Vista Designed to Make Malware Easy 311
SlinkySausage writes "Trojan horses masquerading as 'cracks for Vista' are starting to appear on pirate boards. More worrying though, Microsoft has confirmed that Vista's image-based install process is designed to allow third-party software to be slipstreamed into the installation DVD. Great for corporate deployment of Vista with software pre-installed, but also a huge benefit for malware writers, who can distribute Vista images with deeply-rooted malware."
So? (Score:5, Insightful)
Re: (Score:3, Insightful)
Re:So? (Score:4, Insightful)
Re: (Score:3, Interesting)
Re:It *IS* their problem (Score:5, Insightful)
In reality, Grandma will find it just as easy as Microsoft OS. Email will work, that virus she tries to click on will not run and every website she goes to cant install spyware. Grandma is not going to rush out and buy UT2007 to get some deathmatch smackdown with her homies. She will simply use the computer as it is. Photos are easy to view and open from relatives and friends. This magical Open Office reads all the documents she get's sent even from wierd uncle al that uses that Wordperfect software.
Reality, Grandma get's ubuntu, and a little bit of training as to where the apps she needs are and looks like and Grandma will need no extra help from now on.. Just like giving her a MAC.
That is the reality of what will happen, but I like you really love telling the stories there in the MSFT employee handbook. Hey, check out the section on debunking Programming in anything but Visual Studio! It's a HOOT!
Re:It *IS* their problem (Score:5, Insightful)
Yes, she will probably find it just as easy as a Microsoft OS - but it will be different. It will be different to her, and different to anyone else she might ask for help, and that's the problem.
In the past I have been quite eager to suggest to people to install Knoppix (and later Ubuntu) when I got called in because their hard drives failed or when Windows ME/XP got so clogged with malware that they couldn't do simple tasks such as open the filer. However, it became a nightmare to support them - by the time I was at university I'd be getting called several times a week with one problem or another. But I couldn't send them to someone else - there wasn't anybody else who had linux experience.
You say that she would need no extra help from now on. Have you ever actually met an old person? They're not like us. They're slow. They're senile. They're virtually dead. It's a miracle they can remember how to turn the machine on in the first place. Even if you write them out detailed bullet-point instructions with screenshots (which I've tried) they still manage to get it wrong. This happens with Windows, it happens with Linux. Sure, I've come across a few who have taken to computers and haven't needed any help past the first few days, but in my experience the majority will always need someone to hold their hand. Hell, that bit's not just limited to OAPs, most people I meet over 50 seem to have that same problem.
In your rush to flame me as an MS fanboy, you seem to have completely missed the key point in my original post - sure, little Johnny might be able to train her up in how to use it, but she will always have problems and questions. She will always want to learn how to do something new with her expensive toy, she will always want to fiddle with things, and she will always get confused. She will always need help. And by installing an OS that most people don't have experience of, he'd just be tying himself into supporting her until she dies.
I love Linux, I run my business on top of it, I tell my friends to use it. Software compatability is a minor issue, re-training is a minor issue. But when it comes to installing it for someone else, the deal-breaker is that there is no wide-spread support readily available for them yet, so I'm stuck helping them until they die, or until I reinstall Windows and can palm them off onto someone else.
Re: (Score:3)
There are innumerable counter examples that people could come up with that support exactly the opposite conclusion you have drawn.
The point is, not all old people go out and buy autoroute or use encarta. Some of them only use a web browser and word processor, an
Re:So? (Score:5, Insightful)
What about everyone else on the Internet who gets DDoSed or spammed by this malware? Last time I checked, I was on the Internet - for me, therefore, this is a problem.
Re:So? (Score:4, Insightful)
To recall the tired (tyred?) car analogy, it is a problem if people start driving cars that are dangerous to other drivers, due to unreliable breaks or parts falling off when driving at high speed.
ISPs need to be more proactive at disconnecting people who can't keep their computer clean.
