't seen it made practical. Oh sure you can talk about an undetectable super rootkit on paper but does it actually work in the real world? VMWare doesn't think it would, and they do know more than a bit about virtualization.
I'm not saying this isn't an interesting line of academic research, but I'm getting tired of the "OMG I can own any system and not be detected!" doomsaying. No, really, not the case it seems.
Use read-only media. The read-only media should have a physical write-enable switch, like an SD card or USB key, so you can do updates from a clean boot. Then disable writing and boot. For more info: Read only linux
What is it with all these articles showing up from Tom's Hardware of late?
Its getting absurd and they are of pretty bad quality.
And they're written like an advert.
I have some experience with this sort of thing. Not a difficult setup, but it requires some knowledge and effort to maintain. So the cost is rather high, and hardware requirements somewhat steep. So you need a competent administrator with adequate resources.
The benefit, of course, is that it ends up being much more secure than antivirus software. Useful for when you make a living suing powerful organizations with the means to retaliate against you, while still being able to download porn on the corporate network.
Physical security is still important, though. Depending on who it is that's motivated to break into your systems, and their ability and willingness to simply "disappear" you or your employees when hacking attempts fail. I'd say it's not a setup for the faint of heart.
"I assumed blithely that there were no elves out there in the darkness"
She runs three separate virtual machines designated Red, Yellow, and Green, each running a separate browser and used for increasingly sensitive tasks.
Three operating systems to maintain. Three browsers. Three filing systems? Three PDF viewers?
Where does it end?
To me, the Zero Day exploit suggests that a random choice of OS, web browser and file viewer would make more sense.
But the whole idea seems overly complex and dangerously fragile.
you will take the red pill now
I don't want this guy on the same planet as my corporate network.
Tnks for share
Porno
Sikis
http://www.bedava-ligtv.com
Spiele Spielen
Bundesliga
American Poker
porno izle
I'd root her box ;)
This idea of using VMs could make for some interesting security on laptops that have TPM chips:
First, the laptop would be secured with BitLocker. This would provide two things, first, hardware and MBR tamper detection. Someone messes with the laptop while its not attended, it won't boot and ask for the recovery key. Second, BitLocker is transparant once it boots. No need to worry about an additional passphrase (though the recovery key should be kept someplace secure).
The main OS here is mainly used just as an enlighted host for the other VMs. Using Hyper-V or VMWare Workstation, one can then run several VMs, perhaps based around a similar starting OS and cloned. This way, one can have VMs focusing on tasks (document writing, browsing the naughty sites, payroll, etc.) With wise use of snapshots and isolation, if one of the VMs gets compromised, its just a click away from being rolled back to a clean state.
The only issue is getting data between the VMs, say from the payroll VM to the VM with the mail program. However, one can make a virtual hard disk that can be connected and disconnected from machines, perhaps being hooked up to a third, non Windows VM to check for tainted autorun.inf files and other stuff before it gets shuttled to a more security sensitive VM.
This is a lot of work, but compartmentalization and the ability to dump all changes in a filesystem to a known good point will go a long way in security.
Just because you're paranoid doesn't mean they aren't out to get you.
Since i got absolutely sick of Norton back in 05 i have not used an a/v program, and guess what? nothing but freedom. and i surf alot and download alot. dont do stupid sh1t and you wont need an a/v prog, that includes porn and torrent sites
I know this is a bit sexist and yes women can do whatever men can do (in IT) but it's rare to see a woman that does this sort of thing. I'd tap pay to tap someone like Joanna Rutkowska.
I understand the DEP (data execution prevention) enabled processors weren't common back in Windows XP days but what is the deal with Windows 7 even 64bit version? Why wouldn't MS enable it by default as it is said to prevent very serious attacks on CPU level, without slowing down the system at all?
While there are no real viruses on OS X yet, I try to prepare machines for "no AV needed even while viruses exist" configuration just like you with couple of extra admin prompts, that is all but I don't follow Windows scene too much.
