Slashdot Mirror
Microsoft Links Malware Rates To Pirated Windows
CWmike writes "Microsoft said today that computers in countries with high rates of software piracy are more likely to be infected because users are leery of applying security patches. 'There is a direct correlation between piracy and the malware infection rate,' said Jeff Williams, head manager of the Microsoft Malware Protection Center. Highlighting research that showed worms to be the most prevalent computer security problem today, Williams said the link between PC infection rates and piracy is due to the hesitancy of users of pirated software to use Windows Update. China's piracy rate is more than four times that of the US, but the use of Windows Update in China is significantly below that in this country. Same for Brazil and France. But Microsoft's own data doesn't always support William's contention that piracy, and the hesitancy to use Windows Update, leads to more infected PCs. China, for example, boasted a malware infection rate — as defined by the number of computers cleaned for each 1,000 executions of the MSRT — of just 6.7 per thousand, significantly below the global average of 8.7 or the US's rate of 8.2. France's infection rate of 7.9 in the first half of 2009 was also below the worldwide average."
So malware is Microsoft's fault for not patching pirated machines? Or did I miss something...
Including Windows Genuine Validation is the likely culprit for this.
I'm not hesitant of MS patches because of piracy, I'm hesitant because i use this machine to do all my Photoshop work and the last 4 auto patches crash Photoshop roughly every 6 min rendering my computer completely useless for it's primary purpose.
Suppose it was possible to apply security patches without installing Windows Genuine Advantage (malware by anyone's definition except Microsoft's). Would that make a difference? Perhaps what they are seeing is really just a choice users make between Microsoft malware and "aftermarket" malware.
Well, China is behind an all encompassing firewall.
And the French refuse to install malware written in English.
And users (with both legit and pirated copies) are leery of applying patches because of Microsoft Genuine Advantage and its ilk. Does this come as a surprise to them?
Sent from my iPhone
. . . people would be "leery" of installing "security patches," MS having pushed down things like WGA as a "critical updates." Of fscking course the people running dodgy copies of Windows are going to assume that each new wave of patches might come with a copy protection trojan, in light of the fact they've done it before. So in fact, Microsoft has caused the problem they're bellowing about in the name of attempting to inhibit piracy of Windows.
One CPU cycle wasted on digital restrictions management is ONE TOO MANY.
They're pirates. Of course they're going to run malicious software.
What the hell else would pirates do with a computer, donate to charity and solve world hunger? No, they're going to use it to look up www.saucywenches.com or download illegal treasure maps, or perform DDoS attacks on Royal Navy ships. They'd use a pirate version of Quicken to count their doubloons and inventory their treasure chest. They'd be looking up suspicious sites for syphilis treatments. They'd manually edit the Windows Registry with nothing but a cutlass and a corkscrew.
... and then they built the supercollider.
Wouldn't those pirating an OS be less likely to have infected computers simply because they would be more likely to be more computer literate than your average user? Granted, it is not hard to get and install pirated copies, but your average user who falls for Nigerian scams and self-installing anti-virus malware probably wouldnt be doing much downloading besides some music, if at all. I would assume that someone downloading a pirated version of Windows probably does not use IE, and probably follows safe browsing guidelines as well.
The only thing necessary for evil to triumph is for it to be pitted against a slightly greater evil
Wouldn't the rates of infections be severely affected by how long the machine stays online? Because that increases both — the opportunity to infect the machine, and its value for the hijacker (as a spam-relay)?
With many organizations simply blocking the entire A- and B-class networks from China, even an always-connected server in China is not as hot a target as the one in US.
Also, one would expect, the machine owners' expected wealth to be a factor — some viruses blackmail the owner by threatening to delete their files... The poor Chinese may not even have a Paypal account to pay off the scumbags, so why go after them?
Accounting for all this may change the published statistics quite a bit...
In Soviet Washington the swamp drains you.
