Summary: Another day, another expected problem

● Why Windows security is awful

A friend of mine suggested that I should include as boilerplate in my security stories, a line like: "Of course, if you were running desktop Linux or using a Mac, you wouldn't have this problem." She's got a point. Windows is now, always has been, and always will be insecure. Here's why.

First, desktop Windows stands firmly on a foundation as a stand-alone PC operating system. It was never, ever meant to work in a networked world. So, security holes that existed back in the day of Windows for Workgroups, 1991, are still with us today in 2009 and Windows 7.

[...]

It also doesn't help any that Microsoft's data formats can be used to hold active programming code. Microsoft Office formats are commonly used to transmit malware. Microsoft's latest Office 2010 tries to deal with this by blocking all but read access to documents or 'sandboxing' them.. Since you can't edit a sandboxed document, I'm sure that's going to go over really well. Of course, what will actually happen is that users won't use the sandbox utility, and they'll just spread malware instead.

● 55,000 Web sites hacked to serve up malware cocktail

Security researchers are raising an alarm for a potent malware cocktail — backdoor Trojans and password stealers — being pushed to Windows users from about 55,000 hacked Web sites.