Forgot your password?
typodupeerror
Security The Internet

Web Browsers Under Siege From Organized Crime 168

Posted by Zonk
from the x-force-2007-sounds-like-an-awesome-movie dept.
An anonymous reader writes "IBM has released the findings of the 2007 X-Force Security report, a group cataloging online-based threat since 1997. Their newest information details a disturbing rise in the sophistication of attacks by online criminals. According to IBM, hackers are now stealing the identities and controlling the computers of consumers at 'a rate never before seen on the Internet'. 'The study finds that a complex and sophisticated criminal economy has developed to capitalize on Web vulnerabilities. Underground brokers are delivering tools to aid in obfuscation, or camouflaging attacks on browsers, so cybercriminals can avoid detection by security software. In 2006, only a small percentage of attackers employed camouflaging techniques, but this number soared to 80 percent during the first half of 2007.'"
This discussion has been archived. No new comments can be posted.

Web Browsers Under Siege From Organized Crime

Comments Filter:
  • 80%...? (Score:2, Insightful)

    by Anonymous Coward
    Are they saying that antispyware software misses 80% of the spyware?
  • by TFGeditor (737839) on Tuesday February 12, 2008 @02:29PM (#22394908) Homepage
    Okay, I admint I have not (yet) read the article, but experience tells me that 80% likely involves IE at 90 percent or better.
    • by HangingChad (677530) on Tuesday February 12, 2008 @02:44PM (#22395116) Homepage

      ...experience tells me that 80% likely involves IE at 90 percent or better.

      How is that a troll? He's stating the observation based on his experience.

      I did read the article and can't tell, either. My experience coincides with yours. Funny articles are hesitant to spell out the distribution of vulnerabilities. I wonder if they get leaned on by Microsoft's legal department or one of their PR firms?

      Just exactly how many of those vulnerabilities are Firefox running on Ubuntu? Or Safari? Or, as usual, is Windows and IE the most attractive attack vector?

      • by WilliamSChips (793741) <full.infinity@NosPam.gmail.com> on Tuesday February 12, 2008 @04:37PM (#22396690) Journal
        I'm not fully sure but I know every browser has one vulnerability. It's between keyboard and chair.
        • by nbannerman (974715) on Tuesday February 12, 2008 @05:43PM (#22397924)
          Agreed - this is why I replace all my users with inanimate carbon rods - I haven't had a security problem in months!
        • by ceeam (39911)
          Though when you go to absolutely legitimate site (that has been infected just last night) with IE and through many of its holes you now got a trojan installed on your machine, how is that a user's fault? Apart from using IE this user did absolutely nothing wrong or stupid.
          • Re: (Score:2, Insightful)

            by cp.tar (871488)

            Though when you go to absolutely legitimate site (that has been infected just last night) with IE and through many of its holes you now got a trojan installed on your machine, how is that a user's fault? Apart from using IE this user did absolutely nothing wrong or stupid.

            I should say that using IE is wrong and stupid enough.

            • by Nullav (1053766)
              Considering that it's the default browser on what's basically the default OS, blame for people running IE rests squarely on MS and the OEMs pushing Windows. If I didn't know any better and was buying from an OEM, I'd expect a secure machine; not thousands of attempts at idiot-proofing, just sane default settings, as few background processes as possible, and perhaps some educational material about phishing and downloading apps from untrusted sources or some links pointing me in the right direction.
            • by berzerke (319205)

              I should say that using IE is wrong and stupid enough.

              Except some sites require it (ADP is the worst), and I can't convince management it's worth it to switch to a different company. Personally, I've been searching for a better on-line bank and after the passing the initial screening, one of the first questions I ask is, "Does your site support Firefox?". Most of the time I get a no, use IE. My most recent answer, Feb 11, 2008, states, "Apple Bank's website currently supports Mozilla Firefox version 1.0

              • by cp.tar (871488)

                Have you considered mailing every bank that requires IE and/or fails to support Firefox that you have decided not to become their client due to IE lock-in?

                Send enough mails and you may see some improvement; the management is probably unaware that this may be an issue.

              • FYI, I use Firefox 2x with Wellsfargo.com, and it works just fine. No problems at all.
              • by arminw (717974)
                ......Apple Bank's website currently supports.....

