🚀 go-pugleaf

In the last 24 hours predictions that I have made
more than 2 years ago to my friend have been realized
with respect to computer security and
computer related viruses.

The latest computer virus, Sasser is in its
infantile stages, what has to be understood is that,
none of the existing and future anti-virus
applications are capable or for that matter able
to protect a computer system or network from
the latest and future generations of computer viruses.

Yes, I will say it again:
NONE OF THE EXISTING AND FUTURE ANTI-VIRUS APPLICATIONS
ARE CAPABLE OR FOR THAT MATTER ABLE TO PROTECT
A COMPUTER SYSTEM OR NETWORK FROM THE LATEST AND
FUTURE GENERATIONS OF COMPUTER VIRUSES.

So the next logical questions in my opinion would have to be:
How is so, when there is an increasing number of applications
that offer to protect your internet connection, network,
e-mail and so on?

Are the products on the market not doing what is claimed
to be doing?

To answer the first question,
ALL EXISTING APPLICATIONS ASSUME A PARTICULAR SOFTWARE
MODEL WITHOUT TAKING INTO CONSIDERATION THE ENHACED
CAPABILITIES OF THE OPERATING SYSTEM, THUS,
MAKING THEM INADEQUATE TO DEAL WITH PRESENT AND FUTURE
GENERATIONS OF COMPUTER VIRUSES.

With respect to the second question,
what I can say about it is that it provides
only basic to peripheral protection to low level "attacks"
that are mainly initiated by novices in computer hacking.

The next questions that I am being asked from time to time are:
How did we get here?
What are the causes?
What can be done about it?

The answer to the first question is simple:
For some reason, when companies and corporate entities
are recruiting IT personnel, their first selection
criteria was and STILL IS that the applicant must have
a so called "pleasant personality", in other words,
he must be a nice guy first and foremost,
so, they went ahead and hired all the nice imbeciles
that could spell "Information Technology" and "computer networks".

One cause is that for some reason
ALL UNIVERSITIES IN AUSTRALIA have dropped the subjects
that were introducing the would be IT graduates to
individual computer component analysis and programming, thus,
reducing the necessary skill base that is required
to deal with the Sasser type viruses and their future generations.

When addressing the third question, one has to take
into consideration the fact that
ALL OPERATING SYSTEMS ARE OPEN TO THE SASSER TYPE VIRUSES.
And by ALL I mean, Windows, Unix, Linux, QNX and any other
operating system that has distributed computing capability.

Another cause of such high level of exposure is related
to the applications that are installed on a computer system
or network. So, if there are any Java developed applications
or Java based components installed on your computer, and you
are connected to the Internet, then your computer or network
is virtually naked with respect to security,
no matter what precautions you have taken
(i.e. firewalls, anti-virus, anti-hacking software, you name it),
your system is not protected,
no matter what the vendors are saying.

There will be some that will point out that Unix and Linux
are "safer" with respect to network penetration,
RUBBISH, they are not, if anything, they are MORE VULNERABLE.

The penetration of applications such Opera
(the least safe application) increases by 500% the
vulnerability and exposure of your platform and network.

At this point, you might say, OK, you have made your point
about Java and other applications, is .NET safer?
No, a few years ago, when Microsoft introduced the
.NET environment, I have made a posting in which I pointed
out the fact that the .NET environment will be the cause
of security concerns and vulnerability, issues that have
not been addressed until today,
the vulnerabilities and exposures are there.

I have to point out also, that I am a
Computer Systems Engineer which can write
programs and applications in C++ and Visual C++ only,
thus, you may consider the following a bit biased,
however do as you wish, nevertheless, I have the necessary
knowledge to make the following statement:
ANY APPLICATION, SOFTWARE COMPONENT, PLUG-IN,
THAT HAS BEEN DEVELOPED USING PLATFORMS SUCH AS,
JAVA, VISUAL BASIC AND THE REST, INCREASES THE VULNERABILITY
AND EXPOSURE OF YOU COMPUTER SYSTEM AND NETWORK BY 1000%.

So, what it means is that the moment you have installed a
Java, or Visual Basic developed application,
your computer system or network is not protected from
viruses, hacking at all, no matter what counter-measures
you have put in place
(i.e. firewall, anti-virus, security privileges, passwords, etc).

Does this mean that applications developed using C++,
Visual C++, Borland C++ are safer?
NO. I have looked at a few, "commercial" applications
that claimed to be developed using C++/Visual C++,
and NONE of them have employed the protocols and functionality
of the development language that currently exists in the
C++/Visual C++ environment which would have enable them
to minimize and for that matter eliminate the level of
computer or network exposure.

The developer's answers were that would have been too expensive
to do so (which is rubbish, there are 10 function calls
that have to be used) and in some cases
(I love this answer), the application was not
engineered to take into consideration this functionality.

To make things more difficult one will have to take
into consideration the so called "third-party" plug-ins,
again, they will further magnify the exposure and vulnerability,
on the basis that the developer(s) of the plug-in will
rely for security on the "build-in" features of the
application which are none, however, the plug-in itself
becomes another entry point for the would be hacker,
and example of this is the Macromedia Flash Player,
which was used to gain access and control over another
machine and network, the "beauty" of this was that the
"Task Manager" was reporting activity and CPU usage
allocated to the Macromedia Flash Player, however,
an account was created, files have been transferred,
files have been moved around, an application was installed,
you name it and the Network Security Expert was looking
at the screen and attempting to stop the so called
"break-in" attempt, mind you they had and still have
all the firewalls and anti-virus applications known to man.

So, you might say, OK, you have made your point, what is to be done?
Quite a lot, is the answer, there are procedures and protocols
that when implemented reduced and in some cases, ELIMINATED
the exposure to hacking and virus threats.

Please, do not ask me, because I do not have the time to do so,
on the other hand as author of this posting, I do not want
to be seen as trying to somehow "tout for business",
also keep in mind that I am very, very expensive.

Something about yours truly:
I have something like 15 years IT exposure.
In the late 90's I have pointed out that 95 to 98% of
the Y2K work that was performed at the time was unnecessary.

My main source of income comes from tutoring mathematics
to high school students over to weekend (80 students in total).
The rest of my time I use it to keep up to date with
security and development aspects of information technology.

From time to time, I am asked to solve security
issues by organizations that do not mind working
and receiving advice from a bastard.