RSSVista, Antivirus: What If Allchin's Right?
By Scott M. Fulton, III | Published November 13, 2006, 3:34 PM
PERSPECTIVE Let’s start by clearing up the most frequent mis-perception that emerged from our story last Thursday regarding Microsoft co-president Jim Allchin’s comments. As you'll recall last Wednesday, Allchin held a telephone conference to announce Windows Vista’s release to manufacturing.
At that time, he never advised Vista users not to use antivirus software. What he did say was that he was so confident in Vista’s new "Defense-in-Depth" architecture and failsafes that, under limited circumstances, he would allow a family member to run the operating system without active anti-virus software. Thus, he implied that the operating system might not need antivirus software – at the very least, not in similar limited circumstances.
"Wow, you describe a specific situation and suddenly people extrapolate something completely different!" wrote Allchin on the Vista team blog on Friday.
I agree. The "something completely different" was the notion that the president of Microsoft would advise Vista users to turn off their antivirus or otherwise let their guard down. In the dissemination of this story, that’s the impression that some received; and when they reasoned (rightly) that this couldn’t be correct, we were taken to task by some of our readers and a few of our colleagues.
As a result, sources other than BetaNews reported that BetaNews had reported that Allchin had advised Vista users to turn antivirus off. He did not say that, nor did we say he did. However, we did write him over the weekend to make amends over the confusion that did result.
One blog cited our story as a way of saying that Microsoft issued a challenge to malware writers during the conference, daring them to create a Vista virus. That, too, never happened, nor did we ever say it did.
What Jim Allchin did suggest was that Vista might not need antivirus, at least in some specific, guarded situations.
Now, while you’re turning that over in your mind, and maybe thinking, "What’s the difference?" I want to focus on an aspect of this story that somehow got missed in all the hubbub over who didn’t say what. Why were so many so quick to condemn the suggestion that an operating system could be capable of evolving beyond the absolute requirement for antivirus software, especially from a third party?
In other words, quite succinctly, what if Allchin's right?
As we have come to know it, a virus by definition must be capable of running undetected, with privileges it should not have been granted, delivering a payload that should not be allowed, and replicating itself for network distribution, relying on user ignorance if user unawareness isn't available.
With the objective of disabling the feasibility of malware at this level, Microsoft has engineered a multitude of features for Windows Vista, which some will be experiencing for the first time in its final form as soon as this Friday. One is User Account Control.
Vista beta users have already seen it, and have already experienced some mild headaches with it. It’s a pest, but it’s a good kind of pest. Specifically, it's a new system that runs all applications with the privileges afforded to the basic (i.e., non-administrator) user. The "Power User," by the way, is gone with Vista and with Windows Server 2003 R2.
When an application is capable of making any changes to the system that could impact its ability to function, Windows shuts down – to coin a phrase, it makes like a hole in your monitor. Network access is shut tight, and all other applications are suspended. The screen goes half-dark, except for a dialog box that asks for the user’s explicit permission to let the program do its job, which the user may refuse.
The point is, you can’t avoid seeing this. Anything that could change your system must identify itself. Now, while you’re thinking that all a virus needs to do is learn to identify itself as "IMPORTANT SYSTEM PROCESS," realize that an application must now be authenticated by the operating system to request the very privilege of invoking this User Account Control stop-the-presses feature. It can't identify itself to you as Word, unless it is Word.
For applications that are of the older era (Windows XP and earlier), Microsoft is working to utilize a feature of virtualization to give them the impression that they’re writing values to the System Registry, or writing files to a folder within the Program Files directory when in fact they're actually writing to virtualized copies running within a safety envelope.
Certainly, a malware writer not wanting to run into the pre-emptive assault of Vista's new defense measures, will try to resort to exploiting the weakest link: support for older architectures. In so doing, he’ll discover that support exists within its own little subdivided reality, that cannot be merged with actual reality without a human user’s explicit permission.
Next: Is Microsoft Obligated to Leave Windows Insecure for Security Vendors?
Eventually MS is gonna buy either ESET or Kaspersky anyway, so Allchin WILL be right in the long run... ;)
Seriously now, Vista is much better than XP security-wise, but I wouldn't run it without an AV just yet. I'm still waiting for a white-listing built-in component in the OS which will grant processes, say emule.exe, the bare minimum they need to function, as far as FILE SYSTEM access they need. No reason for emule.exe to go into My Documents for read/write, even though the user running emule.exe normally has access for that (while he never has access to modify system files).
