Forgot your password?
typodupeerror

PEBKAC Still Plagues PC Security 300

Posted by ScuttleMonkey
from the you-can't-fix-stupid dept.
Billosaur writes "ARS Technica is reporting on a study release by McAfee and the National Cyber Security Alliance (as part of the beginning of National Cyber Security Awareness Month) that suggests when it comes to PC security, the problem between the keyboard and the chair is even worse. PEBKAC has always been a problem, but the study highlights just how prevalent it has become. 87 percent of the users contacted said they used anti-virus software, while 70 percent use anti-spyware software. Fewer (64 percent) reported having their firewalls turned on, and only 27 percent use software designed to stop phishing attempts. Researchers were allowed to scan the computers of a subset of the users, and while 70 percent claimed to be using anti-spyware software, only 55 percent of the machines of those users scanned showed evidence of the software."
This discussion has been archived. No new comments can be posted.

PEBKAC Still Plagues PC Security

Comments Filter:
  • by It doesn't come easy (695416) * on Wednesday October 03, 2007 @06:12PM (#20844233) Journal
    I use Avast free home edition anti-virus program and that's it. No firewall (and I turn off the "firewall" that comes with XP) and no anti-spyware programs. And in more than 3 years I have had zero malware of any sort on my computers running XP.

    The secret of my success is that I also don't use Internet Explorer (except for the Windows Update website, cause Microsoft makes me). That one step protects me from >95% of the malware. The other 5% is handled by Avast and Firefox. And I don't download and install "free" programs and games.

    Boycott Internet Explorer (and all of the loss of security, privacy, and control of your own computer that goes with it), use Firefox and a good anti-virus program, and don't do stupid things on the net and you're golden.
    • How do you handle your mail?
      Do you ever visit unknown sites with animations, pdf etc?
      • The thing is, I have a good set of plugins installed in Firefox that checks a lot of things with web sites. For example, I run NoScript, which checks quite a few things about a web site these days. And I use AdBlock Plus. And so on. And I have a private email account, not a free one from Yahoo or anyone else. Not to say I don't use Yahoo every now and then but it is always a throw-away account and it is rare that I do that.
    • Are you sure? (Score:5, Insightful)

      by winkydink (650484) * <sv.dude@gmail.com> on Wednesday October 03, 2007 @06:17PM (#20844277) Homepage Journal
      ...And in more than 3 years I have had zero malware of any sort on my computers running XP.

      That you know of. A lot of zombie-related malware is intended to be very stealthy.
      • Re:Are you sure? (Score:4, Interesting)

        by garcia (6573) on Wednesday October 03, 2007 @06:22PM (#20844323) Homepage
        That you know of. A lot of zombie-related malware is intended to be very stealthy.

        They aren't stealthy enough to go through a logged firewall w/o being missed. IMHO, that's the best defense to any network -- paying attention to what the fuck is going on with your connection.
      • I periodically monitor traffic on my home network and all the traffic I see is explained.
      • Re:Are you sure? (Score:5, Insightful)

        by Rycross (836649) on Wednesday October 03, 2007 @06:25PM (#20844357)
        Yeah, and there could be a huge Linux virus epidemic. Its just stealthy enough that its not being detected! Seriously, its become standard to retort to claims of malware free with Windows with "Nuh uh! You probably just don't know you have it!" which is stupid if only for the reason that such a claim isn't reasonably falsifiable. I know that a lot of malware is designed to be stealthy, but a lot of computer professionals know how to root this stuff out, and theres no reason to think that the grandparent is not capable of detecting it.

        I've never been infected by malware. And I have confirmed this every time I've been challenged on that point. Doesn't stop people comming out and saying that I really am infected, I just can't detect it.
        • Re: (Score:2, Insightful)

          by webmaster404 (1148909)
          No, there won't be a major Linux malware epidemic. For these reasons:

          1. The average user won't be running as root so when you are there, theres nothing you can mess up enough to make the system unusable
          2. Linux was designed with the Internet in mind, Windows wasn't, for example, binary files must be flagged to execute them before they execute making it nearly impossible for you to just "visit a webpage" and be infected
          3. The code is open and more people will be finding out security flaws before crac
          • Re:Are you sure? (Score:5, Insightful)

            by Rycross (836649) on Wednesday October 03, 2007 @06:47PM (#20844599)
            You need to work on your reading comprehension. I wasn't claiming that Linux was vulnerable. I'm saying its assanine to respond to someone claiming to be malware free by saying "No, you just don't realize you're infected."

            I mean, go on, prove to me right now, without a doubt, that your Linux box is not infected by some rare virus that people haven't seen and don't know how to detect. And just to head you off, claiming "Linux doesn't have viruses" isn't a valid response. After all, maybe you're one of the lucky first people to be infected, and you just don't know it yet! See how convenient this is? You can't prove that you DON'T have a virus short of taking a dump of the bits on the physical platter and doing a diff.

