Microsoft: Third party software's to blame for Vista hacks

This week Microsoft is revealing a troubling flaw in its vaunted efforts to lock down the operating system: It seems you can secure the operating system pretty well, but once users install third-party applications on their computers things go downhill fast. Hackers are starting to figure out that it's much easier to attack these applications, which often have far fewer security measures in place but are almost as widespread in installation as Windows itself.

Things aren't all doom and gloom. Overall, Microsoft says that total security vulnerabilities for the first half of 2008 are down slightly from where they were in the second half of 2007, though that's still above where things were through the end of 2005. 47 percent of browser-based attacks were reported by Chinese users, with 23 percent reported by the U.S.

But the big news is how third-party software exploits has consumed this market: Windows XP users find that third-party exploits account for 58 percent of all browser-based attacks. And for Windows Vista, over 94 percent of browser-based attacks target third-party software.

Note that "browser-based attacks" doesn't mean that malware attacks the web browser itself, just that they enter the computing environment while the user is using a browser on the web -- usually visiting a malicious or hacked website. QuickTime, WinZip, and RealPlayer are commonly targeted apps, for example. Microsoft's own apps comprise five of the top 10 most-targeted apps for XP users, but all of the top 10 apps on Vista are from other vendors.

So there you have it: Windows may be more secure than ever, but the programs that run on it appear to be totally busted, security-wise. What can you do about it? Same thing you've always done: Patch Windows with Microsoft's automated Windows Update system, make sure you have an up-to-date anti-malware program up and running at all times, and use common sense when browsing the web and opening email from strangers.

Get additional relevant details from Microsoft's "Key Findings" by clicking here -- or you can read the entire 150-page monster at this link. Both are PDFs.

(via ZDNet)