Will Windows 10 viruses work on phones

[pericle]

Hi, I am just curious since Microsoft announced that there will only be one operating system, Windows 10, across all devises, whether Windows viruses will now work on Windows phones when Windows 10 is released?

 

[a5cent]

With each update to Windows 8 the Store apps are becoming increasingly open to install. Would not surprise me if a mode exists for non store metro apps to exist in Windows 10 enabling developers to target both store and standalone using common tools.

This would allow users to install anything they found on the internet, thereby taking MS out of the loop and removing their ability to test apps for malicious content before making them accessible to users. I think this would be diametrically opposed to the goals MS has set themselves for the Modern environment. Considering free apps can be distributed via the Windows Store at essentially no cost, and corporations can setup their own app store, there is very little to gain by introducing non-store apps, but a lot to lose.

I'd be very surprised if MS did anything like that.

 

[realwarder]

This would allow users to install anything they found on the internet, thereby taking MS out of the loop and removing their ability to test apps for malicious content before making them accessible to users. I think this would be diametrically opposed to the goals MS has set themselves for the Modern environment. Considering free apps can be distributed via the Windows Store at essentially no cost, and corporations can setup their own app store, there is very little to gain by introducing non-store apps, but a lot to lose.

I'd be very surprised if MS did anything like that.

People who want to get their app out mass market would still use the store as it will always be the easy way for users to find, buy and or download apps.

Given that the validation check can still run as a centralized function, that side of concerns are mute.

Microsoft is all about opening up their tools and .net at the moment. Constraining developers to only use the store doesn't work in standalone or offline terminals etc. Sure its easy to say use older tools, but the current focus is definitely WinRT, and the store doesn't support every end use.

I really don't think standalone apps would under mine the store. Windows has been open forever and in some ways WinRT needs to be a little more open too.

 

[Elitis]

As everyone has already said: no, viruses won't be able to run on Windows 10 for Phones. This is because of the different file types (.exe vs .appx), different Instruction Sets (x86-64 vs ARM) , as well as due to the fact that there are several things simply not available on phones (like the entirety of the desktop and it's various components). There's also the fact that like on both Android and iOS apps are sandboxed and isolated. The fact that Android also sandboxes its applications is a point everyone missed. Though, iOS and WP severely limit what sandboxed apps can access while it's possible to work around limitations on Android pretty easily.

?Security Tips | Android Developers
Android has security features built into the operating system that significantly reduce the frequency and impact of application security issues.

• The Android Application Sandbox, which isolates your app data and code execution from other apps.
• User-granted permissions to restrict access to system features and user data.
• Application-defined permissions to control application data on a per-app basis.

The whole sandboxing/isolation thing has more to do with the underlying programming languages used more so than the OS anyway. Java (Android), and C# (WP) need a runtime (a virtual machine) to compile the bytecode and CIL respectively into native commands the CPU actually understand. The Runtimes are what actually provide the isolation and sandboxing. It has nothing to do with the OS. Anyway, WP also makes use of UEFI Secure Boot, further preventing viruses from causing any harm.

 

[a5cent]

The Runtimes are what actually provide the isolation and sandboxing. It has nothing to do with the OS. Anyway, WP also makes use of UEFI Secure Boot, further preventing viruses from causing any harm.

A typical Windows .NET application also executes within a runtime environment, just as a WP .NET app does, yet apps of the former type are neither sandboxed nor isolated from each other. Wouldn't that suggest that it's not the VM (called CLR for .NET applications) which provides the sandboxing?

AFAIK the CLR is one of those components that W10 and W10M will share, but they will not share security models. That too suggests that most security issues will be handled outside the CLR, because otherwise the CLR could not be the same.

I'd argue that the sandboxing/isolation is rather a direct result of the APIs which are made available to the applications running in each environment. When running on Windows, .NET applications have access to everything accessible via Win32. When running on WP, .NET applications have access only to what is accessible via WinRT, which represents a much more limited set of features. It's that limited functionality of WinRT, which enforces sandboxing, as it doesn't provide unrestricted access to the file system, or anything else for that matter. I'd say that both Win32 and WinRT are the public API surfaces of the underlying OS, and that neither are directly related to the CLR, which is why I'd conclude that is in fact the OS that provides WinRT's, and hence also WP's, security features.

 

[a5cent]

Microsoft is all about opening up their tools and .net at the moment. Constraining developers to only use the store doesn't work in standalone or offline terminals etc. Sure its easy to say use older tools, but the current focus is definitely WinRT, and the store doesn't support every end use.

I really don't think standalone apps would under mine the store. Windows has been open forever and in some ways WinRT needs to be a little more open too.

Such an approach would circumvent the store, and therefore also skip the security screenings that apps must currently undergo. In that sense it would undermine security. It may also undermine the store in terms of sales, but I don't think anybody cares about that except MS, and possibly also those interested in piracy.

I also disagree that MS is looking to open up or relax anything related to WinRT security. The fact that MS couldn't sufficiently secure Windows is one of the main reasons WinRT exists in the first place. Sacrificing such a major part of the security system calls WinRT's primary reason for existing into question. If MS now really wants to do that, then surely it would have been far better to just slap a touch friendly UI on top of Win32 and be done with it. That would have been much cheaper and faster, and then we'd already have the openness you desire.

Anyway, I'm quite sure this ain't happening, but we'll have to wait to see who's right.

 

[anon(5348756)]

Could you give me an example of what you're thinking of when you say "turn on or off". I can't think of anything which I think would fit that description. The desktop/Win32 environment on mobile devices isn't just turned off. It literally doesn't exist there.

