Neowin.net - Microsoft Security is Nothing to Sneeze at

Microsoft Security is Nothing to Sneeze at

Posted by malebolgia on 11 November 2005 - 20:30 · 43 comments & 5390 views

I frequently have people write to me to discuss how much Windows sucks and how great open source is. They say it as if Windows is my only security problem and Linux, Apache, and Firefox are our saviors. I often write back that I use Windows and Linux on a daily basis -- and any of them can be secure or insecure. They then somehow take that to mean I’m a Windows zealot because I have the audacity to stand up for Microsoft every now and then.

Here’s the plain truth: Malicious mobile code has been around since before Microsoft was a company, and it will be around long after they are a historical footnote. If Microsoft disappears, that won't stop mischievous hackers from writing rogue programs. Real security solutions aren’t as easy as replacing Windows with another alternative. Real security means persuasive authentication, loss of anonymity, less functionality, peer code review, and programmers learning security along with their first GOTO statement. End-users will have to accept that security means slower development times and more expensive products.

News source: InfoWorld

Breplibot.b is a file 10240 bytes in size, packed using UPX. When launching, the backdoor copies itself to the Windows system directory as $SYS$DRV.EXE. Using this name makes it possible for the Sony rootkit technology to be used to hide the activity of the malicious program. Of course, the backdoor's activity will only be hidden if DRM protection, as used on some Sony Audio CDs, functions on the victim machine.

As usual, Kaspersky Lab warns users to be careful, and not to open email from unknown senders, or open attachments to suspicious messages.

Hide additional information

About the Author
Full name: Unknown
Forum name: vet

malebolgia
Contact: via forum PM
Submissions: Normal · Headline

Total votes: 0

Bookmark on del.icio.us

Advertisement

#1 Posted by Fedorpheux on 11 Nov 2005 - 20:32: Achoo!

#2 Posted by darkyi on 11 Nov 2005 - 20:33: Completely agreed.

#3 Posted by betasp on 11 Nov 2005 - 20:37: I was taught not to use GOTO statements, but to use subroutines... for what it is worth.

(7 replies) #4 Posted by markjensen on 11 Nov 2005 - 20:40: Poor Administration is the cause of nearly all security issues.

Now, Microsoft does bring some of this on themselves by encouraging home users to run as root, and often with no password.

But in the end, it is the people maintaining the box that is the cause of the problem, not what OS it is.

#5 Posted by H3lix on 11 Nov 2005 - 20:40: *waits attentively for the zealots to show up*

(2 replies) #6 Posted by Airlink on 11 Nov 2005 - 20:51: It's not Windows you have to worry about there, Grimey: It's grabing a set of exposed high-votage main busses in an effort to demonstrate how lazy and unprofesional one of your more obnoxious co-workers is. There's a history of that in the Grimes family, or so telivision has lead me to belive.
<hugs the TV>
And as we all know, everything we see on TV is correct.

(6 replies) #7 Posted by em_te on 11 Nov 2005 - 20:54: Open source software has 6 billion programmers working around the clock. That means they have 2 billion people searching for bugs, another 2 billion are creating innovative features and another 2 billion are doing security audits. How could that not be more secure than Windows?

(4 replies) #8 Posted by Eversurf on 11 Nov 2005 - 21:07: I really liked the article. It wasn't just another "My penis is bigger than your penis" article. It had facts and figures. He explained what the facts were "Viruses have been around since the begining and will be until the end" and "The Apaches VS IIS" I agree with the fact that more of those OS are on the internet the more likely people will find faults in the code.

Great article

#9 Posted by CDog on 11 Nov 2005 - 21:12: Obvious stuff but this sort of thing needs to be said

#10 Posted by ArtOf_War on 12 Nov 2005 - 05:43: Very good artcile... serves well as a reality check for both Windows and, more importantly, Linux Fanboys

(1 reply) #11 Posted by Sterling Christensen on 12 Nov 2005 - 10:04: First, see this article and discussion on how many Linux viruses there are:
http://digg.com/linux_unix/How_many_Linux_viruses_are_there_

Linux has about 3 to 8% percent of the desktop market, and more server market share than Windows. You'd think there would be more Linux viruses and worms, but there aren't.

Windows is only just now (in Vista) making it easy to run with reduced privileges, something Linux has done all along.

THAT's what makes me think Microsoft security IS something to sneeze at.

As for his figures, Apache having more reported holes than IIS, one big problem: he compared the number of reported holes, without even looking at their severity. Some of exploits reported for Apache are local, while all of IIS's are remote.

#12 Posted by Blaz0r on 12 Nov 2005 - 12:09: I wouldn't dare to sneeze at a Windows computer, it'd propably get infected!

#13 Posted by aleck79 on 12 Nov 2005 - 13:24: so this 'Malicious mobile' code before Microsoft was on what, punch cards?

(4 replies) #14 Posted by bucko on 12 Nov 2005 - 14:06: The most safest computer is one that is not connected to the internet or lan.

(3 replies) #15 Posted by EduardValencia on 12 Nov 2005 - 17:23: deren microsoft will never dissapear,what a crap article,the legacy of microsft will be intact forever,stop trolling against MS!

#16 Posted by LTD on 12 Nov 2005 - 23:13: --delete---

Last edited by 25908 on 13 Nov 2005 - 04:10

[1]

Commenting has either been disabled on this article or you are not logged in. Click here to login or register, its free!

Note: Anonymous commenting is disabled in order to keep the quality of responses to a high standard.

Scroll to the Top