After enabling DEP, I even gamed on Windows 7 64bit (game is even running under win2k compatibility) and I haven't seen anything bad happen. I remember some stupid HP driver on another machine crashed because of DEP but that was all, the error message was really informative too.
So, do they disable it to make couple of badly written software owners happy while 99% would benefit from it?
BTW, this is what DEP is
http://en.wikipedia.org/wiki/Data_execution_prevention
She's hot and she's a geek. Girls like her are rare.
There's no benefit to a micro-kernel in these so-called ring -1 attacks. None.
You know, the really odd thing is that that's what I just said. Microkernels are not about security, they're about internal kernel API design. That's why Hurd and Mach suck, they're taking the API design guidelines and treating them as kernel architecture.
Yet you use virtualization.
I use virtualization where it's useful. I don't run my desktop under it, I don't use it where performance is critical. I use FreeBSD jails instead of virtual machines on my colo because they've got less overhead.
So, a person who can do mad things like ring -1 and knows about -2 -3 attacks who also happens to be a professional security researcher doesn't use AV and "doesn't see need for it."
This is the most irresponsible thing I have ever heard. Does average user have knowledge of system internals like she does? Does average user can stand the torture of 3 virtual machines? Could average user get rid of "run as admin" even on upcoming Windows 7, especially if he/she is a gamer?
This is more like a Medical Doctor bragging about how he never used any pills or went to a doctor and "doesn't see need for it".
She should browse some average user troubleshooting forums and see the junk non technical people are being victim of. No, they really don't know the privilege levels or CPU rings.
Running three separate VMs is not only a sign of paranoia but also a delusion that as a person functioning in todays world you can realistically have so much control over information that with enough effort you can control your own security in all regards, or even that you can control it to the extent necessary to protect yourself from common threats.
Put aside for a moment that she's a security researcher and that probably invites more attacks than the rest of us face. There are a number of flaws readily apparent with this approach to security:
1 - Knowledge is power, and you just told the world critical elements of your defenses. There's a reason banks don't disclose such things. It doesn't make your system any less secure, but it raises the bar for attackers.
2 - You maintain your own VMs. In your mind nobody is better equipped to protect your systems than you are. In reality if you made a security blooper on one system you probably replicated it on all three VMs, if not the host also.
3 - I guess you assume that if you're running an app in the VM and someone decides to attack a vulnerability in your network stack that it won't actually the host system, and since the VM leverages the network stack of the host system that's not necessarily true.
4 - You may secure connections between entities like your bank by allowing only HTTPS through a browser in the VM. Reality is that in the last year major payment processors have been breached resulting in millions of people's card details being stolen. RBS WorldPay and Heartland Data Systems are two known breaches, there is one other yet unidentified from what I have read.
5 - As others have pointed out, anti-virus *will* protect you against nearly all *common* attacks. Today's anti-virus products even scan mail and http traffic for threats before your applications can process the data themselves (usually not in free versions of the AV apps). To say it adds no value at all is sending a very bad message to the majority of readers who would like to think they're better equipped to handle their own security than they really are.
The reality is that you can very easily do many simple things to help protect yourself. Install all your application updates promptly, be careful where you download software from, don't run attachments from spam e-mail, don't follow links sent to you in email without checking where they really go first, be careful where you enter your card details, run AV software, etc. etc.
However, beyond a certain point you have to spend exponentially more effort, beyond what the majority of people would consider reasonable, for very small gains in security. Chances are that you will still suffer fraud etc. during your lifetime, and it will be due to some vector completely beyond your control.
No, I didn't RTFA. 9 pages? gtfo.
