Microsoft Talks Back To Google's Security Claims

Kilrah_il writes "Yesterday there was a piece about Google ditching Windows for internal use because of security concerns. Now Microsoft is fighting back, claiming its products are the most secure — more than Google's and Apple's. 'When it comes to security, even hackers admit we're doing a better job making our products more secure than anyone else. And it's not just the hackers; third-party influentials and industry leaders like Cisco tell us regularly that our focus and investment continues to surpass others.'"

Comments

Some Helpful Advise

[eldavojohn]

When it comes to security, even hackers admit we're doing a better job making our products more secure than anyone else.

Hint: Your worst nightmares do not have open jovial dialogues with you. And if they did communicate with you or offer you a score card or report, they would want you to feel as though you are completely safe -- totally unaware and unprepared for what you may face.

You've come a long way, Microsoft, but you have much much further to go. If you measure security by percentage increase in security then the evolution from Windows 95 to Windows 7 is nigh impassable. But that in no way means you're number one in the security scores. Run your marketing campaign with setting the "facts" straight but people like me know. With what little (journalistic) evidence you presented, there's no way I can build a conclusion that backs up your statement. And there's no way around that. It would better prepare you to look into the several thousand anecdotes found daily revealing the issues with Windows and Internet Explorer.

Re:Some Helpful Advise

[micheas]

I seem to remember the person that won the P0wn20wn contest stating that there are several security enhancements with regards to the memory stack that are not present in OSX but are in FreeBSD, Linux, and Vista.

But this may be things like the windows login being provably secure, but the firewire driver allowing you to end run the login screen.

Windows has security features that on paper make it look like it could be a very secure system, the problem is that once you have locked it down to use all the security features, you probably have to write your own applications, as most off the shelf windows software does not run in that type of environment.

Re:Some Helpful Advise

[dAzED1]

tired response is tired.

The money is on UNIX systems. That's where the large banks are running their transactions, where stock is being traded, where the military is running it's services, where engineering designs are stored, etc. omgponies you hacked grandpa's 10 year old computer, and added it to your botnet...just what did that get you, really? For just a few $k a month I could build an ec2 cluster that would destroy any botnet in sheer computing power...mostly because I wouldn't have to deal with crazy queing mechanisms, or nicing the tasks down enough to not be noticed by the user.

The reality is, more than anything this tired "people hack windows boxes because they can win more" response pretends to suggest, that UNIX is phenominally more secure on a basic, fundamental, architectural level than Windows. Out of the box, I can trust an app on a RHEL os. Out of the box, I can't even plug a windows machine in to a network without being behind a firewall. I've literally seen, with my own eyes, windows machines get compromised in less than 20 minutes of being online. Sure sure, sample sizes and all that...except, I've also managed hundreds of unix machines at a time without any concerns on them.

Security?

[WahCheng]

Security is NOT about patching holes, a system must be designed from the ground up to be secure. Doze and it's predecessors were NEVER designed this way. Mind you, it's created one hell of an industry patching holes.

Re:Security?

[MrEricSir]

They've added a lot of security. For example, when I debug an application on Windows 7, I have to click four dialog boxes instead of just one. If that isn't real security, I don't know what is.

Re:Security?

[WrongSizeGlass]

They've added a lot of security. For example, when I debug an application on Windows 7, I have to click four dialog boxes instead of just one. If that isn't real security, I don't know what is.

Well, four is greater than one. A car has four wheels and a unicycle only has one. A car is more secure than a unicycle. In fact, in a collision between a car and a unicycle the passenger(s) in the car will always be safer - even if the car isn't moving. Based on the preceding car analogy I can confidently declare Windows 7 is more secure than a unicycle.

Cisco

[abigor]

Well, I can tell you right now that a lot of Cisco's engineers use Macs, and server-side it's Linux. That said, I imagine Cisco management, marketing, etc. are mostly Windows-based.