Then again, the whole point Allchin and BetaNews and all you guys are making is moot anyway. It doesn't matter whether your data gets destroyed by a virus or a harddrive crash/theft/disaster. You need a GOOD up-to-date backup solution regardless.
Score: 0
|"Where's the beef?"
-Clara Peller, January 10, 1984,
Score: 0
|If it can be assembled it can be dis-assembled.
This is the cold hard truth.
Binary has it's limitations. Maybe one day the world will see a symbol based system that simply can't be dis-assembled. Until then.......
Score: 0
|I'm confused, anyone who has tried Vista knows it works just like the Mac now. It simply prompts you for access permission before writing to the hard drive. That means, like the Mac it's ability to carry and transmit viruses is all dependent on the knowledge and experience of the user who chooses what to trust and what not too. Macs are often riddled with viruses users don't know about and only transmit manually by allowing them to be written.
Score: 0
|" So the notion that perhaps this company could get it right...is impossible for some to fathom."
no, just unlikely.
MS has a habit of bragging about their products before they hit the market, and then not quite living up to expectations.
where's zune?
Score: 0
|I didn't see where Allchin actually said "vista doesn't need antivirus", but even if that were the case, let's dissect the meaning:
If the statement is accurate: we win
If the statement is wrong: we stick with antivirus
Who cares
Score: 0
|If Apple had ANYWHERE near the market share that MS had, they too would be inundated with Virii.
Vista will virus free for a few seconds after release. It'll be a challenge, and a target.
AND if it is Virus-proof, you can't protect people from themselves.
Score: 0
|Is this site called BetaNews or BetaSoft? Stop getting into bed with Microsoft BetaNews!
Score: 0
|This may be a strange way of judging whether a news provider is "fair and balanced," but you know you're at least on the level when you get responses about 1) being "in bed with" Microsoft, and 2) bashing Microsoft at the first opportunity, for the same story.
SF3
Score: 0
|LMAO agreed. I've read some articles that you appeared to be 'bashing' Microsoft and then later you write one praising them. I think as long as there is somewhat of a balance, we're okay. (which is, by the way, why I believe that if there is another side to the RIAA stories, I'd like to hear it. But geez, this isn't foxnews, it's a software forum! You guys can write whatever you want, forget I mentioned it :)
Heck, this is a frikin' software forum though, not a Democrat vs. Republican thing; yet many here are almost religious about the software they use. Heh, betanews never claimed to be "fair and balanced"--this isn't a political thing! I find it quite hilarious when it escalates to the point where Firefox vs. IE, for example, becomes just as heated of a discussion as Bush vs. Kerry. :D
Score: 0
|Basically there's a bit of a55 kissing going on here from BN. Ever since they made a coup with the interview with Gary whatsisname about IE7 BN have been falling over themselves to get in bed with MS. To have made a mistake in their reporting and then to kiss a55 in the way that they have sickens me.
Score: 0
|Um--did you mean to reply to my comment? Because it appears that you did not intend to, as the whole point of my post was how upset people can get over ridiculously unimportant things. Assuming you are correct, though I do not believe you are, why is it so upsetting that there are Microsoft supporters at Betanews? Is this so detestible that the social and economical status of the world depends on it?
We have way too many political issues that are controversial to be upset over some organization online prefering one software company to another. Again, I think they are fairly balanced, but if they were not, it's their website--they'll do what they want.
Score: 0
|I think we've hashed out that the original report was in fact accurate so let's move on from there.
How do you think news agencies and reporters get good stories? You usually don't get to interview the likes of "Gary whatsisname" without portraying the company in positive light.
I would guess if you did a full study of articles on BetaNews you would find a slew of stories that do not have any "a55 kissing" and in fact just the opposite. In no way does BetaNews ignore the bad things that happen at Microsoft. In fact, lets recap the front page as it is today:
Microsoft Aims for Apple with Zune - doesn't say they are going to take over the market, but is informational as to what MS wants to do and their goals, biased? hardly...
Beta of Microsoft's Flash Rival Coming - this is BetaNews afterall, and talks about a new beta product...biased about it being the best? hardly...
CompUSA to Sell Vista November 30 - news tidbit, how could you add bias?
Windows Live Mail Launches in Holland - news tidbit about product launch
Vista RTM Build 6000 Leaked to Usenet - yea, this article in no way kisses up to MS...
