Is Zotob A MS Plot . . . .

[NoStop]

begin  trojan.vbs ... On Thursday 18 August 2005 12:00 pm, Leythos had this
to say in microsoft.public.windowsxp.general:

I hate to tell you this, but I've never, not once, said that Linux is
secure out of the box, and I firmly believe that it's not secure out of
the box as I've seen new installed systems rooted in under 4 hours.

When is the last time you installed a new Linux distro? As an example, when
Mandriva 10.2 installs on a new computer, the first thing it does when
installed is goes out to a mirror and picks up any security upgrades
available. So yes, I'd say that "out of the box" it is inherently secure.
Like a thousand times more secure than Windoze and with no further effort
on the part of the user then a one click access to upgrades down the road
on a somewhat regular basis. Windoze on the other hand wouldn't last 5
minutes "out of its box" connected to the Net before being compromised.

 

[Leythos]

You have that one right. With Linux, once installed it just works and
continues to work. Windoze on the other hand slowly degrades until one is
forced to wipe it out and start again from scratch. Sad, indeed, but the
truth.

Then you've not been using Unix or Linux long enough or you've not used
Windows in a normal environment.

 

[Leythos]

begin  trojan.vbs ... On Thursday 18 August 2005 12:00 pm, Leythos had this
to say in microsoft.public.windowsxp.general:

When is the last time you installed a new Linux distro? As an example, when
Mandriva 10.2 installs on a new computer, the first thing it does when
installed is goes out to a mirror and picks up any security upgrades
available. So yes, I'd say that "out of the box" it is inherently secure.
Like a thousand times more secure than Windoze and with no further effort
on the part of the user then a one click access to upgrades down the road
on a somewhat regular basis. Windoze on the other hand wouldn't last 5
minutes "out of its box" connected to the Net before being compromised.

I installed Mandrake 10 a few months ago, installed Fedora Core 3 many
months ago, then FC4 just this week. I've personally not had any box
rooted and not had a problem with any of my Nix boxes as I have a
firewall protecting all of them.

I dropped MDK for FC since FC was much faster in my opinion and also
offered more help and support. I love FC and how it comes with all the
tools I need to access my Windows servers and even has Evolution built-
in to it so I can use native exchange mode with the Exchange server.

I've seen people install Linux in their homes, not enable the firewall,
setup Apache and be rooted in under 4 hours.

 

[NoStop]

begin  trojan.vbs ... On Friday 19 August 2005 04:57 am, Leythos had this
to say in microsoft.public.windowsxp.general:

Then you've not been using Unix or Linux long enough or you've not used
Windows in a normal environment.

The first time I used *NIX was when I used MickeyMouse's Xenix. Is that long
enough for you? As to "Windows in a normal environment", that is such
silliness, it isn't worth a comment.

 

[NoStop]

begin  trojan.vbs ... On Friday 19 August 2005 05:00 am, Leythos had this
to say in microsoft.public.windowsxp.general:

I installed Mandrake 10 a few months ago, installed Fedora Core 3 many

Why 10 just a few months ago when that is an OLD distribution of Mandrake?

months ago, then FC4 just this week. I've personally not had any box
rooted and not had a problem with any of my Nix boxes as I have a
firewall protecting all of them.

A NAT enabled router is all that is required.

I dropped MDK for FC since FC was much faster in my opinion and also
offered more help and support. I love FC and how it comes with all the
tools I need to access my Windows servers and even has Evolution built-
in to it so I can use native exchange mode with the Exchange server.

I've seen people install Linux in their homes, not enable the firewall,
setup Apache and be rooted in under 4 hours.

What firewall? The software one that is available in Linux or a hardware
firewall? I don't bother with the former as I find my router is sufficient.
With FC3 and I would assume FC4 (haven't tried that one), a firewall is
automatically installed during installation using of course iptables. But
I'm sure you know that a firewall doesn't offer 100% protection. It will
slow down an attack but a determined and knowledgeable attacker can get
through a firewall. The key to security is only opening up those
services/ports that you need to open and then making sure those services
are properly setup and secure.

But comparing Linux and Windoze in terms of Net security is to compare
apples to oranges. In short, no comparision, as the damage an attacker can
do to a Linux box is nowhere near as vulnerable as what can be done to a
Windoze box. The latter would take a complete rewrite on MickeyMouse's part
to bring it to the security level of a Linux box and other than bandaids
being applied I don't see MickeyMouse moving in that direction.

