Category Archives: security

security, software

Bloor on the failure of antivirus products

1 Comment

Robin Bloor has another pop at the antivirus industry in this Businessweek comment.

I agree with him. The failure of PC security is easy to prove. Most users have it, yet infections remain common. I am not saying that AV software is completely useless. No doubt it prevents some infections. However I am not convinced that it is worth its cost, which is threefold. First, there is the cost of the subscription. Second, there is the performance impact. Third, it’s not unusual for AV software to interfere with the normal running of your system, through false positives, conflicts, or disabling useful features. At worst, bugs in AV software have been known to make a computer less secure than it would be without it.

A further concern is that users may think they are fully protected by some supposed “security suite”, and therefore make bad decisions about what they download and execute from the web or from emails.

I am not suggesting that everyone removes their AV software. I do suggest that it is considered a last resort. If the malware gets so far that only the AV software catches it, something else is probably wrong.

 

Technorati tags: ,
security, software, windows

Vista is on MSDN. Now for the tricky decisions.

MSDN subscribers can now download the final build of Vista, which means it is available to a large number of people outside Microsoft for the first time.

If you are one of them, you will have one or maybe two tricky decisions to make.

I take it for granted that you will install it, for test and development of course.

First, do you upgrade the release candidate? Or clean install? Daniel Moth says the upgrade is OK, but I plan to do a clean install eventually, despite the hassle. Otherwise there is always the nagging worry that something which doesn’t work right is broken because you upgraded.

Second, do you enable or disable UAC? This is a hot potato. If UAC is widely disabled, then Microsoft’s best effort yet to secure Windows will have been wasted. On the other hand, it is undoubtedly annoying, and in the worst case some app you depend on might not work at all.

I’m keeping it on. With RC2, I’ve found ways to run all the apps that I need to have working, even including Borland Developer Studio 2006 (a very problematic install, though it may be better in the final release build).

As I said to Dan Fernandez:

My view is that Windows security is a huge issue both for Microsoft and actually for every internet user. UAC looks like a pretty good effort to improve it, so to my mind it is in all our interests to try and make it work.

That said, I’m not optimistic. I think lots of people will disable it; I’m also waiting for the first support notes from third-parties that give users the steps to do this – like the little leaflets that come with video cards and other hardware, explaining that you must ignore the warnings in XP about unsigned drivers.

By the way, although Vista is now final, there is still going to be a lot of pain around drivers as well as application compatibility. For example, the Vista drivers for my Toshiba Portege M400 are still in various states of beta, and no doubt the fingerprint reader still does not work. It’s going to be a while before the situation improves and users get anything like a smooth upgrade on this kind of hardware.

Update

See Ed Bott’s post and the linked article for an illustration of the extent and impact of the Windows security problem. The article analyzes a recent pump-and-dump spam attack. Apparently 99.95 of the botnet machines used were Windows, 47.23% XP with SP2.

Technorati tags: , , , ,

security, software, windows

Microsoft’s deeply-ingrained local admin culture

If you go along to the Microsoft Office Developer Center you are currently offered a “Developer Map for the 2007 Microsoft Office System”. It’s described as a poster, but is delivered as an executable. I’m normally suspicious of documents that come as executables, but this is a Microsoft site so I downloaded and ran.

You know what? This thing installs by default into a new folder on the C drive, which means it requires local admin rights. And what does it install? Just a PDF.

Personally I think delivering a PDF as an executable is crazy. Perhaps the author wanted to be sure it wouldn’t open within the browser; a zip would have been fine for this.

You can avoid the admin rights requirement by manually changing the target directory. Few people will do this, because we have learned that changing default directories is often a mistake.

This small incident demonstrates something big, which is the deeply ingrained culture of local admin rights on Windows. I presume that whoever tested this little executable was running as admin, otherwise this unnecessary and annoying requirement would have been spotted and removed.

It chimes with a remark made to me informally at last week’s Tech-Ed, that Microsoft staff running Vista commonly disable UAC (User Account Control), thus removing the most significant security feature in the new Windows.

It is a vicious circle. Microsoft runs with local admin rights, so it issues resources that require local admin rights without even noticing. That means users with lesser permissions or UAC get annoying problems, making them inclined to run with local admin rights as well.

The outcome: Windows stays insecure. Windows botnets proliferate. Malware flourishes.

If Microsoft is serious about security – which I believe it is in some quarters, it must get its own house in order. For the vast majority of computer users, including developers, running as local admin should not be necessary. That means a change of culture and will be hard to achieve; but if Microsoft itself does not make the effort, the world at large has no chance.