Microsoft, Epson Cross-License Patents - yea, okay..
Allchin Backs Off Antivirus Remarks - merely reports on his blog post, biased? hardly...
Microsoft Debuts MySpace for IT Pros - informational product launch on a news site about new and beta produts? my word....
PowerPoint Flaw Not a Vulnerability - dispelling rumors that a bug is bigger problem than it actually is, and as another user pointed out, mentions PowerPoint crashes a lot...a subtle bash...
Yea you are right, BetaNews is always trying to get into bed with MS by reporting all positive things and falling all over them. 9 of 21 articles on the front page are based on MS news, and I still don't see any biased.
This article is merely a perspective asking the question as to what it means if Allchin was right about not needing anti-virus. Loosen up a bit man! This is good reading from a writer who has been in the industry for some time and can offer these sort of perspectives and thought (or discussion) provoking commentaries.
Score: 0
|Well my reply to everyone is this - this website is supposed to be called BetaNews which by it's very title suggests certain implications. One of which that this is a news website supplying relaible unbiased news regarding beta products and other such new and happening news in the software and hardware industry. This is not a WeAreTryingToKeepOnTheRightSideOfMicrosoftBecauseThey'veSatUpAndNoticedWeExistByHonouringUsWithAnInterViewAndWe'dLikeToKeepOnTheRightSideOfThemBecacuseWe'dLikeAnotherInterviewAtsomePointBecauseAfterallWeDoWantToBenoticedAndMakeSomeMoneyFromAdvertisingDon'tYouKnowNews website - as far as I know anyway - although the past few months would seem to indicate otherwise.
Score: -1
|n/a
Score: 0
|"One of which that this is a news website supplying relaible unbiased news regarding beta products and other such new and happening news in the software and hardware industry."
No, that would be implied in a domain called betaunbiasednews.com or utopia.org. Seriously though, is this even worth getting so upset about? Why get upset with betanews and not CNN, msnbc, and all other major news networks? Is software suddenly more important than government?
Score: 0
|Actually, let's start by clearing up the actual cause of the mis-perception of your story last Thursday... the title.
"Allchin Suggests Vista Won't Need Antivirus"
I don't believe he stated that (or rather, did not say so specifically)... yet the title of the article leads one to believe that no matter what, Vista will not need anti-virus at all. I believe that it was an over-generalization, and that can be very misleading.
EDIT: Not really meaning to nitpick, as I do think the whole affair is rather silly.
Mike
Score: 0
|this wouldn't be the first time betanews had a misleading article title... remember the one about Microsoft Training Guerilla soldiers or something? LOL =P
Score: 0
|"and with thousands of knee-jerks going on simultaneously" LOL!
Score: 0
|"Microsoft-bashing somehow unyieldingly remains a national pastime"
Uh, let me get this straight... you report on a telephone marketing product launch and believe that people who actually use Microsoft products who question the security remarks of a "co-president" of a corporation are "bashers"?
Instead of apologizing to Microsoft, why don't you actually play around with the Vista release candidate and find out how hard it is to get a drive-by download, an email virus, or spyware?
Score: 0
|You are all missing the point of this story entirely. It's quite succintly saying that, if you're not an idiot, and don't go clicking YES to inquiries made by Vista, then you are essentially safe from System Killing viruses and malware because the Operating system wont let things run 'WITHOUT THE USERS PERMISSION' and thats the key phrase. You can still quite happily destroy your computer with enough careless OK boxes im sure, but you have to tell it that its okay to do so.
As for the MP3 virus, do you not look at an attachment before opening it? HMM.. EXECUTABLE FILE? FROM SOMEONE I DONT KNOW? HMM. WHATS THE WORST THAT COULD HAPPEN. Sheesh. For real? Come on, Microsoft have gone to the 9th degree on safety for this OS. Credit where credit is due. I would quite happily run Vista without AV, for 3 reasons
1. Ive seen the efforts that have gone in to make vista as secure as it is.
2. I always read dialog boxes before accepting/denying them.
3. Every antivirus application ive tried with vista has been resource hungry, and did nothing but bombard me with prompts about allowing certain applications access to the system. I ignored them all with the exception of the ones Vista told me to watch.
Guess what, my system is still 100% stable and virus free.
