22 ms·

Not one Microsoft product on Kaspersky’s top 10 vulnerabilities list

326 points by tarekayna 14y ago

ajross 14y ago
It's actually this bit from farther down that surprised me the most: > 56 percent of exploits blocked in Q3 use Java vulnerabilities. So much for the idea of a managed language runtime being inherently more secure...
- MichaelGG 14y ago
  The runtime isn't written in a managed language, and that's where most of the vulnerabilities happen, right? The holes aren't in application code, but in _running arbitrary code_, which the JVM fails to do safely. The surface area exposed is larger, because you're allowing the browser to download and run arbitrary programs, something you don't do with unmanaged languages very much. Edit: Also, just consider how much worse it'd be if Java apps were re-written in a language that allows buffer overflows. Enterprises already cannot get security right; even generating SQL queries results in problems. No way would those teams deal with yet another layer of security issues. Hell, I've dealt with commercial teams writing in C++ thinking a buffer overflow has "something to do with network rate limiting."
  - deleted 14y ago
    [deleted]
  - 0x0 14y ago
    > "The runtime isn't written in a managed language, and that's where most of the vulnerabilities happen, right?" At least some of those Java vulnerabilities are logic errors in the sandboxing/securitymanager parts that are supposed to prevent applets from accessing privileged APIs, and those checks are usually implemented inside the actual java.* standard library classes, in the Java language.
- lucian1900 14y ago
  It is inherently more secured in the same context. The JVM applet sandbox has to stand up to random code off the internet, whereas native code is almost only installed explicitly. Remember ActiveX and how it was worse than Java applets?
  - jlgreco 14y ago
    It seems to me that the only reason we put up with JVM applets (whereas anyone suggesting we put up with people ActiveX would rightfully be laughed down these days) is because of that steady monotonous stream of crap about how much better Java is for security. It has dropped our collective paranoia far too low.
    - jebblue 14y ago
      Java is or was until very recently as anyone who has used it since 1995 will know and remember. Recent issue have arisen, hopefully Oracle is going to get its track record up to what Sun's was. Until then, a few bad recent reports for Java 7 will not wipe out decades of countless security reports for all of Windows Operating System and many relied upon Windows applications. Java applets are still far more efficient and far more powerful and have far greater operability with Java web server software than even HTML5 will have.
      - jongalloway2 14y ago
        History and hopefully don't really factor into a thoughtful analysis of current security issues.
        jebblue 14y ago
        Are you saying history in general is not pertinent to analysis? Is your rule only true for security issues or you do you feel that way about everything?
    - ______ 14y ago
      Unfortunately places like Korea still require ActiveX support because it's used by all online shopping, government, etc pages (and is required by law in many cases)... http://www.koreaittimes.com/story/21504/internet-powerhouse-korea-%E2%80%9Cactivex-controls%E2%80%9Daddict http://www.koreaittimes.com/story/21504/internet-powerhouse-...
- meaty 14y ago
  Well CLR seems to be OK so I think this is down to the implementation rather than the concept.
  - aidenn0 14y ago
    Fewer browsers will run CLR code, so harder to do a drive-by.
    - rhplus 14y ago
      That's not true. All four major browsers can run CLR code through Silverlight [1] and depending on the statistics you use, the installation base for the plugin is in the same ballpark as Java, somewhere between 65% and 75% [2]. StatOwl even has Silverlight slightly ahead of Java at 69.7% vs 70.0% [3]. Of course, these are desktop stats. On mobile, it's a different story. [1] http://www.microsoft.com/getsilverlight/Get-Started/Install/Default.aspx http://www.microsoft.com/getsilverlight/Get-Started/Install/... [2] http://en.wikipedia.org/wiki/Microsoft_Silverlight#Adoption http://en.wikipedia.org/wiki/Microsoft_Silverlight#Adoption [3] http://riastats.com/ http://riastats.com/ [4] http://www.statowl.com/custom_ria_market_penetration.php http://www.statowl.com/custom_ria_market_penetration.php
- tptacek 14y ago
  The problem mostly isn't the runtime itself, but instead the various 3rd party modules (all of which are written in late-90's-era C/C++) that get hooked up to the JVM. For instance, the Quicktime API for Java exposed scalar integers, intended to be "opaque", but in fact raw memory locations. The JVM is good. The Java Applet Plugin, on the other hand, is a problem.
  - ajross 14y ago
    Well, sure. But I think that's maybe missing my point -- a managed runtime needs "holes" in it to do its job, which exposes the security problems of the rest of the system via inevitably leaky abstractions. The point was that the managed runtime does nothing to address this, it has to drill down to a C API at some point (or deeper, consider a similar hole in a shader compiler or video codec accelerator). And contrast with alternative affirmative/MAC-based sandboxing schemes like Chrome's NaCl, or OS-level stuff using SELinux/AppArmor. These don't require a managed runtime at all, and yet appear ("appear" being a critical point of courses) to solve this problem in a more robust way.
    - tptacek 14y ago
      So, you're right of course, but I just want to point out that the JVM is very very widely used in another setting other than applets where it has a much better track record: serverside web applications. I'm not sure we really know how to secure a desktop application / fat client platform yet.
    - pjmlp 14y ago
      The best way would be a sandoxing model like SELinux/AppArmor/GateKeeper coupled with a microkernel.
    - ujdtyhf 14y ago
      Yet you are viewing this page a with browser that loads and automatically executes untrusted JavaScript code under managed runtime.
      - 14y ago
- AlexDanger 14y ago
  So the question remains - how best to run Java on a Windows machine and minimise your risk? I've got Win7/64, service packs up to date, java autoinstaller thing....what else can I do?
  - josteink 14y ago
    Set your browser to never auto-launch plugins, but require click to play. If you're not already using ad-block, you will be amazed by how much it improves the performance of your general internet-surfing. So, besides security mindedness, there are already other good reasons for doing it.
experiment0 14y ago
Sorry for going off topic but, I hadn't seen the nextweb new design before. I found it quite disorientating, there is so much orange "stuff". I just didn't know where to look.
- artursapek 14y ago
  I agree, it feels like a complete downgrade to me. It feels like they're trying to be Gawker.
  - thoughtpalette 14y ago