1. I always thought that bigger risk for hospital is an random virus then DDoS attack. I did heard about normal virus attacking hospital - nobody has planned so just someone opened one attachment too far or something like that - but I did not about DDoS attack. Since what would he want to achive? 2. Unfortunatly we live in the world in which there are people beliving they will get 10% for transfer of money from one country to another (usually those countries for some reason don't have good reputation). And usually having AV, not opening attachments unless expected etc. helps avoiding most of the attacks for normal people - nobody will try to DDoS them. Different matter is with companies etc. They need to be secure. I was considered paranoid whenI advised having password and not using admin account for others. 3. Yes - for most people the discovery of the next bug in IE/Fx/Opera/... does matter. I'm not interested much if there is theoretical possibility that software is safe. I'm interested in the security here and now. Numbers of bugs discovered is not the best measurement - much better is time-to-patch - but still it is important in practice. Similary - a single shifts in prices are not important for theoretical economist - but for consumers and producers they are much more important [although thay may posses much less knoledge about origin of shift etc.]. 4. Monolithic kernel does not necessary implies 3rd part drivers. OpenBSD have monolithic kernel and AFAIR does not support loading modules after boot. Linux have most of the drivers included and is perfectly operative without loading modules. There are resons why to use them but they are optional.
I've probably left my head... somewhere. Please wait untill I find it.
Homepage: http://blog.piechotka.com.pl/
Color codes for the three machines should be Red, Green and Blue. This will improve security against the bluepill attack. See bluepills cannot attack "blue" machines!
O this learning! What a thing it is - William Shakespeare
She now realizes that Ken Thompson's paper:
"Reflections on Trusting Trust"
http://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf
- is the basis of ANY hardware firmware or re-flashing of hardware.
I can't wait for next month and hopefully the bombshell we've been waiting for.
Brilliant Joanna indeed.
~hylas
She is simply retarded, sure someone COULD bust in my front door and kill me, but that would require a work and fighting me- Someone could use some ultra complex low level hardware hack...... but why?
There is no such thing as a secure system, never will be- as for her VM's- retarded, simply retarded. Someone could still attack her root machine, hell did she ever consider that once those packets leave her box they are insecure?
There are few people I trust in the mental masturbation of information security, most are just plain stupid like this woman- she needs to just go back to the kitchen and make me a sandwich.
How do you know Nod is actually doing what it claims? It's easy to boost performance by lying about tests. On the other hand, lying is not an option for free scanners.
Yeah, it's speculation but there's some pretty good circumstantial evidence that one Joanna Rutkowska used to be Jan Rutkowski.
If she were Brazilian or Thai, I'd probably find it kinda hot.
Yeah, we're talking about a Pole.
I've been a Microsoft partner for quite a while and my problem was never a lack of licenses. Been accumulating like crazy year after year and it ain't just M$. They don't even cost that much, more than a few heavy lifters were tossed in my direction for free. User and Server Apps included. You have to do some research but it ain't that hard, unless your a Apple/Linux/whatever fan-boy and wouldn't be caught dead on a M$ site! Your call. Me, I need to use & test everything 'ause I never know what else I'll encounter out there in the REAL world. Come to fix a office machine, end up reconfiguring Exchange server in the deal for much, much more. Works for me.
So maybe her setup isn't as good as she thinks.
While DEP is nice, it cannot prevent all exploits from buffer overflows. Google for return-to-libc, it's even in the wikipedia article you linked. Thus, if DEP was enabled by default exploit authors would switch to return-to-libc against Win7 instead of using "classical" exploits. Same as AV: It keeps the stupid attackers out, but the good ones will circumvent it.
Well, I have a similar setup.
I use no AV at all, instead I do all my browsing (except a few trusted sites) inside an immutable virtual machine. I.e. the machine resets itself to a previously saved snapshot every time it is restarted.
Besides I reload an image of my (host) system partition every other month or so. Been doing this for years and have yet to catch any kind of malware!
Regards
Not running a/v is like saying "I don't waste energy producing antibodies because they don't know about every bug out there". Instead what we do in biological security is ADD protection to augment our natural defenses with disinfectants etc.
Yes, you can live perfectly healthy without an immune system, you just have to confine yourself to a bubble to avoid any exposure. The same applies to IT. There are applications where a/v adds nothing, but only when those machines are completely issolated from any possible exposure.
The alternative view is to treat machines (virtual or otherwise) as disposable, a "use once and throw away" approach. Mix that with any persistance and the exposure increases too.
