Microsoft Should Take Out Its Real Competitors
|
Microsoft does its best work when competition is greatest. Maybe, it's time Microsoft should treat hacker criminals as competitors. |
Microsoft's competitive tactics against Netscape were so great, the company went from zero to comparable browser product in about 18 months and in the process generated the ire of U.S. trustbusters. Microsoft has no trouble taking out competitors by any and every means. Hacker criminals pose an even greater threat to Microsoft and its vast network of hardware and security partners. So, why doesn't Microsoft do to hacker criminals what it did to many vanquished software rivals?
Hackers sell zero-day vulnerabilities, including some for Windows Vista, in auction-like marketplaces. In the last couple weeks, not one, not two but three zero-day Word exploits have emerged. Last month, Microsoft dealt with two, separate Windows zero-day vulnerabilities in one week. Microsoft zero-day flaws now dominate the SANS vulnerability rankings. Spam is rising and so are phishing exploits with them.
If criminals attack Microsoft software, the responsibility falls on the company to solve the problem. The software doesn't belong to the people using it. The EULA (end-user license agreement) says so. People receive a perpetual usage license, but Microsoft still owns the software. Why then is Microsoft so cavalier about marauders and vandals coming into its house, plastering graffiti on the walls and stealing from its renters? Surely, Microsoft could be a better landlord.
Microsoft needs to treat criminal hackers for the threat they are, for increasingly they are the Internet equivalent of street gangs. Sure, Microsoft can sue them, buy more security software companies or make its products harder to break into. But those responses are tepid compared to tactics Microsoft used against rivals like IBM, Lotus, Netscape or Novell, among many, many others. As long as the street gangs freely roam, no one is safe.
Microsoft's renter customers look to the company for protection. The more trouble customers have, the less confidence they will have in Microsoft and its products. Lack of confidence can affect upgrade sales.
In America, anyway, people love heroes. Superman is iconic because he is a self-sacrificing hero--the last of his kind fighting for the freedom and livelihood of strangers, of aliens. Microsoft can woo customers by heroic effort, by standing up for them against thieving gangs. Software engineering and lawsuits aren't enough. It's time Microsoft turned some of its bad business tactics of the past to the goodwill of its customers' future.
The recent number of zero-day exploits is terrible sign of big trouble ahead. For several years, security experts have warned against application-layer security threats--the kind assailing Microsoft software today. As businesses fortified the network perimeter with firewalls and other security mechanisms, criminals sought out other areas of weakness. HTTP traffic has proven to be one major area of weakness, whether the browser or applications are connecting to the Internet.
Microsoft isn't exactly unaware of this problem. Its approach to managed code or hardening features in new products like Communications Server 2007, Exchange Server 2007 or Windows Vista are designed to mitigate some of the applications-layer risk. Building stone walls and moats only go so far as long as attackers can approach by the top of the walls or by way of an open roof. As long as Internet gangs run unchecked, Microsoft and its customers are at risk. Fortification is a limited defense tactic. It's long past time for Microsoft to launch a real offensive.
If Microsoft can disable Windows Vista PCs for failing to activate or for having failed to validate, why can't it take out computers infected with malware? There is plenty of evidence that much hacker or spammer activity starts with networks of thousands and thousands of comprised end-user computers. If Microsoft can remotely scan Windows for piracy, surely there are ways of scanning for malware
There, Microsoft could work with its partners. For example, ISPs could begin closer monitoring of IP addresses for heavy outgoing network traffic flows that could indicate spamming or other nefarious activity. If a computer is infected with malware, it either needs to be cleaned up or cut off from Internet access.
The task is more daunting than I suggest, in part because of logistics. If Microsoft treats hackers as competitors, it could dedicate the necessary resources to overcome obstacles. The point is to get infected computers offline, to cut off the enemies' supply lines. If botnets are a major--likely the major attack mechanism--they need to be take down one computer at a time.
Aggressive tactics may not get all the Internet gangs off the streets, but cleaning up a few neighborhoods would be a good start.
Comments (17)
> "Microsoft's competitive tactics against Netscape were so great"
I hope you were being sarcastic. That little incident was one of the best case studies for monopoly abuse.
Posted by Roy Schestowitz | December 19, 2006 12:56 AM
So my grandmother has a compromised computer she uses to order her medicine.
She also inadvertantly became part of a botnet.
Along comes the benevolent Microsoft, carefully weeding out the good guys from the bad guys, and.... voila, no more grandma computer.
