Conficker Worm Could Create World's Biggest Botnet 220
nk497 writes "The worm that's supposedly infected almost nine million PCs running Windows, dubbed Cornficker or Downadup, could lead to a massive botnet, security researchers have said. The worm initially spread to systems unpatched against MS08-067, but has since 'evolved and is now able to spread to patched computers through portable USB drives through brute-force password-guessing.'"
Evolution (Score:4, Funny)
The worm initially spread to systems unpatched against MS08-067, but has since 'evolved
It hasn't evolved. This is clearly Intelligent Design and anyone denying this is a godless heathen!
Re:Evolution (Score:4, Informative)
The vulnerability is detailed by October 23rd's Microsoft Security Bulletin MS08-067. [microsoft.com]
Re: (Score:2)
I'd assume it only runs signed code.
Re: (Score:2)
Still not Ghost In The Shell :
Re: (Score:2)
I have to agree although I wonder how big the pool of machines would have to be and how smart a programmer would have to be to make a worm which genuinely mutates...
Re: (Score:2)
Oh, there has been self-mutating code. The problems with code mutations is the same, though, as with mutation in real life land: Most of them just can't live. Many more can live but are at a disadvantage compared to the "original". So true "evolution" just doesn't make sense for a computer worm. Yes, it spreads fast, yes, it's generation cycle is about that of a bacterium, but unlike life, the originator of the worm had a plan: Use it to infect. And while "go forth and multiply" (which proves reverse Polish
Re: (Score:2)
But even in the cases of mutating code the first code was intelligently designed (or not so it mutates in very bad ways :D)
Re: (Score:2)
(or not so it mutates in very bad ways :D)
It would take a lot of computing power and/or time for random mutation to yield useful results. That's more or less half of evolution right there.
Re: (Score:2)
"It's not like we don't trust in evolution, it's just that we believe there's an intelligent mutating design!"
It's Extreme Evolution (Score:2)
One could argue that humans are Evolution's way to create code.
Re: (Score:2, Informative)
It has evolved - but not by natural selection. Some amount of evolution is accepted as a fact by everyone except young-earth creationists (those who believe the world is about 6000 years old). For example, we know that horses used to have toes and now they have hooves. But some believe this evolution is caused by natural selection and genetic variation, while others believe it was the act of a creator or designer. The evolution of wolves into domestic dogs is an example of evolution caused by man (you c
Re:Evolution (Score:5, Funny)
You forgot arguably the biggest driver of evolution; sexual selection.
But then, this is slashdot, so maybe I shouldn't be surprised.
Re: (Score:2)
Unlike Windows, which is clearly not Intelligent Design. (Windows 7 is not the messiah, either - it's just a naughty service pack.)
Re: (Score:2)
I certainly agree that Windows isn't Intelligently Designed, but does it count as Evolution if it gets worse over time?
I think Windows is a case of "Just Happened".
Re: (Score:2)
The worm initially spread to systems unpatched against MS08-067, but has since 'evolved
It hasn't evolved. This is clearly Intelligent Design and anyone denying this is a godless heathen!
Nope it evolved from a simplier program. Anyone who believes in a flying spaghetti coder is just ignorant.
Re: (Score:3, Funny)
It's not phishing. Just enter your username and password into my^H^Hslashdot's login form, and make sure your account details are correct.....
Re: (Score:2)
follow the money. (Score:5, Interesting)
It should not be that hard to follow the money generates by this malware. Infecting 8 million PC should be a crime.
from the write down, it downloads data from
" hxxp://trafficconverter.biz/[Removed]antispyware/[Removed].exe"
follow that money and the bad guys will be found quickly.
Re:follow the money. (Score:5, Insightful)
It should not be that hard to follow the money generates by this malware. Infecting 8 million PC should be a crime.
It's a crime if it's spammers. It's not a crime if it's government or content industry.
Bitterness aside, the main problem is that usually the people doing it are in a country where it is, for a number of reasons, difficult to track them down. Still, I agree that, short of keeping your OS up to date (if you /must/ use Windows), following the money is the best approach.
Re: (Score:3, Interesting)
You're assuming too much. Keeping Windows up to date?
One problem is the lifecycle support. SP1 isn't supported anymore, I believe, and even trying to manually install the patch won't work because it requires SP2 or higher to be done. (For XP, of course.)
