Windows Security Holes Go Mostly Unexploited 557
murky.waters writes "Wired News has an article with a decidedly different take on security holes in Microsoft Windows: Despite the thousands of known exploits and virii, most MS users aren't target of much harm, and the big guns such as Klez have had almost no effect on home users. An interesting read that, if true, challenges some common arguments."
And how many (Score:5, Insightful)
Re:And how many (Score:3, Insightful)
Re:And how many (Score:3, Insightful)
Perhaps because they don't know? I know I wouldn't notice someone sneaking away my IE history file, or the password file, or a couple of mp3s.
Re:And how many (Score:5, Insightful)
If your Windows PC has a fast (DSL or cable) connection, it may well be one of thousands of machines owned by some jerk who wants to use it to launch DDoS attacks. Its owner may never notice any difference: it appears to operate normally, only sometimes the web seems a bit slower than expected. The attacker has an interest in having the machine appear to be "normal".
Linux more likely to be exploitable (Score:5, Informative)
My lab used to have an unprotected DSL with out-of-the-box RedHat 6.x and unprotected Win95 boxes on it that we used for testing things. As far as I could tell, nobody ever successfully hacked the Windows box, and when I was running ZoneAlarm, it'd detect a lot of doorknockers but no real attack - No surprise, because we had file-system sharing turned off, a relatively obscure freeware web server, no Napster/Kazaa/Gnutella/Morpheus/etc., and not much else useful on it except clients so not much to crack.
But the main Linux box got broken into all the time - I eventually changed its name to "Kenny" because it was getting brutally killed every week. As far as I could tell, nobody seriously bothered it once I upgraded to RH 7.1 in a medium-secure mode (I didn't install FTP servers, for instance, and Apache didn't have any web pages complex enough to be exploited), but by then I wasn't doing much complex, and I'd replaced the highly reliable Pentium-66 with an faster el-cheapo machine that often died on its own so it wasn't available to crackers.
The most common attacks I was aware of were some rootkit followed by installing Staecheldraht DDOS and some IRC bots. (And after I'd wiped out Staecheldraht a couple of times, the loser got annoyed and wiped out my disk drive once.) I noticed the initial attack because one of Kenny's P66 cousins was used to run a tcpdump sniffer to monitor the LAN and it kept doing ICMP to machines at universities. At least one of the rootkits "fixed" ls and ps to not report on its directories and processes, but forgot about some other utilities like /proc, and forgot about semantics problems like
Re:And how many (Score:5, Insightful)
Woopiedoo. What percentage of Linux users installed Tripwire or similar first when they built their box? How will those who didn't notice that they are compromised?
Anti-intrusion systems should be built into the OS. "This binary has been tampered with, refusing to run it" is what we need, but somewhere in a happy medium between that and the "trusted computing" that is creating fear amoungst the geek comunity.
I think Apple has an anti-tamper system in OS X (Score:3, Interesting)
If Mail has been changed or tampered with, if AIM or ICQ or iChat, etc, etc, it asks me 'should I allow this program access to the keychain'?
Of course I dunno if this is robust or reliable, but it seems to exist.
Re:And how many (Score:5, Informative)
- Anti-intrusion systems should be built into the OS.
This is a very, very good point. So far, the only systems I've installed that automatically install intrusion detection of any reasonable sort are Mandrake Linux and OpenBSD. I've been particularly impressed with OpenBSD's daily reporting facilities. By default, it mails a "daily insecurity report" and daily status report on your network interfaces and basic system information to me. In addition, when installing OpenBSD packages, the packages spit out a little blurb after they install, explaining what is left to configure the package, any general security concerns, and suggestions on additionally securing the service. It even installs those packages with decent default security settings. My only complaint is that I have difficulty recommending it, at this point, to my friends who are less experienced in the UNIX world.The political baggage OpenBSD carries with it is rather unfortunate, but I note that after I am port-scanned on my OpenBSD box, I've never had an intruder attempt to use an exploit. Meanwhile, my GNU/Linux box routinely has crackers (unsuccessfully) attempt to do some well-known Apache exploits or attack my mail server. Oy, veh, annoying.
I think that user education is also critical for any operating system. Although you don't expect users to become security experts, it is the responsibility of the distribution designers to make sure the security information reported by their system is concise, easily understood, and presented in an obvious but non-annoying way.
