The NYT on the Proliferation of Botnets 244
ThinkComp writes "The New York Times has a up a story on the proliferation of botnets. The article cites a number of security researchers who paint a depressing picture of the state of internet security, and concludes with the suggestion that for home users, buying a new 'updated' PC may be the only real solution. Unfortunately, as most of us know, given the number of outstanding flaws in software and the ingenuity of malicious software authors, that might not even help."
Well, that's sorta backwards (Score:3, Insightful)
running under Linux (win4lin) and behind a paranoid
firewall is safer than XP or Vista.
Alas, not as safe as an unpached RH9, mind you,
but still safer than Vista (;-))
--dave
Re:Well, that's sorta backwards (Score:4, Insightful)
but still safer than Vista (;-))
You say this with what evidence?
Vista hasn't even been released to the public yet and the only versions people have seen are unfinished betas and a very few corporate users who have started playing with the new RTM Enterprise. You know you're on Slashdot when a product that isn't even out yet has already been relegated to the insecure/unsafe/junk software category.
However, I see you have that little winky smiley thing at the end of your post. Does that mean you're just kidding and it's all a joke? Or are you serious, but going under the guise of joking so if somebody calls you out on your statement you can just say "whoosh!"? Emoticons are stupid--better for people to say what they mean and stick with that.
Re: (Score:2)
Such optimism!
Truth is, every new piece of software is insecure junk until proven otherwise. Almost always, that takes time and exposure, and patches. Certainly that's been the case with past MS OS's, and Vista has a lot of new code. Sorry, nobody gets tens of millions of lines of new code [symantec.com] exactly right the first time. You'd
Re:Well, that's sorta backwards (Score:5, Interesting)
Re:Well, that's sorta backwards (Score:4)
I bet most slashdotters aren't even aware of DEP or using Run As to actually take away rights from a process in XP, so if a bunch IT geeks like /. don't know how to keep XP secure, then neither will users. XP has its share of security problems, but by and large the majority of them are caused by ignorance. The only way to really combat ignorance is to remind them "This is dangerous!" every time they do something risky. I would rather Vista err on the side of caution w/ UAC. The time lost clicking "Allow" all the time is less than the time lost having to restore a compromised machine.
As for the rest of your comment, I agree completely. Cheers.
Re: (Score:2)
Emoticons exist to clarify what is being said. Therefore, it's part of what's being said.
Re: (Score:2)
Re: (Score:2)
Look at it logically and focus your efforts. (Score:5, Insightful)
#1. Worms - if you don't have any open ports, then you're pretty much immune to worms (unless they can crack basic TCP/IP operations). Ubuntu ships BY DEFAULT with no open ports. Windows ships with lots of open ports. Change that behaviour and you've solved an entire CLASS of attacks.
#2. Viruses - an infected program infects other programs, but does not otherwise change those programs. This is not very common now.
#3. Trojans - this is the biggest current threat. And there is no real way to remove it 100%, but it CAN be limited (again, look at Ubuntu). This is primarily a social engineering attack. You have to convince the user to run an app or open a message that will exploit a flaw in their email app (and so forth).
So, why aren't we seeing a focus on the biggest security issue?
Why hasn't Microsoft released a bootable CD so you can run the anti-virus/spyware/adware stuff easier? Clean up the junk AND patch the vulnerabilities in Outlook. Even if it means turning off some of the functionality.
If you cannot do it securely, then you should not do it.
Re: (Score:3, Informative)
Firewalling them is not the same as closing them. (Score:5, Insightful)
Nope. There are still lots of ports open, it's just that Microsoft put a firewall on the system, too.
The problem still exists. But now there is a wrapper obscuring it that you have to get through. That isn't solving the problem. That's just attempting to hide it.
And exploits have been found for Microsoft's firewall. Which demonstrates the problem with not solving it at the lowest level.
I can put an Ubuntu machine with a default install onto the Internet without any firewall and still be safe from worms.
I cannot do that with WinXP (or Win2K or Win9x or WinNT). If you aren't solving the problem at the lowest level, you're not really solving it. You're just hiding it.
Re:Firewalling them is not the same as closing the (Score:2, Insightful)
Re:Firewalling them is not the same as closing the (Score:4, Informative)
Re: (Score:3, Interesting)
Firewalls are bandaids, there is no replacement for well written, secure code.