            Theres ways to be reasonably sure (as in, 99.999999%). There's no reason to believe that the poster that started the thread was not able to be reasonably sure.

            But since you brought this up, tell me how you're going to prevent "Dear stupid user, please install this trojan as root to get your free cursors!" without taking control of the user's own computer away from him or her. You do realize thats how a lot of Windows malware is getting out there right now, don't you?

            Oh and just so you know, there are trojans out there for Linux. One of the systems at my old job was cracked. Luckily the admin noticed that someone was trying to get a rootkit on his system. These cracks often involve software installed on the Linux system with incorrect security settings, as I believe was the case here. But thats the point: the security of the system ultimately falls upon the user not doing stupid things, which is impossible to guarantee without taking control of the computer away from said user.
            • Re:Are you sure? (Score:4, Interesting)

              by Architect_sasyr (938685) on Wednesday October 03, 2007 @07:56PM (#20845319)
              The tripwire installation (cold boot checking), Snort console and usage graphs say that my FreeBSD box hasn't been infected since it was installed.

              There is one possibility, and that is there was code slipped into the repository prior to the 6.2-RELEASE CD's being created (verified the sum of the CD's when I got them) which could be rooting my box. I don't have the time to be doing (is it Orange book?) procedures that will ensure this doesn't happen. I'm with Rycross, there are so many ways to be infected that saying your not is just setting yourself up for a fall.
          • Re: (Score:3, Informative)

            by kwark (512736)
            You are wrong on some points

            1. you don't need to be root to cause trouble to others.
            2. the executable flag doesn't control if things are runnable:
            $ gcc -o hello ./hello.c
            $ chmod a-x ./hello
            $ /lib/ld-2.3.6.so ./hello
            Hello World!
            3. maybe.
            4. we are talking about PEBKAC here, it involves some social engineering to get
            5. I personally doubt it, the more mainstream linux becomes, the relative number of developers among them will drop.

            But I hope you are right (maybe I'm just pessimistic).
        • Re: (Score:3, Interesting)

          by winkydink (650484) *
          Storm has, by some estimates, infected over 10 million machines. Vint Cerf, speaking at the World Economic Forum, estimated that as many as 25% of all computers on the internet are infected. How many of those do you think are running a/v? How many of the users of those infected machines that have a/v actually think they are infected?

          I've sat at a conference of computer security researchers where it was discovered that one of the attendees was infected. So, it can happen to the best and brightest too.
          • Re:Are you sure? (Score:5, Insightful)

            by Rycross (836649) on Wednesday October 03, 2007 @07:00PM (#20844713)
            It can, but if that attendee actually bothered to look for malware, do you think he would have been unable to find it?

            The point is that theres no reasonable response to "You may have malware, but you just can't detect it." I mean, if we posit the existence of undetectable malware, or at least malware undetectable by the poster, then what you have asserted is nearly impossible to disprove. Its simply lazy to respond to "I don't have any malware," with "You do, you just don't know it." Its like saying "Nuh uh! I WIN!"

            If the above poster has actively looked for malware and has not found any, then its reasonable to assume he is not infected, unless you can prove otherwise.
            • by mwvdlee (775178)
              But that's the point; he only has anti-virus installed and DOESN'T use any of the tools that CAN detect other malware types, so he ISN'T actively looking for malware.
              • Re: (Score:3, Interesting)

                by Syberghost (10557)
                But that's the point; he only has anti-virus installed and DOESN'T use any of the tools that CAN detect other malware types, so he ISN'T actively looking for malware.

                Whereas his lack of a firewall means that malware is actively looking for him. Based on the number of malware-indicating signs I get in my logs every day on my firewall, running on a dynamic IP on RoadRunner, I'd be very surprised if said malware isn't looking directly at his IP address many times a day, some of it using vulnerabilities he can
        • Re:Are you sure? (Score:5, Interesting)

          by suv4x4 (956391) on Wednesday October 03, 2007 @07:00PM (#20844711)
          Seriously, its become standard to retort to claims of malware free with Windows with "Nuh uh! You probably just don't know you have it!" which is stupid if only for the reason that such a claim isn't reasonably falsifiable.

          It may be stupid but it's not wrong. I'm a developer and the kind of guy who sets his firewall as limited as possible, has anti-virus on, doesn't download "Free Smileys!!!" software, and in fact I'm very careful about doing things on my computer that may affect my security.

          I thought I was clean, I looked clean, and the PC worked like clean. Until one day I the anti-virus detected a popular keylogger installed on my system (4 years ago). That was on top of that during a full-drive scan, not resident alert, who knows for how long was this thing running, and where it came from.