Re:And how many (Score:3, Funny)
Why is it mailing my system information to you? That doesn't seem very secure at all.
In other news (Score:5, Insightful)
Re:In other news (Score:3, Insightful)
Re:In other news (Score:5, Insightful)
The fact that the bugs go unexploited is a good thing, but it does not excuse the bugs. People are unlikely to want to switch from Windows to another OS simply because there are lots of security holes, because they rarely encounter them. From your average user's point of view, they're no big deal. But that doesn't excuse Microsoft from allowing them to exist, just as the low number of rapes doesn't excuse governmental organisations from allowing dark alleys to exist. Every rape is tragic. Every bug exploited is of course not as tragic, but certainly an inconvenience for the victim, and at times a rather large financial problem for companies.
Bad. (Score:2, Interesting)
I know the difference, but I'm wondering what percentage of the unexploited are also currently unpatched?
Perhaps all the black hats are just saving up for, MWHahahaha, World Domination.
Well yeah, (Score:5, Insightful)
Saying that unprotected windows machines go un-hacked is rediculous. Just look at your server logs (if you run a web server). How many automated hack attemps do you see? quite a few.
Tons of people are infected with viruses and spyware (now that shit should be illigal, god damn) but they never notice or care, as long as their computers keep working.
Maybe I'm an exception, but... (Score:3)
Before I got DSL (and a static IP) I was warned that they usually get a lot of hack attempts. Maybe I'm the exception, or maybe I'm being hacked at such a high-level that my scanners or firewalls haven't caught it.
But overall, running Win2000 the whole time, I haven't had a problem.
Re:Maybe I'm an exception, but... (Score:5, Interesting)
Re:Maybe I'm an exception, but... (Score:3, Funny)
127.0.0.1
Do your worst. >:)
I'd like to think that's part of the reason I have very few problems with hacking. I don't try to hack other people, I don't snoop on networks, and I don't "step up" to challenges like this.
Live and let live.
Re:Well yeah, (Score:5, Informative)
Very true. I worked a temp job doing warranty repairs on Gatway PCs (and wouldn't recommend a Gateway to my worst enemy). Sadly, since the Gateway Country stores don't employ any computer literate people, over half of the systems we were to "repair" involved popping in the restore CD.
But at the time (a few months back), I'd say about 10% of them were Klez-related (in order to tell the user what was wrong, we had to do a diagnosis including virus scan as a first step).
As well, my dad has restored his PC a multitude of times in the 3 years he's had it. He of course thinks it's because Microsoft sucks, or "that new MSN upgrade broke my system", but in reality I think it's because he'll download anything and everything he can get his hands on (he just loves that Bonzi buddy thing... ugh)
My point simply being that most of them probably didn't even know they were infected/exploited (I'm sure most don't read the paperwork we sent back). These statistics come from where, exactly? How many joe-sixpack users, who have already been ridiculed by their geek friends, are going to admit in a survey that they were stupid enough to click on the attachment against everyone's advice?
I just have to wonder where the stats come from. If it's from Wired readers, I'd say it's skewed as their average reader-base is probably a bit more savvy than average.
Saying that unprotected windows machines go un-hacked is rediculous. Just look at your server logs (if you run a web server). How many automated hack attemps do you see? quite a few.
And since Code-Red, Nimda, etc use a semi-random IP selection routine, attempting to stay close to the current IP, home cable/DSL networks are the most affected. My DSL still logs around 80-100 attempts on port 80 per day (keeping in mind Nimda tries several variations per attempt).
Also, the majority affected aren't aware that they are even running a web server at all, much less that they're infected (and spreading infection). To this day, I can go to each IP in my logs, and see the IIS default page on the vast majority (indicating they aren't running IIS for a reason, and likely aren't aware that it's there).
Finally, I just want to say that just because not everyone has been exploited, should mean that we should look at the situation any lighter. The Code Red thing should have been a serious wake-up call to Microsoft. Same with iloveyou, melissa, et al. These things were highly public, and should have been viewed as a major fiasco. Maybe the scene has toned down in the last year or so, sure, but that doesn't mean we should just not worry about it. Hopefully not too many people will read the Wired article and become more lax in their practices...
