XP2 Spotted In The Wild 634
LostCluster writes "WinXP SP2 has just been released to the public via Automatic Update, but eWeek and PC Magazine are together reporting that Windows XP SP2's 'Windows Security Center' is just about as insecure as it could possibly be. According to them, any program (including ActiveX controls) can access and edit the Windows Management Instrumentation database, and therefore spoof the security status of an insecure box to report that it is properly secured."
Clippy.exe is eeevvviiilll (Score:5, Funny)
That MF'ing Clippy.exe in MS Word better stop accessing my Instrumentation database or I'll punch that SOB into the middle of next week. Really any program can access and edit the Windows Management Instrumentation database; I knew solitrae and tetris and an altier motive.
Programs in the wild (Score:5, Funny)
We're out 'ere lookin for signs of the elusive XP2 that's been said to be lurkin' in the wild...
Crikey, I've just spotted a wild paypah-clip in it's natural 'abitat! Look at those big ole eyes an'.. oh!.. there he goes trying to ask me if he can 'elp me!! You see, this creature is what's known as a parasite, 'ee leeches off o' your Windows Management Instrumentation databases. It's 'ard to satisfy one o' these buggers, they'll never leave ya alone until they've done your work for ya.
</steve irwin>
No problem here! (Score:5, Funny)
SP2 - as secure as any linux distro... (Score:5, Funny)
Re:SP2 - as secure as any linux distro... (Score:5, Insightful)
Re:SP2 - as secure as any linux distro... (Score:5, Interesting)
Seriously, this Security Console is a good example. "What if somebody could tell if their machine was secure just by opening a control panel?" That's a very good idea -- but it will take at least a year to develop something like this that actually works well enough to be a part of windows. In the meantime, they shake and bake something so people know they're working on it.
This is the Microsoft equivalent of Sourceforge Development Status 1. It's a dog and pony panel that will undoubtedly be replaced by something good in the future -- but by that time, most of the industry will have lost all trust in it.
Such is the case with IIS 6. It's actually pretty good, according to a lot of web programmers I know, but I just don't trust it -- to the point that I'm considering not using C# for impending web projects despite having a massive C# codebase. MS would have to go VERY far to get that trust back, and make a security leap similar to the UI leap they made from 3.1 to 95 or the stability leap they made from 98 to 2000.
Re:SP2 - as secure as any linux distro... (Score:3)
Office, IE, IIS, Windows... in their latest incarnations, they are varying degrees of good/decent software(configured correctly, ofcourse)... But their first 2 or 3 or 4 versions were bad/horrible/unholy. They got better, but they did so within the public sector, not an R&D lab.
Why so sloppy? (Score:3, Insightful)
Maybe you've seen the old motto. MS: "The whole world is our beta test site."
Why is MS software so insecure, and just plain sloppy? Maybe their management model just does not allow a programmer to finish his work. Later some poor guy is assigned to fix a terrible bug that is getting publicity, but it is difficult, boring work trying to understand what someone else did, and he makes mistakes.
Re:SP2 - as secure as any linux distro... (Score:5, Informative)
You probably don't know it, but marketing is about giving people the product they want. Unfortunately many companies (and Microsoft is one of them) talk about marketing, but what they are really talking about is advertising.
"What if somebody could tell if their machine was secure just by opening a control panel?"
This statement would be a really bad example of marketing: The company and/or its developers and "marketing" experts sit together and brainstorm without ever actually asking the customer. If they were to ask me this exact question, my answer would be:
"Are you really this insane? I don't want a control panel to tell me whether my machine is secure. I want the machine to be secure, plain and simple. Given MS Windows' (whatever incarnation) security track record, I neither would nor could ever trust any application that tells me the security status of the machine from within. It's probably already cracked, infested or whatever anyway by the time I check it. If history tells us anything, it's that any application can be made to tell me that it is secure."
I couldn't agree less with you. According to developers who are far more experienced with Windows than I am (IANAP), Windows is insecure by design, no fix or additional security layer on top of the current product will ever make it more secure. The only way to fix it, is to dump it and start from scratch.
This is the Microsoft equivalent of Sourceforge Development Status 1. It's a dog and pony panel that will undoubtedly be replaced by something good in the future -- but by that time, most of the industry will have lost all trust in it.
Many people argue that XP is, while more stable than all previous versions, with the notable exception of W2K, is still in development status and many of its design features are so braindead, that many knowledgable people have already lost trust in it.
IMHO, this is yet another stupid toy to make the casual home user and the boss feel more secure without actually delivering on the promises. If you were to ask them, they would all answer that they want a machine that is actually more secure rather than a having a MS tool that tells them they are. Once they told you, you design a product that is actually secure and does what the customer wants. This is marketing from an academic's point of view.