    I felt the same. I was thrown off with the side bar on the left rather than right though.
- rndmize 14y ago
  I wasn't bothered by the colors so much as the layout. Almost every news source I read has the article all the way to the left, with navigation at the top and secondary content on the right. Having the navigation on the left and the content on the right was disorienting (and I've felt the same with Google's newer blog layouts). I can understand doing this on a tablet, but on a desktop it feels... overly simplified.
  - Roboprog 14y ago
    Worse for me on my (1024 x 600) netbook: the actual content wasn't even completely visible until I shrunk the font size several notches.
boyter 14y ago
I usually get shouted down when I say this but Microsoft's focus on secure code over the last 10 years has paid off. Not only is the OS too hard a target hence the increase in Java, adobe product exploits, but their software running on their OS has fallen in line too. I know the saying many eyes make bugs shallow, but so does billions of dollars and years of concentrated effort. Kudos to Microsoft for getting their act together.
- Legion 14y ago
  > I know the saying many eyes make bugs shallow, but so does billions of dollars and years of concentrated effort. The saying holds. Billions of dollars buys many eyes.
  - jcheng 14y ago
    That's not really how secure coding works at Microsoft though. There aren't more eyes on the code, just more developer training and more processes in place. (At least that was my experience working there from 2006 to 2009.)
    - tptacek 14y ago
      There are more eyes on the code too, though: virtually everything Microsoft ships gets a 3rd party review.
      - Locke1689 14y ago
        We also have mandatory security training for all developers. Turning every developer into a security reviewer helps a lot. It's nothing compared to the knowledge I got by working in app sec or teaching network security, but it's pretty good for increasing the base of knowledge among general developers.
      - dllthomas 14y ago
        ... that still isn't "many eyes" on any particular piece of code, in the sense of the saying, though.
sriramk 14y ago
This is the result of nearly a decade of work from MSFT, across the board. They built better tools, drilled security into every new hire all the way to the execs, made it a part of every engineering and product process imaginable. Happy that is finally being acknowledged on the outside.
- Breakthrough 14y ago
  "Happy that is finally being acknowledged on the outside." Not to mention by a reputable security company in the business (we all know there's some sources whom are... biased... to put it nicely). Congrats to Microsoft, glad to see they've put security so highly on their priority list. Not to mention the involvement they try to get with hackers, and worldwide trying to stop spam botnets, etc... Very nice to see a corporation working like that.
  - Centigonal 14y ago
    I think it's actually "who" in this case: the pronoun is the subject of "are biased."
- psychotik 14y ago
  I still remember how painful it was to ship anything, waiting in queue for security team signoff. Good to see it payoff though. Good on Microsoft - making secure products and smarter engineers in the process.
- shitlord 14y ago
  Now I wish Adobe would do the same thing.
  - tptacek 14y ago
    They very much are, and have been, for awhile.
    - icefox 14y ago
pooriaazimi 14y ago
Haha. Great to see iTunes and QuickTime (Windows versions, probably?) on the list... Apple should really either update them (I'm not sure iTunes 11 will be released for windows too), or just abandon them (and ask customers to use iCloud for backup). A few days ago I opened a .mov on a Windows machine with QuickTime - it was horrible. I can't imagine how dreadful iTunes probably is. No wonder all PC guys hate iTunes...
- robomartin 14y ago
  I hate iTunes on every platform. It's bloated; it tries to do too many things and it does them all wrong. Just as an example, searching for anything with iTunes is a horrible experience, particularly when compared with searching the 'net with any of the top search engines. Book, app and media management are terrible. Cross-computer management of the same is terrible. Backing-up your iPhone, if you are not careful, can result in erasing every single app from your phone and replacing them with what happens to be on the new machine's iTunes. Take a music database that Windows Media deals with without any issues whatsoever (devoid of metadata other than folders with the album name and files with the song names). Import it into iTunes and watch it get mangled. Albums get destroyed, songs end-up categorized in weird ways, etc.
  - pooriaazimi 14y ago
    Yeah, I feel you. I'm on OS X and hate iTunes with a passion (it's almost an obsession). I almost died of grief when I learned iTunes 11 was delayed... The sheer number of bugs that crapware has is unbelievable. And don't get me started on Music.app on iPad (iOS 5 and 6), or the dreadful state of "Shared Media" in iPhone and iPad's Music apps (stream from a computer). God I hate them. If I ever switch from iOS/Mac, iTunes/Music.app are to blame.
  - moepstar 14y ago
    I hate iTunes too for all of the reasons mentioned above, however there's one thing it does at least half-ok'ish: It doesn't eat a ton of CPU while playing a few simple MP3s... I've tried using Clementine (an Amarok-fork, my favourite music-player by far, at least on Linux) but it's just a resource-hog - comparatively at least. So yeah - does anyone have suggestions on what to use for music playback? Something that doesn't suck? Something that doesn't waste precious CPU-cycles without reason, generating heat and wasting battery on the go?
nostromo 14y ago
Interesting to note that both Apple vulnerabilities listed exist only for their Windows software. (QuickTime: http://lists.apple.com/archives/security-announce/2012/May/msg00005.html http://lists.apple.com/archives/security-announce/2012/May/m... iTunes: http://support.apple.com/kb/HT5485 http://support.apple.com/kb/HT5485) I wonder if these are lower priority for Apple or if they perhaps just aren't as good when developing for Windows.
- Maakuth 14y ago
  I think it could be that the platform works differently enough that you can build vulnerable Windows software by just making some assumptions that would be correct in OSX land but not in Windows. Vice versa, most probably.
- psychotik 14y ago
  If I understand correctly, I think it's a function of how they rank their vulnerabilities. "The rankings are based on the percentage of users whose computers had the vulnerability in question" Machines running Apple software on Windows >> machines running Apple software on Macs. So the same vulnerability wouldn't show up even if it existed in iTunes on OSX, for example.
- gilgoomesh 14y ago