That is my 2 cents. (Australian cents)
Score: 0
|Not exactly sure what the exchange rate is, but for me, that was worth at least $1.25. :)
I agree. I have been using RC2 for quite some time now (more and more as my primary OS), and have not seen the need for any anti-virus protection at all. Windows Defender is performing quite admirably for most of the fodder that infuriates me presently.
Of course, my browsing habits online have evolved quite a bit over the past decade.
Score: 0
|A good two cents, I'd say! You're right; Microsoft has I feel done all it can to protect the users computer. Everything else is up to the user himself and what he will do. I can imagine that before too long, many will want to disable UAC because it's "annoying" and then will complain after they've contracted a virus or some other malware on their system.
Score: 0
|Absolutely! It doesn't matter whether you're talking about computer operating systems or any other type of product. The greatest danger to the consumer, is the consumer themselves.
Have you ever seen an absolutely "safe" product? Make a "foolproof" product and within a very short time, you'll find some fool to prove you wrong.
It doesn't matter how much effort you put into making a product safe for the consumer, somewhere out there, will be a consumer who manages to fail the "common sense" test.
All you have to do is look at the warning labels on any product. They are there for a reason. Usually because someone did something stupid, so now the public must be warned, in order to avoid further liability.
Look at a box of "Preparation H" hemorrhoid suppositories....and a warning..."Not to be taken orally." Now, there's evidence of average consumer intelligence. It's a wonder that software manufacturers don't have to supply a warning, "CD's are not for human consumption."
Whether Microsoft or any other O/S...and I'm not a MS user....somewhere out there is a consumer who will manage to trash their system. Even the best anti-virus system in the world is useless, if the user doesn't heed the warnings.
Score: 0
|I dont know about you all but in pennsylvania, we breed an exceptional crop of fools, and thus they break more foolproof things then the conventional brand of fools.
Score: 0
|I'm in Oklahoma and we have ones here who must set the benchmark!:)
Score: 0
|> 2. I always read dialog boxes before accepting/denying them.
You might, most morons dont.
Score: 0
|Out of curiosity have you tried Clamwin with Vista?
Score: 0
|The problem is that viruses are not as simple as you suggest:
"As we have come to know it, a virus by definition must be capable of running undetected, with privileges it should not have been granted, delivering a payload that should not be allowed, and replicating itself for network distribution, relying on user ignorance if user unawareness isn't available."
I agree that viruses can do most damage if they are either running with admin rights or can elevate to get admin rights BUT that's not a prerequisite for a virus to be effective.
As an example, last year I got hit by a virus that deleted all of my .mp3 files (it specifically targetted mp3s), now it was running with limited user rights yet could still delete the files. The only difference from the .mp3 perspective was that the lack of admin rights meant that it couldn't delete all users .mp3 files (3 or 4 of us share this pc)
In such a scenario, running without antivirus/malware protection under Vista still isn't going to save you, it'll just limit what the virus can do. (As an aside, it turned out later that if I'd run the virus with admin priviledges it would most likely have wrecked my system by adjusting all sorts of key registry entries (eg disabling task manager) and deleting system files, but nonetheless some damage was done without privilege escalation).
Thus it's not a black and white situation...
Score: 0
|Point well taken, Mike. That would indeed qualify as a malicious act to the structure of the file system that would not require rights elevation to achieve. I do believe that kind of malicious process would trigger User Account Control in Vista, but that's just my opinion for the moment, and I'd like to see for sure on the final version.
I'd better be careful here, because I don't want to give anyone the impression that we're daring anyone to go find out the answer to that question for themselves.
S "Quite Sensitive in Recent Days to Pending Avalanches" F3
Score: 0
|In one sentence you claim he never said it, and apologize for aiding in the confusion...
In the next, you posit a question based on the mis-interpretation of the original interview:
In other words, quite succinctly, what if Allchin's right?
You're putting words in his mouth again.
Do you perhaps mean,
"What if our grossly exaggerated misinterpretation of his comments we're right?"
After the pummeling you guys got over this, one would think you'd try and be a bit more careful, but instead you further aggravate it by asking if he was right in saying something he never said.
Score: 0
|Good point...
Score: 0
|I have added nothing, and will add nothing, to Jim Allchin's words. In fact, I am going so far as to suggest that his original comments were accurate, and that his clarification of those comments is also accurate.
Sure, we've gotten questions and comments about this, yours being among them. Public scrutiny is part of doing business on the Internet. As for feeling pummeled, I'm far from that point.
