RE: Gadi Busted In Massive Conspiracy

["Randy Abrams" <abrams () eset com>]

> -----Original Message-----
> From: Valdis.Kletnieks () vt edu [mailto:Valdis.Kletnieks () vt edu] 
> Sent: Thursday, February 02, 2006 9:56 PM
> To: Randy Abrams
> Cc: nick () virus-l demon co uk; funsec () linuxbox org
> Subject: Re: [funsec] Gadi Busted In Massive Conspiracy 
>
> On Thu, 02 Feb 2006 21:28:01 PST, Randy Abrams said:
> > That said, later this month (and beyond) the MS Malicious software 
> > removal tool will start tracking infection rates. This is 
> likely to be 
> > a fairly good indicator.
>
> Convince me that the infection rates among the general 
> population, and among the users clued enough to use the tool, 
> are comparable.

They don't even know they are running the tool. This is a silent download
(after the first time) that runs in the background. It is delivered with
Windows Update automatically and there is no UI until it finds something.
All it takes is a default XPSP2.

 
> What percent of the PC's being used to read this posting have been backed
up in the last 30 days?  
Far less than have been running the Malicious Software Removal tool I'm
sure.

> What percent of the general population does that?
Far less than have been running the Malicious Software Removal tool I'm
sure.

> You can't use numbers from a biased sample of clued people to predict or
estimate the numbers for the larger pool of 
> clueless people....

And what does that have to do with a tool that requires no abilities to use
and generally runs without the user even knowing it is running?
 
Come Patch Tuesday the MS MSRT is updated, all the little computers out
there with autoupdate enabled (tons of them) obediently and automatically
update, download and run the MSRT and it reports back to a server what it
found.

Real interesting stats there. Jason Garms gave a presentation at AVAR about
the results of something like 1.6 BILLION iterations of the tool.

Cheers,

Randy

_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.