                I have found that with Safari, whenever I get a message from a web site that it only works with IE, that this is because their server checks what browser is calling it. Most of the time, if I tell Safari to lie and tell that stupid site that it is being talked to by IE, everything works perfectly or is at least useable. The exceptions to this are few.
    • Re: (Score:3, Funny)

      by dynamo (6127)
      This post isn't a troll, IE is.
    • Re: (Score:2, Redundant)

      by FudRucker (866063)
      even though your comment was modded down as a troll, i agree with you wholeheartedly...
    • Got plugins? (Score:5, Insightful)

      by jschottm (317343) on Tuesday February 12, 2008 @04:05PM (#22396208)
      The web is not just HTML at this point. Both QuickTime and RealPlayer have had notable exploits in the past few months. Acrobat and Flash have had major security holes as well. Just relying on the fact that you're using Firefox doesn't mean that you're not vulnerable.
      • by TFGeditor (737839)
        The summary and article said "browsers."
        • QuickTime, Real Player, Acrobat, Flash, etc., etc., are all technologies that most people experience inside their browser. They're all just more stuff you need to download to get your browser to work. If the web was just HTML, it would be pretty boring. And Slashdot wouldn't exist.
          • by rifter (147452)

            QuickTime, Real Player, Acrobat, Flash, etc., etc., are all technologies that most people experience inside their browser. They're all just more stuff you need to download to get your browser to work. If the web was just HTML, it would be pretty boring. And Slashdot wouldn't exist.

            Sure slashdot would exist. That was one of the better things slash allowed. Since the pages are served staticly after being modified on the server by a perl cgi script... or does your html-only world eliminate cgi as well?

            • >>"... does your html-only world eliminate cgi as well?"

              Yes. People want executable content, they want to be able to "do stuff" inside their browser. CGI and Perl can't deliver that.

              • by drinkypoo (153816)
                Actually, it should be possible to write a streaming animated GIF, until you cause some sort of memory allocation error...
  • by DigitalSorceress (156609) on Tuesday February 12, 2008 @02:31PM (#22394924)
    It seems to me that the moment that organized crime found a way to make money off security vulnerabilities (Spam, ID theft, Ransomware, etc...) the writing was pretty much on the wall (though I'm still trying to figure out what it says). It kind of reminds me of William Gibson's cyberspace: a free-for-all, hostile environment where it was pretty much up to individual users / corporations / governments / whatever to protect themselves through whatever means necessary.

    Welcome to the wild, wild net.
    • by khasim (1285) <brandioch.conner@gmail.com> on Tuesday February 12, 2008 @02:42PM (#22395084)

      It kind of reminds me of William Gibson's cyberspace: a free-for-all, hostile environment where it was pretty much up to individual users / corporations / governments / whatever to protect themselves through whatever means necessary.

      The problem is that no matter how well YOU protect yourself, other agencies have your personal information in their databases.

      What happens if your employer loses a laptop with your SSN, name, etc on it?

      Eventually, the criminals are just going to start building a database with whatever information they can find.

      Then they'll use that database to take out a second mortgage on your home, purchase a new car and open a few credit cards under your name.

      You'll lose more money than you have. And you'll never have a chance to prevent it. Because all the information will be "leaked" from 3rd parties.
      • by Anonymous Coward on Tuesday February 12, 2008 @03:18PM (#22395530)
        Potentially the problems you state are only the scraps, unfortunately it is getting to where every filing cabinet and vault in the world has multitudes of vacuum pipelines hooked to it and organized crime is working hard on figuring out how to break down the filters and routing on these pipelines and channel the flow to themselves. Think in terms of the old vacuum pipes for paper and money transfers inside old department stores and then expand it world wide, now try to imagine keeping it secure, not just your part of it but everyone's part that you connect to and everyone's part that they connect to ad infitum, welcome to the internet.

        Side warning to the F/OSS community: That multitude of eyes may become even more important as we start to wonder, is the Godfather contributing? It doesn't even have to be in terms of direct backdoors, only has to be an exploitable bug which of course don't make the contributor look as bad.

        Side warning to the closed source corporations: See above, biggest difference is your paying them too. Think you can hire that many eyes?

        Side warning to businesses and individuals: Read the above, look around you, let the paranoia begin.

        The internet maybe a highly efficient way of doing business, but it can be an extremely efficient way to steal too. Weigh the KNOWN risk factors, is it really worth it?

        Organized crime is only the tip of the iceberg.