Technorati tags: , ,
security, windows

Vista application compatibility: it’s not going to be fun

I remain concerned about application compatibility and Vista’s virtualization. Here’s an example. After setting up a Tablet PC with Vista RC2, I installed one of my favourite time-wasters, a game called Jack Bridge; not a major piece of software, but typical of countless existing Windows applications that users will want to install on Vista. Setup seemed to go OK, though Vista threw up this perplexing and alarming dialog:

 

Trouble is, at this stage I did not know if the installation was successful or not. Nor is it obvious what the consequences of the two options might be, or what Cancel will do. I took the view that I would rather try it as-is for the moment, and clicked “This program installed correctly.” And so it seemed, to begin with. Everything was fine until I used an option in Jack to check for updates from the Web. The update downloaded, but failed to install with this error:

   

To be honest, I was expecting something like this. The application was attempting to download the update to its folder in Program Files, and then to execute it. Neither operation could succeed, since UAC makes Program Files read-only. I can’t explain the Dutch; it looks like the app has imperfect localization. As a further test, I tried logging on as a different user and running Jack. This was really bad. Jack failed to run, warned me of severe errors, and advised that I contact my reseller. The problem here is the virtual store. Vista tries to help applications such as Jack by seeming to allow read-write access to Program Files, but in reality writes the data to a user-specific virtual store. This means each user gets a different view of what should be the same files. It all happens behind the scenes; if it goes wrong the user has no idea what has happened. I mostly approve of UAC, but I fear the virtual store may cause more problems than it solves.

In the case of Jack, I found a good workaround. I uninstalled it, then reinstalled to a location in my user directory. Jack has read-write access without trickery, and everything works, provided I always run as that user. How many other applications out there are going to have problems with UAC? My guess is a lot. Some of the above may improve in the final release – maybe the dialogs will be better worded – but I’m not expecting fundamental changes. Existing applications are going to cause users immense compatibility hassle. In consequence, they may disable UAC, which will greatly reduce Vista’s security; or they may decide Vista itself is more trouble than it is worth.

Let me be clear: disabling UAC is not a good idea. Users running with local admin rights is a large factor in the Windows security problem, and UAC is a reasonable solution. But I’m expecting the  worst. When Vista hits the world at large, will the buzz will be: turn off UAC or nothing will work properly?

Update

I couldn’t help wondering what would have happened if I had let Vista “Reinstall using recommended settings”. I had a struggle fulling uninstalling Jack in order to try this option. Eventually I found the registry key at HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted, and deleted the reference to install.exe. Reinstalled, and when the dialog appeared chose “Reinstall using recommended settings.” The installation tried to run again, but immediately closed; I guess because the installer considered the application already installed. I removed it through Control Panel and once again reinstalled – my hunch is that the “recommended settings” were automatically applied. If I show properties for the application shortcut, it says “Run this program in compatibility mode for Windows XP (Service Pack 2)”. However it doesn’t seem to help with the specific problems I encounted. Online update still failed, and when I logged on as a different user and tried to run Jack, I got the “please contact your reseller” dialog.

I am not trying to be difficult here. Rather, I’m trying to replicate some typical scenarios when users are confronted with these difficult dialogs.

Technorati tags: , ,

internet, security

IE7: 22 hours to catch a phish

6 Comments

It is now 24 hours since I received an obvious phishing email in my inbox and reported it through both IE7 and FireFox 2.0. Two hours ago, IE7 still said, “This is not a reported phishing website”. Now it’s finally made it:

If this is typical, then the IE7 phishing filter is little use. Phishing sites don’t last long, usually only a few days. Most victims will click that link the moment it turns up in their inbox, not a day later. Speed is of the essence. After 22 hours, most of the damage will already have been done. 

Actually, the IE7 phishing filter could be worse than useless. The message, “This is not a reported phishing website” imparts a false sense of security, making it more likely that someone will tap in their personal information.

Checking again in Firefox, it now catches the phish on its downloaded-list settings, which is the default. Using the dynamic query option in Firefox caught it earlier, but even that won’t catch a brand new phish.

Let me add that anyone clicking one of these links is ignoring plentiful advice from banks and from the media; and in this case the lack of an SSL connection is another sure-fire indication that this is a forgery. But some phishing attempts are cleverly phrased, making you think that someone has placed an order in your name, or hacked your paypal account, or damaged your eBay reputation. In the heat of the moment, it is easy to make mistakes.

Conclusion: Don’t rely on phishing filters to protect you; and if you want to use the one in FireFox, turn on dynamic queries (which means sending a record of your browsing activity to Google).

Technorati tags: , , ,
internet, security

Phishing part 2: Firefox gets there first

5 Comments

It’s three hours since I reported a phishing site to both IE7 and Firefox (Google). I revisited the site in both browsers. At first, Firefox displayed the site as before; but then I switched it to query Google dynamically. Presto! this appeared:

Note that the dynamic query setting is not the default, presumably because of its privacy implications. However, it is clearly more effective than the default downloaded list.

At the time of writing, IE7 is still saying “this is not a reported phishing site”; even though I reported it several hours ago.

This research is not bullet-proof. For all I know, someone else reported the site yesterday. Still, it’s an indication.

I’m still not clear why these browsers can’t figure out that this looks like a banking site, it’s asking for a password, but it’s not an SSL connection – perhaps we should alert the user. That doesn’t strike me as particularly advanced analysis.

