Security threats Toolkit

Story: Microsoft study finds Trojans are biggest threat

• 
• 

Biggest Threat to an OS is Administrative Privileges

ator1940 is correct that the operating system design is at fault for the majority of Trojan attacks/infestations simply because so many programs and operating options require Admin or near-admin privileges in Windows. I find though that most of the issues related to security of the OS are actually the results of bad decisions made by Microsoft management.

You can't operate Windows XP Pro even with SP3 on it without having Admin level access to an awful lot of the system. The alternative Microsoft OS, Vista was worse because it aggravated the user to such an extent and more than the Trojan infestation! Instead of sticking with it, users turn off the security features due to the freaking annoyances. Perhaps with SP1 Vista operates better but I'm not willing to go through evaluating Vista again after my experiences with the RCs and the public Beta.

The second operating system defect issue is the apparent ease at which malware seems to be able to elevate its privilege level even if the user isn't operating at Admin level. There is a fundamental problem with the OS if a downloaded script or HTA program can elevate itself above the security level of the current user. I point the finger straight at Internet Explorer as the guilty party. The decision made by Bill Gates and others to push the browser into the OS was the biggest freaking "pointy-haired Boss" mistake of all software management time.

Operating ANY browser on the Internet is a security risk and as such it should be isolated as much as possible from the rest of the operating system perhaps even to the extent that it operates in its own VM. If Microsoft wants to win me back as a supporter, one thing they could do is to do exactly that. That can be done right now today EXCEPT for some previous bad decisions made by Microsoft.

They need to offer a FREE special configuration of IE8 or 9 that operates totally isolated in its own VM and operable on XP Pro, Vista and Windows 7 when its released. That would require that they open up the EULA terms enough to allow a user to run two instances of the same XP or Vista license on the SAME system, something that VPC2007 doesn't currently allow. (Again a STUPID move Microsoft!) Two more tools to stick into the mix would be the Vista firewall and the Windows Defender into the IE configuration with the VM. That likely would allow the users that cared, a means to prevent their systems from becoming netbots.

• 
• 

• 
• 
• 

Full Talkback thread