NetWitness found a botnet with control of 74,126 Windows systems spread around 196 countries. These systems are found at medical companies, insurance companies, educational institutions, energy firms, financial companies, Internet providers, and government agencies.
Prevx came upon a cache with logon credentials for 74,000 FTP accounts. These accounts were for companies such as NASA, Cisco, Kaspersky, McAfee, Symantec, Amazon, Bank of America, Oracle, ABC, BusinessWeek, Bloomberg, Disney, Monster, and the Queensland government.
You know, you start to become jaded concerning the security of the most popular OS on planet Earth.
The OS that 90% of the people viewing this blog use.
The OS that your company runs on.
The OS that your government runs on.
The OS your school, college or university runs on.
The OS that your bank probably uses.
The OS that despite being quite clearly not fit for use, somehow continues to be used, because so many people’s lives dependent on it.
What people? Well you, me, the IT department that won’t even let you change your desktop pattern wallpaper at work, your parents, your friends, the guy you overheard talking in the bus queue this morning about how his computer has become unusable again, or the other guy he was talking to who said that all he had to do was:
a) pay for more security software
b) visit this site that tells you how to solve your latest Windows problem in 38 easy steps
c) buy a new computer
d) don’t do anything on your computer to do with online banking or payments of any kind.
And, yes that last group of people who benefit from the crap that Gates & Ballmer peddle every day – the criminals and ne’r-do-wells that use the money they generate from hacking your computer to buy & supply drugs to your kids, fund terrorism, and various other nasties.
Lots of fun for all concerned.
Thank you Mr Gates and Mr Ballmer for all this, and thank you Apple for allowing me to write this blog on a computer that is not affected by any of this.
Sorry for being so jaded, but I don’t see anyone, anytime soon kicking Windows technology out of the door.
I remember a Christian once saying to me that the best day’s work that the Devil ever did, was to convince everyone that he didn’t exist.
A similar analogy, is that the socialists have convinced everyone that George Orwell’s book ‘1984’ was about fascism, when actually it’s about the dangers of unrestricted socialism (IngSoc, stands for Engligh Socialism).
These thoughts were piqued when I read a newspaper article in the UK’s DailyMail newspaper, outlining the experience the reporter had when they accidentally clicked on a spammer’s email.
The chaos that ensued, highlighted the dangers of clicking on these sorts of emails, and the article well worth a skim:
I always like to read articles like this because they show the computer experiences of your average Windows user; and I mean the really average Windows user.
The average Windows user makes up the majority of Microsoft customer base, and this article perfectly illustrates the clever trick that Microsoft has played upon them.
The article in question is basically about someone who received an email that asked for all sorts of personal information. This email was a spam email, but the user dumbly accepted it as legitimate, and duly got conned – malware was installed and all sorts of chaos ensued.
Now you can comment on the ineptness of the user, but this article isn’t about their stupidity, it’s about the person that they ultimately blamed.
It’s a big, long article that goes into great detail about what happened to them, but nowhere and I mean nowhere in the article is the word ‘Windows’ or the word ‘Microsoft’ mentioned. Not once.
Ultimately the person who they blamed was – Yahoo. They blamed the email service for failing to filter out the email.
Not themselves for being so inept, not Microsoft for selling them an OS with security holes, but Yahoo. Poor Yahoo.
From the article:
Finally on Monday, three days later, smooth-sounding Jessica from ‘the Yahoo concierge service’ called to help me get back into my account and reassure me that Yahoo took such violations very seriously.She would not be drawn on who might be responsible at Yahoo for stopping hackers. I wanted to know why Yahoo’s own filter system hadn’t spotted a bogus email sent in their name and taken it out before I opened it.
- You for not constantly being on your guard to make up for the fact that an email link can allow remote software to be installed.
- The ‘bad guys’ who send out these emails and take advantage of the security holes in Microsoft software
- The email provider for not filtering out the ‘bad guy’s’ emails.
I’ve long thought that the complexities of the Windows world were, in part, exaggerated by Apple users and their media (I’ve even been guilty of it myself), but I’m here to tell you now, it’s worse than everyone’s ever thought.
I’m now in charge of the company’s website. I relaunched it in the middle of last year and when faced with the complete rewrite that was needed, I decided that the best approach was a Content Management System (CMS) for the website so that anyone with a basic grasp of computers could update it. I certainly don’t have time to administer the website using Dreamweaver, so the plan was to buy in a CMS so that the less web-ware members of my staff could update the site in my absence.
The journey through this has been a difficult one with various problems too numerous to mention, except one. One that has shown me that the complexities of the Windows world are not exaggerated.
At the heart of the website is a registration system that allows a web-user to fill in a standard html form, upload a couple of graphics and then submit this to a choice of a dozen or so destinations. In the background this submission is then uploaded to a centrally stored database, and then automatically emailed to 1 of 10 users of the system. Once received, these users then contact the web-user and process their registration.
Except it doesn’t work. In fact in the 10 months or so since the website launched, it’s never worked.Of course, actually finding this out was an arduous task in itself.