Re:So? (Score:5, Insightful)
TFA is a troll.
Re:So? (Score:5, Funny)
<huge><blink>8uy \/ia9rA 0nL1n3 11!!</blink></huge>
Re: (Score:3, Interesting)
I agree. The risk is there with Vista, Photoshop, anything.
Nemetroid's view seemed to be that the pirates deserve everything they get - and you won't get much argument from me on that point - but that view doesn't take into account the consequences for the rest of us. It's unlikely that today's "malware" is going to screw around with only the machine it's installed on. Perhaps my original comment wa
Re:So? (Score:5, Interesting)
I agree in principal - but disagree in practice, - I have had a number of calls and even been disconnected by various ISP's due to behaviour that they assumed was viral - simply because their methods of detection were too simplistic - perfect for most people but a pain for many others - the solution in my case was to go for an ISP that was rather more expensive than the norm...
Oh and the reasons for the calls and disconnections -
Your computer has a virus because it is sending and receiving email directly - via ports 25 + 993, - apparently (according to their documentation) I either had a virus or my mail client was incorrectly configured - I should change the SMTP server to smtp.foo.com and my "pop3" server (never mind that 993 is clearly related to IMAP) to pop.foo.smtp. - My return calls to the ISP required escalation to their 3rd level before they understood that I didn't want to use their mail servers.... (I was even told that their servers were incompatible with my servers, and that there was no such thing as an IMAP server...."its POP3 for Post Office Server...")). So real reason for the disconnect was me using a mail client with my own servers - this was before I used a local mail server - more on that later....
Same ISP; I used port 23456 for testing an app I was writing (still am writing - its intended to manage a number of Debian machines apt configs and updates etc creating groups of them etc...) - I was told that I had been detected as a Hacker by technical support. I changed ports - and then left that ISP about am month later.
New ISP was taken over by another ISP after about 8 months of my contract with them. At about this time I had started to use my own mail server and about 2 weeks after that all mail associated ports (for some reason except 587) would return errors - ( Here is a copy of the message received whenever you try to connect to port 25 manually - the same for others...)
server-001:/home/*********# telnet smtp.foo.com 25
Trying 216.234.246.150...
Connected to smtp.foo.com.
Escape character is '^]'.
554 Please check your SMTP server is set to smtp.********.com. Further help is available at http://help.*******.com/sessionBegin.do?solutionI
Connection closed by foreign host.
(*'s to protect the innocent - which they are sort of..)
Again major discussions with tech support - first off with them claiming that no ports were blocked or redirected (I recorded that call and played it back to every level of support I got passed to...) Anyway I was finally told that yes they only allowed mail through their servers (but why was I not using either their mail servers or a web mail service? - they even offered to help me set up a hotmail address....). This was apparently due to the sending of spam and due to issues with virus infections so I guess its a fair point. So rather than putting up much of a fight (as in contract terms and TOS etc.. I offered to leave if they terminated the contract without penalty (which they did and let me keep the router that I had never used, a set of cordless dect phones (Which was nice) and a 4 month old sony k800i. Not bad - and no grumbles.
I now have a business account with a major provider - and all is well.
I guess what I am saying is that its all well and good detecting things which could be malicious - but you will miss a lot (there is only so much you can do) and you will block a lot of legitimate users - or identify them incorrectly as viral.
Last point it turns out that the ISP that forces you to use their mail servers will relay any mail from within its network regardless of pretty much anything (including the lack of from addresses or the inclusion of hundreds of recipients) so the blocking of mail there is really part of their solution (presumably they monitor what goes through their mail servers too...) which may have an impact on privacy as well as on the flexibility of service.
Anyway. As I said - I agree with you but I am not sure how the ISP's are supposed to do it. Clearly mandatory virus scans are out of the question.
Re:So? (Score:5, Insightful)
They didn't. You are free to install pretty much whatever you want/can in your machines. They do get to decide, however, if your traffic is acceptable to pass thru *their* network. Read your TOS.
