Microsoft: Sophos Windows 7 Malware Test 'Sensationalised'
Linked by Thom Holwerda on Tue 10th Nov 2009 09:31 UTC
Windows Last week, security vendor Sophos published a blog post in which it said that Windows 7 was vulnerable to 8 our of 10 of the most common viruses. Microsoft has responded to these test results, which are a classic case of "scare 'm and they'll fall in line".
E-mail Print r 5   · Read More · 108 Comment(s) http://osne.ws/hc6
Thread beginning with comment 393944
To view parent comment, click here.
To read all comments associated with this story, please click here.
RE[6]: They deserve it
by lemur2 on Wed 11th Nov 2009 01:57 UTC in reply to "RE[5]: They deserve it"
lemur2
Member since:
2007-02-17

"Firstly, Linux has significant market share in areas where it is an attractive target ... servers for example.
Sigh. Linux server != Linux desktop. Servers are locked-down far more than desktops. You can't extrapolate one from the other. Apples and oranges. Once you start opening up ports to run things like BitTorrent, web browsers, etc, the attack vectors become multiplicative. "

Nevertheless, the argument that "Linux is not an attractive target" is utterly debunked by the number of Linux servers.

"Secondly, in Linux the "paradigm" for installing new software is not to download & run stuff from some random website, but rather to use a package manager.
Um, that works fine if you only run open source software, but there are MANY cases where no open source application exists for what you want to do. So, what does a user do? Fail? I don't think so. "

No, you just don't think.

The package managers and repositories do not require that applications they contain be open source. There are binary-only repositories which allow for distribution of closed-source applications via package managers.

Being closed source means that such applications are not auditable, but that does not mean they necessarily contain malware. They can still benefit from the secure delivery channel to end-users systems offered by package managers.

As an example, Adobe's flash player for Ubuntu is deliverd by package managers. Ubuntu has a "third party repository" to provide for just this kind of distribution.

https://help.ubuntu.com/community/Repositories/Ubuntu#Third-Party~*~...
"The "Third-Party Software" tab is where you will be able to add the Canonical Partner Repositories. You will see two Canonical Partner repositories listed - one for applications and another for source code (src). The partner repositories offer access to proprietary and closed-source software and are not enabled by default. Users must specifically enable these 'partner' repositories. Select "Close" and "Reload" to save and update the database if you chose to add either or both of them."

"I have never heard of a single case, ever, of an end-user's system being compromised with malware through installing software using a package manager.
So what. There have been cases where repositories have been compromised. Only dumb luck prevented you from getting screwed by a malicious attack. http://www.eweek.com/c/a/Security/Security-Web-Digest-Major-Open-So... "

This is an incident where a GNU server was hacked. Broken in to. No system is invulnerable to a hack where a password is either guessed or illegally obtained. No malicious code was injected on to the server. No end users systems were compromised.

"Amongst many millions of Linux users, there has got to be the odd stupid one here and there you would think.
Millions? Talk about overly optimistic... "

Pfft.

http://www.desktoplinux.com/news/NS5114054156.html
"Eric Lai quotes ABI analyst Jeff Orr as saying that the study shows that 32 percent (about 11 million netbooks) of this year's netbook shipments will be used with a Linux-based operating system. "

There is 11 million desktop Linux systems right there, in one small section of the market, in just one year.

The fact that for thousands of packages, for many, many millions of users, over many years, the one incident that you came up with resulted in no end-users systems being compromised rather proves the point, doesn't it, about the relative security of Linux desktop software distribution compared to Windows?

Thankyou for illustrating it so nicely.

Edited 2009-11-11 02:05 UTC

Reply Parent Score: 1

RE[7]: They deserve it
by tomcat on Wed 11th Nov 2009 03:51 in reply to "RE[6]: They deserve it"
tomcat Member since:
2006-01-06

Nevertheless, the argument that "Linux is not an attractive target" is utterly debunked by the number of Linux servers.


BS. Those servers are running a paltry number of services and are locked-down tighter than a nun's thighs. Those kinds of environments aren't as attractive as desktops because the cost of finding and exploiting a vulnerability is considerably more difficult.

Being closed source means that such applications are not auditable, but that does not mean they necessarily contain malware. They can still benefit from the secure delivery channel to end-users systems offered by package managers.


Again, it provides no independent means of auditing, which debunks your claim about package managers being safer. They're merely another distribution channel.

This is an incident where a GNU server was hacked. Broken in to. No system is invulnerable to a hack where a password is either guessed or illegally obtained. No malicious code was injected on to the server. No end users systems were compromised.


So much for your "secure" claim.

There is 11 million desktop Linux systems right there, in one small section of the market, in just one year.


And, naturally, ABI doesn't offer any details to back up its claims on what MIGHT happen in the future.

Reply Parent Score: 2

RE[8]: They deserve it
by lemur2 on Wed 11th Nov 2009 04:18 in reply to "RE[7]: They deserve it"
lemur2 Member since:
2007-02-17

"Nevertheless, the argument that "Linux is not an attractive target" is utterly debunked by the number of Linux servers.
BS. Those servers are running a paltry number of services and are locked-down tighter than a nun's thighs. Those kinds of environments aren't as attractive as desktops because the cost of finding and exploiting a vulnerability is considerably more difficult. "

Sigh! This depends ENTIRELY on what you mean by "attractive". For your meaning above, you are correct, but that is not what was meant by "attractive" in the original context of the argument.

In its original context, which was "Linux systems aren't attractive targets for malware" ... the word "attractive" actually means what might be gained by the balckhats by getting their malware onto the target systems. In that context, servers are a lot more attractive than desktops, as they generally hold a lot more valuable information.

"Being closed source means that such applications are not auditable, but that does not mean they necessarily contain malware. They can still benefit from the secure delivery channel to end-users systems offered by package managers.
Again, it provides no independent means of auditing, which debunks your claim about package managers being safer. They're merely another distribution channel. "

When you add closed-source repositories, yes, you kind-of have a point (I have made another post about this). They are indeed then merely another distribution channel ... a safer-than-anything-on-Windows distribution channel with an impeccable record to date.

"This is an incident where a GNU server was hacked. Broken in to. No system is invulnerable to a hack where a password is either guessed or illegally obtained. No malicious code was injected on to the server. No end users systems were compromised.
So much for your "secure" claim. "

How so? Elaborate please?

PS: No system is invulnerable to hacking via knowing the password. None at all.

However, if any attempt was made to put a malware binary onto a GNU repository server: it would show up in the server logs; it would be auditable that it had happend by comparison to source; and there would have been an enormous hoo-ha made over it.

Once again, the reality about repositories and package managers is ... impeccable record. Impeccable.

"There is 11 million desktop Linux systems right there, in one small section of the market, in just one year.
And, naturally, ABI doesn't offer any details to back up its claims on what MIGHT happen in the future. "

So? ABI's predictions for the future are based on what they measure in the real world today.

BTW: Dell says that it sells one third of netbooks with Linux:

http://blog.laptopmag.com/one-third-of-dell-inspiron-mini-9s-sold-r...

Edited 2009-11-11 04:26 UTC

Reply Parent Score: 2

Read more of this thread... >