Microsoft offers reward to catch worm maker

Well since we're at it... a few more headlines you're not likely to see...

- Telkom offers uncapped internet at low prices
- Malema finishes high school
- rpm gets Communications Portfolio

I could go on, but...
 
Why doesn't M$ just fix their stupid OSes. Imagine if your car needed an update every week because of security holes, eg drive over a particular bump in the road and the brakes will fail - so gotta fix that - imagine how dangerous and expensive driving and constant updating (taking the car to your dealer) would be.

MS should just make sure that code cannot be executed automatically and even if it is, code may not modify the kernel - inject or terminate processes and access areas it should never have rights to access. MS started this whole thing and they were the only system out there from the 90s - they killed off OS/2. Even in the old DOS days the days of DOS viruses - :( - and then internet and all these stupid security holes leading to compromised user data and botnets.
 
PeterCH said:
MS should just make sure that code cannot be executed automatically and even if it is, code may not modify the kernel - inject or terminate processes and access areas it should never have rights to access.
Click to expand...

Its called User Account Control in Vista...
 
Chris_H said:
Its called User Account Control in Vista...
Click to expand...

Um, no. UAC is a little dialog box that pops up whenever you want to do something useful :-P

The reason Windows is targeted is not because it's the most "popular" operating system (and that's a topic for another day - it's not popular), but because it's security is extremely shoddy.

In Windows, anything with a .exe extension can be run. Try it. Create a text file called me.txt, with a bunch of random rubbish inside it. Rename it to .exe. Try to run it. Windows will try. Sure it won't get very far, but it'll still try it's best to execute that file.

Now try that on Unix or a Unix-like operating system. Nothing doing. On Unix or a Unix-like operating system, you have to give a file permission to execute. Not only that, the permissions system is threefold, so that the file owner has a set of permissions, the people in the file's group have a set of permissions, and everyone else on the computer has a set of permissions. These permission sets are Read, Write and eXecute. If only the file owner has eXecute permissions, everyone else on that computer can try as hard as they like, they will not be able to execute the file.

In addition to this permission set, users on Unix and Unix-like operating systems don't run as the computer administrator, but rather as regular users. A regular user has full access to their "home" directory, which is somewhat like a user's My Documents directory on Windows. But unlike Windows, a regular user on Unix and Unix-like operating systems can install software to their home directory. All their settings are stored in their home directory as well, so each user has their own "experience" on that computer.

So, because none of the users on Unix or a Unix-like operating system has administrator rights, they cannot do system-wide changes. This means that if a virus were to infect a user's account, it would be totally isolated from the rest of the operating system.

So, in short, if you want to run a virus in Windows, you simply use a little social engineering and get the user to double-click on that icon there. On Unix or a Unix-like operating system you have to switch to the root user (computer administrator), set the global eXecute permissions on the file, and then run the file while still logged in as root. A bit more of a manual process.

On a related note, here's an interesting blog about the Conficker worm: http://blog.linuxtoday.com/blog/2009/02/i-give-up-peopl.html
 
PeterCH said:
Why doesn't M$ just fix their stupid OSes. Imagine if your car needed an update every week because of security holes, eg drive over a particular bump in the road and the brakes will fail - so gotta fix that - imagine how dangerous and expensive driving and constant updating (taking the car to your dealer) would be.

MS should just make sure that code cannot be executed automatically and even if it is, code may not modify the kernel - inject or terminate processes and access areas it should never have rights to access. MS started this whole thing and they were the only system out there from the 90s - they killed off OS/2. Even in the old DOS days the days of DOS viruses - :( - and then internet and all these stupid security holes leading to compromised user data and botnets.
Click to expand...

Making a car completely "hijack-proof" is (or would be) illegal. Making an operating system "completely safe" is just impossible. I'm not defending M$ here, but really?
 
Tanarri said:
Making a car completely "hijack-proof" is (or would be) illegal. Making an operating system "completely safe" is just impossible. I'm not defending M$ here, but really?
Click to expand...

It is very possible. The fact with Windows is that files previewed in MS Outlook are auto-executed and can ALREADY infect the system. Stuff in the browser can and does auto-run and it executes and has full access to your entire system. Autorun.inf files which auto-execute whenever a USB stick or DVD/CDROM is inserted. Rootkits which can be installed on audio CDs and which can corrupt the entire system. That is incredibly reckless.

There are other numerous stupid things in Windoze:
By default for example, Windows hides extensions, so a JPG file and an EXE file
will not have their extensions shown but their icons. Creating a trojan with a standard JPG icon can fool the user into executing it who thinks he is double clicking on a JPG picture and not an executable file with total access to everything once run which just happens to have a standard JPG icon inside it.

MS Windoze is just 'defective by design' and probably so - for the paranoid person because MS wants to sell support contracts for its apps OR
because if you're just a pragmatist, MS is incompetent to write a safe, secure
operating system. They could do what Apple has done and base it on Unix
and add virtual machines to run the previous stuff.

Drawing a car analogy is like saying - anyone who smiles at you has the door become automatically unlocked or opening the window
automatically allows the hijacker to open the door - via the handle without any further interaction.
 
Last edited:
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X