Not one Microsoft product on Kaspersky’s top 10 vulnerabilities list

http://thenextweb.com/microsoft/2012/11/02/microsofts-security-team-is-killing-it-not-one-product-on-kasperskys-top-10-vulnerabilities-list/?utm_campaign=social%20media&utm_medium=share%20button&utm_content=Microsofts%20security%20team%20is%20killing%20it:%20Not%20one%20product%20on%20Kasperskys%20top%2010%20vulnerabilities%20list&awesm=tnw.to_lLo7&utm_source=Twitter

by tarekayna • 14 years ago

326 135 14 years ago

thenextweb.com

ajross2• 14 years ago

It's actually this bit from farther down that surprised me the most:

> 56 percent of exploits blocked in Q3 use Java vulnerabilities.

So much for the idea of a managed language runtime being inherently more secure...

MichaelGG• 14 years ago

The runtime isn't written in a managed language, and that's where most of the vulnerabilities happen, right? The holes aren't in application code, but in _running arbitrary code_, which the JVM fails to do safely.

The surface area exposed is larger, because you're allowing the browser to download and run arbitrary programs, something you don't do with unmanaged languages very much.

Edit: Also, just consider how much worse it'd be if Java apps were re-written in a language that allows buffer overflows. Enterprises already cannot get security right; even generating SQL queries results in problems. No way would those teams deal with yet another layer of security issues. Hell, I've dealt with commercial teams writing in C++ thinking a buffer overflow has "something to do with network rate limiting."

0x0• 14 years ago

> "The runtime isn't written in a managed language, and that's where most of the vulnerabilities happen, right?"

At least some of those Java vulnerabilities are logic errors in the sandboxing/securitymanager parts that are supposed to prevent applets from accessing privileged APIs, and those checks are usually implemented inside the actual java.* standard library classes, in the Java language.

lucian1900• 14 years ago

It is inherently more secured in the same context. The JVM applet sandbox has to stand up to random code off the internet, whereas native code is almost only installed explicitly.

Remember ActiveX and how it was worse than Java applets?

jlgreco• 14 years ago

It seems to me that the only reason we put up with JVM applets (whereas anyone suggesting we put up with people ActiveX would rightfully be laughed down these days) is because of that steady monotonous stream of crap about how much better Java is for security. It has dropped our collective paranoia far too low.

meaty• 14 years ago

Well CLR seems to be OK so I think this is down to the implementation rather than the concept.

aidenn0• 14 years ago

Fewer browsers will run CLR code, so harder to do a drive-by.

tptacek12• 14 years ago

The problem mostly isn't the runtime itself, but instead the various 3rd party modules (all of which are written in late-90's-era C/C++) that get hooked up to the JVM. For instance, the Quicktime API for Java exposed scalar integers, intended to be "opaque", but in fact raw memory locations.

The JVM is good. The Java Applet Plugin, on the other hand, is a problem.

ajross2• 14 years ago

Well, sure. But I think that's maybe missing my point -- a managed runtime needs "holes" in it to do its job, which exposes the security problems of the rest of the system via inevitably leaky abstractions. The point was that the managed runtime does nothing to address this, it has to drill down to a C API at some point (or deeper, consider a similar hole in a shader compiler or video codec accelerator).

And contrast with alternative affirmative/MAC-based sandboxing schemes like Chrome's NaCl, or OS-level stuff using SELinux/AppArmor. These don't require a managed runtime at all, and yet appear ("appear" being a critical point of courses) to solve this problem in a more robust way.

AlexDanger• 14 years ago

So the question remains - how best to run Java on a Windows machine and minimise your risk?

I've got Win7/64, service packs up to date, java autoinstaller thing....what else can I do?

josteink• 14 years ago

Set your browser to never auto-launch plugins, but require click to play.