          Bottom line is, the infection status isn't something easy to assess, especially if you're not very experienced in the area and especially if you consider that you're virus free by default.

          The only way to not push your luck is know what you're doing, and turning your firewall off deliberately is equivalent to not knowing what you're doing.

          If you ask me now, since I wiped my disk twice, and changed all my passwords and reinstalled everything since, am I virus free? I'll tell you yes.. but I'll NEVER be 100% sure in my answer, since I could easily be wrong.

          It's not different on a Linux server by the way, so this is not a Windows vs Linux argument AT ALL.
          • Re: (Score:3, Insightful)

            by Rycross (836649)
            But you did detect it, when you bothered to scan your machine. Theres always the chance that if you run a full scan against your OS and come up clean, that there is some undetected malware there. But is it reasonable to assume that?

            #1: I'm malware free.
            #2: No you're not, you just don't notice it.
            #1: Well, I rebooted into safe-mode, ran two anti-virus scans, some rootkit detectors, spy-ware detectors... all came up negative. My harwdware firewall shows no abnormal traffic...
            #2: Maybe the virus also infect
            • Re: (Score:3, Insightful)

              by suv4x4 (956391)
              This is a complex system. It's never so perfectly running so you can claim "everything is all right so I'm clean" today.

              Why is my disk spinning all the time? May it be malware? Oh yes, the indexer is doing this...
              Why are my apps starting slow? May it be malware? No, after drfragmenting they start faster again... or is the malware now inactive?
              What are those connections in my netstats? Well just about 40 apps I have which all absolutely need to phone home for updates, latest news, patches, and god knows what
            • by penix1 (722987)
              You have added extra steps in your argument that the original poster didn't have. Let's review:

              I use Avast free home edition anti-virus program and that's it. No firewall (and I turn off the "firewall" that comes with XP) and no anti-spyware programs. And in more than 3 years I have had zero malware of any sort on my computers running XP.

              The only thing he is running is the free avast. He has disabled all firewalls. He doesn't do anything for malware/spyware. So let's see what you posted:

              #1: I'm malware fre

        • Re: (Score:3, Insightful)

          by garnetlion (786722)
          its become standard to retort to claims of malware free with Windows with "Nuh uh! You probably just don't know you have it!"

          That's because it's become standard for lusers to waltz into tech support with claims of "Nuh uh! I don't have any malware on my machine!" then be proven wrong about 3 seconds into a Spybot scan. I'm not saying you do, but it's a claim I've heard enough times not to take at face value.
        • by king-manic (409855) on Thursday October 04, 2007 @02:42AM (#20848505)
          Yeah, and there could be a huge Linux virus epidemic. Its just stealthy enough that its not being detected!

          Yes it's called vi. *dons asbestos vest*
      • Re: (Score:3, Interesting)

        by Brigadier (12956)


        this is the truth. At my company we are considering going back to cloned drives that get re-cloned once a month. even with spybot,windows defender, company firewall, and f-secure people still get infected.
        • Two things your company could do. First use Firefox not IE. Second, don't use Outlook (I bet your company uses Outlook for mail and calendering). I have to admit that Outlook is the best mail program for integrating with Microsoft products but it is also a primary vector for malware. If you move your office apps off of Microsoft products, your malware problems will go away. You heard it here first.
        • by daeg (828071)
          I do this and it's great. While not on a set schedule, I randomly re-image drives after hours. I back up the drive first because there is inevitibly some file someone misplaced where they shouldn't have. They love me for getting a "brand new" computer. And then buy me free lunch when I painstakingly [read: easily] type a few cp commands to pull their file off the backup. It takes hours of my time [read: about 30 seconds] to rescue that Powerpoint file they just HAVE to have.
    • by spagetti_code (773137) on Wednesday October 03, 2007 @06:30PM (#20844407)
      Similar here, but I've run XP, *no* AV, *no* anti-spyware etc for 4 years. I do have a firewall/wireless hub for the house. I browse with Firefox only, and thats kept up to date and has Adblock and NoScript. My mail is scanned (although quite a few nasties sneak through).

      My wife is computer illiterate, but she knows she's only supposed to open a small set of attachments and sees me about the rest. She knows not to open anything she doesn't recognize.

      4 years, no viruses/spyware etc. I've tried a couple of those online scans and they came up clean.

      However, now the kids are starting to use the PC.... I've switched to Ubuntu. I not convinced I can set up an XP machine that can't be infected by them.

