How Windows Gets Infected With Malware

Orome1 writes "Since Up to 85 % of all virus infections occur as a result of drive-by attacks automated via commercial exploit kits, CSIS has actively collected real time data from them for a period of three months. The purpose of their study is to reveal precisely how Microsoft Windows machines are infected with malware and which browsers, versions of Windows and third party software that are at risk. They monitored more than 50 different exploit kits on 44 unique servers / IP addresses. The statistical material covers all in all more than half a million user exposures out of which as many as 31.3 % were infected with the virus/malware due to missing security updates."

Comments

70% on fully updated installs.

[140Mandak262Jamuna]

Salient point is that, fully updated and patched installs let 70% of the infections through.

Re:70% on fully updated installs.

[houstonbofh]

Mainly because the technology is reactive. We have to see and attack before we can guard against it.

Re:70% on fully updated installs.

[Moheeheeko]

The day that people stop clicking on "want bigger pen0r?" or "see x clebrity naked here" links is the day that 30% jumps to 90%. The fact is is that a fully updated maintaned system is virtually malware proof if the user uses common sense.

Re:70% on fully updated installs.

[LordLimecat]

Even more salient is that only 13% of the successful infections relied on software that was Windows only (10% were IE exploits, 3% were Windows Help exploits).

All you folks encourgaging your friends and families to buy Macs for the specific reason of their security are in for a world of hurt in a few years when Mac hits ~30+% market share. Kits are already starting to appear.

Re:70% on fully updated installs.

[Dunbal]

Stupid users eh? Explain the following: Yesterday I visited the top site google provided for a search I did. I was not searching for anything particularly exotic or deviant, certainly not pornographic or illegal. Immediately on visiting the site with my Windows 7 machine, Microsoft Security Essentials pops up to alert me of a "severe" threat (Trojan:JS/BlacoleRef.A) it had located in my browser cache (Firefox 7.01). I did what the security program said, and it says the threat was removed. I have no idea if it was removed or not, my only choice with such an obfuscated, complicated OS is to assume that the tools I am given are not lying to me and are doing the job that they are.

However should I be infected in the above scenario, how exactly does this make me a "stupid user"? I've had a PC since the late 1970's. I can code in ASM, Cobol, Fortran, Basic, C, C++. I like to think I know how computers work. I don't click "Yes" to everything, and I don't run programs from dubious sources anywhere other than a virtual machine. Should I be going through my registry and boot files daily to not be a "stupid user"? Isn't that what an OS is supposed to do for me - take care of the basic functions of my machine while I run the programs I need? Are you just going to troll me by saying "use linux instead you noob"?

Re:70% on fully updated installs.

[Anonymous Coward]

You say:

Salient point is that, fully updated and patched installs let 70% of the infections through.

TFA says:

The conclusion of this study is that as much as 99.8 % of all virus/malware infections caused by commercial exploit kits are a direct result of the lack of updating five specific software packages.

Re:70% on fully updated installs.

[networkBoy]

But sadly, average users need better than this.
Everyone on /. is at least computer literate, likely has fundamentals of data and system level security, and understands the importance of backups (even if they don't do it, they are accepting a known risk).
The average user thinks that e-mails are private, that 'password' is a bad password but that 'pa$$word', 'mypassword', 'PaSsWoRd', and password123' are all good enough, and that their digital pictures are perfectly safe on their hard drive in their 5 year old PC that has never been opened and physically cleaned.

I also think Linux is bad for the average user, because while it is more secure than Windows by default, if you muck with it you can cause vastly more damage to the system if you are in the "just enough knowledge to be dangerous" camp. Ubuntu goes a long way towards this, but it needs an even friendlier interface (IMHO) for system setup and config. We won't get that till an OEM adopts it seriously for end user platforms.

I think the ideal solution is only now starting to be available (mostly to power users). Run everything in a VM jail. XPMode on Win7 is awesome for this. If only is was the default mode of operation, rather than limited to Pro and greater levels of the OS. And if only they made snapshotting and rollbacks easier (other guest OS's would be nice too).

-nB

Re:70% on fully updated installs.

[hedwards]

That's the theory behind Immunet, once one of the computers is infected by a new virus it's analyzed pretty much immediately and a signature is added before the virus has a chance to infect more machines. It doesn't stop new infections, but it does diminish the spread.

I'm not sure how well it ultimately works, but the basic theory behind it is sound.

Another thing that could happen would be for the ISP to throttle the connection back to dial up speed for infected computers downloading anything other than antivirus software. The main concern I'd have there would be false positives and the inherent reward of throttling users.

Re:70% on fully updated installs.

[minstrelmike]

You guys aren't supposed to read between the lines. Stats are supposed to obscure facts, not detail them so even a manager can figure it out.

Re:70% on fully updated installs.

[UnknowingFool]

But aren't you assuming that the other 87% are fully cross-platform? For instance Java and Flash vulnerabilities exist in both Linux and OS X but don't result in the same issue as those platforms are different. For example, a Flash vulnerability may allow the execution of a bundled .exe file; however that does nothing for Linux/OS X users. For them they would have to get scripts and even then bypass any default settings that don't allow scripts to run automatically.

Re:70% on fully updated installs.

[houstonbofh]

Are you just going to troll me by saying "use linux instead you noob"?

User Virtual Box to browse, you stupid Noob! :) It is actually almost to this point. Some of the exploits even work on Linux. Only as the running user, however, so a root exploit means you were a stupid Linux noob running as root. (So far anyway. Tomorrow may be different.)

Re:70% on fully updated installs.

[CadentOrange]

Your anecdote perfectly illustrates why we need to run AV scanners on our machines. It doesn't matter how careful we are, we are not immune to drive by attacks. At this point, the typical slashdot response is "Run AdBlock/NoScript". This doesn't always guarantee that you'll be safe because what happens if the "safe" site you regularly visit has been compromised and the script you're about to allow is no longer safe? AV packages add another layer of defense, and this is a good thing.

Re:70% on fully updated installs.

[rsilvergun]

"my Windows 7 machine ... how exactly does this make me a "stupid user"?", well, there's your answer

Sorry, I kid, I kid. But seriously, I feel your pain. My brother put a virus on my PC when he viewed a video about how to teach a kid to ride a bike. Go figure. What I've taken to doing is doing my web browsing in a Vitual Box running Ubuntu + Chrome. It's pretty bullet proof, and even if it gets through it's tough to get out of the V-Box (Yeah, I know it can be done, but who does it?).

Re:70% on fully updated installs.

[spottedkangaroo]

Unless the scanner didn't know the virus yet. I think you'll find that they don't know about anything from the last month or so. If you check virus total with the various binaries you collect on a mail server, you'll find that literally *most* of them don't get caught in any consistent way by any majority of the virus scanners listed there. It's not just that virus scanners suck, it's that the don't work for anything but the oldest stuff. So I hope UAC can do the job and it isn't a userspace malware setup.

Re:70% on fully updated installs.

[houstonbofh]

I also think Linux is bad for the average user, because while it is more secure than Windows by default, if you muck with it you can cause vastly more damage to the system if you are in the "just enough knowledge to be dangerous" camp. Ubuntu goes a long way towards this, but it needs an even friendlier interface (IMHO) for system setup and config. We won't get that till an OEM adopts it seriously for end user platforms.

I have set up a laptop for 2 different client's wives with Ubuntu. Both were non-computer experts, and kept getting every infection known to man. After setting them up (Over 2 years ago) I never say those laptops again. I still see the clients, but they say the laptops are running perfect. Lost a lot of business there, and from happy clients. :) Ooops...

Re:70% on fully updated installs.

[Krneki]

It helps, but what can you do if you favorite site serves infected 3rd party adds?

P.S: I do use noscript.

Re:70% on fully updated installs.

[ackthpt]

To think with GUI Operating System versions it began with Microsoft's rather optimistic view, with regards to ActiveX, nobody on another networked computer would every think of invading your computer, manipulating it, installing software on it and controlling it.

Big fan of OTR and impressed when I heard a radio play from the 1950's which predicted unprotected computer hardware being infected... so the concept wasn't new.

I also spent my early years on a mainframe system, where we were always vigilant to keep aspiring computer science students from exploiting security holes in software and operating system (the fake login program, these days called a Spoof, was a standard entry point for most.) We had pretty hardened systems by the mid-80's, when the mainframes were starting to be replaced by PC-servers.

I still have this nagging feeling that prevailing attitudes, not just at Microsoft, but among a large number of developers is, "Nah, nobody'd ever do such a thing, so I won't bother trapping it."

Re:70% on fully updated installs.

[AJH16]

An interesting thought, but something seems fishy there. How does immunet tell that a particular piece of malware is malware? If it can tell automatically, then why not simply prevent it in the first place and updates are not necessary as you now have the perfect AV. If you can't tell automatically, then it relies on an end user to recognize and prevent infection. At this point, it is really relying on the end user and is not really any better than conventional AV.

Re:70% on fully updated installs.

[beelsebob]

Tbf, a large number leveraged flash and acrobat reader. Flash is not installed by default on Macs any more (though is likely to be installed as there's no alternative), acrobat reader is not installed, and is unlikely to be installed due to the existence of preview, and safari's native pdf rendering.

Re:70% on fully updated installs.

[blackicye]

Salient point is that, fully updated and patched installs let 70% of the infections through.