I REALLY trust a monopolisitic behemoth to do the right thing.
Posted by KC | December 19, 2006 8:29 AM
Hmm how will they leverage their illeagle monopoly against hackers? Without the power of their stangle hold on the desktop they are next to nothing.
Posted by Dag Richards | December 19, 2006 10:40 AM
You said "Why then is Microsoft so cavalier about marauders and vandals coming into its house, plastering graffiti on the walls and stealing from its renters? Surely, Microsoft could be a better landlord."
That's easy. They do not have to, nor are they compelled to do so. Just look at their sales volume every year. Until MS feels the financial pain, they will do nothing.
Posted by Joe | December 19, 2006 1:16 PM
Microsoft should do a lot more to protect the customers using its products. If it resorts to cutting people off from the internet when their pc is infected then it could be causing more problems. Unless Microsoft can clean up those computers for the customer within say 24 hours - then they are only cutting off their customers even more. You are talking about policing the internet and opening the door for even more serious control over what should be public domain.
Posted by Andrea | December 19, 2006 1:18 PM
It is my opinion that for years Microsoft has been letting virus attacks happen and has been patching Windows one virus at a time waiting for this Vista release. My opinion is Virus's and Spam have actually created new businesses and opportunities. If there were some magic bullet to get rid of them, that bullet would anger many business leaders.
Posted by Damon | December 19, 2006 1:28 PM
The only kind language that Mickeysoft understands is dollars and cents. Anything else is irrelevant to them. Unfortunately, Mickeysoft won't be doing anything soon, as there is no real threat of any mass defection to anything else. If there were a significant movement to Apple or Linux, there's a chance that Mickeysoft will awaken and start to take notice. Until then, get used to living in gangland. For Mickeysoft, it's going to be business as usual...
Posted by Colin N | December 19, 2006 2:00 PM
The day I read they add this feature is the day I pull the plug on every MS product I own, and I'd recommend every individual and company do the same.
I like the little old lady story above, and you know they'd be the first hit by Microsoft too. Then you have companies. Maybe say mid-december timeframe, internet orders pouring in - maybe 60% of your annual business comes in a 4 to 6 week period of Christmas...then wham-o MS pulls your plugs, and leaves you sitting in the dark. Most companies would shutter their windows if they lost a fraction of this. I'd suggest that MS would be liable for damages to the company, and to it's employees.
How about MS do something truly unique. Fix the bugs in a reasonable time, and then undercut those selling the bugs/hacks by freely posting them. The "business" of selling hacks would evaporate over night.
...And what about the day when someone finds the hack into the MS remote shutdown code and proceeds to turn off every Windows PC in the world... well maybe that'd be a good thing after all.
Posted by Warren | December 19, 2006 2:01 PM
What next? I suppose you would want Microsoft to install a key logger on every MS OS computer so they can see what each user does? I am quite sure sane people know how to drive before buying a auto so where is the education for computers. All MS is interested in is the bottom dollar and not the safe guarding of the internet. Vista has just been released and they are already hacking it and even selling the hack on the internet. With all the eye candy on a MS desktop no wonder it can be hacked. Their Genuine Advantage is a joke and all it does is create a privacy issue for the user. MS should change their Motto to "Harass the buyer/User" or "We do not care anymore because you the sucker bought the OS". With all the research and developers at MS one would think they could come up with a way to validate Windows without a continuing validation after the initial one. To me it is punish the mass to catch the few or everyone is guilty until proven innocent.
Education is the front runner and until they devise a way to educate the user malware and such will still take over their computers. Not forcing ISP's to monitor users computers.
How about manufactorers making computers that have full security installed and cannot be disabled until the user installs the one of their choice. Not a chance because it is another ACLU or some other idiotic organization stating it violates someones rights.
So until all of the MS OS users wise up MS will continue on their path because money counts and you dont.
Posted by SpiderintheGlass | December 19, 2006 9:52 PM
Do like I did, get a MAC
Posted by Jim Z | December 20, 2006 9:55 AM
I have never seen such a retarded idea in a long time. Where do you draw the line? Have Microsoft report you to the RIAA for copying a DVD? Face disconnection when you install a non-approved competitors app because it isn't validated by a Microsoft-mandated testing agency?
Last time I checked, Microsoft wasn't above the law and certainly has no business becoming involved in ISP decisions to block users. I hope eWeek didn't pay you to write this article - they'll want their money back.
