PEBKAC Still Plagues PC Security

Billosaur writes "ARS Technica is reporting on a study release by McAfee and the National Cyber Security Alliance (as part of the beginning of National Cyber Security Awareness Month) that suggests when it comes to PC security, the problem between the keyboard and the chair is even worse. PEBKAC has always been a problem, but the study highlights just how prevalent it has become. 87 percent of the users contacted said they used anti-virus software, while 70 percent use anti-spyware software. Fewer (64 percent) reported having their firewalls turned on, and only 27 percent use software designed to stop phishing attempts. Researchers were allowed to scan the computers of a subset of the users, and while 70 percent claimed to be using anti-spyware software, only 55 percent of the machines of those users scanned showed evidence of the software."

And the solution is...

[It doesn't come easy (695416)]

I use Avast free home edition anti-virus program and that's it. No firewall (and I turn off the "firewall" that comes with XP) and no anti-spyware programs. And in more than 3 years I have had zero malware of any sort on my computers running XP.

The secret of my success is that I also don't use Internet Explorer (except for the Windows Update website, cause Microsoft makes me). That one step protects me from >95% of the malware. The other 5% is handled by Avast and Firefox. And I don't download and install "free" programs and games.

Boycott Internet Explorer (and all of the loss of security, privacy, and control of your own computer that goes with it), use Firefox and a good anti-virus program, and don't do stupid things on the net and you're golden.

Re:

[someone1234 (830754)]

How do you handle your mail?
Do you ever visit unknown sites with animations, pdf etc?

Are you sure?

[winkydink (650484)]

...And in more than 3 years I have had zero malware of any sort on my computers running XP.

That you know of. A lot of zombie-related malware is intended to be very stealthy.

Re:Are you sure?

[garcia (6573)]

That you know of. A lot of zombie-related malware is intended to be very stealthy.

They aren't stealthy enough to go through a logged firewall w/o being missed. IMHO, that's the best defense to any network -- paying attention to what the fuck is going on with your connection.

Re:

[It doesn't come easy (695416)]

I periodically monitor traffic on my home network and all the traffic I see is explained.

Re:Are you sure?

[Rycross (836649)]

Yeah, and there could be a huge Linux virus epidemic. Its just stealthy enough that its not being detected! Seriously, its become standard to retort to claims of malware free with Windows with "Nuh uh! You probably just don't know you have it!" which is stupid if only for the reason that such a claim isn't reasonably falsifiable. I know that a lot of malware is designed to be stealthy, but a lot of computer professionals know how to root this stuff out, and theres no reason to think that the grandparent is not capable of detecting it.

I've never been infected by malware. And I have confirmed this every time I've been challenged on that point. Doesn't stop people comming out and saying that I really am infected, I just can't detect it.

Re:

[winkydink (650484)]

Storm has, by some estimates, infected over 10 million machines. Vint Cerf, speaking at the World Economic Forum, estimated that as many as 25% of all computers on the internet are infected. How many of those do you think are running a/v? How many of the users of those infected machines that have a/v actually think they are infected?

I've sat at a conference of computer security researchers where it was discovered that one of the attendees was infected. So, it can happen to the best and brightest too.

Re:Are you sure?

[Rycross (836649)]

It can, but if that attendee actually bothered to look for malware, do you think he would have been unable to find it?

The point is that theres no reasonable response to "You may have malware, but you just can't detect it." I mean, if we posit the existence of undetectable malware, or at least malware undetectable by the poster, then what you have asserted is nearly impossible to disprove. Its simply lazy to respond to "I don't have any malware," with "You do, you just don't know it." Its like saying "Nuh uh! I WIN!"

If the above poster has actively looked for malware and has not found any, then its reasonable to assume he is not infected, unless you can prove otherwise.

Re:

[mwvdlee (775178)]

But that's the point; he only has anti-virus installed and DOESN'T use any of the tools that CAN detect other malware types, so he ISN'T actively looking for malware.

Re:

[Syberghost (10557)]

But that's the point; he only has anti-virus installed and DOESN'T use any of the tools that CAN detect other malware types, so he ISN'T actively looking for malware.