Its not that bad (Score:5, Insightful)
The nag "Where if your anti-virus" box is a reminder that windows needs an AV program to run properly. I can't stress how important a built-in firewall is, even if it is "weak" its still going to introduce people to the concept of a firewall much more than the old version did. Personally, I dont think ports over 1025 should be blocked by default, but that's just me.
I've been running SP2 since MS released the final version and am pretty pleased with it. XP even feels snappier. It passes the "grandma" test fairly well and like you wrote is a good first step towards securing windows. If it only helps fight spyware installs its worth its bytes in grams of gold. Especially for us techies who get called, bothered, etc for stuff that is completely preventable.
This is really the first step to securing windows for the everyman, if such a thing is truly possible. Soon enough current machines will be replaced with machines with processors which understand NX, thus making the feared buffer overflow much less fearsome.
Even though SP2 is going to cause all sorts of headaches with clients, friends, and family, I'm very optimistic about what it can do to help stop spyware and to a lesser extent worms and viruses. Its a real shame there isn't an equivalant SP for the HUGE win2k user base out there. Seems like the script kiddies will now be focusing on win2k machines from now on.
Re:SP2 - as secure as any linux distro... (Score:3, Interesting)
Essentially, Microsoft has done the best they can in their po
Re:SP2 - as secure as any linux distro... (Score:4, Informative)
You run *any* OS as root or equivalent on a daily basis, and you're going to have problems sooner or later.
Okay, so if you're running IE that's more likely to be "sooner" than "later" but the point still stands - the main problem is running systems with more privileges than they need.
Re:SP2 - as secure as any linux distro... (Score:5, Interesting)
First, let me assume you didn't mean what you said. What you *did* say doesn't make sense, as the only way for a system to run with less privileges would be for it to not even have a System Administrator account while leaving some other system with that authority. That sort of top-down authority over PCs seems quite out there for all sorts of reasons.
So, lets assume you mean "the main problem is users running with more privileges than they need". The problem at core then is *why* they run at higher privilege than necessary. Part of the reason is that Run As and the like are not inconvenient and just not well known. In the process of making the system more "user friendly" Run As and ilk aren't at all discussed. In fact, users added at install are given power user (which can do all sorts of nasty things to applications) or administrator power.
For the complete naive (or to overcome various limitations to Windows sessions, like not being able to do persistent apps in the background (dialup users on at least Win 2k (and possibly Win XP, though having not used it in that capacity I couldn't say), you know what I'm talking about)), this means having one account open either all the time or possible on auto-login. For the less naive (or users who can figure ways to overcome the limitations of Windows), you'll create multiple users, but then all users can still screw up the entire machine with *anything* they run. Yes, physical access does mean you can 0wn a box, but like you pointed out with so many buggy programs it also means very much that non-physical access can 0wn the box too.
My point in all this is, even users who *try* to do some security are still fucked over thanks to MS opting for ease of use and "usability" over reducing privileges, finding a better way to have someone admin the box (and watch users flee when they realize they have to do work; oh, but it's better to go under the MS banner of low/no maintainance, turn a blind eye to the reality that most PC software needs maintained, then moan to all your techie friends that your computer is so slow, keeps crashing, etc), and teaching the user how to run the few necessary programs in "less-secure" mode (anything automatic short of extensive hashing will end up being spoofed and exploited all over, so it's better to rely on the user) while making sure Windows itself is actually designed to handle multiple people using a machine.
But, all those stack protectors should slow down those hackers, hopefully (well, assuming they're done at runtime in a staggard approach to avoid a whole cluster of near-identical hardware all producing the same value; the last thing you want is something predictable), which is at least some small consolation for those who actually update their machine...
Re:SP2 - as secure as any linux distro... (Score:5, Insightful)
I'll grant that some of the Windows defaults are appauling, security-wise, and creating users as Administrators is part of that. Microsoft are making an effort to advertise features like Run As, though - there's a topic in XP help explaining why running as an Administrator is a bad idea, for instance.
(That said, I've no idea how many people actually read it, of course).
The point I'm trying to make is that any system with uneducated administrators is going to have security problems, sooner or later. Most Unix users tend to do their research and understand why running as root is a problem, as do the application developers. If your applications will run fine as a normal user, then people will run as a normal user.
That doesn't apply as strongly in the Windows world - people are much less likely to do any security research, and application developers do have a tendency to make it harder for people to run as a user. That's beginning to change, though - the current guidelines for the "Designed for Windows" logo on software include a requirement that software runs correctly as a non-administrator.
Hopefully, the next release (be it a SP3 or Longhorn, should it ever be released) will concentrate on the user education side of things, and make it easier to do the right thing with regards to least privilege.