So, a security expert who can't see what av can add? Doesn't inspire me with much confidence in their connection to the real world. Perhaps they have lost sight of the majority threat/risk landscape out there through a myopic view on theoretical risks.
Bugs don't have to be undetectable, they just have to be a pain in the ass to remove, very difficult to stop up-front, and quick/easy to deploy their mischief. If those criteria are met, then with a zero-day exploit (these are published all the time), the bug could potentially hit maybe 20% of computers on the Internet successfully (Assume 80/20 rule for got the patch in time, etc.). How many more millions of machines do you need to infect and run your program on than 20% of the Internet?
stuff |
A few years ago, I set up a bunch of thin clients for general browsing, chatting and homework at a school dorm [...] upon login (LDAP authentication), the user's directory would be mounted from an individual password-protected Samba share (accessible from the users' personal computers as well), with the noexec attrubite of course.
In an environment where everything writable is noexec, how do engineering and computer science students run programming exercises that they have compiled? Or is it a Dijkstra-style "if you compile your assignments, you get an F" course?
Oh, how wrong this is.
You should look into the L4 microkernel project some time, and its follow-ups (e.g. Pistachio, Fiasco)
In a nutshell: The reason most "microkernels" have bad performance is that they are not anywhere near "micro" enough.
I just don't give a damn about any stupid EULA. I have read them in the past, and disagree with half of what is printed in them. "Accepting" the EULA is a coercive exercise. Basically, it says "If you don't like ANYTHING we tell you, then you can't use our software." Bullshit. Complete and utter bullshit. I take almost all the same liberties with Microsoft and other proprietary software that I take with open source software - decompile, reverse engineer, change code, etc. The ONLY thing that I don't do with proprietary, is to redistribute. What I do INHOUSE is my business.
The day that Microsoft sits down with a panel of consumers who represent business, government, the nerd community, and average users, and hammer out a REASONABLE EULA, then I'll pay attention to the EULA again. The best "for instance" is the changing hardware deal. If I buy a Compaq, and the mainboard dies a week after the warranty dies, I insist that I have the right to replace the mainboard and any peripheral hardware, and to reinstall Windows - FOR FREE.
Corporate coercion of consumers may or may not be legal - but I will never respect it, or abide by it.
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
The reason most "microkernels" have bad performance is that they are not anywhere near "micro" enough.
Indeed, and one of the ways they achieve this is by NOT performing context switches between different security domains for every message. For example, the L3 and L4 family kernels delegate security domain management to user-space programs, and L4Ka supports message passing operations entirely in user space... with no kernel intervention.
This is bringing the design back to the real-time operating systems that inspired the whole Microkernel concept.
"For what its worth, I don't use an A/V product either. And Like her, I also have a "pretty reasonable setup" and a dose of "common sense". But I'm still balancing the increased responsiveness and hassle-free experience vs the extra security. Its a trade-off that's worth it to me, but I recognize that it is still a trade-off." - by vux984 (928602) on Saturday July 18, @06:32PM (#28743977)
I recommend running one to folks in this guide for Windows users:
----
HOW TO SECURE Windows 2000/XP/Server 2003, & even VISTA, + make it "fun-to-do", via CIS Tool Guidance (& beyond):
http://www.tcmagazine.com/forums/index.php?s=f95071c12d0fc4e3d6b3c8b08dd8c05d&showtopic=2662
----
And people that've applied it have seen results like this (going on 2++ yrs. testimonial below, & no malware/trojan/virus/spyware/keylogger/worm infestations, period):
----
http://www.xtremepccentral.com/forums/showthread.php?s=97c1e368dad75689a8da7df5a0e97418&t=28430&page=3 [xtremepccentral.com]
"Its 2009 - still trouble free!
I was told last week by a co worker who does active directory administration, and he said I was doing overkill. I told him yes, but I just eliminated the half life in windows that you usually get. He said good point. So from 2008 till 2009. No speed decreases, its been to a lan party, moved around in a move, and it still NEVER has had the OS reinstalled besides the fact I imaged the drive over in 2008.
Great stuff!
