Linked by Thom Holwerda on Mon 2nd Apr 2007 21:05 UTC, submitted by Dale Smoker
Windows Microsoft has decided to rush out a fix for a flaw in Windows, saying that the problem has become too serious to ignore. The flaw, which will be patched on Tuesday, was originally disclosed to Microsoft in December, but it was not publicly reported until last week. The bug lies in the way Windows processes .ani Animated Cursor files, which are used to create cartoon-like cursors in Windows.
Permalink for comment 227115
To read all comments associated with this story, please click here.
Member since:

{Malware don't care about your box, it cares about being able to comminucate with other malware and last time i checked (like 5 second ago) regular users can make outgoing connections and listen on local ports (above 1024). That's all a botnet need, for example. }

No, for several reasons.

Firstly, the "paradigm " on Windows systems is all wrong, from a security perspective. Users are routinely expected to install stuff. They often run as root. The typical means to install stuff is by running an uncredentialled executable, as root. There is no central, vetted repository of stuff to install, and users are expected to search for it themselves. Users have absolutely zero means of vetting or auditing the quality of stuff they install. Malware (for Windows systems) can hide in millions of places by virtue of the myriad closed-source applications. Finally, the vendor of the OS does not have user's interests in mind, but rather the vendor's own interest drives the functionality of the system.

The other paradigm on Windows systems is that "data files include executable instructions". As already mentioned, installation packages are typically executables, rather than passive data files. Picture files have executable hooks ... witness the .wmf security hole of recent times. Even mouse cursor definition files have executable hooks ... witness the .ani security hole of very recent times. CDROMS include "autoexecute" files. Office files include executable macros ... and so on, and so on. This type of "security hole just waiting to be exploited via embedding instructions in data" is absolutely riddled throughout the Windows world.

Finally, no-one can "hide" malware in open source programs. Open source programs are vettable and auditable, and are necessarily written in the user's best interest (otherwise other code would "win" in the meritocracy ... this is the major win of the open source paradigm versus the closed source model). So, if you simply adopt a straightforward policy on a Linux system which goes "only install stuff from repositories using your package manager" ... then you are guaranteed to never get malware.

There are no botnets for Linux.

Edited 2007-04-03 23:57

Reply Parent Score: 1