  Quicktime on Windows is stuck at version 7, which is riddled with numerous problems. It's this old Quicktime codebase that is the source of the Quicktime and iTunes vulnerabilities on Windows. The current version on Mac and iOS is Quicktime X. This version was a complete rewrite (that started on iOS and eventually migrated to the Mac). The complete rewrite allowed for a vastly more secure design (among other improvements).
  - shinratdr 14y ago
    But the iTunes backend is still QuickTime 7 on both Mac OS X and Windows. QuickTime is really only present on Windows machines nowadays as the backend of iTunes.
drivebyacct2 14y ago
Beat by Oracle and Adobe. Something to truly be proud of. Aw, no one else finds this to be a strange brag? Should we make a list of all of the companies that aren't up there?
- xer0x 14y ago
  I agree, this is a really weird post.
  - drivebyacct2 14y ago
    Careful, that's a suicidal comment.
rgbrenner 14y ago
Oracle took the top 2, but Adobe had 5 runners up. Too bad Adobe couldn't overtake Oracle, they clearly put in a lot of effort at it. And Microsoft.. not even being listed? Are they even trying anymore?
- camus 14y ago
  but oracle products account for 53 of the malware attacks !
bprater 14y ago
Is it getting safer to say that antivirus software may soon be a thing of the past?
- zalzane 14y ago
  selling antivirus software is a lot less about fixing viruses than it is about convincing the average computer user that they are at risk without XXX antivirus suite.
- Corrado 14y ago
  My question is, would you run Windows 7/8 without any anti-virus software at all? Do you feel that comfortable? After years of Linux/OS X I can safely say that I won't use an OS that requires anti-virus ever again.
  - Negitivefrags 14y ago
    I have never run a windows system with anti virus. There is a very simple technique. Don't install viruses.
    - Jarshwah 14y ago
      I've had a single virus on a windows machine, and I was about 90% sure that it was going to be a virus and wanted to see what happened. I don't run anti-virus software, but I think it's only the power users that are capable of doing so. User education is still too low. Would you trust your parents or grand-parents to "not install a virus" ?
    - rbanffy 14y ago
      Considering the kinds of vulnerabilities we've seen, this may prove difficult. I remember one where browsing to a folder with a specially crafted image provoked a buffer overflow that got exploited.
  - freehunter 14y ago
    I used to run Security Essentials. When I upgraded to 8, it automatically uninstalled it. It's baked into the OS now, along with a constantly updated blacklist of known malware programs if you try to manually install something bad. You can get around it easily, but they don't make it intuitive to do so for users who are not comfortable clicking around and exploring. Above and beyond being comfortable not using an AV on Windows 8, I would go as far as to say that if you are using an AV on Windows 8, you're being taken for a ride by your vendor of choice. And I say this as an information security professional. I've tried to get a virus on Windows 8 without doing anything more than what it takes to get a virus on Windows 7. I did not succeed.
Lagged2Death 14y ago
I figured there would be a lot of Adobe stuff on the top 10, but that is a lot of Adobe stuff.
ecounysis 14y ago
Glancing at the list, I see there are only four companies in the world who cannot claim they don't have a single product on Kapersky's top 10 vulnerabilities list.
- encoderer 14y ago
  But the fact that the largest software company in the world is among them is what's notable.
  - ecounysis 14y ago
    Yes. I wonder what percentage of vulnerabilities 11-20 belong to Microsoft?
UnoriginalGuy 14y ago
If you're running Chrome please for the love of all that is holy enable Click-To-Play for all plugins. With it disabled it is like running without a pop-up blocker. You can do so in Settings -> Advanced Settings -> Content Settings -> Plug-Ins -> Click To Play. When you visit a site which has a plug-in you'll get a UI control similar to the pop-up blocker which allows you to add it to the exceptions list and or to allow it just this one time. You should add YouTube to the exceptions list.
- nickbaum 14y ago
  Or better yet, switch YouTube to the HTML5 player: http://www.youtube.com/html5 http://www.youtube.com/html5 One less site that needs Flash.
  - padraigm 14y ago
    Every time I join the YouTube HTML5 trial it gets silently turned off and videos start playing in Flash again a week or two later. Does that happen to anyone else?
    - nextstep 14y ago
      Yes! I have turned that on many times and I always end up watching flash videos again. I wonder if it had to do with my session cookie expiring. Does anyone know how they toggle this experiment on/off for different users?
      - moreati 14y ago
        I'm in the beta, I've never had to rejoin. Possibly because I'm logged into my Google account, which is linked to my Youtube account. Note that some Youtube videos are still delivered as Flash, I believe is whenever adverts are shown.
  - barrkel 14y ago
    HTML5 videos on YT start automatically, which is exactly what I don't want, and in fact the second-biggest reason I use click-to-flash (first being animated ads). At one point, I was being forcibly opted into HTML5 video on YT and had to disable that feature in Firefox to get back out of it.
Someone 14y ago
Reading http://www.securelist.com/en/analysis/204792250/IT_Threat_Evolution_Q3_2012 http://www.securelist.com/en/analysis/204792250/IT_Threat_Ev..., I find it surprising that the Netherlands manages to be the best malware exporter in the world (third in 'production', close behind Russia and the USA (both with a much larger population), but also in the top 10 for 'least consumption', a list that neither Russia nor the USA made). Does anybody have any idea how that comes about? The only reason I can think of is that Amsterdam is a huge node in the Internet backbone (http://en.wikipedia.org/wiki/Amsterdam_Internet_Exchange http://en.wikipedia.org/wiki/Amsterdam_Internet_Exchange). Malware authors might want to host their stuff close to such nodes, so that they can distribute their wares efficiently.
- budgi3 14y ago
  Amsterdam is a criminal epicenter
  - dr_doom 14y ago
    Any further links or reading? I am very interested in this subject.
    - yread 14y ago
      Just look at the number of banks and high frequency trading shops :D
- rhplus 14y ago
  The Netherlands has a long history of being a hub of international trade, from spices and bulbs to diamonds and IP packets. Add to that its tolerant attitude towards pornography, prostitution and drugs - compared even to much of Western Europe - and it wouldn't be much of a surprise to see organized crime diversifying beyond things like porn hosting (which benefits from the IXP you mention) into malware and identity theft too. (I have no data to back this up...)
pserwylo 14y ago
Ah Shockwave, good to see you again my old friend. I can't believe it's still around and kicking, given the last release of Director seems to be about two years ago. I don't play any online games, but can somebody vouch for whether it is still used to develop browser games anymore?