This proves that no amount of software development can overcome human stupidity.

I haven't used an antivirus program in over 15 years and have not had any infections in about as long. I do download a free trial of some random antivirus program every year or so and just do a full manual scan before I uninstall it though.

I like to tell people that the best antivirus that you can possibly install lies between your ears.

Re:70% on fully updated installs.

[oakgrove]

I used to do the bi-monthly schlep to my mother's house to clean off the latest Google-results-hijack/adware/trojans du jour. Finally one day I told her, "I got something for ya." Installed Ubuntu 10.04 LTS and haven't had a problem since. She's one very happy Linux user.

Re:70% on fully updated installs.

[jijacob]

The catch here is that *you* set the laptops up. Had you given the wives an Ubuntu CD and left them to their own methods, odds are they wouldn't be so happy.

Re:70% on fully updated installs.

[Hatta]

How many are let through with a fully updated NoScript?

Re:70% on fully updated installs.

[LordLimecat]

exe files arent materially different than Linux / Mac bin files-- if you can tell the OS to execute arbitrary code, the extension is hardly meaningful.

Regardless, thats not how those exploits work. Machine-code is somehow slipped through the plugin's security measures, and is executed (buffer overflow, etc). That code then downloads the actual exe and dll files that are set up as the permanent infection, and will often attempt privilege escalation at the same time (and if successful, will often overwrite the MBR with an infected copy). But it isnt like Oracle simply forgot to remove the "System.runWindowsOnlyExeFile" command, or the "system.IO.writeInfectedMasterBootRecord" command (really, who comes up with these names?)

If you doubt me, reviewing the attack methods of the past 4-5 years of Pwn2Own would be informative.

Re:70% on fully updated installs.

[LordLimecat]

Flash is also not installed by default on Windows, nor is Java (though your OEM vendor may slip it in on you). That doesnt matter; the first time the user visits youtube, they will get Flash, and that will likely be the version of Flash they have for the next umpteen months until their local friendly geek updates them. (does Mac system update cover java?)

Re:70% on fully updated installs.

[maxwell demon]

It helps, but what can you do if you favorite site serves infected 3rd party adds?

P.S: I do use noscript.

AdBlock Plus.

Re:70% on fully updated installs.

[ThePilgrim]

Except having it set up is how most people receive windows

Re:70% on fully updated installs.

[Synerg1y]

I think anon is referring to users who open email zip files from unknown senders and who don't bother to install an AV to start...

Being a coder doesn't make you a bad / good computer user... it's just different. By seeing the grains you may have trouble seeing the big picture. Security knowledge is what is required to know if your infected or not... or you can just trust MS... or you can not store anything sensitive easily accessible on your computer (cached browser passwords are a sec joke, you can google how to extract them... it works, I've had to help some "stupid" users who can't remember theirs).

I've known coders who can't set up their own environment, much less configure a computer (not saying this is you by any means). A browser is a ready made program, it has nothing to do with whether the user knows how to code or not (unless your making extensions) and the difference is how well you know the options, and a level deeper... what do the options do that is not listed in the UI, as in how do they tie together.

Lastly, if your truelly truelly curious and are willing to let your computer drive you crazy for a week or two, look into comodo anti-virus, it provides that granular view into the workings of your computer by blocking everything until you allow it (in the right configuration that is in their documentation), and if you don't know something is, you can google it, if google doesn't know, it's probably safe to block. On that note, I run security essentials, cause I'm way too lazy to care about little things like this, all my data is behind encryption mostly on external drives, nobody's going to write an exploit that can successfully get at that.

Re:70% on fully updated installs.

[JDG1980]

How many users are willing to have all websites broken by default until each one is explicitly whitelisted?

Re:70% on fully updated installs.

[Endo13]

And what's to say that same site didn't also have another infection that wasn't caught?

You make some very interesting points.

Re:70% on fully updated installs.

[Dunbal]

Being a coder doesn't make you a bad / good computer user...

No I agree. Especially if you learn to code in a cookie-cutter university environment. However I taught myself everything I know about computers back when computers were far simpler than today. I knew how to peek and poke to memory, deal with interrupts and DMA channels and even sometimes write my own drivers before most of today's coders left their diapers. I have intimate and fairly obsolete knowledge not only of CPU's and their supporting chips, but I understand on a fundamental level how a computer works, just like the first automobile owners back at the turn of last century had no need of a mechanic. But curiously operating systems (including linux) have become bloated. "Features" have become interdependent. I believe it's gotten to a point where one single person is now incapable of knowing all the little details of an OS and all the housekeeping it does in the background. So even someone who really, truly understands computers like myself can easily have the wool pulled over his eyes through some attack vector unknown to him.

look into comodo anti-virus

I tend to avoid 3rd party security software because of previous bad experiences with Zone Alarm and FreeAVG to name but a few (skipping over the obvious McAffee and Norton). They tend to start off well and then when they reach some sort of critical mass suddenly the company decides it wants to force you to have anal sex with it. No thanks. At least Microsoft screws me up front.

Re:70% on fully updated installs.

[David_Hart]

I'm not sure that I agree with the extrapolation that 70% of patched systems "let" the infections through. The article talks about drive-by automated attacks but seems to mix in statistics for more general attacks. As long as the system is fully patched, there are no zero-day exploits, and there is no physical access, then the system should be safe. My thought is that the remaining 70% is due to user activity, rather than a fully patched system being exploitable.

Re:70% on fully updated installs.

[oakgrove]

And if you think that would be bad, imagine giving them a Windows CD.

Re:70% on fully updated installs.

[gtall]

"does Mac system update cover java?" Nope, as of OS X 10.7, java is your problem, not Apple's.

Re:70% on fully updated installs.

[140Mandak262Jamuna]

Salient point is that, fully updated and patched installs let 70% of the infections through.

[citation needed]

I know you are not supposed to read the Fine Article, but not even the summary? The summary quotes the very article to mention the 31.x% statistic.

The article also says 99.8% of the infections happened due just five software. Cant understand that. On top of it, it splits Adobe into two pieces Flash player and Pdf reader. Thus the top prize goes to Java JRE. But there it clubs an array bounds violation with ActiveX vulnerability in the deployment tool. Looks like the article has the stench of a shill setting it up for Microsoft/Adobe to claim "Java has the top prize for being vector of malware".

Re:70% on fully updated installs.

[Moheeheeko]

This largely depends on what you google. Something mainstream and well known will usually net you posotive results on the first link, other things not so much. It pays to read the url before clicking the link.

Re:70% on fully updated installs.

[Pope]

Yes, the built-in Software Update service on OS X includes some Java updates, but with Lion, Java is no longer installed by default. http://support.apple.com/kb/DL1421

Re:70% on fully updated installs.

[Synerg1y]

I've never known anybody to use Zone Alarm, I've hosed a few windows with FreeAVG > killed performance and uninstalling didn't do as much as it should have...

Comodo is hard to use, but a lot better than the ones you've mentioned, and though I tend to conform to your view on third party software, think of comodo as a layer between the user and the OS that prompts for user interaction to let the OS do anything. Definitely, don't use it if you don't want to though, but you do have the wrong impression of what I am referring to :)

Easiest way would be to set up another windows instance and play with it, as you probably regret not doing with AVG :)

If you think malware / spyware is sketchy on a windows box, root kits are just plain out creepy
http://www.bleepingcomputer.com/startups/rootkit.html

The rootkit is what makes me want to reinstall windows on compromised machines than try and fix em,
http://www.bleepingcomputer.com/startups/rootkit.html

Re:70% on fully updated installs.

[ak3ldama]

We have monitored more than 50 different exploit kits on 44 unique servers / IP addresses. Our figures come from the underlying statistical modules, thereby ensuring an as precise overview of the threat landscape as possible.
The statistical material covers all in all more than half a million user exposures out of which as many as 31.3 % were infected with the virus/malware due to missing security updates.

Re:70% on fully updated installs.

[ewanm89]

Unless it's a privilege escalation exploit.

Re:70% on fully updated installs.

[LordLimecat]

:\ one would have hoped they would have started moving towards "best of Windows and Linux", not "we're putting more things on the user's plate".

Seriously, why cant MS and Apple get on the "update repository for desktops" bandwagon?

Re:70% on fully updated installs.

[UnknowingFool]

The problem is that you are assuming arbitrary code execution rather than arbitrary file placement. Both are bad but there is less severity in file placement depending on where the file is located. If files can only be saved to user directories but not executable there is less risk. As for Pwn2Own there were different categories. One was code execution and one was file placement and one was reading user files.

Re:70% on fully updated installs.

[amicusNYCL]

I think anon is referring to users who open email zip files from unknown senders and who don't bother to install an AV to start...

Maybe, but the 70% number quoted, and this study, dealt with drive-by browser installs rather than emailed zip files.

Re:70% on fully updated installs.

[lpp]

The report only shows how many machines were running each browser or OS on the infected machines. They don't report how many machines in total had those browsers or OSes. So it may be that 100% of the Win98, Win2k and Win2003 installations were infected but they represent such a small subset of the total userbase that the percentages in the pie charts are also relatively small.

Additionally, the browser report doesn't break out different versions of IE and Firefox. The fact is a lot of people are still using IE7 and maybe even IE6. IE8 is an improvement and IE9 even more so. Likewise, I still see a number of FF3 users and FF4 users. I would lump FF5 through FF7 together because, really, wth not. Practically the same anyway. But FF5+ represents an increase in safety over FF4.