      That switch was a *major* pain. Switching MSmoney to gnucash, losing Photoshop, copying outlook mail history to evolution, loss of PDA syncing, blah blah blah.
      • I see we are like-minded :). I have (literally) tried for years to get my wireless card working in Linux on my old laptop that just died and never succeeded and so never switched it to Linux (because having a laptop that can't do wireless seems like an affront to nature to me). If you look back at some of my older Slashdot posts, you'll see a few rants and raves about it. Forced to replace my laptop, I was also forced to buy the "OS" Microsoft calls Vista; however, this time I made sure to get hardware t
      • by suv4x4 (956391)

        However, now the kids are starting to use the PC.... I've switched to Ubuntu. I not convinced I can set up an XP machine that can't be infected by them.


        You could've tried installing a good firewall (ZoneAlarm isn't exactly the most efficient one, but it's easy to use and free), and dropping to a non-admin account.

        By definition, you can't infect system files in non-admin mode. Some software may not run, or not run properly, but I'd give that a shot, since you can't run any of your Windows software *at all* u
        • by Rycross (836649)

          By definition, you can't infect system files in non-admin mode.

          Sure you can, if you combine your malware with an elevation of privileges exploit.

          • by suv4x4 (956391) on Wednesday October 03, 2007 @07:09PM (#20844799)
            Sure you can, if you combine your malware with an elevation of privileges exploit.

            Since 99% of Windows XP-s out there run in admin mode all the time, I'm pretty sure none of them is particularly well doing in the privileges exploit area.

            Also this is the user level. Getting privileges higher than the current user isn't so trivial to exploit, since typically the entire browser will run at that level, including any add-ons and plugins. You do need to exploit an app running under admin, and if there's no such, you can't exploit anything.
        • By definition, you can't infect system files in non-admin mode
          Running as a non-admin certainly does reduce the chance for an infection, but I still can't convince myself that they can't download something that could infect something. Good comments about Firefox vulnerabilities though. Thanks.
      • Re: (Score:3, Informative)

        by rtechie (244489)

        I not convinced I can set up an XP machine that can't be infected by them.

        Removing Administrator rights in XP stops 98% of possible malware infections, since it's difficult to install ANYTHING. You can even have them use IE 7 safely because they won't be able to install ActiveX controls and the JVM is likely to flip out given the rare possibility of a Java exploit.

        Of course, they can't install anything. And you might run into the occasional app that requires Administrator rights. I strongly suggest you don't use these apps because it is network-aware apps with lousy coding pract

    • by BigDogCH (760290)
      "use Avast free home edition anti-virus program and that's it. No firewall (and I turn off the "firewall" that comes with XP) and no anti-spyware programs. And in more than 3 years I have had zero malware of any sort on my computers running XP. "

      I believe the opposite to be more useful, but to each their own.......... No anti-virus, no windows patches. Instead, run a strict firewall, use software you trust, and use your machine as a limited user whenever possible (though XP does make this difficult).
      • no windows patches

        It's interesting you should mention this. Lately, I get this feeling of dread every time I let my computer check for updates (it's on manual update, something else I always recommend). It always crosses my mind that the computer may not start back up after installing the latest Microsoft patches. Doesn't that make you feel gooooood all over....
      • by Dmala (752610)
        I do pretty much the same, although I tend to install most of the updates, and I don't have the patience to run XP as a limited user. I've always had my boxes behind a Linux-based or hardware firewall.

        I've never been hit by a virus, and I've been hit by spyware only once. Sadly, it was entirely my fault. I had switched over to IE to view a site that wasn't rendering in Mozilla (first mistake) and a popup appeared asking if I wanted to run an ActiveX control. I reached for "Cancel" but somehow hit "OK
    • And I don't download and install "free" programs and games.

      I think this is the real reason you don't have trouble.

      I haven't had a virus "hit" since about 1995, sent to me on a floppy disc via my employer (word macro virus). But then I live behind a router, update whenever MS tells me too and avoid seedy places on the net. I used firefox for a long while but have gone back to IE (a debate for a later time). Updating when MS wants to is a big part of that. Most of the exploits out there had long been patched by the time they hit the front page. The rest, since I kno

      • No doubt not installing the adware laden free programs helps a lot. However, I sometimes deliberately click a link that I know to be malware to see what will happen and (most of the time) it simply fails to do anything because it can't start one of the OS included ActiveX controls. The other times (usually a download) Avast catches it or I'm smart enough not to run that EXE file. And of course I have the file extensions displayed (hiding "known" file extensions is another stupid Windows trick that I alwa
    • zero malware of any sort on my computers running XP.
      How can you make that claim? Because you haven't noticed it?

    • Re: (Score:3, Insightful)

      by dc29A (636871) *
      The secret sauce is to not run Windows as administrator. You don't even need anti virus programs.

