Throw away your digital picture frames

Apple » Throw away your digital picture frames

Apple » Throw away your digital picture frames — Tue, 19 Feb 2008 07:40:14 GMT

PingBack from http://apple.joejoeblogs.info/?p=17929

re: Throw away your digital picture frames

Nick Brown — Tue, 19 Feb 2008 10:30:26 GMT

Steve, I think you may be inadvertently trying to gloss over something here:

>If you own one of these frames, SANS suggests that

>you take it to a friend who has a Mac or Linux box

>and plug it in there. Yeah, that's good advice; there

>exist no viruses for these operating systems,

>correct?

I think that a bar chart of "# of malware in the wild (or even in the lab) per OS" would show up the nature of the risk. There may even be an (as in, one) autorunning USB worm for the Mac or Linux. But there are hundreds for Windows, which is why the factory that make the digital photo frames has them.

It's also the case that people run with full privileges on Windows because, when you don't, strange things happen, or unexpectedly don't. I still remember a product manager for NT 4.0 Workstation - touted as highly secure when it came out - dismissing the Nth privilege elevation exploit, with "well, 3/4 of corporate customers give full admin rights to their users anyway, so this doesn't represent a threat at all".

Anyway, if anyone wants a *permanent* fix to this and all other USB-drive worms, head on over to

http://nick.brown.free.fr/blog/2007/10/memory-stick-worms.html

Cheers

Nick

re: Throw away your digital picture frames

Steve Riley — Wed, 20 Feb 2008 21:28:14 GMT

Yes, but another bar chart shows that Microsft products place you in the fewest days of risk -- that is, we acknowledge and repair vulnerabiliites more quickly than other operating systems. Yet another bar chart shows that of currently-available operating systems, Windows has the fewest number of vulnerabilities. Check out some of Jeff Jones's research.

People run with full privs on Windows because so many third-party apps fail otherwise (even our own apps had this problem once upon a time). We've been advocating for years now that developers write for standard users, customers are now demanding that products run as standard user, and UAC is compeling vendors to write for standard user. There is no longer any excuse for a product to require admin privs -- I consider such products to be fundamentally broken.

re: Throw away your digital picture frames

marcelo e. sauaf — Tue, 26 Feb 2008 02:43:33 GMT

I searched Secunia and Sans and didn't find any about 'mocmex', wasn't strange? regards!