 

[Kerry Brown]

But comparing Linux and Windoze in terms of Net security is to compare
apples to oranges. In short, no comparision, as the damage an attacker can
do to a Linux box is nowhere near as vulnerable as what can be done to a
Windoze box. The latter would take a complete rewrite on MickeyMouse's
part
to bring it to the security level of a Linux box and other than bandaids
being applied I don't see MickeyMouse moving in that direction.

Please crawl back under your bridge and troll elsewhere. This newsgroup is
about helping people with XP not proselytising your favourite alternative
OS. All OS's have flaws and exploits. Linux has less than XP. So what.
That's not what this newsgroup is about.

Kerry

 

[Dimple Wathen]

I hate to tell you this, but I've never, not once, said that Linux is
secure out of the box, and I firmly believe that it's not secure out of
the box as I've seen new installed systems rooted in under 4 hours.

You are right of course... I misquoted.

 

[Leythos]

begin  trojan.vbs ... On Friday 19 August 2005 05:00 am, Leythos hadthis
to say in microsoft.public.windowsxp.general:


Why 10 just a few months ago when that is an OLD distribution of Mandrake?

Because I went through a phase where I wanted to start using Linux more
often and for desktop, and at the time, when I was doing the testing,
MDK10, SUSE something Personal, and Fedora Core 3 were all that was
available to me,

A NAT enabled router is all that is required.

NAT is the minimum that's required - I agree.

What firewall? The software one that is available in Linux or a hardware
firewall? I don't bother with the former as I find my router is sufficient.
With FC3 and I would assume FC4 (haven't tried that one), a firewall is
automatically installed during installation using of course iptables. But
I'm sure you know that a firewall doesn't offer 100% protection. It will
slow down an attack but a determined and knowledgeable attacker can get
through a firewall. The key to security is only opening up those
services/ports that you need to open and then making sure those services
are properly setup and secure.

I was talking about a Linux install directly connected to the Cable
Modem because they believed that Linux was secure.

But comparing Linux and Windoze in terms of Net security is to compare
apples to oranges. In short, no comparision, as the damage an attacker can
do to a Linux box is nowhere near as vulnerable as what can be done to a
Windoze box. The latter would take a complete rewrite on MickeyMouse's part
to bring it to the security level of a Linux box and other than bandaids
being applied I don't see MickeyMouse moving in that direction.

But there was a stat from a reputable company a year or so ago that
showed more compromised Apache boxes than IIS boxes - so, MS must be
doing something right.

 

[Leythos]

begin  trojan.vbs ... On Friday 19 August 2005 04:57 am, Leythos hadthis
to say in microsoft.public.windowsxp.general:

The first time I used *NIX was when I used MickeyMouse's Xenix. Is that long
enough for you? As to "Windows in a normal environment", that is such
silliness, it isn't worth a comment.

That was about when I started with Unix - sold a Radio Shack server with
Xenix on it to a customer.

I have many, running for years, stable and fast Windows 2000 and XP
system. Just retired out last NT4 server a few months ago. As long as
you do the same maintenance as you would a nix box the Win boxes remain
fast and stable.

 

[Guest]

Zotob: An Avoidable Worm And The Negligence Factor
http://www.securitypipeline.com/169400254?_loopback=1

 

[kurttrail]

Zotob: An Avoidable Worm And The Negligence Factor
http://www.securitypipeline.com/169400254?_loopback=1

LOL! Carey responded to my thread with an automated response!

I thought he promised to kill-file me. As usual, Carey is full of sh*t!

--
Peace!
Kurt
Self-anointed Moderator
microscum.pubic.windowsexp.gonorrhea
http://microscum.com/mscommunity
"Trustworthy Computing" is only another example of an Oxymoron!
"Produkt-Aktivierung macht frei"

 

[Dimple Wathen]

You have got to be trolling.

Actually, I am not. Ranting a little perhaps....

I install tons of applications on a weekly basis for testing a design
work, have many computers personally, not to mention all the work that
gets done at clients locations - and not one of the has any issues with
the Windows XP OS or any of the standard MS Office applications, nor
with many of their other commercial / common applications.

Whoa.. Wow... Well, I never... Now this sounds like the other side of
trolling, stating that XP in your case never has any issues. I mean,
you have never encountered a case where the installation of an
application broke some other application or some aspect of XP? It's
very hard to believe.