Re: (Score:2)
Firewalls *should* be bidirectional filters. That is, they filter what goes out (egress) as well as what comes in (ingress). You are probably confusing them with NATs which usually allow anything out and provide some limited means for inbound port mapping. The XP firewall, when correctly configured will filter egress. Unfortunately it is relatively easy for an application to override. For example any kind of SMTP spambot needs to be able to send out SMTP (and probably hook up with IRC). If SMTP is blocked e
Re: (Score:3, Interesting)
Open Ports (Score:2)
Re: (Score:2, Insightful)
Well thats not really true. There is almost an unlimited number of ways a machine can be compromised.
Most of them still valid.
A program written for a specific task downloaded and run by the end user does not fall into the categories you list.
First problem with XP and SP2 was its new security features did very little. Like come on it now asks the end users is this ok to run ? but the problem is the first time they saw things like this every time they clicked no their programs didnt work. So from then on they
Re: (Score:2)
I would have thought the biggest problem at the moment are web browser vulnerabilities - which is why I use Noscript.
Re: (Score:2)
Is Bill Gates moderating? (Score:2)
His post seriously addresses TFA, and the only possibly flame-like statement has a smiley after it. Somebody please scroll back and mod him up.
Capitol Punishment (Score:5, Funny)
O.K.,O.K. maybe just corporal punishment
Re: (Score:2)
Re: (Score:2, Funny)
What is "capitol" punishment? A stick of dynamite in the rotunda?
You mean "capital" punishment.
Re: (Score:3, Funny)
Re: (Score:2)
The bareass corporal punishment should be reserved for female crooks of appropiate age.
The rest should be rid of -- but, sending them to the Capitol would count as a cruel and unusual punishment.
Make Microsoft liable (Score:5, Insightful)
If you sell me a chain saw, and I ignore the instructions and cut off my hand, it's my own damn fault. If I ignore morality and criminality and cut off my spouse's head, it's still my own damn fault. But if the chainsaw goes off on its own power, while I'm sleeping, and slices and dices the whole damn town, it's your fault for selling me such a product, especially if you manufactured it with the knowledge that it could, in certain not-uncommon circumstances, do exactly that.
Re: (Score:3, Interesting)
And what if it's a GPL'd chainsaw that you made in college, put on the internet for people to copy and use if they want, but never took the time to test thoroughly?
Re:Make Microsoft liable (Score:5, Insightful)
Ever been part of the warez scene on IRC?
I'm assuming you haven't, so I'll explain. That system is entirely trust based, and self-regulating. If a file ever comes from anyone which has a virus or anything else suspect included, the source of the file immediately gets ostracised, at least as a source, and most likely in terms of download access as well, since the system is based on reciprocal trade. Wrong, I hear you say...what about cracks coming from warez *web* sites or p2p nets which have malware? Said malware would likely be put into the archives by the webmasters of those sites themselves...the upstream cracking groups would NOT be doing it, because there are a lot of people in the warez food chain who are not going to want to receive/propogate known malicious files. ANY group which includes files for compromising a system with a release has just destroyed its' ability to subsequently release files that people will trust at any point in the future. Ditto for eMule files that have nasties in them...they get intercepted/recreated downstream. That is part of the entire reason why nets like eMule use the sorts of file hashing systems that they do; if you know the hash of a particular group's release, you can download said release and get entirely clean warez.
Ditto with any moron who was going to be dumb enough to try and write GPL licensed malware...they'd gain a horrible reputation very, very quickly. The other thing is, anyone who is sufficiently interested in doing the wrong thing as to be writing malware in the first place is not going to care about licensing it unless they are exceptionally stupid...which malware authors generally aren't. Sociopathic and deserving of being used as live shark bait, yes. Stupid, no.
Accidental bugs which lead to buffer overflows and such are different. They are unavoidable, and people know that...despite the best of developer intentions, occasionally they happen. As such, although the author of said bug will not risk ostracision for authoring it, in most cases (at least if the program in question has more than half a dozen or so users) it gets patched very quickly.
Re: (Score:2)
Yep. Those bugs were accidental... really.