Very simple answer (Score:3, Insightful)
Here's the virus count for my gateway since July 4 of this year:
717 WORM_KLEZ.H
120 WORM_SIRCAM.A
45 WORM_YAHA.E
11 PE_NIMDA.E
6 WORM_BUGBEAR.A
2 WORM_HYBRIS.B
1 JS_NIMDA.A
1 WORM_HYBRIS.C
1 WORM_KLEZ.E
Re:Well yeah, (Score:3, Insightful)
Agreed.
Apparently malicious code inserted into Windows by 13 year olds with nothing better to do deoesn't harm stability any more than what MS put in there. (O.K. that's out of my system now)
The other factor is probably that most people don't have anything all that interesting on their PC that couldn't be gotten more easily on a warez newsgroup. The same reason most people needn't worry about neighbors listening in on their cordless (or even tapping in at the NID on their landline).
The reason is ... (Score:5, Funny)
Deadlines in mirror are closer than they appear (Score:2)
They'll get around to it.
Sad but true. (Score:3, Interesting)
One of the things that annoys me the most is the number of reported holes that are caused by buffer overflows. There's simply no excuse for them this decade! If you don't have a good enough quality control process to test for them all, and MS doesn't, you shouldn't let your people write code in C! Don't get me wrong - I really *like* C, and I've been using it for over 20 years. It's a great language for a lot of things, including compact, efficient, clean, obvious code, and it does let you shoot yourself in the foot [216.239.51.100]. But if you can't keep your people from shooting, and can't tell where the holes are, and can't tell whether all your feet are intact, it's not the language for you. And if you want to use C++ or C-- or C-sharp or C-dull, and you don't enforce the use of safe I/O and copying methods, don't do that either. (By the way, this rant applies to Linux as well.)
Esther Dyson has her signature-line about "Always make new mistakes". Buffer overflows and testing for maliciously formatted input aren't new mistakes, folks! They're CS100 material, the first thing you should be learning after you learn how to do arrays and input functions. (And I learned my programming in PL/I, an language that won't let you overflow buffers.) At least make the bugs interesting, like race conditions or something! Accepting input that abuses ..s in directory paths when they shouldn't be there isn't a new mistake, and it's one of the most common bug reports I see that aren't memory-related.
Lies, foul lies. (Score:5, Informative)
It's an epidemic.
On the other hand, we know of surprisingly few cases where machines were exploited on the network for other types of obvious security holes.
"We know of" being the key phrase.
You missed the point. (Score:5, Informative)
Not just Windows security holes (Score:4, Informative)
I find this typical of the slanted, Microsoft-bashing nature of posts here on Slashdot!
Sooner or Later (Score:5, Insightful)
Experts who discover and report security holes seem to be far more industrious than the malicious hackers willing or able to exploit those holes.
The problem is that the article fails to mention that if the holes are not fixed, sooner or later the so called malicious hacker will find it and exploit it *quietly*. This is dangerous thing.
IMHO, better to expose it and then *quickly* fix it rather than do nothing.
The problem is now that Microsoft knows (or being told) about the holes but often takes a very long time to fix it and sometimes ditch the bugs as "unimportant". This is even worse as this *will* give a plenty opportunity for the hackers to implement the exploit.
Klez - What kind of virus name is this? (Score:4, Funny)
Re:Klez - What kind of virus name is this? (Score:2, Informative)
The author did, however, name KLEZ and it's parasite, Elkern. KLEZ appears to be an acronym, though what it stands for is unknown.
Also, sometimes the author's names are simply ignored - for example, Nimda isn't actually called Nimda, it just wrote a file called ADMIN.DLL and while reversing it, the researchers..
Re:Klez - What kind of virus name is this? (Score:5, Funny)
Re:Klez - What kind of virus name is this? (Score:2)
Re:Klez - What kind of virus name is this? (Score:2)
Opaserv exploited one (Score:3, Interesting)
Its so bad, that if you install win98 on a fresh machine, password protect and share the C drive, and connect to the internet, you can get this variant within 5 minutes. Opaserv exploits a shared drive password flaw, and has full access to the machine. Then it will ruin the CMOS and main hard drive partitions.
From my tech support experience, this year has been the worst for exploits.
