Microsoft says recovery from malware becomming impossible

[mdlbear]

This eWeek article starts with the following:

In a rare discussion on the severity of the Windows malware scourge, a Microsoft security official said businesses should consider investing in an automated process to wipe hard drives and reinstall operating systems as a practical way to recover from malware infestation.

"When you are dealing with rootkits and some advanced spyware programs, the only solution is to rebuild from scratch. In some cases, there really is no way to recover without nuking the systems from orbit," Mike Danseglio, program manager in the Security Solutions group at Microsoft, said in a presentation at the InfoSec World conference here.

Now, the second part of this is true even in the Unix/Linux world: once your machine has been compromised, the only really reliable way to deal with it is to nuke it and re-install. The difference is that in the Unix world it doesn't happen very often, it doesn't take long to fix, and your local data (user home directories, databases, etc.) are going to be in separate partitions that don't have to be wiped because user code is very unlikely to be capable of compromising the system.

The first paragraph, though, says that Windows is so insecure and so badly broken that the only thing you can do is minimise your downtime when the inevitable, frequent, successful attacks occur. And that neither Microsoft nor its users see any other solution.

Comments

[dejla.livejournal.com]

That is just... that is just horrifying. There are no words.

[kissmyassterisk.livejournal.com]

As a forced user of Windows, I can confirm the frequency and inevitability of attacks. ::kicks computer:: Stupid machine...

[saffronrose.livejournal.com]

they mean, no other solution that still uses MS products...
I have a great solution to that problem in the article. Avoid MS products.

[mdlbear]

That's what I do, too. Works great.

[almeda.livejournal.com]

I knew the 'everything on earth can, and HAS TO, write to the One Solitary Registry that cannot be fixed' concept was a bad'un when they first came UP with it. Sigh.

[technoshaman.livejournal.com]

I have to disagree on one teeny bit. If you run the SHA1 checks in rpm --verify, or the Debian equivalent with md5sums (which escapes me; if you remember, I'd love to be enlightened), I think you can be reasonably sure of system integrity. Tripwire and other such tools help as well. Although if you're not ready for something, it may actually take longer to do the integrity checks than it does to restore from something like a Mondo Restore image....

Symantec and McAffee have a vested interest in seeing that Microsoft stay at least somewhat broken. So does Microsoft, actually. If they can get away with teasing us with the Next Big Fix long enough for Ballmer to retire, then they win. And everybody doing the Dominant Paradigm loses bigtime when MSFT finally throws up its hands with respect to Windows and the stock price tanks, throwing a bazillion retirement plans into disarray....

But, yeah, a properly partitioned Linux (or other Unix or Unix-like, including MacOS X) box being run by an unprivileged user has designed into it an order of magnitude more security than Windows will ever have without a total rewrite. Which they're not willing to do, because it would put them and a lot of other people out of business. A *lot* of other people.

And I'd be willing to let them continue, except that they're also foisting this big-brother, we-own-everything-and-you-just-rent, and oh-by-the-way, neither-property-nor-privacy-rights-exist kind of attitude on the general populace, and you only have to look at the other Washington to see where *that*'s getting us.

Nay, f--- that.

What do you bet Microsoft will start offering a service to reload your Windows box with the software it knows you own over the network, just type in your credit card number here....

And what do you bet there'll be phishing schemes based on it before it even goes live. (I know, no bet on a sure thing...)

[mdlbear]

I hope somebody else remembers the Debian equivalent of rpm --verify, I don't. I do run chkrootkit from a cron job. If a system fails that and I can't find the problem, I can do a clean reinstall in under an hour. (It's amazing how fast you can install from a local mirror.)

No bet.