My wife has been using a Windows XP computer that was a upgrade from
Windows 2000 Professional, without any issues (for accounting, books,
editing images, newsletters, etc) for almost 3 years without any rebuild
of the system and we're just now moving it to a faster hardware platform
(via ghosting to the new drive and then doing a repair install).

You must be some of the luckiest inthe world.

I help install, upgrade and "fix" many Windows computers. They all have
had problems, from minor to major over the years.

My own XP development system works best because I am careful. But I
"Windows Udpated" a driver and it caused havoc with Photoshop. Just one
video driver update and "issues".

The only constant maintenance a Windows box needs it a monthly defrag of
the drives on a busy system and to ensure that Windows automatic updates
are working.

There are numerous "turds" left behind by most uninstalled application;
many hardware upgrades leave the previous hardwre drivers in place;
sometimes old/unused drivers and DLLs get loaded unnecessarily; I
turned someones computer on just yesterday and XP decided that its
printer is now "new hardware" and wants to install its (already
installed) drivers -- and I could not prevent that process from
happening -- I had to go through the install process all over again,
the result two printers where there should only have been one.

On another computer I ran "Windows Update", re-booted, and not its
Internet access has problems.

I have many more such "issues".

Try this some day: save the state of the system dir and the registry,
install a major Windows application, then un-install it, and then
compare the state of the system dir and the registry. I do this all the
time. 90% of the time SYS or OCX or DLLs are left behind still
registered and shared, and registry entries have not been deleted.

Please explain to me some more about how you maintain your XP/2K boxes.
I honestly want to understand how you have no problems.


P.S. I still think this defrag bit is a myth. Other than performance,
how can which clusters (or whatever the NTFS equiv. is) a program
resides in affect its operation after that program has been loaded into
memory. You've got to explain this in technical detail for me to ever
believe it.

 

[Dimple Wathen]

begin trojan.vbs ... On Thursday 18 August 2005 12:00 pm, Leythos had this
to say in microsoft.public.windowsxp.general:

When is the last time you installed a new Linux distro? As an example, when
Mandriva 10.2 installs on a new computer, the first thing it does when
installed is goes out to a mirror and picks up any security upgrades
available. So yes, I'd say that "out of the box" it is inherently secure.
Like a thousand times more secure than Windoze and with no further effort
on the part of the user then a one click access to upgrades down the road
on a somewhat regular basis. Windoze on the other hand wouldn't last 5
minutes "out of its box" connected to the Net before being compromised.

But you can't talk of "Linux" and then talk of "Mandriva" and mean the
same thing... apples and oranges.

 

[NoStop]

begin  trojan.vbs ... On Friday 19 August 2005 09:41 am, Leythos had this
to say in microsoft.public.windowsxp.general:

That was about when I started with Unix - sold a Radio Shack server with
Xenix on it to a customer.

I have many, running for years, stable and fast Windows 2000 and XP
system. Just retired out last NT4 server a few months ago. As long as
you do the same maintenance as you would a nix box the Win boxes remain
fast and stable.

One must do considerably more maintenance on a Windoze box to keep it
running. You must surely know that! Just keeping up with virus and spyware
blockers' data files means more work. Frankly, my Linux boxes just keep on
trucking, never missing a beat and not requiring much effort at all on my
part.

 

[Tinkerer]

What does Mandriva, or any of the paid Linux versions run these days?

--

Cheers,
Tinkerer


begin trojan.vbs ... On Friday 19 August 2005 09:41 am, Leythos had this
to say in microsoft.public.windowsxp.general:

That was about when I started with Unix - sold a Radio Shack server with
Xenix on it to a customer.

I have many, running for years, stable and fast Windows 2000 and XP
system. Just retired out last NT4 server a few months ago. As long as
you do the same maintenance as you would a nix box the Win boxes remain
fast and stable.

One must do considerably more maintenance on a Windoze box to keep it
running. You must surely know that! Just keeping up with virus and spyware
blockers' data files means more work. Frankly, my Linux boxes just keep on
trucking, never missing a beat and not requiring much effort at all on my
part.

 

[Dimple Wathen]

(e-mail address removed) says... [snip]

I kinda sorta don't blame people for being upset that their shiny new
XP computer gets cracked.

I also don't blame users when their systems are compromised, unless it
was due to not following rules of basic security. The sad part is that
all the information on how to be safe is easily available on the web,
but those types don't look for it.

Yes and no. I mean, you apparently know all about configuring
computers. Many people don't.