Re:SP2 - as secure as any linux distro... (Score:4, Interesting)
Heck, for all those cases when a program doesn't need to really be run as admin, Windows could sandbox the program in a pseudo-root and continue to let the program run in such a limited state (which developers might end up trying to work around instead of fixing the inherent problem, but that's a whole other point). There's also the possibility of making up "roles" for users and programs either by default (to further limit, not expand privilege) or easily accessible.
The fact is, Microsoft hadn't until XP SP2 made any measurable attempt to mitigate the security risk to users. And even now, XP SP2 still is more reliant on filtering out possibly bad content and auto updating than educating the user and giving them options to help to secure their setup (auto update and filtering can be good things, don't get me wrong, but they're not end-all solutions and are only stop gaps to a bigger problem). Something like email viruses probably won't stop until a heavy dose of educating the user enough to not run viruses and some degree of lobotomize the system enough to never run a virus.
So, a lot of the problem is still MS's (it's their email client for the most part and their OS which has to be lobotomized to support not running viruses). I'd also say they're pretty well required to teach the user security, given this is a new computer and security is really a key concept an internet connected user needs to understand. But, as part of MS's quest for a stable system for the home user, MS really slacked off over the issue of telling the user they'd have to be admin and they really do need to learn a lot of things if they want their system to continue running smoothly; and it can't be that MS was unaware that security was at all an issue because there actually *are* user accounts and lower privileges in NT/2K/XP; MS just decided to ignore the issue in favor of making it easier on the user who was adding programs. Making it more complex by forcing users to learn security in the short term was less marketable than progressively dealing with security flaws later as well as just crappy design decisions such as leaving various services on and exposed to what would almost certainly be the internet.
Whew..that was a lot to write. And with all my bitching about Windows, I can't say I've personally used any other OS which does a good job of educating the user on what *not* to do while providing them ways to mitigate the possible damage on questionable programs that demand more privilege than they probably deserve (I haven't used OS X, so I can't speak for it; I used be a Windows user but now am a Linux user (except when I admin my mom's machine)). The issue of how to make administrating understandable and easy enough that all home users (or a few, given how much of a pain it is to have to get off every N minutes so someone else can properly install an app or whatever) are both willing and able to do the task is no small order. The fact that MS has for years pushed MS as "great" at administrating when it's only at best marginally better (it's a lot easier to do the granular ACL than doing various crazy groupings) really shows what's true of most companies: they're run more by marketers than engineers. The amount of work necessary to make administrating something anyone is *willing* to do is pretty mind boggling (just look up various research, or contemplate the issue of hundreds of programs, a few users, and how to make sure each program can't do harm to anything even if it *wants* to without pissing off said few users). Windows really isn't the right tool for the job; sadly no tool I know of is yet nor do I think ever will be ready. So, shall Microsoft rent out really cheap admins to everyone to improve security?
Re:SP2 - as secure as any linux distro... (Score:5, Interesting)
It drops an executable into the Startup folder for the *user*. In other words, no root privledge is ever exercised, and the app would likely do nothing on a correctly-configured box (the worst malware can do running as non-root is wipe a user's directory -- same as in Linux or any other OS with similar permissions). Learn about security before you comment on it, please.
Re:SP2 - as secure as any linux distro... (Score:3, Insightful)
oh and *ONLY* wipe a user's directory? what fucking planet do you live on?
Re:SP2 - as secure as any linux distro... (Score:4, Insightful)
Uh, it doesn't install a program. It drops a file in a directory. Granted, this directory is sort of important (Startup) but it's only for the user, not the system. Even if it tries to access important files, like I mentioned, it'll be denied on a correctly-configured box.
Also, the act of scrolling doesn't run the program, but restarting does. Small point, but kind of shows you know nothing about it.
"oh and *ONLY* wipe a user's directory? what fucking planet do you live on?"
The same planet where UNIX has had the exactly same scheme for 20+ years, Windows for 10 or so and Mac OS X for 5. As far as I know, short of a dumb terminal, there's no system in the world that can prevent users from doing dumb things to their files. It's the ones that screw up the system that need to be prevented.
Can someone answer this question? (Score:3, Insightful)
Re:Can someone answer this question? (Score:5, Informative)
I'm sorry, were you expecting better? (Score:2, Insightful)
Exhibit A: Windows.
Bill can announce a new security initiative every day from now until Doomsday, and it won't mean a damn thing unless they scrap Windows completely and start over. Period.
Re:I'm sorry, were you expecting better? (Score:5, Insightful)
Quite frankly, if MS never "innovated", it would be a fairly secure product. NT 3 was practically bulletproof. It's when they started grafting on Win32 junk from 9x, things started to get screwed up. Take off that top layer and everything would be kosher (but a lot less user-friendly)... just like Linux.
