Friday, August 05, 2005

Prototype viruses to Microsoft's newest OS found

Microsoft released the beta version of their new operating system, Microsoft Vista, about a week ago. The ZDNet is reporting that 5 proof-of-concept viruses have been published that attack Vista's command-line tool called Monad.

::::::::Five proof-of-concept viruses that target Monad, the next version of Microsoft's command prompt, were included in a recently published virus writing magazine, according to Mikko Hyppönen, the director of antivirus research at F-Secure.

Monad is a command line interface and scripting language that is similar to Unix shells such as BASH, but is based on object-oriented programming and the .Net framework. It was initially expected in Vista, but Microsoft hinted a couple of months ago that it may not be ready for initial versions of the Vista client or server. However, Microsoft has confirmed that Monad will be included in Exchange 12, the next version of the company's collaboration server due in the second half of 2006.

The proof-of-concept viruses, along with detailed explanations of how they work, were included in a magazine that was published on the Web over the last week. The viruses' only action is to infect other shell scripts on the host's operating system. They would cause little harm in the wild, but would be relatively easy to modify using the information from the article, said Hyppönen in a blog posting on Thursday.

He warned that if Microsoft ships Monad with Vista and it is enabled by default this could lead to an "outbreak of scripting viruses". Microsoft may choose to ship the tool as an add-on or disable it by default to reduce the risk, he added.

Well, that didn't take long. I find it hard to fathom how a company can be saying that security is their first concern in putting out new software and leave holes in a new product big enough and obvious enough to be exploited in a week. I know this is a beta version, but let's get serious. A company with the purchasing power of Microsoft can surely afford to hire people who have the skills (excuse me, "skilz") necessary to write viruses like these. Those people - assuming MS has, in fact, hired some - should be allowed first crack at the beta software before MS puts it out to the public so they can find the exploits and have the fixed. Who among us will now view MS Vista as a trustworthy system? Good thing they've got a year to fix things, I guess.