I just recently returned from a trip to India and found that many of the cyber cafes and family homes that I visited were not running the latest service-packs for Windows. I would attribute that to mostly being because although they had "broadband" their speed even during off hours were more around the range of 64 to 128 Kbps with high latency due to over subscription. Can any of you imagine downloading Windows XP SP3 over that kind of connection? (Setup a speed limiter on your next bit torrent download at about 5 KBs/40 kbps and see how long that file takes to transfer) Along with the problem that most computers are purchased as cheaply as possible so they frequently run with the minimum amount of ram possible, making the use of Antivirus software and the latest Service packs way too slow to even browse the web.
Security patches and Anti-virus updates that are several megabytes a piece are fine for someone with a lowly 512 kbps broadband connection, but understand that most people in these countries like China and India still have very large modem and slow DSL that is extremely over subscribed at the ISP.
Even here in the US there are many people that have dial-up even if other options are available because they don't feel the broadband options provide a good cost/performance ratio. $40 for 512kbps WISP connection or $10 for a cheap dial-up connection. $480 + install for the first year, or $120 for a year of dial-up over a phone line they already have...
Please keep in mind that although 5+ Mbps broadband is available in most Metro markets there are still a lot of people that have much slower connections making many online services out of reach (Steam, hulu, and to some security patches).
Perhaps these pirates just feel such extreme guilt for copying Windows that they are rejecting patches and virtually flogging themselves with malware.
This sig is exactly seventy characters long and a real waste of space!
Williams said the link between PC infection rates and piracy is due to the hesitancy of users of pirated software to use Windows Update.
Make Windows free.
Obviously Microsoft doesn't want to acknowledge the large portion of their licensed users who set Windows to do their updates automatically but have never touched an antivirus or security software. I've worked in IT and with the Joe Public users and that was by far the biggest problem out there.
People would often call in with viruses/malware they've just been living with on a 2 year old computer, and when you asked them about what they use for antivirus, they wouldn't have a clue. "I used that link that was on my desktop when I bought it," they would say. Well, that 30 day trial will get you into more trouble than not applying your windows updates, especially when they're opening up all those emails from disposed Nigerian dictators.
Microsoft said today that computers in countries with high rates of software piracy are more likely to be infected because users are leery of applying security patches.
When you purposely push out "security patches" that only disable copies of Windows that are pirated, then yes, they are leery of using them, and rightly so (Assuming their goal is to run Windows without paying, and not buying Windows or using another OS)
This is the exact situation Microsoft has stated they wanted to happen.
And before anyone starts, I am not suggesting Microsoft change their rules on supporting pirated copies of Windows.
It's theirs to choose how to support how they want.
Just that this is the only conclusion one could expect from their current choice.
but lets give MS the benefit of the doubt. After all, haven't they earned our trust? I'll take them at their word that stealing windows = malware. Fortunately, I don't have to steal windows anymore, a guy from nigeria says I'll be rich soon.
China's piracy rate is more than four times that of the US, but the use of Windows Update in China is significantly below that in this country. Same for Brazil and France. But Microsoft's own data doesn't always support William's contention that piracy, and the hesitancy to use Windows Update, leads to more infected PCs. China, for example, boasted a malware infection rate -- as defined by the number of computers cleaned for each 1,000 executions of the MSRT -- of just 6.7 per thousand, significantly below the global average of 8.7 or the US's rate of 8.2. France's infection rate of 7.9 in the first half of 2009 was also below the worldwide average."
How can Microsoft possibly conclude that Malware is a greater threat to pirated PCs from the previously quoted data? Obviously the US has a higher infection rate than China, with the US being at 8.2 per thousand and China only at 6.7.
If it were me analyzing the data I'm afraid I would have to conclude that users who use windows update more often and use official copies of windows(US users) are more likely to receive a malware infection than users on pirated copies without using windows update(China).
I guess I deserve a job at Microsoft if I'm able to better comprehend the statistics than they are, assuming the numbers from this article are even true.