SP2 won't necessarily work on all computers, for one reason or another. Some may choose not to go up to SP2 due to all that garbage installed with it. (I think a very annoying firewall is installed, and doesn't it tamper with Internet Explorer against one's
Re: (Score:3, Insightful)
The Windows Firewall is greatly improved in SP3, but even the default un-patched firewall in XP is more or less a joke if you plan on doing any network sharing. So either way you have to deal with it. Also, I think it's SP3 you mean about the tampering with IE. It'll install IE7 if you want it or not unless you already had it installed. The only way to uninstall it without going through a big hassle is to have IE7 installed prior to installing SP3 if I remember right.
There are very few reasons to not in
Re: (Score:2)
I think it's SP3 you mean about the tampering with IE. It'll install IE7 if you want it or not unless you already had it installed.
Oddly, the reverse seemed to happen to me. I had installed IE7 on my daughter's box. When SP3 went in, it reverted to IE6.
Go figure.
Re: (Score:2)
Also, I think it's SP3 you mean about the tampering with IE. It'll install IE7 if you want it or not unless you already had it installed.
I have many XP machines with SP3 installed, and none have IE7.
Since there are no options to the SP3 install, I can't see how someone could choose not to install IE7 if it was actually part of SP3.
Re: (Score:2)
Re: (Score:3, Insightful)
Which is all fine and dandy, until you realize that text files can have an executable component, if there is a buffer overflow or some other kind of incorrect data handling in notepad.
There is no such thing as a non-executable file.
Re: (Score:3, Insightful)
Its a good bet that the machine or machines responding to the trafficconverter.biz domain name are either hacked (e.g. zombies) or obtained using stolen or fake credit cards and other ID.
The chances that the information listed for the account(s) owning trafficconverter.biz matches with the owners of this botnet is very little.
Re:follow the money. (Score:5, Insightful)
It's not like the FBI and Interpol and going to look at the bogus whois information and throw their hands up and say "oh noes". They can go and raid the registrar's offices and find out what IPs registered the domain, what credit cards (stolen or not) were used, and if they were stolen, where from and when. Furthermore the worm has a whole list of websites, so every single one of those can be checked in the same way, and even if they are all hijacked, there will be hundreds of potential clues about the perpetrators.
Personally, I am sick of spammers attempting to add comment spam to sites that I run, signing up for bogus accounts, sending massive amounts of spam, continuously trying ssh connections, running exploits etc the list goes on. The police need to do something to help us.
Rich.
Re:follow the money. (Score:4, Insightful)
Re: (Score:3, Interesting)
You assume that you're dealing with a country that has a stable legal infrastructure. In 99 of 100 of such cases, you are not.
The servers are usually located either in countries from the Soviet Union breakup or emerging countries in Southeast Asia. Sometimes, but rarely, South America. And if it's anywhere else, rest assured that it's a hacked server that won't stay up longer than a few days. Those people know exactly how long it takes you to find them, find their server's location, get the local authoritie
Re:follow the money. (Score:4, Interesting)
This nasty virus has caused me to be up working overtime for the past two weeks.
Well one hint to finding the assholes who wrote this virus is the fact that the virus willingly ignores computers originating within the Ukraine.
That narrows it down to about 80 million people. ;-)
Re: (Score:3, Funny)
This nasty virus has caused me to be up working overtime for the past two weeks.
Well one hint to finding the assholes who wrote this virus is the fact that the virus willingly ignores computers originating within the Ukraine.
That narrows it down to about 80 million people. ;-)
Ukraine has about 46 million people. And the situation is already being dealt with -- Russia has stopped to supply them with gas.
Re:follow the money. (Score:5, Insightful)
Personally, I am sick of spammers attempting to add comment spam to sites that I run, signing up for bogus accounts, sending massive amounts of spam, continuously trying ssh connections, running exploits etc the list goes on. The police need to do something to help us.
Rich.
I think you should be careful what you wish for. The Police could do something, they could turn the Internet into a Police State.
Re: (Score:2)
Personally, I am sick of spammers attempting to add comment spam to sites that I run, signing up for bogus accounts, sending massive amounts of spam, continuously trying ssh connections
One thing you can help at least - move your public ssh port to a # in the range of 10000-30000. The number of login attempts on my servers have dropped from thousands a day to none since I did that a few years ago.