Posted by Mumba | December 20, 2006 11:07 AM
As an industry professional I am not an advocate of 1 OS or software solution over another. I prefer to use whatever gets the job done most efficiently. That is indeed the point of software and computing for my purposes.
However, I must say, Microsoft bashing by semi-savvy tech consumers and the uplifting of Mac and Linux as more secure alternatives is wearing a little thin. Do your research and ask yourself if you would be safer if Linux or Mac had an 85% market share. Hackers and crackers go after the largest market just as any good business person might. The problems Microsoft is dealing with are unique to their position in the market whether or not you agree with the level of effort they have put into the solutions.
On another note, I feel a little saddened by the lack of personal responsibility that is prevalent in our society today. I think that MS has only the obligation to provide the best product that they can provide within their business model. If you don't like their product, or the fact that you need to be responsible for the security of your computer when using their product, then make your objection with your purchasing power and stop acting as if those persons being infected are somehow blameless for not taking basic precautions. Again, do your research if you don't understand the percentages here. Most consumers become infected because they are not responsible computer users, Mac, Linux or Window!
Posted by Bill S | December 20, 2006 4:31 PM
Actually, I think if Mac or Linux (or better yet BSD) had 85% market share, there would be less botnets and the like. *NIX runs a lot of servers which are high value targets to hackers (either for the prestige of defacing a website or for the great bandwidth and other resources they have), but is not compromised as often. Part of the problem is no auditability, but worse is the horrifically complicated security token thing vs. the simplicity of root or not on almost everything else (Mac included). Worse than these is Microsoft's willful decision to spend more manpower on DRM and things that customers don't want than fixing known vulnerabilities (well documented).
So don't blame it all on market share. Sure, even OpenBSD had the OpenSSH problem, but other OSes don't let known zero-days fester while plugging DRM holes that don't waste everyone's time and money.
Posted by Dan | December 20, 2006 7:12 PM
Good point Dan but the distinction between cracking for profit and hacking for fun or prestige is an important one. Trying to own 1 resource because it has lots of bandwidth is a bad investment for a hacker. Also, servers or other higher end network devices are usually administrated by more knowledgeable users who at least take basic precautions to secure their machines and when's the last time Grnadma installed Linux. I think the prerequisite for installing Linux is a CS degree ;)
The proven model for the best return on time and effort is to go after the masses of ignorant home users. This is where the market share issue becomes the primary factor.
Posted by Bill S | December 22, 2006 6:26 PM
Joe- I do not want M$ or any other company controlling my internet access at their whim...
It's bad enough M$ wants me to upgrade windows media player every time I use it - or IE to subscribe to RSS feeds. Why? Because they have not "fixed" the problems in old versions of their software; they release new versions with the same problems with a new covering... distracting users if only for a moment.
If I have some piece of software on machine that I use that is deemed "malware" (Firefox, WinAmp), will I receive notice? The security experts at microsoft have enough to worry about without worrying about my machine being attached to the network.
Posted by Frank | January 22, 2007 9:21 PM
DON'T BE STUPID
You have just enough technical knowledge and no business or common sense, which makes you dangerous. As much as I don't like some of what Micro$oft has gotten away with in the past I say this is not FULLY their problem, they are providing an imperfect product in an imperfect world. To the point:
1) We still have street gangs on the streets and will always have them there and on the internet no matter what is done someone somewhere will try to take advantage of someone else, it's human nature.
2) As already pointed out Micro$oft controlling the access vs. the individual people and companies would make for a big mess that would just give M$ more control in a world where they already weld too much power.
3) M$ has left the bulk of security for the end user to 3rd party software companies and will probably always have at least some competition there (Netscape and other browsers are still around), their biggest focus of security has been on the OS, but anymore the bulk of breaches occur in internet browsers and internet enabled applications, yes they have released a new version of IE and Office patches etc. that helps address some of that; but much like the U.S. borders there is a balance between security and the need for flow of traffic.
Ultimately your asking the impossible of M$ or anyone else, and that is.. "Fix the world please I don't like it here", so quit your whining and buck up and do what everyone else does and buy your 3rd party security software or just like STD prevention you can always abstain.
TekMan
Posted by TekMan | March 7, 2007 11:50 AM
There are stealth industry paid comments here. Be sure to note them and beware.
Posted by Evets Kralc | May 9, 2007 6:58 PM