Printable View
Was reading this article http://technet.microsoft.com/en-us/m...77windows.aspx and came to point 5.
Will this spell the end of needing an AV on your system? You can lock-down any software application on your network.
I am going to test this on my home computer ...
Any thoughts.
If you dont know what I am talking about , you can DL the tutorial from http://www.microsoft.com/downloads/d...displaylang=en
I havent read the article yet (I will though).
The answer to your question is no, there will forever be a need and requirement for AV software.
Why? Besides the fact that AppLocker does very little in protection, rather it restricts what the (already authenticated and installed by the user) software can do. You still need to prevent your computers and networks with firewalls and AV products to prevent unauthorised and malicious use of your assets as well as the chance of becoming a "zombie node"...... Really, on this point, which I continually and often re-enforce to clients I could go on and on and on and on.... and on :)
CTO
Bull***t :pQuote:
Use it to enhance or even replace your anti-virus software, ensuring that only the software you want to run will run.
Believe only half of what you see, and none of what you hear or read.
I thought reading was power and knowledge. Someone lied to me! /cutting up the libary card now.
Reading isn't power; Reading is the electric cord, Power is the plug in ability to realize when something is bullshit. ;)Quote:
Originally Posted by Cider
EDIT:
The forever needing AV isn't totally correct; Windows has that need, but if you look at most Linux and BSD AV products, a lot of them only check for virii so you don't accidentally send one to someone running Windows. I can't remember which one has that as their product description, but it said that basically it checks for Windows virii and is merely a way to make sure you don't infect friends running Windows since they can't normally touch you anyway unless you're dumb enough to use Root for everything.
Would the statement; "Linux & BSD OS' would be just as likely to be infected as windows providing that infections were written to attack said OS" ?Quote:
Originally Posted by gore
Or are the Linux/BSD OS' naturally protected or shielded?
I have no clue :p But until gore's comment I thought these OS's were simply less prone to attack as they are non-user friendly etc etc or "less popular" or simply there are just more Microsoft products in the world and they are much easier :p
?? Curious ??
That's 50/50. Because they're only less popular on desktops:Quote:
Originally Posted by CybertecOne
More than 60% of all Web Servers are running Apache, which, as you may have guessed, runs on Linux, BSD, and does run on Windows, but, most people running that are generally running it on Linux and BSD.
So they already have a market share even bigger than Windows when it comes to servers. Some people used to say all the time "Well, if Linux / BSD were used as much as Windows, people would write virii for them!" well, Apple is aimed at the technical idiot and it's core is FreeBSD. Have you seen any Apple virii lately?
It does have SOME truth that, if Linux and BSD were the same sized install base as Windows, yea, a lot more people would be trying to put virii on those machines, but, the truth that no one wants to admit to is that it's just not as easy.
The last Worm for Linux? Spread around the net targeting RedHat Linux...hat was the payload? It PATCHED YOUR MACHINE FROM FURTHER INFECTION! lol.
So yea I'm sure there would be more people TRYING to spread viruses on Linux and BSD, but Linux and BSD both make it a lot harder for it to happen.
The non user friendly thing hasn't been true since like 2003 or so. Even then it wasn't true like it was in the late 1990s.
Back then, yea, apparently Linux wasn't easy to use. I got my first computer in 1999, and a year later I had BSD and Linux both, and neither one was hard.
When SUSE 8.1 Professional came out, I started using it and ONLY it on my boxes. The user friendly part was actually better than Windows XP.
Burning a CD-ROM of an ISO in KDE on Linux, or BSD:
Click on ISO file, have Writable CD in drive. It checks the MD5 Sum for you, without you havign to tell it too, and you click start, it burns, you're done.
Windows? Navigate through 300 menus, make sure you set it to burn as an image so you don't have a useless Coffee Coaster after, and wait.
SUSE and RedHat both also had hat Taskbar Security updates checker before XP did. Well sort of... The code was around then, but at least in SUSE 8.1, when I started using it, I wanted to get updates installed and was like "Well, I will go to the site and check for what I need to install" because I came from Windows and thought I had to install all these things one at a time, reboot, all that.