I find myself eeriely drawn to this thread... I now really want to
understand where you are coming from.

PC users that know nothing about computers just plug their computer in
and starts using it. Dell or Gateway or Whatever has configured it anf
the get what is generally known as a "Craputer" for all the services
and programs running at start-up. They probably have AV and two
firewalls (XP's and one from the AV company). And they have Automatic
Updates from Microsoft. They are also bombarded with warnings about
"Viruses" everyday. (Which is why they accept the AV software and
Windows Update and "Activation" paying extra money for service plans.)

But what these people don't have is any understanding of Internet
protocols and RFCs and traceroute and DNS servers.

And on top of that they are used to electronic gadgets, like telephones
and cdplayers, to always "just work".

At this point, is the new XP box secure? Or are the users required to
spend the hours necessary, online, reading about how to secure their
computer?

(I am not in anyway arguing or trying to argue -- I may be drifting off
topic here...)

Imagine all the people that open the ebay email and actually go to the
fake ebay site and enter their personal information - that one mode of
getting peoples personal info has been on every news channel, in most of
the tech sections of news papers, listed on ebay's real site, and is
easy to determine if it's real or not, but people still fall for it.

Ignorance is not an excuse, it's a wanton action of being lazy in my
opinion.

In this example, yeah, sure.

Yea, but with a properly secured network they would not be able to
download any content that might contain malicious files - like we don't
allow .SCR files to pass through the HTTP sessions in our firewalls.

Well, I meant to write that I am LESS likely to sympathize.... (I ain't
always smart.)

As an aside, I'd like to know how to setup XP to block such files. Do
you use a router? Third party software? Basic XP can just deny access
globally or per website via IE. I am obviously missing something here.

I can, as there is no reason to allow outbound ports 135~139, 445, 1433~
1434 and FTP outbound should be limited to a specific internal machine
or to know good FTP sites. We have all the Sororities setup so that
outbound traffic to destination ports 135~139, 445, 1433~1434, and to
non-approved FTP locations is blocked - in addition to blocking content
in HTTP sessions.


Windows can not come hardened out of the box, it would break to many
existing methods and fail in corporate environments. They need a new
version, abandoning all the prior versions.

But you just said that "there is no reason to allow outbound ports
[...] and FTP outbound should be limited to a specific internal machine
or to know good FTP sites."

How does the average user learn to do this? And if I can do this why
can't MS do it by default?

And I have always that MS should have skipped XP and come out with a
completely new OS, one specifically for Home use where no servers ever
need to be run, only client software with basic Internet access.

[snip]

This is the start - knowing that you don't know and accepting that you
have to learn more - that's all that I ask of my team. Never say you
know when you don't, never fake it, never feel afraid to say "I don't
know". It's always better to learn that to hide.

I know what I know and I thought I knew what I did not know. I now know
more about what I did not know as I have seen various Worms and Trojans
completel;y take over XP boxes I thought "secure" behind routers.

--

 

[cquirke (MVP Windows shell/user)]

On 18 Aug 2005 11:11:09 -0700, "Dimple Wathen"

NoStop wrote:

I want my computers to just work! I want to plug my new USB printer/
scanner/ camera/ whatever and have it work.

Fair enough. I don't see a reason why PnP should be exposed to the
Internet to accomplish that, yet part of August 2005's pain is a
defect in PnP that may be exploitable from the Internet.

Actually, all Windows machines slowly degenerate over time.

They don't have to - it depends how you set them up. For example,
smart use of partitioning, reducing those absurdly-huge IE web caches
and SR stores etc. can help systems hold their performance whether the
HD is nearly empty, or nearly full.

They are like old cars where the transmission is going, the brakes
are wearing... It needs constant maintenance.

Cars wear out their load-bearing surfaces, and are designed so that
these items can be replaced as needed with a minimum of labor and
downtime. PC software's "load-bearing surfaces" are those that are
exposed to external material, and smart design would limit the biulk
of these, and make it easier to amputate and replace them.

Instead, we have deeply-embedded subsystems that are
needlessly-exposed to the Internet on the basis that the Internet is
"just another network", and as a consequence of NT's original design
as corporate network fodder. Drop that design into consumerland, and
you can expect as much trouble as putting wings on a train and calling
it an airliner. Expect a bad safety record to follow.

Just look at the thousands of Hijackthis logs people keep posting all
over the Net saying "My computers is ^&^#$$&*&% please help!". Ninety
percent of those Hijackthis logs have some sort of anti-virus,
anti-spyware program installed!