Suffice to say after tracking the problem it appears it boils down to this: The web-users form is received centrally, perfectly. It’s when this form is emailed through my company’s webserver, we have a problem. It just never gets there. Doesn’t even register as spam, it just doesn’t arrive.
Changing the destination to a ‘@googlemail.com’ domain – it works fine.
It’s something to do with the website’s backend software communicating to our email server, they just don’t get along. Of course the one set of Windows users (who run the back-end website software for us), blame the other set of Windows users (who run our email server). I have the envious task of arranging a meeting between these 2 groups to hammer out a solution.
In the meantime, I, a lowly Mac-user, not versed in the intricate voodoo of email systems, has come up with a solution. All submissions from the website go to a ‘@googlemail.com’ email address, I set up for this purpose. They then come through to Apple Mail, where a Apple Mail set of rules, then examines the email, determines which destination it’s meant for and then forwards it on. This works fine.
But why doesn’t it one Windows based email system, work with another? It seems to me that these ‘experts’ haven’t a clue, at a low-level, how Windows actually works, and that is a scary thought, and it has taken a single G5 Mac and Apple Mail, to sort out the problem (at least in the short term).
The Washington Post reports that some PC users have declared their email bankrupt, announcing to everyone on their contacts lists that they are giving up on responding to the glut of e-mail in their inboxes. Some are even giving up on email entirely and returning to the communication technology that started it all – the telephone.
I look at news like this and roll my eyes and sigh. The world has been given short shrift on a fantastic communication technology, one that should have revolutionised our lives for the better. What went wrong? I can sum it up in one word – Microsoft, and the minions that serve them.
I run a small art department inside the belly of a larger PC-based organisation. Having set up this studio myself from the ground up, I had complete say in exactly what I wanted – the Windows based IT department is full of clueless PC drones who’s last experience of the Mac was sarcastic Mac-bashing articles from copies of PC magazines back in 1996.
So I was left well alone – and thank god. Mac OS X 10.2 was my choice when I got the studio running and I made sure that certain things were in place:
1) We had our own network – all Mac network & printer ethernet cables go through a single switch, positioned in the studio, and we have a single ethernet cable which connects us to the PC network, therefore any problems caused by the PC network can be disconnected straight away.
2) Although we use the PC network’s email, we do not use software that they recommend. I used the crap OS8 port of Outlook for years – very painful. No, we use Apple Mail.
3) All Mac IT related problems are our problems – we sort them out, and in turn, we end up sorting them out with minimal fuss. No putting a support call through to IT and then waiting 3 days before it’s answered in this department. Not that this happens very often, I’ve had 1 days down time in 6 years, and that was to upgrade to Tiger.
So there I’ve set the scene. The company email used to run through Outlook. Lucky for us, it allowed POP or IMAP access, so Apple Mail worked quite happily, as long as we knew the IP addresses.
However I began to notice that when sending email back to PC’s I would sometimes get no reply. Upon investigating I found that it was not a technical problem, it was a social one – the recipients simply had too much email spam to get through and would either resort to deleting it en masse, in the hope that any really important messages would be re-sent, or simply ignoring their email completely.
Something has to change. The IT department decided to ‘upgrade’ the email, by moving over to a web mail service provider (not one I’ve ever heard of), with (apparently), 1st class spam filtering.
This move didn’t affect us; I didn’t expect Safari (or Firefox for that matter) to work, and it didn’t. However being web based we could access it via POP or IMAP in Apple Mail, so that is what we do, and it works fine.
However the spam problem still remains. The ‘1st-class spam filtering’ seems to mean that any email that isn’t our company domain is labelled as [SPAM], it still gets through,it still clogs up people’s email, and ‘real’ email still gets missed.
The main problem (and its solution) here is the difference between the way in which Apple Mail handles spam, and the PC server handles spam.
Faced with the spam problem, PC-based IT departments choose to handle the spam centrally – all email is fed through the filter and one size fits all. I get important communications for instance from newpapers, telling me about last minute availability of ad space. Guess what? It’s labelled as spam, and I can’t tell the server that this shouldn’t be labelled as spam, it doesn’t work like that, it sometimes goes into my junk folder, sometimes doesn’t.
Now somebody else getting that message, may agree that it IS spam, in my department it ISN’T spam. Get it?
The solution to the whole spam problem, is to handle spam at the client level. The spam filter in Apple mail is absolutely the best piece of software engineering I’ve ever seen. I roughly get 300 emails a day, about 25 of these are legitimate and Apple Mail 99.9% of the time gets it spot on, I’ve been training it for about 3 months, but it got it pretty right first time.
One person’s spam, is another person’s great offer, so why don’t we just let it all through and let the user decide? Because again, this shows the fundamental problem with computer infrastructure’s: you dear user are hated and loathed by those people who should serve YOUR best interests, instead they choose to serve THEIR best interests.
An unknown writer once said, “”Personal computing can be seen as serving the needs of those who have CREATED the system, instead of serving those who USE the system.”