        We may have to become stainless steel rats just to be free.
        • by vertinox (846076) on Tuesday February 12, 2008 @04:12PM (#22396320)
          Side warning to the F/OSS community: That multitude of eyes may become even more important as we start to wonder, is the Godfather contributing? It doesn't even have to be in terms of direct backdoors, only has to be an exploitable bug which of course don't make the contributor look as bad.

          How do know that a low paid programmer at Microsoft hasn't been bribed by organized crime and if so how do you detect the code?
          • by dave562 (969951)
            If the programmer is low paid their work is being reviewed via the QA process. Now say what you will and laugh all you want about the idea of Microsoft QA, but I can assure you that the odds of one single programmer being bribed and inserting malicious code into a core library is pretty low.
            • That's the job of the high paid ones!
            • by rifter (147452)

              If the programmer is low paid their work is being reviewed via the QA process. Now say what you will and laugh all you want about the idea of Microsoft QA, but I can assure you that the odds of one single programmer being bribed and inserting malicious code into a core library is pretty low.

              More like, by the time his code makes it through QA/review/standard revisions, it will be incomprehensible compared to what it was originally and his clever little trojan won't work anymore :D.

              We hope...

              • by dave562 (969951)
                Pretty much. I can see it now. "What's all of this highly optimized assembly code doing in here?! We need to re-write it in Visual Crap 2.0 so that it is fully Web 3.0 buzzword extensible and slow as molassas on a cold day if you try to run it on anything less than a quad-core Intel chip."
      • by TheRealMindChild (743925) on Tuesday February 12, 2008 @03:38PM (#22395806) Homepage Journal
        Then they'll use that database to take out a second mortgage on your home, purchase a new car and open a few credit cards under your name.

        I got that one covered. I just haven't paid several bills for a long while now. If someone tries to get credit with my credentials, all they will get is people laughing and pointing at them
        • This is organized crime we're dealing with here. When you piss them off they'll send some hired goons around to your house to rearrange your finances.
      • Re: (Score:3, Insightful)

        by SCHecklerX (229973)
        It's even easier than that. Every time you pay with your credit card at a restaurant, you are trusting that waiter not to steal your number, or that they don't print a tape with the number on it and put it in the trash unshredded.
        • by Cederic (9623)

          This is why the waiter never gets to touch my card, and hands the sole copy of the tape with its number on it directly to me. The copy he gets to put in the till hasn't got the number on it, the card reader is brought to my table, there are minimal opportunities here.

          Ok, back in the real world.. half the restaurants still print the number all over the place, half the waiters take your card over to the machine instead of bringing the machine to you, the machine uses unencrypted wireless signals and there is
          • Re: (Score:3, Informative)

            by dave562 (969951)
            the machine uses unencrypted wireless signals

            I call BS on this one. I've done a couple of POS implementations for restaurants and all they all used WPA encryption on the devices and the access points were setup to only accept connections from a pre-defined list of MAC addresses. Ya ya, MAC addresses can be spoofed but it is going to take an attacker a long time to hit a restaurant wireless network. The majority of restaurants still swipe the card at the hard wired terminal anyway. The restaurant indus

      • Re: (Score:3, Informative)

        by vertinox (846076)
        What happens if your employer loses a laptop with your SSN, name, etc on it?

        If you are paranoid like me you will have already called one of three major credit companies (not the free score but Equifax, Experian, or TransUnion) and put a freeze on your credit every 90 days with a fraud alert. Or you can pay one of their subsidaries a monthly fee for any notifications via email or SMS of any changes or requests in your credit (yeah it kind of feels like I'm paying them to solve a problem that is their fault).
      • by homer_s (799572)
        Then they'll use that database to take out a second mortgage on your home, purchase a new car and open a few credit cards under your name.

        And the banks who lent the money based on a number (that is not even supposed to private) would end up eating the loss. And the credit bureaus who base their business on this number would be run out of business by competitors with better ideas.
        At least, that is how it would work in my kooky libertarian world. But I guess everyone likes this setup better.
      • Re: (Score:2, Insightful)

        by ardent99 (1087547)

        Eventually, the criminals are just going to start building a database with whatever information they can find.

        This is really important. There are a lot of people who argue that if you have nothing to hide, you don't need to worry about the government tracking your information. This argument tends to have the implicit assumption that the government has your best interests at heart and wouldn't [fill in your worst abuse here]. However, even if you believe this, clearly it is not true about criminals.

    • Kinda leads to interesting thoughts...perhaps it may behoove certain of us to act as "night watchmen" for our various neighbourhoods, in the interest of keeping that sort of thing away from our systems.