I would have liked to have seen relative infection rates within each browser and OS version. That is, it's nice to know the percentage of infections that involved Windows XP, but I would also like to know what % of Windows XP users became infected. Even then you aren't controlling for varying levels of user experience and ability to avoid infection, or anti-malware installations, but I suppose there are limits to all data collection.

Re:70% on fully updated installs.

[LordLimecat]

I assume that for a few reasons. If the exploit relies on being able to stick exe files in dangerous locations where they will be executed by the os (like naming it notepad.exe and sticking it in %windir%), it has several additional issues to deal with-- chiefly, if the user does not have admin credentials, the infection will likely fail.

Having machinecode download and execute code from the %temp% folder is much more reliable, doesnt rely on admin privileges, and is unlikely to be blocked-- if you try to block file execution from temporary folders, it breaks basically every software updater in existence (as they extract to %temp% and then run an extracted exe or msi).

Re:70% on fully updated installs.

[Cramer]

UAC only stops the lazy and dumb. There have been numerous published means of evading it and doing bad things. (completely unknown to the user.)

Re:70% on fully updated installs.

[Anonymous Coward]

The conclusion of this study is that as much as 99.8 % of all virus/malware infections caused by commercial exploit kits are a direct result of the lack of updating five specific software packages.

The statistical material covers all in all more than half a million user exposures out of which as many as 31.3 % were infected with the virus/malware due to missing security updates.

(emphasis mine)

Salient point is that, fully updated and patched installs let 0.0626% of the infections through.

(ftfy)

I know that hating on Microsoft is supposed to trump reading comprehension but the e-pedant in me can't let this one go.

Re:70% on fully updated installs.

[kermidge]

Right on. The reflexive riposte of "stupid users" is often wrong-headed. For decades personal computers have been marketed as appliances. Expecting the general user to become hip to HIPS, AV, doing updates to their piece-meal systems (OS, drivers, apps, etc.) is unrealistic. Any admonishments or usage tips regarding security or safe surfing presented to the customer are, I suspect, merely things to be clicked through by them to get to doing whatever it is they wish to do.

Trying to convince people even to do updates often as not falls on deaf ears. For instance, among other things, I've recommended to Windows users for years to use Secunia - first their on-line scanner and now their excellent PSI. It helps, but only if people take heed or let me install it.

The suggestion for using a virtual machine for browsing (apart from licensing issues) is a good one, but who amongst the general user population will even be aware of this, let alone do so?

Expecting general users to educate themselves to become proficient in doing their own security and incorporate best practice is little more than an elitist cop-out. Unless and until suppliers put useful security at least on par with marketing's out-the-door bling, I don't see the situation improving. Transparent updates for all software, provided the vendor is trusted, the update is verified to work (without regressions) and old versions verified as being completely removed might help. I'm not holding my breath.

Hells bells, even with the big improvements in fllters, we've managed to do little to even remove spam from the networks this past decade.

[In the hope of saving some the trouble of typing, I've been using Linux as my main OS for several years; all Windows installs are as virtual machines.]

Re:70% on fully updated installs.

[Optic7]

I have no idea if it was removed or not, my only choice with such an obfuscated, complicated OS is to assume that the tools I am given are not lying to me and are doing the job that they are.

Can you give us an example of how another "better" OS would have handled this differently?

BTW, I largely agree with you and laugh at people who don't run real-time AV scanners on their machines, like a CS student I met once. But I don't get your point with that sentence though because I don't know how another OS would have done it better.

Re:70% on fully updated installs.

[mlts]

Malware doesn't need UAC to deliver a payload. A lot of stuff can run as a user:

1: Slurping up files.
2: Obtaining keystrokes can be done with some software in userland.
3: Some Web browsers install in the user's home directory. Hooking into that or modifying the executable directly isn't difficult.
4: Running a botnet client can be done.
5: User documents can be encrypted with an obnoxiously large public key and a note left where to send the random money.
6: Caches can be riffled through to look for contacts to target for spear phish attacks.

Even without Administrator access, malware can do a number on a user. Heck, even without leaving the context of the Web browser, it can sit and wait until someone logs on their bank, then use the authentication cookies to perform a transfer while putting up a bogus screen for the user (like site is down or whatnot.)

Re:70% on fully updated installs.

[Riceballsan]

Well in theory, if you rigged a computer with a baseline install, and the 3 major browsers and perhaps flash, ran a script to make it visit random pages, but not download or install any files or programs, upon reboot any process running is almost certainly malicous.

Re:70% on fully updated installs.

[_0xd0ad]

An exe is not just arbitrary code. It has a header which contains information about the executable and it can contain entirely different sections for execution under Windows/DOS. A DOS executable header begins with the characters "MZ". Windows executables are denoted by "PE". Most Windows applications will have a DOS MZ executable stub at the beginning, before the PE section, to display "This program cannot be run in DOS mode." and exit.

http://www.fileformat.info/format/exe/corion-mz.htm

Now, if you were talking about a DOS .com compact executable, yes. Nothing but pure arbitrary code.

Re:70% on fully updated installs.

[vtcodger]

**All you folks encourgaging your friends and families to buy Macs for the specific reason of their security are in for a world of hurt in a few years when Mac hits ~30+% market share. Kits are already starting to appear.**

Yep. And predictably in a few years, kits will include Ubuntu as well as Windows and Mac. And in a few more years, Unix in general will be only marginally more secure than Windows. In point of fact, Unix uses pretty much the same implementation technologies as Windows, and has pretty much the same types of vulnerabilities. IMHO, the notion that Unix is substantially more secure than Windows is almost surely delusional. It's obscurity that protects Unix, not superior technology.

Re:70% on fully updated installs.

[Shoe Puppet]

Like, app stores?

Re:70% on fully updated installs.

[AliasMarlowe]

Salient point is that, fully updated and patched installs let 70% of the infections through.

What are you, some kind of Microsoft basher? Fully updated and patched installs accounted for barely 68.7% of infections, not 70%...

Re:70% on fully updated installs.

[Riceballsan]

Installing a modern linux OS, is generally easier then windows, even for someone who has never used linux before.

typical linux install, insert CD, boot computer, click the install linux button (by default it will ask to downlaod the updates, and does so in this step), hit next, accept the defaults. computer boots back up, ready to go with a word processor, firefox and almost everything they need ready to go.

windows 7. insert install CD, hit next, accept the defaults, computer boots back up, look for manufacturs CD to install any missing drivers, find printer drivers, find Office CD or go to webpage to download open or libre office, install antivirus, agree to windows updates, reboot, install more updates, reboot. Done.

There are a few exceptions to the list, and it's not uncommon for windows to have all of the drivers ready for you, But oddly in all installs of linux I have done recently, everything I have ever thrown at it has been automatically detected and ready to go on reboot, and I do admit the antivirus would be necessary if linux were to ever fall into the common for average users to get category.

Re:70% on fully updated installs.

[hairyfeet]

There is also an easy way to solve it, that is the combo of Comodo Dragon and Avast Free. you simply use the Dragon's built in secure DNS, which is constantly updated and will block any site that has malware (you can of course choose to go to the site anyway but Comodo tells you what malware is on the site so if you continue its your own stupidity) and if there happens to be a site Comodo doesn't catch (haven't seen one yet, but possible) then Avast, which scans the page BEFORE it loads will catch it and put a screeching halt to the page load and throw up a warning, again listing the malware that was detected.

Using this combo my users, some of which would get more viruses than a Bangkok whore, went down to nothing. Zip, zero nada, squat. I even loaded it on an XP test box (because XP security sucks compared to Win 7, which is what most of my users are now on) and just started clicking every link in my spam folder, just to see if I could infect the thing. I got a bazillion stop loads by Comodo along with Avast saying I shouldn't go to that site, but as long as I didn't click ignore, which should be called the "yes I'm a moron please infect me' button, all was golden. I ran three different offline scanners, two boot CD scanners, and two online scanners, and nothing. Zip zero nada squat. Then add in Win 7 with ASLR and DEP and you have a box that I can hand to my worst users and not have to worry about it coming back except for hardware upgrades.

So you CAN lock Windows down nicely, it just takes a little thought, that's all. I tried the same experiment with MSE and 3 got through, AVG let 2 past, Adaware Free also caught everything though, so if you prefer it over Avast its good. I've simply found my customers like Avast, especially that nice little female voice that Avast uses. But with the above you too can let your worst users loose on the net and go have a beer, confidant you won't be dealing with a zombie when you get back.

Re:70% on fully updated installs.

[140Mandak262Jamuna]

Thanks for parsing it buddy. Had not fully understood what the article was saying.

So only 31.3% of the exposures resulted in infections. And almost all the infections were due to lack of updating just five packages. So 70% of the time even un-updated machines/software did not result in infection. This casts a completely different light (and makes me look pretty dumb, make it just dumb, I'm not pretty).

Also the study divided flash player and pdf reader as two different packages. But lumped Java JRE update tool vulnerabilities with JRE array bounds violation. Cant figure that out.

Re:70% on fully updated installs.

[Zamphatta]

So basically the authors fond the real answer to "how Windows gets infected with malware", is "by using it."

Re:70% on fully updated installs.