      (1) Don't run Windows as administrator. This is the most important thing you can do to secure your Windows PC.
      (2) Use Firefox or Opera, if FF, use AdBlock+ and NoScript addons.
      (3) Use common sense. If you "Click here to win 20000$" sounds too good to be true. Yup, it is probably an invitation for malware.
      (4) Avoid downloading awesomevideo.exe when surfing for pr0n (or cracks/serials). In fact, treat every execut
      • Re: (Score:3, Insightful)

        by Jeremi (14640)
        Use a VM to test them. Free virtualization is available and is easy to use


        Running it in a VM will probably keep your main system from being infected, but how do you know when it is safe to move the suspect executable out of the VM? No matter how long you run it, it could be that the malware portion will only activate after a bit longer period than that...

    • Re: (Score:3, Insightful)

      by jon_joy_1999 (946738)
      I find that most users who are the opposite of you (I have one friend who doesn't even have any of the XP service packs installed) don't understand computers, the internet, or other humans, because they "have better things to do" like posting on myspace, or txtng there frenz mang. the one without any of the service packs installed gave me her computer to fix. I counted at least three popup advertising programs, and one virus with just the task manager. I downloaded SBS&D and found 67 other problems. the
    • by pilgrim23 (716938)
      I see one major issue; The internet is a interlink of many computers of many makes and types... One vendor's software on that mesh of machines was designed from the get-go without thought one of security. One vendor. Unfortunately, that vendor is the major software vendor of the world in terms of machines using their product. Regardless; if that vendor was either removed from the Net or, made financially libel for damages to other computers on that net caused by their negligence, me thinks this issue w
    • You could limit your list to the last one and you'd still be fine. I use IE, always have (minus a brief stint with Firefox just to try it, which I was unsatisfied with), and I have had exactly one instance of spyware infesting my computer. That instance was because I was stupid enough to just blindly go to a keygen site that a friend told me to go to. Firefox, AV, none of that is necessary to keep a machine relatively secure. All you need is a brain.

      Of course, I'm not recommending that users don't run AV

    • That's not likely. Either you have a hardware firewall of some kind (home router?), or you disabled all the Windows DCOM and SMB services. There is a long history of exploitable bugs in these services, and lots of infected machines out there sending attacks on TCP port 135, 139, 445, etc. Sometimes you have to wait weeks or months for Microsoft to release a security update, so a firewall is really your only protection.
    • by dave420 (699308)
      I have a firewall, no AV, and use IE, and I've never had a problem with malware or viruses. Any kind of firewall and your maxim of "don't do stupid things on the net" will save you, regardless of browser.
    • Re: (Score:3, Insightful)

      Same here, except: 1) I use a hardware firewall since I need to connect multiple computers to the Internet anyway, and use windows file sharing on my LAN. 2) No antivirus except clam, which I run once a month to make sure I haven't done something stupid.

      It's amazing how unnecessary all the bloated antivirus, firewall and other security software is. Of course, this 'study' highlights that "on noes, a lot of people not using AV!" which is only natural considering the source.

      The fact is, the simple act of

    • Re: (Score:3, Informative)

      by Von Helmet (727753)

      If you want to stop using IE altogether, you can use Windizupdate, which works with Firefox and Opera, and possibly a couple of other browsers.

  • by Chas (5144) on Wednesday October 03, 2007 @06:20PM (#20844307) Homepage Journal
    Nothing is ever, EVER going to be idiot-proof.

    Because idiots are both highly prolific and highly creative.

    Unless the world standardizes on a single platform, and never, EVER changes it again, this is always going to happen.

    It's a matter of "that's not how I learned it" or "I never learned it", and they wind up making the systems do things they aren't supposed to.

    It does, however, go to show you that even hordes of security professionals can't be collectively omniscient.

    As always, "security" is a PROCESS, not an endpoint, not a product.
    • by s20451 (410424)
      On the other hand, we could solve this problem tomorrow by forbidding any user-installed or user-downloaded program to run with root privileges. The rest of the security problem would be solved by having all software digitally hashed and signed by its author, and verified by some trusted third party. Unfortunately this would put an end to hacking and Free software. So as long as unqualified amateurs can run arbitrary code, we will have this problem. It's kind of a corollary to Murphy's law.

      My personal o
      • Re: (Score:3, Insightful)

        by Chas (5144)
        "On the other hand, we could solve this problem tomorrow by forbidding any user-installed or user-downloaded program to run with root privileges."

        Pedestrian to a jumper on a ledge: "I forbid you to jump."

        Jumper: Eeeeeeeeeeeeeeeeeeeeeeee! *SPLAT!*

        You can forbid all you want.

        You can codify it in corporate rules.

        You can come up with all sorts of intricate technical controls to enforce it.