      I know I'm probably going to have to make another scan of my landlady's computer...she falls for half the stuff that comes through, even after my lectures on "DON'T CLICK IT" :-/
      • by gnick (1211984) on Tuesday February 12, 2008 @03:02PM (#22395320) Homepage

        perhaps it may behoove certain of us to act as "night watchmen" for our various neighbourhoods
        That's an interesting idea and may function just fine at a land-lady level. But, for some reason, my bank balked at the idea of granting me admin access to their server so that I could make sure that my personal info was secure.
        • Re: (Score:2, Interesting)

          by KublaiKhan (522918)
          Well, start small, anyway. The bank can afford to make itself secure, but if every computer in the neighbourhood is sending out Russian viagra ads, your bandwidth will suffer--so doing some basic cleaning and firewalling will benefit you bandwidthwise.

          Hell, if you're feeling ambitious, you could set up some kind of neighbourhood LAN and get folks to chip in towards a big fat pipe, if you can prove they'll have a safer connection... ;-p

          Come to think of it...does anyone know of any successful examples of a "
          • by gnick (1211984)
            Hmmm... Your ideas intrigue me and I'd like to subscribe to your newsletter. But, the only implementations I know of were at a municipal level rather than a neighborhood organization.
          • by upside (574799)
            I know of one [www.dna.fi], in Helsinki. Volunteer run non-profit association. Provides connectivity to individual houses and apartments around the area. I've been thinking of such an effort in my parts. It does require a bunch of tech-oriented people to keep it running.
  • Then why do I feel like it is so old and obvious that it needs a 'duh' tag?
  • by grassy_knoll (412409) on Tuesday February 12, 2008 @02:32PM (#22394942) Homepage
    From TFA:

    The overall number of vulnerabilities reported for the year went down for the first time in 10 years.


    Combined with the comment that camouflaging techniques are used in 80% - 100% of recorded attacks, I wonder if the number of attacks is really going up ( as it has been in the past 10 years ) but detection is getting worse.
  • by downix (84795) on Tuesday February 12, 2008 @02:34PM (#22394980) Homepage
    Over the past 4 weeks I've noticed a rash of almost hourly attempted breakins to our servers.

    Here's a sample:
    ftp attempts for 5 hours straight:
    Feb 12 10:27:02 localhost proftpd[24841]: localhost.localdomain (::ffff:82.186.102.42[::ffff:82.186.102.42]) - no such user 'Administrator'
    Feb 12 10:27:02 localhost proftpd[24841]: localhost.localdomain (::ffff:82.186.102.42[::ffff:82.186.102.42]) - USER Administrator: no such user found from ::ffff:82.186.102.42 [::ffff:82.186.102.42] to ::ffff:192.168.10.26:21
    Feb 12 10:27:02 localhost proftpd[24841]: localhost.localdomain (::ffff:82.186.102.42[::ffff:82.186.102.42]) - Maximum login attempts (3) exceeded

    ssh attempts almost constant since last friday:

    Feb 11 01:37:07 localhost sshd[13953]: pam_unix(sshd:auth): check pass; user unknown
    Feb 11 01:37:07 localhost sshd[13953]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.31.37.13
    Feb 11 01:37:07 localhost sshd[13953]: pam_succeed_if(sshd:auth): error retrieving information about user ajith

    When I catch them, the majority of the IP #'s match up to systems which have been rootkitted. The stream of odd login names always catches me off guard, sometimes in english, sometimes japanese or chinese. Does anyone know of someone that keeps track of these things, so I can send my logfiles to?
    • by KublaiKhan (522918) on Tuesday February 12, 2008 @02:37PM (#22395028) Homepage Journal
      The folks over here [sans.org] keep track of that sort of thing. You may want to speak with them.
    • Re: (Score:3, Funny)

      by sirgoran (221190)
      Whoops!

      Sorry, my bad. Thought I was on my server...
    • by cheater512 (783349) <nick@nickstallman.net> on Tuesday February 12, 2008 @03:43PM (#22395874) Homepage
      Your looking for this for your SSH logs: http://denyhosts.sourceforge.net/ [sourceforge.net]
      It will automatically detect and block the attackers and optionally add them to a gobal block list.
      • Your looking for this for your SSH logs: http://denyhosts.sourceforge.net/ [sourceforge.net]
        It will automatically detect and block the attackers and optionally add them to a gobal block list.

