[jasonlambert]

Full Article: http://www.theregister.co.uk/content/56/33226.html

Opinion To mess up a Linux box, you need to work at it; to mess up your Windows box, you just need to work on it, writes SecurityFocus columnist Scott Granneman.

We've all heard it many times when a new Microsoft virus comes out. In fact, I've heard it a couple of times this week already. Someone on a mailing list or discussion forum complains about the latest in a long line of Microsoft email viruses or worms and recommends others consider Mac OS X or Linux as a somewhat safer computing platform. In response, another person named, oh, let's call him "Bill," says, basically, "How ridiculous! The only reason Microsoft software is the target of so many viruses is because it is so widely used! Why, if Linux or Mac OS X was as popular as Windows, there would be just as many viruses written for those platforms!"

A pretty interesting article i thought, but the author seems to be a little confused about what "Social Engineering" is.


Jason

[fingal]

Interesting article! He does seem a bit mixed up about the whole 'social engineering' thing. I believe Kevin Mitnick and his girlfriend coined the phrase? This seemed to involve conning people out of passwords over the phone, or just manipulating people in general in order to gain access to secure systems.

[jasonlambert]

Social Engineering is basically about manipulating people. I can promise you it has F**k All to do with Outlook Express automatically executing files

The authors statement: "Poorly designed software makes it easier for social engineering to take place" is totally incorrect.

[sarumont]

From Mitnick's book:

Social engineering uses influence and persuasion to deceive people by convincing them that the social engineer is someone he is not, or by manipulation. As a result, the social engineer is able to take advantage of people to obtain information with or without the use of technology.

[flw]

Mitnick's book

When every I read his name I cringe He's nothing more that a entry level social engineer with intermediate VMS and cell preak skill sets that got lots of publicity and some jail time. This is assumed as proof of his skill level accross the board.

Infact, he was indeed a scape goat with a basic skill set in social engineering and has been looking to take advantage of his name recognition by his P.O.S. book (Over priced unless used at 1/3 to 1/4 the full cost) , radio talk show (canceled BTW) and his (company ) offering misc. security services.

[e_dreamer]

Originally Posted by Jaguar

Social Engineering is basically about manipulating people. I can promise you it has F**k All to do with Outlook Express automatically executing files

The authors statement: "Poorly designed software makes it easier for social engineering to take place" is totally incorrect.

sorry, but i can't really agree mate.
if it didn't execute the files automaticly, then people whould have to be maniuplated into doing it for themselves... which would require more social engineering so to speak.
it's easier for me to persuade you to walk into a room, than it is for me persuade you to walk into a room and open a sucpicious looking box. if you get my meaning.

[jasonlambert]

IIRC you had to click on the email subject to get the option to delete it. I understand where you are coming from though.

[flw]

if it didn't execute the files automaticly, then people whould have to be maniuplated into doing it for themselves...

All types of methods of infection require user action, it just depends on how much and the exceptance of inaction is action none the less.

Traditionally click on a file from floppy or hard drive, file attachment from email or have the option on (on by defualt but the user chooses by decision or ignorce to leave it on rather that view as text only) for previewing messsages which then initiates the infection. All require the user to do something.

My point is that all virus's requre user action or lack of, but still chosen by the user still. So it does require some action, at some point in the process, OS or app setup etc....

Just like you chose to or not to, get a current AV and keep it up to date etc...

My 2 cents,