Sick Personal Computers should be banned from the net says Microsoft

**Maggy** · 06-10-2010, 15:46

http://www.bbc.co.uk/news/technology-11483008

Quote:

Virus-infected computers that pose a risk to other PCs should be blocked from the net, a senior researcher at software giant Microsoft suggests.
The proposal is based on lessons from public health, said Scott Charney of the firm's trustworthy computing team.
It is designed to tackle botnets - networks of infected computers under the control of cybercriminals.
Putting machines in temporary quarantine would stop the spread of a virus and allow it to be cleaned.

Seems obvious to me but is it that easy to implement?

Stuart · 06-10-2010, 16:10

Seems a good idea to me. It would require a fair amount of work ISP side though.

IIRC, NTL did something similar for a while in Ex-CWC areas (not sure about original NTL). If your connection showed certain types of behaviour, your internet access was cut, and you were only given access to website for cleaning computers.

haydnwalker · 06-10-2010, 17:59

Great idea... problem is, that would leave linux and macs on the internet...seems like MS is shooting itself in the foot a little bit.

Peter_ · 06-10-2010, 20:35

Quote:

Originally Posted by Stuart

Seems a good idea to me. It would require a fair amount of work ISP side though.

IIRC, NTL did something similar for a while in Ex-CWC areas (not sure about original NTL). If your connection showed certain types of behaviour, your internet access was cut, and you were only given access to website for cleaning computers.

They started again in August click HERE.

Stuart · 06-10-2010, 21:46

Quote:

Originally Posted by haydnwalker

Great idea... problem is, that would leave linux and macs on the internet...seems like MS is shooting itself in the foot a little bit.

No need to limit it to Windows. In fact, both Linux and OSX are also vulnerable to viruses, they just aren't infected as much as Windows.

Hom3r · 06-10-2010, 22:17

One small problem, were do you then get AV / malware updates to fix the problem?

idi banashapan · 06-10-2010, 22:21

if it's build into the OS (the AV tool), then as soon as something is detected, it can restart the machine in safe mode without network and run a full scan. once the malicious software is dealt with, the system can restart as normal. that way, everyone always has some kind of AV protection from the get-go. currently MS has Security Essensials, which is a free, but optional add on. if it were built in, it could allow the machine online giving the user the option to install a third party AV. if the OS cannot detect an OS running, then it can stop any network traffic, thus stopping any nasties from propegating.

Stuart · 06-10-2010, 23:05

Quote:

Originally Posted by Hom3r

One small problem, were do you then get AV / malware updates to fix the problem?

Include the update servers in the list of allowed sites?

---------- Post added at 23:05 ---------- Previous post was at 22:59 ----------

Quote:

Originally Posted by idi banashapan

if it's build into the OS (the AV tool), then as soon as something is detected, it can restart the machine in safe mode without network and run a full scan. once the malicious software is dealt with, the system can restart as normal. that way, everyone always has some kind of AV protection from the get-go. currently MS has Security Essensials, which is a free, but optional add on. if it were built in, it could allow the machine online giving the user the option to install a third party AV. if the OS cannot detect an OS running, then it can stop any network traffic, thus stopping any nasties from propegating.

Good ideas in theory.. The only problem with relying only on the user's machine to protect itself is that if the machine should become infected (and it's possible for a machine with a fully patched av to become infected), then the protection is effectively removed as the first thing any virus is likely to do is remove it.

That can happen even if the AV is part of the OS.

idi banashapan · 06-10-2010, 23:13

does that not render all AV completely pointless then?

not all malicious software can manage that successfully. some protection is better than none, right?

Anonymouse · 07-10-2010, 12:17

Quote:

Originally Posted by heero_yuy

The problem is people who have no idea what their computer is doing or what is running and only investigate when the whole thing grinds to a halt with virii.

True. One way they - Microsoft and any PC vendors - could reduce the spread of viruses, trojans and any other malware which must install itself to run is to tell people to stop using Administrator accounts to browse the Internet.

That's by far the most effective means - if the user only has a user account, the malware can't install, Windows itself won't let it. The same is true in Linux - don't use your superuser account for Internet access unless you're actually installing something yourself. In fact, don't use the Admin/superuser account at all unless you're installing, or otherwise making significant changes. And it's so easy to create a user account after you've set up the PC; you don't need any tech knowhow. It'd be easy for the vendors to explain it, too: the difference between a user and an administrator is like the difference between having a ticket to a rock concert and having a backstage pass.

And it would stop most crapware in its tracks. Even with AV/firewall software, if you're using an Admin account for Internet access, you are not safe. Been there, done that, took me 10 days to kill the fecker (well, actually, it took 10 days of struggling followed by about 10 minutes for F-Secure BlackLight Beta to destroy the rootkit I'd somehow picked up). A stupid mistake, but at least I learned from it.

Pass this on to everyone you know who's thinking of getting a PC: set up the admin account (because you have to have at least one, of course), then once you're up and running, set up a user account and use that one only. It's not a substitute for AV/firewall software, but it will help enormously.

gazzae · 07-10-2010, 12:19

Of course that requires software developers to put more effort into creating software that doesn't require admin rights in order to run

idi banashapan · 07-10-2010, 14:16

Microsoft have introduced UAC which combats the whole admin account issue.

Stuart · 07-10-2010, 14:35

Quote:

Originally Posted by idi banashapan

Microsoft have introduced UAC which combats the whole admin account issue.

It's an attempt, and with some work, can be bypassed.

ZrByte · 07-10-2010, 14:53

Quote:

Originally Posted by idi banashapan

Microsoft have introduced UAC which combats the whole admin account issue.

Have to have that disabled to run a lot of software, especially older installers. The fact that you have to reboot to stop it means that re-enabling and disabling it on the fly is not an option for me.

idi banashapan · 07-10-2010, 14:57

Quote:

Originally Posted by Stuart

It's an attempt, and with some work, can be bypassed.

Well, if people actively try to avoid protecting their machines from virus attacks and malware, then perhaps they shouldn't be on the net at all. Banning them will be for the best.