How does MS come up with these brilliant ideas?

The BBQ Pit
21

Every security system I can think of - whether it’s the low- tech locks on your doors or high-tech firewalls - is basicaly a compromise between convenience for the good guys and inconvenience for the bad guys. Most of us are willing to compromise a certain amount of security for the convenience of features, and MS markets to that. Of course, MS should fix the bugs and oversights that lead to security breaches.

I’ll second ntucker’s position that it is not MS security holes that attract hackers, it is MS’s popularity. There is not much bang for the buck in writing viruses for Macs, Linux or Open VMS.

22

If it created jobs for all of us, with my skills and experience, I’d be able to go to a programming interview and actually get hired! :mad:

23

God point - but I won’t allow Outlook opn any of the machines on my networks.

24

Or spellcheck.:smack:

25

Unix had dozens of hacks and exploits long before Microsoft was a blip on the map. Most successful website hacks are against Linux. The proliferation of worms, virii and hacks for Windows are simply a function of the popularity of that OS. The same effort devoted to Unix & Linux would probably open a huge number of doors in those systems too (although one hopes not quite as many as Windows).

I always shake my head at the poor losers who succumb to the knee-jerk anti-Microsoft spew everytime the Great Evil is mentioned. There are always reasons to dislike individual products, but it is laughable to automatically discount everything Microsoft.

26

Just when is this happening?

27

The catch with security though is that you have to look at security from the stand-point of your typical end-user, no even the person with an average amount of tech-savvy-ness. Windows is inherently insecure out of the box and that’s the configuration most people use it as. Most flavors of *NIX and OS X take the approach of making the OS locked down or near locked down by default requiring the user to make modifications to enable features that provide for essential security problems (the exception being that the OS X firewall isn’t enabled by default).

Windows, OTOH, instals in a rather insecure mode and requires the user to activate certain features, many in an unintuitive or difficult way (it took me quite a while to actually FIND the XP firewall).

Some Interesting Articles.

Washington Post-Windows: Insecure by Design

Letter to the Dept. of Homeland Security from the CCIA

NY Times (Reg. Required)

Among others. Yes, Linux is the most attacked OS on the Web. Near under it in attacks is BSD (which is the least successfully breached) that’s a fact that can’t be denied. Hackers will go after anything they can find and, despite MS ubiquity on the desktop, the server market is still rather well dominated by various *NIX flavors.

IMHO that makes servers a much juicier market for virus-writers and hackers. After all, why write a virus that will disrupt the desktop machines of the office staff when you can write one that will disrupt the core infrastructure of many corporations (even MS uses UNIX servers for a few mission critical systems). Despite that high-profile the number of *NIX viruses is still considerably lower than the number of Windows viruses. It leads me to believe that there is something inherently wrong with the Windows OS; something far more than just larger market-share.

28

I forgot to add (oh how nice it would be to be able to edit) the ratio of Linux/UNIX hacks versus Windows hacks is roughly equal to the ratio those OSes hold in the webserver market.

NetCraft Webserver Survey

29

A funny part about the recent worms has been Microsoft’s Press Release. Basically, it said that only XP systems can be affected. but then it quickly reminded us that 98 and company are no longer supported, and we should upgrade as soon as possible for the sake of security.

That’s right: we should stop using an OS that DOESN’T have these problems so that we can buy one from them that does: problems that they don’t seriously plan on addressing in a permanent way for two years or more.

30

No, I wasn’t wrong when I mentioned that you won’t have these same problems with Eudora (or Netscape, or even Mac’s Mail), because the majority of Outlook-centered viruses you see out there are the creations of script-kiddies who take advantage of Microsoft’s decision to allow attachments (and certain code) to automatically execute upon either preview or open.

So, while I wasn’t saying that Eudora viruses cannot occur, you probably won’t see one in the same vein as these Microsoft ones, because Eudora doesn’t handle its mail the same way.

That said, I agree: given enough time and interested people, I’m willing to bet any program can be cracked.

Yep. It was hell in a school district; although we were up-to-date with our Virex, the staff kept bringing in these damnable floppies from home…

31

Arggh! Didn’t you read where this report was from?! Google for “mi2g” and “D.K. Matai” so that you will know to never quote a report from them again…

I mean, surely it struck you as a little suspect that no-one else produced figures remotely resembling theirs?

32

I remember there being something else fishy about that study. Thanks dylan

33

OK, so mi2g are less than reputable. So can someone give us the straight dope on what systems really do get hacked the most?

34

It’s all going to depend on how we want to define hacked within the scope of the discussion. Basically you can put hacks into the two categories of virii and actual webserver hacks which lead to defacement, data theft, etc. The difference between the two being that virii tend to exploit a flaw in the actual OS of a computer while hacks exploit flaws in the daemon for whichever protocol is being hacked (telnet, ssh, http, etc.).

A discussion of OS integrity should really focus on virii since those are direct attacks against the OS for the most part. OS being defined in this case as the kernel as well as any software written so as not easily removable by a lay-person (like Outlook Express). If using virii as a criterion for OS integrity all one really needs to do is get a list of virii affecting each system take a count and maybe weight the results a bit based upon the potential damage individual virii can have on a given system.

While thinking about this I pulled up the virus list from the AV software on the computer I’m typing this on (a Powerbook running MacOSX) and from one of my NT servers. The results were, astounding.

MacOSX

Number of Virii-4810
Latest Definitions-08/01/2003

WinNT

Number of Virii-65074
Latest Definitions-09/18/2003

Something important to note is that while I was looking through the OSX list I found virii from the early days of System 7 as well as UNIX virii (which can affect it due to the BSD core) while the NT numbers were only for OSes with the NT kernel. Another note is that no virus on the list affected any MacOS later than System 9.2.
Now, the straight dope n which systems get hacked the most. I thought about this for quite a bit last night and I realized that the most reputable sources for such statistics would likely be hacker communities. Namely, those such as Attrition.org where the members post their successes in website defacement and server cracking. Unfortunately, at the moment the only figures I can obtain are from 2001 but they are quite the opposite of mi2g’s statistics.

According to the stats posted at Attrition.org about 58% of all successful defacements were against Windows machines while the OS only held 30% of the web market. I don’t how these relate to statistics for today, it appears that the only study that has been done is that by mi2g and we’ve already determined that those results are, at best, suspect. All we know is that Windows share of the server market has been falling, perhaps as a result of being the most hacked server.

Keep in mind that most of the onus on web-security is on the Administrator as webserver software has a tendency to be insecure in it’s default configuration. There is still, however great pressure on the part of the vendor to release a product that is secure when configured to be so (and given my experiences with supposedly locked down Windows machines MS has failed at this)

Register Article Summing up the Survey.

Attrition.org Study

35

Correct me if I’m wrong, but isn’t the computer virus properly pluralized to viruses? (Cite Discover magazine, November 1984, page 92, at the top of the third column.)

I’m always having to tell people that the plural of mouse is mouses, because in the words of an instructor at the college I attended, “it’s not an animal.”

36

"Two staffs
Make staves.

But two giraffes
Do not make giraves.

One giraffe
Makes me laugh."

-Ogen Nash

37

Yeah, well fuck you, Ogden Nash!! Asshole.

38

Viruses are microorganisms that give people inflammations and sicknesses.

Virii screw up computer boxen.

39

Amen.

40

From a message from jjimm, where he corrected me in another thread:

I think he is right.