Kaspersky: "Vista less secure than XP"

cescotto

"Natalya Kaspersky, the company's chief executive, said that without UAC, Vista will be less secure than Windows XP SP2. "There's a question mark if Vista security has improved, or has really dropped down," she said to our sister site ZDNet UK at the CeBIT show in Hanover last week."

Yes, that's completely true! Viruses are breaching through the Vista hardened services using drilling tools, they're all getting around one of the most complete set of exploit prevention mechanisms ever implemented using magical powers!! Oh my god, it's the end!!!

I would have understood if she stated "Vista is less secure with UAC disabled" or "Vista is not a lot more secure than XP with UAC disabled" but saying that "Vista is less secure than XP with UAC disabled" is a plain lie.

I wouldn't have expected this from Kaspersky (the producers the best AV available for windows), but it looks like that all the other AV vendors they have to fall to this low lying tactics just to abuse their notoriety in the security field at their advantage: convincing people to stick to XP means more business for them. What a shame...

Dr Herbie
Horses for courses

cescotto wrote:

"Natalya Kaspersky, the company's chief executive, said that without UAC, Vista will be less secure than Windows XP SP2. "There's a question mark if Vista security has improved, or has really dropped down," she said to our sister site ZDNet UK at the CeBIT show in Hanover last week."

Yes, that's completely true! Viruses are breaching through the Vista hardened services using drilling tools, they're all getting around one of the most complete set of exploit prevention mechanisms ever implemented using magical powers!! Oh my god, it's the end!!!

So they're effectively saying "If you switch off the security features, Vista is less secure"? You might as well say "If you switch off your anti-virus software, viruses might get through".

Publicity story. Nothing more.

Herbie

sushovande
Smiley Face Sharp

Dr Herbie wrote:

So they're effectively saying "If you switch off the security features, Vista is less secure"? You might as well say "If you switch off your anti-virus software, viruses might get through".

Publicity story. Nothing more.

Herbie

I disagree.

Take out UAC from Vista, and it should be at least as secure as XP. Think about it.

What I found lacking in the article was proof that Vista less UAC was actually less secure than XP. The article touted claims that Kaspersky engineers had found 5 ways to circumvent UAC. Then what? What proves that it is less secure?

Vista has a better firewall... it randomizes dll's while loading to memory... it has the concept of protected mode...

I really doubt whether it is less secure than XP. Uac or no uac.

ZippyV
Fired Up

sushovande wrote:

Dr Herbie wrote:
So they're effectively saying "If you switch off the security features, Vista is less secure"? You might as well say "If you switch off your anti-virus software, viruses might get through".

Publicity story. Nothing more.

Herbie

I ~~dis~~agree.

Take out UAC from Vista, and it should be at least as secure as XP. Think about it.

What I found lacking in the article was proof that Vista less UAC was actually less secure than XP. The article touted claims that Kaspersky engineers had found 5 ways to circumvent UAC. Then what? What proves that it is less secure?

Vista has a better firewall... it randomizes dll's while loading to memory... it has the concept of protected mode...

I really doubt whether it is less secure than XP. Uac or no uac.

sushovande
Smiley Face Sharp

ZippyV wrote:

sushovande wrote:

Dr Herbie wrote:
Publicity story. Nothing more.

I ~~dis~~agree.

I disagree that it is just a publicity story. However there is a condition: the story is not just publicity if, and only if, they PROVE that Vista is less secure than XP with UAC turned off.

ZippyV
Fired Up

sushovande wrote:
However there is a condition: the story is not just publicity if, and only if, they PROVE that Vista is less secure than XP with UAC turned off.

But they haven't proved that so...

the_sombrero_kid

There is an arguement to be made that vista being a brand new OS with a largly brand new code base has yet to be tested and usually in that situation it will be less secure. they could not possibly consider all the different exploits people used in previous OS when writing from the ground up. it is likely that some of these mistakes will work thier way back in and hackers will find a multitude of hacks for an untested OS, but the fact is microsoft will constantly evolve the OS on demand as with XP making it more and more secure all the time.
the real question is not which OS is more secure now, it's which OS was more secure at it's inception or which OS willl be more secure 5 years after it's release. XP was not designed with security in mind at every level of production and in every component, it couldn't have been since it was largly derived from the NT code base so my money would be on vista.
imo it's a lot like Ecology and Evolution of Animals and such, the same laws that would govern the introduction of a large highly adaptible omnivore into a habitat of smaller less adaptable predators, it's likley that initially the predators would have the upper hand but vista will quickly form an equilibrium with the new habitat

androidi

edit:

I'm not sure what state UAC is in if you disable it from the security center.