Re:I'm sorry, were you expecting better? (Score:5, Interesting)
Re:I'm sorry, were you expecting better? (Score:4, Insightful)
Great point. I would suggest a few other things to consider.
One of the things I find interesting about Unix is its modular nature. For the most part, various components are fairly well insulated from each other. One is able to rip out or drop in pieces as one wants. This allows for major changes of the system's operation. This can be applied to anything from hardening the system to implementing new functionality. Security may have been an afterthought for Unix. But it's foundation allowed for it.
Keep in mind that "security" hadn't always been a buzzword for Unix. A very visible example is the Morris Worm. But exposure to the public via the Wild Internet caused the Unix community to start picking up all its dirty laundry. It learned lessons. And those lessons are often the basic tenants of Infosec.
One of my criticisms of Microsoft is that they ignore history. The Unix crowd has already run its gauntlet early on and made its findings and lessons learned widely available. Yet Microsoft continually repeats not only Unix's mistakes, but also their own.
Sure - a mature code base implies a greater degree of bug fixing, etc. But that solves implementation mistakes. It doesn't help fundamental design flaws. Those can be very difficult to deal with. Especially if your system isn't very modular.
One final point - how mature IS the relative codebases? How much of the original *nix code still exists vs. being entirely new? And how much of WinXP is pedigree WinNT from a previous decade?
Re:I'm sorry, were you expecting better? (Score:4, Informative)
Re:I'm sorry, were you expecting better? (Score:5, Informative)
Re:I'm sorry, were you expecting better? (Score:3, Informative)
First of all, the update was NOT anywhere near 400mb.
Secondly, it contains every update, every fix, etc since XP was released.
Thirdly, it contains these fixes for every version of XP--home, corporate, pro.
thanks for playing!
Re:I'm sorry, were you expecting better? (Score:5, Insightful)
If Microsoft would focus on *real* security like that found in FireFox, OS X, etc., they wouldn't have to put these stupid "security" enhancements in. On the bright side, Microsoft is making Macs veeerrrry attractive to end users.
Comment removed (Score:5, Informative)
Re:I'm sorry, were you expecting better? (Score:3, Insightful)
Re:I'm sorry, were you expecting better? (Score:3, Insightful)
Re:I'm sorry, were you expecting better? (Score:4, Informative)
I just looked, and in Internet Options/Security settings, there's an "Allow META REFRESH" checkbox, which for me is enabled. I don't know if I've set it in the past, but I didn't do it recently. I am running a "custom" security level, not a prepackaged one.
But the grandparent's assertion that there's no way to change it appears to be wrong. I've tried both 302 and meta refresh redirects and both work for me on XP/SP2
Re:I'm sorry, were you expecting better? (Score:4, Insightful)
First off... im not bashing linux, and im not saying Linux needs a 400 meg patch, because frankly it doesn't. Nor, am I saying that Linux is a worse or better operating system. Actually, now that I think about it more, although my wording was poor, what I meant to say is I dont think the Linux Community, could have pulled off a patch like this with as minimal impact as what Microsoft has done.
Not an attack... just an observation... here is my reasoning...
Microsoft has control over all aspects of the OS, one of the positives I suppose of closed source. They know for example that a change here in the kernal, will break feature x in the web browser. Additionally, one company controls basically all of the API's that 3rd party companies would have to use to write software.
Now, contrast that to the linux world, whereas you have on entity basically in control of the kernal development and direction. Then you have another group that controls Apache, another for GCC, another for X, another for KDE, etc, etc... You make massive changes in the kernal, and you are going to have a trickle out effect, that all other teams are going to have to deal with. Thing is, there is nobody there with a big stick that would force people to comply. Additionally, Linux is all about choice and freedom. But with that, perhaps my biggest beef with linux, and IMHO the thing holding linux back the most is the labrinth of dependancies between various libraries and subsystems. In a situation like this, where you need to make sweeping changes across the board, the team based, decentralized aspect... not to mention the multiple distributions, would make it all but impossible to do a rollout like this, with less impact then what MS has experienced.
Once again, to keep the fanboy zealots ( not you Hundalz ) quite... im not saying Linux sucks, or that open source sucks, or any of these things. And yes, im well aware that Linux does not need a patch like this, unlike windows... so please stop beating that poor dead horse.
What im saying is, that in this case, MS did good. For once they actually deserve some kudos. Also, this is one of those rarer examples, where a closed source single controller development system, is actually superior to open source. ( In regards to the ability to make sweeping changes with minimal impact, fairly quickly. ).
