Comments on: The next generation of security threats

Forget widespread worms. Nowadays, limited-scale threats like targeted e-mail attacks are causing the most concern.

[Ted Miller]

I could be wrong...

...but I believe hackers don't bother hacking Vista because of Vista's unpopularity. Not enough people out there are actually using the operating system.

I worked on a womens Vista laptop over the weekend and she was almost in tears because she could not write her articles like she could on XP. She was upset for being forced to buy Vista.
I think she reflects the feelings of a lot of people out there.

My complaint about Vista is its crappy file management system. I cannot believe how hard it is compared to XP in the downloading moving and saving files.

I believe Microsoft has not a clue of what is really going on out there in the real world.

I am a Microsoft user and will be for a period of time to come. I do hope the hackers will come and fix the file management problem in Vista since microsoft can't seem to do things right.

I understand that Apples Lepherds software has problems like vista, but their Tiger is great. I also have a collection of various Linux distros and they are also very good. I think PCLInux and Ubuntu are excellant. So you advocates please don't bother us!

[Penguinisto]

Not really.

FWIW, Vista has bugs and nasties too... and not because of any
popularity.

Leopard had a few teething troubles, but none were major and it
should be fairly smooth sailing once they're ironed down (no
operating system really escapes this, except Debian Linux (which
uses only proven code in its releases) and FreeBSD (ditto)).

Advocate? No... I shan't in this particular response, as per your
request. You have the natural right to make your own decisions,
and the responsibility to either make do with them or to improve
what you can. If you want to run Vista and suffer that badly
under it (as you yourself have expressed), that's your business.

/P

[Penguinisto]

"Applications are dangerous"

How... disingenuous of the MSFT flack to say that.

Yes, [i]applications[/i] are dangerous... it's part and parcel of
security on any computer.

However, how come data files (e.g. powerpoint files) have to be
so dangerous (to a Windows user) as well?

Family photos, important documents, music... those things
shouldn't present any danger at all to a user (and on Mac and
Linux, they don't). Yet even the [i]screen saver[/i] (*.scr) on a
Windows box could hide potentially nasty bugs.

***? covering up poor programming practices and bad design
with 'oh, apps are dangerous - we got your money, so deal with
it'

Increasing numbers of us have found a better way, thanks much.
And as a bonus, I don't have to live in fear of my applications,
either.

/P

[Ina Fried]

re: Applications are dangerous

A couple of things in response. First, the person who said this wasn't a flack--It was a Microsoft security engineer speaking to a room full of his own company's engineers. I was the only reporter there.

Your point about protecting files is a good one. It is an emerging threat for the industry, not just Microsoft. But clearly Microsoft, particularly with Office, is one of the biggest targets. The company said that part of the impetus for the new Office file types is to make them more impervious to attack. Of course, the proof there will be in the pudding.

[whmurray]

Object Interpreter Applications

The class of application that is most dangerous is that of common object interpreters. They present a large attack surface because they are popular and widely used.

Many of them contain escape mechanisms that permit the object being interpreted to invoke the execution of programs. These programs my be external to or included in the object itself. MS Word was so bad about this for so long that Word objects are now generally feared.

While this capability is useful its utility does not justify the risk.

Until recently pdfs were preferred to docs because Adobe controlled the specification of the object and the interpreters (Adobe Reader and Acrobat.)

The original intent of pdf appears to have been to encapsulate a printable document. However, many pdfs are only, or preferably, viewed rather than printed. (I try never to print.) Adobe, which now also owns MacroMedia Flash, says wouldn't it be nice if an object could also contain moving graphics. Oops there went the attack surface.

When an object type is very popular, new interpreters emerge. I now have a number of programs on my computer, including, for example, the FoxIt viewer that will interpret pdfs. Oops. There it goes again. To get an idea of how bad the problem is, look at the size of the latest version of the Reader. The bigger and more complex the program, the greater the opportunity for error.

Remember the idea of Object Oriented Programming, in which the object would encapsulte both the data and all of the methods and procedures that could operate on it. The market preferred the traditional model, in part so that the common methods would not have to be replicated for each object.

Now the methods are proliferating and becoming more complex. Part of the problem is that the decisions about the functionality of the program and the risk associated with it are separated from one another and made by different people.

All that said, everyone should have seen this coming. We fixed the transport layer and attacks moved to the server. We fixed the servers and attacks moved to the client. We fix the OS and attacks move to the applications. First they moved to the browsers. Now they are moving to "plug-ins" and helper applications. Where is the surprise.

[SenorFrog]

PDF FILES

With all the "goodies" Adobe is planning on putting in the latest and greatest, will they also be making sure that businesses and government offices can continue to use the PDF/A format (which I believe is for document reproduction and nothing more)?

[chash360]

There are smart people out here!

I thought I was preaching to the deaf....You actually understand what is the problem with this, awesome. The Object interpreters could be made much safer if the really critical functions are separated. That being functions that can Access, Create, Edit, Or Delete Processes or Files. All other code is relatively harmless GUI or logistics. Executable processes, code, etc. that contain such functions should have mandatory permission sets just like users, such that they can be set by compotent users, to prevent unwanted activities. Then, Ideally, if I set IE such that it is not allowed to access my secured data folder, then it can not access it! If I set Outlook express to not be able to write to any file it does not already own, and can not create new ones with out prompting me, I just protected myself against a whole lot of malware that is out there. If a file contains macros for a macro language in some application, (or webpage with a script) that includes the afore mentioned functions, then it too should have permission sets, because in essence it is an executable, not just a flat data file. It just happens to be a file that an application executes, as opossoed to the OS executing it directly. This is how these holes start, your application is trusted, even if the file or script isn't. If the code does not contain these functions, it can not actually do any damage to your system.
There is no suprise about all of this, they knew they were breaching good security practices, M$ showed everyone the way how to completely screw up security, and now they have created an entire industry around the problem. Almost like a pharmecutical company, make more money treating symptoms (and medication side effects), and at all costs avoid curing the root cause.

[whmurray]

"Threats"

This article is not about "threats." It is about potential attacks, vulnerabilities, and risks, not threats. To maximize the utility of the words, we need to learn to use them in a consistent and mutually exclusive manner. They are not interchangeable.

[Schratboy]

New Threat Smet!

Crikie! Most IT managers don't even have a freaking handle on the basics let alone worrying about all the so-called new threats. None of the hype matters as long as owners and administrators continue to "Fly Blind" and don't know how their network is being used. Fundamental knowledge is the best defense and doesn't require excessive instrumentation, expensive or technical skill. A little bit of knowledge and policy goes a long way to keeping data and assets safe and risk-free.