[Nutria]

She said the UI was inconsistent

I dispute that, but it's really subjective opinion, since GNOME 2 seems very consistent to me.

and the fonts were unreadable.

2001 is calling, your unreadable fonts were just fixed...

Seriously, are you sure that you didn't install Debian?

Her main issue was flash game compatibility

I installed Ubuntu 10.04LTS on my wife-kids PC and everything's hunky-dory. The kids play flash games, the wife watches recent TV shows on network web sites and they all read email and write the occasional document.

I couldn't even figure out how to get a non-admin user setup for her on Ubuntu.

WTF?

Minimum-privs is the *default*.

I have an MCP, MCSA, MCSE, MCITP SA, and MCITP SE. Obviously

If you can't use Ubuntu, then you're obviously a drooling idiot who *should* stay on Windows.

Re:70% on fully updated installs.

[Nutria]

what can you do if you favorite site serves infected 3rd party adds?

Get your pr0n from usenet?

Re:70% on fully updated installs.

[Nutria]

But FF5+ represents an increase in safety over FF4.

How so?

Re:70% on fully updated installs.

[Nutria]

How many users are willing to have all websites broken by default until each one is explicitly whitelisted?

Exactly. I deinstalled Noscript 2 years ago because it's just a big fat hassle. Sadly, ABP is creeping in that direction on web sites with lots of video on it.

Flashblock is still a Big Win, though.

Re:70% on fully updated installs.

[WorBlux]

Usually you can Crtl+Alt+F1, run top and then kill whatever program is responsible for it. As for in application volume, you can usually set which mixer is targeted. To move a panel you have to take the lock off first in the panel settings. Flash Compatibility.. really not much you can do there though it has gotten better in the past two years. For a non-admin user go and make an account, then remove the user from the admin and wheel groups. Of course it takes time to learn all this, and if you are already a advanced expert in a totally alien system I can see why you wouldn't bother though it's not particularly difficult. In fact learning it might jeopardize all sorts of muscle memory and normal memory that you need for work.

Re:70% on fully updated installs.

[Dunbal]

This largely depends on what you google.

Something related to EVE Online character skills?

Re:70% on fully updated installs.

[jefe7777]

true. but this just tells me that all of the following together while not perfect, is about as good as it gets:

- up to date on everything
- user skilled in spotting oddities
- noscript/adblock
- sandbox
- good security software

and if one is going to do any browsing in the seedier corners of the net, then a full VM.

Re:70% on fully updated installs.

[lennier]

Also the study divided flash player and pdf reader as two different packages. But lumped Java JRE update tool vulnerabilities with JRE array bounds violation. Cant figure that out.

Possibly because Flash Player and Adobe Reader are two separate downloads, each with their own auto-updater, while Java JRE with its auto-updater is one download?

Makes sense to me.

Re:70% on fully updated installs.

[lennier]

It's my opinion Microsoft takes security very seriously.

Indeed. In fact, all Microsoft developers are required to take a strict regimen of humour-suppressing drugs in order to protect them from bouts of spontaneous uncontrollable giggles as they compile the monthly Patch Tuesday list of "privately reported" buffer overflows which their ten years of uber-security focus on top of decades of advanced compiler technology have somehow failed to detect before shipping.

Working in that kind of environment is no joke.

Re:70% on fully updated installs.

[Dunbal]

Can you give us an example of how another "better" OS would have handled this differently?

Not allowing code to be executed from data segments and not allowing any program to run anything with system level privileges would be a start. This whole concept of having a remote server even be able to execute code on your machine is sheer lunacy. Yeah in a perfect world it's a hell of a concept - centralize the work and every computer becomes a dedicated, specialized terminal. But the world is not perfect. Why oh why do we insist (active desktop, RPC, activex, java, flash) on even allowing remote execution - intentional or not?

Re:70% on fully updated installs.

[WorBlux]

Considering how most infection are through non-updated vectors and most Mac OS X and most linuxes have a package manager that updates everything together I somehow doubt it. Also there aren't a lot pirated version running around without updates. Fixing bugs quickly and distributing the fix widely is the first defense against malicious code. Also the Sun JRE and acrobat packages are rarely on linux boxes, Open JRE and okular or evince are preferred.

"The conclusion of this study is that as much as 99.8 % of all virus/malware infections caused by commercial exploit kits are a direct result of the lack of updating five specific software packages."

Re:70% on fully updated installs.

[Moheeheeko]

Somone wanting to get your EVE info and steal your account. Any mmo search runs that risk.

Re:70% on fully updated installs.

[houstonbofh]

Nope. Their husbands are still clients, and I run into them from time to time. They are still running it, and happy.

Re:70% on fully updated installs.

[houstonbofh]

I couldn't even figure out how to get a non-admin user setup for her on Ubuntu. This was two years ago. Disclaimer: I have an MCP, MCSA, MCSE, MCITP SA, and MCITP SE.

This is one reason MS Cirts mean nothing... You could not wander the menu to System -> Administration -> Users and Groups? Your could not click on "Add User" and choose "Desktop?" What will you do when the next Windows comes out?

Re:70% on fully updated installs.

[Optic7]

Again, agreed on the general premise, but to me it doesn't seem like that's what it did at all. It seems like the AV scanner detected an incoming file in the cache that contained a javascript threat, not necessarily that an execution of that threat was attempted. Of course, the threat would be there to be run at some point, and like I said, I also really wonder how malware is executed at all, but I think that this is an important distinction. I still think that except for malware that comes through unpatched java/flash/acrobat or 0-day exploits, most of the malware that gets installed is due to the user clicking on the prompts that come up asking them in not so many words if it's ok to infect their computer with malware.

Re:70% on fully updated installs.

[LordLimecat]

Its a hair-splitting distinction. If you can point at a random data blob and tell the system "run the code contained therein", you are running arbitrary code.

Re:70% on fully updated installs.

[LordLimecat]

A), you failed to read my post where I mentioned that 3% of the infections were through Windows Help.

B), the linux marketshare is so absolutely insignificant that you wont be seeing professionally packaged, commercially available (black market) malware kits for linux for a long long time. Macs, on the other hand, are already starting to get their share of them, as their market share is 15-30x higher than Linux's.

Re:70% on fully updated installs.

[scot4875]

My 4 year old couldn't stand it either. Her main issue was flash game compatibility (really all she uses the computer for) and because she couldn't get the volume right. It was as if the volume scale was linear rather than logarithmic. It took about a day for her to royally fuck up her Ubuntu install.

There you have it, folks: AC's 4-year old daughter isn't a big fan of Ubuntu. Adjust your recommendations accordingly.

--Jeremy

Re:70% on fully updated installs.

[hedwards]

It's not any more suspicious than any other antimalware program. The typical way of telling is that you run the file and see what happens. Of course you don't want to run the file on your computer, but I remember years ago when antivirus software started actually running the programs in a VM to see if it tried to do anything suspicious.

Ultimately you're going to get false positives from time to time, but that's the case with any software and if it gets it wrong you'll hear about it.

Re:70% on fully updated installs.

[Cryptimus]

Wrong. On the contrary, the article - if you read it - specifically says the following:

    The conclusion of this study is that as much as 99.8 % of all virus/malware infections caused by commercial exploit kits are a direct result of the lack of updating five specific software packages.

    So, fully patched installs let through 0.2% of infections.

    The 31.3% figure refers to the percentage of infections relative to exposure. In other words, it's the infection success rate over the entire data set.

    Thank you, come again!

Re:70% on fully updated installs.

[mjwx]

Tbf, a large number leveraged flash and acrobat reader. Flash is not installed by default on Macs any more (though is likely to be installed as there's no alternative), acrobat reader is not installed, and is unlikely to be installed due to the existence of preview, and safari's native pdf rendering.

No, they'll just get Mac users the same way 90% of windows Malware is installed.

Social engineering.

"Install free Muppets/Hello Kitty/Naked Katy Perry screensaver"
/mac user clicks
Oh Hai, I'm a Mac Virus.

There is no technological defence for stupidity, pretending a platform automagically protects you from yourself is stupid, convincing others this is true to other people makes one the heir to the throne of the kingdom of idiots.

Re:70% on fully updated installs.

[mgblst]

Bullshit. Only someone who does not understand simple OS basics would ever think this. There are major differences between OX X, Linux and Windows.

Re:70% on fully updated installs.

[spazzmo]

Where have you been for the last decade? Everyone knows the reasons people have to use Windows. Or do you get off on watching the same tedious old arguments go round and round in circles yet again...

Re:70% on fully updated installs.

[beelsebob]

You mean like the Mac App Store?

Re:70% on fully updated installs.

[jc79]

B), the linux marketshare is so absolutely insignificant that you wont be seeing professionally packaged, commercially available (black market) malware kits for linux for a long long time.

I would have thought being able to pwn the majority of web and database servers out there would be a decent incentive to write malware kits for linux. Anyway, why pay black market rates when metasploit is free?

Re:70% on fully updated installs.

[LordLimecat]

No, because malware kits dont WORK on server installs, they only work when someone browses to your infected website. If you know of any big iron servers running Gnome with an outdated Firefox and a vulnerable version of flash, do let me know, however.

Hacks on servers tend to be bruteforce attempts, worm attacks, and dedicated efforts by a human being. Those are all kind of irrelevant to the discussion, as its a different class of attack than malware.

Re:70% on fully updated installs.

