Slashdot Mirror
In Test, Windows 7 Vulnerable To 8 Out of 10 Viruses
As Windows 7's market share passes 3.6%, up from 1.9% the day before launch,
llManDrakell notes an experiment they did over at Sophos. They installed Windows 7 on a clean machine — with no anti-virus protection — with User Access Control in its default configuration. They threw at it the next 10 virus/worm samples that came in the door. Seven of them ran; UAC stopped only one baddie that had run in the absense of UAC. "Lesson learned? You still need to run anti-virus on Windows 7."
Anyone who uses any computer (including Mac AND Linux) without anti-virus is asking for what they get. Especially with the number of good free anti-virus programs available for Windows, there is no excuse not to have one either way. I use Avast Home Edition. It's free (just registration required), fast, and small-footprint. Even if 9/10 viruses would be blocked by UAC, an anti-virus program that blocks the last one is worth it.
Is this supposed to be a surprise?
For one, they watered down UAC. Second, UAC won't do anything if the virus simply attaches itself to your user account, instead of the whole system. UAC is supposed to help keep malware gaining admin rights and infecting your system, not to stop it from running.
Next you'll be telling me that 8 out of 10 people who have unprotected sex with HIV-positive, syphilitic, sore-encrusted prostitutes will contract some sort of venereal disease.
So, for (1) Windows 7 is very similar to Vista, with a lot of code reuse, and (2) the people who develop viruses target *almost exclusively* windows, so how would the need to run an antivirus on a new version of windows ever be something you would doubt?
~dijjnn
Windows 7 had 1.9% market share before launch?
So 8/10 viruses don't require administrator permissions and conform to Windows development standards. If only the rest of the software industry had such high standards.
New tests show that software written for Windows runs on Windows! Copycat studies have also shown conclusively that software written for Macs run on Macs and software written for Linux runs on Linux! More at 11.
I'm running several macs, both at home and at work, and the only time I've ever run an anti-virus on any of them was at the request of my ISP last month - there was a report of a virus originating from my home IP address. I downloaded and ran the latest ClamAV, and of course there was no virus on the machine, it was a spoofed IP address...
Over the past 5 years, that's the only time I've ever run a virus check. It came up with 0 viruses. I conclude that the likelihood of me getting a virus on a mac is still small compared to my XP box, which every time I run a virus check flags *something* new as wrong/suspicious. Sometimes I can even tell if the something is innocuous or dangerous...
Slashdot likes to say that anecdotal evidence is meaningless (which of course it is), but when a sufficiently large collection of anecdotes all say the same thing, we call that consensus. The general consensus is (I believe) that Macs are a lot less likely to be infected than Windows boxes, so your 'Anyone who uses any computer (including Mac AND Linux) without anti-virus is asking for what they get' statement is in fact news to me.
Simon
Physicists get Hadrons!
Bullshit. Microsoft made the same claim when they made the switch from 16-bit to 32-bit - "Viruses will be a thing of the past." 64 bits is not "magic pixie dust" - it's just the size of a native integer or memory pointer on your cpu.
no, majorme is right... 64-bit does make a big difference since you're not allowed (even as an admin with elevated privileges) to run kernel level code that's unsigned. 64-bit Vista/Win7 is more resilient to malware than 32-bit Vista/Win7.
Did the account set up on Vista / Win7 have an administrator role, or was it a "normal user" account? By not disclosing that, Wisniewski is only giving us half the story.
!#@%*)anks for hanging up the phone, dear.
So in Vista, UAC had only two settings: On and off. When it was on the system functioned with real separate privileges. You had to escalate to perform administrative actions. Ok well people bitched and whined and bitched and whined about that since you had to do it for things like changing file permissions or accessing system control panels. Thus Microsoft relented and watered it down for 7, having two settings in between on and off. It is set to one of those by default. More or less it asks for permissions for a program trying to get admin access, but not a user initiated operation.
Viruses use security holes to get onto PCs in the first place - once the virus is running on the PC, it's got free reign. There can be absolutely no security vulnerabilities on a system and the virus usually still do what it wants if it's preloaded onto the system.
