is windows insecure by default?

it must have been discussed before i am not posting this here to make anather " linux is better(secure)as compared to windows" thread we all know that and we all agree to that although microsoft responds to security vulnerabilities pretty fast but still i believe windows is insecure by default.
take a look at these two links
http://zone-h.org/en/advisories/read/id=6392/
http://www.packetstormsecurity.nl/fi...rflow.pdf.html

one microsoft product having medium level security vulnerability and anather windows based player having buffer overflow.
although second is not microsoft related bug but still i am posting it here.
what i was thinking while reading these two post is "what microsoft can do to make windows better in terms of security?"
if they make windows an open source OS would it make any difference to softwares like winamp to not make these stupid mistakes( i think this is third exploit in a short time fow winamp)

again the first vulnerability in IE confirms that microsoft needs major changes if they want to be anywhere close to linux.may be they have to design a new OS right from the beginning.

if u still have any doubt or if u don't agree a little bit see this:()
http://www.packetstormsecurity.nl/fi...ched.html.html

Technically, yes it is.. However (and IMO) that kinda question is somewhat ignorant, no? Sorry, just the way it sounds is a tad ignorant IMO.

Quote:

---

i think this is third exploit in a short time fow winamp)

---

WinAmp is now owned by AOL. In the true sence of the word 0wNeD....................Is there a coincidence, or is the fact that Nulsoft has lost there indipendence got something to do with it?

Quote:

---

it must have been discussed before i am not posting this here to make anather " linux is better(secure)as compared to windows" thread we all know that and we all agree to that although microsoft responds to security vulnerabilities pretty fast but still i believe windows is insecure by default.

---

Actually Linux is neither more secure than Windows by default. (ever looked as to what is open and closed for a default linux install?). Both can be locked down well by the administrator after the fact and both are dependent on having a decent administrator (this varies by degrees with which linux distro you use). That said, however, I have strong suspicions about MS's lifecycle controls and that they still seem to miss out on the testing portion. I suspect that they aren't going beyond the box (that is, intended input/output) to do testing.

Now, Winamp isn't MS's responsibility or fault. That's those coders responsibility/fault. It'd be like saying that exploits that expose Apache are the fault of Red Hat or SUSE. So that should be considered a separate issue.

Quote:

---

what i was thinking while reading these two post is "what microsoft can do to make windows better in terms of security?"
if they make windows an open source OS would it make any difference to softwares like winamp to not make these stupid mistakes( i think this is third exploit in a short time fow winamp)

---

Maybe, maybe not. Putting it open source however won't be something that will happen.

Quote:

---

again the first vulnerability in IE confirms that microsoft needs major changes if they want to be anywhere close to linux.may be they have to design a new OS right from the beginning.

---

No, they don't need to design the OS over again. They do need however to redesign IE. They did it for IIS. IIS 6 has had huge improvements and I don't think I've seen a single exploit for this version as of yet (I know it's relatively new but still... ). On this same line, KDE needs to deal with KDE's Konqueror (type Konqueror and then hit Submit. You can do comparisons with Mozilla, Netscape, FireFox, Opera, etc. IE probably has the highest in a short period but many are close -- Konqueror just had a new one announced on FD either today or yesterday IIRC)

Quote:

---

if u still have any doubt or if u don't agree a little bit see this)
http://www.packetstormsecurity.nl/f...tched.html.html

---

That's just the same exploit as the first one above, just described differently. You said this wasn't a "linux is better than Windows" but it sounds like it. If you don't like Windows, don't use it. If you like Windows, then learn to secure it. The same can be said in reverse for Linux.

Quote:

---

i believe windows is insecure by default.

---

You are absolutely correct young man!

I have a Norton AV disk.............5.25" ( :eek: ) that claims to detect "ALL 726 known computer viruses" ( yes, seven hundred and twenty six)

Security was not an issue when I started in the game :D NO OSes were secure........

What we really need is a good World War to get these skiddies walking in minefields?..............the draft..........no (S)kiddies rights............they are beaten into them by a master sergeant?

And I would go after the parents (terminate them to protect the human gene pool?) if they supply a computer to one of these slime balls, they might as well have supplied a .45 auto, for all the responsibility they have shown?

But I was always a reasonable man?
:D

Quote:

---

What we really need is a good World War to get these skiddies walking in minefields?..............the draft..........no (S)kiddies rights............they are beaten into them by a master sergeant?

---

The removal of skiddies would result in the degeneration of my intellectual superiority feeling because it would take away many idiots, so I vote against. :D

Windows has evolved from a time when security was not an issue
for PCs. Not that long ago, the PC wasn't powerful enough to be a
server, so its single-user OS was wide open and simple. Servers
ran on special hardware. Now, there's been so much progress that
we're barely able to catch our breath.

Windows NT was designed for business and school LANs, not to be an
internet server. Features have been grafted on, without removing old ones.
A lot of famous vulnerabilities are related to misconfiguring those LAN
protocols so you wind up inadvertently sharing your folders on the net.

They are redesigning Windows, or writing an all new OS with security in mind
but you may not like it when you discover just how secure it
will be against you trying to play MP3s, pirated movies, or software
not approved by M'soft.
:cool:

Any OS can be secure or completely unsecured; it's only a matter of how the administrator manage is server.

All OS's are insecure or unusable by defualt... I thought this was a fairly obvious observation? You put an unpatched Win XP box on the net, you leave it overnight, it's owned. You throw an unpatched RH box on the net, you leave it overnight, it's owned...