If you're not already using ad-block, you will be amazed by how much it improves the performance of your general internet-surfing. So, besides security mindedness, there are already other good reasons for doing it.

experiment0• 14 years ago

Sorry for going off topic but, I hadn't seen the nextweb new design before. I found it quite disorientating, there is so much orange "stuff". I just didn't know where to look.

artursapek• 14 years ago

I agree, it feels like a complete downgrade to me. It feels like they're trying to be Gawker.

thoughtpalette• 14 years ago

I felt the same. I was thrown off with the side bar on the left rather than right though.

rndmize• 14 years ago

I wasn't bothered by the colors so much as the layout. Almost every news source I read has the article all the way to the left, with navigation at the top and secondary content on the right. Having the navigation on the left and the content on the right was disorienting (and I've felt the same with Google's newer blog layouts). I can understand doing this on a tablet, but on a desktop it feels... overly simplified.

Roboprog• 14 years ago

Worse for me on my (1024 x 600) netbook: the actual content wasn't even completely visible until I shrunk the font size several notches.

boyter• 14 years ago

I usually get shouted down when I say this but Microsoft's focus on secure code over the last 10 years has paid off. Not only is the OS too hard a target hence the increase in Java, adobe product exploits, but their software running on their OS has fallen in line too.

I know the saying many eyes make bugs shallow, but so does billions of dollars and years of concentrated effort. Kudos to Microsoft for getting their act together.

Legion• 14 years ago

> I know the saying many eyes make bugs shallow, but so does billions of dollars and years of concentrated effort.

The saying holds. Billions of dollars buys many eyes.

jcheng• 14 years ago

That's not really how secure coding works at Microsoft though. There aren't more eyes on the code, just more developer training and more processes in place. (At least that was my experience working there from 2006 to 2009.)

tptacek12• 14 years ago

No, the saying does not hold. Microsoft didn't buy "many eyes"; they bought a relatively small number of very specialized eyes. At any one time in the mid 2000's, something like 4-5 security firms did $1MM or more in a year at Microsoft, and those firms each had between 15-40 people working at them --- and no firm did 100% of its business at MSFT.

What happened at Microsoft may not disprove this folk wisdom about defect detection, but it's evidence against it, not for it.

sriramk• 14 years ago

This is the result of nearly a decade of work from MSFT, across the board. They built better tools, drilled security into every new hire all the way to the execs, made it a part of every engineering and product process imaginable. Happy that is finally being acknowledged on the outside.

psychotik2• 14 years ago

I still remember how painful it was to ship anything, waiting in queue for security team signoff. Good to see it payoff though. Good on Microsoft - making secure products and smarter engineers in the process.

shitlord• 14 years ago

Now I wish Adobe would do the same thing.

tptacek12• 14 years ago

They very much are, and have been, for awhile.

mark_g• 14 years ago

Their Secure Development Lifecycle guide can be downloaded from http://www.microsoft.com/en-us/download/details.aspx?display... .

sinnerswing• 14 years ago

"it's a trap!"

Breakthrough• 14 years ago

"Happy that is finally being acknowledged on the outside."

Not to mention by a reputable security company in the business (we all know there's some sources whom are... biased... to put it nicely). Congrats to Microsoft, glad to see they've put security so highly on their priority list. Not to mention the involvement they try to get with hackers, and worldwide trying to stop spam botnets, etc... Very nice to see a corporation working like that.

Centigonal• 14 years ago

I think it's actually "who" in this case: the pronoun is the subject of "are biased."

lumberjack• 14 years ago

What can we trace this security priority initiative of Microsoft back to?

mcphilip• 14 years ago

Jan 15, 2002 email from Bill Gates to all MSFT staff [1]. Includes some real gems, like;

>So now, when we face a choice between adding features and resolving security issues, we need to choose security. Our products should emphasize security right out of the box, and we must constantly refine and improve that security as threats evolve.

1.http://www.wired.com/techbiz/media/news/2002/01/49826

tptacek12• 14 years ago

The "Summer of Worms", after Slammer, Blaster, and Welchia owned up some huge fraction of every Windows machine connected to the Internet, including large portions of the DoD. Microsoft's software security was repeatedly on the front page of CNN and the subject of Congressional hearings.

