Comments on: Windows flaw spawns dozens of attacks
Attacks designed to exploit Windows Meta File flaw range from malicious spam to an MSN Messenger worm.
Sites harbor Windows Trojan
Most Popular
Latest tech news headlines
- China arrests thousands in Web porn crackdown
January 2, 2010 6:26 PM PST
- Application packaging for cloud computing: A proposal
January 2, 2010 4:56 PM PST
- When policemen are caught looking at Web porn
January 2, 2010 4:16 PM PST
- See all headlines
RSS Feeds
Add headlines from CNET News to your homepage or feedreader.
More feeds available in our RSS feed index.
- Markets
Related quotes
Why is it that people actually defend microsofts "security" practices?
MS security- the biggest oxymoron since military intelligence
In the long run that won't work either. As a matter of fact, this type of tactic is likely to make Microsoft appear as the underdog! Good work guys!
to this attack."
Nope, 95 percent. The rest is Mac or linux ;)
Let those Windows users boil in there troubles, they know there
are better systems but refuse to use it.
Also,
""According to PC World, users of the Windows OS should install
an unofficial security patch now, without waiting for an official
patch from Microsoft, security researchers at The SANS
Institute's Internet Storm Center (ISC) advised.
The flaw stems from a malicious email containing the file
?HappyNewYear.jpg?. Microsoft had advised last week that to
exploit a WMF vulnerability by e-mail, "customers would have to
be persuaded to click on a link within a malicious e-mail or open
an attachment that exploited the vulnerability."
Experts are now saying that users only need to view the folder
that contains the affected file, or allow the file to be indexed by
desktop search utilities such as the Google Desktop. To make
matters worse, the security advisors say source code for a new
exploit was widely available on the Internet by Saturday, allowing
the creation of new attacks with varied payloads."
copy and paste the entire url (not just the first line)
http://www.pcworld.com/resource/article/0,aid,124142,pg,
1,RSS,RSS,00.asp
run Windows.
We've locked IE's settings so neither it or Outlook can display
images. And if just one of our Windows boxes falls victim to this
latest example of MS security only our Macs and Linux machines
will be allow to access the internet or send/receive email
attachments.
Our management is fed up with Windows problems and asking
for alternatives.
This may help keep down on network traffic and may keep you from updating everyday, but it is giving Virus writers and hackers a good windows of opertunity to do their worst. Maybe Microsoft should consider having a set weekly or bi-weekly update instead of once a month. Helps close that gap a little bit more.
It is funny that MS has a few of the top security experts on the payroll, and have even published outstanding security books, yet can't apply that knowlege.
They are just too big, too slow, and have no forward thinkers. Which is why Vista will be far too little, years too late.
The bugs crop up effectively at random, so there is no way to tell which programmers will be able to attack the new problem most effectively. Ilfak Guilfanov came out with an effective fix this time, he might have to use someone elses fix for the next.
That's why open source can react so much faster, no one is pigeon holed in some other part of the company.
under its Software Security Incident Response Process (SSIRP) to
analyze the attack, assess its scope, define an engineering plan,
and determine the appropriate guidance for customers..." . But
days later they don't have a solution.
In the meantime, "Ilfak Guilfanov, a Russian security engineer,
has released an unofficial fix that has been found to work." Way
to go IIfak!
While MS is searching for a clue perhaps it would be best if they
push Ilfak's program out through Windows Update. At least HE
appears to have a clue to what's going on.
month or so ago when security people complained that the hole
was found many months ago, M$ was orderly notified and did
nothing.
For *MONTHS*. Yeah, they take security [CENSORED] seriously.
Thou people always complain about Apple's closed mouth
policies or Linux distro's waterfall of updates - it's only M$
which displays such ignorance toward its customers.
Id be willing to bet they determined the threat is not serious enough to hack in a countermeasure and push it to a couple billion windows machines just to break working systems and have to push another update later on.
They likely decided to wait and fix it right rather than half assing it.
free of viruses and spyware. Software *cannot* install on a Mac
without a user's explicit permission.