I found out I didn't.... You know what I did to install updates? I clicked on the thing in the taskbar, typed root's password, and it grabbed ALL of them. And if there isn't a Kernel update, no reboot either.
So not only could I install everything, I could also, with one mouse click, tell it "Just grab all updates for me and install them without bugging me" and it would!
And no reboots!
I was amazed how easy it was. And if you wanted to do it yourself, you could open YaST2, go to updates, and it showed you, in a nice GUI format, "Here are the security updates for you" and then "These ones aren't for security they are just bug fixes" and then "These ones here are new features, and new drivers we found for you" and install them....
Even a new video driver update didn't need a reboot. You would just shut down X Windows, and load it again, and it worked!
Shutting down X was no big deal; ALT+CTRL+BACKSPACE and it shut down and restarted X for you.
I was amazed.
So anyway, everything right now that isn't Windows, is somehow based on Unix. Linux, BSD, Apple's Mac OS X, all have something in common:
They use BSD sources at their core. And there still aren't much for any viruses for these things.
That means every illiterate Computer user who bought a Mac because they saw that Apple commercial about how they were easier than Windows, is running BSD on a super pretty GUI, without a virus. So in a way, they already have that market share that would make them popular enough to target, but in the Unix world, you have REAL user accounts.
Remember Windows 95 and Windows 98? You could click on Cancel and get system access. NT, 2000 and Windows XP, have user accounts, and unlike those OSs, you actually have to set up a user account without root privs for yourself, which means you only use root to install stuff and do admin work, which today is so easy you rarely need to, because you can make a cron job to do almost everything for you without ever logging in as root.
And FreeBSD has Jails and other means of making things run inside a little box that can't touch your system.
If you aren't sure about a piece of software, run it in a jail, or somewhere like a sandbox, and it can't infect the box.
And if you run something as a normal account, it can't infect the machine it's running on because a normal account has no root privs so it can't even look at system files.
A user opens some exploit? Oh well, back up their files that aren't infected, make them a new account to move their crap to, and delete that account, boom, gone.
I can go into more if you'd like me to, but I feel like I'm rambling on, so I'll stop here for now, but I'm happy to talk more lol.
Nice post gore :) cheers on the insight
CTO
Thanks. I was half asleep trying to think "OK, you wrote a paper about this once but... Oh yea, you didn't ever publish it!... Hmm, how to explain" and then, in my half asleep way, I rambled on and on. I looked at it after that and read some of it thinking "Man, I'm rambling, I can just stop here so I don't end up with like 900 pages of crap and if they want more info, I'll go into detail later when I've slept" lol. I finally got to bed around 10:30 AM and I'm up again because tonight is "The Rocky Horror Picture Show" and since I've never been to it I have to go cause my Wife said so lol.
NP: NOFX - Theme from a NOFX Album
HAHA - Have fun! Ive never been to a Rocky Horror show but heard they are fantastic :p
Well to get back to the topic, if you look at the enthusiasm shown by Windows users fo UAC, I don't see this flying at all.
Also consider most still log in as administrator, and many attacks are at the applications layer these days, where the application is already approved and running.
Most Windows users don't want security..............I sometimes wonder how many could actually spell it :rolleyes:
And AV/Security products are here to stay.................if you hadn't noticed there is rather a lot of money to be made out of that sector;)
err ... so im in the right trade Nihil ???
It certainly looks that way given that OEMs bundle trial versions of security suites.
One thing that has always amused me is that whilst Windows users don't seem to like UAC, least privilege accounts or locking down their systems they seem quite happy to buy security suites that frequently make their systems run like absolute dogs.
Of course, from a corporate viewpoint it is a whole different ballgame. A lot of IT managers look on their AV suites as an insurance policy. Senior executives generally haven't much of a clue so if you don't have AV and you get hit, you will be fired.
On the other hand, if you do have AV and you get hit you took the perceived required precautions so it wasn't your fault ;) A case of job security rather than systems security :D