Breaking Warez (Score:2)
Re: (Score:2)
Hey, yank the network cord and yo
Re:Make Microsoft liable (Score:5, Funny)
Hans Reiser, is that you?
Re: (Score:2)
Re: (Score:2, Interesting)
And i was thinking about this the other day. Thats why software typically isnt bought by end users but licensed on an "as is" bases.
Re: (Score:3, Insightful)
This psychotic-chainsaw-with-artificial-intelligence analogy is one of the dumbest things I've ever heard. Maybe the author of that post is really so ignorant about computers that he believes them capable of free-thought and action. If he is, I feel sorry for him. The people who modded him up, though, should know better. Computers require programming or user input, or both. Either way, they only do what SOMEONE ELSE has told them
Re: (Score:2)
Re: (Score:2)
When a corporation creates a product that is unsafe not just to its user, but to many thousands of others, and provides instructions for that product which, even if faithfully and fully followed by its user, are insufficient to prevent it from causing damage and suffering to thousands of others, that corporation should be liable for the damage and suffering.
If you do this with Windows, you're fine. How is it going to help, again ?
Re: (Score:2)
Buying a new computer won't help you (Score:2, Insightful)
The people offering this "advice" have got to be idiots. True, it might cost more to pay someone else to de-own your PC and train you on how to avoid problems in the future than the cost of replacing the hardware. That doesn't mean that educating yourself isn't the right answer though. What does buying a new machine do to make you more secure? Buy a $400 brand spankin' new bottom of the line Dell, throw it up on the net, and get owned in under 20 minutes.
Re: (Score:3, Insightful)
Buying a new computer won't help you unless you know how to secure it and maintain it.
I'm guessing the poster thought that was the advice based on the closing anecdote. In it someone ran into trouble because their current PC was a botnet client. They weren't running the security software provided by their ISP because it overwhelmed their PC, and were buying a new one that was powerful enough to run all of the anti-virus/firewall/etc. protection they need.
You don't need to be a security guru, but you
Not quite.... (Score:5, Insightful)
Ummm, most Mac OS X users don't have to know anything about TCP/IP or NAT, etc. Of course, they have an OS that has security built in at a very low level, not tacked on as an after thought. Windows, at least through XP, is still based on the notion that it wants to make it easy to connect to everything and everyone. As such, it's pretty open and malware takes advantage of that. OS X and the various *nix distros start at the other end of the spectrum where things are locked down unless you open them up (although OS X has more opened up than, say Ubuntu and various other linii).
As others have posted, if Windows shipped with all ports closed except those that were really needed, then the user wouldn't need to worry about all these things. They wouldn't be opening a port until they needed it for some specific application and then that application could explain the dangers, if any to having the port open. It's basically a compromise between ease of use and security. Microsoft chose to maintain it's ease of use model from the pre-internet days, when everything was local and has tried to add security on top. It just doesn't work that well.
So, the real choice is, it seems, that if you want a Windows pc, then you need to learn about TCP/IP, NAT, firewalls, etc. On the otherhand, if you just want to use your computer, either buy a Mac or put a secure Linux, like Ubuntu, on your pc. (I just use Ubuntu as an example, there are others, too)
Re:Not quite.... (Score:4, Interesting)
I cannot believe people are still saying this. How many stories about botnets do we have to have on Slashdot before people realise that UNIX is not secure either.
Look. The vast majority of this crap comes in via browser exploits these days. Running malicious attachments etc is not such a favoured technique anymore. There is nothing in UNIX that stops applications from being written in an insecure fashion, there is nothing in UNIX that stops apps hooking each other to hell and back (which is largely what these bots are doing when they steal data), there is nothing in UNIX that even makes it hard to install a rootkit. Just phish the password out of the user, or wait until an authentication dialog appears and overlay your own, or wait until a privilege escalation attack is found (new ones appear all the time). But as you don't need root to steal data, send spam, display popup ads or any of the other things bots do this is really just a nice-to-have bonus, it's not essential.
The fundamental architecture of Windows NT is no different to UNIX these days. They are both seriously flawed because they are based on a threat model from the 70s, when the world of computing was totally different. Having an administrator user and also a "regular" user who are really the same person is a nasty hack that doesn't solve the problems at all. Apple don't have the answers ... have you seen how easy it is to suck SSL protected form data out of Safari? Neither does the Linux community. SELinux has gone down the route of totally static policy, which is fine for servers but worthless for desktops.