- TazeTSchnitzel 14y ago
  AFAIK its only advantage was 3D authoring support, and Flash has that too now, so I see no reason to continue using it at all.
VeejayRampay 14y ago
Adobe have been embarrassing themselves for a solid decade now as far as security is involved. Might be time for them to step up.
- rbanffy 14y ago
  I'd be happy with installing their software on case-sensitive filesystems.
artichokeheart 14y ago
Not one Microsoft product on top 10 vulnerabilities affecting Microsoft operating system.
- lostnet 14y ago
  That is a more significant finding! Dropping out of the overall top ten may have little or nothing to do with better security since the calculation is intentionally skewed to measure by number of affected users. MS bugs got raised to the top in a desktop dominant world, but they've lost ground (and therefore importance in this calculation) against mobile/tablet/etc devices making the most successful cross platform products capable of affecting more users.
romland 14y ago
And to think that a free (as in it didn't cost me a cent unless I want to pay for it) piece of software protected me from most of this. The phenomenon known as NoScript is quite marvelous in doing its job without eating much of my CPU cycles :-) Of course, when you get down to the bottom line you know it's not a huge technical feat, but really, neither is anti-virus software. It's a matter of foresight and hard work. Donate today :) (Disclaimer, I am in no way connected with NoScript other than being a happy user) Edit: After posting this I realize it comes across as a bit of advertising and not contributing much to the conversation, I was about to delete it, but I stopped myself and wanted to add: I am -truly- happy not having to (even though I do) worry about what links I can click.
taylorbuley 14y ago
Declining marginal vulnerabilities
lifeguard 14y ago
Let's take a look at CERT, shall we? 17 Sep 2012 VU#480095 Microsoft Internet Explorer 6/7/8/9 contain a use-after-free vulnerability 17 Sep 2012 VU#389795 Windows Phone 7 does not check certificate Common Names when sending or receive Hmm. OK, how about #1 service being remotely attacked right now: MS Terminal Services
- rhplus 14y ago
  The OP is a list of vulerabilities by severity. When I look at the current US-CERT database, I don't see any Microsoft products in the top 10 results by severity[1] or by date[2]. [1] By "Common Vulnerability Scoring System": http://www.kb.cert.org/vuls/byCVSS http://www.kb.cert.org/vuls/byCVSS [2] By Date: http://www.kb.cert.org/vuls/bypublished http://www.kb.cert.org/vuls/bypublished
  - lifeguard 14y ago
    Whatever. " Not one Microsoft product on Kaspersky’s top 10" implies that Microsoft products are secure. They are not.
    - scholia 14y ago
      The notion propagated by fanboys is that Microsoft software is the least secure on the planet, and if you believe that then you might well expect Microsoft to occupy many if not most of the top 10 places. The point of the headline is that it doesn't. It's based on challenging a known assumption, not establishing the opposite assumption.
      - lifeguard 14y ago
        Every time Microsoft releases a new product the Astroturfing goes through the roof and the dishonest message is insulting to experienced system engineers.
        scholia 14y ago
ben0x539 14y ago
All those _s functions must be paying off!
cdibona 14y ago
This reminds me of the bear joke: They only had to outrun oracle and adobe...
- tptacek 14y ago
  The implication here is that Microsoft didn't actually improve their security so much as Oracle and Adobe failed to keep up with theirs. I don't know whether you intended to say that, but either way, it's a false statement.
  - JoeAltmaier 14y ago
    ...or a criticism of Oracle and Adobe, which is then 100% true statement.
tuananh 14y ago
This is because Adobe is doing a too good job putting its products on the list : )
buster 14y ago
And yet a friend of mine has to reinstall her shiny new netbook because apparently there is some nasty rootkit/trojan that cannot be removed (so easily).
Create 14y ago
...they are so valuable, that they are traded on the black market. https://twitter.com/VUPEN/status/263283188175106048 https://twitter.com/VUPEN/status/263283188175106048
hmart 14y ago
The fact hat Adobe still ships expensive, crappy, heavy, memory consuming, battery drain and insecure products is not news. 5 of them in the Top 10.
dschiptsov 14y ago
Sure, the same way there is no danger to heath in fast-food, every advertiser will tell you for sure.)
shocks 14y ago
Now is as good a time as any to disable Flash and Java in my browser. Not sure why I haven't done this earlier. Props to Microsoft though. Nice! :)
stcredzero 14y ago
For security reasons, I've stopped using PDF readers based on Apple and Adobe code. I'm now using XPDF through an Automator app as my default PDF program, with Google Chrome as an alternate.
martinced 14y ago
I'm a long time Java dev and lately it's been terrible, totally terrible, for Java from a security point of view. A gigantic fiasco. Flash's track record is very poor too. Saying that something is "less vulnerable" than these two really doesn't mean much. We're talking about hundreds of millions of zombie PCs due to Java applets + Flash exploits. So being "less vulnerable" than these technologies doesn't mean much. So no Microsoft product in the top 10? You mean Word is not as big as an attack vector as Java applets and Excel is not as big as an entry point as Flash? Is there any surprise in here!? That's not the interesting thing: what concerns most people is the browser they use to surf the Web. Is Safari + Java applet plugin more vulnerable then IE + Java applet? Is Chrome + Flash more vulnerable then IE + Flash? That's what counts. And also: how do you install Java on your system if you really need it (e.g. because you're a Java dev) and yet make sure it's not available from your browser? Or from another user account? This kind of stuff is trivial to do on Linux: it's been a long time since I'm using a throwaway user account that has no Java installed to "surf the Web" (using Chrome but whatever). It's trivial to do because on Linux you can install Java from a regular user account (no need to be root). On Windows this is not possible: installing Java requires the admin password and opens a whole can of worms ; ) I can tell you: I'm surfing from Linux using Chrome which has Flash. I also have Java installed in a separate (developer) user account. And I'm pretty sure this is more secure than surfing from a Windows machine, no matter where Microsoft stands in that report from their "friend in bed" Kaspersky... Also, for a little touch of irony regaring the article, Kaspersky's revenues are virtually entirely coming from sales of anti-virus protecting Windows OSes. Why aren't they succesful on the Linux servers powering the Internet?