I pity Windows folk these days. I laugh, but I pity. :-)
because many of my friends and relatives are PC users and all
those infected machines keep filling up my mailbox with junk.
Even with junk filters and no infections, it's a huge pain in the tush.
Besides, my friends are neat people who are often stuck with
Windows because of work, and I hate to see them having so much
difficulty.
That said, it is a no-brainer that if Mac OS X (or Linux, or other UNIX variant) was the dominant OS, it would be the one being attacked by swarms of hackers, and the Windows users would be smugly laughing.
So I do not wish for much more market share for the Mac (well, maybe a couple more percent), because I like the lack of attention we get from the bad guys...
How is it that the price for computer parts are dropping but the macs continue to stay at such a high price?
I hear these stories of people who drop $3000 on a new mac and when a new high end game comes out (that's if it comes out for mac) they couldn't run it....How about the people who bought the emac and can't upgrade to USB 2.0 and are forced to use 1.1 or the dying firewire.
My point is this, if I drop $2000-$3000 for a new pc I better not be locked in to something I can't uprade. The shelf life of a Windows PC is 5-7 years...I shouldnt have to upgrade to a new $2000-$3000 PC every other year just to run a new OS.
Apple is a cult that requires you to buy new expensive equipment every year to be "cool".....Apple users stay away from the Kool-aid :0)
Go ahead apple fanboys start your flaming
Mac and buy a $499 Mac Mini. Or take their Intel box
and put Linux on it. Forget about Windows! It is like
having a "High Maintenance" girl or boy friend!
I'll never forget when the first version was released. It just seemed like a big, clunky box that you had to unwrap any time you wanted to do your WORK. We installed it just to check it out, then immediately uninstalled it -- it slowed our computers down to a crawl, and the general consensus was, "What is this crap?"
But oh dear, then came the big Windows 95 rollout, and the general public was seduced by all the dancing trashcans and talking paperclips and other goofball, resource-wasting cartoons, and all of a sudden we were all but forced to upgrade to mini-mainframes in order to run all that junk. And lo and behold, suddenly it was damn near impossible to repair your own OS, because (are you kidding me?) some idiot had decided to make the code inaccessible.
To protect its "intellectual property value," or simply to hide the fact that the product SUCKS? Microsoft throws a zillion programmers onto every "new release," and none of the left hands knows what any of the right hands are doing, but they slap the whole bloated mess together and shove it out the door, and oh to hell with security, we'll just fix all the problems some time later...yeah, sure they will. If I bought an automobile that I had to drive in for a recall repair every two days, and then every third repair caused the thing to stall on the highway, I'd junk that lemon and drive something else, but nooooo, can't just junk Windows, because if you're dealing with the public at large, it's very sadly the only ride in town.
We can all be thankful Bill Gates made his fortune by duping computer users, instead of setting his sights on conquering the automobile market (although at least in that case, he'd have been in jail a long time ago).
I like Mac more because of the eye candies... Though it's too expensive... That's OK for the consumer guy in me (unless my wife checks the tag price and objects)...
I like Windows most because it works just right for me as a consumer, professional and as a "techie" guy -- all-in-one!
I look forward to Windows Vista which promises better security (ala Unix/Linux) and better eye candies (ala Mac)...
Well, OK... so Microsoft is copying... err... stealing ideas? Whatever... Who ever said OpenOffice's GUI is original? :D
What's the point? If Unix/Linux fans can choose to be blind about what's wrong with Unix/Linux; and if Mac fans can choose to be blind about what's wrong with Mac; I can too...
Quits. ;)
;-)
OS X server is a pain in the ass. And royally so. However, OS X client version is nearly unbeatable from any other standpoint. Games? Who cares, go by an Xbox, which is built to do nothing but run games at an HD resolution, comfortably in your living room.
