How come viruses work?

[Tarquin Farquhar]

Your not thinking about this one.

Go back to basics.. What is a virus... its a program that does stuff on your PC just like OUtlook, Explorer etc. The problem is to differentiate which programs you want to run and which you don't. Anti viri software does this but it is a race. The clever bit is how to get it past that and on to your PC and run. After that its just a normal program like the ones you are already running.

There are so many you just can't say don't do this cause they will find one that will do somethign else instead. How does your pc know that you want to send email or to hack a website. It doesn't so it just runs it happily either way.

How about making my PC so that it will only run programs that *I* launch explicitly, like by double-clicking on the icon or entering the name on a command line? So if I go to a web site, it can display what it likes on my screen, but it can't run programs on my PC? Is that not sensible?

[VectraMan]

Unfortunately, that study is so seriously flawed as to be meaningless.

I thought it might be. I'd suggest the biggest problem with browser security is that HTML and it's related technologies have become so ridiculously overcomplicated that it seems nobody, not Microsoft, Google, Apple, or Open Source beardyweirdies can come up with a browser without at least a few serious holes.

I can't be bothered writing full explanation (I've got to go and sign on in 40 minutes) but essentially it is because Windows is NOT an operating system, it is a program laucnher.

Us old farts with bald heads or grey beards remember real computers with multi-processors and multi-threading and multi-user and real concurrency and ... security.

Amongst the many activities of a real operating system are to protect the machine from the programmes running on it, and the programme areas from one another. On a real computer you cannot scribble all over the RAM with any old tulip like you can on a Micro$oft box. Your programme can screw itself all it likes but it will not have the permissions to change (or even see) anything else.

Imagine every thing running on your PC as running on its own virtual machine. A bit like that. Except the disk space is protected too. And better. And without the degradation.

Everything Richard says is correct of course. As long as it's 1990 and you're talking about Windows 3.0 in Standard Mode on a 286. Fortunately things have moved on.

[VectraMan]

So if I go to a web site, it can display what it likes on my screen, but it can't run programs on my PC? Is that not sensible?

Internet Explorer does that.

[Moscow Mule]

I thought it might be. I'd suggest the biggest problem with browser security is that HTML and it's related technologies have become so ridiculously overcomplicated that it seems nobody, not Microsoft, Google, Apple, or Open Source beardyweirdies can come up with a browser without at least a few serious holes.

IIRC, both Chrome & Safari do (or will soon) sandbox your internet browsing so it can't do anything nasty to your PC (or did I make that up?).

[Tarquin Farquhar]

Internet Explorer does that.

OK, you're being pedantic. If I browse the web, how does a website infect my PC? Does it not have to do something on my PC, that instead might just not be allowed?

[NickFitz]

...it seems nobody, not Microsoft, Google, Apple, or Open Source beardyweirdies can come up with a browser without at least a few serious holes.

write software that can be mathematically proven to be free of bugs

[NickFitz]

OK, you're being pedantic. If I browse the web, how does a website infect my PC? Does it not have to do something on my PC, that instead might just not be allowed?

If you're using IE, it's probably through a security hole in an ActiveX component. Supposedly this isn't allowed, but somehow it still happens. (The fact that the average user doesn't bother reading the warnings they receive but just clicks away merrily doesn't help.)

With other browsers, it'll be a similar flaw.

This only applies to Windows, by the way.

[Tarquin Farquhar]

If you're using IE, it's probably through a security hole in an ActiveX component. Supposedly this isn't allowed, but somehow it still happens. (The fact that the average user doesn't bother reading the warnings they receive but just clicks away merrily doesn't help.)

With other browsers, it'll be a similar flaw.

This only applies to Windows, by the way.

One of the posters on one of your links had a good phrase: "Computers should be easy, not users should be PhD's.".

So do viruses usually get in via actual bugs in part of the OS? Or is it usually because the user said "yes of course that's OK" when they shouldn't have done? How about if I browse using a low-level user account, and routinely refuse requests that don't look like something I have just initiated?

But honestly, I'd like a really read-only browser: let me read web pages but do not save anything (maybe the odd bookmark). And a read-only email client to go with it.

[VectraMan]

If you're using IE, it's probably through a security hole in an ActiveX component. Supposedly this isn't allowed, but somehow it still happens. (The fact that the average user doesn't bother reading the warnings they receive but just clicks away merrily doesn't help.)

With other browsers, it'll be a similar flaw.

This only applies to Windows, by the way.

I doubt that's true. Flash is the only ActiveX control in common usage, and that's well enough known that security holes are reported as a problem in Flash (and there are some). And of course Flash isn't Windows only.

In Vista, Active X controls are limited. I know this from working on one that didn't work in Vista's "protected mode". The Netscape plugin version of the same thing that works in Firefox/Chrome/Safari/Opera has no such restrictions and can run like a native application, but in IE, the ActiveX control is prevented from having the same access.

Vista also does all sorts of clever things in keeping track of programs you've downloaded and treating them differently until you unlock them.

I suspect 99% of these problems are actually people installing bits of crappy software they download. I recently installed Serif Draw Plus/Lite - or something, and it installed the Ask toolbar which installed an upgrade service which took it on itself to delete my boot.ini regularly. : Entirely my doing and no virus checker would have helped. That was under XP; under Vista or Windows 7 it wouldn't have been able to do that.

[Platypus]

I suspect 99% of these problems are actually people installing bits of crappy software they download.

I'm sure you're right, but I got clobbered by a drive-by virus yesterday that got onto my machine, I can only assume when I clicked onto a website to download torrent I was looking for. I didn't agree to download anything, and I was using Firefox. I have anti-virus which is right up-to-date. I have SP3 whiich is fully up0-to-date with the latest patches. And yet I got screwed.

I'm still reeling from just how ineffective all that "protection" was, and wondering if I should do my web browsing in a virtual machine. Which is bloody ridiculous if you think about it.

Computers should be easy to use! When someone makes one that way, it'll really catch on. Maybe Steve Jobs already has ;-)