BryanStarbuck• 14 years ago

I agree with this comment from my time working there. Microsoft engineered their way to this level of success.

pooriaazimi2• 14 years ago

Haha. Great to see iTunes and QuickTime (Windows versions, probably?) on the list... Apple should really either update them (I'm not sure iTunes 11 will be released for windows too), or just abandon them (and ask customers to use iCloud for backup). A few days ago I opened a .mov on a Windows machine with QuickTime - it was horrible. I can't imagine how dreadful iTunes probably is. No wonder all PC guys hate iTunes...

robomartin• 14 years ago

I hate iTunes on every platform. It's bloated; it tries to do too many things and it does them all wrong. Just as an example, searching for anything with iTunes is a horrible experience, particularly when compared with searching the 'net with any of the top search engines. Book, app and media management are terrible. Cross-computer management of the same is terrible. Backing-up your iPhone, if you are not careful, can result in erasing every single app from your phone and replacing them with what happens to be on the new machine's iTunes. Take a music database that Windows Media deals with without any issues whatsoever (devoid of metadata other than folders with the album name and files with the song names). Import it into iTunes and watch it get mangled. Albums get destroyed, songs end-up categorized in weird ways, etc.

pooriaazimi2• 14 years ago

Yeah, I feel you. I'm on OS X and hate iTunes with a passion (it's almost an obsession). I almost died of grief when I learned iTunes 11 was delayed...

The sheer number of bugs that crapware has is unbelievable. And don't get me started on Music.app on iPad (iOS 5 and 6), or the dreadful state of "Shared Media" in iPhone and iPad's Music apps (stream from a computer).

God I hate them. If I ever switch from iOS/Mac, iTunes/Music.app are to blame.

moepstar• 14 years ago

I hate iTunes too for all of the reasons mentioned above, however there's one thing it does at least half-ok'ish:

It doesn't eat a ton of CPU while playing a few simple MP3s...

I've tried using Clementine (an Amarok-fork, my favourite music-player by far, at least on Linux) but it's just a resource-hog - comparatively at least.

So yeah - does anyone have suggestions on what to use for music playback? Something that doesn't suck? Something that doesn't waste precious CPU-cycles without reason, generating heat and wasting battery on the go?

deeqkah• 14 years ago

PC guy here. Have used Fedora for years as my daily OS and the only reason i have a Windows VM on my linux machine is actually because i love iTunes so much. I don't have an iDevice, either.

I've used a vast array of media players for Linux and Windows and nothing i can find matches the features iTunes has for organizing my music library.

However, it's difficult to understand why Apple doesn't update iTunes on Windows more frequently. I'm pretty sure the last iTunes update on Windows fixed well over twenty-five security vulnerabilities in open source libraries that were known for upwards of six months to everyone.

While that STILL doesn't match the negligence of companies like Oracle and Adobe, it's still negligence. Unacceptable negligence which is putting users at risk.

nostromo• 14 years ago

Interesting to note that both Apple vulnerabilities listed exist only for their Windows software. (QuickTime: http://lists.apple.com/archives/security-announce/2012/May/m... iTunes: http://support.apple.com/kb/HT5485)

I wonder if these are lower priority for Apple or if they perhaps just aren't as good when developing for Windows.

Maakuth• 14 years ago

I think it could be that the platform works differently enough that you can build vulnerable Windows software by just making some assumptions that would be correct in OSX land but not in Windows. Vice versa, most probably.

psychotik2• 14 years ago

If I understand correctly, I think it's a function of how they rank their vulnerabilities. "The rankings are based on the percentage of users whose computers had the vulnerability in question"

Machines running Apple software on Windows >> machines running Apple software on Macs. So the same vulnerability wouldn't show up even if it existed in iTunes on OSX, for example.

gilgoomesh• 14 years ago

Quicktime on Windows is stuck at version 7, which is riddled with numerous problems. It's this old Quicktime codebase that is the source of the Quicktime and iTunes vulnerabilities on Windows.