But under gpedit you can configure UAC to elevate without prompting. This will atleast leave IE7+ to be in the Protected mode and file/registry writes will be virtualized like before.

So with this in mind, I do consider Vista already more secure than XP can ever be WITHOUT the UAC prompts since you don't have those features in XP. Also it has been already shown that these do actually help against some threats that work in XP. (RTM Vista no updates vs fully updated XP)

Charles
Welcome Change

FUD

C

Xaero_Vincent
Sexy me

Well I'm sure Vista has plenty of security holes lurking in it's new network and audio stacks as well as in the millions of lines of new kernel and driver code.

Security researchers, project developers, and end-users are constantly finding security holes in open source software and patching them. Far more problems would be uncovered quickly if Windows were under an open scrutiny model like Linux or FOSS in general.

But as long as Vista's external security like UAC, IE 7 protected mode, and MAC keep them concealed, people should be safe enough until discovered by further internal audit testing or by hackers.

SecretSoftware
Code to live, but Live to code.

I think Kaspersky is jealous, because MS has started taking security in windows more seriously, so as to begin making AV companies less attractive to customers.

AV should just be a scanner and a disinfector. Most AV solutions nowadays, they have more than that. They have process integrity controls, and process activity monitors and spy ware etc. etc. While these are all good, I think its better to have MS implement these things natively within the OS environment so the users would not have to rely on 3rd parties for their security. If MS would tab into Kaspersky's viral detection definitions and also other vendors like symmantec, windows will be even more secure, and we would not need to bother with 3rd party's products, that can be buggy.

All, in all, I think Vista is more secure than XP. Vista is more reliable than XP. Vista would crash less than xp. Obviously there are avenues for improvement (As in the kernel, and other areas), and I think the future is bright for Windows. I am happy about it.

Only regret is that Vista did not have all the drivers for my display device, but that is a 3rd party's problem, mainly. Cool

littleguru
<3 Seattle

Kaspersky is weird. One day they say that they (virus scanner companies) are loosing the battle against the malware. On the next day they say Vista is less secure than XP.

Lucky me I don't need a virus scanner and haven't had a virus in the last 15 years.

FUD!

AndyC

You're not allowed to call yourself a security company on Windows these days unless you periodically make wild and unsubstantiated claims about Vista.

It's like a Logo requirement or something.... Wink

Kevin Daly
Of course it *looks* like my nick is just my name, but actually, well, it's just my name.

Remember, the last thing people in the (in)security business want is a secure OS from Microsoft...they can see the gravy train slowing down and they don't like it one bit.

Which is why we've been getting non-stop FUD on Vista security for almost a year now.

stevo_
Human after all

An AV company talking bullshit about Vista security? never...

cheong

I haven't read through the post, but at least as I heard that Microsoft takes the pain to do all the hardening, such as to change all string handling functions of their DLLs to the "safe" variants, I'd say what even with UAC switched off, it'd still be more secure than WinXP.

And for the claims about their engineers finding the holes for Vista, what good did they done for not telling Microsoft about it? It's the hole is the fault of the system itself, I doubt what can be done for them to stop it being exploited... And when Microsoft later issued the patch for it, I doubt how they managed to "not break" the system.

LarryOsterman

the_sombrero_kid wrote:
There is an arguement to be made that vista being a brand new OS with a largly brand new code base has yet to be tested and usually in that situation it will be less secure. they could not possibly consider all the different exploits people used in previous OS when writing from the ground up. it is likely that some of these mistakes will work thier way back in and hackers will find a multitude of hacks for an untested OS, but the fact is microsoft will constantly evolve the OS on demand as with XP making it more and more secure all the time.

On the surface, that argument seems reasonable. But ya know, the new stuff in Vista isn't the stuff that worries me. The stuff that worries me is the OLD stuff that hasn't been rewritten in years.

There's a bunch of code in the OS that quite literally hasn't been touched in years. Much of that code was written back in the late 1980's and early 1990's back when the threat landscape looked very different from today (heck, this is code that was written for an OS that didn't support preemptive multitasking). We've done a lot of work improving the quality of the old code (banned APIs helped a lot, for instance) but there are still potential issues in that code.

The new stuff we've written is orders of magnitude better quality than the old stuff. We've improved our basic engineering practices and as a result, I'm actually more confident in our new code than I am in our old code.