326 points by tarekayna 14y ago

It's actually this bit from farther down that surprised me the most: > 56 percent of exploits blocked in Q3 use Java vulnerabilities. So much for the idea of a managed language runtime being inherently more secure...

MichaelGG 14y ago
The runtime isn't written in a managed language, and that's where most of the vulnerabilities happen, right? The holes aren't in application code, but in _running arbitrary code_, which the JVM fails to do safely. The surface area exposed is larger, because you're allowing the browser to download and run arbitrary programs, something you don't do with unmanaged languages very much. Edit: Also, just consider how much worse it'd be if Java apps were re-written in a language that allows buffer overflows. Enterprises already cannot get security right; even generating SQL queries results in problems. No way would those teams deal with yet another layer of security issues. Hell, I've dealt with commercial teams writing in C++ thinking a buffer overflow has "something to do with network rate limiting."
- deleted 14y ago
  [deleted]
- 0x0 14y ago
  > "The runtime isn't written in a managed language, and that's where most of the vulnerabilities happen, right?" At least some of those Java vulnerabilities are logic errors in the sandboxing/securitymanager parts that are supposed to prevent applets from accessing privileged APIs, and those checks are usually implemented inside the actual java.* standard library classes, in the Java language.
lucian1900 14y ago
It is inherently more secured in the same context. The JVM applet sandbox has to stand up to random code off the internet, whereas native code is almost only installed explicitly. Remember ActiveX and how it was worse than Java applets?
- jlgreco 14y ago
  It seems to me that the only reason we put up with JVM applets (whereas anyone suggesting we put up with people ActiveX would rightfully be laughed down these days) is because of that steady monotonous stream of crap about how much better Java is for security. It has dropped our collective paranoia far too low.
  - jebblue 14y ago
    Java is or was until very recently as anyone who has used it since 1995 will know and remember. Recent issue have arisen, hopefully Oracle is going to get its track record up to what Sun's was. Until then, a few bad recent reports for Java 7 will not wipe out decades of countless security reports for all of Windows Operating System and many relied upon Windows applications. Java applets are still far more efficient and far more powerful and have far greater operability with Java web server software than even HTML5 will have.
    - jongalloway2 14y ago
      History and hopefully don't really factor into a thoughtful analysis of current security issues.
      - jebblue 14y ago
        Are you saying history in general is not pertinent to analysis? Is your rule only true for security issues or you do you feel that way about everything?
  - ______ 14y ago
    Unfortunately places like Korea still require ActiveX support because it's used by all online shopping, government, etc pages (and is required by law in many cases)... http://www.koreaittimes.com/story/21504/internet-powerhouse-korea-%E2%80%9Cactivex-controls%E2%80%9Daddict http://www.koreaittimes.com/story/21504/internet-powerhouse-...
meaty 14y ago
Well CLR seems to be OK so I think this is down to the implementation rather than the concept.
- aidenn0 14y ago
  Fewer browsers will run CLR code, so harder to do a drive-by.
  - rhplus 14y ago
    That's not true. All four major browsers can run CLR code through Silverlight [1] and depending on the statistics you use, the installation base for the plugin is in the same ballpark as Java, somewhere between 65% and 75% [2]. StatOwl even has Silverlight slightly ahead of Java at 69.7% vs 70.0% [3]. Of course, these are desktop stats. On mobile, it's a different story. [1] http://www.microsoft.com/getsilverlight/Get-Started/Install/Default.aspx http://www.microsoft.com/getsilverlight/Get-Started/Install/... [2] http://en.wikipedia.org/wiki/Microsoft_Silverlight#Adoption http://en.wikipedia.org/wiki/Microsoft_Silverlight#Adoption [3] http://riastats.com/ http://riastats.com/ [4] http://www.statowl.com/custom_ria_market_penetration.php http://www.statowl.com/custom_ria_market_penetration.php
tptacek 14y ago
The problem mostly isn't the runtime itself, but instead the various 3rd party modules (all of which are written in late-90's-era C/C++) that get hooked up to the JVM. For instance, the Quicktime API for Java exposed scalar integers, intended to be "opaque", but in fact raw memory locations. The JVM is good. The Java Applet Plugin, on the other hand, is a problem.
- ajross 14y ago
  Well, sure. But I think that's maybe missing my point -- a managed runtime needs "holes" in it to do its job, which exposes the security problems of the rest of the system via inevitably leaky abstractions. The point was that the managed runtime does nothing to address this, it has to drill down to a C API at some point (or deeper, consider a similar hole in a shader compiler or video codec accelerator). And contrast with alternative affirmative/MAC-based sandboxing schemes like Chrome's NaCl, or OS-level stuff using SELinux/AppArmor. These don't require a managed runtime at all, and yet appear ("appear" being a critical point of courses) to solve this problem in a more robust way.
  - tptacek 14y ago
    So, you're right of course, but I just want to point out that the JVM is very very widely used in another setting other than applets where it has a much better track record: serverside web applications. I'm not sure we really know how to secure a desktop application / fat client platform yet.
  - pjmlp 14y ago
    The best way would be a sandoxing model like SELinux/AppArmor/GateKeeper coupled with a microkernel.
  - ujdtyhf 14y ago
    Yet you are viewing this page a with browser that loads and automatically executes untrusted JavaScript code under managed runtime.
    - 14y ago
AlexDanger 14y ago
So the question remains - how best to run Java on a Windows machine and minimise your risk? I've got Win7/64, service packs up to date, java autoinstaller thing....what else can I do?
- josteink 14y ago
  Set your browser to never auto-launch plugins, but require click to play. If you're not already using ad-block, you will be amazed by how much it improves the performance of your general internet-surfing. So, besides security mindedness, there are already other good reasons for doing it.

experiment0 14y ago

Sorry for going off topic but, I hadn't seen the nextweb new design before. I found it quite disorientating, there is so much orange "stuff". I just didn't know where to look.