Re: (Score:2)
continuously trying ssh connections
What the heck do you have ssh open to the world for in the first place?
Try this:
http://www.openvpn.org/ [openvpn.org]
I've got customers with Windows and Linux servers running this, and Windows and Linux clients, also. There are at least several pages that I've found with a single Google query on how to install it on OS X.
It will also run on the BSDs.
There really is no excuse to have any management port open to the Internet anymore, on any machine.
Re: (Score:2, Interesting)
Actually you are on to something, we (the people) are not giving enough definition of responsibility for someone owning a website that can be used for harm.
When you drive a car and can hurt people by driving over them, you need a license and pass some courses etc...
Well for owning a website, you have to pay with an proper credit card, should any of those numbers show up as having been stolen the site is downed immediately, and the person contacted to provide new information for credit card approval, and as
Re: (Score:2)
The police need to do something to help us.
They've already sent an SOS to the world. What more do you want?
Re: (Score:2)
Until you got all the paperwork down to make this raid, there will be no data left on the server. Been there, done that, didn't even get a cool looking t-shirt.
Re: (Score:2, Informative)
Re: (Score:2)
How are you going to follow the receiving money? Suppose they are making a botnet. They're then likely to sell it on to organised crime, the Kremlin or others known to engage in DDoS attacks. This is not the kind of transaction published in the FT.
In addition, if the botnet is used, someone will probably trigger this botnet from a throwaway client hacked into an unsecured wireless network or just using a network at a coffee shop. Steal a netbook and load Linux on it, and no problem. Organised crime probably
Re:follow the money. (Score:5, Interesting)
It sounds very simple but you're missing the bigger picture.
How do we know that that virus has ANYTHING to do with trafficonverter.biz or that they knowingly provide that service? What are you going to do, shut down the website without a full legal investigation? Brilliant! I don't like slashdot, so I make a virus that looks like it gets its instructions from them, or from random comments posted on there. You've now made it incredibly easy for me to "social-DoS" a website. I can get them shutdown, or cause them lots of financial hassle to deal with the investigation, just by downloading something from them with my virus.
Or say I want AVG out of business - I make the program download a particular older version of AVG to use a known vulnerability in it to propogate my virus or elevate its permissions. Or I just install it on every machine I infect forcibly. If people don't start associating AVG with malware (like that Antivirus 2008/2009 thing) then I've just given them the impression that it's a horrible piece of software that forces itself on you. Or I make sure that it's the only virus scanner that can or can't detect my virus - either way, I win in discrediting AVG.
The fact is that a virus is an unwanted, untrusted application. Because it's untrusted, you can't just start shutting things down because you find a "clue" in that virus's code. That's why it takes *so* long to convict known virus-writers. International boundaries, legal obligations (hence why you can't just "take over" a botnet that has people's/company's PC's in it and issue random command to "clean it up"), verifiable evidence, there are a million holes.
The problem is not that viruses make money. It's that viruses STILL WORK. That they STILL EXIST. That they are STILL CAUGHT by people. They've been around for 30-odd-years and they are more prevelant than ever and 99.9% of viruses operate on a single platform, targetting old, known, already-patched vulnerabilities. The fix for viruses is not to stop their creation by "persuasion" (removing revenue streams, harsher sentences, etc.) but to prevent them by technical means and ensure those means are adhered to. This means punishing users and operating systems that *don't* conform. Virus infections are a daily occurence and people are now blasé about them... I've had people casually mention having dozens of viruses on their machines and could I have a look if they bring it in next month, etc. The problem, again, is an OS that allows such things to exist and propogate so readily and simply (literally, I could write a Windows virus in a matter of hours with no previous knowledge and virtually zero documentation... Unix-based? Wouldn't know where to start because I would need to find a gaping hole in heavily-tested, proven-rugged, complex code that I can barely understand.
