And, it's not just Microsoft

In a survey by the non-profit SANS Institute, it says that the number of
flaws that can be exploited in non-Windows environments point to a paucity of
patches and other security upgrades which Microsoft is known for. As more
Windows users agreed to receive security upgrades automatically, hackers sought
to take advantage of other software programs that might not be patched as
frequently, says SANS in its Top20 Internet Security Vulnerabilities survey.

SANS Chief Executive Alan Paller says in an interview to Reuters that
"operating systems have gotten better at finding and fixing things and
auto-updating, so it's less fertile territory for the hackers." But
hackers have come up with ingenious ways to take control of a user's computer
by tunnelling through Microsoft's web browser Explorer, Media Player, and
instant-messaging software, as well as Windows software for servers and personal
computers. Explorer's ability to spring holes and let spyware infiltrate the
Windows OS registry within seconds of being opened for the first time is well
known.

Just that the balance is slowly shifting away from just Microsoft products,
even as the company's new anti-spyware beta version is rising to the task of
scanning and logging various forms of spyware. Software from Oracle Corp and
Computer Associates International have also made the SANS list, as did media
players like Apple's iTunes, RealNetworks Inc's RealPlayer, and Nullsoft's
Winamp. Mozilla Foundation's latest Firefox release 1.0.3 tries to plug
numerous security loopholes, even as new patches and upgrades are being released
on a daily basis for Firefox users. When it comes to the pinch, even anti-virus
products from Symantec Corp, F-Secure, TrendMicro and McAfee Inc have proved
vulnerable, reveals the SANS survey. Online, tough times lie ahead.

Ravi Menon