artursapek 14y ago
I agree, it feels like a complete downgrade to me. It feels like they're trying to be Gawker.
- thoughtpalette 14y ago
  I felt the same. I was thrown off with the side bar on the left rather than right though.
rndmize 14y ago
I wasn't bothered by the colors so much as the layout. Almost every news source I read has the article all the way to the left, with navigation at the top and secondary content on the right. Having the navigation on the left and the content on the right was disorienting (and I've felt the same with Google's newer blog layouts). I can understand doing this on a tablet, but on a desktop it feels... overly simplified.
- Roboprog 14y ago
  Worse for me on my (1024 x 600) netbook: the actual content wasn't even completely visible until I shrunk the font size several notches.

boyter 14y ago

I usually get shouted down when I say this but Microsoft's focus on secure code over the last 10 years has paid off. Not only is the OS too hard a target hence the increase in Java, adobe product exploits, but their software running on their OS has fallen in line too. I know the saying many eyes make bugs shallow, but so does billions of dollars and years of concentrated effort. Kudos to Microsoft for getting their act together.

Legion 14y ago
> I know the saying many eyes make bugs shallow, but so does billions of dollars and years of concentrated effort. The saying holds. Billions of dollars buys many eyes.
- jcheng 14y ago
  That's not really how secure coding works at Microsoft though. There aren't more eyes on the code, just more developer training and more processes in place. (At least that was my experience working there from 2006 to 2009.)
  - tptacek 14y ago
    There are more eyes on the code too, though: virtually everything Microsoft ships gets a 3rd party review.
    - Locke1689 14y ago
      We also have mandatory security training for all developers. Turning every developer into a security reviewer helps a lot. It's nothing compared to the knowledge I got by working in app sec or teaching network security, but it's pretty good for increasing the base of knowledge among general developers.
    - dllthomas 14y ago
      ... that still isn't "many eyes" on any particular piece of code, in the sense of the saying, though.

sriramk 14y ago

This is the result of nearly a decade of work from MSFT, across the board. They built better tools, drilled security into every new hire all the way to the execs, made it a part of every engineering and product process imaginable. Happy that is finally being acknowledged on the outside.

Breakthrough 14y ago
"Happy that is finally being acknowledged on the outside." Not to mention by a reputable security company in the business (we all know there's some sources whom are... biased... to put it nicely). Congrats to Microsoft, glad to see they've put security so highly on their priority list. Not to mention the involvement they try to get with hackers, and worldwide trying to stop spam botnets, etc... Very nice to see a corporation working like that.
- Centigonal 14y ago
  I think it's actually "who" in this case: the pronoun is the subject of "are biased."
psychotik 14y ago
I still remember how painful it was to ship anything, waiting in queue for security team signoff. Good to see it payoff though. Good on Microsoft - making secure products and smarter engineers in the process.
shitlord 14y ago
Now I wish Adobe would do the same thing.
- tptacek 14y ago
  They very much are, and have been, for awhile.
  - icefox 14y ago

pooriaazimi 14y ago

Haha. Great to see iTunes and QuickTime (Windows versions, probably?) on the list... Apple should really either update them (I'm not sure iTunes 11 will be released for windows too), or just abandon them (and ask customers to use iCloud for backup). A few days ago I opened a .mov on a Windows machine with QuickTime - it was horrible. I can't imagine how dreadful iTunes probably is. No wonder all PC guys hate iTunes...

robomartin 14y ago
I hate iTunes on every platform. It's bloated; it tries to do too many things and it does them all wrong. Just as an example, searching for anything with iTunes is a horrible experience, particularly when compared with searching the 'net with any of the top search engines. Book, app and media management are terrible. Cross-computer management of the same is terrible. Backing-up your iPhone, if you are not careful, can result in erasing every single app from your phone and replacing them with what happens to be on the new machine's iTunes. Take a music database that Windows Media deals with without any issues whatsoever (devoid of metadata other than folders with the album name and files with the song names). Import it into iTunes and watch it get mangled. Albums get destroyed, songs end-up categorized in weird ways, etc.
- pooriaazimi 14y ago
  Yeah, I feel you. I'm on OS X and hate iTunes with a passion (it's almost an obsession). I almost died of grief when I learned iTunes 11 was delayed... The sheer number of bugs that crapware has is unbelievable. And don't get me started on Music.app on iPad (iOS 5 and 6), or the dreadful state of "Shared Media" in iPhone and iPad's Music apps (stream from a computer). God I hate them. If I ever switch from iOS/Mac, iTunes/Music.app are to blame.
- moepstar 14y ago
  I hate iTunes too for all of the reasons mentioned above, however there's one thing it does at least half-ok'ish: It doesn't eat a ton of CPU while playing a few simple MP3s... I've tried using Clementine (an Amarok-fork, my favourite music-player by far, at least on Linux) but it's just a resource-hog - comparatively at least. So yeah - does anyone have suggestions on what to use for music playback? Something that doesn't suck? Something that doesn't waste precious CPU-cycles without reason, generating heat and wasting battery on the go?

nostromo 14y ago

Interesting to note that both Apple vulnerabilities listed exist only for their Windows software. (QuickTime: http://lists.apple.com/archives/security-announce/2012/May/msg00005.html http://lists.apple.com/archives/security-announce/2012/May/m... iTunes: http://support.apple.com/kb/HT5485 http://support.apple.com/kb/HT5485) I wonder if these are lower priority for Apple or if they perhaps just aren't as good when developing for Windows.

