12.07.08
Eye on Security: ‘Fun’ with Zombies, Press Ignorance, and Bizarre Solutions
“Our products just aren’t engineered for security.”
–Brian Valentine, Microsoft executive
Microsoft software is not exactly renowned for being secure, despite attempts to manipulate journalists. The software is notorious for being deficient or defective. To Microsoft, security and networking were an afterthought, not a design consideration, as shown here. Granted, trouble should be anticipated.
Zombies Conundrum
Stories about Windows zombies are a dime a dozen, just like zombie nodes. It is estimated that about 320 million Windows PCs are zombies. Here is the latest story on this never-ending (and very costly) battle.
Researchers at Trend reported that 500,000 unique hosts have been infected across the globe. Macalintal said that because of the behavior of the worm, he expected to see the botnet grow bigger and produce more variants.
That’s small potatoes compared to the whole, but it just happens to be a new example. Not so long ago we witnessed hospitals and army bases becoming botnets, as well. It’s a hugely serious subject that results in many untold deaths.
Insecure by Design
As prior links demonstrate (we strive to avoid repetition), it is agreed even by Microsoft’s biggest of fans that Windows fails at security because it’s just bad at it. It’s nothing to do with market share and those lies are running thin. In the following new article, Microsoft’s security model comes under fire.
When Microsoft released an emergency patch last month for a critical vulnerability in the server service in Windows, administrators and security teams in enterprises around the world scrambled to test the fix, schedule downtime and get the patch distributed as quickly as possible. If ever there was an occasion to use all due haste in deploying a patch, this was it. Not only was the vulnerability present in every supported version of Windows, but Microsoft officials had warned that it was a prime candidate for a worm.
Here is another one from the news.
Security Manager’s Journal: When is a patch not really a patch?
[...]
If you don’t reboot a Windows server after a patch is applied, the patch doesn’t take effect, but SMS doesn’t notice that failure to reboot. This insistence on rebooting is one of the things I dislike about Windows. In the Unix world, all that’s usually required is that a particular process be restarted.
There has been lots of chatter about a flaw in Mozilla Firefox, but like many previous ones, this new vulnerability only applies to Windows, where Firefox inherits some risky behaviour which it sometimes attempts to mimic due to necessity. Why isn’t the press covering this properly?
Bad, wicked Firefox, bad wicked open source…except that this trojan *only* works on Windows…which means it’s bad wicked Windows, yet again. But the article never mentions this, of course.
[...]
And yes, you guessed it, it only works on Windows. So that bit about “[t]he most remarkable feature of the episode may not be the breach of security, but the cost of dealing with it” is really about the cost of using Windows – well, it’s The Economist, what do you expect, accuracy? When will they ever learn?
As Glyn Moody shows, there are rare exceptions among the reporters.
The Web Vector
Adding to a mountain of reasons for infection:
“Koobface” that uses the social network’s messaging system to infect PCs, then tries to gather sensitive information such as credit card numbers.
2. Most recent Windows infections result from the same simple trick
BitDefender’s Top 10 E-Threats Report identifies just one type of attack as being responsible for more than a third of Windows infections in the past month: fake anti-virus scans, also known as scareware.
Attacking the Outcome, Not the Cause
Here is a good and short article titled “Punishment vs. Prevention.”
Finally, I feel compelled to issue the warning, “Be careful what you wish for, because you might just get it.” If the government takes over Internet security, there is sure to be a large amount of new regulation imposed. And this could mean security companies like F-Secure would have to devote a lot of resources towards compliance. I think it would be much better for us to take responsibility for finding solutions ourselves.
This is a hot topic at the moment because concerned authorities ponder tackling the zombies issues by making punishment for those caught a lot more severe. But it’s totally the wrong way of addressing the issue. As Carla argues very rightly: ““Instead of Throwing Everyone In Jail, Fix Your Lousy Products”
Have any of them– has one single vendor, whether it’s Symantec or Trend or McAfee or F-Secure or anyone– ever said “Quit throwing your money down a rathole– stop using Windows, or at least don’t put it on the Internet”? Wouldn’t that little tidbit of honesty be refreshing? But no, they’ll never do that. If the same conditions existed in, say, the small home appliances industry people would be getting electrocuted by their toasters and hair dryers every day, and the manufacturers would advise them to learn correct handling of live wires, and a thriving industry of insulated safety garments would prey on the survivors. If they made safety gear for swimmers it would be so bulky and uncomfortable they either wouldn’t use it, or they would drown under the weight of it.
Following current trends, anyone who criticized them would be persecuted under the DMCA.
Instead of pointing a finger at those who produce and sell shoddy software, those who suffer are blamed for negligence and stricter rules are devised as means of punishment (false cure), not prevention. It won’t work. The systems need to be changed, as opposed to just their side-effects. █
