Slashdot Mirror
In Test, Windows 7 Vulnerable To 8 Out of 10 Viruses
As Windows 7's market share passes 3.6%, up from 1.9% the day before launch,
llManDrakell notes an experiment they did over at Sophos. They installed Windows 7 on a clean machine — with no anti-virus protection — with User Access Control in its default configuration. They threw at it the next 10 virus/worm samples that came in the door. Seven of them ran; UAC stopped only one baddie that had run in the absense of UAC. "Lesson learned? You still need to run anti-virus on Windows 7."
Anyone who uses any computer (including Mac AND Linux) without anti-virus is asking for what they get. Especially with the number of good free anti-virus programs available for Windows, there is no excuse not to have one either way. I use Avast Home Edition. It's free (just registration required), fast, and small-footprint. Even if 9/10 viruses would be blocked by UAC, an anti-virus program that blocks the last one is worth it.
Next you'll be telling me that 8 out of 10 people who have unprotected sex with HIV-positive, syphilitic, sore-encrusted prostitutes will contract some sort of venereal disease.
Did the account set up on Vista / Win7 have an administrator role, or was it a "normal user" account? By not disclosing that, Wisniewski is only giving us half the story.
!#@%*)anks for hanging up the phone, dear.
Viruses use security holes to get onto PCs in the first place - once the virus is running on the PC, it's got free reign. There can be absolutely no security vulnerabilities on a system and the virus usually still do what it wants if it's preloaded onto the system.
You don't need administrative privileges to do many things that viruses want to do (eg. send mail, monitor keypresses). They ran the test by loading the virus onto the machine, then letting it execute. That doesn't demonstrate that the system is full of holes - it demonstrates that the system is very good at backwards compatibility!
Agreed, to know whether this is scary would require me knowing whether these were drive-by exploits or require me being stupid enough to run their virus.
I'm pretty confident in my ability to avoid the social networking sort of viruses. It's the drive-by exploits that I'm concerned about.
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
They could have at least tested it with Security Essentials . . . it's freely available to Windows users.
And yet the post at the Sophos blog says: "On October 22nd, we settled in at SophosLabs and loaded a full release copy of Windows 7 on a clean machine. We configured it to follow the system defaults [emphasis mine] for User Account Control (UAC) and did not load any anti-virus software." The point is that they installed Windows with the defaults like 99.999% of the users out there would do.
My mom is probably a typical Windows user, and when she eventually installs "the new Windows", I'm willing to bet she'll just go with the defaults. Because it's easy. So if the default install of Windows 7 doesn't include & configure Security Essentials by default, then this test reflects what real users will see.
Sure, they could have done a followup test to install Microsoft's Security Essentials, then see how that would have fared with the same 10 viruses. But these guys sell their own anti-virus software, so I don't really expect them to take the extra step.
Slashdot should have a Wall of Shame for programs that are like this.
Kodak Easy Share is my pick.
It's NOT me! It's the meds! I'm on 1000mg of Fukitol.
This article is not saying Windows 7 is insecure. You couldn't even come to that conclusion if you look at what they did. They ran untrusted code known to contain viruses on a Windows 7 machine. UAC only blocked those that tried to perform administrative tasks, which is what its job is. They did not try to do remote infection.
I could write a virus attached to an executable that deleted your favorites file or all of the documents in your user's document folders. This would still be a nasty virus and would not be classified as an administrative activity, thus not triggering UAC. This would not indicate any flaw in the OS or it's level of security. This is no different from any other platform, running as admin or not, if you run untrusted code, it will be able to do anything your logged in user can do.
The point of the article is that people should not pretend UAC *is* virus protection. Microsoft doesn't market it as virus protection, and people shouldn't be under the impression that UAC prevents viruses from running.
Lesson learned: don't execute random questionable crap on your computer and you can almost certainly live without AV.
Yes, even Mac and Linux need (and regularly run) anti-virus software... If the role demands it.
Grandma running a Mac to check her email and (gah!) facebook will likely never need it.
Linux running a mail server absolutely needs to have and run it. It would be downright irresponsible not to, regardless of whether the Linux server was vulnerable to any of the viruses coming through or not.
and to also throw in my "who is surprised by this?"... You mean to tell me that they are surprised that windows software, written to specifically take advantage of a "feature" of windows, still runs on the newest version of windows, which is only minimally different from previous versions of windows, and was written specifically to remain as compatible as possible with previous windows software?... Hmmm
So...what's the best anti-virus software for Windows 7?
Disconnect it from the network.. You asked..
They got some malware, and ran it. If these malware did not need elevated privileges, they are expected to run. You download a bash script from the net that goes "\rm -rf ~" and then complain that your $home is hosed? I am not sure the test is fair. Did the malware get root privileges? Did they do any damage that simple plain process with user privilege could not do? Unless such things happened, this test amounts to nothing more than testing backward compatibility of some old binaries in new OS. Duh.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
This makes logical sense to me, but (apparently) it isn't done.
It is done. Everytime Windows Firewall says "This application is trying to access the internet" and you hit unblock. Everytime Windows Vista says "You need administrative Rights to run this, do you want to continue?".
It's either
A) A whitelist the users can set, which frustrates users to a point that they don't care and allow everything they come across.
B) A blacklist run by some antivirus or another, which is constantly trying to keep up (and failing).
C) A whitelist that is set by some third party (Like Apple - which is why Macs are so Virus free*) which can annoy users when they can't run their application.
*They aren't, I know, but their software limitations are what keep them at their virtually safe status.
You still need to run anti-virus on Windows 7."
Or, alternately, DON'T INTENTIONALLY RUN VIRUSES ON YOUR COMPUTER. Geeze.
On what OS can you run viruses written for that OS, which will not run? RTFA; they ran virus.exe on Windows 7 and were gobsmacked that they ran. This is FUD and/or a slashvertisement for Sophos..
// MD_Update(&m,buf,j);
...software written for Macs...
You lost me here. Is there a Wikipedia entry you could point to?
The ______ Agenda
Well, yes seeing as the whole purpose to upgrade is to be able to have little or no security issues, and no need for AV.
Cancel or allow, so what, it is bypassed, so I will just stick with XP seeing as I already have my license and already have my Av on it.
M$ needs to come out with an OS that has no possibility of being owned by a virus, sort of like linux does, linux only has rootkits. Sysinternals is good for rootkit detection and is owned (now) by M$, so if they could tweak their OS to be more like linux, we would all be in a safer place.