Re: (Score:2, Informative)
Most likely the pirates will be the ones who find out that they are infected and will try to fix it; compared to installing it on Mom's laptop and never bothering to fix it.
I think this is being blown out of proportion and a little exaggerated.
Re: (Score:2)
> and will try to fix it; compared to installing it on Mom's laptop and never
> bothering to fix it.
Most wannabe pirates know less than nothing about software and are quite likely to install "it" on Mom's laptop.
Fixing botnetting is potentially easy (Score:5, Insightful)
1) People run insecure machines. 2) People leave computers on. 3) People leve them coennected to the internet.
Break any of these three links in the chain and you'll fix bot netting. (1) is impossible, given V1.00-beta humanity. But surely, (2) and (3) are pretty easy to achieve. For Joe Sixpack, there is no benefit in keeping a PC running 24/7, except that it helps contribute to the power bill and rolling blackouts.
Servers, of course, are a different matter but they are [hopefully] better administrated.
Re:So? (Score:5, Insightful)
This is another FUD piece. Vista makes it more difficult to modify the installation sources. In XP and previous os's the installation sources were just a pile of binaries. Anyone with write access to the source could take out one thing and add another...
With Vista the OS is already built and closed up inside of an image file... to review:
in vista in order to "exploit" this "vulnerability" you need to have write access to the installation sources and the tools and knowledge to rebuild the share (the image format is not "zip", you need a certain understanding of the process to make this go).
in XP you just need access to the shares.
And in what way is this different from any other thing that you'll ever install on your computer?
Re:So? (Score:5, Insightful)
Re: (Score:3, Insightful)
If that were true, Google probably wouldn't feel obligated to display warnings [google.com] when visiting certain unscrupulous websites which provide "cracks." If that were true, Kazaa and eMule wouldn't be littered with virii and malware. You're making a large generalization about a group of people who have only one thing in common: They didn't feel like paying
Re: (Score:2)
a source link about this happening, this would've been
a helpful and up-mod worthy post.
Re:Ignoring the big picture (Score:4, Insightful)
Re: (Score:2, Insightful)
Re: (Score:2)
Re:So? (Score:5, Interesting)
Slipstreaming is essentially remastering Vista (and XP-s) ISOs to include the latest patches/service packs, i.e. in case of XP, this allows you to have a windows install that won't get you rooted in 5 minutes after you go online (with SP2). You can also include drivers or basically anything you have installed. In other words, you can install win XP, firefox, ffmpeg codecs, a viruscanner, openoffice, etc., and then you can make a custom ISO that would install windows XP and all that software in one go! This is good if you maintain a number of PCs in a comp. lab.
This feature makes life of sysadmins a lot easier, and I'm glad MS didn't take this away - I wouldn't be surprised if the control freaks did. To turn this into a "Vista designed to make malware easy headline" is simply trolling, and article should be tagged troll accordingly. Especially since almost all operating systems have this ability (to remaster the ISOs to include updates/security fixes and 3rd party programs. Basically this is what linux distributions are about).
Re: (Score:3, Insightful)
Of course the one thing that can fix this is a signed copy (PGP) of each original ISO. This could certify that it is original as long as the algorithm has few collisions that will be of use to an atta
Re: (Score:3, Insightful)
Exactly - and what's worse regarding this article is that it has always been this way. As to PGP signatures (or sha256/md5 sums) - I believe each win xp iso is unique. At least that would make sense if MS
This is idiotic (Score:5, Insightful)
Re: (Score:2)
Don't forget that those same kiddies will install said "crack" on every computer they can get their hands on (like their Grandma's).
The custom Linux images you mention won't stand a c
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Insightful)
Re: (Score:2)
Good luck getting the md5 checksum of your pirate Vista iso from a trustworthy soul at Microsoft...
