Although Vista's included e-mail client blocked all 10 malware emails present on November's list of most common threats, three got around Vista's built-in resistance when a third-party e-mail client was deployed.
As Microsoft advertized Windows Vista's enhanced security at the operating system's U.S. launch on Thursday, one security vendor said that a third of the month's top 10 exploits can effectively infect a Vista-equipped PC.
"Vista's baseline protection is satisfactory, and the operating system will be great for people who don't have any defense at all, but there will persist to be the need for additional security," says Ron O'Brien, a senior security analyst with Sophos.
Although Vista's included e-mail client—dubbed Windows Mail to separate it from the now-defunct Outlook Express—blocked all 10 pieces of malware that made Sophos' November chart, three got around Vista's built-in defenses when a third-party e-mail client was used. The trio that managed to hit Vista—Stratio.zip (aka Stration), Netsky.d, and MyDoom.o—accounted for nearly 40% of the malware volume Sophos detected in the month.
"No operating system is 100% secure," says O'Brien. "But hopefully Vista will contribute to the decline in some types of malware."
Sophos' results echo comments made Wednesday by other security analysts, who foreseed that new security techniques and technologies in the operating system will prevent some kinds of exploits, but do little to prevent social engineering-style attacks that rely on duping users into visiting Web sites or opening e-mailed file attachments.
"These aren't exploiting a vulnerability," notes O'Brien, but instead user interaction to infect or hijack a PC.
O'Brien says Vista would soon be hackers' target . "It won't be long before cybercriminals develop Vista-specific malware or modify current threats to fit the bill," he expects. "Stratio.zip, for example, remains on the top 10 due to constant, minor alterations to its code that force security systems to re-identify the malware."
Stratio.zip, which held the top spot and accounted for a third of all e-mailed malware in November, swaped the long-running big dog, Netsky.p, a worm that first appeared in 2004. "Netsky.p is proof that there are a large number of vulnerable machines out there," says O'Brien. "Even the most basic [antivirus] protection would prevent Netsky from propagating."
Netsky.p, which took second place in Sophos' November top 10, accounted for 15.6% of all malware. Bagle.zip, Zafi.b, and Netsky.d held down the third through fifth spots, respectively.
|