You don't need administrative privileges to do many things that viruses want to do (eg. send mail, monitor keypresses). They ran the test by loading the virus onto the machine, then letting it execute. That doesn't demonstrate that the system is full of holes - it demonstrates that the system is very good at backwards compatibility!
Agreed, to know whether this is scary would require me knowing whether these were drive-by exploits or require me being stupid enough to run their virus.
I'm pretty confident in my ability to avoid the social networking sort of viruses. It's the drive-by exploits that I'm concerned about.
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
They could have at least tested it with Security Essentials . . . it's freely available to Windows users.
And yet the post at the Sophos blog says: "On October 22nd, we settled in at SophosLabs and loaded a full release copy of Windows 7 on a clean machine. We configured it to follow the system defaults [emphasis mine] for User Account Control (UAC) and did not load any anti-virus software." The point is that they installed Windows with the defaults like 99.999% of the users out there would do.
My mom is probably a typical Windows user, and when she eventually installs "the new Windows", I'm willing to bet she'll just go with the defaults. Because it's easy. So if the default install of Windows 7 doesn't include & configure Security Essentials by default, then this test reflects what real users will see.
Sure, they could have done a followup test to install Microsoft's Security Essentials, then see how that would have fared with the same 10 viruses. But these guys sell their own anti-virus software, so I don't really expect them to take the extra step.
In other news, running "sudo rm -rf /" as may cause migraines in up to 90% of linux administrators.
XML is a known as a key material required to create SMD: Software of Mass Destruction
Slashdot should have a Wall of Shame for programs that are like this.
Kodak Easy Share is my pick.
It's NOT me! It's the meds! I'm on 1000mg of Fukitol.
Seriously, this guy is almost pathological in his determination to distribute as much FUD as possible about Windows.
Taco: Fire this retard. The stuff he posts is NOT news for nerds. It is thinly veiled, and ineffective, smear pieces. Real stories about OS problems are interesting. Kdawson's FUD isn't.
Sophos was testing Windows 7 in its default configuration. I don't know if the Firewall is enabled on a default install, but I suspect it probably is based on the defaults in XP Service Pack 3. If it's not, then the firewall is going to be irrelevant to a good number of users who are also likely to run Windows without AntiVirus on board. If it is, then it's not providing any protection to speak of, apparently.
One of the tests failed, not because Windows provided protection, but because the virus itself wasn't Win32 code. I'm sure the developers of Bredo-M are on it and will have a fix out soon.
Particularly disappointing in this test, however, was UAC's failure to protect against all but one of the eight buggers that did try to run in Windows 7. That is/was supposed to be Microsoft's response to allowing most applications to run as Administrator rather than a limited user (thereby enabling or even encouraging the existence of a large base of applications that REQUIRE Administrator access).
"This post contains words, known to the State of California to cause thought. Wash brain thoroughly after reading."
Antivirus software vendor has reached the conclusion that you still NEED antivirus software.
This article is not saying Windows 7 is insecure. You couldn't even come to that conclusion if you look at what they did. They ran untrusted code known to contain viruses on a Windows 7 machine. UAC only blocked those that tried to perform administrative tasks, which is what its job is. They did not try to do remote infection.
I could write a virus attached to an executable that deleted your favorites file or all of the documents in your user's document folders. This would still be a nasty virus and would not be classified as an administrative activity, thus not triggering UAC. This would not indicate any flaw in the OS or it's level of security. This is no different from any other platform, running as admin or not, if you run untrusted code, it will be able to do anything your logged in user can do.
The point of the article is that people should not pretend UAC *is* virus protection. Microsoft doesn't market it as virus protection, and people shouldn't be under the impression that UAC prevents viruses from running.
It could also just as easily read: "Two out of every ten virus writers deploy their work without testing it first."
Side thought: Of course, this WAS written by Sophos, an AntiVirus marketer. One could hardly expect them to choose viruses/worms that cast "naked Windows 7" in a good light, now could they?