(Okay, md5 isn't the epitome of security these days, but it's still probably ridiculously difficult for someone to generate the appropriate gribble that can be put inside an iso with a preinstalled rootkit so as to match the original hash)
Re:This is idiotic (Score:5, Informative)
Now, if you're downloading the software illicitly, you deserve a compromised copy.
Re: (Score:3, Informative)
Re: (Score:3, Insightful)
Sympathy? (Score:5, Insightful)
Now if someone wants to download an third-party image for something they haven't paid for, and gets stung with malware, how on earth is this Microsoft's fault?
Re: (Score:2, Insightful)
mod parent up (Score:2)
Re: (Score:2, Flamebait)
Re: (Score:3, Insightful)
That's because one doesn't tend to notice groupthink when it coincides with one's own beliefs.
There is *plenty* of anti-MS groupthink on this site; comments about IE being "part of the kernel", constant BSOD jokes, security complaints that have no basis in reality (some do, most don't), etc.
Similarly, there is the anti-Linux groupthink (no hardware support, no software support, crap GUIs, etc), the anti-GPL groupthink (it'll neve
Groupthink? (Score:3, Insightful)
You keep using that word.
'Groupthink', as generally understood, isn't just consensus or dogma (which is basically what you are giving examples of). It isn't just social pressure to conform. Also, it isn't a persistent set of memes.
As I heard it at least in my undergrad years, it is
Re:Sympathy? (Score:5, Insightful)
Microsoft has issues, but this isn't one of them. Not to mention the language the submitter used is unabashedly anti-microsoft. Articles like this just go to show that slashdot editors will accept ANYTHING that remotely supports their groupthink. An users like yourself just gobble it up while denying there is any groupthink going on.
Re:Sympathy? (Score:4, Insightful)
Quite frankly, the way to get a story accepted is simple... Pique the interest of about 5 or 6 editors. Wonder why stories all cover similar topics? Because this is a news agregation blog that filters technology stories to what that small group of people finds interesting. This group of people includes open source advocates, free-speech fundies, and anti-MS administrators. It is full of inflamatory stories that get discussions happening. That's not groupthink. That's what happens whenever you have a small group making decisions.
But comments are largely much better. You'll notice Microsoft's defenders have been modded up in this discussion as well. Five years ago, you couldn't say "Hey, the Xbox is a neat system" without going straight down to -1. Now lots of people defend MS's software and practices and get modded up. Sure, there are groups of people who still think Microsoft's company policies are monopolistic, directly conflict with orders made by governments, and are largely overbuilt, poorly made POS's. And they're right. Just try looking at a Word document with pictures on a computer with multiple monitors, and you'll see what I mean.
What I'm saying is just because there is a group of people who have come to the same opinion does not mean that there is groupthink going on. This is especially true if there are other groups who have come to different conculsions, and who are also valuable parts of the community.
Re: (Score:2)
That's funny. One of the most predominant forms of slashdot groupthink I see is the manifestation says things like that. Thanks for reminding me that I'm right.
Bad analogy time... (Score:2, Funny)
Re: (Score:2, Funny)
Apples and Oranges
Your comparing a big corporate bank with a big corporate software firm, obviously stealing software doesn't hurt anyone.
Corporate deployment (Score:5, Insightful)
Silly (Score:4, Insightful)
Pile of FUD (Score:5, Insightful)
So you can customise the install disc yourself and slipstream software into it? Surely that's been possible with every single distro of Linux for the last few years or so now? Could put malware into a custom Ubuntu CD, couldn't you? Not a new thing.
More to the point, unless you download your version of Vista from some obscure warez site, it's very unlikely to have malware slipstreamed into it; UNLESS YOU PUT IT IN YOURSELF.
Just because something has the capability to have malware put into it does not make it bad. This is a stupid fuss being made of nothing. I'd say I expect better from Slashdot, but considering the number of Microsoft/Zune/Vista bashing troll articles that are getting posted these days I'd be lying.
Re: (Score:3, Interesting)
Your exactly right.