The current version on Mac and iOS is Quicktime X. This version was a complete rewrite (that started on iOS and eventually migrated to the Mac). The complete rewrite allowed for a vastly more secure design (among other improvements).

shinratdr2• 14 years ago

But the iTunes backend is still QuickTime 7 on both Mac OS X and Windows. QuickTime is really only present on Windows machines nowadays as the backend of iTunes.

drivebyacct22• 14 years ago

Beat by Oracle and Adobe. Something to truly be proud of. Aw, no one else finds this to be a strange brag? Should we make a list of all of the companies that aren't up there?

xer0x• 14 years ago

I agree, this is a really weird post.

drivebyacct22• 14 years ago

Careful, that's a suicidal comment.

rgbrenner• 14 years ago

Oracle took the top 2, but Adobe had 5 runners up. Too bad Adobe couldn't overtake Oracle, they clearly put in a lot of effort at it. And Microsoft.. not even being listed? Are they even trying anymore?

camus• 14 years ago

but oracle products account for 53 of the malware attacks !

bprater• 14 years ago

Is it getting safer to say that antivirus software may soon be a thing of the past?

zalzane• 14 years ago

selling antivirus software is a lot less about fixing viruses than it is about convincing the average computer user that they are at risk without XXX antivirus suite.

Corrado• 14 years ago

My question is, would you run Windows 7/8 without any anti-virus software at all? Do you feel that comfortable? After years of Linux/OS X I can safely say that I won't use an OS that requires anti-virus ever again.

Negitivefrags• 14 years ago

I have never run a windows system with anti virus. There is a very simple technique. Don't install viruses.

freehunter• 14 years ago

I used to run Security Essentials. When I upgraded to 8, it automatically uninstalled it. It's baked into the OS now, along with a constantly updated blacklist of known malware programs if you try to manually install something bad. You can get around it easily, but they don't make it intuitive to do so for users who are not comfortable clicking around and exploring.

Above and beyond being comfortable not using an AV on Windows 8, I would go as far as to say that if you are using an AV on Windows 8, you're being taken for a ride by your vendor of choice. And I say this as an information security professional. I've tried to get a virus on Windows 8 without doing anything more than what it takes to get a virus on Windows 7. I did not succeed.

jff• 14 years ago

Man I really hate to break it to you but Linux (and almost certainly OS X) has many privilege-escalation bugs at any given time. Any executable you run on any operating system could potentially be a virus; the main thing protecting you on Linux is that the combinations of buggy kernels and buggy libraries are much wider than on Windows, which generally stays pretty up-to-date and thus consistent across many machines.

Don't pretend Unix-type OSes are immune to malware. Don't forget the Morris worm.

Lagged2Death• 14 years ago

I figured there would be a lot of Adobe stuff on the top 10, but that is a lot of Adobe stuff.

ecounysis2• 14 years ago

Glancing at the list, I see there are only four companies in the world who cannot claim they don't have a single product on Kapersky's top 10 vulnerabilities list.

encoderer• 14 years ago

But the fact that the largest software company in the world is among them is what's notable.

ecounysis2• 14 years ago

Yes. I wonder what percentage of vulnerabilities 11-20 belong to Microsoft?

UnoriginalGuy• 14 years ago

If you're running Chrome please for the love of all that is holy enable Click-To-Play for all plugins. With it disabled it is like running without a pop-up blocker.

You can do so in Settings -> Advanced Settings -> Content Settings -> Plug-Ins -> Click To Play.