My provider shuts customers off if they use port 139 (and others) on their PC's without having previously informed them that, basically, "I know what I'm doing". The Internet stops and all webpages are replaced by an automated message about how to install a firewall (which, thankfully, also includes the "I know what I'm doing" option). I do "know what I'm doing", I have several layers of protection on everything connected to the Internet but I've left this on. What we need is a massive opt-in that enforces this for the average person. My ISP can already scan every webpage and email for me for viruses and replace them with warning text. They need to extend this to be the default, with opt-out. Then when Joe-Idiot gets a virus, it's probably his own fault because he bypassed the safety barrier and thus you can throw him off if his IP starts spamming or trying to infect others.
Even a simple method (e.g. an automated port scan every day, ala GRC.com's ShieldsUp and an email if open ports change). It's not a catch-all but it will certainly shock a few people if they realised just how open their PC's are and will warn companies and professionals when something happens that sho
Re: (Score:3, Interesting)
Dunno, but whay can't we remove trafficonverter.biz from the DNS for a few weeks?
You might say it's bad for them and "all smappers need to do to shut down a web site is...blah, blah" but that's ignoring how spammers work. If spammers learn that websites will be removed from DNS at the first sign of trouble then they won't use websites.
Spammers don't do it for political reasons, they're thieves who are trying to get money.
Re: (Score:2)
Removing it from DNS won't help, they'll just switch the software to using the site's IP address.
Re: (Score:2, Funny)
"smappers" is a lovely word and should be given a meaning at once!
Re: (Score:3, Insightful)
Then when Joe-Idiot gets a virus, it's probably his own fault because he bypassed the safety barrier and thus you can throw him off if his IP starts spamming or trying to infect others.
Most ISP terms of service allow them to do this already. If they actually tried to enforce it, they wouldn't have any customers left.
Re: (Score:3, Insightful)
Most ISP terms of service allow them to do this already. If they actually tried to enforce it, they wouldn't have any customers left.
That's a fair comment, but I don't think it's true. Given the near-monopoloy position of ISPs, the customer either can't leave, or would think long and hard before doing so.
The real issue I think is that it will cost the ISP real money (in terms of added call volume to their support weenies). If they allow their infected customers to pollute the internet, then the cost is pa
Re: (Score:3, Insightful)
Yes, sometimes the public interest outweighs the commercial interest of a business. It happens in meatspace every day for all kinds of reasons, from anonymous bomb threats to the president coming within 2 miles of the place.
Tolerance (Score:2)
The problem is that most people tolerate a certain amount of crap in their life. They don't clean the windshield for a single bug-strike, they don't pump up a tire that is a little low, and they don't care about computer virus problems if they haven't been hurt by them lately.
In simple economic terms, it currently costs the average computer user more time and effort to protect against virus problems than they (personally) perceive themselves to suffer from them. They'd rather throw $60 at the problem and
Re: (Score:2)
I'm more and more convinced that the solution is simple: "Accept only trusted communications". Automatically refuse any attempt at communication to your network that is not properly signed and encrypted, as well as specifically authorized by a competent authority within your organization.
Re: (Score:3, Insightful)
My post did address your question, but maybe not as directly as necessary.
Which police? Which law enforcement? Which banks? Which victims? The problem is that such questions are not only difficult to answer but are severely hindered by international boundaries. It's nothing to do with how easy it is to catch the kid down the road doing this to you, it's about how to illicit information from a foreign country who really have no interest in helping you (it's hurting them too, most probably, but that's no
Re: (Score:2)
If at least one average slashdotter is not in a position to do something technically about this problem then who are you suggesting - I've just nipped over to flowerarranging.about.com and they're stumped.
The GP is absolutely correct, the police can't/won't do anything about it, it's up to technically minded individuals either working for Microsoft or an associated security software vendor to sort it out. And I'm full sure that at least some of them are average slashdotters or similar.
I've just read on the
Re: (Score:2)
"You cannot secure a platform against viruses where the end user can execute arbitrary code. It just ain't possible."
http://wims.unice.fr/wims/wims.cgi?module=adm/unice/challenge [unice.fr]
I disagree totally anyway... you don't need to make it impossible - you need to make it unnecessary and, providing software is up to date, incredibly infeasible. That is easily possible, with such things as secured Linux distros (the above is merely a system call interceptor but it seems to do a pretty damn good job... enough to hi
Re: (Score:3, Informative)
A nice idea in theory. Since I'm in exactly this business, allow me to illustrate how this works (or rather, how it doesn't).