Whereas his lack of a firewall means that malware is actively looking for him. Based on the number of malware-indicating signs I get in my logs every day on my firewall, running on a dynamic IP on RoadRunner, I'd be very surprised if said malware isn't looking directly at his IP address many times a day, some of it using vulnerabilities he can

Re:Are you sure?

[suv4x4 (956391)]

Seriously, its become standard to retort to claims of malware free with Windows with "Nuh uh! You probably just don't know you have it!" which is stupid if only for the reason that such a claim isn't reasonably falsifiable.

It may be stupid but it's not wrong. I'm a developer and the kind of guy who sets his firewall as limited as possible, has anti-virus on, doesn't download "Free Smileys!!!" software, and in fact I'm very careful about doing things on my computer that may affect my security.

I thought I was clean, I looked clean, and the PC worked like clean. Until one day I the anti-virus detected a popular keylogger installed on my system (4 years ago). That was on top of that during a full-drive scan, not resident alert, who knows for how long was this thing running, and where it came from.

Bottom line is, the infection status isn't something easy to assess, especially if you're not very experienced in the area and especially if you consider that you're virus free by default.

The only way to not push your luck is know what you're doing, and turning your firewall off deliberately is equivalent to not knowing what you're doing.

If you ask me now, since I wiped my disk twice, and changed all my passwords and reinstalled everything since, am I virus free? I'll tell you yes.. but I'll NEVER be 100% sure in my answer, since I could easily be wrong.

It's not different on a Linux server by the way, so this is not a Windows vs Linux argument AT ALL.

Re:

[Rycross (836649)]

But you did detect it, when you bothered to scan your machine. Theres always the chance that if you run a full scan against your OS and come up clean, that there is some undetected malware there. But is it reasonable to assume that?

#1: I'm malware free.
#2: No you're not, you just don't notice it.
#1: Well, I rebooted into safe-mode, ran two anti-virus scans, some rootkit detectors, spy-ware detectors... all came up negative. My harwdware firewall shows no abnormal traffic...
#2: Maybe the virus also infect

Re:

[suv4x4 (956391)]

This is a complex system. It's never so perfectly running so you can claim "everything is all right so I'm clean" today.

Why is my disk spinning all the time? May it be malware? Oh yes, the indexer is doing this...
Why are my apps starting slow? May it be malware? No, after drfragmenting they start faster again... or is the malware now inactive?
What are those connections in my netstats? Well just about 40 apps I have which all absolutely need to phone home for updates, latest news, patches, and god knows what

Re:

[garnetlion (786722)]

its become standard to retort to claims of malware free with Windows with "Nuh uh! You probably just don't know you have it!"

That's because it's become standard for lusers to waltz into tech support with claims of "Nuh uh! I don't have any malware on my machine!" then be proven wrong about 3 seconds into a Spybot scan. I'm not saying you do, but it's a claim I've heard enough times not to take at face value.

Re:Are you sure?

[king-manic (409855)]

Yeah, and there could be a huge Linux virus epidemic. Its just stealthy enough that its not being detected!

Yes it's called vi. *dons asbestos vest*

Re:Are you sure?

[Rycross (836649)]

You need to work on your reading comprehension. I wasn't claiming that Linux was vulnerable. I'm saying its assanine to respond to someone claiming to be malware free by saying "No, you just don't realize you're infected."

I mean, go on, prove to me right now, without a doubt, that your Linux box is not infected by some rare virus that people haven't seen and don't know how to detect. And just to head you off, claiming "Linux doesn't have viruses" isn't a valid response. After all, maybe you're one of the lucky first people to be infected, and you just don't know it yet! See how convenient this is? You can't prove that you DON'T have a virus short of taking a dump of the bits on the physical platter and doing a diff.

Theres ways to be reasonably sure (as in, 99.999999%). There's no reason to believe that the poster that started the thread was not able to be reasonably sure.

But since you brought this up, tell me how you're going to prevent "Dear stupid user, please install this trojan as root to get your free cursors!" without taking control of the user's own computer away from him or her. You do realize thats how a lot of Windows malware is getting out there right now, don't you?