When you visit a site which has a plug-in you'll get a UI control similar to the pop-up blocker which allows you to add it to the exceptions list and or to allow it just this one time. You should add YouTube to the exceptions list.

nickbaum• 14 years ago

Or better yet, switch YouTube to the HTML5 player:

http://www.youtube.com/html5

One less site that needs Flash.

padraigm• 14 years ago

Every time I join the YouTube HTML5 trial it gets silently turned off and videos start playing in Flash again a week or two later. Does that happen to anyone else?

barrkel• 14 years ago

HTML5 videos on YT start automatically, which is exactly what I don't want, and in fact the second-biggest reason I use click-to-flash (first being animated ads). At one point, I was being forcibly opted into HTML5 video on YT and had to disable that feature in Firefox to get back out of it.

ams6110• 14 years ago

I'd go one step farther and just disable plugins. I have run without plugins for years and it really is a non-issue 95% of the time. If I absolutely need a plugin I will enable it for the time I need it and then disable it again.

Someone• 14 years ago

Reading http://www.securelist.com/en/analysis/204792250/IT_Threat_Ev..., I find it surprising that the Netherlands manages to be the best malware exporter in the world (third in 'production', close behind Russia and the USA (both with a much larger population), but also in the top 10 for 'least consumption', a list that neither Russia nor the USA made).

Does anybody have any idea how that comes about? The only reason I can think of is that Amsterdam is a huge node in the Internet backbone (http://en.wikipedia.org/wiki/Amsterdam_Internet_Exchange). Malware authors might want to host their stuff close to such nodes, so that they can distribute their wares efficiently.

budgi3• 14 years ago

Amsterdam is a criminal epicenter

dr_doom• 14 years ago

Any further links or reading? I am very interested in this subject.

rhplus3• 14 years ago

The Netherlands has a long history of being a hub of international trade, from spices and bulbs to diamonds and IP packets. Add to that its tolerant attitude towards pornography, prostitution and drugs - compared even to much of Western Europe - and it wouldn't be much of a surprise to see organized crime diversifying beyond things like porn hosting (which benefits from the IXP you mention) into malware and identity theft too.

(I have no data to back this up...)

pserwylo• 14 years ago

Ah Shockwave, good to see you again my old friend.

I can't believe it's still around and kicking, given the last release of Director seems to be about two years ago.

I don't play any online games, but can somebody vouch for whether it is still used to develop browser games anymore?

TazeTSchnitzel• 14 years ago

AFAIK its only advantage was 3D authoring support, and Flash has that too now, so I see no reason to continue using it at all.

VeejayRampay• 14 years ago

Adobe have been embarrassing themselves for a solid decade now as far as security is involved. Might be time for them to step up.

rbanffy2• 14 years ago

I'd be happy with installing their software on case-sensitive filesystems.

artichokeheart• 14 years ago

Not one Microsoft product on top 10 vulnerabilities affecting Microsoft operating system.

lostnet• 14 years ago

That is a more significant finding!

Dropping out of the overall top ten may have little or nothing to do with better security since the calculation is intentionally skewed to measure by number of affected users.

MS bugs got raised to the top in a desktop dominant world, but they've lost ground (and therefore importance in this calculation) against mobile/tablet/etc devices making the most successful cross platform products capable of affecting more users.

romland• 14 years ago

And to think that a free (as in it didn't cost me a cent unless I want to pay for it) piece of software protected me from most of this. The phenomenon known as NoScript is quite marvelous in doing its job without eating much of my CPU cycles :-)

Of course, when you get down to the bottom line you know it's not a huge technical feat, but really, neither is anti-virus software. It's a matter of foresight and hard work. Donate today :)

(Disclaimer, I am in no way connected with NoScript other than being a happy user)

Edit: After posting this I realize it comes across as a bit of advertising and not contributing much to the conversation, I was about to delete it, but I stopped myself and wanted to add: I am -truly- happy not having to (even though I do) worry about what links I can click.

taylorbuley• 14 years ago

Declining marginal vulnerabilities

lifeguard3• 14 years ago

Let's take a look at CERT, shall we?