"This post contains words, known to the State of California to cause thought. Wash brain thoroughly after reading."
... you can use your preferences to choose which authors you do or do not want to see stories from. If you dislike KDawson's choice of stories so much, you can opt to not display them. Hell, you have a lower UID than I do, and this feature has been available for the entire time I have been a member here. Why you don't know about it is beyond me; why you opt not to use it is even more of a mystery.
Or you can just continue trolling. The choice is yours.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
You still need to run anti-virus on Windows 7
There's a classic example of abductive reasoning. I do not have to run anti-virus on Windows 7 because I don't, nor do I ever plan to run Windows 7.
Windows 7 has a whitelist (based on authenticode signatures) of programs which are allowed to automatically elevate. However, it also has mandatory access controls, which segregates programs into different integrity levels. When UAC elevates a program, it is placed in a high integrity level. Lower integrity levels aren't allowed to inject things like keystrokes into higher integrity levels.
So you are somewhat right, but mostly wrong. Malware could trick a trusted program into bypassing UAC and autoelevating, but after elevation the malware won't be able to interact with the trusted program anymore. And since all the trusted programs require a second user interaction before doing anything after elevation, tricking a part of Windows into auto-elevating doesn't help malware at all.
The facilities are there, in Windows registry and group policy for instance (Software restriction policy, I believe it is called). Some networks might even use those settings, but in general it's FAR FAR too much hassle (especially for a home user). Some software firewalls even work this way already too - I know that pay-for versions of ZoneAlarm come with signature checking of the most popular apps and allow users to black/white list them from accessing the Internet/local network.
The problem is that people would still authorise the same crap as they do now to run because they just click yes when they see a security dialog. And every time that software is updated (as specified by good network practice), you have to update all the signatures again (and query the user again, who gets bored/annoyed and just keeps clicking Yes). And most viruses on home machines are because people *chose* to run a program that they didn't know the origin of, either by downloading, clicking I Agree or turning their security settings off. And viruses still get through program exploits (macro viruses would be one old example - they appear to be Microsoft Word, which would obviously be "allowed" on the whitelist).
Also most "whitelists" can usually be hacked / added to by the virus itself if it gains the permissions of the user (how else would the user authorise it to run?) so they again become useless. There are ways around this but they all annoy the user.
Basically, either these schemes stop everything working (and users cry foul every time they want to run something new or update their software) or throw so many "Do you want to allow this?" dialogs at the user that they quickly disable it or just click Yes to everything when they want run their spiffy new download from disreputable sites.
Network admins find it far too much hassle to exercise this level of control because of the problems it can cause (basically, users want to be able to run arbitrary code under their user accounts).
The problem is not viruses, or the whitelist/blacklist, the problem is providing glaring holes in the OS, running as administrator (or making privilege escalation trivial) and running programs that you don't know the origin of. Stop those three things (the easiest of which is just to stop people wanting to run every program they download) and you stop the problem of computer viruses. Whitelists just make that a little trickier, but always provide an avenue to either bypass the whitelist (by the program itself inserting itself into the list, like Windows Firewall allows in some Windows versions) or piss the user off with so many dialogs that they turn the security off / click Yes to everything each time (Windows UAC).
A machine without AV is vulnerable to viruses!
News at 11!
Talk about a useless piece of FUD...
My Linux, Solaris, HP-UX, and OpenBSD machines don't run antivirus software. Yet they have never had a virus.
It's not the 'machine' that gets the virus, it's the badly written operating system.
So...what's the best anti-virus software for Windows 7?
Disconnect it from the network.. You asked..
"Lesson learned? You still need to run anti-virus on Windows 7."
Or you could start by turning up the UAC level.
People complain that UAC in Vista was too intrusive, so MS turned it down by default. Now people are complaining that it doesn't do enough.
They got some malware, and ran it. If these malware did not need elevated privileges, they are expected to run. You download a bash script from the net that goes "\rm -rf ~" and then complain that your $home is hosed? I am not sure the test is fair. Did the malware get root privileges? Did they do any damage that simple plain process with user privilege could not do? Unless such things happened, this test amounts to nothing more than testing backward compatibility of some old binaries in new OS. Duh.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Just recently had to edit the Host file. (Local DNS file).