Re:Opaserv exploited one (Score:2)
a) Figure out Opaserv hit them
b) Figure Windows went bad again and simply try to reinstall the OS
c) Figure their hard drive pooped out and buy a new machine
d) Profit!!!
You'd think that virus writers would get pissed off that Microsoft keeps getting credit for all the messed up machines. I mean what does a self respecting cracker need to do nowadays
Re:Opaserv exploited one (Score:2)
----
Illegal Microsoft Windows license detected! You are in violation of the Digital Millennium Copyright Act!
Your unauthorized license has been revoked.
For more information, please call us at:
1-888-NOPIRACY
If you are outside the USA, please look up the correct contact information on our website, at:
www.bsa.org
Business Software Alliance
Promoting a safe & legal online world.
----
Annoying huh? But you're right. I've been helping a lot of people out who've been infected by Opaserv. Of the few who recognized it is Opaserv, I've already had 1 guy say "Well, I don't want to mess with it, I went out earlier today and bought a new machine with WinXP on it."
Re:Opaserv exploited one (Score:2)
Re:Opaserv exploited one (Score:2)
Re:Opaserv exploited one (Score:3, Insightful)
Overwriting the BIOS with garbage is as good as destroying it, unless you have a system with dual BIOS chips. If you can't boot to DOS, you can't re-flash it with the correct software.
Re:Opaserv exploited one (Score:5, Informative)
And since it doesn't exist, there's no reason for MS to release a patch to fix the vulnerability [microsoft.com], right?
Obviously, you're intelligent and checked Google [google.com] before flaming away.
What a load of horse feces (Score:5, Interesting)
Needless to say, for the week this was going on, I noticed serious network problems at home. And pinpointed them to every time she turned on her computer, the network would lag to a stop. Finally after researching it I discovered what was going on.. I found the channel these guys hung out in, and she wasn't the only victim. They had a few hundred hacked users they could control.
So when I see reports like this, I suddenly get a whiff of steaming horse shit.
Re:What a load of horse feces (Score:2, Insightful)
Ever join a chatroom and get mass autosends of crap like 'HoTCHICKandDOG.vbs'? Your girlfriend accepted and ran one of them. (Or maybe through an e-mail or a website or whatever)
So it's not what this article is about. Unless you consider user incompetence a security hole. And then, I don't know what you expect MSFT to do about it.
Re:What a load of horse feces (Score:4, Insightful)
Just because your girlfriend's computer got compromised doesn't make the article's position incorrect. Even a few hundred zombies on some script kiddy IRC channel doesn't invalidate the contention.
I really don't think you can use your indivdual experience as a barometer for the world at large. Being cracked isn't a unique experience, but it's not as common as the FUD-mongers would have us believe.
Re:What a load of horse feces (Score:3, Interesting)
Over the summer my sister decided to run some P2P software on my main workstation while I wasn't home. I get home the next day and noticed my LAN lights on my hub going nuts from my main workstation. So I yanked the cord from the hub and decided to see what processes were running.
Low and behold I discovered what was causing it. My sister downloaded a keygen off the network that turned out not to be a keygen but a trojan instead that was connecting to an IRC server and was DoS'n someone.
Using an IRC daemon, some IRC monitoring software, and a small edit of my hosts file, I discovered where this thing was connecting, what channel it was joining, and the password required for the channel. I fired up another IRC connection from my machine and decided to talk to the kiddies.
The kids were acting like they didn't know anything and subsequently kicked me out. Didn't do anything beyond there but they had a massive collection of bots going.
Why... (Score:5, Funny)
Re:Why... (Score:3, Insightful)
Outbreaks of Ebola and other very quick killing virii stamp themselves out due to lack of new hosts.
Doug
They must not be herding my patrons (Score:3, Interesting)
I'm not surprised (Score:2, Interesting)
What are they gonna do? Edit someones Sims save file to make them 6 year old girls? I've been DDOS'd and had various exploits tried against me in the past. The worst they could do is annoy me.
I mean, rock-solid security on your OS is all fine and good.. But I don't wear a bulletproof vest either, and it's ok, because I hardly ever get shot at.
One word: Zombie (Score:2)
Re:I'm not surprised (Score:2, Insightful)
The many exploit-ers are not aiming at you in particular. Once an exploit is found, setting up an automated tool to hack random machines is not hard. You may just happen to be one of the random victims.