        Some idiot is STILL going to find a way around it.
        • by s20451 (410424)
          Of course, what I mean is to forbid at a very low level in software or (preferably) in hardware. That is, the end user does not get the root password, ever. Only qualified professionals get the password. (And, before you take me too literally, the "root password" is also an analogy for a hard-core security model.)
          • by Chas (5144)
            As I said.

            You can forbid all you like.

            Sooner or later, it's STILL going to happen
    • by siddesu (698447) on Wednesday October 03, 2007 @06:37PM (#20844495)
      as computers have become more powerful and versatile and the software more complex, the average user has a choice -- either become a nerd who follows all news, and spends large portion of their time learning about new technologies, how they are integrated, what risks are there, etc.; or ignore the problems, _trust the vendors_ to mostly do the right thing, learn the part of the interface they care about and react if they get hit. it is just not realistic to expect a user to know a lot about computers, as it is unrealistic to expect that a sick person can successfully self-medicate themselves to health.

      so, while the problem is between the chair and the keyboard, it is between the chair and the keyboard of the people who create the software, and not the people who use it. mostly.
      • by Knara (9377)

        become a nerd who follows all news, and spends large portion of their time learning about new technologies, how they are integrated, what risks are there, etc.

        I endorse this choice, as it would lead to more dates for moi.

      • Re: (Score:2, Insightful)

        by Blnky (35330)

        as computers have become more powerful and versatile and the software more complex, the average user has a choice -- either become a nerd who follows all news, and spends large portion of their time learning about new technologies, how they are integrated, what risks are there, etc.; or ignore the problems, _trust the vendors_ to mostly do the right thing, learn the part of the interface they care about and react if they get hit. it is just not realistic to expect a user to know a lot about computers, as it is unrealistic to expect that a sick person can successfully self-medicate themselves to health. so, while the problem is between the chair and the keyboard, it is between the chair and the keyboard of the people who create the software, and not the people who use it. mostly.

        Wow, way off. You have just presented a false dichotomy [wikipedia.org]. A user can choose to learn a reasonable amount of information required to maintain the health of their system and its components whether or not they 'care' about them or not. An average level of knowledge, action, and competency is not a overzealous requirement. Consider your analogy which is just as flawed. Most people are not 'medical nerds'. Yet they can deal with colds, flu, localized infections, allergies, headaches, etc. Likewise most people ha

        • Re: (Score:3, Interesting)

          by siddesu (698447)
          your analogy would be true if the people had at their disposal equipment for dealing with computers similar to the one they have to take care of disease and so on in their bodies. as it happens, it is the body that takes care of all these, and the person doesn't participate in the process. the various over-the-counter medicines mostly make the process less painful. why is that so? because the body (or the person) has other things to do.

          so, to extend _your_ analogy, just as the genes -- the ultimate designer
      • by big_paul76 (1123489) on Wednesday October 03, 2007 @08:35PM (#20845673)
        Here here.

        In WWII, they had frequent aircraft crashes caused by pilots landing with the gear up.

        They consistently attributed these accidents to "pilot error".

        Then somebody took a look at the design of the cockpit, and realized that it wasn't designed in a way that would make it immediately obvious to a pilot whether or not the gear was up or down. When the cockpit was re-designed, the high rate of 'gear up' landings evaporated.

        In other words, the designers were blaming the users for a design flaw. Happens all the time in the software industry these days.

        I'm not saying that PEBKAC errors don't happen, or that idiots don't do stupid things. But I suspect that a large slice of the cases we classify as "user error" should really be called design error.
    • Capability based desktop is actually almost idiot proof.
  • that this really is not news to the crowd that hangs out here on /. We promote good security so much because we already know what the above mentioned article states. It is nice to have some numbers, although I'm always skeptical of "facts" on the interwebz.
  • by Zombie Ryushu (803103) on Wednesday October 03, 2007 @06:23PM (#20844345)
    If you combine PEBKAC with the nightmare OS that is Windows, you see the dark and terrible Hell that has been created. Granted, it is true that alot of people who use computers don't deserve them, but everyone feels they are entitled to them. Really, the majority of people haven't earned the right to use computers, because they have no discipline to do so. But they will anyway, because there is money to be made. Its like giving Guns to chimps.

    I started on Tandy 1000 286s, and Commodore 64s, so I have that discipline, that experience, I learned how to walk before I ran, and ran before I flew. But that just isn't the way our world works.

    Do realize that the actions these insecure people with irresponsible habits take affect the lives of millions of people through scams, and DoS attacks.
    • Can't wait for the "disciplined computer user" licenses, we can lock all those computer illiterate retards out!
    • the nightmare OS that is Windows

      What's wrong with XP SP2 security wise? Or Vista? or Windows 2003 Server? Care to elaborate? No really, what is this big nightmare about Windows security post XP SP2?