You follow this trail to some registrar in, say, Uzbekistan. He will point you to Malaysia, where the server is located. So you phone your local Interpol office (let's assume you are on good terms with them and they actually listen when you call, as in my case. It helps when you point them to some bank scams first so they see you as someone who ain't just a waste of time). If they are
ISP Blacklists (Score:2, Interesting)
One thing about botnets... I don't really understand why there couldn't be a blacklist of known botnet controllers maintained by a trusted authority (SANS, or perhaps a collaboration of the leading AV vendors, for example) that ISPs could use to block their customers from connecting to. Or, they could even go one step further and shut off the customers connecting to botnets until they're sure the customers have cleaned their computers.
Re: (Score:2)
Ignoring any technical issues I can see two main issues with that:
1) ISPs would have to put in effort and money to combat these things
2) By actively trying to combat them they would then be more responsible for the ones they didn't catch
It's good in theory (just like stopping the spammers with measures ISPs could take) but the practice never seems to make sense to the corporates.
Re:ISP Blacklists (Score:5, Interesting)
1) ISPs would have to put in effort and money to combat these things
Depending on the amount of traffic that worm generates, it might even be worth it.
Re: (Score:2)
It might, but that assumes that the ISP puts in the effort and money to investigate whether it is worth it or not in the first place ;)
Re: (Score:2)
I know ISPs are considerably more complex and technically advanced today than in 1997, but my first inside knowledge of an ISP was a tech sales guy who installed a modem bank in his garage. He had some inkling of how to wire it all together and he could read the help files on the server software and keep it up 99% of the time, but beyond that he didn't really have deep understanding of anything he was doing. He certainly wasn't about to launch any theory based investigations to solve problems he saw for
Re: (Score:2)
Wait,
are you telling me the the ISPs don't use services like spamhaus?
I think there could be a similar service for botnet control points.
Re: (Score:2)
bothaus?
Re: (Score:3, Insightful)
Re: (Score:2)
Re: (Score:2)
One thing about botnets... I don't really understand why there couldn't be a blacklist of known botnet controllers ...
Like this one [spamhaus.org]?
Re: (Score:2)
Care to elaborate...?
How can blacklists which block a few servers in Russia suck more than a worldwide botnet sending out spam and trojans?
Re: (Score:2)
Yes, known black hat servers should be blocked, but it won't help. It is trivial for a botnet designer - who ends up with a huge network of windows PC's across all ip address ranges - to randomize and encrypyt the main control point of the botnet so that blocking a couple of IP addresses would be routed around in a couple of seconds, probably automatically.
How can it spread through USB sticks? (Score:5, Interesting)
I dont use Windows much but I assumed MS had disabled or at least set the default to off of the autoexec.bat feature so how else could it spread just by plugging in a USB stick? Someone tell me this security hole the size of a planet isn't still enabled by default in Windows installs??
Re:How can it spread through USB sticks? (Score:5, Informative)
I dont use Windows much but I assumed MS had disabled or at least set the default to off of the autoexec.bat feature so how else could it spread just by plugging in a USB stick? Someone tell me this security hole the size of a planet isn't still enabled by default in Windows installs??
It posts an "execute" option in the autoplay dialog that looks almost exactly like the harmless "browse folder" option, complete with misleading folder icon. It's moderately clever, but of course still rquires autoplay to be enabled.
Re: (Score:2)
How does one disable autoplay in XP, without making a half dozen manual registry changes?
Re: (Score:2, Informative)
How does one disable autoplay in XP, without making a half dozen manual registry changes?
Through a policy (gpedit.msc).
http://support.microsoft.com/kb/953252 [microsoft.com]
The article is about 10 times as long as it needs to be, look for the subtitle "How to use Group Policy settings to disable all Autorun features".
Re: (Score:2, Informative)
Re:How can it spread through USB sticks? (Score:5, Interesting)
Autorun is still enabled by default in Windows for all removable devices.
USB sticks are a little odd though as autorun only works for certain ones with a specific hardware flag set. I would guess it's trivial for this worm to change the flag to enable autorun, however.
Re: (Score:3, Insightful)
I would guess it's trivial for this worm to change the flag to enable autorun, however.
Only after its executing....and if it's doing that, what's the point?
Re: (Score:3, Informative)
Infect other computers. That's the whole point of putting itself on the USB stick in the first place.
