Slashdot Mirror
Microsoft: One In 14 Downloads Is Malicious
alphadogg writes "About one out of every 14 programs downloaded by Windows users
turns out to be malicious, Microsoft said Tuesday. And even though Microsoft has a feature in its Internet Explorer browser designed to steer users away from unknown and potentially untrustworthy software, about 5% of users ignore the warnings and download malicious Trojan horse programs anyway. IE also warns users when they're being tricked into visiting malicious websites, another way that social-engineering hackers can infect computer users. In the past two years, IE's SmartScreen has blocked more than 1.5 billion Web and download attacks, according to Jeb Haber, program manager lead for SmartScreen."
These are the same folks that only change the oil in their cars when the warning light comes on.
On the list of malicious files, as determined by the Microsoft Corporation:
- Google Chrome
- ubuntulinux.iso
- antivirusotherthansecurityessentials.exe
- iTunes
- *ipod*.exe
- gmail.com/index.html
1. Ubuntu
2. Firefox
3. Chrome
4. OpenOffice
5. VLC
See my blog http://ilovecookes.blogspot.com/ for light hearted technical information.
I didn't realize IE was downloaded so frequently.
"Our goal each year should be to increase the number of goals we set for ourselves!"
Why does MS even have these stats?
"About one out of every 14 programs downloaded by Windows users turns out to be malicious, "
Windows or IE?
If windows, how are they collecting these stats?
Comment removed based on user account deletion
Despite Microsoft's attempts to completely nanny people, they've almost taken it too far ... which means that people start ignoring/disabling the warnings.
The other week I launched IE on a new server install ... the very first warning message is "You are about to access the internet, and people can see what you do" -- which gets a "do not show me this again" before I dismiss.
As soon as you submit into a search engine, you get told "You are about to submit something on the internet, are you sure" -- which also gets a "do not show again".
By the time I tell it I don't want it to save passwords, autocomplete forms, and that, yes, I really do want Google as my default search ... well, I've stopped listening to anything "helpful" IE is telling me.
I rank the utility of the stuff that MS has "designed" to make IE safe right up there with the error messages that amount to "something bad has happened, contact your admin" --- oooh, that's informative. And, since I'm the admin ... give me some f'ing idea as to what went wrong so I can try to fix it.
Microsoft build in really pedantic and lame safeguards, which get turned off and/or ignored for the rest of time since they don't actually do anything useful.
Lost at C:>. Found at C.
Seriously only 5% of people ignore warnings? I would have to say about 75% of people I have seen download regardless of if you say "warning this will completely reduce your computer into a pile of steaming dung" in exchange for a screensaver with kittens, and then if you cut it down from that to IE users... well then I'd put that number closer to 95% would ignore the warnings.
and yes that means I use IE. But, when it consistently tells me things like Downloader_Diablo2_enUS.exe can harm my computer after downloading it from battle.net I tend to not believe in its ability to really determine if something is malicious or not. As always, proper instruction on internet safety will go farther than a security feature that any idiot can bypass.
Only for very blatant lies. Otherwise I would be suing damn near every company that ever had an advertisement.
Without administrative access, how would "an user" (anything like "an hero"?) install an application that is useful and not malicious?
Millions of people do it daily. The walled garden has its benefits.
The soylentnews experiment has been a dismal failure.
"IE's SmartScreen has blocked more than 1.5 billion Web and download attacks" How many of these were actually factually malicious? Perhaps that is why people are ignoring the warnings? You can block (nearly?) 100% of malware by simply being Amish
Just tell "make install" to put it under your $HOME.
Installing an application does not need admin access unless you need it to be available for everyone.
Is to block every 14th download, thus making Windows malware free!
Interesting point and I'd like to read that professor's work, but I don't believe online services are flourishing for security reasons, but rather that it's coincidental from the average user's perspective. The whole point of this story is that people are not aware and knowledgeable enough about technology and security, so I doubt they factor it in highly enough to use it in their decision to chose an online service.