My client STILL Hasn't called me back in regards to that one machine to get it locked down for the kid. I am glad it worked and I am sure her wallet is appreciated too now that it works. Speaking of which, I need to call her to see if I can get some leads.
APK - I will say it again, the guide is FANTASTIC! Its made my PC experience much easier. Sandboxing was great. Getting my host file updated, setting services to system service, rather than system local. (except AVG updater, needed system local)" - THRONKA user @ xtremepccentral.com
----
Thus?
I say it's DOABLE to have results like that above, 100% uptime for YEARS to DECADES, + YES, on WINDOWS too... &, without AV & AS, but also, any virtualization layers (as they all lend to "performance-hits"), because I have the same here myself (along with many others)... AND, here??
I am going on a decade++ solid here now in fact, of safe 100% 'uninterrupted by online maladies' uptime, by doing the above.
HOWEVER:
Yes, even though I recommend the "layered security" of antivirus &/or antispyware programs for MOST users, just to be safe(r) online?
WELL, per my subject-line above?
Yes - I have been doing what I have seen as "running naked" (meaning w/out antivirus or antispyware programs running resident ALL THE TIME in say, your tooltray + their possible background services as well), & I have seen no problems...
Simply just by practicing what is in my guide above (going on more than a decade of safe surfing thru 3 machines now, never had a problem)
APK
P.S.=> Much of it IS, "common-sense", much of it is not - &, I'd still recommend folks run RESIDENT scanners for AntiVirus &/or AntiSpyware products in combination (say, NOD32 AV + SpyBot S&D AntiSpyware's teatimer product) for THEM to be safer...
However, here? I am not running either resident, & I'm saving CPU time, RAM, & other various forms of I/O as well by NOT keeping them running resident "all the time, 24x7", & I only use them as periodic manual scanners (say, on Sunday a.m. every week)...
100% safe & stable Windows uptime? It's doable, IF you know what you're doing - a LOT of safe computing simply boils down to that, just like it would safe driving... apk
a web browser that doesn't execute attachments
Do you actually own a computer?
I'm a Programmer. That's one level above Software Engineer and one level below Engineer.
Here is a link to the full text (I hope it works!) http://www.tomshardware.com/review_print.php?p1=2356
"Only behavioral controls will stop novel attacks, and you need to know what behaviors to stop. Simply stopping anything that might possibly be used to get control the system will leave you with a nonfunctioning system." - by blueg3 (192743) on Sunday July 19, @12:13AM (#28745469)
Agreed, 110%, & especially per my subject-line above (in regards to javascript mostly, but, also other things & practices to do OR avoid + more) - curb the use of it, most of the things affecting folks' machines adversely is avoided, especially in today's HEAVILY "online world"... most of the attack causes/root vectors (whatever) I see reported deal in javascript delivery mechanisms (more than malicious binaries downloaded & run)...
I recommend watching it with unlimimted, indiscriminate usage of javascript on "every site under the sun", @ least unprotected by something like NoScript (or just turning it off for MOST sites & leaving exceptions for sites that ABSOLUTELY DEMAND javascript for full/proper function only)...
And, as Ozymandias said in the film "The Watchmen"?
"So I resolved to apply antiquities teachings (usage of custom malicious site &/or adbanner blocking HOSTS files) to the world today, & so began my conquest: Conquest, NOT OF MEN, but, of the evils that beset them - Fossil Fuels (antivirus resident), Oil (antispyware resident), Nuclear Power (VM for security layers), are like a drug, & YOU GENTLEMEN, are the pushers..." - Adrian Veidt (Ozymandias), THE WATCHMEN
And since HOSTS files ARE "from antiquity" in computing? They work for that "behavioral modification", too, because of a simple principal: "You can't get burned, if you can't go into the kitchen"... & that goes for limiting indiscriminate javascript usage (NOScript + AdBlock for MOZILLA/FireFox products, & Opera's native "by site" preferences are perfect here in fact, but there's more for 'layered security', like filtering .PAC files + custom cascading stylesheets & more as well in that guide)
Those are 2 "novel techniques" that actually WORK, & for MOST folks, with 12 other things, in this guide for Windows users' security online:
----
HOW TO SECURE Windows 2000/XP/Server 2003, & even VISTA, + make it "fun-to-do", via CIS Tool Guidance (& beyond):
http://www.tcmagazine.com/forums/index.php?s=f95071c12d0fc4e3d6b3c8b08dd8c05d&showtopic=2662
----
And people that've applied it have seen results like this (going on 2++ yrs. testimonial below, & no malware/trojan/virus/spyware/keylogger/worm infestations, period):
----
http://www.xtremepccentral.com/forums/showthread.php?s=97c1e368dad75689a8da7df5a0e97418&t=28430&page=3 [xtremepccentral.com]
"Its 2009 - still trouble free!