Re:Cisco

[ThePhilips]

That resonates with my own reading of the quote: all companies who are on the receiving end of M$' security investments praise the investor.

And obviously anti-virus companies would tell that Windows is better: without the swiss cheese OS they would be out of job.

Microsoft?

[Anonymous Coward]

Secure products?

Crap.... woke up in the wrong universe again.. I hate when that happens.

Focus and Investment

[Weaselmancer]

Nice zero content marketingspeak there:

"...third-party influentials and industry leaders like Cisco tell us regularly that our focus and investment continues to surpass others."

Focus and investment. Notice "results" aren't on that list.

As a side note, I'd also like to add that lately BP has had a huge focus and investment on cleaning up oil spills. More so than any other oil company. But still - nobody loves them this week. Wonder why?

Hi, I'm a hacker...

[thestudio_bob]

Hi, I'm a hacker and Windows 7 was my idea.

Uh huh

[starfishsystems]

Right. That's why there's no longer any market for third-party virus checking on the Windows platform.

And all those idiotic corporate restrictions on email attachments can go, too. That'll be a great relief, because right now I can't even attach a zipfile without Outlook complaining about it.

And those flashes of screen content that appear when I reconnect to a locked Remote Terminal session, those are just in my imagination. No information exposure there, any more. Good, cause that was really stupid. Wait, I'd better check. Nope, still there.

And those irritating and needless messages requesting permission after I've launched an Active Directory management window, those are gone too, right? Because now the system has finally caught up to the X Window System technology available back in 1993?

Oh, no. Actually, I just checked, and it hasn't.

Wow, Microsoft. I am impressed. You actually drank the kool-aid to prove that it was harmless. Except that it's not.

Vista reinstall

[NetNed]

I did a reinstall on a Vista machine recently for a friend. 100+ windows critical updates later and it was done! Really, the install itself took a fraction of the time that all the updates took. I guess if security is measured in security updates, you win Microsoft. Now claim your paper hat that says "We Won!"

Re:Keep saying it and one day it might stick

[Dynedain]

Where are the equivalent virii in 2010? I remember Code Red and Slammer and the really malicious code that was raping any system stupid enough to expose 135/137 and 445 to the world. I don't remember any malware of that league in recent memory.

That's because modern spyware is more focused on hijacking your machine to be part of distributed botnets. That means you don't want the user to realize the machine is compromised. As such, vandalism is less prominent in favor of the lucrative enterprise of selling access to the botnets.

Microsoft products are the most secure lawnmowers

[davecb]

Poor chaps, they can only make a "c2" grade in the old orange-book (U.S.Department of Defense) grading by removing the networking, while a mainline Linux distro hits b1 (courtesy of the CIA).

--dave

Re:Both have problems

[Kitkoan]

I always figured they hacked the prize they valued most and that's why Windows was on the bottom of the list.

Wrong. They always hacked the Mac because Apple is way easier to hack then Microsoft

From the links article:

This came in via e-mail: Many pundits have made a lot of the fact that the Mac was the first to be exploited in the Pwn2Own contest. Was the choice of the Mac as the first target because the hardware/operating system combo was more desirable as a prize than the commodity Windows laptops of the other competitors? Or was it just because Macintosh exploits occur with much less frequency than Windows exploits and would therefore be more newsworthy?

So until this year, applications on Apple were way easier to exploit than Windows. This is because Apple had weak ASLR and no DEP while Windows had full ASLR and DEP. This year, Snow Leopard has DEP, so its no longer trivial to exploit. In fact, I have lots of bugs in Safari that I easily could have exploited on Leopard but will be very difficult on Snow Leopard. So it used to be that that it was much worse, but now its mostly comparable (although still slightly behind)

And this is from Pwn2Own 2010.

Re:Both have problems

[symbolset]

So what you're saying is that for the last two years Pwn2Own has been some sort of security Special Olympics? That's actually very interesting.

Did they ever have a BSD?