Oh and just so you know, there are trojans out there for Linux. One of the systems at my old job was cracked. Luckily the admin noticed that someone was trying to get a rootkit on his system. These cracks often involve software installed on the Linux system with incorrect security settings, as I believe was the case here. But thats the point: the security of the system ultimately falls upon the user not doing stupid things, which is impossible to guarantee without taking control of the computer away from said user.

Re:Are you sure?

[Architect_sasyr (938685)]

The tripwire installation (cold boot checking), Snort console and usage graphs say that my FreeBSD box hasn't been infected since it was installed.

There is one possibility, and that is there was code slipped into the repository prior to the 6.2-RELEASE CD's being created (verified the sum of the CD's when I got them) which could be rooting my box. I don't have the time to be doing (is it Orange book?) procedures that will ensure this doesn't happen. I'm with Rycross, there are so many ways to be infected that saying your not is just setting yourself up for a fall.

Re:

[kwark (512736)]

You are wrong on some points

1. you don't need to be root to cause trouble to others.
2. the executable flag doesn't control if things are runnable:
$ gcc -o hello ./hello.c
$ chmod a-x ./hello
$ /lib/ld-2.3.6.so ./hello
Hello World!
3. maybe.
4. we are talking about PEBKAC here, it involves some social engineering to get
5. I personally doubt it, the more mainstream linux becomes, the relative number of developers among them will drop.

But I hope you are right (maybe I'm just pessimistic).

Re:

[Brigadier (12956)]

this is the truth. At my company we are considering going back to cloned drives that get re-cloned once a month. even with spybot,windows defender, company firewall, and f-secure people still get infected.

My Theory: XP can work, but not with kids

[spagetti_code (773137)]

Similar here, but I've run XP, *no* AV, *no* anti-spyware etc for 4 years. I do have a firewall/wireless hub for the house. I browse with Firefox only, and thats kept up to date and has Adblock and NoScript. My mail is scanned (although quite a few nasties sneak through).

My wife is computer illiterate, but she knows she's only supposed to open a small set of attachments and sees me about the rest. She knows not to open anything she doesn't recognize.

4 years, no viruses/spyware etc. I've tried a couple of those online scans and they came up clean.

However, now the kids are starting to use the PC.... I've switched to Ubuntu. I not convinced I can set up an XP machine that can't be infected by them.

That switch was a *major* pain. Switching MSmoney to gnucash, losing Photoshop, copying outlook mail history to evolution, loss of PDA syncing, blah blah blah.

Re:

[rtechie (244489)]

I not convinced I can set up an XP machine that can't be infected by them.

Removing Administrator rights in XP stops 98% of possible malware infections, since it's difficult to install ANYTHING. You can even have them use IE 7 safely because they won't be able to install ActiveX controls and the JVM is likely to flip out given the rare possibility of a Java exploit.

Of course, they can't install anything. And you might run into the occasional app that requires Administrator rights. I strongly suggest you don't use these apps because it is network-aware apps with lousy coding pract

Re:My Theory: XP can work, but not with kids

[suv4x4 (956391)]

Sure you can, if you combine your malware with an elevation of privileges exploit.

Since 99% of Windows XP-s out there run in admin mode all the time, I'm pretty sure none of them is particularly well doing in the privileges exploit area.

Also this is the user level. Getting privileges higher than the current user isn't so trivial to exploit, since typically the entire browser will run at that level, including any add-ons and plugins. You do need to exploit an app running under admin, and if there's no such, you can't exploit anything.

Re:

[dc29A (636871)]

The secret sauce is to not run Windows as administrator. You don't even need anti virus programs.

(1) Don't run Windows as administrator. This is the most important thing you can do to secure your Windows PC.
(2) Use Firefox or Opera, if FF, use AdBlock+ and NoScript addons.
(3) Use common sense. If you "Click here to win 20000$" sounds too good to be true. Yup, it is probably an invitation for malware.
(4) Avoid downloading awesomevideo.exe when surfing for pr0n (or cracks/serials). In fact, treat every execut

Re:

[Jeremi (14640)]

Use a VM to test them. Free virtualization is available and is easy to use

Running it in a VM will probably keep your main system from being infected, but how do you know when it is safe to move the suspect executable out of the VM? No matter how long you run it, it could be that the malware portion will only activate after a bit longer period than that...

