Article: How safe are you in Windows?

Replies

• 

  durga ch

  @ Leo, Nice article😀
  
  By the way i quite did not undertsand the below statement and
  "I'll say you better not because windows is not actually safe. All other OS es are based on older concept of OS making which was designed specially for making Unix, are safe from this threat. The new concept of OS Windows is not."
  
  and any clues about loop holes in security in Windows 7? Also when Vista is considered stronger in securty was not windows 7 buitl on VISTA ?
  
  PS: Mods can this be moved to articles section?
• 

  Kaustubh Katdare

  @ Durga: Moved from articles to this section because its a typical tech-article. 😀
  
  First off, nice article. I, however, do not agree to everything mentioned in the article. The article begins with the anti-MS tone, which I didn't like. Microsoft makes very good software - XP & Vista are great for home users who store movies, song files & photos on their PCs and don't use it for critical work. The most common activity also involves browsing the Internet and even shopping online.
  
  Even if someone breaks into a users computer, all he'd do is delete photos/videos/song files and worst delete critical OS files. It would be important to notice that the security provided by XP/Vista and even 7 is, in my humble opinion, enough for home users.
  
  Mission critical systems may make the computers more secure by putting the system behind powerful firewalls & shielding the networks.
  
  I believe its all boils down to the target users of the OS.
• 

  Leo

  Hi Durga the complete sentence is like this, “The others who think they are smart and make a good 20-30 character long passwords with letters, numbers and symbols, now its your time to get disappointed because even your password can be broken easily if you are under any version of windows. SHOCKED!!!!!! . I'll say you better not because windows is not actually safe.”. I am asking people to not get shocked because I said their passwords with 20-30 characters long can even be broken easily, “I'll say you better not” means this.
  Now your another question “All other OS es are based on older concept of OS making which was designed specially for making Unix, are safe from this threat. The new concept of OS Windows is not.”. OS means Operating System. In earlier days before 1970 many computer operating system's system-programs were written in Assembly level languages. Programming in assembly level needed very high precision to write codes. Several programming languages were coming up to take challenge but all failed. The market was trying to introduce first console based games for mass people. But in year 1969 Ken Thompson and Dennis Ritchie were trying to build a computer platform that will be strong enough to perform for their new computer game “Space Travel”. In order to build such platform Dennis Ritchie invented the most loved programming language of all time “C language”. The layered architecture for this operating system was built and “C language” stood tall to every challenge that came in way. This OS was names as Uniplexed Operating System now known as Unix. Unix code was open to all to change and sell in market so many people came in market with their own Unix distribution. The main problem with them was their distributed efforts for same OS, because of which they failed to perform or install on different machines in similar way. And then suddenly from nowhere Microsoft came in market with guarantee with that one OS which will perform same on each platform and he proved his words and the battle with Unix distributes ended giving defeat to all Unix distributors. The architecture designed by Microsoft for its OS was totally different from Unix. Only these two architectures of Unix and Microsoft defined OS design in market. Soon programmers found that architecture designed by Microsoft isn't safe though it is much user friendly. So they started making other OS which would be user friendly with all things that a programmer and mass people need. With little modification to Unix architecture other operating systems like Linux, Mac OS X, Solaris, Wildcat etc stepped in market. Google Chrome OS which will be available to download is also designed on Unix background. And recent study show that 92% of those machines which are using these OS never suffered from data loss, viruses, mal-ware, ad-wares, worms, root-kits, back-doors, crashes etc. There's no way anyhow there passwords can be broken easily though many people will claim so they can break. No hash tables, system dumps can be stolen. And the biggest thing is that these operating systems were never virtually cloned. Therefore I termed Windows as a new concept of Operating system. For more reference you can read “Operating system concepts by A. Siberchatz, P.B Galvin, G.Gagne” I think 8th edition is currently available in market.
  Last you want to know why Windows 7 is not secure though it is based on VISTA?
  In Windows Vista people found UAC(User account control) very much irritating because it use to provide even administrator limited right and used to pop up message before every unknown program's execution, if not turned off. According to me UAC is the biggest thing that protects Vista from threats everywhere on Internet and from viruses, worms, ad-wares etc. The UAC rights not even in hands of Administrator provided Vista with an uncompromising security. Now you are absolutely correct that Windows 7 is based on Windows Vista, in fact it have more security features than Vista. For example some Linux features are added to it which makes it robust to perform and highly stable, more advanced and new security tools which makes it more stronger. But in Windows 7 administrator will be given right to raise alarm on various type of actions by UAC, this is were Windows 7 becomes weaker from Vista because an intruder can use dll injection attack to disable UAC keeping user unaware that it is turned off. So the added security features became futile before this threat. And the last threat that I heard from someone and I am not sure about this, so I haven't included it in my original article but for your sake I am telling here. It doesn't by default saves remote access logs which is really very dangerous but this information is still suspicious so better check yourself before believing.
  I hope my answers were good enough for your queries, you are free to ask anything if you haven't understood any of above things.
• 