Random victims can then be staging points for many things such as: warez servers, DDOS attacks on someone else, automated hack stations to get more zombies, etc.
This is fairly short sighted. Yes it may be an annoyance to you, but when your machine and thousands of others are DDOS-ing etrade.com, I can't make trades. Now it annoys me.
The difference is that it is hard to set up a gun that fires non-stop at random people for long periods of time. And if it were not so hard, and if there was a low risk of being caught by the police, I'm sure that you would start wearing a bullet proof vest -- or risk getting maimed.
Re:I'm not surprised (Score:3, Informative)
M$ is the Disease (Score:2)
"In the computer security game, you can't be an Edward Jenner and come up with a vaccine for electronic smallpox that will put you in the history books and eventually result in the complete eradication of the disease," George Smith said. "You can only be the guy that spots the electronic poison ivy and suggests people either steer clear or buy calamine."
That's not true. If you could come up with a vacine that eradicated Microsoft, the disease would disappear along with it!
Re:M$ is the Disease (Score:3, Insightful)
Too late, we're already infected.
We'd have to eradicate Microsoft before the KDE, Gnome, and Mono projects finish cloning all of their convenient but insecure features (autorun when someone puts a disk in your CD drive, macros in your documents, Visual Basic scripts in attachments, click and run everything). Trade press folks saying that Linux on the desktop will never succeed until the apps work exactly the same way, when many of the security holes are simply logical consequences of the features as designed.
Re:M$ is the Disease (Score:2)
In that case, Linux developers should pay more attention when Microsoft screw up, the better to make sure that they don't wind up doing the exact same thing at some point in the future...
In a related story (Score:5, Funny)
There is a reson for this (Score:5, Insightful)
- Steal the HS research paper on crop circles
- Grab secret financial information
- Use as a proxy to hide the hackers identity*
- Part of a DDOS attack*
Now, lets think of all the benefits of hacking a server/websiteAlso note the last 2 reasons for hacking a home computer are really for working with servers. The truth is, not too many people really care about hacking your computer, unless its a means to an end.
Re:There is a reson for this (Score:3, Interesting)
Re:There is a reson for this (Score:3, Insightful)
Note that in the last two reasons you give -- use as a proxy to hide identity, and use in a DDOS attack, it is in the interest of the attacker to hide the fact that there has been a successful attack, and to allow the owner to continue to use his/her machine normally. If the owner notices that something is wrong and re-installs the OS, the black hat loses the box. So, naturally the home user thinks he has no security problems. The attacker might even have patched a few security holes, so no other attacker can take it over.
ahem... (Score:5, Informative)
As we speak, someone is changing the news options on the RIAA website [riaa.org]. However, they don't seem to be stopping them from doing it. I did grab a shot of a particularly amusing one [granzeau.com] though.
Oh, and just so everyone knows. [netcraft.com]
Re:ahem... (Score:2)
The interesting part: (Score:3, Funny)
Since a small percentage of homes are robbed... (Score:2, Informative)
Re:Since a small percentage of homes are robbed... (Score:2)
The biggest issue I have with Klez is the forging (Score:5, Interesting)
I am then subjected to dozens of e-mail scanning auto-responders telling me I have a virus, auto replies from people I've never heard of, and the occasional jerk who thinks they know everything screaming at me in e-mail telling me I am stupid for letting myself get infected.
The fact I am also the postmaster admin to 13,000 users means I get users contacting me in a panic thinking they have a virus because one of the three above things happens to them. This, despite a faq and notices on intranet etc etc that this thing is out there.
Klez is probably the primary reason I am starting to hate Microsoft. It doesn't matter if my computer and all computers I am responsible for are completely patched and that my mail gateway blocks it, I still get to be a victim indirectly, and I doubt we'll ever see the entire planet fully patched.
My Nutty Theory (Score:2, Interesting)
Little impact? (Score:2)
Big impact? (Score:2)
Re:Little impact? (Score:2)
public memo (Score:5, Informative)
Public Memo:
Its "viruses", not "virii". Repeating, "viruses".
Did you also get the memo about the TPS report cover sheets?
Quick, somebody turn the FUD back up!... (Score:2, Funny)
God Bless American AntiVirus companies and their Anti-Terrorist business campaign!