17 Sep 2012 VU#480095 Microsoft Internet Explorer 6/7/8/9 contain a use-after-free vulnerability

17 Sep 2012 VU#389795 Windows Phone 7 does not check certificate Common Names when sending or receive

Hmm. OK, how about #1 service being remotely attacked right now:

MS Terminal Services

rhplus3• 14 years ago

The OP is a list of vulerabilities by severity. When I look at the current US-CERT database, I don't see any Microsoft products in the top 10 results by severity[1] or by date[2].

[1] By "Common Vulnerability Scoring System": http://www.kb.cert.org/vuls/byCVSS

[2] By Date: http://www.kb.cert.org/vuls/bypublished

lifeguard3• 14 years ago

Whatever. " Not one Microsoft product on Kaspersky’s top 10" implies that Microsoft products are secure. They are not.

ben0x539• 14 years ago

All those _s functions must be paying off!

cdibona• 14 years ago

This reminds me of the bear joke: They only had to outrun oracle and adobe...

tptacek12• 14 years ago

The implication here is that Microsoft didn't actually improve their security so much as Oracle and Adobe failed to keep up with theirs. I don't know whether you intended to say that, but either way, it's a false statement.

JoeAltmaier• 14 years ago

...or a criticism of Oracle and Adobe, which is then 100% true statement.

tuananh• 14 years ago

This is because Adobe is doing a too good job putting its products on the list : )

buster• 14 years ago

And yet a friend of mine has to reinstall her shiny new netbook because apparently there is some nasty rootkit/trojan that cannot be removed (so easily).

Create• 14 years ago

...they are so valuable, that they are traded on the black market.

https://twitter.com/VUPEN/status/263283188175106048

hmart• 14 years ago

The fact hat Adobe still ships expensive, crappy, heavy, memory consuming, battery drain and insecure products is not news. 5 of them in the Top 10.

dschiptsov• 14 years ago

Sure, the same way there is no danger to heath in fast-food, every advertiser will tell you for sure.)

shocks• 14 years ago

Now is as good a time as any to disable Flash and Java in my browser. Not sure why I haven't done this earlier.

Props to Microsoft though. Nice! :)

stcredzero3• 14 years ago

For security reasons, I've stopped using PDF readers based on Apple and Adobe code. I'm now using XPDF through an Automator app as my default PDF program, with Google Chrome as an alternate.

martinced• 14 years ago

I'm a long time Java dev and lately it's been terrible, totally terrible, for Java from a security point of view. A gigantic fiasco. Flash's track record is very poor too. Saying that something is "less vulnerable" than these two really doesn't mean much.

We're talking about hundreds of millions of zombie PCs due to Java applets + Flash exploits. So being "less vulnerable" than these technologies doesn't mean much.

So no Microsoft product in the top 10? You mean Word is not as big as an attack vector as Java applets and Excel is not as big as an entry point as Flash? Is there any surprise in here!?

That's not the interesting thing: what concerns most people is the browser they use to surf the Web. Is Safari + Java applet plugin more vulnerable then IE + Java applet? Is Chrome + Flash more vulnerable then IE + Flash?

That's what counts.

And also: how do you install Java on your system if you really need it (e.g. because you're a Java dev) and yet make sure it's not available from your browser? Or from another user account? This kind of stuff is trivial to do on Linux: it's been a long time since I'm using a throwaway user account that has no Java installed to "surf the Web" (using Chrome but whatever). It's trivial to do because on Linux you can install Java from a regular user account (no need to be root).

On Windows this is not possible: installing Java requires the admin password and opens a whole can of worms ; )

I can tell you: I'm surfing from Linux using Chrome which has Flash. I also have Java installed in a separate (developer) user account. And I'm pretty sure this is more secure than surfing from a Windows machine, no matter where Microsoft stands in that report from their "friend in bed" Kaspersky...

Also, for a little touch of irony regaring the article, Kaspersky's revenues are virtually entirely coming from sales of anti-virus protecting Windows OSes. Why aren't they succesful on the Linux servers powering the Internet?

Not one Microsoft product on Kaspersky’s top 10 vulnerabilities list

Related Stories