SF3
Score: 0
|"Do you perhaps mean,
"What if our grossly exaggerated misinterpretation of his comments we're right?"
No, he means what if what Allchin actually said was correct? He originally said he did not need to run an antivirus on the pc his son used with Vista (more or less), right? What if he was right about that?
Of course, maybe I'm the one who is making the "grossly exaggerated misinterpretation"...
Score: 0
|Actually, he did say it. The quotes are accurate and Allchin did say that in certain scenarios antivirus may not be needed. Unfortunately, people turned that into "Vista never needs antivirus" as the article above explains.
The point is, that statement got him into hot water and he was forced to back off it. Notice in his blog post, he doesn't stand up and say "Yes, Vista really is secure enough not to run antivirus in certain cases." But, as noted above, Allchin may be right.
You're just as bad as the folks who turned the initial story into "Allchin says never use antivirus," which the initial article never once claimed. Read -> Comprehend -> Comment.
Score: 0
|I suppose I was not "grossly misinterpreting" this article after all then, he is saying that the original statement from Allchin was correct.
Score: 0
|The statement was correct. The telephone game that followed is what caused all the confusion. We have been in contact with Allchin, who has never disputed our story.
Unfortunately: "Allchin suggesting that Vista may not need antivirus in certain causes" went to "Allchin says Vista wont need antivirus" and ended up as "Allchin says uninstall your antivirus software"
That's how the Internet works though :)
Score: 0
|Again, not meaning to be picky, but since there's so much fuss about this anyway...
Perhaps it was the title of the original article that may have acted as a catalyst for much of the fuss.
Reading a headline such as "Allchin Suggests Vista Won't Need Antivirus, In Certain Cases" would not hold my attention very long, for I would most likely respond with "You don't say... I'm comfortable using XP without antivirus, in certain cases. Next article..."
However, when the headline actually read "Allchin Suggests Vista Won't Need Antivirus", that's an attention getter (almost preposterous considering Windows security in the past). It wasn't necessarily untrue, it was simply not specific.
It did, however, force me to read the article. Keep 'em coming. :)
Score: 0
|"It did, however, force me to read the article. Keep 'em coming. :)"
same.
Score: 0
|I think we should all just say thank you to microsoft for finally trying to fix the problem. Now only time will tell how well they did.
Score: 0
|I've invented a vaccine for the common cold. Now everyone can go outside without putting on a jacket.
Score: 0
|Good, I hate wearing a coat!
Score: 0
|But, it's still freezing out there... can I still wear one if I get cold? :P
Score: 0
|And catch frost bite?
Score: 0
|Since being cold does not cause a "cold" I'm not sure what the segue is.
Score: 0
|no, but doesnt it slow down you immune system or something to that regard that helps you catch one?
Score: 0
|well in a few months it will have mutated to something else and your vaccine will mean s***.
Score: 0
|http://forums.microsoft....tID=909837&SiteID=2
False positives suck. A lot.
Down with all AV, it's a reactive security stance that needs to die.
Score: 0
|OMG! I actually agree with you, lol!
Seriously, right you are... better to teach users to be responsible and simply prevent malicious acts in the first place... ideally. :)
Score: 0
|Until MS gets it right - if they ever will - OneCare is garbage. There are far better security solutions than it.
As for teaching users about Internet responsibility, how do you teach an eight year old to avoid a Google link "Puppy wallpaper", replete with a picture of a cute puppy, to avoid clicking on it? Of course a REAL antivirus solution such as NOD32 flags it immediately as containing a dangerous script. Further evidence why you need reputable anti-malware software.
Score: 0
|any OS that is made will be vulnerable to attack and all they can do is lock it down as much as possible. add-on virus and malware protection will still be needed to further protect the system. they will be around for a long time because there will allways be someone trying to figuring out how to get by the safeties.
Score: 0
|Wait, so NOD32 is the first AV without a single false positive? Awesome. sign me up. Oh wait, it's not true because every single AV vendor has false positives. It's the nature of signature based defenses.
Score: 0
|i would rather have a false positive than for it to be ignored.
Score: 0
|Of course no av solution is perfect, but NOD32 consistantly achieves stellar ratings in these reputable tests http://www.av-comparatives.org/
...Advanced+ Certification in both On-demand and Retrospective tests. You can not go wrong using Kaspersky and perhaps a couple others as well. At least you will have better defenses against malware than OneCare will currently offer.
Score: 0
|