News stories all repeat the same theme about the “Mydoom” or “Novarg” virus:
[Mydoom] doesn’t appear to exploit any Windows security flaw.
It’s almost as if Microsoft wrote it for them.
The so-called experts blame the users. They say users are just being tricked and that’s how the worm spreads:
“It’s the trust factor you are exploiting,” said Oliver Friedrichs, senior research manager with anti-virus vendor Symantec Corp. “Most people, when they receive something, they want to trust it. You don’t want to miss something people may be sending you.”
But then it goes on to say:
On activation
3 comments for “Who says Mydoom doesn’t exploit security flaws”
Comments are closed.
It’s obvious that Microsoft does not want to stop the likes of MyDoom; We’re told (I don’t use Windows, so I don’t know) that MyDoom and others of it’s genre will install mail-relay agents subsequently used for spam networks. We’re told by their own boasts that Organized Crime will sell you time on that network via a front office in Poland.
Now, the facts:
If Windows added a simple two layer permissions system, no attachement would be permitted to install system-level software without effectively entering your ‘sudo’ password. Immediately virii are impotent.
If Windows added a simple iptables firewall, any mail relay or virii replication port that did get installed would not be able to reach the internet anyway. Immediately the worms and spam-engines are impotent.
Microsoft mouthpiece Bill Gates recently announce his Plan for Spam as Black Penny, a system which will bind all email transactions to the windows platform and likely require continual challenge-key upgrading much as the way your satellite TV needs new keys periodically download. ie, simple to require you to pay a tithe (or your computer manufacturer to pay a tithe) lest you be excluded from the Black Penny messaging network.
In 2006, suddenly 90% of all desktops will only run Black Penny messages.
and the final fact:
Virii like MyDoom render conventional email undesirable.
IMHO, it doesn’t take a rocket scientist to add up those items.
Good points mrG. We in the open-protocol camp have to take some blame for leaving an opening like this in place for Bill to exploit.
For my part, I’m working on some projects to attempt to address some of these issues using open (unencumbered) protocols and technologies.
However, as you say, it is not in Microsoft’s best interest (at least from their limited perspective) to adhere to open-standards, and with control of 99.99% of the desktops, Microsoft can make things pretty ugly for all of us (including their own customers and users).
Not I. I don’t say they don’t exploit security laws. They do. And I’m not saying this because I’m commenting on your blog.