This remindes me of the last time someone found out a way to crash firefox and jumped up and down saying ZOMG!! teh hax!!11. And my computer science friends who couldn't recognize a shell if it bashed them in the face will be prancing around saying Use IE, it's the most secure (even though there's a million ways to crash IE remotely). And what really gets me is that the editors at slashdot are dumb enough to post this nonsense.
Re: (Score:2)
Re: (Score:3, Interesting)
Actually, I think it's more a matter of greed. This particular method is known as Yellow_journalism [wikipedia.org] and it's hardly limited to MS bashing or even the tech sector.
Re: (Score:2, Insightful)
Congratulations, you win my Pun of the Day Award!
Re:Pile of FUD (Score:4, Insightful)
Re: (Score:2)
People interested in slipping malware into something would hardly limit themselves to just put it on "some obscure warez site", when they have the possibility to put it on a p2p network. Also, it only takes the first idiot to d'load it from the site and move it to its "share" directory to begin the chain.
Re: (Score:2)
Re: (Score:2)
With that said, I don't really see a problem with this in Vista either. It's a good for
Re: (Score:2)
> good form of punishment to those who chose to pirate software instead of
> paying up or taking the better alternatives. But we all suffer in the end from
> more bot machines. Events like EveryDNS being dos'ed can only get more
> powerful.
And that's the problem.
Re: (Score:2)
Re: (Score:2)
Why would Microsoft make piracy either? (Score:2)
They have added a valuable feature for their paying customers, and former non-paying customers may be more likely to pay.
From Microsoft's perspective, it's a no brainer business decision.
So basically (Score:2)
Of course currently providing trojaned distros or packages in linux is absolutely impossible just ask the ssh people.
nothing new, move along (Score:2, Insightful)
a) there's a trojan that claims to be a free activation utility to Vista
b) you can slipstream malware into pirate Vista images (also possible in XP)
I.e. using pirated software could get you malware, which is news because of...?
Re: (Score:2)
this is slashdot. any non-issues that can be spinned in an anti-MS way is news.
when they do something good, they're wrong. when they do something bad, they're wrong. for the people here, there's no way MS can win.
How did this end up on the main page? (Score:5, Insightful)
What's the point of this article? If I download illegal cracked versions of a commercial Microsoft OS, something bad might happen? And somehow that's Microsoft's fault? If someone did the same thing with a RHEL install ISO, would that be Red Hat's fault?
This smacks of the same FUD that Microsoft tosses around about Linux and other FOSS. Let's stop stooping to their level.
Re: (Score:2, Insightful)
Re:How did this end up on the main page? (Score:5, Informative)
Re: (Score:2)
OK, honest question: Are the RTM versions of Vista (going to be) downloadable from Microsoft? Otherwise this is pretty irrelevant...
Re: (Score:2)
Because it casts Microsoft in a bad light. Not that they need much help, but we must do any little thing to further the cause.
from the it-wasn't-that-hard-in-xp-either dept. (Score:2)
What a time saver! (Score:2, Redundant)
Legitimate feature (Score:2)
If people want Vista they can pay for it. The operating system market will be a whole lot less broken once it gets harder to pirate copies so freely.
Designed to panic (Score:5, Insightful)
Getting malware when downloading a crack is always a possibility, yes.
However, this entire story smells of FUD - this is one of the oldest arguments software vendors use to scare people away from pirated software - "All pirated software has viruses in it! Don't use it, it'll make your computer blow up! Make sure your copy is legit!" It's a valid argument, and they have every right to defend their products from piracy, but I suspect it is often overstated.
Then take this article's headline - "Vista Designed to Make Malware Easy". We've gone from fact (one Vista crack was found - and caught by people downloading it - with malware in it), to speculation during an interview, to an entire Slashdot headline. Good good. The relevant part from the interview:
Finally, if the above headline is correct, then how is it different from "Linux Designed to Make Malware Easy"? Anyone can bundle a rootkit with a Linux distro and put a torrent of it up somewhere. Heck, it's even easier, since Linux is free and open to start with. The bottom line is, if you're not getting your software from a trusted source, then you have no reason to trust it.