I was told last week by a co worker who does active directory administration, and he said I was doing overkill. I told him yes, but I just eliminated the half life in windows that you usually get. He said good point. So from 2008 till 2009. No speed decreases, its been to a lan party, moved around in a move, and it still NEVER has had the OS reinstalled besides the fact I imaged the drive over in 2008. Great stuff! My client STILL Hasn't called me back in regards to that one machine to get it locked down for the kid. I am glad it worked and I am sure her wallet is appreciated too now that it works. Speaking of which, I need to call her to see if I can get some leads. APK - I will say it again, the guide is FANTASTIC! Its made my PC experience much easier. Sandboxing was great. Getting my host file updated, setting services to system service, rather than system local. (except AVG updater, needed system local)" - THRON
Wait, what are you trying to sell me?
Don't put the word "browser" in the summary of an article that isn't really about them. Knowledge of a web browser represents the bare minimum level of expertise necessary to comment on /. and as such the inclusion of that word in the summary greatly increases the signal-to-noise ratio.
Your pal,
The guy who wanted to read informative comments about VM exploits rather than NoScript
"Wait, what are you trying to sell me?" - by atraintocry (1183485) on Sunday July 19, @05:25PM (#28750313)
See subject-line 1st, & go back to -> http://it.slashdot.org/comments.pl?sid=1307407&threshold=1&commentsort=0&mode=thread&cid=28749341 & that guide will get you to up to a 99++/100 on CIS Tool, if you pursue its points enough...
Plus, doing the rest the guide, above & beyond CIS Tool only, and its points for security of a Windows NT-based OS of modern ancestry (2000 & beyond), only some of which I noted in that url above now?
It'll give a user years, to DECADES, of stable FAR safer online internet & local to system uptime on a Windows NT-based OS such as 2000/XP/Server 2003 (Vista too, to an extent), that's all... no sale - no charge - no ca$h -> Free...
APK
P.S.=> And, it works... apk
Honestly.
AV is decent, and is useful is you have a large network to maintain, or users who don't know what they are doing.
If you know what you are doing, keep your OS patched and locked down, use a secure browser, keep up maintenance like looking out for odd files/processes etc, then AV is not going to add any additional protection. IN fact, the presence of AV, since it generally has to run as Administrator, adds an unnecessary attack vector. There are very few, if any scenarios where the security of a machine will be increased by the presence of an AV if the machine is well maintained and locked down and the user knows what they are doing. There are plenty of situations where having an AV could lead to a DoS, shell or false sense of security.
There is nothing wrong with a security researcher not using AV and using a more secure approach,especially given the nature of her work and the sensitive information she deals with.
If you ignore ACs because they are anonymous - you're an idiot.
Her setup is more like a fortress filled with cruise missiles that can be launched with lots of advanced warning of attack.
And atom bombs! And ninjas! In a whiny white fortress on a mountaintop. Totally sweet!
Sir, you seem to have gone a bit over top with your war-analogies, somehow implying that virtual machines can cause a digital equivalent of "cruise missile" damage to attackers. At best, such a setup would render attacks useless.
May I suggest a car analogy?:
A dirty old car you drive in the nasty neighborhoods (not really caring if it is destroyed) as well as a fancy Mercedes to drive to the places you know for certain nothing bad will happen to the car.
I lost my sig.