The internet is the same way, if you are stupid enough to browse porn, piracy, or any other questionable site on an embedded browser you deserve what you get just for acting a fool.
Interestingly,
in a recent study by Avast, they found that "regular sites" beat porn sites (and other illegitimate sites) in hosting malware. I've
personally seen very aggressive malware being served by websites like: MSNBC, AppleInsider, LifeHacker, and AnandTech. I've read reports about similar occurrences at places like the New York Times, CNN, and the BBC, among many others. Some of the WORST offenders are Web Forums (running on systems like Interact), personal blogs run by inexperienced website operators, and hardware OEM websites for old and discontinued products. Most of these get infected simply through neglect, and the virus and malware makers creep in through holes in old versions of the software running on the sites.
Interestingly, in that study and many others, they found that "porn sites" in particular (especially mainstream ones that are actually selling access to the site rather than just scraping other available content), were actually substantially
safer than many other "classes" of sites. Which makes sense if you think about it... If your business is to sell access to your website for a monthly fee and keep the users coming back and paying that monthly $19.99 bill, it doesn't serve you very well to infect their machines with all sorts of nefarious malware which will only serve to make the user experience of accessing your site a poor one.
For the big-name sites, these infections almost always come from the ads. The problem is that many of the ad networks don't monitor or filter their content very well, and the distribution systems they use are almost always easily compromised. So, if you are a malware maker looking to infect as many machines as is possible in one fell swoop (in order to build your zombie machine botnet of destruction), it is a nice juicy target to attack these ad networks. You get instant wide distribution, and even better your content is distributed on "legitimate sites" that many people trust, meaning that if the users get an ActiveX permission dialog (or whatever), many people will mindlessly approve it thinking that the BBC or MSNBC couldn't possibly be attacking their machine (not reading the dialog itself to look at the publisher's signature).
Crafty email phishing scams are also a common source of problems, of course. Many users just aren't very sophisticated. I guess all I'm pointing out is this... I think there can sometimes be in the hardcore tech community a strong "blame the dumb user" undercurrent to security discussions. In other words, you didn't update your browser/Flash/Java/Windows/etc and you got infected, so it is "your" fault. The car analogy is a perfect example, you don't blame Toyota if you don't know how to drive and you crash the car (well, actually that does happen, I guess).
However, the analogy breaks down completely when you look at the utter complexity of trying to update a modern Windows PC for the "average" user. These people don't even fully understand what a "browser" is, and how it is different from "Flash" or "Java" or the operating system. My mom doesn't fully grok the difference between "Windows" and "Office" (she calls them both "Microsoft"). How can we, as an industry, expect that user to be able to fully maintain a working and secure system when it is designed for a tinkerer and expert? It is absurd! Windows has dramatically improved with the modern versions of Windows Update which actually seem to work right most of the time, but even this system breaks down: Just the other day, I discovered that one of my Win7 machines hadn't gotten any updates in MONTHS because there was some "Critical patch" to the Windows Update system itself that didn't auto-update itself like it is supposed to (for whatever reason) and which needed to be installed or all future updates were being held back. The only reason I found it was that I happened to go into the Windows Update tool and checked for updates manually because I was looking for updated drivers for a crappy Microsoft Webcam (and I was too lazy to Google search and figured I'd just use Windows Update).
On my mom's machine, this would have sat unnoticed essentially forever. If she didn't know me, she'd be in deep trouble. And then we have to update Flash, and Java, and Acrobat, and our Anti-Virus, and our browsers, and so on and so forth. Your router might need firmware updates, and now even your phone runs complex software (Flash on phones still seems like a Really Bad Idea). Plus, they have to be able to monitor the system to make sure it is being backed up properly (with systems typically designed with a computer expert in mind). Many of these systems remind you, but often they do it at inappropriate times when you're just trying to "get work done" (the worst are ones that only notify you at login). And then they're often designed that if you click "OK" or "Not Now" the dialog goes away and never returns and you're expected to just remember which application needed the critical update. It is absurd. The DESIGN of modern computer system security is so decentralized and complex that it is effectively DESIGNED for it to fail for the average person.
Taking that same analogy, imagine if there were critical recalls on your Toyota almost every single week, that are suddenly absolutely essential to the safe operation of your vehicle. And then imagine that these recalls were announced to you in a wide variety of different ways: some via email, some via phone, some via mail, some by the car itself, and some not at all (you're just expected to "know" to check). And then, imagine that you can't just bring the car into the dealer to get a repair, but you have to deal with each individual component manufacturer individually, and usually install the fix yourself, with limited instructions which assume that you are a fully certified car technician. And then imagine that all the while your car seems to be actively trying to
trick you, flooding you with lying emails about fake updates and invalid security prompts and warnings that don't really apply to you. This is the environment that most people find themselves in at home with their PCs. It is an absurd situation, and it should surprise absolutely no one that it fails spectacularly with regularity.
So... Uneducated users are certainly a problem. But bigger problem is that we design
systems that
require the users to be security experts and technicians in order to use them safely, and then we effectively require "regular people" to
use these systems for their everyday life. You honestly can't get a good job at all if you don't have some basic level of computer skills and Internet access in the West. And that's just going to get "worse". And then we do an amazingly poor job of educating our children about these systems. Using a computer is probably the single most important life skill you can have before you enter the modern workforce in America. But our schools treat computer skills as an almost extracurricular afterthought (just like we do with finances, we teach them math and basic history, but NOTHING about money at all in our schools). Our schools are designed to teach the skills that the baby boomers needed to succeed in the world, not for the modern work world at all.
Author
Topic: Switch from IE to Chromium (Read 38518 times)