[monkyyy]

"I do admit the antivirus would be necessary if linux were to ever fall into the common for average users to get category."
but it would be auto-installed and cross disto viruses would be very hard to write

Re:70% on fully updated installs.

[monkyyy]

linux did it first, w/ one very important difference, able to add different "stores"

Re:70% on fully updated installs.

[monkyyy]

i disagree, good user permissions and telling the person to stop and think(also known panic) whenever root password prompt pops up

Re:70% on fully updated installs.

[jc79]

Point understood. My mental classification of malware kits includes worms and other attack methods, as well as their payloads - I'm sure the crims aren't purely interested in owning desktops when there's plenty of poorly configured, unpatched servers out there. Not to mention 0-day exploits discovered by bad guys and sold to other bad guys in the form of kits.

But yes, it's mostly Windows systems with flash, acrobat reader &c that are the low hanging fruit for the kinds of people who would buy kits rather than writing their own.

Re:70% on fully updated installs.

[Lord_Byron]

A what? Oh wait, I think I remember hearing about those...they don't make them anymore, do they?

Re:70% on fully updated installs.

[mangu]

Everyone knows

When someone starts a sentence with those words he's almost certainly wrong.

Or do you get off on watching the same tedious old arguments go round and round in circles yet again...

Not me. I just wonder why so many people get off on complaining about the same tedious old problems round and round yet again. Microsoft sucks. Period. Why do you people still wonder How Windows Gets Infected With Malware?

Imagine if in the 1960s everyone knew the reasons people had to drive Chevrolet Corvairs...

Welll

[jawtheshark]

Understandably... Given the zoo of updaters you get by installing just a handful applications, I too disable disable them, except for Windows update itself. (Well, I used to, I still have a XP copy somewhere on an old laptop, I migrated fully to Linux years ago). However, doing that and running as Limited User pretty much took care of not being infected. It also helped, not using the system browser.

As I understand, these days infection most often occurs over Adobe Flash, Adobe Reader, Internet Explorer, in that order.

Re:Welll

[jawtheshark]

Next time, I'll read the article... Promised, because that's what it says, except I forgot Java... :-) Who installs that anyway? ;-)

Re:Welll

[QuantumRiff]

I can't tell you how much I wish Windows Update would update other applications.. I guess I've turned into a crusty, bearded old Linux geek.. but one command to update everything kind of spoils you. (and being able to install and uninstall more than one application at a time is nice too).

Re:Welll

[mikael]

I must admit I always had some suspicions of web browsers that visit dozens of websites before they even visit your own home page. Running 'tcpdump -vv' and 'netstat -a', while a browser is very enlightening, even more so when doing 'whois' on those websites I've never heard of.

Never could understand why 'firefox' was opening a shttp link to weather.noaa.gov, or who "stopbadware.org" was.

Re:Welll

[houstonbofh]

Plug-in repositories are one thing I WISH windows would steal from Linux!

Re:Welll

[LordLimecat]

Which is why Chrome is such a boon-- auto-blocks Java if its too old, auto-updates Flash, auto-updates its PDF reader (which notably isnt Acrobat based).

Even if you disregard marketing blurbs about Chrome's security, the auto-update alone makes it a huge security plus.

Re:Welll

[houstonbofh]

weather.noaa.gov is the stupid toolbar something added. stopbadware.org is the firefox link scanning site trying to keep you safe from "bad websites" but only after they have infected lots of folks, and for a while after they are cleaned up... The other 52 websites on a given page are adds, and google analytics.

Re:Welll

[somersault]

According to my colleague, the option is there for Win7 to do that now. It's apparently the software vendors who need to integrate their apps into it. I doubt Adobe and Oracle will do that without being pushed though, there probably is something in the rules against pushing extra toolbars and such when updating.. they love doing that.

Re:Welll

[Leebert]

It will happen if and when Microsoft can manage to swipe the App Store concept. The end goal is in sight, although we might not like the side effects.

Re:Welll

[bill_mcgonigle]

I think that's in Windows 8 and they're calling it an 'App Store'.

No word yet on how many reboots it'll take to install an app.

Re:Welll

[buchner.johannes]

Use PSI https://secunia.com/vulnerability_scanning/personal/

There are also several software-updaters based on repositories, but none are really good. The software landscape is just different in Windows.

Re:Welll

[Nerdfest]

They will likely do what Apple did and borrow the concept, but not allow other repositories to be added. The walled garden is now an accepted approach it seems.

Re:Welll

[maxwell demon]

The other 52 websites on a given page are adds,

Only adds, or could also be a few subtracts among them?
SCNR

Re:Welll

[VGPowerlord]

weather.noaa.gov is the stupid toolbar something added.

Why would a toolbar contact a government-run weather service?

Re:Welll

[mikael]

So in effect, they get to know your online usernames plus all the websites and comments you make?

Re:Welll

[apparently]

Why would a toolbar that someone installed in order to get weather updates contact a government-run weather service? It's just a hunch, but I'd guess that its so it can get the weather.

Re:Welll

[Cramer]

This is actually why I f'ing HATE chrome. It refuses to allow me to run the versions of java I MUST run for certain apps to work. Java is the worst pile of GD crap I've ever seen. (and windows makes it even worse... ever tried to maintain installs of multiple versions?)

Re:Welll

[Cramer]

(otherwise, I love chrome)

Re:Welll

[VGPowerlord]

OK, since you missed my point, I'll stop trying to be subtle:

Why would a toolbar contact a government-run weather services instead of their own, since if they contact their own weather service they can track your information rather than having the government track it?

Re:Welll

[_0xd0ad]

To get information, obviously. Maybe you want to know the current temperature at the Guam International Airport, updated in your status bar automatically? Here it is. The add-on just scrapes that page.

Re:Welll

[shutdown -p now]

There's no such option so far as I know. MS apps can integrate with Windows Update for their updates (and usually do so), but there are no public third-party hooks.

Re:Welll

[shutdown -p now]

In many cases, when a Windows installer says that it wants a reboot, it doesn't actually need it. It's there "just in case", and because users have grown to accept that as the unfortunate but necessary side effect of installers.

Win8 apps (the ones that can go into the store) don't need reboots to install, because they each get their own private folder, and can't install components outside that folder - a lot like what the convention is for OS X, but forced by the OS. Since can't install or change system-wide components, there's no situation in which they might have to deal with locked files and such. And they don't have custom installers.

Re:Welll

[Nutria]

Why would a toolbar contact a government-run weather services instead of their own

Because it's an add-on written by Joe Programmer?

Re:Welll

[lennier]

Why would a toolbar contact a government-run weather services instead of their own

Probably because they're too cheap to actually own a weather service so they'd rather just flash ads in your face while loading the free government-run one? That is how the invisible middle finger of the free market works best.

Re:Welll

[houstonbofh]

Not accepted by me. (And I am not that special, no matter what my mother says.)

Re:Welll

[houstonbofh]

They could... Scary, huh?

Re:Welll

[somersault]

Hmm, so he was just being a douche. Thanks.

Re:Welll

[LordLimecat]

Im fairly certain you can bypass that-- either through an "about:" page or through a command-line switch.

Re:Welll

[apparently]

Well here's a thought: what's easier, maintaining your own weather information, or tapping into a resource that already provides that information so that you don't have to duplicate the effort? Are you seriously that retarded that this confuses you? Am I talking to a retarded person? If so, congrats on figuring out how to post on slashdot; there's a good chance that you could be an editor in no time.

How Window Gets... hu wha?

[sgt scrub]

A window can get infected? Lies I tell you!

Re:How Window Gets... hu wha?

[houstonbofh]

Yep. When a window licker has a cold or the flu...

Re:How Window Gets... hu wha?

[adeft]

Yeah, that sentence made my head hurt just a bit.

Three guys beat IE!!!

[140Mandak262Jamuna]

According to the article, IE ranks fourth! Java JRE ranks first, Adobe Flash and Adobe Pdf reader takes the next two places. I think combining these two, Adobe is the king of the hill now in being the vector of disease. Not that it is any surprise.

Java JRE issue is confusing. If the problem is with Java and specs, it should be platform independent. So it is the Windows implementation that is at fault? I don't know.

Re:Three guys beat IE!!!

[ColdWetDog]

OTOH, you can cruise the Internet in safety and ease using the following combination:

WIndows 98
Safari for Windows
Quicktime for Windows

About the only thing you could do is run iTunes, but you would be safe!

Re:Three guys beat IE!!!

[daid303]

Java JRE, so, disable it. I haven't found a single site that depends on it, the add-on seems to install by default (I just want the runtime, not the browser add-on...) and only use in the browser seems to be an attack vector.

And It's not a problem with the specs I think, it's the problem that the Java JRE is huge, and a single exploit in a single feature is a problem.

Re:Three guys beat IE!!!

[gad_zuki!]

Yep, the advice I always give is:

1. Uninstall java. Most end users never have a need for it and don't update it.

2. Use Chrome to read PDFs or Foxit. No need for Adobe, but to be fair Adobe's new sandbox model in version X is resistant to viral infections and exploits.

3. Update flash as often as it says or switch to Chrome.

4. Run MSE or some other AV.

Re:Three guys beat IE!!!

[LordLimecat]

Yes, people who actually deal with such issues for a living have known this for some time. The difference between browsers is rapidly becoming moot-- the market share of any one browser is too diluted to be worth targetting when compared with the widespread adoption of Flash, Java, Acrobat, and Quicktime.