There are soem things I don't like, want changed or added to OS X. But all it takes is time. Windows has had what? 6 years since XP was released, and all they can come up with is a couple of service packs? The Mac OS in that time made vast improvements from OS 9 to 9.2.2, and then a HUGE jump to OS X. There's been three versions of SO X that have been outstanding.
So, I think all of your arguements are pretty, well, lame.
In alot of cases this will force people to have to buy new hardware.
So far Microsoft has seen surges in sales of Windows XP for every flaw and exploit that has come out. THIS IS VERY WRONG! Microsoft should not be rewarded for poor programming. What's to stop them from deliberately creating flaws and vulnerabilities to increase sales.
The LAW needs to step in and FORCE Microsoft to patch "EVERY" version of Windows that is affected by this flaw... AT NO COST TO THE USER.
Linux/MAC/Unix Vulnerabilities Outnumber Windows' 3 To 1
By Gregg Keizer, TechWeb News - 01/04/2006
Tallies kept by the U.S. government's computer security group show that Linux and Unix operating systems faced nearly three times the number of vulnerabilities in 2005 than did Microsoft's often-maligned Windows.
In the US-CERT (United Stated Computer Emergency Readiness Team) year-end vulnerability summary, Linux/Unix accounted for a whopping 2,328 vulnerabilities, about 45 percent of the 5,198 total.
And you do know that there are various versions, right?
SO, when you compare OS X (a unix/bsd based OS) to Windows XP, how many are there?
But you don't do that! You are grouping every version of unix and linux, which all are different no matter how similar, into one category. So tell me that ONE, one SINGLE version of any of those has more flaws than any version of windows.
They don't. Learn how to fairly compare things and don't post such nonsense you fanboy.
> Linux/MAC/Unix Vulnerabilities Outnumber Windows'
> 3 To 1
Get real. Number of vulnerabilities means very little. Here are some REAL numbers:
Last virus infection:
My Windows PC: 6 months ago
My Mac: 1993
Last time I had to completely reinstall the OS because of Spyware or infection:
My Windows PC: 6 months ago
My Mac: never
You can't even reinstall the Windows OS, unless the machine is off the network or behind a firewall. Last time we tried that, it was infected before we could even go on-line and apply all the patches.
systems, Windows and IE are by far the clear majority. Mac OS had
a count of 41, compared to the WIndows count of 812. and almost
all of the Mac vulnerabilities were never exploited by any hacker
before they were fixed. (In fact, Apple found most of them).
So as they say, figures don't lie, but...
........ well, you know the rest
>.< Ya thay may be good at what they do when they worked. Our "power macs" or whatever they were G5, *shrugs*.
Number 1: They had this 2 hour shut down bug, or 2 hour stuff up bug, either way they would go to check the temp and the fan would just start full ball and basicly crash the computer, ya s they "fixed that" after like 4-5 months and still they died a lot.
Number 2: The usb ports on them wouldent work they "fixed that" round the same time, they stil dident work.
Number 3: The DVD burners in the g4's i think they were would just sit there "buring" for hours so we had to put the files on the other computers so we could burn it, they never fixed that.
Number 4: Just general loss of data on random occations. Probly just a computer thing but who knows.
Anyway I guess u gotta bace your love or hate of something by your experiances, though I saw we were using macs and I almost died even before I started using them. Also my Windows PC's have never needed a reinstall of windows.
I dont know what that mac v's pc guy was doing having to re install windows cause of a virus, I have had the net of this computer for years (around 4) and it hasn't had any problems (also young and old people using it, you know how they were with opening things) Maybe just luck? *shrugs* I dunno maybe one day il try linix or something but till then windows powers on ^.^;
;-)
who weren't any good on the PC either. And you should have found
a better company to work for .
>>Macs cant fix there own...etc etc.
I seriously doubt you even know what a Mac is,
let alone WORKED *their*.(tee-hee)
Hint: its not something you eat.