      Just because the users are stupid and run Windows as administrator, doesn't mean the OS itself is insecure [amazon.com].

      PS: I am posting this from my Kubuntu Feisty machine.

      • I don't want to talk about that because I'm not the most qualified person in the area to comment on the issue. I have my perceptions, I'm probably going to shoot myself in the foot by proceeding further and embarrassing myself.
    • "I started on Tandy 1000 286s, and Commodore 64s, so I have that discipline, that experience, I learned how to walk before I ran, and ran before I flew. But that just isn't the way our world works."

      Um, no. You ran as fast as you could on those Tandys and Commodores, which inspired you to run on to the next thing when it came out. Get off your high horse and quit whining about all the "stupid lusers". I think people like you are the only ones feeling "entitled" to anything.

      Just because the general popu

  • by jdogalt (961241) on Wednesday October 03, 2007 @06:24PM (#20844353) Journal
    So let's see, it's not software that is broken and buggy, but rather the problem is the users that 'inadequately' act as an insanely complex added layer of security, managing a bunch of brain-numbingly-unrewarding security layers.

    This article reeks to me of a security industry that is proactively trying to cover its ass, primarily because of the fact that the only reason they thrive is because microsoft 'needs' to keep it's source closed, and the public 'needs' an illusion of security.

    Sorry, but I've recently gone through about my 5th runaround of giving selinux-Enforcing an honest try, and realizing yet again what an utter pile of useless shit it is (for the vast majority of Fedora users at least). (review my past comments which I won't argue over again... or just laugh as setroubleshootd tells you how the solution to your problem is to reboot and force a relabel... pulling in hardcoded path state from /etc/selinux/....)

    Wake up and smell the insecurity folks and get used to it. Don't say anything within earshot of a mobile phone's mic that you wouldn't feel comfortable with any telecom employee overhearing... or anyone those employees might give network access to...

    It's a brave new world. Don't give me this shit that the users are to blame.
    • Scoffing at the low number of users running anti-virus is misplaced. Anti-virus software gives a false sense of security. Real security is just being careful what you do. I've never run anti-virus software and my computer is fine. I know dozens of people who run it and get viruses constantly. I think the problem is assuming you actually need anti-virus software rather than the low number of users running it.
  • by xxxJonBoyxxx (565205) on Wednesday October 03, 2007 @06:31PM (#20844417)

    ...a study released by McAfee...87 percent of the users contacted said they used anti-virus software, while 70 percent use anti-spyware software. Fewer (64 percent) reported having their firewalls turned on, and only 27 percent use software designed to stop phishing attempts.


    This Slashvertisement rates a 4.2 out of 5.

    It caused many readers to wonder, "if McAfee has an all-in-one package that can handle all my anti-spyware, firewall, anti-virus and phishing needs?". However, McAfee was unable to get the actual product it was trying to pitch in its press release on Slashdot.

    Well done (though not perfect) - another high-five to my those PR pros!
    • Re: (Score:3, Insightful)

      by Lumpy (12016)
      But McAfee does do all that. by consuming 98% of your computers processing cycles and making every file operation go through 30 or more operations first, malware does not have any computing resources left over for them to run.

  • is that with our computers today, all that it takes a run-of-the-mill PEBKAC to screw things up.

    One day, we'll look back at PC security of today and laugh at the crap one had to go through just to not have your typical PC go down in flames.

    Just a thought.
    • Re: (Score:3, Informative)

      by wellingj (1030460)
      One day, we'll look back at PC security of today and laugh at the crap one had to go through just to not have your typical PC go down in flames.
      ...Could be tomorrow if you downloaded an .iso [debian.org] tonight.
  • Anyone care to explain how this acronym works?
  • PICNIC (Score:5, Funny)

    by Saint Stephen (19450) on Wednesday October 03, 2007 @06:35PM (#20844457) Homepage Journal
    Problem in Chair, Not In Computer. PICNIC.

    That's the phrase I heard used to describe this condition.
    • by antdude (79039)
      No, it's PWCT (Problem With Chair Thrower (Steve Ballmer)). :)
    • by uncoveror (570620)
      IO error: Idiot Operator, Error ID 10 T. Those are two I have heard.

      Most people who have computers have them for work, because kids allegedly need them for school, or because someone told them they would be left behind without one. These people have no clue how they work and no desire to learn. Microsoft makes life harder for them with every change. We have had the start menu since Windows 95, yet most still use their icons for everything.
    • Re: (Score:3, Informative)

      ID-TEN-T error.
      There's a nut loose on your keyboard.
      OSI Layer 8 error.
      There's heaps of ways to describe the problem.
  • None of this info really seems useful or reliable.