MacOS and Linux are statistically insignificant, but if people keep recommending them as a "solution" then soon they won't be and then we'll find, oh look, it's just as easy to create Mac botnets as it is Windows botnets. What little trust is left in computer security people will then be gone.
The fact is, residential computing is fucked. Utterly, utterly fucked. The guy quoted by the NYT is right, the war was already lost a long time ago, and people keep pretending it wasn't. The war was lost when the computing community decided that user based DAC security models could stop malicious software. They can't, they don't, and they never will so please stop saying MacOS or Linux are somehow inherantly better, when they aren't! They are at best temporary band-aids.
Re: (Score:2, Offtopic)
As for the fundamental architecture of NT being no different than Unix, well maybe, maybe not, but the security model sure is different. By default on Windows, everything is open and accessible unless you shut it down. Even if you don't enable file and print sharing, there are hidden administrative shares that can't be disabled without droppi
Re:Not quite.... (Score:4, Informative)
Really? Every XP box has hidden files shares turned on automatically. There isn't anyway to turn them off without resorting to executing a batch file after Windows starts. If you are relying on the Window's firewall for security, it is only providing a false sense of security, at best. There have been numerous tech articles against it (yes, it is better than nothing, but it isn't a full firewall).
Many malware rely on open ports to do their dirty work (connecting to IRC is just such an example). Several Linux distros have all ports disabled, other than those needed for actual use. OS X has most ports disabled. Even with the Windows firewall, there are many ports that are open, because otherwise, all the "neat" things Microsoft has touted you can do won't work. The problem is, that they are open whether you do those neat things or not and they don't show as an open threat because Microsoft wants them to be open.
Try it for yourself. There are many security websites that you can hit that will "test" your pc and tell you what is at risk with the default Windows settings. In short, the default Microsoft security settings may stop the kid down the block, but they won't stop the real hacker any more than copy protection does on CDs. At best, it just makes it a little less convenient.
The safely ignorant (Score:2)
That's not really required. My aunt runs a Windows 2000 install I set up for her, she doesn';t have the admin password, IE, Outlook or the ability to install software and has never had a problem. My sister has a Mac, she keeps a seperate root account and has never
Re: (Score:2)
Re: (Score:2)
An easy answer (Score:5, Insightful)
Any traffic that isn't specifically requested by the user is blocked. You manually open and close ports as you need them.
Oh, right, that would break most authenticity checks to combat "piracy", and totally botch most advertising on the net, and set us back to the early 90s. BTW - sign me up.
Re: (Score:3, Insightful)
Well .... No, not exactly ... unfortunately.
Re: (Score:2)
Of course the idea needs more thought. And internet traffic needs more control. Why should I need to have random packets going out and back when I'm not doing anything on the net? DHCP keep alive? UPnP? I say bullshit. I'm not running server apps, so there isn't a need to be on all the time. I shouldn't have to use a sniffer on a machine that is idling. And my OS should
New PC (Score:5, Insightful)
Re: (Score:2)
This story brought to you via the botnet which tookover the NYT.
The root of the problem is responsibility (Score:5, Insightful)
The core of the problem is responsibility, or a lack thereof.
Vendors aren't responsible for the results of the flaws in their programs. Worse, they aren't responsible for deliberate design decisions that make it impossible to secure systems. I make an analogy to automobiles. Auto makers aren't generally liable for defects in cars, unless the source of the defect goes beyond a simple mistake or defective part, but they are responsible for repairing those defects and can be sued if they refuse to do so. And they're liable for design decisions they make. Witness the Ford Pinto. The current state of software liability is akin to Ford claiming that, because they had a valid business reason for building the gas tank on the Pinto the way they did (it was cheaper, thus let them price the car cheaper), they cannot be held liable for the fires that happened as a direct result of their decision. The courts slapped Ford around for making that claim, why are software vendors not treated the same? I can live without strict liability for software flaws, but lack of liability for design decisions that directly lead to security problems is probably the biggest reason we still have problems.