Quote:

---

Originally posted here by nihil
I have a Norton AV disk.............5.25" ( :eek: ) that claims to detect "ALL 726 known computer viruses" ( yes, seven hundred and twenty six)
:D

---

Isn't there more than 100,000?
Or is that 726 'active' viruses?

It's probably the main more common viruses stored on the disk. To keep a defs file that would track every virus would mean multiple diskettes being swapped in and out. Since we are seeing many of the same viruses/worms over and over again (ie., MyDoom, SoBig, Sasser, etc.) it saves on some time by going after those ones since that's what most people would be affected with today. It'd be rare to see someone infected with .. say... NATAS (a particularly nasty MBR virus I remember being infected with once due to a shrink wrapped diagnostic diskette from 3Com being originally infected)

Quote:

---

Isn't there more than 100,000?
Or is that 726 'active' viruses?

---

LOL. He's talking about back in the day. 5.25" disks are not in use anymore...they're the huge, thin floppies. When these disks were in use, 726 viruses was a lot. Stick around, you'll learn nihilish one of these days :).


This really feels like one of those "Windows sux, linux is better" threads to me. Every operating system is as secure as the user allows it to be (knowingly, or unknowingly). This has been discussed over and over in AO. Lets wait for Longhorn and see what that is going to bring.

I think rcgreen has expressed my feelings very lucidly.

We tend to overlook the historical aspects and the effects of legacy architecture in operating systems. Just look at the development patterns:

Win 3.x
Win 95
Win 98
Win98SE
Win ME
WinXP

Yet the next OS (Longhorn) will be several years in development, because of the architectural changes I suppose?

I have just reached down to the bottom shelf of my workstation and picked up a copy of Red Hat Linux 5.2 (May 1999)..................now I wonder how secure that would be "out of the box" :eek:

Hah! some more........... Linux Pro v5.4 "Personal Workstation/Powerful Server".........Red Hat 6.1........S.u.S.E. 6.2....................

In my workshop I have an Acorn Archimedes.............now that IS a secure box............only 114 known viruses, and how many Skiddies can even spell the RISC OS, let alone hack it :D

Cope57, that is an old 5.25" floppy that goes back to the 1980's. There were only 726 viruses then! (mostly boot sector, with the odd file infector (.exe, .com)

You are right, there are probably 100,000 now. The number depends on whether you use "family" names, and whether you include all the very old viruses that probably would not run on a modern OS?

I find this an interesting topic, but am a little surprised that people seem to expect OSes to be "secure" when they hark back to an era when that was not really an issue.

When I look at older OSes, I tend to follow the views of fellow history buffs such as Gore, we look at stability, performance, ease of use and resource requirements.

Otherwise I will be criticising the Wright Brothers for not fitting afterburners and a HUD :p

Quote:

---

Win 3.x
Win 95
Win 98
Win98SE
Win ME
WinXP

---

No windows 2000?

Or Windows NT/2003?

IMO, Windows NT, 2000, 2003 and XP are all attempts by Microsoft to slowly introduce security to a work environment as well as general users (ala WinXP Home). Change is often viewed as a scary thing and users are very slow to response and do what things we really want them to do. The idea of "I don't have anything worthwhile to steal" is still out there. Heck, even students taking computer courses at my college -- when I went to speak to them about it (in semesters earlier than the ones I teach) -- have that belief. "Oh.. I'm just a student. Who cares?"

The reality is, however, regardless of whether it's a home user or a large corporation, security isn't paid attention to until a major violation has occurred and/or it appears in the media. Case in point, recent CIBC fax boo-boo (and notice that this specific security breach had little to do with computers -- most security breaches have everything to do with the user/admin/programmer than the OS it affects).

So companies and individuals will continue on their merry way as long as it's stable and they can access what they want, humming "We don't have anything to steal, hi-ho.."

What a newbie like me thinks is that both OS: Windows and Linux are insecure.
The problem are the hackers.
A hacker mostly hates Windows beacuse he must pay for it and he can't make an improvement on it( change things in system files).
People likes to do what they want not to be restricted) And they start to make viruses that damege windows. And later they say windows is BAD system. But if a good hacker try to make virus for Linux he is also having succes.
But the hackers that are making viruses for Windows are 1000 times more than the hackers which make viruses for Linux.

Cybr~ and MsM,

I was restricting my comments to stand alone or "home" distributions of Windows.

In parallel you had:

Win 3.11 for workgroups
NT 3.51
NT 4.0 (various SPs)
NT 5.0 (Win 2000)
XP Pro
Win 2003

I was hoping to demonstrate that the home editions were just the "latest models", and that there was no fundamental architectural redesign. Hence, no fundamental improvement in security.

If you get a copy of NT 4.0, take a look in the Windows System32 folder. You will find 4 files with a .bas extension............."gorillas" is one of them
:D

Those are Quickbasic files, and that shipped with DOS 5.0!!! Microsoft were trying to develop NT 4.0 and Win 95 at the same time.............they didn't have the resource, so the NT guys borrowed code from the Win 95 team.............who were building an improvement to Win 3.X, that was DOS based. They did not understand those files and left them there!

It is hardly surprising that there were no great security improvements? Microsoft were aiming at a "home" and a "business" marketplace, and until XP, kept the two separate. I guess that would seriously dilute their resources?

I still believe that the most secure operating system is the one that YOU understand.