Friday, June 1, 2007

Vista no more secure than XP

In an interesting and detailed article, CRN explains why Windows Vista is still prone to viruses and worms.

Once again: Windows users, switch and live better!

2 comments:

Mario said...

You'd better read this article, Vista is more secure than OS X.

Filippo Sironi said...

From the article you have posted: "Vista produced the usual warning message that running the file might cause problems. XP also gave similar warnings and allowed the engineer to run both trojans." do you think this is a good analysis?! If i write a simple:
sudo rm -rf / in Mac OS X and I give my root password no one warn me. Moreover in Windows Vista UAC surelly ask for admin password or permissions elevation to damage the OS.
"It's not clear how IE 7 detected the bad control on the first site. It's possible that the other four sites were not detected because the code might not have been targeting Vista. On XP, however, some of the sites were able to run client-side code." And in Windows Vista? To run a client-side malicious software you receive a prompt from UAC that ask to elevate permissions. If you answer yes you know that none of the operating systems can protect from the worst virus in the world... the stupid user.
"Vector Markup Language (VML) and other vector-based images pose a significant threat because they allow hackers to execute remote code. Hackers use simple redirects to pull in users into sites riddled with malware and bots. Past and current Windows architectures are still unable to accurately detect embedded scripts in images." In Windows Vista any code coming from caches and other IE's directories can only access caches, temp files and download folder in user's home, this code can't produce any damage.
Has Safari got an anti-phishing system? I think not. So Mac OS X is weaker than Windows Vista?!

In conclusion i think this is a bad article, incomplete and partial. It hasn't mentioned UAC control and I think UAC takes part in a lof of attack, moreover IL system's integrated in Windows Vista permit no one to access private data from the browser so I think that actual malwares are completly useless.
And http://blogs.technet.com/security/archive/2007/06/01/windows-xp-vs-windows-vista-security.aspx you can find impressions from Jeff Jones that report also Ars Techina articles that criticize CRN work.