Next came Antivirus. I wanted to delete the subscription based antivirus she was using and install AVG. Luckily I noticed her subscription ran through 11-2012 so I left well enough alone.
I then walked over to her win 7 box. It had norton crapware installed by the manufacturer and required her to find an obscure greyed out link to avoid purchasing norton security essentials every time she booted.
For many of today's Windows antivirus solutions, the cure seems like it is worse than the disease.
No, just Norton. It's shockingly bad which is a real shame given how it's bundled with so many Windows boxes nowadays.
Incidentally, AVG isn't great either. And please don't go with Avast, that's just as bad. If not worse. The number of naughty things you can do without Avast batting an eyelid is so awful it's just funny. If you want a half-decent AV for Windows, try Avira.
Unix is written from the ground up as a multiuser OS. This means important system files are not writable by non-root users. On windows, there are rudimentary safeguards intended to steer prying eyes away from the windows\system32 folder but by default any user can run cmd and type cd %system root%\system32 and then type del *.* and get away with crippling their machine. In fact, I'm sitting here on win 7 enterprise as I type this and I just went to the folder and did a "dir /ar" to see how many files are not user writable. Guess how many? One. someobscureapi.dll has its write-protect flag set. The other 3,000 files can be deleted by me. Plain old me. Plain old not logged in as root me. This means that any batch file or exe file that runs as me can overwrite, delete or modify the fundamental underpinnings of the OS. No hacking required.
Compare this with OS X (or Linux or any other *nix) where files I can write are confined to /Users/myuserfolder. Sure it is possible to write an exploit in Unix that runs as a user but obtains root priveledges but on windows it's not even necessary to think that hard. All you need to do is want to do something and it's done. If only MS would adopt a Unix layer beneath windows we might begin to see the end of the era where easily doing harm to a system is the rule rather than the exception.
Oh dear. I'm afraid you're completely wrong on that front. Just because a file isn't set to read only doesn't mean that you can delete or modify it. Security permissions have existed in Windows dating back to Windows 2000 (at least, I can't remember earlier than that). Admittedly they didn't do a whole lot in XP as everyone just ran as an admin anyway, but in Vista and 7 Microsoft introduced the "TrustedInstaller" group. Right-click on any system DLL or EXE in the system32 folder, and go to the Security tab. There you can see effective permissions for users and groups of users. See yourself there? Unless someone's been mucking about with your machine you should only have read and execute privileges. Even running as system (or root in Unix terms) you can't modify the files there. You need to take ownership of the file in order to alter permissions of it, which (by default, again Windows lets you muck about with it for some unknown reason - probably too many complaining about UAC in Vista) requires you to accept a UAC prompt.
There is some validity to the market share theory that fewer virus authors attack OS X because there are fewer targets but I assert that it is also a harder target because OS X is built on Unix which was initially conceived as a multi user OS where with few exceptions nobody is root unless they try to be.
Perhaps. I tend to believe that while XP still has around 50% market share (last time I looked), why go after anything else when there's that low-hanging fruit just sitting there. Malware authors have had years of experience going after Windows targets, why throw all that knowledge away for a different OS when the market share is still very low. It's easier to gain knowledge incrementally as new versions of Windows appear. If you look at the recent Pwn2Own contest, the number of exploits used for IE8 that had to be chained to together just to break out of the browser is seriously impressive stuff and more complicated than for any other browser.
On windows, everybody is root all day every day and a highly destructive attack is much easier to mount.
Yeah, that's not true either I'm sorry to say. Root on Windows is the system user, which you can only run as if you get the OS to launch you as such. This usually means running as a service (like the PsExec tool from Sysinternals will do for you). It's more difficult to do anything as system given that you don't get a desktop (there is one incidentally, you just can't ever see it), and it's not easy to get a command prompt running as system.
Cheers,
Snooksy