Re: (Score:2)
It obviously was executing on the machine from which it got onto the stick.
Trivial for a worm to change the flag? (Score:5, Informative)
I would have to agree. I fought, what I think is this worm, at work for a week or so. If not, here is what I fought.
*Would disable Recovery console so you couldn't go back to an early date.
*Spread by USB thumb drive.
*Stick in a thumb drive, if the computer had AVG, it would detect it, but not be able to "heal" everything...but by this time it was too late.
One variant of it put in a root kit and blocked all access to antivirus sites. You could go anywhere on the Internet unless it happened to be an antivirus site.
This same one also blocked exe files if they happened to be something like Spybot search and destroy. It just wouldn't run anymore.
Also, it turns off the ability to change settings to view hidden files and folders, so you can't see the folders it adds.
My guess is, it is pretty freaking trivial for these people to do whatever they freaking want in Windows (except for probably disabling DRM!).
Transporter_ii
Re:How can it spread through USB sticks? (Score:5, Informative)
Re:How can it spread through USB sticks? (Score:4, Insightful)
I really hate Microsoft for this kind of stupidity. They could have just made an option "autorun program from USB stick" with nothing customizable about it.
Re:How can it spread through USB sticks? (Score:4, Informative)
See http://isc.sans.org/diary.html?storyid=5695
The option appears as :
Install or run program: Open folder to view files (Publisher not specified)
So people falling for it, would have clicked even on "Install virus and destroy your life ? YES/NO".
Re: (Score:2)
That would be great :
Infect your system from removable drive ?
[yes] [no] [file not found]
I wonder what most users would pick though.
Re: (Score:2)
One of the options on the box appears as "Open folder to view files" which might sound innocuous, but is actually an "autorun.inf" option created by Conficker that in reality runs the virus.
I may be dense, but why would you want to give untrusted programs control over what appears in the autorun dialog box? Shouldn't control over those options reside entirely with the OS? I suppose game manufacturers might want to put some icon next to "Play Game" or something like that, but that seems to create a rather
Re:How can it spread through USB sticks? (Score:5, Informative)
Re: (Score:3, Insightful)
I must admit, it is cleverly done. Put me in front of a Windows machine with default settings and I'd probably select the topmost option.
Still, it's an epic fail to enable such autostart of random programs from USB stick. It is sacrificing essential security for questionable convenience.
Not the size of a planet (Score:3, Funny)
the size of Pluto maybe.
Creamed, kernel, or cob? (Score:3, Funny)
Re: (Score:3, Funny)
In german, cornficker has exactly this meaning.
Re: (Score:2)
How are viruses and worms named, anyway? "Downadup" and "Conficker" are very... arbitrary names. Do they roll some dice and consult a table of vowel & consonant sounds or something?
(Reminds me of alien name generation tables from Traveller...)
Re: (Score:2)
not exactly. the german word "korn" means "cereal", not "maize".
Re: (Score:2)
a cereal fucker
Re: (Score:2)
This is what baffles me... (Score:2)
Why is it able to register domains automatically? This is where we should be working to block the verdamt thing... stopping the automatic registration of domains... make it take time and require money to actually create the domain...
Re:This is what baffles me... (Score:5, Informative)
Finding unpatched servers (Score:2, Informative)
The guys at Winh4x [blogspot.com] have generated a script that detects servers missing the MS08-067 update.
Cancel or allow ? (Score:3, Interesting)
You could still have trusted services, time.windows.com etc, but multiple requests when the browser hasn't registered a click for an hour should be regarded as suspicious. I realise this is the "wrong end of the stick", but we have to deal with things the way they are, not how we'd like them to be. At least being nagged will bring the publics awareness to the problem existing on their machines.
Another idea - use the mouse, so that if it's left unmoved for more than x amount of time the "watchdog" would lock the net down. If you need to leave something running like bittorrent, you can specifically add it as a trusted service, but never permanently. Anything other than BT accessing the net during that time period (or until you move the mouse again) will automatically be denied.
It seems to me that the wider community is having to carry the can for the sorry state of windows security, so making life inconvenient for those who leave their machines unpatched should be fair game.
Re: (Score:2)
It'd be trivial for trojan developers to just emulate a move of the mouse, or a press of the keyboard or a button.