Could not save it because of UAC, and didn't get a UAC prompt either, had to give up and disable UAC first.
I thought it was common knowledge that viruses dont need admin to do a large number of things? I could swear this comes up every time arguments about whether linux can get viruses start. Viruses dont need admin to auto run (users can have per-user settings on that), send packets, send email, launch popups, install BHOs, install firefox addons, read files, etc etc etc.
The things "non-admin" stops are the important things, like installing drivers, installing rootkits, installing LSPs, hooking system files, patching system files, etc etc etc. THOSE are all that matters. If you have a computer set up for the family to use with a non admin account (on XP), the point isnt that you think itll prevent them from getting crapware, its that the crapware wont affect other parts of the system (hopefully).
Its also a hell of a lot easier to remove viruses installed with non-admin priveleges-- the difference is night and day. Non admin viruses usually just stick a single entry (maybe 2) in the startup list, and SysInternals Autoruns or HijackThis cleans that in about 15 seconds. Admin-installed viruses tend to take on the order of 15-30 minutes of manual removal, or booting into linux, or running combofix, or some combination of the 3, and if you screw up once and miss a file the whole thing reinstalls.
FWIW Im an IT consultant (part of my job is helpdesk) and I have yet to deal with a nasty virus / rootkit on Vista. XP on the other hand, I've seen viruses that took 45 minutes to remove even with tools like SDFix, the SysInternals suite, and launching ubuntu to manually remove the infected DLLs sorting by date.
You still need to run anti-virus on Windows 7."
Or, alternately, DON'T INTENTIONALLY RUN VIRUSES ON YOUR COMPUTER. Geeze.
You still need seat belts in cars with airbags, fire departments for neighborhoods with fire resistant code compliance, and ambulances even if a doctor lives next door.
I mean, really . . . this is stupid.
I dont recall seeing MS claim win7 was virus proof...
Flappinbooger isn't my real name
On what OS can you run viruses written for that OS, which will not run? RTFA; they ran virus.exe on Windows 7 and were gobsmacked that they ran. This is FUD and/or a slashvertisement for Sophos..
// MD_Update(&m,buf,j);
This is proof slashdot is biased, do you notice how slashdoters like to pick on Windows? You'd never see an article talking about people having problems with Ubun... wait... fuck...
But... the future refused to change.
Hitting Google is apparently easier than doing research. I went through the articles on your "osx+virus+in+the+wild" link, and what I found on the first pages was...
None of these (except possibly Inqtana-A) would be a threat to semi-competent users, and the only article that isn't from 2006 is the garbled wiki page.
Now if you want some actual research on Mac OS X viruses, you can check a vendor's site:
http://www.sophos.com/security/analyses/viruses-and-spyware/search-results/?search=OSX&action=search&x=0&y=0
Interestingly, what the site won't tell you is that most (if not all) of these viruses are phantom menaces; you have to Google each one yourself for that kind of detail. Many are proof-of-concept never seen in the wild, and most exploit holes already patched in the OS. All are trojans that require serious PEBKAC to run, even the only two known "worms" for the plantform -- Inqtana and Tored.
Inqtana, a virus one that got some notoriety and media attention is an example of all three -- a proof of concept (with an expiration date) that attacked an old hole in the Bluetooth stack and which required victims to consent to accept the download from an infected machine. Tored was an email worm that required you to execute an attachment on a very stupid looking spam email payload. Both are basically glorified trojans -- nothing on par with Conficker.
Now, trojans aren't complete non-issues, but savvy computer users currently have very little to fear from running a Mac w/o AV software since there are currently no self-instantiating viruses for the platform in the wild. Don't download pirated software (and risk something like iWorkS which hides itself in installers for certain programs), and don't trust installers where none should be present.
If it's for-profit but free, you're not the customer -- you're the product (e.g., the Slashdot Beta's "audience").