Maakuth 14y ago
I think it could be that the platform works differently enough that you can build vulnerable Windows software by just making some assumptions that would be correct in OSX land but not in Windows. Vice versa, most probably.
psychotik 14y ago
If I understand correctly, I think it's a function of how they rank their vulnerabilities. "The rankings are based on the percentage of users whose computers had the vulnerability in question" Machines running Apple software on Windows >> machines running Apple software on Macs. So the same vulnerability wouldn't show up even if it existed in iTunes on OSX, for example.
gilgoomesh 14y ago
Quicktime on Windows is stuck at version 7, which is riddled with numerous problems. It's this old Quicktime codebase that is the source of the Quicktime and iTunes vulnerabilities on Windows. The current version on Mac and iOS is Quicktime X. This version was a complete rewrite (that started on iOS and eventually migrated to the Mac). The complete rewrite allowed for a vastly more secure design (among other improvements).
- shinratdr 14y ago
  But the iTunes backend is still QuickTime 7 on both Mac OS X and Windows. QuickTime is really only present on Windows machines nowadays as the backend of iTunes.

drivebyacct2 14y ago

Beat by Oracle and Adobe. Something to truly be proud of. Aw, no one else finds this to be a strange brag? Should we make a list of all of the companies that aren't up there?

xer0x 14y ago
I agree, this is a really weird post.
- drivebyacct2 14y ago
  Careful, that's a suicidal comment.

rgbrenner 14y ago

Oracle took the top 2, but Adobe had 5 runners up. Too bad Adobe couldn't overtake Oracle, they clearly put in a lot of effort at it. And Microsoft.. not even being listed? Are they even trying anymore?

camus 14y ago
but oracle products account for 53 of the malware attacks !

bprater 14y ago

Is it getting safer to say that antivirus software may soon be a thing of the past?

zalzane 14y ago
selling antivirus software is a lot less about fixing viruses than it is about convincing the average computer user that they are at risk without XXX antivirus suite.
Corrado 14y ago
My question is, would you run Windows 7/8 without any anti-virus software at all? Do you feel that comfortable? After years of Linux/OS X I can safely say that I won't use an OS that requires anti-virus ever again.
- Negitivefrags 14y ago
  I have never run a windows system with anti virus. There is a very simple technique. Don't install viruses.
  - Jarshwah 14y ago
    I've had a single virus on a windows machine, and I was about 90% sure that it was going to be a virus and wanted to see what happened. I don't run anti-virus software, but I think it's only the power users that are capable of doing so. User education is still too low. Would you trust your parents or grand-parents to "not install a virus" ?
  - rbanffy 14y ago
    Considering the kinds of vulnerabilities we've seen, this may prove difficult. I remember one where browsing to a folder with a specially crafted image provoked a buffer overflow that got exploited.
- freehunter 14y ago
  I used to run Security Essentials. When I upgraded to 8, it automatically uninstalled it. It's baked into the OS now, along with a constantly updated blacklist of known malware programs if you try to manually install something bad. You can get around it easily, but they don't make it intuitive to do so for users who are not comfortable clicking around and exploring. Above and beyond being comfortable not using an AV on Windows 8, I would go as far as to say that if you are using an AV on Windows 8, you're being taken for a ride by your vendor of choice. And I say this as an information security professional. I've tried to get a virus on Windows 8 without doing anything more than what it takes to get a virus on Windows 7. I did not succeed.

Lagged2Death 14y ago

I figured there would be a lot of Adobe stuff on the top 10, but that is a lot of Adobe stuff.

ecounysis 14y ago

Glancing at the list, I see there are only four companies in the world who cannot claim they don't have a single product on Kapersky's top 10 vulnerabilities list.

encoderer 14y ago
But the fact that the largest software company in the world is among them is what's notable.
- ecounysis 14y ago
  Yes. I wonder what percentage of vulnerabilities 11-20 belong to Microsoft?

UnoriginalGuy 14y ago

If you're running Chrome please for the love of all that is holy enable Click-To-Play for all plugins. With it disabled it is like running without a pop-up blocker. You can do so in Settings -> Advanced Settings -> Content Settings -> Plug-Ins -> Click To Play. When you visit a site which has a plug-in you'll get a UI control similar to the pop-up blocker which allows you to add it to the exceptions list and or to allow it just this one time. You should add YouTube to the exceptions list.

nickbaum 14y ago
Or better yet, switch YouTube to the HTML5 player: http://www.youtube.com/html5 http://www.youtube.com/html5 One less site that needs Flash.
- padraigm 14y ago
  Every time I join the YouTube HTML5 trial it gets silently turned off and videos start playing in Flash again a week or two later. Does that happen to anyone else?
  - nextstep 14y ago
    Yes! I have turned that on many times and I always end up watching flash videos again. I wonder if it had to do with my session cookie expiring. Does anyone know how they toggle this experiment on/off for different users?
    - moreati 14y ago
      I'm in the beta, I've never had to rejoin. Possibly because I'm logged into my Google account, which is linked to my Youtube account. Note that some Youtube videos are still delivered as Flash, I believe is whenever adverts are shown.
- barrkel 14y ago
  HTML5 videos on YT start automatically, which is exactly what I don't want, and in fact the second-biggest reason I use click-to-flash (first being animated ads). At one point, I was being forcibly opted into HTML5 video on YT and had to disable that feature in Firefox to get back out of it.

Someone 14y ago

Reading http://www.securelist.com/en/analysis/204792250/IT_Threat_Evolution_Q3_2012 http://www.securelist.com/en/analysis/204792250/IT_Threat_Ev..., I find it surprising that the Netherlands manages to be the best malware exporter in the world (third in 'production', close behind Russia and the USA (both with a much larger population), but also in the top 10 for 'least consumption', a list that neither Russia nor the USA made). Does anybody have any idea how that comes about? The only reason I can think of is that Amsterdam is a huge node in the Internet backbone (http://en.wikipedia.org/wiki/Amsterdam_Internet_Exchange http://en.wikipedia.org/wiki/Amsterdam_Internet_Exchange). Malware authors might want to host their stuff close to such nodes, so that they can distribute their wares efficiently.

budgi3 14y ago
Amsterdam is a criminal epicenter
- dr_doom 14y ago
  Any further links or reading? I am very interested in this subject.
  - yread 14y ago
    Just look at the number of banks and high frequency trading shops :D
rhplus 14y ago
The Netherlands has a long history of being a hub of international trade, from spices and bulbs to diamonds and IP packets. Add to that its tolerant attitude towards pornography, prostitution and drugs - compared even to much of Western Europe - and it wouldn't be much of a surprise to see organized crime diversifying beyond things like porn hosting (which benefits from the IXP you mention) into malware and identity theft too. (I have no data to back this up...)

pserwylo 14y ago

Ah Shockwave, good to see you again my old friend. I can't believe it's still around and kicking, given the last release of Director seems to be about two years ago. I don't play any online games, but can somebody vouch for whether it is still used to develop browser games anymore?