        It's really more effective, in my opinion, to simply disable interactive logins altogether and use DSA key authentication. Brute force login attempts become a negligible threat, since attackers are not trying to spoof dsa private keys and even if they did the sheer number of possible dsa keys combined with the number of possible user names makes the chance of a successful breakin very very slim. Using denyhosts requires that the botted cracker machines out there be given a good chance to brute force their

    • by jschottm (317343)
      The article has very little to do with what you're describing - simple common name/password attacks - which have been going on for years. Iif [sic] you use non-attack-dictionary passwords, these aren't a threat. They just sit there and try things like root/password, root/passw0rd, etc.

      These attacks are so common that no one tracks them anymore. SANS has a system that you can submit your firewall logs to but not the detailed syslog information. You can attempt to report the attacks to the appropriate par
    • by mikael (484)
      I used to get those on my home system - it was really obvious that something was happening as both the hard-disk drive and the network lights on the cable model were thrashing away and the desktop slowed down to a snails pace. The only solution at the time was to disconnect the network table. The sysadmin logs showed that over 300 login attempts had been made within a minute. These would all come from the same address, and come in two or three waves, although these could be anywhere in the world (Europe or
  • ...It begs the question "how am I funny to you?"
  • by kabocox (199019) on Tuesday February 12, 2008 @02:38PM (#22395052)
    We've seen what kinda of profits spam brings in. I wonder how profitable this is.

    Heck, spyware/adware, or some shady P2P programs could have something like this. Reminds me of what happened to http://www.shareaza.com/ [shareaza.com]. It's claimed by a group that be like this. That address used to be shareaza's main site, and it easy for many to not know to go to http://shareaza.sourceforge.net/ [sourceforge.net] for the new updates.
  • original report (Score:3, Informative)

    by formant (852164) on Tuesday February 12, 2008 @02:39PM (#22395060)
    Here is the link to the source : http://www.iss.net/x-force_report_images/2008/index.html/ [iss.net]
  • I didn't know IBM hired Rob Liefeld. Did they put Cable in charge of the investigation?

    Organized crime, huh? When they hit your browser, does the screen just go black?

    • by FudRucker (866063)
      RE:["Organized crime, huh? When they hit your browser, does the screen just go black?"]

      well it is called the "Black Market"...
  • by gnarlyhotep (872433) on Tuesday February 12, 2008 @02:47PM (#22395146)
    Be a shame if sumfin' were to happen to it, like.
  • by RobBebop (947356) on Tuesday February 12, 2008 @02:48PM (#22395162) Homepage Journal

    stealing the identities and controlling the computers of consumers at 'a rate never before seen on the Internet'.

    5%, 25%, 50%? 90%? Are there estimates for the "rate never before seen" that users are having their personal information stolen?

    And what personal information is it? To extend the old saying "If it is on the internet, it is public". Well, *all* information you store the computer that you access the internet suffers from this lack of security.

    A truly secure user experience would be managing personal data on an unconnected system (or even a private network of systems) and then transferring data from there that needs to make it to the Internet via the Sneakernet [wikipedia.org]. This is how the Department of Defense guarantees the security of Secure Facilities, and it is (unfortunately) the only way to guarantee the security of your own personal information.

    But for systems that are on the 'Net, using an OS that doesn't hide/obfuscate fundamental security models is a plus. For example, it is easier for me to shutdown outgoing ports/services on Linux [uic.edu] than on Windows [windowsecurity.com].

    As far as browser exploits... one can only hope that developers close off the attack vectors faster than they open new ones.

    • In fact, no security, of any kind, anywhere, is absolute.

      For example, critical US Department of Defense secrets have ended up in the hands of adversaries, despite extreme efforts to safeguard these secrets. And the same is equally true, of course, for other nations. Thus there is demonstrably not a condition of absolute security, even at the most secure end of the scale.

      But we're talking here not about military security and state espionage but about web browser vulnerabilities. For the most part the

      • by RobBebop (947356)

        pressure by the insurance industry.

        Snake oil? Software insurance? Can you actually sell this? Oh... sign me up.

        1. Sell software insurance
        2. ???
        3. Don't validate claims because users had insecure protection

        Oh, I'm going to go file a patent for this....

        To reply seriously...

        The perception of value and risk for a consumer product is at a much lower point on the scale relative to a hardened military installation.