There are some cases where it is conceivable that IE would be more secure than firefox, given the huge leaps made between IE6 and IE9 over the last 4 years.

Re:Three guys beat IE!!!

[RicktheBrick]

I am getting this pop up ad for Norton anti-virus. That would not be unusual except for the fact that the only way I can see to get rid of it is to click the accept button. There is no x or a no thanks button on it. I have microsoft anti-virus and I also have Iobit windows care program and I run firefox with their pop up blocker. Even with all of that I still get that pop up. I will not accept just because they do not have a easy way to decline.

Re:Three guys beat IE!!!

[washu_k]

The JRE issue is simple. The JRE is being exploited to deliver Windows malware. Linux or other OSes can get "infected" by the same exploit, but since the payload code is for Windows it won't run on other OSes. The JRE is just the delivery method, it's not actually running the malware.

The big issue with Java is that while it is platform independent, it is not version independent. There are many many Java apps that require a specific version of the JRE and will not run on a newer one. So if you need to run an app that needs an old JRE you can't patch and secure your system. At a previous employer about 80% of our comprimised systems were because of Java with almost all the rest because of Adobe products. That was despite our default browser being IE6.

Re:Three guys beat IE!!!

[Billly Gates]

Lazy or ignorant admins at your other place. ... not you in particular :-)

IE it is easy to setup zones of protection. Setup the intranet sites in its own DMZ or just configure the MSI to setup IE to use Java for one or two particular sites only. It will then be disabled in the internet zone. I believe even ancient IE 6 has that option if you have the later service packs. Banning flash is obvious too as it serves no work purpose other than people calling saying they can't watch youtube or msnbc during work hours but I think their bosses would chuckle and give you a thumbs up for that one.

JRE is a big threat now should be treated as such.

Update early. Update often.

[mrflash818]

When a Microsoft Windows machine gets infected by viruses/malware it does so mainly because users forget to update the Java JRE, Adobe Reader/Acrobat and Adobe Flash.

Update early. Update often.

Re:Update early. Update often.

[chispito]

When a Microsoft Windows machine gets infected by viruses/malware it does so mainly because users forget to update the Java JRE, Adobe Reader/Acrobat and Adobe Flash.

Update early. Update often.

Alternately, you could simply not use Adobe plugins.

Re:Update early. Update often.

[houstonbofh]

Funny enough, while there are loads of alternative pdf readers out there, all of the alternative flash players I know of seem to be Linux only, or the windows versions are way behind. http://www.gnu.org/software/gnash/ http://sourceforge.net/apps/trac/lightspark http://swfdec.freedesktop.org/wiki/ Perhaps this will get these projects some attention...

Re:Update early. Update often.

[networkBoy]

I wish this were true.
So many enterprise apps are Java (not JS) it is frightening.
I maintain a whitelist for JVM apps allowed in the browser rather than uninstalling it. Annoying, but I can not do my job without it, nor can my wife go to school without it (on-line classes use it for the "classroom app").
-nB

Re:Update early. Update often.

[jimicus]

Alternately, you could simply not use Adobe plugins.

Let's face it, for most people that's a bit like telling them not to have sex if they don't want to get pregnant.

Entirely true, but so un-representative of the real world you might as well save your breath.

Re:Update early. Update often.

[i kan reed]

Uninstall reader/acrobat as useless, install firefox with flashblock, adblock.
Ta-da, infection almost certainly now depends on users being morons.

I personally would like a way to tell firefox to block cross-domain anything that's not a static image. That would quash a lot of the scripts that are problematic without the hassle of noscript.

Re:Update early. Update often.

[antdude]

How do we watch Flash videos then? :P

Top 5 to be avoided

[hesaigo999ca]

I guess dont use java, adobe reader or flash, or IE, and you should kill 90% of possibilities.

Better statistics?

[SpryGuy]

Looking at the graphs and statistics, I ended up wishing they'd factored in usage share, to make the numbers more meaningful.

I mean, if (say) 70% of users used XP and 30% of users use Win7, then seeing 70% of the exploits on XP and 30% of the exploits on Win7 doesn't tell you much other than there's an exploit that is the same across them. It does NOT mean that XP is more vunerable than Win7. Ditto the breakdown by browsers. Without usage share factored in, the numbers can be misleading in either direction.

Re:Better statistics?

[Billly Gates]

Ask any IT professional who has migrated to Win 7 and almost every one will say the amount of support issues and malware tickets go down significantly aftewards. Win 7 is much more secure than XP by design and many under the hood things in runtime and at compile time. It is near impossible to peak and poke in a Windows 7 machine with an exploit.

Flash and Java will execute other executables so it bypasses all security.

Re:Better statistics?

[SexyKellyOsbourne]

Agreed.

Security in Windows XP was really an afterthought -- it wasn't until SP2 seven years ago that it was reasonable to install. Before that, it would get rooted WHILE installing. In Win7, that is built in, not merely tacked on or recompiled. But it still includes IE6 by default, which US-CERT said was not fixable in its security model in 2004, and is the biggest danger of installing it.

Of course, I don't know what kind of masochist would voluntarily install an OS from 2001 that still considers SATA to be exotic hardware and can only be cloned across the same hardware, but that's another issue.

Windows 7 boxes are still exploitable, but only if they're grossly unpatched. The ones that get infected are usually have no Service Pack, much less have ever had Windows Update run, and are using an expired version of Norton Antivirus. Windows Update kills common malware rather well, and Security Essentials is free and actually quite nice (beats AVG).

The same would apply to someone who has ignored 2 years of Ubuntu Security Notices and patches. There are quite a few: http://www.ubuntu.com/usn/

As far as Flash and Java goes, I've been putting Chrome on home systems for browsing. It blocks usage of versions of Flash, Java, Quicktime, and other plugins that are exploitable. The malware blocker is also excellent on it, although Firefox and IE9 are catching up on doing that well.

Re:Better statistics?

[Billly Gates]

The issue is many organizations are downgrading from Firefox to IE 7 or IE 6 again due to security concerns. Many think because IE is updated that is secure and therefore supported regardless of whether it is insecure by design. Sigh

Firefox 3.6 is unsupported and therefore more insecure than IE 7 according to the PHBs.

There are a lot of ignorant people who stick to old assumptions in I.T. today

How Windows Get Infected With Malware 16

[DRAGONWEEZEL]

Simply Click HERE! ;)

Re:how windows get infected with malware?

[LordLimecat]

How Windows [machines] get infected.

I didnt have trouble parsing that; possibly if you turned the brainpower spent making snarky responses to reading comprehension you wouldnt have had the issue either.

Not much meat in TFA

[sl4shd0rk]

User's patches not up-to-date. User got infected.

The applications the malware targets are unsurprisingly the same-ol-same-ol. Windows, Java, IE, Adobe.

Perhaps the real questions should be:
- Why is patching so ineffective?
- Why is patch frequency not decreasing over time (these are *very* mature applications) ?

Re:Not much meat in TFA

[quacking duck]

The Flash update process is pretty retarded, for one.

In the control panel, it can tell me which versions of the ActiveX (IE) and plugin (Firefox, etc) are installed, but when I manually ask to check for updates it sends the default browser to the Flash download page.

What a completely lame-brained approach--the control panel should check for, download and install updates itself, or pass it off to an Adobe Update app, or *something* that doesn't require manually downloading and installing a fresh copy of *both* IE and plugin versions of Flash.

Re:Not much meat in TFA

[painandgreed]

- Why is patch frequency not decreasing over time (these are *very* mature applications) ?

Not really. They are new versions of old software filled with new features that require new patches. If it was the same code, then we could expect for these products to be mature, but the code base is constantly increasing. New features are constantly being added, sometimes in the same updates that fix other bugs. I fight with this sort of thing all the time with enterprise programs. Our business installs a program. We find bugs and demand they are fixed and they are with the next update that adds more features, new code, and more bugs. Sure, we want just a stable product, but other people want new features and the vendor needs them to stay ahead of the competition and sell to new customers. Any bug fixes are applied to new versions rather than the current one because they can't or won't expend the money to fix older versions as well as the newer ones with new features.

Re:Accounting for market share?

[houstonbofh]

IE is the default browser on more systems than anything else. And even if Firefox is installed, the API calls on windows for http downloads use the IE engine, unless you go to some trouble.

Java JRE

[Bigbutt]

Unfortunately I run into areas where I am unable to upgrade the JRE due to incompatibilities with newer versions. For instance, in dealing with a Dell DRAC, the old Chassis says it'll support 1.4_5 something or other or newer. The problem is with the exact version it works fine but upgrading JRE on my system causes it to fail and refuse to start up the console java app. So I have a Windows laptop at my desk that is kept at that specific version of the JRE so I can continue to access the chassis until it's replaced. It's just one example but it's one I have to deal with on a periodic basis.

[John]

Re:Java JRE

[magamiako1]

Easy: Virtualize the management system used to manage these cards, throw it in a VM that is not used for general everyday computing (its sole purpose is managing the DRACs)

Contact Dell to see if an update exists that would allow you to use a newer version of Java.

If the hardware is too old, look into a replacement plan due to aging.

