Kaspersky: "Vista less secure than XP"

cescotto wrote:



"Natalya Kaspersky, the company's chief executive, said that without UAC, Vista will be less secure than Windows XP SP2. "There's a question mark if Vista security has improved, or has really dropped down," she said to our sister site ZDNet UK at the CeBIT show in Hanover last week."

Yes, that's completely true! Viruses are breaching through the Vista hardened services using drilling tools, they're all getting around one of the most complete set of exploit prevention mechanisms ever implemented using magical powers!! Oh my god, it's the end!!!

Dr Herbie wrote:


So they're effectively saying "If you switch off the security features, Vista is less secure"?  You might as well say "If you switch off your anti-virus software, viruses might get through".

Publicity story. Nothing more.

Herbie

I disagree.
 
Take out UAC from Vista, and it should be at least as secure as XP. Think about it.

What I found lacking in the article was proof that Vista less UAC was actually less secure than XP. The article touted claims that Kaspersky engineers had found 5 ways to circumvent UAC. Then what? What proves that it is less secure?

Vista has a better firewall... it randomizes dll's while loading to memory... it has the concept of protected mode...

I really doubt whether it is less secure than XP. Uac or no uac.

sushovande wrote:



Dr Herbie wrote:  So they're effectively saying "If you switch off the security features, Vista is less secure"?  You might as well say "If you switch off your anti-virus software, viruses might get through". Publicity story. Nothing more. Herbie

I disagree.
 
Take out UAC from Vista, and it should be at least as secure as XP. Think about it.

What I found lacking in the article was proof that Vista less UAC was actually less secure than XP. The article touted claims that Kaspersky engineers had found 5 ways to circumvent UAC. Then what? What proves that it is less secure?

Vista has a better firewall... it randomizes dll's while loading to memory... it has the concept of protected mode...

I really doubt whether it is less secure than XP. Uac or no uac.

ZippyV wrote:



sushovande wrote:  Dr Herbie wrote:  Publicity story. Nothing more. I disagree.

sushovande wrote:

However there is a condition: the story is not just publicity if, and only if, they PROVE that Vista is less secure than XP with UAC turned off.

There is an arguement to be made that vista being a brand new OS with a largly brand new code base has yet to be tested and usually in that situation it will be less secure. they could not possibly consider all the different exploits people used in previous OS when writing from the ground up. it is likely that some of these mistakes will work thier way back in and hackers will find a multitude of hacks for an untested OS, but the fact is microsoft will constantly evolve the OS on demand as with XP making it more and more secure all the time.
the real question is not which OS is more secure now, it's which OS was more secure at it's inception or which OS willl be more secure 5 years after it's release. XP was not designed with security in mind at every level of production and in every component, it couldn't have been since it was largly derived from the NT code base so my money would be on vista.
imo it's a lot like Ecology and Evolution of Animals and such, the same laws that would govern the introduction of a large highly adaptible omnivore into a habitat of smaller less adaptable predators, it's likley that initially the predators would have the upper hand but vista will quickly form an equilibrium with the new habitat

edit:

I'm not sure what state UAC is in if you disable it from the security center.

But under gpedit you can configure UAC to elevate without prompting. This will atleast leave IE7+ to be in the Protected mode and file/registry writes will be virtualized like before.

So with this in mind, I do consider Vista already more secure than XP can ever be WITHOUT the UAC prompts since you don't have those features in XP. Also it has been already shown that these do actually help against some threats that work in XP. (RTM Vista no updates vs fully updated XP)

Well I'm sure Vista has plenty of security holes lurking in it's new network and audio stacks as well as in the millions of lines of new kernel and  driver code.

Security researchers, project developers, and end-users are constantly finding security holes in open source software and patching them. Far more problems would be uncovered quickly if Windows were under an open scrutiny model like Linux or FOSS in general.

But as long as Vista's external security like UAC, IE 7 protected mode, and MAC keep them concealed, people should be safe enough until discovered by further internal audit testing or by hackers.

I think Kaspersky is jealous, because MS has started taking security in windows more seriously, so as to begin making AV companies less attractive to customers.

 AV should just be a scanner and a disinfector. Most AV solutions nowadays, they have more than that. They have process integrity controls, and process activity monitors and spy ware etc. etc. While these are all good, I think its better to have MS implement these things natively within the OS environment so the users would not have to rely on 3rd parties for their security. If MS would tab into Kaspersky's viral detection definitions and also other vendors like symmantec, windows will be even more secure, and we would not need to bother with 3rd party's products, that can be buggy.

All, in all, I think Vista is more secure than XP. Vista is more reliable than XP. Vista would crash less than xp. Obviously there are avenues for improvement (As in the kernel, and other areas), and I think the future is bright for Windows. I am happy about it.

Only regret is that Vista did not have all the drivers for my display device, but that is a 3rd party's problem, mainly.

You're not allowed to call yourself a security company on Windows these days unless you periodically make wild and unsubstantiated claims about Vista.

It's like a Logo requirement or something....

Remember, the last thing people in the (in)security business want is a secure OS from Microsoft...they can see the gravy train slowing down and they don't like it one bit.

Which is why we've been getting non-stop FUD on Vista security for almost a year now.

An AV company talking bullshit about Vista security? never...

I haven't read through the post, but at least as I heard that Microsoft takes the pain to do all the hardening, such as to change all string handling functions of their DLLs to the "safe" variants, I'd say what even with UAC switched off, it'd still be more secure than WinXP.

And for the claims about their engineers finding the holes for Vista, what good did they done for not telling Microsoft about it? It's the hole is the fault of the system itself, I doubt what can be done for them to stop it being exploited... And when Microsoft later issued the patch for it, I doubt how they managed to "not break" the system.

LarryOsterman wrote:



the_sombrero_kid wrote:There is an arguement to be made that vista being a brand new OS with a largly brand new code base has yet to be tested and usually in that situation it will be less secure. they could not possibly consider all the different exploits people used in previous OS when writing from the ground up. it is likely that some of these mistakes will work thier way back in and hackers will find a multitude of hacks for an untested OS, but the fact is microsoft will constantly evolve the OS on demand as with XP making it more and more secure all the time.

On the surface, that argument seems reasonable.  But ya know, the new stuff in Vista isn't the stuff that worries me.  The stuff that worries me is the OLD stuff that hasn't been rewritten in years.

There's a bunch of code in the OS that quite literally hasn't been touched in years.  Much of that code was written back in the late 1980's and early 1990's back when the threat landscape looked very different from today (heck, this is code that was written for an OS that didn't support preemptive multitasking).  We've done a lot of work improving the quality of the old code (banned APIs helped a lot, for instance) but there are still potential issues in that code.

The new stuff we've written is orders of magnitude better quality than the old stuff.  We've improved our basic engineering practices and as a result, I'm actually more confident in our new code than I am in our old code.

Just because code changed does not inherently mean that it's worse.

I have no idea why Kaspersky said what they did, IMHO it makes no sense at all.