And users aren't held responsible for their use of a computer. They treat it as some sort of plug-and-play device like a television or a radio: plug it in, turn it on and stop thinking about it. A computer isn't an appliance, you can't just ignore it after initial set-up. Again, cars make a good analogy. You can't just ignore a car's maintenance after you buy it, you need to put new tires, new brakes and such on it regularly. And car owners get held liable if they don't. If you wore your brakes out so they don't work anymore and didn't get them serviced, when you rear-end someone because you don't have any brakes you will be held responsible by the courts and the insurance. If you're running on bald tires because you don't think you should have to check and change anything, you're going to get ticketed by the cops at some point for unsafe mechanical condition and the car's registration will get suspended until you fix the problem. Sure it's a hassle and expense to keep maintaining all those things about a car that need maintained, but we don't accept that as an excuse for someone not maintaining them and causing damage or injury to others as a result. So why do we let computer users off the hook when they say "But I don't know anything about computers!".
Software vendors and computer users need to grow up. They've been both acting like spoiled 5-year-olds who were running in the house after being told not to, knocked over the china cabinet and broke everything in it, and now that Mom and Dad are standing there they're whining that they shouldn't have to own up to it and take their punishment. No dice.
Re: (Score:2)
Because the "damage" they cause is very small, and virtual in nature (an annoyance at most.)
when they say "But I don't know anything about computers!"
Because 100% of the lawmakers are firmly in this category?
Re: (Score:2)
Yeah, sorry... I sort of stopped reading right there.
Computers aren't cars, webpages aren't newspapers, and the Internet is not a highway.
The closest real-world analogy to a botnet would be an engineered real-world virus, and even that isn't a good enough analogy to come to any conclusions with. (For one thing, nobody is a "manufacturer" of human bodies, so the blame situation would be entirely different.)
Friends don't let friends make car analogies. Do your part to put a st
Yeah, But... (Score:2)
Re: (Score:3, Informative)
I don't know, I see the basic advice about security everywhere I look. You can't go to any security-related Web site, or even Microsoft's site, without hearing the basic common-sense rules I learned from other people in the BBS community back 25 years ago when I was in high school. Don't install software from sources you don't know and trust. Don't use software that downloads and runs stuff from external sources automatically. Put a hardware router with a firewall between your computer and the Internet. E-m
Yes! Buy a new PC... (Score:3, Insightful)
and sell your old one cheap.
Just the other day I bought an older Dell that "wouldn't boot" for $15, sans hard drive. An hour of hacking around inside, and I was able to get it going. It's a little old, but it'll make a nice LiveCD tester.
Consumers are getting raped by MS and Dell, but they're not going to learn, so might as well take advantage.
Re: (Score:3, Interesting)
"Same old," Arthur says. "How's the writing thing going?"
"Harder than I expected," I say. "But thank God for computers. I can't imagine typing this all out on a typewriter."
"Computers are great," Arthur says. "Until they go wrong."
"Ain't that the truth."
"My old computer was so infested with porn I had to throw it out," Arthur says.
"No way," I reply, taking a sip from my martini.
"I'm not kidding."
"Couldn't you reformat the h
Doesn't advise getting a new PC for everyone (Score:2)
Did anyone really expect a middle-aged, non-techie to think "Gosh, I should finally install Linux with a lightweight window manager!"
Re: (Score:2)
the computer slow to a crawl, I'd say that the
'security software' was actually malware/spyware.
Re: (Score:2)
I am offended every time an ISP tries to install software on my computer. When we go to the gas station, do the attendants try to glue widgets to our upholstery or steering wheels?
It's damned AOL, convincing people wrongly since the beginning that "The Internet" is a piece of software on their computer. It is not. It is a utility, and an ethernet cable is just like a power cord.
(This small rant after a Verizon FIOS install put shedloads of crap on my parents' PC. I had to explain to them that this c
Re: (Score:2)
Building botnet's is simply too lucrative a business.
Re: (Score:2)
Um, no. Users run without root as a default on Linux. Most dists warn users to be careful with their root account. With XP, you can deprivilege your users, but that isn't the case by default.
I'm no fan-boy of either system and can also say that the basic windows security architecture is much better than Linux with a very fine granularity of rights and privilege levels. Unfortunately, they are poorly documented and even Microsoft themselves can't use them properly within the applications.