I'm gonna go lie down for a bit until the spinning stops.
Re: (Score:2)
Finally, if the above headline is correct, then how is it different from "Linux Designed to Make Malware Easy"? Anyone can bundle a rootkit with a Linux distro and put a torrent of it up somewhere. Heck, it's even easier, since Linux is free and open to start with. The bottom line is, if you're not getting your software from a trusted source, then you have no reason to trust it.
I agree with almost all of your posting, but "easier" doesn't really hit it. There are public (and well-advertised) MD5 checksums of most distro's ISO files, there's almost no way of getting malware in so easily. But then of course, regular users never check their MD5s and they don't apply to customized distro images either... so you definitely got a point. ;)
Microsofts concern? (Score:2)
Bad news for the pirates (Score:2)
If not, why is this even news?
Re: (Score:2, Interesting)
It's not malware, it's adware (Score:2)
How is this new? (Score:2)
A better title for this article would have been: "Downloading and running untrusted software from disreputable sources can get yo
interesting strategy (Score:2)
Isn't OS X using "signed binaries" for their critical apps like the dock and Finder? I assume those would not be so easy to subvert or even modify in
Deceptive Title Practices (Score:2, Insightful)
This is pure FUD (Score:2)
So. All this tells me is that if you install from an image, you can include anything on the image you want. Well, Linux or any other OS is just as vulnerable to this. Bringing it up in the context of Vista is just pure FUD against MS. Why doesn't Slashdot wait until Vista is in enough hands for some real vulnerabilities to emerge? I'm fairly confident that will happen at some point.
Warez don't need slipstream (Score:2)
Title should read: (Score:5, Insightful)
Vista isn't designed to make malware easy, it's a problem inherent in the design. When I read the headline I thought "Microsoft wants it easy to distribute malware?" But when I read further, it's just another misleading headline on slashdot.
Smells like an Apple (Score:2)
Why does this sound familiar? I say Vista be renamed Pussy Cat. Future upgrades can be named Tabby, Manx and Burmese since Apple is already using big cat names. Why is it if Windows is so fundimentally superior does it as the years go by get more like Mac? This is from a primarily Windows user. Just seems like Windows is stuck in the rut of trying to catch up with what it considers an inferior OS. Mac isn't perfect but when it comes to involvation and stability there r
Nobody sees the real problem (Score:5, Funny)
But Windows still allows you to run ANY program you download. And this affects legit users too. Why isn't anybody talking about this.
I think it's about time Microsoft forbids running programs on Windows, or malware will have an edge.
XP and Linux also have it (Score:2, Informative)
Os malware (Score:2)
With Bittorrent the quality of pirated software is bound to increase, all we need are some friendly people to release checksums for the Vista DVD and then a bunch of Serial #'s.
By making the OS unlock with diffrent serial #'s they reduce the difficulty of cracking it exponentially.
Relax, it's nothing to worry about. (Score:5, Funny)
Right?
*Gets out chalk and marks High-water* (Score:3, Funny)
FUD!!! (Score:4, Funny)
Re: (Score:2, Funny)
Also, its pretty stinking easy to check the MD5 sum of a downloaded image, ain't it? Non-story.
Re: (Score:2)
Checking the MD5sum against what exactly, seeing how one would have to be stupid enough to download an insecure ISO of Vista? An original disc? and in that case, why would one download it in the first place? And if the person didn't want the copy-protection in the original, and downloaded a cracked ISO, then what good would the MD5sum be?
Or did you mean that it's easy to get and check the MD5sum of a Linux ISO? Because
Re: (Score:2)
Try again.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Let the FUD begin!!!
Re: (Score:2)
Re: (Score:2, Informative)