Leave it to microsoft (Score:5, Interesting)
Re:Leave it to microsoft (Score:4, Insightful)
The point of the security center is so you dont get that malicious code running on your system in the first place. If it does, your systrem is already compromised, and nothing can be trusted anyway.
No OS can protect against malicious code running as root/admin.
Re:Leave it to microsoft (Score:3, Informative)
If the OS has the concept of a superuser, then you're correct. However, that's ignoring other OSes [sun.com] that are built on capabilities or mandatory access controls. Those do away with "root users" altogether, and replace them with users with sufficient access to grant necessary rights to other users. These aren't hypothetical creations, but real systems in use, today, in high-security installations.
Internet Meltdown Predicted for Today (Score:5, Funny)
Re:Internet Meltdown Predicted for Today (Score:3, Interesting)
You know what I got from the article was:
It will now be easy for people/code to exploit a new vulnerability in Windows allowing (insert favorite action taken after an exploit is found HERE).
Umm, I saw this coming, I mean it's 10am where I am right now and I haven't heard about today's exploit yet.
In all seriousness Joe Computer needs to stop trusting Microsoft to do everything in his computer. Their idea of shouting "HEY STUPID get an anti-virus program" isn't a bad idea. The implementation wa
That's ok (Score:5, Funny)
That's ok. MS probably wants it to be easy to use so that everyone can use it.
Pseudo Problem. (Score:5, Insightful)
This is like complaining that one can shut down your computer by removing the power plug.
Actually, no... (Score:3, Interesting)
I don't consider that to be a non-problem
Re:Actually, no... (Score:5, Informative)
Yes it does [google.com]
Scary stuff. (Score:5, Interesting)
Step 2: Drag the scrollbar down a bit and let go
Step 3: Start -> Programs -> Startup
That's just spooky.
Re:Scary stuff. (Score:5, Informative)
Step 0: Open IE
Couldn't even drag the scrollbar in Firefox :-/
Then I opened IE and tried it - jackpot. Nice little booom.exe in my startup folder. I have SP2 installed. Good grief.
Re:Scary stuff. (Score:5, Funny)
I guess I'll have to switch back to IE.
Incorrectly report, but change? (Score:4, Interesting)
What I've yet to see is any indication that its possible to actually do the turning off of things, which would be rather more serious.
As it is, surely the only problem is if you forget that you turned something off? I've no big plans to make my box insecure now I've done configuring it on installation.
Close it anyway MSFT or stop the default Admins! (Score:5, Insightful)
Sadly just about everyone runs shit as Administrator (it is the default mode for XP Home installs) to make life easier and as MSFT has noted they are opening themselves up to the attacks... For those that will mention that Linux is so much better remember that these are the same people that wouldn't like to have to change to root (sudo, su, login, whatever) to install anything and would be opening themselves up to the same vulnerability level as if they had been running Windows.
Basically the problem was in design... They should not have had an open API controlling the "WSC" and thus malware would not be able to detect the presence of the programs' status from a single location. The real problem is that MSFT isn't admitting that it is a serious problem and needs to be changed on a different level... Saying that malware writers are going to use the direct route and disable the firewall/AV outright, while true, doesn't get them off the hook for creating this hole that is more difficult even for a more advanced user to notice.
Re:Close it anyway MSFT or stop the default Admins (Score:3, Informative)
Administrator is the default context for XP Pro, too, if you create users at install time. I run as administrator, but I use Firefox to browse everything but windows update, and I have Norton installed and auto-updating itself every day. Hence I am operating in an insecure fashion, but with little risk.
(Watch me get owned tomorrow or something, but nonetheless, I stand by my statements.)
On Linux I do typically do everything as me, and sudo when I can, but some programs don't work right when you sudo,
Wouldn't matter (Score:3, Informative)
As a receant example later variants of one of the receant worms was zipping itself and encrypting the zip to try and evade virus scann
Re:Close it anyway MSFT or stop the default Admins (Score:3, Interesting)
I got my sister (15, and understands precisely nothing technical about computers), after much yelling, screaming, and misunderstanding (this one mostly on my part), to use an unprivledged user for normal work and to make changes and install as Administrator.
That said, not only are default accounts admins, but you cannot only have unprivledged accounts; you must have a named admin in addition to Administrator. Very dumb.
Re:Close it anyway MSFT or stop the default Admins (Score:5, Interesting)
Linux, I feel, has a better system at the moment. However, as this is the developers fault, I see no reason why linux would be immune from this problem.
Dumb, slightly OT question/proposition (Score:3, Insightful)
This is just one of those off-the-top-of-the-head-and-not-thought-out type ideas, but i'm curious.