New PC isn't going to help... (Score:2, Insightful)
Ubuntu (Score:2)
Push for Windows CDs (Score:5, Insightful)
Heck, a 700MB USB flash drive isn't expensive now. They should build read only flash drives with windows into the box, and put an option to run a reinstall in the bios. Solder it in so no one will steal it.
It's the least they could do, considering. I mean, Windows compes preinstalled on almost every PC sold, and there are a zillion pirate copies of Windows floating around on the net, so hardly anyone needs to steal it, and anyone who wants to steal it can. But legitimate users are screwed when they have problems because they don't get CDs, because giving them CDs would encourage piracy. And, I suspect, because it's good for business if people trapped in a monopoly have to buy extra computers to solve this problem.
Re: (Score:3, Funny)
Re: (Score:3, Interesting)
I had suspected that my Windows 2000 installation may have been compromised in some way so I wanted to reinstall it. Unfortunately, it took me several days to find one of my two original installation CDs. I found both of them, then I remembered that they were both Windows 2000 upgrade disks, so I will also need to find either my Windows 98 disk, my Windows ME disk or one of my two Windows NT 4.0 disks, none of which I could find. So I couldn't reinstall Windows. If that had been Linux I would have just
Re: (Score:2)
If I recall correctly, an upgrade install looks for an existing install on yo
Re: (Score:2)
Thanks, for the info!
I did back up my Linux files, and other data files too. I also backed up the boot sector of the hard disk onto a USB flash drive, just in case the Windows installation program decides to rudely overwrite the boot sector with its own boot loader. I also created a GRUB boot CD which, if necessary, could be used as a temporary way to start-up Linux or Windows. A Knoppix live CD can also be used to access partitions in an emergency. I am prepared to give it a try again sometime. Perha
Printed Article (Score:2)
January 7, 2007
Attack of the Zombie Computers Is Growing Threat
By JOHN MARKOFF
In their persistent quest to breach the Internet's defenses, the bad guys are honing their weapons and increasing their firepower.
With growing sophistication, they are taking advantage of programs that secretly install themselves on thousands or even millions of personal computers, band these computers together into an unwitting army of zombies, and use the co
What about the ISP? (Score:2)
Re: (Score:2)
It took about 3 days to kill online gambling by prevventing the banks from handling the transactions. A million-dollar business reduced to being sold for one dollar. If they did the same to businesses promoted by spam, etc, the whole mess would stop in 3 days.
Bullshit: Just turn off services. (Score:4, Informative)
I really, really don't get it. It's not that hard to keep a Windows box safe. I do understand how grandma can screw up, but I just do not buy the rubbish that every Windows machine gets compromised in five minutes.
People talk about "open ports." To me, that's right up there with "oh no! My IP address is visible!" paranoia. It's just not how computers work! Worms don't somehow jump into your computer through magic holes called "ports:" They exploit bugs in services.
So, disable all the services you don't need. Get rid of the blasted Windows filesharing cruft. Shoot the scripting host. Turn off the remote desktop crap. Look through all the services, and just clean all that junk out. If you don't have idiot programs running that worms can fool into executing arbitrary code or otherwise misbehaving, you're ok! Then connect to the 'net and install the latest updates. In the time it takes you to do that, nobody will jump up through your NIC and give your computer gonorrea.
A firewall is a safety net, and it makes perfect sense in, say, a production IT department to have as many safety nets and backups as you can. But a properly-configured machine, without exploitable crap running, shouldn't strictly need it, and I really think that a competent personal user can easily stay safe.
As for the "security software" the article speaks of: Though an up-to-date antivirus is a decent idea, most software firewalls and other pieces of security software really just operate something like modern-day politicians, keeping users alarmed so as to justify their own existance. "Someone is trying to HACK you!" they scream, as an innocent ICMP ping request arrives at your computer. Pfft. Save your CPU cycles and just don't be a fool!
Re: (Score:2, Insightful)
I don't know why your post is considered Insightful. Because you said 5 minutes instead of 12 minutes? This from MSFT's web site:
http://www.microsoft.com/technet/desktopdeployment
Techniques for Patching New Computers
Published: August 3, 2005
By Tony Northrup
I've Been Hacked Already?