Re:Java JRE

[DigiShaman]

I have clients that can't use their check scanner for online corporate banking if JRE gets upgraded. Of all the PCs in the office, that's the one you do NOT want to get infected with a rootkit and keylogger for obvious reasons.

Re:Java JRE

[Bigbutt]

Not allowed to virtualize Windows (I've asked). They're trying to reduce the number of Windows licenses in the company (I have a Mac :) )

The last update was applied. This was end of life'd two years ago.

Hahahahahahaha. Believe me, we're trying to get old hardware replaced.

[John]

Re:Java JRE

[Bigbutt]

Granted but I do from the system I use to access the DRAC. The issue is that my Windows box has to stay at a specific version of the JRE in order to continue to access the DRAC. So upgrading the JRE isn't possible. Fortunately I've received a new laptop so the old Windows one just sits until I need it to access the DRAC.

[John]

Re:Java JRE

[Bigbutt]

My solution is to just keep the old laptop around but not use it for anything but that specific task. So it sits in a drawer and every month or so I have to break it out, turn it on, and check out the console for the server that stopped responding to the network for some reason. If it doesn't get on the 'net, there isn't much of a chance of it getting infected.

[John]

Re:Java JRE

[magamiako1]

Company's going to have fun on the Mac environment....(word: it's worse)

Re:Java JRE

[Bigbutt]

Most of my problems are related to being forced to use IE or needing to use Visio. I have an RDC connection to a terminal server but they won't put project or visio on the server. Again, the laptop still has its uses. I'm particularly amused that I still have my old laptop; so much for recovering a Windows license :)

[John]

Re:Java JRE

[magamiako1]

IE is relatively secure as long as your sys admin (you have sys admins? right?) provides a proper update schedule and enforces update policies to occur.

As noted by this article and many countless before it--MOST problems are solveable (well over 99% of them) by merely having a proper update policy.

Re:Java JRE

[GoblinKing]

For what it's worth that is not a Java problem ... it's an "idiot programmer for Dell writing bad code in Java" problem by requiring a specific version with no upgrade path. I have a number of Java applications that were written using the 1.4 JDK that will run without problem on the current 1.7 JRE.

Re:Java JRE

[healyp]

Why don't you update the DRAC firmware? Unless your DRAC's are beyond ancient. Why, just this week I went through the process of getting all our DRAC5 cards up to Firmware 1.60 and DRAC6 cards up to 1.70. Now they all work on any browser and on Linux even- though it does require the sun-java package on Linux, IcedTea/OpenJDK doesn't cut it.

Re:Java JRE

[SexyKellyOsbourne]

If you can, ask management "What's the cost of shutting down the production line for a day?"

Explain to them that the system is a petri dish for viruses and even intentional industrial sabotage. A single Win7 Professional license to virtualize the system (virus protection, instant restoration, little to no downtime) via XP Mode, or even a damned Xen Server License, is pretty good insurance versus that.

I did something similar once while consulting for something else at a factory, and the VP turned white and was on the phone immediately.

Java and Adobe need automated silent updates

[sandytaru]

They need to incorporate the option of turning on automatic, silent upgrades like Google Chrome has - many end users don't recognize the "Hey I've got an update" balloons on their machines, and just ignore them until they wind up several versions out of date. Also, Adobe needs to cut out this "reboot required" nonsense for Adobe Reader. Not everyone is able to reboot machines at a drop of a hat, and it's annoying to have to schedule a reboot on a server for a program that didn't require a reboot for installation and is only used once every few months. (I seriously update Adobe more than I use it on many machines.)

Re:Java and Adobe need automated silent updates

[goldspider]

I don't know about Flash, but Java can be set to auto-update.

Re:Java and Adobe need automated silent updates

[AtomicJake]

Silent updates is the worst idea ever. Something that worked yesterday, stops working today - and I have no clue why.
It is OK for some users to enable automatic updates (e.g. if you use only a Web browser and no specific plugins), but even then: Make the users aware about each update. Most users are far better off with a planned update.

Re:Java and Adobe need automated silent updates

[Rhywden]

Yes. But it only looks once a month. Better to use something like Secunia PSI.

Re:Java and Adobe need automated silent updates

[sandytaru]

That only works if users actuall install the updates. Best case scenario, they actually call IT and ask about it and make us install it for them. Worst case scenario, they ignore it and we don't find out about it until six months later when they're system is suddenly infected beyond repair because they double clicked a fake UPS attachment reciept.

Words counts!

[jabberw0k]

Grammars be important, their how we speech proper. Kapeesh?

Re:how windows get infected with malware?

[somersault]

What talk bout. We no talk that here.

Injection and Payload

[Synerg1y]

It looks like they were mainly studying browser based attacks, the CVE's I looked up all had to do with browser code injection, along those lines.

They go on to state 85% of virus infections (do they mean malware / spyware?) are caused by drive by attacks (website exploits)

I'm not sure of and am to lazy to look up the actual figures, but I would dedicate that 85% to email based attacks, not Nigerian scams, but infected attachments, embedded code, etc.

Oh well, I'm demoting the scope of these statistics to browsers only...

and also state that I believe WIndows gets infected buckets more by email based attacks for many reasons including the ease of guessing email addresses on a domain, as well as user trust that who is sending them the email knows their email so they may know them, etc...

Salient point:

[aepervius]

http://www.net-security.org/images/articles/102011-infection.jpg

Avoid Java, Flash, acrobat and IE Explorer and you avoid around 95+% of the entry points. IOW it does not seem to be opera or mozilla which is vlnerable, but the added cruft plug in.

Re:how windows get infected with malware?

[LordLimecat]

There were multiple Windows machines being discussed. "Gets" is only appropriate for the singular case, so the usage of the plural "get" was correct.

Pedantic fail.

Summary of the article

[rabtech]

TL;DR:

The majority of infections are (in order): JRE, Acrobat Reader, Flash, and a minority are actual browser exploits and/or Quicktime exploits. No word on the versions but I expect that they are all well-known and long-patched holes.

Part of the reason I run with Java disabled, Flashblock installed, etc.

Forced updates needed

[mrshermanoaks]

Unless you force users to update software before continuing to use it, they will nearly always pick the "remind me later" option. Updates to packages like these need to be automatic and enforced for all but the most managed of users, or this problem will just go on forever.

It this issue affected only the individual users, it would be one thing. But the fact that clicking the "remind me later" has a disastrous effect across society means that you can't just rely on people to do the smart thing. They won't. They'll do the quick, easy thing.

Re:how windows get infected with malware?

[LordLimecat]

One might wonder how you ever manage to read headlines if you cant grasp the concept of implied words. Its not exactly uncommon for a headline to drop words, nouns and verbs alike.

Why, Msn.com has the headline "Dust storms, Bear attacks, more". Oh noes! Theres no verb in those sentences! WHAT are the dust storms doing? Or perhaps the dust is currently storming, and its the object of the attacks and storms that we are missing? However will we decode this headline? And what is the bear attacking?

Really folks, if you cant get this, slashdot is probably not the site for you.

Product Pushing.

[nairnr]

Of course this study was done to showcase a product... And it is a Danish company CSIS...

"With this study CSIS has received confirmation that our security program Heimdal is addressing a market not adequately covered by a proper patch routine or policy for this area. "

Re:Product Pushing.

[Guspaz]

Not to be confused with CSIS, the Canadian Security Intelligence Service, our equivalent of the CIA.

Re:FTFA

[maxume]

The article never equates user exposures with infections.

(so it isn't clear if that other 70% actually result in infections...)

I call BS - Linux repos package them all the time

[daboochmeister]

I call BS - many Linux repositories package and provide Adobe and Oracle software all the time, without issue, and without "extra toolbars and such" being installed when you use their packages. Are you really really sure that MS isn't imposing a requirement that Adobe and Oracle find unacceptable? (go ahead, call me cynical) Or possibly that MS won't allow the licenses under which such packages are provided?

Secunia PSI

[ThatsNotPudding]

http://secunia.com/vulnerability_scanning/personal/
I'm sure it's not unique, but I like that it does keep track of third-party programs and services - especially the seemingly purpose-built attack vector: Flash.

Re:Secunia PSI

[flappinbooger]

ninite pro also has some auto-update functionality that reminds me (vaguely) of the linux repository functionality.

Re:how windows get infected with malware?

[somersault]

"Storms" and "attacks" are both verbs. The dust is storming, the bear is attacking. There was an s missing from the headline. It's a Slashdot meme to make jokes about the poor editorial quailty. You need to relax and get over it.

Re:I call BS - Linux repos package them all the ti

[somersault]

Perhaps. I was trying to give MS the benefit of the doubt, as my colleague typically does. I guess it could be just laziness on MS' part.

Re:how windows get infected with malware?

[LordLimecat]

Not correct. You might be able to make the case for "attacks" being a verb, but ONLY if it is referring to a single bear doing the attacking. If it is referring to several incidents, it would be "bear-attack", plural-- that is "bear attacks" (noun).

Dust storm, however, is a noun, and I have never heard the usage that would indicate the dust was storming something-- you would have to think the dust was breaching the walls of something, which is a bit of a stretch.

From the context (being a headline, the use of what appears to be a plural combined with the word "more"), it seems obvious that they are referring to several incidents involving dust storms, and several incidents involving bear attacks.

Re:And the conclusions to be drawn are

[magamiako1]

No, it's called shitty application developers that don't want to leverage the tools Microsoft provides for securing their applications.