Security is rarely mentioned in the list of features of these services: nothing in Flickr, Picasa, or DropBox other than to discuss how files you upload can be shared selectively rather than be public. DropBox doesn't turn up anything when you query for "virus" in the help section (and even suggests disabling your anti-virus to solve a connectivity problem). Even Google Docs which has drawn much concern on data security neglects to reassure you that documents you upload are properly safeguarded, and doesn't guarantee that downloading an MS-Office version of a document is devoid of malicious code which may have been uploaded by whoever shared it with you. There's far more concern assuring you that they perform backups and that your data won't be lost. Twitter mentions security only in the context of safeguarding your account from hijacking. Facebook's "privacy" aspects are obviously not worth mentioning and where they mention it it's due to bad publicity, not a way of attracting users away from MySpace by being a safer platform. It has taken major Twitter/EC2/PSN outages for people to even realize there's a risk in relying on online services, which still isn't being discussed in these feature sets- public understanding of availability is as meager as security.
There's certainly a risk and possibly even this hidden cost you're suggesting in using proprietary online services, but I don't see that they are being used to avoid downloading an executable file, or otherwise provide any such protection against browser-based attacks. To the contrary- all of the above popular services except for Google Docs actually encourage or even require (DropBox) users to download binaries (in the case of Facebook/Twitter mobile apps), and Facebook users are clicking random links to the same kinds of nonsense they had been getting in their email.
No, it would not require applications to be designed for this.
Applications should not be installing themselves at all. Installation is the job of other system tools, not the application itself.
You are correct that you would need to do that, but that is pretty much an install task anyway.
Yes, user-mode programs should install into %LOCALAPPDATA% unless being installed for all users. Chrome, for example, does this correctly, which is why you do not need admin credentials to install it.
If you don't know where you are going, you will wind up somewhere else.
I love that analogy because those of us who resist FaceBook and deal with the marauders are knights.
For all intensive purposes, "whom" is no longer a word. That begs the question, "who cares"?
For example, email. On a personal level many of my friends and family have stopped using it and require me to communicate via Facebook. The problem for me is that I don't have a Facebook account. The problem for them is that they don't want spam.
Huh? The vast majority of what shows up on Facebook is spam. OK, maybe not in the traditional sense given the spam is whatever inane thing someone decides to post rather than a Viagra ad. Oh, you mean the private message thing that no one seems to know how to use because they post conversations in their statuses?
This post comes with a double-your-money-back guarantee!
Any offense taken to this post is at your sole discretion.
Comment removed based on user account deletion
The majority of downloads on our Windows computers seem to be Microsoft patches, so 1 out of 14 being malicious sounds about right.
By "application", I mean everything in the .deb, .rpm, or .msi package
Then why didn't you say that in the first place? Instead, you argued the man down by essentially saying "a package designed to be installed by root has to be installed by root". Just admit you're arguing the wrong point instead of backpedaling and you might leave with some credibility intact. He was obviously referring to software compiled from source 99 percent of which can be installed in $HOME without root powers.
The soylentnews experiment has been a dismal failure.
Name an actual malicious App from the app store.
Go ahead.
I'll wait right here.
These are all policy violations and nothing else.
Please note I have no skin in this game except laughing at the Windows idiots trying to plug their ears and blind their eyes to the biggest problem in the Windows software universe - that of untrusted repositories.
Your post screams so much denial it's funny.
1 in 14. Not my statistic, Microsoft's. Almost 6 billion malware definitions.
Remove the fucking tree from your eye before pointing out the speck of lint in Apple's or Linux's. Only the most rabid and stupid softie would ignore these statistics and say "hurr everyone else is just as bad off." No, we're not as bad off as you. And we're laughing at you. Laughing as you try to spin this. And the more you spin, the more we laugh at the little retard.
--
BMO
Just admit you're arguing the wrong point
I hereby apologize for having argued the wrong point. Please allow me to rephrase: Almost all existing packages are designed to be installed by root.
erdraug: One in 14 computer users is computer illiterate.
Here is a test for you if you have bandwidth and can stop laughing after a logical period. Obviously it is a FIRMWARE UPDATER, don't actually run it!
Help doc (from a company who is very close to MS and others)
http://seagate.custkb.com/seagate/crm/selfservice/search.jsp?DocId=215451
Exe file (as I said, just don't run it!)
http://www.seagate.com/staticfiles/support/downloads/firmware/MomentusXT-ALL-SD25.exe
Idiots didn't even create a mechanism to alert false positive so we, "dumb users!" ignored the warning after doing a Kaspersky and Virustotal scan and run it.