Just because code changed does not inherently mean that it's worse.

I have no idea why Kaspersky said what they did, IMHO it makes no sense at all.

SecretSoftware
Code to live, but Live to code.

LarryOsterman wrote:

the_sombrero_kid wrote:There is an arguement to be made that vista being a brand new OS with a largly brand new code base has yet to be tested and usually in that situation it will be less secure. they could not possibly consider all the different exploits people used in previous OS when writing from the ground up. it is likely that some of these mistakes will work thier way back in and hackers will find a multitude of hacks for an untested OS, but the fact is microsoft will constantly evolve the OS on demand as with XP making it more and more secure all the time.

On the surface, that argument seems reasonable. But ya know, the new stuff in Vista isn't the stuff that worries me. The stuff that worries me is the OLD stuff that hasn't been rewritten in years.

There's a bunch of code in the OS that quite literally hasn't been touched in years. Much of that code was written back in the late 1980's and early 1990's back when the threat landscape looked very different from today (heck, this is code that was written for an OS that didn't support preemptive multitasking). We've done a lot of work improving the quality of the old code (banned APIs helped a lot, for instance) but there are still potential issues in that code.

The new stuff we've written is orders of magnitude better quality than the old stuff. We've improved our basic engineering practices and as a result, I'm actually more confident in our new code than I am in our old code.

Just because code changed does not inherently mean that it's worse.

I have no idea why Kaspersky said what they did, IMHO it makes no sense at all.

why couldn't MS just start from scratch and write the whole OS from scratch? Or rewrite the old code base , and just archive the old stuff? Expressionless

DarthVista
...

Because then there will be millions of disappointed little children who can no longer play "DOS" games like Commander Keen.

Xaero_Vincent
Sexy me

DarthVista wrote:
Because then there will be millions of disappointed little children who can no longer play "DOS" games like Commander Keen.

Umm.. you must have not tried playing any DOS games on Vista. NTVDM is totally crap now that it won't even lock video memory properly for full-screen DOS games.

No King's Quest VI, Hero's Quest, Fifa Soccer w/ sweet intro music... Expressionless

[C][C][C]

FreeDOS? I dunno... I'll guess I'll try when Vista comes; two months shipping period is awesome! Perplexed

AndyC

SecretSoftware wrote:

why couldn't MS just start from scratch and write the whole OS from scratch?

Remember how successful Netscape Navigator 5 was after they decided to completely rewrite the Navigator 4 code base? Oh wait a moment....

YearOfTheLinuxDesktop
Seven of Niner! Resistance is Futile!

AndyC wrote:

SecretSoftware wrote:

why couldn't MS just start from scratch and write the whole OS from scratch?

Remember how successful Netscape Navigator 5 was after they decided to completely rewrite the Navigator 4 code base? Oh wait a moment....

I still have some netscape 5 builds on my old backups! I remember it required 64mb of ram to compile and my computer had just 32 Sad

reinux

I saw this.

Less secure than XP? My xss.

UAC is a safety net. With UAC off, it's still more secure than XP. Even with people not reading the UAC messages half the time, it's still more secure.

Kapersky's just like Norton and McAfee of course. Windows goes out of security problems and the security vendors go bankrupt.

Tough.

ZippyV
Fired Up

Xaero_Vincent wrote:

DarthVista wrote: Because then there will be millions of disappointed little children who can no longer play "DOS" games like Commander Keen.

Umm.. you must have not tried playing any DOS games on Vista. NTVDM is totally crap now that it won't even lock video memory properly for full-screen DOS games.

No King's Quest VI, Hero's Quest, Fifa Soccer w/ sweet intro music...

FreeDOS? I dunno... I'll guess I'll try when Vista comes; two months shipping period is awesome!

Or Stunts.

LarryOsterman

AndyC wrote:

SecretSoftware wrote:

why couldn't MS just start from scratch and write the whole OS from scratch?

Remember how successful Netscape Navigator 5 was after they decided to completely rewrite the Navigator 4 code base? Oh wait a moment....

Ding! Ding! Ding! Give the man a ceegar.

In addition, every change made to the OS has to be done for a reason. It would cost millions and millions of dollars to rewrite this old code and while it's not perfect, it's not necessarily bad either, so it's not clear that it would be worth the investment.

And there's a ton of code out there that depends on the behaviors of the old code, and we'd have to retest all of it.

My point was simply that the new code isn't necessarily buggier than the old simply because it's new.

Kaspersky: &quot;Vista less secure than XP&quot;