You could be transmitting your IP address right now for hackers to lock-in on! Buy some protection for you and your loved ones before they wipe out your hidden porn collection!
--
Security through "It hasn't happened yet" (Score:3, Insightful)
Do we doubt that there are malicious, destructive and/or idiotic people out there? Do we doubt that there are enough relatively easy-to-exploit bugs out there that can have amazingly destructive consequences?
While I would love for there to be a more holistic approach to security, as long as the majority software platform (with all of it's variants) is rife with holes and the security repair falls exclusively to the same people who built it bad in the first place, I'll take point-by-point/line-by-line review any day of the week and twice on Tuesday.
Re:Security through "It hasn't happened yet" (Score:2)
This doesnt solve the problem but it would explain the lower than expected numbers they talk about.
RIAA HACKED (Score:5, Funny)
Why bother (Score:3, Funny)
What is needed is a remote, unattended install of Linux so the system security can be fixed while giving the cracker something more useful to use. It might even be considered charitable, the new system admin could maintain the system for free and the users might not even notice if you gave them an autologin with a message telling them their kid installed a cool new desktop theme!
Exploits == Security Holes? (Score:5, Insightful)
I mean, think about what an exploit really is: Somebody has taken a feature of Windows and turned it against the user or the user's machine. The problem I see here is that you can't have a totally secure machine and have all those fancy features you like.
I'll give you an example: I use Outlooks's to do list to keep track of my tasks. There's a feature where you can attach shortcuts to each task. I've found this handy, whenever I need to do my time sheet I just pull up the task and double click the shortcut inside of it. Now, in order to 'crack down' on security on my computer, I turned off a bunch of those handy-dandy features and found myself unable to launch that shortcut anymore!
Now, before you start saying "Oh, MS could easily fix that...", instead think about the real problem here. Either I don't use that feature at all, or MS has to think of every single malicious use of a feature and only allow the non-dangerous ones. Sorry, that's not a good solution. You're holding MS (or anybody else) responsible for other people's creativity.
I'm not saying that MS is unfairly given a bad rap for this whole topic. I think their default choices are ill-thought and have caused serious damage. However, it needs to be considered that there is always an inherent risk with any piece of software you use. It's not a matter of security holes, it's a matter of deciding whether or not it's worth the risk.
I, for one, would never underestimate people's creativity. I read about an insurance scam once where this guy got fire insurance for each of his cigars, over $1,000 a piece. Then he smoked them. He took the insurance company to court, and the judge reluctantly ruled that the insurance company had to pay the guy $12,000. Fortunately for the insurance company, though, they were able to charge him with arson. Heh he got a hefty fine ($10,000 ish? I don't remember..) and served jail time.
Now, if you think about this insurance company, you probably wonder why they didn't a policy about cigars or items that were meant to work with fire? Well, it's simple: They never imagined that somebody'd do that. The only way they could be fraud proof is if they were to clearly define the rules for every ridiculous outcome they can think of. Know what'd happen then? There would be people unable to redeem fair claims because their unusual case strayed outside the boundaries that are clearly defined. There would also be that one guy who figures out a creative way to buck the system anyway. The insurance company is far better off coming up with ways to deal with the eventual fraud instead of over-relying on their policies and laws to protect them.
So where does that leave us computer people? Well, it's simple: Using a computer is risky. Take a few risks but protect yourself. Worried about people stealing your credit card info on-line? My answer is not: "well don't use one then!" Instead, my answer is: "Get a credit card with a company that'll protect you in that event." Worried about data loss? Make backups once in a while. Worried about hackers breaking in on your always on connection? Use a firewall, but use common sense too. A firewall is the equivalent of shutting a few windows, it's not a structural reinforcement.
Total security is a pipe dream. Instead of blaming Microsoft, take some sensible precautions to minimize the damage done. The benefit here is that you protect yourself from damage that can happen outside of the exploit world. (Lightning strikes, hardware failure, children...)
I still get Klez virii daily (Score:3, Funny)
Business are target (Score:2)
1. Don't download e-mail attatchments. Avoid attatchments to e-mails entirely if possible, use IM file transfers instead.
