Get Smart about Business Spending
- Related Stories
-
First potential virus risk for Windows Vista found
August 4, 2005 -
Windows patch gets its own rumor site
August 1, 2005 -
Test run for Windows Vista
July 27, 2005 -
Commentary: The Vista for consumers
July 27, 2005
Instead, the software maker is looking at possibly delivering the command-line shell tool, code-named Monad, as part of its next major server operating system release, a Microsoft representative said. That release, code-named Longhorn Server, is due in 2007.
"Monad will not be included in the final version of Windows Vista," Stephen Toulouse, a program manager in Microsoft's security group, said in a blog posting. "So these potential viruses do not affect Windows Vista."
Microsoft is responding to the online publication of five examples of malicious code that target Monad. The tool was initially intended to be included in Vista. When news of the exploits came out, it triggered reports that they would be the first viruses for Windows Vista.
With the announcement, Microsoft is making it clear that the Monad viruses will not affect the client version of the operating system update, formerly known as Longhorn.
Monad, also known as MSH, is the replacement for the simple command shell in the current versions of Windows. A command shell lets users enter text-based commands, as in the predecessor to Windows, DOS. Monad has much more functionality, similar to shells in competing products, such as Bash in Unix.
Monad is available to testers, but is not part of the first Vista beta, released last week, Microsoft said Thursday. However, at the time, the company left open the possibility that it would be included in later test versions of Vista, saying that it had no further details on a specific delivery vehicle for the command line shell in Windows. Friday's announcement ended any confusion over Monad's inclusion in Vista.
Taking stock
Toulouse's posting follows comments from a Microsoft developer in another blog posting on Thursday criticizing security company F-Secure's claims of a possible first Windows Vista virus. "It's a misleading title, as it's an issue that affects any vehicle for any executable code on any operating system," wrote Lee Holmes, who works on the team building Monad.
"The fact that MSH is used as the execution vehicle is really a side-note, as it does not exploit any vulnerabilities in Monad," Holmes wrote. "The guidance on shell script viruses is the same as the guidance on all viruses and malware: protect yourself against the point of entry, and limit the amount of damage that the malicious code can do."
Toulouse gave no details on why Monad won't be part of Vista. He did say that the new shell is "being considered for the Windows operating system platform for the next three to five years."
While it is now clear that the new command line shell won't ship as part of Vista, it is still unclear how the technology will be delivered. Microsoft representatives have said Monad would first ship as a feature of Exchange 12, the next release of Microsoft's e-mail server, due in the second half of 2006.
In a TechNet Web chat for developers and technology professionals in December, Microsoft representatives said Monad will support Windows Server 2003, Windows XP and Longhorn, which then was the code name for both the client and server versions. Microsoft could release Monad as an operating system update or downloadable add-on.
See more CNET content tagged:
Stephen Toulouse, Microsoft Longhorn, shell, blog posting, Microsoft Windows Vista
Windows is build in such a way that quite a lot of people are using it with administrative rights. Using powerfull scripting on top of that makes it dangerous as the script will also be executed with administrative rights.
On the *nixes this threat is less present. Everywhere it is stressed that using the root account is insecure, so scripts have less power, as most of them will be executed with user rights.
It's not the features of windows, but the architecture that are making it such a willing victim of spyware, viruses, ... The features (new and old) just make it easier to exploit the flawed architecture.
- Misleading Report
- by Mendz August 7, 2005 1:46 AM PDT
- This is the second time CNET is misleading the public about scripting. Unix, Solaris, Linux, Mac, etc. have scripting support after which MSH is more or less patterned. It is unfair to specify that MSH is unsafe. If MSH is unsafe, then it is safe to say that all shell scripting languages are unsafe. And, therefore, all OSs with shell scripting support are not safe. It's a shame this article is ever published after an earlier report on Monad which is similarly misleading.
- Reply to this comment
-
-
- Geez!!!
- by Mendz August 7, 2005 2:04 AM PDT
- It's the same author... Tsk, tsk, tsk...
- View reply
Processing -
- Scripting in combination with architecture
- by Steven N August 8, 2005 4:37 AM PDT
- It's the combination of scipting possibilities and the way windows works that are a dangerous combination.
- View reply
Processing -
(34 Comments)Windows is build in such a way that quite a lot of people are using it with administrative rights. Using powerfull scripting on top of that makes it dangerous as the script will also be executed with administrative rights.
On the *nixes this threat is less present. Everywhere it is stressed that using the root account is insecure, so scripts have less power, as most of them will be executed with user rights.
It's not the features of windows, but the architecture that are making it such a willing victim of spyware, viruses, ... The features (new and old) just make it easier to exploit the flawed architecture.