See here for an update.

internet, security

FireFox 2.0, IE7 both fail phishing test

1 Comment

I’m not in the habit of visiting these sites, but when an email apparently from Bank of America plopped into my inbox a few minutes ago, it seemed the ideal moment to test out my brand new browsers – release versions of IE7 and Firefox 2.0.

The score is tied at zero for both browsers. Here’s the site in IE7:

Looks good, doesn’t it? No little padlock; so just to be sure I clicked Tools – Phishing filter – Check this website:

Personally I think this dialog is overly reassuring. Further, it strikes me that most sites where you suspect phishing are probably aping a site that uses SSL, so the dialog could usefully alert me to this. Never mind, let’s try Firefox 2.0:

No better, sadly. I tried both the options in the security section, including the scary one that sends all your web activity to Google, but still FireFox failed to warn me that I was about to give away precious financial secrets.

Luckily I don’t have an account with Bank of America. Still, the lesson here is that that neither browser is magic. There’s a delay between the appearance of a phishing site, and its blacklisting. It’s the same problem with anti-virus signatures: default permit is a broken security model. You have been warned.

Incidentally I reported the sites in both browsers. No instant change; but I’ll try the url again later.

PS: see here and here to see how quickly IE7 and Firefox started detecting this fraudulent site.

apple, security

Apple ships virus, blames Microsoft

Apple has confessed on its site to shipping some iPods compete with an unwanted guest, the Windows RavMonE.exe virus.

Here’s what Apple says:

As you might imagine, we are upset at Windows for not being more hardy against such viruses, and even more upset with ourselves for not catching it.

Funny; though I doubt Apple is all that upset since it uses Windows viruses as a marketing pitch in its rather inaccurate page on the subject.

Maybe this is what they call viral marketing 🙂

Tags: Apple microsoft security ipod

security, windows

If Microsoft doesn’t use UAC, why should anyone else?

2 Comments

Hey Doug, I don’t want to pick on you but this…

There are a few things about Vista that most “power user” types change, and so have I. I have the UAC stuff disabled, since I’m installing and configuring so much software right now that it just feels in the way.

Doug Mahugh is a technical evangelist for Office 2007, and this is from his blog. He’s probably one among many Microsoft folk disabling UAC – though I hope otherwise – but it’s a big mistake.

What’s the biggest problem with Windows right now? Security, right. And what’s the centrepiece of Vista’s security solution? UAC, right. So it strikes me that anyone evangelising Microsoft software should be evangelising UAC as well.

There’s more. Consider Outlook, for a long time a decent Exchange client, but a poor standalone email client and PIM (Personal Information Manager). One of the reasons is that everyone at Microsoft uses Exchange. So they didn’t suffer the problems of standalone Outlook, so they didn’t beat up the product team about it, so the problems went unfixed.

More than anyone, Microsoft folk need to use UAC and ensure that it works right.

Bottom line: don’t disable UAC.

Tags:


security, windows

Vista security: now prove it

Microsoft says Vista is more secure – but nobody out there will believe it. They “know” that Windows is insecure, and even if Vista really is a secure operating system, it will take a long time to change that perception.

How secure is Vista? Nobody knows as yet; though I don’t doubt that enormous effort has been put into this aspect of the new Windows. There are also some solid security advances over Windows XP. Users no longer run with local admin rights by default – even if they have those rights, they are disabled unless processes are specifically elevated, which means passing a dialog. Another key improvement is that Internet Explorer is sandboxed.

Having said which, everyone will be watching for security alerts and “Patch Tuesday” fixes after Vista’s final release. Undoubtedly when the first flaw is discovered Windows will be proclaimed as insecure as ever.

That’s not necessarily so. All operating systems have security flaws. But Microsoft’s challenge is twofold: addressing first the technical issues, and second the public perception.

The latter may be even harder than the former. For sure, it’s gleefully exploited by competitors. Apple says on its site:

Connecting a PC to the Internet using factory settings is like leaving your front door wide open with your valuables out on the coffee table. A Mac, on the other hand, shuts and locks the door, hides the key, and stores your valuables in a safe with a combination known only to you. You have to buy, configure, and maintain such basic protection on a PC.

Apple’s statement is mostly false. A new, default installation of XP with SP2 (which is how PCs are supplied) has an effective built-in firewall; although a router with NAT is safer, you can connect a cable modem directly and intruders can’t get in. I had a machine connected like this for 2 years always-on, in pre-SP2 days but with the built-in firewall enabled, and suffered zero successful attacks.

Still, Apple is correct in saying that numerous viruses target Windows and there are a large number of infected machines, largely I suspect because users run as local admin and they (or their children) cheerfully execute malicious scripts and executables. Can Vista stop this happening, even though such users will need to pass a dialog? Probably not altogether.

The best hope then is that Vista will be mostly secure for sane users. The worst scenario is that people are persuaded to turn off UAC (User Account Control), and instead put their trust entirely in ineffective third-party utilities, only to grumble a few months down the road that Windows has let them down again.

In security, nothing changes quickly. Watch this space.

Tags: