COMPUTER security experts have poured scorn on Bill Gates鈥檚 claim that
breaking up Microsoft will make it harder to fight future viruses such as last
week鈥檚 Love Bug. What鈥檚 needed, say the experts, is a more diverse range of
software on people鈥檚 computers, not a uniform, monopolistic one.
Writing in this week鈥檚 Time magazine, Gates argues that products
will be less safe if applications such as the Microsoft Outlook e-mail program
had to be developed separately from its operating system. 鈥淧rovisions like these
would kill innovation in the Operating System,鈥� Gates wrote. 鈥淯pdates to Windows
and Office technologies that could, for example, protect against attacks such as
the Love Bug virus would also be much harder for computer users to obtain.鈥�
Such statements surprise security experts, who reckon the close connection
between application software and the operating system compromises security. 鈥淎
big part of the problem is the tight integration between Outlook and the
operating system,鈥� says Ryan Russell of the computer security company Security
Forum in San Mateo, California. 鈥淚 would think that some separation between the
product lines would actually be more secure.鈥�
Advertisement
Microsoft applications sometimes exploit undocumented capabilities of the
operating system. This creates hidden vulnerabilities that viruses can take
advantage of.
The Love Bug swept through networks faster than any computer virus to date,
stealing passwords, deleting MP3 music and JPEG picture files, and clogging up
e-mail gateways. It cost people millions of dollars in downtime and maintenance
charges. Most experts agree that the outbreak was made worse because Microsoft
Outlook is set by default to permit automatic sending of e-mails. This made it
easy for the Microsoft Visual Basic virus to reproduce by e-mailing itself to
everyone in the host computer鈥檚 address book.
Another reason the Love Bug spread so quickly is the lack of software
diversity amongst Internet users, says Simon Shepherd of the Virus Certification
Centre at Bradford University. The major networks affected were those containing
Microsoft Outlook. 鈥淛ust like in nature,鈥� says Shepherd, 鈥渢he greatest risk of
being wiped out by a virus is a limited gene pool.鈥� Diversity makes software
more resilient.
Graham Cluley, a security manager with the British antivirus company Sophos,
points to another factor. He says many new Internet users don鈥檛 appreciate that
security measures are worth having even if they slow things down. But the threat
from viruses is mounting as ever more devious programs are written: some newer
bugs arriving by e-mail don鈥檛 even have to be opened to infect a computer.
Caspar Bowden of the Foundation for Information Policy Research, in London,
points the finger at software companies. He says they are too keen to fit their
packages with flashy extra features such as auto-remailing rather than
unglamorous safety features. It鈥檚 time software companies started to treat
security itself as a selling point, he says.