![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png){kind=small}
Aug. 6th, 2002
Why Windows has a 6 month life span...
Aug. 6th, 2002 09:37 pmI just read an intresting paper on how Windows (all versions) are fundimentally insecure. I'll try to make a little sence with it... and make some comparisions.
To be close to what Windows has with Linux, for example, I would need the Linux Kernel, many fundimental utilies to get it to a command prompt, Xfree 86 (X11) to get graphics, GTK and GNOME to get a user interface, and a window manager... say, Sawfish just for kicks. Windows combines all of that in one...
... and looses some native security checks in the merge. The one lost check the paper says is that any Windows program can send any other Windows program fake control messages, using documented Windows calls, and do so totally anonymously.
The paper demonstrates a way to send and execute a small trojan horse, grab administrator permissions, and be able to cause further damage... using documented calls. And Microsoft can't do a thing unless it changes the way the calls work, and break everything.
It makes me wonder why Microsoft can't upgrade it's version of Unix...
To be close to what Windows has with Linux, for example, I would need the Linux Kernel, many fundimental utilies to get it to a command prompt, Xfree 86 (X11) to get graphics, GTK and GNOME to get a user interface, and a window manager... say, Sawfish just for kicks. Windows combines all of that in one...
... and looses some native security checks in the merge. The one lost check the paper says is that any Windows program can send any other Windows program fake control messages, using documented Windows calls, and do so totally anonymously.
The paper demonstrates a way to send and execute a small trojan horse, grab administrator permissions, and be able to cause further damage... using documented calls. And Microsoft can't do a thing unless it changes the way the calls work, and break everything.
It makes me wonder why Microsoft can't upgrade it's version of Unix...