  Leo

  Hi Big_K I don't think I started with anti MS-tone. I am very big admirer of Windows for making all things perfectly user friendly. And soon I'll purchase the new candy from MS Windows 7. No company ever creates any OS just to target common people who just want to watch movies, listen music or just store pictures. MS has kept total view of making OS user friendly, in that effort it have to suffer security threats which is just a human error. By the way the threat exists to those who are not power user of systems. Windows is not just used to save pictures and movie, many people use it as server PC, ftp servers, computer from data storage network and even banking and e-shopping. Even the most powerful firewalls and security tools will fail to perform if user don't know about his system security tools and tweaks. Yes they are available in Windows but not in user friendly way, only a professional who have deep knowledge of system can secure his Windows. My article is for those who don't know how to use Windows because they want to use only those features that are available in user friendly manner. We can not explain possibly how to secure Windows in real way to general as well as many expert professionals. And at last every data in your computer may appear invaluable until its gone. By the way I have new article for your moderation please check it here
  #-Link-Snipped-# and thank you for replying that will encourage me to write further.
• 

  Kaustubh Katdare

  @Leo - I appreciate your article. I'm only wondering what kind of security thread can regular users face [and what will be the damage?].
  
  Those users who use Windows to store critical data may need all the extra security features. Windows releases variants of Windows for different sets of users. What I'm implying is that, Windows inbuilt security is enough for a regular user who never goes beyond storing photographs, music & video on their computer.
• 

  Aashish Joshi

  If you are just looking to play some music, watch some movies even play games occasionally, windows is good enough, provided you have decent antivirus protection
• 

  Ashraf HZ

  I got used to the UAC prompts after a while. Now I sort of miss it in Windows 7. I feel something is wrong when it doesn't come up at times 😛
  
  As much as Windows is vulnerable, I think its better to not give an illusion that other OSes are invulnerable to threats mentioned. Any physical access to the computer (such as via bootable disc) can get you past Linux logins too.
  
  I believe it all boils down to user habits. A big threat obviously comes from the Internet, so being vigilant on where you browse, which email you open, and what information you send to someone. Next, as Leo mentioned, is who you give your computer access to. These steps are probably part of the first line of defense.
• 

  Aashish Joshi

  yes, physical access can render almost all security measures useless, unless you have some form of biometric security!!
• 

  Ashraf HZ

  I suppose, short of removing the hard drives themselves. Quite a number of business laptops have biometric identification integrated in them. Perhaps it should be made a standard?
• 

  safwan

  well, I think MS 's windows are more vulnerable then other os. But I too agree with biggie for normal users who just want to store and watch movies and playing games is moderates.
  
  But form above article and posts Its nice information thanks Leo for sharing this knowledge.
• 

  durga ch

  Hey That was quite a nice piece of explanation what you have provided,
  As far a biometric standard is concerned, my finger print reader never actually allow me to access my computer!!??, it just says the reading is incorrect, ma be the first time I fed the reading I did not do it right,
• 

  vik001ind

  ash

  I got used to the UAC prompts after a while. Now I sort of miss it in Windows 7. I feel something is wrong when it doesn't come up at times

  😛
  Windows 7 is much lighter than windows vista, MS has tried to make it more like XP, having enough security like that of vista. UAC is present in Windows 7, the setting can be modified from security features.
  I don't think windows is more vulnerable to attackers as you described.
  Windows is vulnerable to attacks as at present it doesn't have security modules like SELinux in linux. Even though its not so easy to crack a windows machine, that you grab a tool & windows is cracked, there are many steps involved in it like port scanning. Almost all the attacks, you describes above in Windows machine requires physical access to the machine. No OS is safe from physical access attacks (specifically social engineering attacks), anyone can hack linux too(with basic linux knowledge) if given physical access to machine with a rescue cd. Telnet is no more used for attacks, its obsolete now, infact telnet is disabled in windows vista & windows 7 by default.
  Telnet is more used in linux than in windows machines, today.
  
  In fact I think crackers, (not hackers) are used to cracking windows as there are more windows available to them than any other OS in the world, thats why there are large no. of security threats available in windows than any other OS.
  Since Linux is now evolving around there, many threats have been discovered in it.
  checkout this link---
  #-Link-Snipped-#
• 

  Gurjeet Singh

  @leo-- a very good article ,as i read the all the comments ...if you talk about userfriendly then windows is best and the user finds the windows in the familar way..like as in the linux has some powerful security features ..but most of the programs still needs to start from terminal ..so it depends on the user also to take interest in that...moreover
  
  @ash as u talk about the bio informatics (retina pattern,or finger matching) which is from the login side .it should be standard but here the discussion is attack from Internet also ,the attacks.one more thing i want to know that the firewall system is same is in all OS or it has some difference in Linux compare to windows...
• 

  Leo

  [FONT=Times New Roman, serif]Hi friends as I read your remarks on my article and I found that many people think that I had written everything with Anti-MS tone. For everyone here, I want to make clear that I never wanted to start or end with Anti-MS tone. My article was to point out towards various security threats that a user may face while on Windows System and measures to be taken to keep yourself away from them. The article was written with no technical details. But I found some people have wrong piece of information while reading views, and I think I must clear those things. By the way if anyone really feels strongly that the article was cent percent against Microsoft Windows then I am extremely sorry for that. Many people think Windows is vulnerable because of large number of users, I use to feel the same until I had read books on “Operating System Structures” I can not remember the name of Author but this book will open those concepts of Operating System to people who want to know on what basis different Operating Systems are built. You will find that how much Microsoft has sacrificed just to make Windows super user friendly and super fast responsive. I recommend everyone here reading these books which I have read to collect enough information to check clarity on each statement I have made. The process journaling in Linux and Unix makes them more reliable with memory modules available so that it should not crash. But to make it more responsive Windows grants permissions to its memory management modules to change stack pointer positions as per program requirement which makes is more susceptible to crash when in valid operation is performed. Most of the time when your computer crashes it is mistake of memory management module and not the program you are using. I urge people to read following books to make things more clearer to them,[/FONT]
  
  
  [FONT=Times New Roman, serif]Operating System by A.Silberchatz and P. Galvin[/FONT]
  [FONT=Times New Roman, serif]Linux Complete Reference by Richard Peterson[/FONT]
  [FONT=Times New Roman, serif]Windows System Programming by J.M Hart[/FONT]
  [FONT=Times New Roman, serif]The Design of Unix OS by M.J Bach[/FONT]
  [FONT=Times New Roman, serif]Operating Systems by William Stallings[/FONT]
  [FONT=Times New Roman, serif]Operating System Structures ---------------------[/FONT]
  
  
  [FONT=Times New Roman, serif]If you need any technical details then please feel free to ask I will be glad to reply. If you have not read or you don't want to read them and need some technical details on any topic which you have not understood I am here to reply. Now let's reply to people who have wrong piece of information.[/FONT]
• 

  Leo

  ash

  I got used to the UAC prompts after a while. Now I sort of miss it in Windows 7. I feel something is wrong when it doesn't come up at times 😛
  
  As much as Windows is vulnerable, I think its better to not give an illusion that other OSes are invulnerable to threats mentioned. Any physical access to the computer (such as via bootable disc) can get you past Linux logins too.
  
  I believe it all boils down to user habits. A big threat obviously comes from the Internet, so being vigilant on where you browse, which email you open, and what information you send to someone. Next, as Leo mentioned, is who you give your computer access to. These steps are probably part of the first line of defense.

