Risk-ware and the Public Internet

By: 
Kort E Patterson

Computers have become indispensable business tools, exceptional multimedia entertainment systems, and are rapidly becoming the primary means of communication for both data and voice.

They've also become prime targets for cyber criminals who want to steal your personal and business information, covertly use your computer and Internet connection to send spam email, hijack your system to commit crimes in your name, or simply vandalize your property out of sheer mindless destructiveness.

The worst problems plaguing the Internet - viruses, spyware, malware, script kiddies, spam, etc. - only exist because Microsoft's Windows makes them possible. If you're still using Microsoft Windows, the risk-ware on your computer is endangering you, your business, and everyone else on the public Internet.

The flaws in Windows are the primary reason computer viruses exist. While there are a very small number of viruses that target Apple computers, nearly all of the 80,000 known viruses can only infect Windows machines. Only Windows offers so many maliciously exploitable flaws. Windows computer viruses have caused billions of dollars in damage and lost productivity - costs that are paid by Windows users, not by Microsoft.

Microsoft built covert back-doors into Windows so it could extract information from your computer without your knowledge. It steadfastly denied the existence of these intentional security breaches until they were proven to exist by independent researchers. Now the Internet is swarming with spyware seeking to steal your confidential information and send it to cyber criminals who are even more "ethically challenged" than Microsoft.

Just using Windows Internet Explorer to visit a website hosted on a Microsoft IIS web server can give cyber criminals control over your computer. The Department of Homeland Security's U.S. Computer Emergency Readiness Team (CERT), Secunia, and others are now advising anyone who cares to listen, not to use Windows Internet Explorer because of the clear and present danger it poses to its users and the rest of the Internet. Less well publicized is that the latest IE exploit also involves yet another dangerous security flaw in Microsoft's IIS web server product.

"Script kiddy" tools are widely available to those who lack the technical skills to break into your computer themselves. These "cyber crime for dummies" tools are only useful for breaking into windows computers.

Even macros in MS-Word documents can be used to gain control over an unsuspecting Windows user's computer.

Microsoft has always put a lot of effort into claiming its products are safe and easy to use. But advertising claims don't offer much protection from the real world flaws in its products. A decade of market dominance has brought vast riches to Microsoft and its founders - riches they obviously preferred to pocket rather than spend on producing a quality product. And while Microsoft has gotten rich on the money it's saved on product development, the costs and disruptions caused by Windows virus epidemics continue to escalate for users.

Microsoft has released so many band-aid patches for flaws in its products that applying them has become a major cost overhead for administrators. Instead of being able to concentrate on using their computers for the tasks they were purchased to perform, Windows owners are being forced to spend increasing amounts of time and money simply trying to keep their systems running, and vainly trying to protect themselves from the risk-ware on their machines. And since all of this wasted time and effort is being consumed just putting band-aids on the most obvious symptoms, the cost overheads and dangers to users continue to grow. One of the few certainties in our uncertain world is that there will be more Windows security patches next month - and the next, and the next...

If only Microsoft put as much effort into actually deserving its advertising claims as it puts into making them. But further demonstrating that it is institutionally incapable of producing a product that lives up to its advertising, Microsoft has instead launched a smear campaign in a venal effort to keep its customer base from finding out how much better off they'd be switching to Linux.

There are no real Linux viruses - none at all. Not that there hasn't been a great deal of effort to create Linux viruses by those with a vested interest in preserving the market dominance of Microsoft's risk-ware. But contrary to all of the manufactured hysteria, there remains zero actual potential for a user to infect his own Linux machine with a virus - let alone infect anyone else.

There is plenty of unfounded hysteria being spread by those with an obvious self-interest in creating a false perception that Linux is as "vulnerable" as their inferior products - or seeking to sell unneeded "virus protection" to the gullible. But an objective analysis of these claimed "Linux viruses" reveals that the alleged danger to Linux users is more hoax and wishful thinking than substance. None of the claimed "Linux viruses" are capable of actually causing harm to a Linux system even when intentionally "run" by a user - let alone capable of infecting other Linux systems.

In essence, the majority of the claimed "Linux viruses" are nothing more than manufactured hysteria based on the premise that, since someone with root level privileges can build and run legitimate programs, he could also theoretically build and run malicious programs. He could also take a large hammer to his computer, but is that theoretical "risk" a valid concern in the real world?

The rest of the "Linux viruses" being promoted in the smear campaign against Linux claim to exploit the specious "vulnerabilities" of insecure services designed for use on trusted networks - none of which should ever be used where they could be exposed to malware in the first place. Linux is so flexible that it's possible to build a system that is so crippled it's as vulnerable as a Windows system, but only someone wanting to fabricate false "proof" of unfounded accusations would have a reason to do so.

According to Microsoft's Fear, Uncertainty, and Doubt (FUD) campaign, you're supposed to believe that these contrived theoretical "risks" are a greater cause for alarm than the billions of dollars of damage Microsoft's risk-ware has caused in the real world.

And the harm caused by Microsoft's risk-ware in the past is insignificant compared to the threat it's rapidly becoming to the Internet itself.

By some estimates as much as 70% of current Internet email traffic is now spam. It's become a distressing routine for individuals to abandon one email address after another as they become known to spammers. A growing number of businesses are considering abandoning email altogether as the volume of spam they receive makes it increasingly impossible to use email for legitimate purposes.

One of the reasons spam is so difficult to stop is that spammers have become a profitable market for Windows malware creators. Having perfected their skills with mindless vandalism and information theft, malware creators have discovered that they can sell their ability to take over the computers of unsuspecting Windows users to spammers seeking ways to get around blocks on their own servers. The new generation of malware no longer tries to cause sensational damage, but rather to turn infected machines into compliant zombies willing to serve their new masters for a price. Zombie Windows computers with Comcast broadband Internet connections have become the largest source of spam in the US. And Comcast is just one of many broadband suppliers. In desperation, some ISPs are now arbitrarily blocking all email sent directly from broadband connected computers because zombie Windows machines have become such an overwhelming crisis.

The presence of Windows computers on the Internet is progressively making the most powerful communications network ever created unusable. Are the astronomical profits Microsoft makes from its risk-ware worth sacrificing one of the most valuable resources mankind has ever created? Microsoft obviously thinks so. Do you? Are you part of the solution or part of the problem? Are you practicing safe computing, or providing a haven for risk-ware that endangers you, your business, and everyone else on the public Internet?