Re: (Score:2, Interesting)
The 'dimming the desktop' isn't just to catch the users attention. When a UAC prompt comes up it does so on the secure desktop, where mouse and keyboard can not be manipulated by a program. For example, when using synergy http://synergy2.sourceforge.net/ I was unable to interact with the UAC prompt without using the local keyboard/mouse.
Re: (Score:2)
That's because synergy will have been running in user mode.
Unfortunately, trojans et al. are a little less respectful of privileges and memory boundaries.
I'm not sure how this really relates to the original idea here though unless you're suggesting the keyboard and mouse threads always run in this mode but interacts with the desktop that remains running at reduced privileges? I can imagine that would only make things worse.
Say it ain't so (Score:3, Insightful)
Well, I guess that almost held for two weeks. Maybe someday people will consider addressing the underlying cause of these problems instead of the symptoms.
Patch and Pray: Windows is a costly liability (Score:3, Interesting)
The only reason why there hasn't been a class action lawsuit against Microsoft for their incompetence is that many misguided people STILL think that every 20 minutes of MS Word is worth 1 week of their time spent Patching and Praying and trying to recover data.
The argument that the vast Windows Ecosystem (700 m computers) is itself an argument for using Windows has been disproven by the Internet. If you have a network or connect to the Internet, Windows is a significant risk. And don't blame the users. That's as arrogant as the US makers of the cars that Nader condemned [wikipedia.org] in 1965. Windows is "Unsafe At Internet Speed".
The Windows operating system, which is a liability on any network, must be constantly patched to protect against the "latest" threats. Microsoft's only constructive answers to these exploits are "patch and pray" and also to cripple connectivity (Windows XP SP2).
There will always be smart Bad Guys. The Bad Guys who excel at being bad are MUCH more creative than Microsoft and they have clearly put Generalissimo Ballmero and his regiments to flight. If you have the worst possible defences, you can't expect to be left in peace. Using Windows today is like sending your cavalry to engage hostile tanks. You *will* get slaughtered at some point and if it doesn't happen immediately, it's because the tank crews took pity.
Re:Patch and Pray: Windows is a costly liability (Score:5, Insightful)
*ALL* operating systems much be constantly patched to protect against the "latest" threats. Windows just gets the majority share of attention because there are millions of Windows boxes, many unpatched, many owned and operated by computer illiterate users who have little or no interest in securing them (And even in Vista, which is a vast improvement on XP from a security perspective, the default security leaves a lot to be desired).
Ok, they are *usually* less serious than this particular vulnerability, but my Ubuntu box downloads "critical" updates at least once a week on average.
Microsoft have made a lot of bad design decisions in their products, often in order to thwart competition, but them actually being incompetent or negligent, especially in recent years, is a lot harder to prove.
Re: (Score:2)
*ALL* operating systems much be constantly patched to protect against the "latest" threats.
Not if the threat is in the Windows Ecosystem. All OSs are updated, but how many OSs are used to form Botnets based on OS-specific technology?
Ok, they are *usually* less serious than this particular vulnerability, but my Ubuntu box downloads "critical" updates at least once a week on average.
My Ubuntu box and my OS X box receive updates, sure. But, for example, I am unaware of any Linux-based or OS X-based Botnets. They will not be updated for this Botnet. The easiest target is the target of choice.
Microsoft have made a lot of bad design decisions in their products, often in order to thwart competition, but them actually being incompetent or negligent, especially in recent years, is a lot harder to prove.
Exhibit A - the invention of the Botnet.
Re:Patch and Pray: Windows is a costly liability (Score:4, Insightful)
The only reason why there hasn't been a class action lawsuit against Microsoft for their incompetence is that many misguided people STILL think that every 20 minutes of MS Word is worth 1 week of their time spent Patching and Praying and trying to recover data.
Actually, I think it's more fundamental than that. I think the last 20 years of Microsoft dominance have convinced people that this is the *only way computers can work*. That it's impossible to do any better. So they've learned to live with the instability, the insecurity, the constant fear of losing work due to mysterious crashes and instabilities.
Heck, just look at the praise lavished on XP. Compared to 95, XP is a quantum leap in terms of stability. And yet, in my experience, it's only just adequate. But compared to what people were used to, it's amazing!