The blind spiot there is that MS does sweet FA to help users maintain
their PCs, once the PCs can no longer safely boot Windows for any
reason. It's just a shrug and "wipe and re-install".

We didn't notice or care about that in the Win9x era, because DOS mode
functioned as an adequate maintenance OS, and tools for that abounded,
so data recovery, malware management and interactive file system
repair were possible, if not always easy.

But capacities over 137G and NTFS break that maintenance environment,
and there's nothing to replace it - at least, nil MS will let you use.

-- Risk Management is the clue that asks:

"Why do I keep open buckets of petrol next to all the
ashtrays in the lounge, when I don't even have a car?"

 

[Leythos]

I have many more such "issues".

I see that

Try this some day: save the state of the system dir and the registry,
install a major Windows application, then un-install it, and then
compare the state of the system dir and the registry. I do this all the
time. 90% of the time SYS or OCX or DLLs are left behind still
registered and shared, and registry entries have not been deleted.

And many OS's have that issue - they leave all sorts of little parts of
the applications behind. It's no more a problem on XP and any other OS.

Please explain to me some more about how you maintain your XP/2K boxes.
I honestly want to understand how you have no problems.

What's to explain, we use our systems for business, our clients use
theirs for business, we maintain a BUNCH of servers, and I personally
have many systems (servers and workstations) in my home - and I even had
three teen kids using them.

P.S. I still think this defrag bit is a myth. Other than performance,
how can which clusters (or whatever the NTFS equiv. is) a program
resides in affect its operation after that program has been loaded into
memory. You've got to explain this in technical detail for me to ever
believe it.

That's why you have so many problems with your systems - you don't
understand how they work. There are few applications that just load
their EXE and are done with the drive. Even your browser caches files to
make your experience quicker, same with Word, Exel, Counter-Strike,
etc... The idea you need to understand about disk access is that when
the head has to move without reading data, it's slower and inefficient
if you defrag and pack your files it means that disk access is optimised
and that the drive heads don't have to seek all over the drive without
reading anything.

 

[Leythos]

One must do considerably more maintenance on a Windoze box to keep it
running. You must surely know that! Just keeping up with virus and spyware
blockers' data files means more work. Frankly, my Linux boxes just keep on
trucking, never missing a beat and not requiring much effort at all on my
part.

I have a munch of computers in my home - I've not had to do anything to
any of them manually in the last couple months, other than use them to
play, send out proposals, edit video, etc...

My clients have not had to do anything manually to maintain their boxes
in mothers either - well, one client has a beta application that they
get weekly updates for and it requires them to login as a domain admin
account to update it, but, they don't have to do any of what you mention
- ever.

 

[Leythos]

How does the average user learn to do this? And if I can do this why
can't MS do it by default?

Let me just answer this as a summary to all that you asked:

1) Limiting outbound connections can be done with a proper firewall,
most people don't have one, most people don't know anything about
security, most people choose to remain ignorant out of choice - even
though they know they should be learning more.

2) Anyone connecting a PC with any OS directly to the net as a home user
or small business should be shot - yea, bold statement, but there is no
secure OS for anyone in the above categories that they can be sure is
secure.

3) Anyone on the Internet should be behind a firewall - not a NAT
router, a honest to God firewall.

4) I've never met anyone that has a properly configured security
solution that has been compromised - and I've met lots of
users/companies that have never been compromised - more than were not
properly configured.

5) All of this information, on being secure, on what to setup, what to
look for, is fully and freely available on the Web for anyone that wants
it.

You asked about blocking FTP outbound except to specific sites - it's
done with a firewall.

Ask about securing your network - it's done with a firewall.

Ask about removing bad things from HTTP or SMTP sessions - it's also
done with a firewall (and other solutions too).

Ask about blocking anything in any direction - it's also done with a
firewall.

Most of the cheap appliances you see at appliance stores, like BestBuy,
Circuit City, etc... those are NOT firewalls, they are just simple NAT
devices, many have "firewall LIKE" features, but they are not firewalls
in a complete sense of protection.

I have a friend that just installed VOIP, they sent a cheap Linksys
router that has a phone jack on it - he already had a firewall
appliance, but he had to put this device in the first place, so, their
linksys just has his firewall set to it's DMZ - so that everything
passes inbound through the VOIP router to his firewall. His firewall
still protects his network.