2. Don't use Outlook.
3. Don't visit untrustworthy websites. like warezprontrojanforyou.com
4. Use a firewall if you are on a LAN.
Anti-virus software is almost useless for a home user, unless they are incredibly stupid. All it does is interfere with other programs and waste memory. Seriously if you are a home user who the crap wants to crack into your pc? You probably haven't even configured it properly so it can't even have enough uptime to get anything useful from it.
And do hax0rz really want to steal your family photo album? The best they can hope for is your quicken files or your credit card number. They can get thousands of CC#s by cracking a business database better than getting home users through windows holes. Computer security is somethign only business have to worry about.
Re:Business are target (Score:2)
Code Red, Nimda and iloveyou are just myths ? (Score:2)
but maybe i am wrong lets read the wired article now.
Mitigating factors... (Score:3, Interesting)
A lot of the potential exploits would fall at the first two hurdles above. For instance, by setting Outlook (Express) to use the Restricted Zone, you've already plugged several holes.
This is not to excuse Microsoft for creating the holes in the first place. Particularly odious are those related to allowing scripting to be performed in places where it makes no sense whatsoever, eg. Windows Media files. That is not a case of sloppy coding, that is bad design from the get-go.
Sad to say, even if Microsoft fixed all the outstanding holes tomorrow, you will still need to have a firewall and anti-virus software, because the malware will continue regardless, until such time as we all move to a platform that is secure by design. (And, no, in truth that platform doesn't exist yet)
Can't extrapolate this to determine overall risk (Score:5, Insightful)
Likewise, every remote root exploit makes it technically possible for this [berkeley.edu] to happen. Even if relatively few people are being hacked by script kiddies today, that says nothing about the odds of a highly skilled attacker pulling off a single massively devestating attack.
This report is no reason for complacency.
To coin a medical phrase (Score:2)
We've got the Exchange server punting any attachments that don't end in
We've got parts of the workstation's registries locked out from normal user modification, and Trend Officescan is installed on all worstations and automatically updated from the server.
We've got an agressive firewall policy. (e.g. no tftp from funny locations.)
We haven't had ANY recient virus attacks. Short of having someone brnig something minor in on a floppy, virus attacks just haven't happened. I don't think we'll see many more as time goes on as all of the easy vectors have been plugged.
So it doesn't matter that they're there? (Score:2)
We had a security exposure, we didn't "patch" it - does that mean it wasn't dangerous that we left the doors open? No, it just meant we hadn't been ripped off yet.
Pardon my French but... (Score:2)
As it is in the real world... (Score:3, Insightful)
Of course most vulnerabilities don't get exploited, it's just a matter of volume.
I think it's better preparation and response... (Score:3, Interesting)
Virus scan engines were updated, email servers had attachment blocking filters installed, patches were installed, etc.
There has been a slew of updates made available to applications like Outloook, Outlook Express, IIS and so forth which disable many of the features that these exploits took advantage of. The Outlook 2k security update, default permissions in OE 6.0, IIS Lockdown wizard, URLScan, etc.
Then you have a whole slew of administrative utilities such as HFNetChk from Microsoft/Shavlik to test systems for patches and various tools(HFNetChk Pro) to do reports on large numbers of machines and push out patches.
I do agree that the security finders tend to overstate the impact, but it's still important to react to the issues. The conclusion that wired really should be making is that we've learned lessons and learned how to better prepare and respond. That's why their are fewer major problems.
I beg your pardon? (Score:3, Funny)
Hmm.
*checking mail logs*
According to my mail server's logs, I have gotten FORTY virus/worm-infected emails since midnight.
No effect on home users? Someone hit this guy with a cluebat.
Just my $.02...
suburban logic? It won't happen to me. (Score:3, Interesting)
Security holes = hidden tax that effects all (Score:4, Insightful)
If a company is hacked and blackmailed they often don't report it. But the cost is passed along to the consumer.
Re:Security holes = hidden tax that effects all (Score:3, Funny)
The biggest security hole (Score:4, Insightful)
And I have heard claims that as many as 90% of security breaches go undetected. Think about it. How many of even you Linux users actually run tripwire on your personal system? What percentage of people do you think even check the md5sum against their downloads before compiling as root? It is small I guarantee. I once posted the wrong md5sum for a release of an open source project and it was downloaded hundreds of times without anyone saying anything.