First, I'm not even a user of Microsoft stuff (see my sig), and I'm not posting because I think I know what Microsoft should do. This is not a rhetorical question on my part, but just a plain question. As I understand it, when a machine is infected it makes trouble for everybody (becomes part of an army of botnets or whatever). So, helping pirates who, except for pirating Microsoft Software are pretty much minding their own business, to keep their machines virus free would help everybody wouldn't it? They try to give junkies clean needles not to help them be junkies, but to try to prevent the spread of disease. Have I got that right? If I do, then, isn't it a similar situation with Microsoft?
In theory, theory and practice are the same; in practice they're different. (Yogi Berra & A. Einstein)
The fact that there's a "Great (Fire)Wall" separating the Chinese from the rest of the internet? Chinese culture being less individualistic may simply not produce as much malware, and since most citizens are restricted to their own countrymen, there's a bias. That such a sampling bias exists should disqualify it from being included among the other countries, or at least warrant further research before lumping it in there.
Microsoft has a financial incentive to make people fear running unauthorized copies of Windows.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
I, on the other hand, am inclined to think otherwise.
I don't think that anybody in their right mind would call Fedora Linux lacking in security, but if you were to download the install DVD for Fedora 11, the latest version, what you'd get is exactly what you'd have downloaded on the first day it was available. Then, after installation, you'd have to download all the updates needed to bring your system up to date. How is this different from what Microsoft does?
Good, inexpensive web hosting
car manufacturer who goes and cuts stolen cars' breaks
More like a manufacturer who won't replace (possibly shoddy) brakes on cars because the owners didn't bother to register with them.
You can download Fedora 11 ISOs with all updates to a recent date here: spins.fedoraunity.org
I can find no similar site for Windows XP, Vista, or any other MS product.
So yeah, no difference between Fedora and Windows at all. :rolleyes:
It's almost like M$ keeps moving the holes around and re-hiding them, but never fixing them. That would certainly permit the known holes and backdoors to be available for exploit but make it harder for 'unauthorized' (you did read the EULA, right?) entities to use them.
That is, however, only when M$ can be assed to patch in the first place. Not like they've dropped patches for versions they still claim to support.
Beta is broken and the link to classic doesn't work. Stop wasting our time or there won't be anybody left here.
What Microsoft does different from Fedora is to prevent copies of windows that raise the 'piracy' flag from downloading any updates.
Besides, the interpretation is flawed in more ways, by limiting the 'percentage users having malware on their computer' number to the users that run a specific tool, MSRT, which is normally found through windows update. For what it's worth, all this means is that people in china don't trust, or at least don't run MSRT.
MSRT: http://www.microsoft.com/security/malwareremove/default.aspx
If I walked out of that store, and someone offered to give me an exact copy of that suit for free, I wouldn't complain.
Do people on car forums provide computer analogies to their car issues?
Every time MS releases a service pack, they slipstream the update into the ISO, recall from retail the CD's with the old version, and start shipping the new ISO to OEMs and retail. The reason that you don't see it as an end user is because they don't change the packaging to reflect this. Usually, the only people who will actually see the change are people who are ordering the CD/DVD version (as the SKU will change), and people with access to MSDN, where the old versions of the ISO are still available for historical reasons. (MSDN subscribers can get every version of Windows that's ever been released, going back to Windows 3.1, and MS DOS 5.0... don't copy that floppy!)
They can't slipstream normal security patches into the ISO and release it on the fly, because they aren't allowing normal users to download the ISO.... it's strictly OEM install and retail purchase. They release security patches every month, and the logistics of recalling/shipping a new ISO every 30 days would be far too expensive.
You can argue that OEMs have a moral obligation to run system update before they ship the computer to the end user, but when you consider that many systems end up sitting in a box at a retail outlet for weeks or months before they're sold, that ends up being a bit of a non-issue... the only times where that'd be even remotely useful is for computers that are built to order, but by necessity they still have to have a baseline image so that end users get the out-of-box-experience.
Obligatory disclaimer: I'm by no means an MS fangirl... I do have their software on an HTPC and a gaming laptop, but run Linux elsewhere... that said, I also have an MSDN subscription as a benefit from a previous job that they "forgot" to disable when I left the company.