        To say that users don't store information that has high value to them to be kept private is silly. I was *very seriously* suggesting a non-networked computer to give security. This would eliminate the opportunity for a *software failure* to cause the data to become

  • by rufusdufus (450462) on Tuesday February 12, 2008 @02:54PM (#22395226)
    I've been saying this for years now: antivirus and firewalls cannot protect from sophisticated attacks.

    There is only one solution: executable code must be embedded in hardware read-only media and must be reloaded after every session. [today reloading a virtual machine is a good approximation, but this method will succumb under sufficiently sophisticated attack; it really needs to be built into nonflashable rom]

    Nobody wants to hear this. I'm not exacty sure why; a little thought should lead anyone with some knowledge of operating systems and hacking to the same conclusion.

    Its just going to get worse, with botnets, blackmail and scammers gaining more and more power until we remove the ability of malignent code to survive.
    • Its just going to get worse, with botnets, blackmail and scammers gaining more and more power until we remove the ability of malignent code to survive.
      Who gets to define the term "malignant code", and how? There's your barrier right there. One man's malignant code is another man's valid program (ref. Trusted Computing).
    • by durdur (252098)

      executable code must be embedded in hardware read-only media and must be reloaded after every session
      What happens when you need to update this executable code? How do you ensure it is only ever updated from a secure/reliable source?
    • Re: (Score:2, Interesting)

      by NotBorg (829820) *

      There is only one solution: executable code must be embedded in hardware read-only media and must be reloaded after every session. [today reloading a virtual machine is a good approximation, but this method will succumb under sufficiently sophisticated attack; it really needs to be built into nonflashable rom]

      Because there's no reason to update software, ever? I know that I get security updates all the time which I'm happy to say I didn't have to replace a chip to apply. The fact that you can't modify c

    • Every time I close my text editor and then realize that I meant to type a few more things, I have to take the ROM cartridge out of my computer, put it back in, wait for the volume to be checked, then for the executable to be moved into faster storage (so swapping doesn't take half a minute), and only then do I get to wait for it to be copied into main memory and run? Or is the interim storage too insecure?

      How many ROM slots am I supposed to have on my desktop machine? Three, maybe four? So, let's see, I ca

    • Nobody wants to hear this. I'm not exacty sure why

      Could be because it's an extreme position? Or because knowledgeable system designers don't see that it solves anything? Just a thought.

    • blackmail and scammers gaining more and more power until we remove the ability of malignent code to survive

      And therein lies the problem. Who decides what is malignent and what is not?

      If we implement the "hard coded" solution you propose, then by default, we give ALL of the coding power to the companies that do that hard coding. Talk about lock-in! But if you leave it "open" and allow amateur's programs to run, then you have the malignancy problem you mention. The whole problem is that we do not
    • There is only one solution: executable code must be embedded in hardware read-only media and must be reloaded after every session

      Nobody wants to hear this. I'm not exacty sure why;

      Because you completely fail to understand the idea of a Von Neumann architecture machine. There is no semantic difference between data and executable code. Want to run a spreadsheet? Those formulae are all executable code. Want to run a web browser? What do you think all of that JavaScript is? What about word processor macros? If you limited a computer to running locked software, you would dramatically reduce its usefulness.

      You are also completely ignoring the fact that data persists even if prog

  • by DoofusOfDeath (636671) on Tuesday February 12, 2008 @03:00PM (#22395290)
    Hand me your cache!

    (Sorry - for humor I go for quantity, not quality.)
  • by EllynGeek (824747) on Tuesday February 12, 2008 @03:03PM (#22395338)
    I did read the actual report, all 56 pages of it. As usual, Windows' total lack of security guarantees that any random blackhat with a minimum of skill can exploit it. Go ahead and mod me Troll again, you lameass Microsoft-fanboi moderators, but it won't change what the report says- Windows is the problem.
    • by gnick (1211984)

      Windows is the problem.

      I'm certainly no MS fanboy, I don't consider your original post a Troll, and I won't even argue your 90% speculation. But I can't blame Windows's security for this. When you have 76% of the market share [wikipedia.org], it doesn't seem unreasonable that the blackhats will target you 90% of the time. So, unless their security is head-and-shoulders better than the competition, they will still have the most breaches.

