Pavel Kankovsky wrote:
I have no idea how you would put a number on that, because the way the AV software reports an "infection" is biased to inflate the numbers. If, for example, I go to a webiste, and while I'm there an exploit attempts to run but the AV software prevents it from running, it will report an "infection". Yet the box was never infected. The AV prevented the exploit from completing successfully.On Tue, 25 Apr 2006, Paul Schmehl wrote:We haven't had a Windows box hacked in a long time.Does it include Windoze boxes possesed by malware? Such a box is not hacked in a strict sense but the difference is almost irrelevant (esp. when backdoors have become a standard feature of malware).
If I get a virus through email (extremely unlikely here), and I click on the attachment deliberately trying to get it to run, and the AV software stops it, but reports an infection, is that an infection? Or simply a detection and prevention?
Does adware count? If so, which ones? Which viruses would count as "hacks"? And what actually counts as a hack? A detection/prevention? Or only actual infections?
If you point is to say that Windows is far more susceptible to attack, then that's a given.
-- Paul Schmehl (pauls@xxxxxxxxxxxx) Adjunct Information Security Officer The University of Texas at Dallas http://www.utdallas.edu/ir/security/
Attachment:
smime.p7s
Description: S/MIME Cryptographic Signature
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/