A few years ago, I was doing systems engineering work for a technology firm when a UNIX
And without a single use of "hacker" (Score:3, Insightful)
how come no mention of DDOS? (Score:3, Insightful)
is it because the issue is outside the scope of the article or am i hopelessly behind the times and that's not really a problem anymore for some reason i'm not aware of?
Re: (Score:2)
Today, the "other" use is to send spam. Lots and lots of spam - 10x more than a year ago or so. But the Eastern European protection racket is still there and these people are still getting paid off.
Just another cost of business on the Internet.
Re: (Score:3, Interesting)
Welchia (Score:4, Interesting)
Re: (Score:2, Interesting)
Re: (Score:2)
Did you ever see it in action? They were in the middle of installing blaster patches at work the day welchia came in through a still unpatched machine. I wasn't even peripherally involved (having patched) so I wasn't paying too much attention but I remember it caused quite a stir.
Re: (Score:2)
Re: (Score:2, Interesting)
It failed because the measures it was taking where far too soft. The worm should've disabled the machine with instructions to take it to the repairman (who could've done a proper job of cleaning the machine) and a message that indicated MS was to blame.
The problem is that people who think "Car accidents never happen to me" (most of us) mistakenly think: "Virii will never happen to me"[1], if they even know virii exists. Getting a hundred or two in repair costs might make them think for once.
Footnotes:
Re: (Score:2)
Maybe it should even run the firefox installation (is there a theme to make firefox look like IE?) to set it up, so that the average user doesnt even feel the difference.
Re: (Score:3, Funny)
Paycheck? They get screensavers. Just take a popular screensaver, write a hostile wrapper, and upload it to your scum site. If antivirus software removes your malware, some users will even reinstall it.
Re: (Score:2, Interesting)
Re: (Score:3, Insightful)
Re: (Score:2, Insightful)
Re: (Score:2)
Re: (Score:3, Insightful)
yup that's right in windows Admin isn't trusted enough to look at a users files, so next time the user tries to get tricky:
Re: (Score:2)
Did that with my dad and brother over a year ago. I just get a call every 4-5 months to install something for them. Much better than the calls every couple weeks because the computer was broken or because my dad couldn't figure out how to burn a photo CD on Windows. (He *really* likes _Burn folders_ on OS X.)
Re: (Score:2)
Even if Linux were to become more popular, I doubt that it would have as many security problems as Windows. For one thing, Linux is not the inbred monoculture that Windows is. There is more genetic diversity and less standardization in the software that Linux users use. The typical Windows computer uses Internet Explorer, Outlook, Office and the same version of the same kernel. In Linux there are several different email programs, several different browsers, several different word processors and differen
Re: (Score:2)
Even if Linux were to become more popular, I doubt that it would have as many security problems as Windows. For one thing, Linux is not the inbred monoculture that Windows is.
It will be when/if it attains the "popularity" of Windows.
Re: (Score:2)
Even if Linux were to become more popular, I doubt that it would have as many security problems as Windows. For one thing, Linux is not the inbred monoculture that Windows is.
It will be when/if it attains the "popularity" of Windows.
So then, on the server front, why is Apache not subject to as many attacks as Windows IIS? Apache is running on at least as many, probably more, servers than IIS but still there are many more attacks on IIS than on Apache. Similarly attacks to MS SQL server (eg the slammer worm) have caused considerable disruption to the internet, but we do not hear of such attacks to Oracle, MySQL or Postgresql even though a lot of internet connected servers run these.
Re: (Score:2)
So then, on the server front, why is Apache not subject to as many attacks as Windows IIS?
IIS has had a better security record than Apache for some years now.
(Additionally, cherry picking one particular software package to try and make a generalisation about an entire platform, is an atrocious methodology - and that's ignoring the issues with comparing such disparate things.)
Finally, you completely missed the point of my statement, which is that Linux isn't going to become especially popular *until* it
Re: (Score:2)
Really? I'm intrigued by this comment. Could you cite some *independent* sources that back this up?
Without knowing what you consider "independent", maybe not. However, Secunia [secunia.com] should get you started, as will Google [google.com].
Additionally, before stating Apache is more prolific, you may wish to consider that Netcraft's methodology is a flawed way for determining this, and hence their data does not support the assertion.
Re: (Score:2)