TazeTSchnitzel 14y ago
AFAIK its only advantage was 3D authoring support, and Flash has that too now, so I see no reason to continue using it at all.

VeejayRampay 14y ago

Adobe have been embarrassing themselves for a solid decade now as far as security is involved. Might be time for them to step up.

rbanffy 14y ago
I'd be happy with installing their software on case-sensitive filesystems.

artichokeheart 14y ago

Not one Microsoft product on top 10 vulnerabilities affecting Microsoft operating system.

lostnet 14y ago
That is a more significant finding! Dropping out of the overall top ten may have little or nothing to do with better security since the calculation is intentionally skewed to measure by number of affected users. MS bugs got raised to the top in a desktop dominant world, but they've lost ground (and therefore importance in this calculation) against mobile/tablet/etc devices making the most successful cross platform products capable of affecting more users.

romland 14y ago

And to think that a free (as in it didn't cost me a cent unless I want to pay for it) piece of software protected me from most of this. The phenomenon known as NoScript is quite marvelous in doing its job without eating much of my CPU cycles :-) Of course, when you get down to the bottom line you know it's not a huge technical feat, but really, neither is anti-virus software. It's a matter of foresight and hard work. Donate today :) (Disclaimer, I am in no way connected with NoScript other than being a happy user) Edit: After posting this I realize it comes across as a bit of advertising and not contributing much to the conversation, I was about to delete it, but I stopped myself and wanted to add: I am -truly- happy not having to (even though I do) worry about what links I can click.

taylorbuley 14y ago

Declining marginal vulnerabilities

lifeguard 14y ago

Let's take a look at CERT, shall we? 17 Sep 2012 VU#480095 Microsoft Internet Explorer 6/7/8/9 contain a use-after-free vulnerability 17 Sep 2012 VU#389795 Windows Phone 7 does not check certificate Common Names when sending or receive Hmm. OK, how about #1 service being remotely attacked right now: MS Terminal Services

rhplus 14y ago
The OP is a list of vulerabilities by severity. When I look at the current US-CERT database, I don't see any Microsoft products in the top 10 results by severity[1] or by date[2]. [1] By "Common Vulnerability Scoring System": http://www.kb.cert.org/vuls/byCVSS http://www.kb.cert.org/vuls/byCVSS [2] By Date: http://www.kb.cert.org/vuls/bypublished http://www.kb.cert.org/vuls/bypublished
- lifeguard 14y ago
  Whatever. " Not one Microsoft product on Kaspersky’s top 10" implies that Microsoft products are secure. They are not.
  - scholia 14y ago
    The notion propagated by fanboys is that Microsoft software is the least secure on the planet, and if you believe that then you might well expect Microsoft to occupy many if not most of the top 10 places. The point of the headline is that it doesn't. It's based on challenging a known assumption, not establishing the opposite assumption.
    - lifeguard 14y ago
      Every time Microsoft releases a new product the Astroturfing goes through the roof and the dishonest message is insulting to experienced system engineers.
      - scholia 14y ago

ben0x539 14y ago

All those _s functions must be paying off!

cdibona 14y ago

This reminds me of the bear joke: They only had to outrun oracle and adobe...

tptacek 14y ago
The implication here is that Microsoft didn't actually improve their security so much as Oracle and Adobe failed to keep up with theirs. I don't know whether you intended to say that, but either way, it's a false statement.
- JoeAltmaier 14y ago
  ...or a criticism of Oracle and Adobe, which is then 100% true statement.

tuananh 14y ago

This is because Adobe is doing a too good job putting its products on the list : )

buster 14y ago

And yet a friend of mine has to reinstall her shiny new netbook because apparently there is some nasty rootkit/trojan that cannot be removed (so easily).

Create 14y ago

...they are so valuable, that they are traded on the black market. https://twitter.com/VUPEN/status/263283188175106048 https://twitter.com/VUPEN/status/263283188175106048

hmart 14y ago

The fact hat Adobe still ships expensive, crappy, heavy, memory consuming, battery drain and insecure products is not news. 5 of them in the Top 10.

dschiptsov 14y ago

Sure, the same way there is no danger to heath in fast-food, every advertiser will tell you for sure.)

shocks 14y ago

Now is as good a time as any to disable Flash and Java in my browser. Not sure why I haven't done this earlier. Props to Microsoft though. Nice! :)

stcredzero 14y ago

For security reasons, I've stopped using PDF readers based on Apple and Adobe code. I'm now using XPDF through an Automator app as my default PDF program, with Google Chrome as an alternate.

martinced 14y ago

I'm a long time Java dev and lately it's been terrible, totally terrible, for Java from a security point of view. A gigantic fiasco. Flash's track record is very poor too. Saying that something is "less vulnerable" than these two really doesn't mean much. We're talking about hundreds of millions of zombie PCs due to Java applets + Flash exploits. So being "less vulnerable" than these technologies doesn't mean much. So no Microsoft product in the top 10? You mean Word is not as big as an attack vector as Java applets and Excel is not as big as an entry point as Flash? Is there any surprise in here!? That's not the interesting thing: what concerns most people is the browser they use to surf the Web. Is Safari + Java applet plugin more vulnerable then IE + Java applet? Is Chrome + Flash more vulnerable then IE + Flash? That's what counts. And also: how do you install Java on your system if you really need it (e.g. because you're a Java dev) and yet make sure it's not available from your browser? Or from another user account? This kind of stuff is trivial to do on Linux: it's been a long time since I'm using a throwaway user account that has no Java installed to "surf the Web" (using Chrome but whatever). It's trivial to do because on Linux you can install Java from a regular user account (no need to be root). On Windows this is not possible: installing Java requires the admin password and opens a whole can of worms ; ) I can tell you: I'm surfing from Linux using Chrome which has Flash. I also have Java installed in a separate (developer) user account. And I'm pretty sure this is more secure than surfing from a Windows machine, no matter where Microsoft stands in that report from their "friend in bed" Kaspersky... Also, for a little touch of irony regaring the article, Kaspersky's revenues are virtually entirely coming from sales of anti-virus protecting Windows OSes. Why aren't they succesful on the Linux servers powering the Internet?