UA String any different? (Score:4, Interesting)
Re:UA String any different? (Score:3, Interesting)
VB CODE IN YOUR FACE
Wscript.echo "Service Pack: " & objOperatingSystem.ServicePackMajorVersion _ & "." & objOperatingSystem.ServicePackMinorVersion
I almost used the BLINK tags for that one
Oh my god! (Score:3, Insightful)
Seriously, this is just more scaremongering. The WMI system has to be accessed locally, and their examples of how this could be circumvented is pretty silly. ActiveX apps on a web page won't run unless you specifically tell them to. The only other ways are via a downloaded application. It boils down to "you have to do something on your computer that lets a malicious application run". How is that any different from any other operating system in the world? Even as a non-root linux user you can fuck up a system by running a malicious script... I don't get it.
Am I missing something?
Re:Oh my god! (Score:3, Insightful)
Even as a non-root linux user you can fuck up a system by running a malicious script...
I'm intrigued. While I've only given it a few minutes' thought, I haven't managed to come up with a way that an unprivileged Linux user can hose an entire system (well, outside of their own data) with a malicious script. Could you let me know what I'm missing here? Thanks.
Re: (Score:3, Informative)
No real surprise (Score:4, Insightful)
Personally, I'm just glad that it doesn't bomb randomly after install. Yet.
ho hum (Score:2)
Not working for me (Score:2)
Today I got the notification on my notebook and decided to try the same thing on that one as well. Same thing--the update box goes away but nothing appears to download.
It's not that big of a deal, but I do want to get it installed on at least one of my machines to see if it would break anything.
Need root? (Score:5, Insightful)
While we are not aware of any malware exploiting this, we think it will only be a matter of time. The one mitigating factor that we found is that to change the WMI, and spoof the Security Center, the script has to be running in Administrator mode. If executed in Windows XP's Limited Mode, it will give an error, and not allow changes. Unfortunately, most home users who will be at risk, run in the default administrator mode.
How can we convince people not to run admin mode? It's easy at work, in UNIX land (most people don't get to know root pw.) But most Windows users I know don't even know the difference.
Every windows security problem I know of can be solved, or at least significanly mitigated, by users not running root.
Re:Need root? (Score:3, Insightful)
Two steps are required:
1) Make apps that work without admin mode. Most stuff on the shelf today still doesn't. I have yet to see a game that does.
2) Make apps that need admin access prompt you for it. - *nix has done this for a long long time.
But neither of these things will happen until the mentality changes. The mentality won't change until the apps are there. I've tried to get user's to do it when possible, but then they go download some spywar
Re:Need root? (Score:3, Interesting)
Simple. Force them not to. When my family got a new PC, I immediately dumped XP Home and put on XP Pro. I set up myself with the Admin account and gave everyone else Limited User accounts.
If they want to install software, tough. They have to go though me first. Just like at work.
Re:Need root? (Score:5, Informative)
Most programs on Linux run happily as a non-root user. So many programs on Windows force you to run as an admin user that most people who even think about trying to run as a non-root user quickly give up...
Add To This... (Score:3, Informative)
So Windows offers you as an IT manager two options:
- Remove admin rights from users but anytime an application requires a minor elevation in rights you will get pestered.
- Give
Re:Need root? (Score:3, Informative)
Re:Need root? (Score:3, Informative)
No, you've hit the nail on the head. "Administrator" under Windows XP is not like "root" under UNIX. The former is something that came along fairly recently and put down a few arbitrary restrictions on applications. Problem is, most Windows software was written prior to XP, and at one time the restricted items--like writing to your own application folder--were the accepted ways of doing things. There are
and you were expecting what??? (Score:3, Insightful)
Windows XP SP2's 'Windows Security Center' is just about as insecure as it could possibly be.
and you were expecting what???
Remember Windows Management Instrumentation requires administrator credentials. If you have admin priveledges on any box, you can do much harm, regardless of the Operating System
I installed it last night (Score:5, Informative)
It's 94.50 mb which takes a while to download. Upon installation and restart the new windows security center pops up and trys to get you to turn on your firewall, automatic updates and antivirus software. By default if any of these are off, there's an obnoxious red shield in the system tray. Turning off alerts for these makes it go away.
Otherwise there doesn't seem to be any major changes.
So far nothing's borked.
Send in the Rovers (Score:5, Funny)
Maybe MS could get NASA to send a few rovers in there to see what they can find out.
I don't think anything can be done. (Score:5, Interesting)
I've always criticised Linux users for being sloppy and the like, but the operating system itself is at least rock solid. It rarely crashes, it has a decent windowing system, and I don't see advisories for it on Bugtraq every 8 hours. Windows is easy to install, but it's all too easy for someone else to compromise. Ease of use is nice, but I think I'll take peace of mind with GNOME on Fedora Core.