Re:

[jon_joy_1999 (946738)]

I find that most users who are the opposite of you (I have one friend who doesn't even have any of the XP service packs installed) don't understand computers, the internet, or other humans, because they "have better things to do" like posting on myspace, or txtng there frenz mang. the one without any of the service packs installed gave me her computer to fix. I counted at least three popup advertising programs, and one virus with just the task manager. I downloaded SBS&D and found 67 other problems. the

Re:

[thePowerOfGrayskull (905905)]

Same here, except: 1) I use a hardware firewall since I need to connect multiple computers to the Internet anyway, and use windows file sharing on my LAN. 2) No antivirus except clam, which I run once a month to make sure I haven't done something stupid.

It's amazing how unnecessary all the bloated antivirus, firewall and other security software is. Of course, this 'study' highlights that "on noes, a lot of people not using AV!" which is only natural considering the source.

The fact is, the simple act of

Re:

[Von Helmet (727753)]

If you want to stop using IE altogether, you can use Windizupdate, which works with Firefox and Opera, and possibly a couple of other browsers.

Can I get a "Well DUH!"

[Chas (5144)]

Nothing is ever, EVER going to be idiot-proof.

Because idiots are both highly prolific and highly creative.

Unless the world standardizes on a single platform, and never, EVER changes it again, this is always going to happen.

It's a matter of "that's not how I learned it" or "I never learned it", and they wind up making the systems do things they aren't supposed to.

It does, however, go to show you that even hordes of security professionals can't be collectively omniscient.

As always, "security" is a PROCESS, not an endpoint, not a product.

it is not a user fault

[siddesu (698447)]

as computers have become more powerful and versatile and the software more complex, the average user has a choice -- either become a nerd who follows all news, and spends large portion of their time learning about new technologies, how they are integrated, what risks are there, etc.; or ignore the problems, _trust the vendors_ to mostly do the right thing, learn the part of the interface they care about and react if they get hit. it is just not realistic to expect a user to know a lot about computers, as it is unrealistic to expect that a sick person can successfully self-medicate themselves to health.

so, while the problem is between the chair and the keyboard, it is between the chair and the keyboard of the people who create the software, and not the people who use it. mostly.

Re:it is not a user fault

[big_paul76 (1123489)]

Here here.

In WWII, they had frequent aircraft crashes caused by pilots landing with the gear up.

They consistently attributed these accidents to "pilot error".

Then somebody took a look at the design of the cockpit, and realized that it wasn't designed in a way that would make it immediately obvious to a pilot whether or not the gear was up or down. When the cockpit was re-designed, the high rate of 'gear up' landings evaporated.

In other words, the designers were blaming the users for a design flaw. Happens all the time in the software industry these days.

I'm not saying that PEBKAC errors don't happen, or that idiots don't do stupid things. But I suspect that a large slice of the cases we classify as "user error" should really be called design error.

Re:

[fredklein (532096)]

See? See?!? Slashdot didn't make it "immediately obvious" that I failed to close my tag properly. Blame Slashdot!!

Re:

[siddesu (698447)]

your analogy would be true if the people had at their disposal equipment for dealing with computers similar to the one they have to take care of disease and so on in their bodies. as it happens, it is the body that takes care of all these, and the person doesn't participate in the process. the various over-the-counter medicines mostly make the process less painful. why is that so? because the body (or the person) has other things to do.

so, to extend _your_ analogy, just as the genes -- the ultimate designer

Re:

[Chas (5144)]

"On the other hand, we could solve this problem tomorrow by forbidding any user-installed or user-downloaded program to run with root privileges."

Pedestrian to a jumper on a ledge: "I forbid you to jump."

Jumper: Eeeeeeeeeeeeeeeeeeeeeeee! *SPLAT!*

You can forbid all you want.

You can codify it in corporate rules.

You can come up with all sorts of intricate technical controls to enforce it.

Some idiot is STILL going to find a way around it.

I would say

[chuckymonkey (1059244)]

that this really is not news to the crowd that hangs out here on /. We promote good security so much because we already know what the above mentioned article states. It is nice to have some numbers, although I'm always skeptical of "facts" on the interwebz.

