Re:Microsoft: Third party apps killing our security
by teej on Monday November 03, 2008 @04:31PM
(#352553)
I don't see the difference between a Linux "zombie" and a Win32 "zombie". I've personally seen both platforms get compromised and when it happens the results are typically the same.
I'm solidly behind the theory of viruses being made for the cheapest platform available - Windows and Linux.
Re:Microsoft: Third party apps killing our security
by tptacek on Monday November 03, 2008 @04:45PM
(#352571)
What does a virus care about how "expensive" the platform is that it infects?
Re:Microsoft: Third party apps killing our security
by teej on Monday November 03, 2008 @04:46PM
(#352574)
The person creating the virus cares. Affordability of the platform is a major issue when the producers are coming from eastern Europe.
Re:Microsoft: Third party apps killing our security
by tptacek on Monday November 03, 2008 @04:53PM
(#352584)
I'm thinking that suggesting that Eastern Europeans care about the cost of an OS license is a really weak argument.
Malware authors care about exactly one number: the ratio of the dollars it takes to put a malware program out in the field over the dollars collected by that malware program. That ratio is good for Windows, and extraordinarily crappy for Linux. If my mom (and all moms like her) switched to Ubuntu, the ratio would get better.
What is a deciding factor is, "how much money will I make for each line of code that I write". The answer:
* Linux: Negigible.
* Mac OS X: Very near negligible.
* Win32: Very significant.
Malware authors are only going to move to new platforms when they hit "peak oil" for Win32 --- when there is so much competition for new desktops that it's worth it to target an OS that has a 5-10% share. We are nowhere near that point yet.
The words "similarly exploitable" are slippery and imprecise. The overwhelming majority of Windows "infections" are not caused by Win32 platform flaws. They're caused by unsafe user interactions with the web browser and mail programs. Those exact same unsafe interactions are present on OS X. Are the two "similarly exploitable"? Well, if writing a Mach-O malware shim is "similar" to writing a Win32 PE malware shim, then sure. Otherwise, no.
PS: Bona fides: my company is standardized on OS X, I came to OS X by way of Yellow Dog Linux on a TiBook, and prior to that I'd been FreeBSD since 1994. I've got an aggregate of 5 months of Win32 "userhood" in my whole career (though much more exposure at a systems programming level). I'm not an apologist; I just think the Win32 security haters are wrong.