Running as admin? (Score:5, Insightful)
The next thing to be said is usually: "But most home users run as admins." (The article also mentions this.) Well, that's not a Windows problem; that's a user problem. Even if Windows forced users to run in "limited mode" (which would cause an outcry in itself - "eek, Microsoft is trying to take away control over our own computers from us"), it also doesn't help that most third-party software for Windows requires admin rights either to install or *gasp* to run. Of course, this is ancient news to everyone with a clue
Of course, even when running as admin, protecting yourself against malicious code is fairly trivial; simply use a firewall (SP2 incidentally includes one), don't run binaries from untrusted sources, surf the web and check your email using something other than IE/Outlook [mozilla.org], use a virus scanner/shield, and keep your apps and OS updated. Again, no news to anyone with a clue.
Re:Running as admin? (Score:5, Insightful)
You are oversimplifying. Ask yourself why most home users run as admins. May it be because that's the default? Because XP doesn't even offer another setup option, but hides it well? Or maybe because tons of things simply don't work if you run as a normal user?
Driving reckless is a user fault, yes. But driving reckless when that's how the manual told you to do it and that's what the car was designed for makes it a bit more tricky to properly place the blame.
Re:Running as admin? (Score:3, Insightful)
STILL Broken (Score:4, Informative)
Great work Microsoft! After all the beta-testing, SP2 is still broken. Here's what I've found so far that's messed up badly:
What I find funny is that ZoneAlarm's AntiVirus monitor feature detects AVG and Norton properly.:P
Re:STILL Broken (Score:4, Informative)
# Unreal2 won't run
Both working fine here..
# Norton Antivirus status is not detected by Security Center
Norton's problem, they've said repeatedly they're working on a patch.
# AVG Antivirus is not detected by Security Center
This should be working. It's works for a lot of other people correctly.
Windows crashes on startup if any non-MS OS is doing a SMB network scan while it is starting up
Huh? Did you pull this one out of the air? We haven't had a problem with this on our network here (300+ PCs, 10+ Macs)
Security Center considers having Automatic Updates set to "Ask Before Installing" a security risk
And I agree that it should. Users are totally retarded, and should be treated like a child.
I'm gonna have to call BS (Score:3, Insightful)
As for AVG, well, you screwed something up. It detects fine on every system I've put it on. As for Norton, it is a documented Norton problem, and they (Norton) are working on it.
Windows? (Score:3, Funny)
Not running as admin is all that matters? Not so. (Score:4, Interesting)
Sure, running as ADMIN is almost stupid and multiplies your chances of being 0wned by large. But its not the only source of being 0wned as people said above. As long as I remember, IIS (along with Sendmail, Bind, IE and some others) where considered the worst software in terms of security in the SANS Institute list. Break-ins are common in these softwares and would grant you good priviledges for doing some nasty things.
Just to be fair the same can happen in Linux/Unix but it's a bit less easy to do it. And you can always run an UserMode Linux, for example, and host the application inside it which would turn the host system almost invunerable and this is quite difficult to do in Windows (I can only think of VMWARE). Normally people are a little better educated to not use root in daily use and every installation program of recent distros explicit says it.
Re:Not running as admin is all that matters? Not s (Score:3, Informative)
M$ should make the Admin account anoying to use (Score:5, Insightful)
Calling Dr. Freud (Score:3, Funny)
I'd bet it's when I'm taping out the BPM for the music loaded on the drive. It has to be like the Chinese water torture. Poor little computer.
Please, let us make amends. I'm offering a sincere apology and promise to do what I can in the future to keep you from feeling battered and furthering your feelings of insecurity.
Good thing I've got all your patches up to date, or you might find strangers abusing you from far away locations. I'd never let you have such unsecured access. It' would only lead to more insecurity.
Bad Logic From Microsoft (Score:5, Interesting)
They bypass this obvious lack of security as a feature, and that the application is rather to serve as an extra barrier of obscurity to hackers, and not as a solution to the problem (which it will ultimately be marketed as.)
This unfortunately isn't an adequate mentality. Microsoft appear to make the mistake to think that hackers are as technically challenged as their regular home user base.
Yes! certainly a home user wouldn't be able to craft some accidental software that rips a hole through the new security centre features. However, hackers which discover holes in Windows (Without ever seeing the source code.) have the competency to add the extra layers of dodging to their worms. This it at Microsoft's peril, as now worms can fool a system into reporting that everything is fine, in turn fooling the technically challenged home user into also thinking, that their new DDoS server is also functioning without a hitch.
Microsoft needs to understand that hackers are significantly "gifted" in comparison to their regular user base (many of which who'd think Mac OS X is another version of Windows.) They must craft their security devices such that they can not be trivially undermined, and put an end to the assumption that more easily bypassed road blocks lead to greater security.