PEBKAC Combined with a Nightmare of an OS, Sheeple

[Zombie Ryushu (803103)]

If you combine PEBKAC with the nightmare OS that is Windows, you see the dark and terrible Hell that has been created. Granted, it is true that alot of people who use computers don't deserve them, but everyone feels they are entitled to them. Really, the majority of people haven't earned the right to use computers, because they have no discipline to do so. But they will anyway, because there is money to be made. Its like giving Guns to chimps.

I started on Tandy 1000 286s, and Commodore 64s, so I have that discipline, that experience, I learned how to walk before I ran, and ran before I flew. But that just isn't the way our world works.

Do realize that the actions these insecure people with irresponsible habits take affect the lives of millions of people through scams, and DoS attacks.

perfect business plan, yeah!

[Uksi (68751)]

Can't wait for the "disciplined computer user" licenses, we can lock all those computer illiterate retards out!

Re:PEBKAC Combined with a Nightmare of an OS, Shee

[dc29A (636871)]

the nightmare OS that is Windows

What's wrong with XP SP2 security wise? Or Vista? or Windows 2003 Server? Care to elaborate? No really, what is this big nightmare about Windows security post XP SP2?

Just because the users are stupid and run Windows as administrator, doesn't mean the OS itself is insecure [amazon.com].

PS: I am posting this from my Kubuntu Feisty machine.

Re:PEBKAC Combined with a Nightmare of an OS, Shee

[TheQuantumShift (175338)]

"I started on Tandy 1000 286s, and Commodore 64s, so I have that discipline, that experience, I learned how to walk before I ran, and ran before I flew. But that just isn't the way our world works."

Um, no. You ran as fast as you could on those Tandys and Commodores, which inspired you to run on to the next thing when it came out. Get off your high horse and quit whining about all the "stupid lusers". I think people like you are the only ones feeling "entitled" to anything.

Just because the general popu

the blame game: pass the buck as always...

[jdogalt (961241)]

So let's see, it's not software that is broken and buggy, but rather the problem is the users that 'inadequately' act as an insanely complex added layer of security, managing a bunch of brain-numbingly-unrewarding security layers.

This article reeks to me of a security industry that is proactively trying to cover its ass, primarily because of the fact that the only reason they thrive is because microsoft 'needs' to keep it's source closed, and the public 'needs' an illusion of security.

Sorry, but I've recently gone through about my 5th runaround of giving selinux-Enforcing an honest try, and realizing yet again what an utter pile of useless shit it is (for the vast majority of Fedora users at least). (review my past comments which I won't argue over again... or just laugh as setroubleshootd tells you how the solution to your problem is to reboot and force a relabel... pulling in hardcoded path state from /etc/selinux/....)

Wake up and smell the insecurity folks and get used to it. Don't say anything within earshot of a mobile phone's mic that you wouldn't feel comfortable with any telecom employee overhearing... or anyone those employees might give network access to...

It's a brave new world. Don't give me this shit that the users are to blame.

This Slashvertisement rates a 4.2 out of 5

[xxxJonBoyxxx (565205)]

...a study released by McAfee...87 percent of the users contacted said they used anti-virus software, while 70 percent use anti-spyware software. Fewer (64 percent) reported having their firewalls turned on, and only 27 percent use software designed to stop phishing attempts.

This Slashvertisement rates a 4.2 out of 5.

It caused many readers to wonder, "if McAfee has an all-in-one package that can handle all my anti-spyware, firewall, anti-virus and phishing needs?". However, McAfee was unable to get the actual product it was trying to pitch in its press release on Slashdot.

Well done (though not perfect) - another high-five to my those PR pros!

Re:

[Lumpy (12016)]

But McAfee does do all that. by consuming 98% of your computers processing cycles and making every file operation go through 30 or more operations first, malware does not have any computing resources left over for them to run.

PICNIC

[Saint Stephen (19450)]

Problem in Chair, Not In Computer. PICNIC.

That's the phrase I heard used to describe this condition.

Re:

[complete loony (663508)]

ID-TEN-T error.
There's a nut loose on your keyboard.
OSI Layer 8 error.
There's heaps of ways to describe the problem.