  
  [FONT=Times New Roman, serif]You are right miss Ash, no OS in the world is safe enough to be not vulnerable and also no data is safe from physical access until it is encrypted with strong key and strong algorithm. By the way you mentioned even Linux and Unix logins can be past using a bootable disk. I know nearly 5-10 ways to get inside Linux Box without using password but all these ways need inter-net connection. I don't think Linux and Unix OS logins can be passed by bootable disc because Linux and Unix store keys by encrypting them by non-reversible algorithms that is when you reverse the algorithm which created key you will find the original and reversed keys are not same. And Windows login is passed because Windows does not encrypt your keys, it arranges them in hash table and by obscuring it places in registry. The hash table algorithms are available on net for free and so passing Windows Logins is possible. That is why I mentioned to use third party softwares to save passwords. If you have the disk which can really pass Linux and Unix logins I want to know more about how they accomplish the task of passing logins. Thank you for the reply I'll post my new articles in “Post Your Computer Articles Here” as soon I get time. Please don't forget to read them and reply.[/FONT]
  
  
  
  
• 

  Leo

  vik001ind

  😛
  Windows 7 is much lighter than windows vista, MS has tried to make it more like XP, having enough security like that of vista. UAC is present in Windows 7, the setting can be modified from security features.
  I don't think windows is more vulnerable to attackers as you described.
  Windows is vulnerable to attacks as at present it doesn't have security modules like SELinux in linux. Even though its not so easy to crack a windows machine, that you grab a tool & windows is cracked, there are many steps involved in it like port scanning. Almost all the attacks, you describes above in Windows machine requires physical access to the machine. No OS is safe from physical access attacks (specifically social engineering attacks), anyone can hack linux too(with basic linux knowledge) if given physical access to machine with a rescue cd. Telnet is no more used for attacks, its obsolete now, infact telnet is disabled in windows vista & windows 7 by default.
  Telnet is more used in linux than in windows machines, today.
  
  In fact I think crackers, (not hackers) are used to cracking windows as there are more windows available to them than any other OS in the world, thats why there are large no. of security threats available in windows than any other OS.
  Since Linux is now evolving around there, many threats have been discovered in it.
  checkout this link---
  #-Link-Snipped-#

  [FONT=Times New Roman, serif]Hi vik001ind. I disagree that Windows is not safe because it does not have modules like SELinux. Windows can be made much stronger than Linux in security by using various third party softwares. This is cent percent possible. I don't know about you but me my my friends consider it is just easy to crack Windows by taking a master key and get in unless you are protected by third party softwares. I know Linux and Unix are also vulnerable but tools securing them are free and only some are paid because it is open source. And I don't think remote access attacks I described need any physical access. I completely agree with you no operating system is safe from physical access and off course intruding any system is not joke that a basic knowledge will help to crack it you can not even crack windows 98 without sound knowledge of networking and commands whereas case differs if you are using some tools or your victim is fool. Telnet is still best available tool used for intruding because it provides complete administrator rights while remote access. And though telnet is not by default active many people who often access their computers remotely use telnet client to save money on softwares for remote access. It is also active on many servers. When it comes to port scanning many new commercial port scanners are available which not get detected easily, by the way people like us consider using port scanning tools primitive to know which port is active. I completely agree you in case with security on Linux, even Linux is not secure if Linux user is novice. Also I apologize for confusion on Hackers and Crackers.[/FONT]
  
  
• 

  vik001ind

  Selinux module is inbuilt in Linux, its not a third party, of course every OS can be secured by using third party software. Windows don't have anything like it which implements intensive security like SElinux implements on configuration files by default.
  You said about crack cds sometimes, I'm referring to those when i said about physical access.
  And people who use telnet nowadays may not need high security measures as they may not doing important stuffs. Its easy to make fool of fools.
• 

  Kishan Gupta

  I am using windows 7 now. By default in windows vista and 7 administrator account is disable and that's why there is no password for administrator account. I read somewhere that by using administrator power any one can hack my system easily on network. Is it right? If yes then how i can safe my system from this.
• 

  vik001ind

  in xp administrator account is enabled & if you don't set the password anyone can login to your system with username administrator & password blank. This security issue was tackled in vista & 7 by disabling it.
  by the way, all windows system password can be cracked using crack cd or rescue cd that edits windows sam file where passwords are stored.
• 

  Mahesh Dahale

  vik001ind

  in xp administrator account is enabled

  disable administrator account by using console root\Local user and group
• 

  vik001ind

  cmd command for disabling the adminstrator account --
  > net user administrator /active:no
  
  put yes for enabling.