XP SP2 is awesome - leads to blue screen (Score:3, Informative)
http://www.crn.com/sections/breakingnews/breaking
I had to boot into recovery mode and run a batch script to uninstall SP2, just like the article outlines. Then I had to go into the registry and change some keys, then do an uninstall via the add/remove programs wizard. Man, thanks Microsoft for a full night.
I'm not sure if I'm going to try again, we'll see how I feel after stewing about it all day...
Thank god it's just IT (Score:3, Funny)
They would invade a country run by a dictator, continue the dictator's tortures even in the same places, inflame the world and make the world an insanely dangerous place to live.
Oh, wait...
Cowards at PC Mag (Score:5, Insightful)
People, get a clue: a "malicious site" can't do anything to your computer, unless your box has already been compromised.
PC Mag, here's an idea: tell the users what the real problem is. You damn well know what it is. But you're afraid, because they spend a shitload of money on ads.
Animated dog... (Score:5, Funny)
Re:Leopard? (Score:5, Funny)
Cue Marlin Perkins (of the old Mutual of Omaha Wild Kingdom [museum.tv] shows):
MP: "Today, we are going to find and capture the elusive XP2 Leopard. My associate, Jim, is armed with a toe-nail clipper and a badminton raquet. Jim, why don't you start marching down that trail over there? I'll be back at the truck with the cameraman and a bottle of scotch."
Re:this is surprising? (Score:5, Insightful)
Re:this is surprising? (Score:3, Informative)
Re:this is surprising? (Score:5, Insightful)
I guess that depends on what you mean by "have to". An out of the box Fedora Core 2 system will work and play just nicely with your email, office, internet, graphics, video, etc. An OOB Windows XP install will only last 20 minutes once connected to the internet.
Out of the box Fedora may work with everything, but at some point in time, security vulnerabilities will be found in some piece of open source software, and a patch will (quickly) be made available. An unpathed *nix machine can be just as dangerous as a Windoze box.
Re:this is surprising? (Score:5, Informative)
Windows XP came out in 2001. Do you really need me to tell you that running a RedHat distribution from 2001 would be suicide right now?
Re:this is surprising? (Score:3, Informative)
Assuming you never patch the system, I agree. However, assuming that you're the slightest bit proactive about maintaining the box, I strongly disagree.
I use RH7.3 as a baseline for my systems (because RHEL costs too damn much, and because I'm not particularly fond of 8, 9, or FC) and while it's not quite that old (early 2002 as opposed to 2001) it's stable and secure. O
Re:this is surprising? (Score:5, Informative)
Of course, you can "update" them also with mod chips, but I don't think that that is what you had in mind :)
Re:this is surprising? (Score:3)
Re:You would think.. (Score:5, Insightful)
What Microsoft is doing is analogous to me trying to turn my apartment into a bank:
Initially I just put up a sign that says "Bank" and leave the money lying on my sofa. Then when I get tired of people walking in and taking the money I lock my door. Then they kick in my door, so I get a thicker door. So now they climb in through a window, so I close and lock the windows. They break a window, I put up shutters. They cut through the floor, I lay down cement; ceiling, I add an alarm; they cut the electricity, I buy a generator. Maybe at some point I buy a safe, which works until they pick the safe up and roll it out of a hole cut into my wooden walls. This goes on for years, until eventually I get fed up and move out, and have a building built to purpose that's secure as a bank should be.
Where this analogy breaks down is at some point pretty early on customers would stop giving me their money until I got my act together, where they've shown no intention of doing the same to Microsoft.
Re:Still better than Unix. (Score:4, Informative)
I don't know what Unix you're using (perhaps Version 7 on the Interdata 7/32 or some other forgotten vintage system), but modern Unix-like operating systems, such as *BSD, Linux and Solaris, by default create user's home directories with permissions user: read/write, group: no permissions at all, world: no permissions at all, and no special ACLs. Filesystems for these operating systems support ACLs (much like NTFS ACLs. Personally, I've found the user/group/world permissions have covered every case I've encountered, but that may not be true for everyone hence POSIX ACLs were created).
Certainly in the Linux world, major distributions turn the firewall on by default (RedHat since at least 7.x, and continuing into Fedora Core) during the install process. It's been a proper stateful inspection filter since before XP was even out. Also in a Redhat or Fedora install, you are asked to create a non-root user. The Windows XP install also asks you about what users you want to create, but by default creates them all with root privileges.
Re:Still better than Unix. (Score:3, Funny)
Re:This sounds like a typical... (Score:5, Insightful)
Re:Please help a Linux Newbie (Score:5, Funny)
What do you mean *They*?
It's the same guy Anonymous Coward every time!