      • by RiffRafff (234408)
        Criminals don't steal the most abundant ("popular") car; they steal the easiest. Yet another car analogy, but it works here. Windows' security is knees-and-ankles below the competition. They get targeted first. Otherwise you'd see the Web getting broken everyday, since it's mostly run on Apache with non-Windows servers. IIS and its ilk still get targeted first. Or so has been my observation.
        • by gnick (1211984)

          Yet another car analogy, but it works here.

          Stealing cars and exploiting computer exploits are completely different situations. Imagine a city where 76% of the population drove Hondas. The other 24% drive a variety of cars of roughly the same value. Each make of car has a different security system. Now, if you can figure out how to get around Honda's security system, 76% of the cars in the city are yours for the taking. If you figure out how to get around Buick's security system, you have your choice of the handful of Buicks driving around.

          Desp

      • Re: (Score:3, Insightful)

        by EllynGeek (824747)
        The old "more market share is why Windows is more attacked" has been so thoroughly debunked you should be ashamed of yourself for parroting it yet again. Please- educate yourself; you reveal that you know little about operating systems when you say that. It's just not true. Well, it's partly true- with the perfect combination of easily exploited and dominant market share, it's a perfect recipe for organized crime and blackhats of all varieties to run rampant. If an open-source Unix-type operating system wer
        • by gnick (1211984)

          The old "more market share is why Windows is more attacked" has been so thoroughly debunked you should be ashamed of yourself for parroting it yet again. Please- educate yourself; you reveal that you know little about operating systems when you say that.

          Wow, that was kind of nasty... Did my post somehow make it sound like I thought Windows was as secure as its competitors? The superior security is one of the many reasons I've got Slackware installed.

          That said, Windows is attacked much more than the other OS's. It's more popular and, in general, its users are less computer-savvy. If I were a blackhat, Windows would certainly be my choice target for a variety of reasons - Even if it was on an even-footing security-wise with its competitors. I'm certain

    • [the majority of] Windows users are the problem.

      Fixed that for ya.
  • You know... (Score:5, Funny)

    by Guppy06 (410832) on Tuesday February 12, 2008 @03:05PM (#22395366)
    "In 2006, only a small percentage of attackers employed camouflaging techniques, but this number soared to 80 percent during the first half of 2007."

    If they're going to hose my Windows boxen and install spurious applications of dubious intent, I find that I prefer if they camouflage their attempts so as not to bother me with constant popups from the system tray telling me to install their spyware to get rid of spyware.
  • by Panaqqa (927615) * on Tuesday February 12, 2008 @04:00PM (#22396136) Homepage
    ...after all, it was only a matter of time once rootkit source code was published for anyone to grab. From that time onwards, true stealth malware was possible to create without needing to be a security researcher. Combine the ease of integrating someone else's rootkit code into a payload with a vigorous open market for Windows vulnerability information ($25,000 gets you a brand new zero-day exploit) and you reach the situation we have today.

    Some people believe the largest botnets out there are ones built with the Storm Worm or other similar exploits. My bet would be that there are plenty larger out there, undetectable because they hide behind rootkits and don't do stupid stuff like turn the box into a spam cannon. And for people who think that the C&C (Command and Control) would be detected, think again: if a rootkit can conceal a file then it can also conceal a process, a named pipe, an interrupt handler, you name it.

  • controlling the computers of consumers at 'a rate never before seen on the Internet'
    Before remote control of computers starting occurring on the Internet the majority of hacks came from psychics, thus explaining the ever popular tinfoil hat.
  • by WD (96061) on Tuesday February 12, 2008 @04:37PM (#22396692)
    ... secure your web browser [cert.org]. Many browsers are not secure out of the box, which puts you at risk of attack.
    • by g8oz (144003)
      Another good idea with Internet Explorer:

      Go to Tools => Internet Options => Advanced => Disable "Enable third party browser extensions".

      I've found it prevents quite a bit of spyware from running even if it has installed itself, and is a quick help for complaining friends & family who want you to do something about their slow computers.
  • by Repton (60818) on Tuesday February 12, 2008 @05:35PM (#22397776) Homepage

    Consider this hypothetical situation: I'm running Windows XP with no firewall and no antivirus. I'm on broadband and my ADSL modem/router does NAT with no port-forwarding rules set up. I'm fully patched and run out-of-the-box firefox. I don't run executables from untrusted sources, I understand how to treat email attachments, and I'm smart enough not to get caught by phishing.

    How vulnerable am I? How likely is it that I will get compromised?

    Does the answer change if I'm running fully-patched IE7?

We can predict everything, except the future.

Working...