- "SunOS or Solaris": 64 total, since 95
(ca 10/year)
- "FreeBSD": 21 total, since 2000
- "Linux kernel": 16 total, since 2001
- "Red Hat": 23 total, since 1997
- "Debian": 39 total, since 1999
- "Apple": 49 total, since 2001
- "Windows NT": 80 total, since 1998
- "Windows XP": 76 total, since 2001
- "Windows 98": 26 total, since 1999
- "Explorer": 147 total, since 1999
- "Firefox": 19 total, since 2004
- "Outlook": 73 total, since 1998
The numbers are rough - for example, two hits on "Apple" were actually Windows vulnerabilities that seemed to have nothing to do with the company Apple.
Difficult to draw any conclusions - especially
that Linux/Unix would fare worse than the
Microsoft products.
* though they are also prone to virus attacks, files cannot be tampered with due to very strict adherence to permissions.. hence ur data is really "safe"...
* there are only very few cases of root privileges attack.. it happens mostly in softwares that we never use at our homes..
* the response time to write a fix for an attack is great because for the simple reason that there are many number of developers who know linux /unix and come up with a solution
there are many more, more, more reasons why u should not compare linux with windows... windows is a garbage that grows with age... he he :))
* though they are also prone to virus attacks, files cannot be tampered with due to very strict adherence to permissions.. hence ur data is really "safe"...
* there are only very few cases of root privileges attack.. it happens mostly in softwares that we never use at our homes..
* the response time to write a fix for an attack is great because for the simple reason that there are many number of developers who know linux /unix and come up with a solution
there are many more, more, more reasons why u should not compare linux with windows... windows is a garbage that grows with age... he he :))
* though they are also prone to virus attacks, files cannot be tampered with due to very strict adherence to permissions.. hence ur data is really "safe"...
* there are only very few cases of root privileges attack.. it happens mostly in softwares that we never use at our homes..
* the response time to write a fix for an attack is great because for the simple reason that there are many number of developers who know linux /unix and come up with a solution
there are many more, more, more reasons why u should not compare linux with windows... windows is a garbage that grows with age... he he :))
I had a job at a small appliance company in '99. Management, manufacturing, sales, and IT all used Windoze 98 or NT. The programmers mostly used FreeBSD. I had to exchange files with all of them. Much of the job for a while was editing the CEO's powerpoint slides. Lots of Excel and Word files. Lots of purty HTML email.
As far as I know, I was the only Linux user (SuSE, pre-Novell) in the place. I picked a window manager theme that looked like Windoz 98 and visitors to my office seldom noticed.
I was outed when the Melissa worm came through. All the Windoze boxes were ruined and had to be reinstalled. The FreeBSD users hadn't bothered to set up their own MTA and kept mailboxes on the NT server, so they were fairly dead too. I had the only working computer in the place.
If you work at a good sized place, I'll bet you've got stealth Linux users, too.
I got a spam from a server at a magazine publisher in Florida last fall. It was an unusual source (most spam comes from Windoze bot-nets on residential broadband) so I called them. Got through to the IT guy right away and he got on his Xserve box that second and confirmed he was compromised and sending. Called me back an hour later to tell me Apple's OS security folks had found the thing, and it was really small, and they were all astonished, and they wouldn't have known if I hadn't called.
So report your spam. Pick the weirdest one each week if that's all you have time for. And give CNet a hard time for not informing the world about which corporations are responsible.
These days you don't even have to install it to use it. Today's "live" CDs are so good the Windoze users don't believe it when you tell them. If you haven't tried Knoppix or Ubuntu yet, run do not walk to Knoppix.net or Ubuntulinux.org and be amazed.
- We don't know that
- by clsgis January 11, 2006 5:54 PM PST
- "Why is it that MS always waits for attacks before pluggin holes?"
- Like this Reply to this comment
-
(99 Comments)We don't know that. Hundreds of organizations have licensed Windoze source code. They're under strict nondisclosure agreements. It's *possible* the NSA or McAfee is poring over the Windoze kernel the way the public goes over Linux-2.6 and Apache-2.3, quietly reporting bugs before any exploit appears, and MSFT is quietly fixing them. I doubt it, but there's no way to know either way.