I've gotten arguments from developers who SWEAR they can do it better--and by better, I mean "I should be able to put my application anywhere on the system and the system shouldn't be exploitable by any bugs in my code."

I shit you not, we argued over this for a while.

Microsoft provides developers every tool they need to make a Windows application that can operate on least privilege but they REFUSE to use it.

Better Development / Better Education

[nanoosa]

There are many holes that have been overlooked by developers; however, education of the end user is just as important.

Re:Flash, Silverlight, Office, Java

[LordLimecat]

My friends & family run $OS with the browser running in an isolated user account, works quite well

So do most windows users. Luckily for the virus makers, its pretty easy to pester the user with a zillion gksudo / consent.exe prompts requesting elevation-- all it takes is clicking "allow" if you dont have a password set, and its all over.

Re:How Long Will it Take

[Shoe Puppet]

I'm not surprised you haven't found any root-kits.

This..

[Marble68]

Find out how Windows gets infected with Malware by downloading this exclusive EXE *FOR FREE*.

Re:It is not 2005 anymore

[Billly Gates]

The old vulnerabilities of putting an activeX control, tricking a RPC, or targetting a buffer overflow in Windows XP or IE 6 are long gone.

IE 9 on Windows 7 and IE 10 in Windows 8 are one of the mose secure web browser out there. Not seriously?

It is compiled with VC 2010 and has crazy ASLR, Dep (data execution prevention), and even checks exception handling at compile times to make sure it not abused. Even if you you could figure out how to do a buffer overrun and poke some bad instructions in ram, its addressing is all randomized so targeting the kernel or a particular dll to execute is all but impossible. This is especially true under WIndows 7 where the whole system has a scrambled layer of ram addresses that is always changing. It is a bitch to do now.

Even IE 8 which is not a modern browser in today's standards (still mediocre), is ok secure wise when patched compared to its horrible past siblings of IE 6 and IE 7.

Modern IE is not IE 6, or IE 7 by a longshot. As I.T. professionals you need to learn newer things. It does not make sense to target Windows or IE vulnerabilities because by the cracker finishes the trojan MS will likely fix it via a Windows update.

Flash however is compiled with adobe's with no such security checks at compile time! Doh. Even worse many users have 2 year old flash 9 still that is never auto updated. You can run bad javascript in PDFs that crossite to a badsite and a whole other nasties. I use Foxit and it even caught a PDF that did just that and had xss cross site scripting protection. Thank God.

Flash is never updated, does not have the resources as MS, and Oracle doesn't give a shit about Java and refuses to patch security glitches. The RMI by its very nature is to allow foreign natively compiled code so no crazy hacks needed.

The solution? Ban flash at work, setup IE to use Java for selected Intranet sites only in a protected zone. It is very easy to setup and any administrator at work should always do that. Youtube is not business productive anyway and is the only real reason to use Flash. ;-) You can ban these with Chrome and I assume Firefox as well but you can't do particular sites like IE can. Ms put them there for a reason.

Do these steps and your support will go down by at least 50% at work. Guarantee it.

Windows Help

[c 0xFF]

3% of successful infections used a feature that nobody I know about has ever used (beyond accidentally pressing F1).

Just goes to show that even the most benign features could potentially harbor a security risk if the programmers didn't do their job right, regardless of operating system.

Useless charts

[ytpete]

All those pie charts are kind of useless unless they normalize them for percent of installed base... Oh, IE makes up the largest number of browser infections? Maybe because IE makes up the largest number of browser users. Windows 2000 gets far less malware than Windows Vista? Probably not actually more secure... just has far fewer users anymore.

old proverb: infections ~ install base

[Onymous Coward]

The tendency for infection is correlated to how popular the OS is, goes the oft-repeated idea.

For relative infectibility, I quote the "exposed to malware" numbers from the article. They make it a little ambiguous whether this means actual infections. And for relative popularity between Windows OSs, I quote from the Wikipedia article on Windows (with some averaging).

"Exposed To Malware"

1. XP - 41%
2. Vista - 38%
3. 7 - 16%

(Relative) Install Base

1. XP - 46%
2. Vista - 11.4%
3. 7 - 40.2%

Appears to be a large discrepancy between these numbers. Any explanations? On the face of it it looks like it is not true that popularity of OS correlates highly with infection rate.

Re:old proverb: infections ~ install base

[Lance_Denmark]

People still using XP are doing so because of legacy software? Likely to be businesses which have some tech minded people behind them. Most savvy home users have moved onto Windows 7, as Vista was a pile of shit. Those left using Vista are the Moms who send emails full of cats.

Re:old proverb: infections ~ install base

[shutdown -p now]

People who have already upgraded to Win7 are more likely to be up-to-date on patches - doesn't sound too surprising to me.

That, and UAC also helps.

Re:Flash, Silverlight, Office, Java

[Nutria]

So do most windows users.

I dispute that, and assert that most home users run using the default Admin account that was automatically created by the manufacturer.

Happy wives and daughters

[overshoot]

Well, OK, we're not married. I'll wait while heads explode all over /.

Anyway, several years ago $DAUGHTER was headed off to University and it was time for her to take responsibility for her own computer, so we went shopping at Fry's and she got the usual mobo, PSU, HDD, video, etc. for the case I bought her. She and $HERSELF (not her mother but ...) then built the box and, following the online instructions, did a Stage One installation of Gentoo.

Worked like a champ for four years, she kept it up and all w/o my needing to hold her hand (not that I object to holding her hand, even now.) She only replaced it because a laptop suited her needs better in grad school. So she wiped a new ThinkPad down to bare metal and installed Ubuntu. Here we are four years later and she's doing her dissertation on that ThinkPad, still no help required from Dad.

And before anyone asks:
* No, she's not a CS or other tech major. Sociology, actually.
* She already has a boyfriend and he's about 6'4" of professional outdoorsman.

Re:Happy wives and daughters

[i_b_don]

WTH is a "professional outdoorsman"?

d

Re:Happy wives and daughters

[reboot246]

I wonder if it's anything like "urban outdoorsman", only full time.

Re:Happy wives and daughters

[jc79]

I'm a professional outdoors-person, although I prefer to be referred to as an outdoor instructor, or mountain leader. I work freelance for a number of organisations (mostly residential outdoor education centres) as well as running a business teaching navigation and guiding hillwalks.

Re:Flash, Silverlight, Office, Java

[LordLimecat]

Someone didnt pay attention to the Vista and Win7 changes. As in Ubuntu default installs, the user has admin "capabilities", but they are dropped most of the time. To actually use them, you must click through a UAC prompt that is functionally identical to gksudo.

Re:Flash, Silverlight, Office, Java

[Nutria]

Someone didnt pay attention to the Vista and Win7 changes.

The only non-XP Windows systems I've seen in the past 5 years is the Win7 Starter on my wife's (brand new) netbook.

Other than that, we're pure Linux at home and XP at work, so there was nothing to not pay attention to (if that makes any sense).

Re:Flash, Silverlight, Office, Java

[LordLimecat]

Ah, well perhaps you shouldnt have commented on Vista and windows 7. You see, WinXP market share is under 38%, so my comment about "most windows users" was accurate.

Incidentally, 7 really is worth the upgrade-- dont judge it based on Starter which really is awful and is usually put on devices that should never have run windows to begin with.

Re:Flash, Silverlight, Office, Java

[Nutria]

perhaps you shouldnt have commented on Vista and windows 7

Point *slightly* taken.

7 really is worth the upgrade-- dont judge it based on Starter which really is awful and is usually put on devices that should never have run windows to begin with.

I'm not going to pay an extra $100 on a $250 computer. When/if my wife comes upon it's limitations (so far she hasn't) then we'll discus what to do.

Re:Flash, Silverlight, Office, Java

[LordLimecat]

Yes, I dont think I would spend the money if it were that much. But if you can snag a $30 student upgrade, its worth it, and if you are getting a new computer, might as well go for 7. The new GUI is much better (as in, it improves productivity), cross-GPU-vendor multi-monitor is supported, and theres heaps of other goodies. To be sure, there are annoyances, but all in all I think 7 was a good direction.

Now if only they hadnt thrown that all out for the mess that is Windows 8.....

Re:Flash, Silverlight, Office, Java

[Nutria]

But if you can snag a $30 student upgrade, its worth it

Guess we're not upgrading... :)

cross-GPU-vendor multi-monitor is supported, and theres heaps of other goodies.

It's a netbook, for Christ's sake.

Now if only they hadnt thrown that all out for the mess that is Windows 8.....

I know the feeling. I've held our desktops back to Ubuntu 10.04 and 10.10 because my wife hates change and I hate (1) change for change's sake and (2) pandering to mythical Linux newbies.

Professional ourtdoorsman

[overshoot]

Designing and building trails for the Forest Service, for one. As in, spending more time hiking with a pack and sleeping in a tent than under a roof. In between doing things by hand rather than with power tools because the tools are too hard to get to where the work needs to be done.

Re:Listen goof: What gave you the idea

[apparently]

Apparently you can't answer easy, simple questions. I realize that you're posting as AC, but could you provide me with the state that you live in so that I can direct you to your state's Department of Developmental Services, so that they can help you learn the art of responding to easy questions? With any luck, they can team you up with a second grader who can teach you how to respond to sentences that end with question marks: "?".