Vista Security Claims Debunked – Figures Skewed

Use Netsparker


Ah more news about the insecurity of Vista and something we are all pretty aware of…the skewing of figures by Microsoft.

Microsoft apparently still hasn’t learned that counting vulnerabilities doesn’t establish some kind of ‘security level’.

You can read the report here:

Vista 6 Month Vuln Report [PDF]

The Microsoft “researcher” claims that Windows Vista is exponentially less vulnerable than many Linux distributions and Mac OS X. It may be true that the default Vista installation has had less public vulnerability reports, and that Linux has had many more, but this is due to the nature of Open Source. Jeff does not include any “silently fixed” vulnerabilities that have been patched since Vista was released and Microsoft has not disclosed such vulnerabilities publicly.

The methodology used was deeply flawed, as I briefly mentioned before, bugs in Firefox and other software like emacs count as a flaw for Linux whilst IE bugs get ignored for Vista.

The conclusions that are drawn are built on a lack of understanding by the Microsoft researcher. I highly encourage him to go back and take another look, and pare down the results to essential information that is absolutely critical to the conclusions, rather than just “Other OS’s have more bugs, see, look at my graphs”…

Good PR, but bad research? Seems par for the course.

And perhaps it could backfire PR wise, as the clued in people get pushed further away from Vista.

Source: Full Disclosure

Posted in: Exploits/Vulnerabilities, Windows Hacking

, , , , , , ,


Latest Posts:


Malcom - Malware Communication Analyzer Malcom – Malware Communication Analyzer
Malcom is a Malware Communication Analyzer designed to analyze a system's network communication using graphical representations of network traffic.
WepAttack - WLAN 802.11 WEP Key Hacking Tool WepAttack – WLAN 802.11 WEP Key Hacking Tool
WepAttack is a WLAN open source Linux WEP key hacking tool for breaking 802.11 WEP keys using a wordlist based dictionary attack.
Eraser - Windows Secure Erase Hard Drive Wiper Eraser – Windows Secure Erase Hard Drive Wiper
Eraser is a hard drive wiper for Windows which allows you to run a secure erase and completely remove sensitive data from your hard drive by overwriting it several times with carefully selected patterns.
Insecure software versions are a problem Web Security Stats Show XSS & Outdated Software Are Major Problems
Netsparker just published some anonymized Web Security Stats about the security vulnerabilities their online solution identified on their users’ web applications and web services during the last 3 years.
CTFR - Abuse Certificate Transparency Logs For HTTPS Subdomains CTFR – Abuse Certificate Transparency Logs For HTTPS Subdomains
CTFR is a Python-based tool to Abuse Certificate Transparency Logs to get subdomains from a HTTPS website in a few seconds.
testssl.sh - Test SSL Security Including Ciphers, Protocols & Detect Flaws testssl.sh – Test SSL Security Including Ciphers, Protocols & Detect Flaws
testssl.sh is a free command line tool to test SSL security, it checks a server's service on any port for the support of TLS/SSL ciphers, protocols as well as recent cryptographic flaws and more.


6 Responses to Vista Security Claims Debunked – Figures Skewed

  1. Nobody_Holme August 21, 2007 at 12:09 pm #
  2. TheRealDonQuixote August 21, 2007 at 9:16 pm #

    Man I hate Microsoft. If thier OS’s weren’t so easy to hack, and the mere fact that so many people use them, I’d never bother with it at all.

  3. Mitchel Ashley August 22, 2007 at 12:14 am #

    It has been our experience and the experience of our SAT team here are Stillsecure that Vista is the most secure OS ever made.

    Combine that with some security tools like SafeAccess and you have a nearly inpenatrable computing fortress.

  4. Michael Ajitsingh August 26, 2007 at 5:28 am #

    Those who use MS Windows are the same people who’d walk down Baghdad with a sign on their back saying “Hi, I’m an American.”

  5. Daniel August 30, 2007 at 3:29 am #

    hmmm oh well. security is still totally Dependant on the user.

  6. Sandeep Nain August 31, 2007 at 2:09 am #

    Well how about telling micro$oft that we agree with whatever microsoft says… I hope this will stop them from bugging us with their fake reports..