Another reason they go undetected is that many trojans are customized. If you were going to plant a keystroke logger on a target's computer would you use one that is found by McAfee antivirus? No. You'd compile your own; changing the signature, different size, different port, different protocol, and only use that particular version in that one instance.
Of the breaches that are detected, many are not reported. What bank or online retailer wants people to know that their personal data was stolen? So just because there hasn't been a Code Red lately doesn't mean all is well.
0190 attacks very common in Germany (Score:3)
Windows Security Holes Go Mostly Unexploited (Score:3, Funny)
Well let's get to work!
haha, what crappy software! (Score:3, Insightful)
Klez (Score:3, Interesting)
We can tell from the users profile if its a p2p network program, or a virus, viruses dont portscan your entire network, or spam your smtp servers.
Many users have found things such as back orafice, or other remote programs. Lucky its easier to watch for this when you own the entire network, for an ISP, it would be much harder.
YMMV.
Despite the thousands... (Score:4, Insightful)
3 words... no shit sherlock. Despitesthe incredible stupidity of claims that klez is ineffective, I'd have to say the reason that thousands of different virii/exploits/etc aren't being used is because the existing ones work very well to nail a large range of people. If 2% of the exploits hit such a large audience of say 100000+ people, why bother trying to hack up new methods.
Once a given method begins to be less effective, then the hackers/etc can move onto something more effective.
It's like having a changeroom with 1000 peepholes. Why do you need 998 of them when the one or two in the corner are showing you all you need to see?
Tell that to flight 111 (Score:3, Insightful)
Security is, and never will, be perfect but it does make it harder for an intruder to pull something off. Florida in the late '70s probably had the most stringent security of any airports in the states (lots of cuban hijackers wanting to go home, etc.). Nontheless, I was able to walk all over their security systems before I made the mistake of tellling someone what I'd just done (asking for help, I was).
It's not that most home users aren't affected by viruses, it's that most home users don't notic when they're infected. Most home users don't have the money to pay for someone who can watch their network on an ongoing basis for signs of intrusion. Even fewer are geekheads like me who can look at the blinking lights on my hub, go 'where did that traffic come from' and then load up ethereal and/or go through my firewall logs (firewall? what fireall) to figure out if what happened was really benign.
Even businesses -- One place that I do occasional work (the only Unix-head in a sea of Windows) didn't know that they were infected until I noticed way too much traffic for the time of day and started up ethereal. I told their admin, he plugged the holes, and a little while later I found more signs of exploitation on their net. The last time I told their Windows admin about a problem, he had given up trying to secure their boxes. Spammers are still using their proxy boxes to deliver email but most majour services (except Hotmail!) are refusing their connection, now.
If Al Quaida was using the thousands of 'benign' Windows exploits to setup a distributed meltdown of the internet, we wouldn't know it untill after the pieces fell down. They spent 4 years setting up September 11. How much damage could they do with 4 years worth of Windows exploits?
In other news (Score:3, Insightful)
"The average citizens wouldn't know a hack if it walked up and bit them," Sweeney [packetattack.com] said. "And many of the so-called landmines require a very specific event to occur and the odds are very slim that it will occur. "
Idiot. People care about the security problems is like Sudan's citizens care about landmines problems. The fact that majority of them are not victims doesn't mean it's safe out there.
Re:Good thing (Score:5, Insightful)
This doesn't mean that Windows' security doesn't need a LOT of work - it does. It's just that practically speaking many exploits are not "the end of the world" as many news sites (*cough*) would like to make it seem.
Re:Well dah... (Score:3, Informative)
Your wrong, home users do have something that is worth stealing, bandwidth anonymouty.
Currently hackers use exploited/infected machines to abuse their bandwidth, and remain anonymous. The bandwidth is used for ddos attacks, you would be surprised what 500 infected cable customers machines can do to almost any network, regardless of its size.
There are also trojans that run as proxy servers and mail relays, to be abused by spammers to send mail and annoying messenger spam out, since it always looks like it came from an infected machine, and there are never logs on said infected machine.
Actually, there was ONE known Mac exploit (Score:3, Interesting)
People just using the web service built into the Mac OS, however, have never had anything to fear. Unlike IIS, Personal Web Sharing and the AppleShare IP Web Service were always airtight.
~Philly