    13% don't use antivirus... how many are Mac or Linux users?

    30% don't use anti-spyware stuff... how many are running OSX or Linux (again), or are browsing with scripts and other stupid things turned off?

    73% don't report using anti-phishing software... doesn't IE have that on by default now? So the users are almost CERTAINLY misinformed about this one; they've got protections running they don't even know about.

    Same for firewalls. I know both OSX and Windows XP
    • What percentage have an old out-of-subscription Norton's installed, and think that they are protected, but aren't really?
  • This looks like an anti-virus advert (or a close variation thereof.)

    In my history of major computer usage, I had three "infections" that I had experience with. Of these three, I do admit I was a little foolish with one of them, but they have all been purged entirely. The anti-virus or anti-spyware only served as a reactive approach, and weren't effective in preventing the software from entering in the first place (in spite of the AV software displaying a warning that a program was infected.)

    The only way t
  • ... for the crappily insecure, services tied to ports, admin rights for all, Windows that they've been selling (or rather imposing on to) people who buy PCs. I mean they stuck IE in there and added wizards for connecting to the Internet right? But they never bothered to fix all the security holes. Why should I have to pay for AV and firewall - THEY should pay - so I want my money off them. Who's with me?
    I mean they don't sell cars without brakes do they?
  • 1) posts concerning stupid user anecdotes, and the perils of stupid users
    2) posts concerning elistist administrator mentality concerning users and the perils of treating users as the problem
    3) posts concerning effective training
    4) that ac who always posts that longass vulgar post.

    Thank you and goodnight
  • Looking at the article i would assume n=378 is the number of participants. If so isn't that a little on the low side no matter how they are picked?

    A subset of this would have a pretty big margin of error would it not?

    Most studies i recall use more than 1000 people to get to 3% error, not knowing the subset (or the set for sure) wouldn't a margin of error nearing 10% be entirely possible?

    This would seem to invalidate the whole thing pretty much (in case the MacAfee tag didn't do that already!) This would lea
  • by Arrogant-Bastard (141720) on Wednesday October 03, 2007 @09:24PM (#20846079)
    The problem is not that users fail to use anti-virus, anti-spyware,
    anti-phishing, anti-left-handed-metric-wrench software.

    The problem is that users CHOOSE to use operating system and
    applications which are so miserably designed and written that they
    are susceptible to these problems as-shipped by the vendor(s).
    (I take the position that any OS which needs anti-virus software
    to survive in the wild is clearly broken and should never by used. By anyone.)

    Anti-* software is a band-aid. Its use is a clear indication that the
    product it's trying to band-aid is broken. And anyone deliberately
    using known-broken products should not be very surprised if Bad
    Things happen as a result.

    It continues to amaze me that anyone is surprised by this --
    although I suppose by now I ought to have gotten accustomed to
    this state of affairs. [Some] people install obviously defective
    operating systems (e.g., any version of Windows), use obviously
    defective mail clients (e.g., Outlook), use obviously defective
    web browsers (e.g., IE) and then actually expect that they can
    somehow make up for this series of stunningly poor decisions
    by installing enough add-ons. It doesn't work, of course, which is
    why we see hundreds of millions of infected systems out there,
    spewing spam, conducting DoS attacks, poking at web servers,
    brute-forcing ssh servers, and so on.

    My point being that by the time the conversation has gotten to
    anti-* software -- it's too late. The damage has been done, and
    there's no undoing it (despite lots of wishful thinking and the
    earnest assurances of anti-* vendors, who of course, let's not
    forget, have a substantial profit motive).

    (Ah. About this point, some M$ apologist will raise one of the
    usual canards -- for example, "M$ products are attacked because
    they're popular". Not true, of course; M$ products are attacked
    because they're miserably weak as a result of incompetent design
    and even worse implementation. M$ is hardly alone in this, it's
    that for some inexplicable reason, it seems to attract the most
    defenders -- despite the fact that as possibly the most well-funded,
    well-staffed, well-equipped software company in the world...it
    has repeatedly proven that it can't even write a decent mail client.)

    So. These studies shouldn't ask questions like "Are you using
    anti-spyware?" They should ask questions like "Why are you dumb
    enough to use an OS/application software combination so badly
    written and maintained that anti-spyware is deemed necessary?"
  • by whereiswaldo (459052) on Thursday October 04, 2007 @12:01AM (#20847535) Journal
    Several of the top viruses of 2006 were over 2 years old (according to a report by Sophos). Obviously there was anti-virus protection available for those threats but many, many people aren't protecting their computers. It's no wonder why creating huge botnets continues to be so viable.

Luck, that's when preparation and opportunity meet. -- P.E. Trudeau

Working...