They've identified the wrong problem

[Arrogant-Bastard (141720)]

The problem is not that users fail to use anti-virus, anti-spyware,
anti-phishing, anti-left-handed-metric-wrench software.

The problem is that users CHOOSE to use operating system and
applications which are so miserably designed and written that they
are susceptible to these problems as-shipped by the vendor(s).
(I take the position that any OS which needs anti-virus software
to survive in the wild is clearly broken and should never by used. By anyone.)

Anti-* software is a band-aid. Its use is a clear indication that the
product it's trying to band-aid is broken. And anyone deliberately
using known-broken products should not be very surprised if Bad
Things happen as a result.

It continues to amaze me that anyone is surprised by this --
although I suppose by now I ought to have gotten accustomed to
this state of affairs. [Some] people install obviously defective
operating systems (e.g., any version of Windows), use obviously
defective mail clients (e.g., Outlook), use obviously defective
web browsers (e.g., IE) and then actually expect that they can
somehow make up for this series of stunningly poor decisions
by installing enough add-ons. It doesn't work, of course, which is
why we see hundreds of millions of infected systems out there,
spewing spam, conducting DoS attacks, poking at web servers,
brute-forcing ssh servers, and so on.

My point being that by the time the conversation has gotten to
anti-* software -- it's too late. The damage has been done, and
there's no undoing it (despite lots of wishful thinking and the
earnest assurances of anti-* vendors, who of course, let's not
forget, have a substantial profit motive).

(Ah. About this point, some M$ apologist will raise one of the
usual canards -- for example, "M$ products are attacked because
they're popular". Not true, of course; M$ products are attacked
because they're miserably weak as a result of incompetent design
and even worse implementation. M$ is hardly alone in this, it's
that for some inexplicable reason, it seems to attract the most
defenders -- despite the fact that as possibly the most well-funded,
well-staffed, well-equipped software company in the world...it
has repeatedly proven that it can't even write a decent mail client.)

So. These studies shouldn't ask questions like "Are you using
anti-spyware?" They should ask questions like "Why are you dumb
enough to use an OS/application software combination so badly
written and maintained that anti-spyware is deemed necessary?"

Old viruses still prevalent

[whereiswaldo (459052)]

Several of the top viruses of 2006 were over 2 years old (according to a report by Sophos). Obviously there was anti-virus protection available for those threats but many, many people aren't protecting their computers. It's no wonder why creating huge botnets continues to be so viable.

Re:

[ShinmaWa (449201)]

The problem is that if the user can kill it, so can the virus. A lot of viruses have anti-anti-virus routines built in them to detect and disable anti-virus software from detecting and disabling THEM. It's a warzone out there.

Because of this, anti-virus software embeds itself very deeply in the system and runs with ring 0 privs to prevent virii from subverting them.

Re:

[Vegeta99 (219501)]

Health class is a bit like having a class for condom enthusiasts who sit around talking about how the average user doesn't wear a condom. And then having a good old laugh at them while at the same time being a smug prick.

These people may have more sexually transmitted diseases, but i bet they get laid more often.

Re:

[wellingj (1030460)]

One day, we'll look back at PC security of today and laugh at the crap one had to go through just to not have your typical PC go down in flames.
...Could be tomorrow if you downloaded an .iso [debian.org] tonight.

Why are you proud of using broken tools?

[argent (18001)]

To all of those who are crowing that they haven't run virus protection or spyware scanners in xx years. Why are you proud of this fact.

Because I've been a network administrator herding a 100-400 programmers plus their administrators and secretaries and sales guys and so on, for 20 years. And I do protect myself.

* Don't use Windows at all unless you have to.
* If you have to, don't use any application that uses the HTML control on untrusted content.
* If you have to, don't run any services on it you don't need

Re:

[The Cisco Kid (31490)]

Ah yes, and companies that make arc-welders should take into account so the average moron can weld. Oh, and rocketships should be more simpler. And backhoes.

A computer is neither a toy now an appliance. It is a tool. It is a very powerful and complex tool. Expecting a "computer company" (Im not sure if you are referring to PC OEM's like Dell and HP, or Microsoft) to be able to successfully design a system to be both meaningfully usable by an idiot to accomplish anything useful while still remaining secure i