Sure, easy enough. Think about it this way: not all Windows needs to be present for us to think about it as Windows. For example, the desktop alone isn't windows. The NT kernel alone isn't windows. The APIs alone aren't windows. The Desktop, NT kernel and APIs together, that's windows. But there's also another myriad of little and big elements that conform what we think of as Windows. For example, since Windows 8, the tiles and metro apps are part of windows now, as it's part of both the x86-64 and ARM versions and works everywhere. In the same way, sandboxing is part of windows too, which was much heavier in windows 8 too.

So, what has been referred to before as "turn on or off", which is actually not accurate, means that the mobile version for tablets and phones (which WILL actually be exactly the same code, from what we know) will include the NT kernel, the APIs, metro apps, sandboxing... but it won't include the code for the desktop as well as other desktop-related code. That doesn't make it not windows, it still have many of the elements that constitute what we would understand as Windows. So, more than turning features on or off, it would be more precise to talk about expunging or keeping code.

That's why you can think of W10 as one Windows, yet different versions, where the phone version (version = SKU) would be, as has been mentioned earlier, a subset of big Windows. The code present on the phone will be the same present in big windows, but the latter will have many other features - among them the "freer" wild-west that is the desktop world. Finally, to circle around to the initial question, since these viruses need the extra freedom in the x86-64 desktop world to affect anything, even if you ported a virus to ARM code you wouldn't be able to run it because a) Modern environment doesn't allow such freedoms, b) if such code where to run it would be sandboxed and thus limited to just that single app and c) the Windows store would never (well, practically never, nothing is perfect) validate one such virus program, so it would never be accessible to users.

Does this clarify things?

EDIT: I forgot to add one thing. All of what I mentioned doesn't yet apply until Windows 10. This is an ongoing process. With WP8, phone windows and desktop windows shared about %33 of the codebase and features. With WP8.1, we were up to %77 shared code. With Win10 we should theoretically have 100% code, but the scenarios where we use that code (and subsets of it as I've mentioned) are the "differential" parts between versions/SKUs. They're all still Windows... just different. Big windows and small windows will be like 2 twins: mostly identical, but one has more skills - but is insecure - and the other twin has less skills but is perfectly secure at what he does.

Also, as you mentioned in the last comment, no, Microsoft will indeed not loosen Modern requirements, as the whole point is to keep that stuff safe. What they will do is bring the Modern APIs and controls up to par with the x86 APIs which have enjoyed 30 years of development and refinement. That's why MS is sharing code, as it's the best way to bring more features to their new Modern platform code by replicating what is already there in the insecure platform, bringing it to the secure one. That'll get developers programming for the modern stuff - which they don't do now so much because the modern stuff is still too limiting. Once the modern environment is up to par with the legacy abilities, be sure it'll displace legacy for 99% of consumer software, as there's only gains to be had since the modern environment brings security and reliability improvements that are inherently impossible in the desktop platforms philosophy. When both have the same skills, pick the smarter platform, not the dumber one

 

[Elitis]

A typical Windows .NET application also executes within a runtime environment, just as a WP .NET app does, yet apps of the former type are neither sandboxed nor isolated from each other. Wouldn't that suggest that it's not the VM (called CLR for .NET applications) which provides the sandboxing?

AFAIK the CLR is one of those components that W10 and W10M will share, but they will not share security models. That too suggests that most security issues will be handled outside the CLR, because otherwise the CLR could not be the same.

I'd argue that the sandboxing/isolation is rather a direct result of the APIs which are made available to the applications running in each environment. When running on Windows, .NET applications have access to everything accessible via Win32. When running on WP, .NET applications have access only to what is accessible via WinRT, which represents a much more limited set of features. It's that limited functionality of WinRT, which enforces sandboxing, as it doesn't provide unrestricted access to the file system, or anything else for that matter. I'd say that both Win32 and WinRT are the public API surfaces of the underlying OS, and that neither are directly related to the CLR, which is why I'd conclude that is in fact the OS that provides WinRT's, and hence also WP's, security features.

Of course, there are different implementations of sandboxing. Some involve intercepting system calls, some involve modifications to the kernal itself. So, you could argue that the APIs are providing the sandboxing and, in some cases, be right. By definition, a sandbox is a confined execution environment, a container.
"Process virtual machines are designed to execute a single computer program by providing an abstracted and platform-independent program execution environment."

"A process virtual machine (also, language virtual machine) is designed to run a single program, which means that it supports a single process. Such virtual machines are usually closely suited to one or more programming languages and built with the purpose of providing program portability and flexibility (amongst other things). An essential characteristic of a virtual machine is that the software running inside is limited to the resources and abstractions provided by the virtual machine—it cannot break out of its virtual environment.

"sandbox limits, or reduces, the level of access its applications have — it is a container."

This link provides good detailed information on sandboxing

 

[a5cent]

"Process virtual machines are designed to execute a single computer program by providing an abstracted and platform-independent program execution environment."

"A process virtual machine (also, language virtual machine) is designed to run a single program, which means that it supports a single process. "

This link provides good detailed information on sandboxing

I think we're both pretty clear on what a sandbox is. I like the link you provided, but note that the section on "process virtual machines" or "language virtual machines" is basically describing the JVM (Java virtual machine), which in effect is a small OS in its own right, meaning it also contains all security related provisions fully within itself. Like you said though, sandboxing can also be achieved in other ways that are completely unrelated to such virtual machines... and the Windows CLR (the .NET version of the JVM) does.

The Windows CLR shares some properties of the JVM, but not all. For example, the Windows CLR doesn't even try to make the same "write once run anywhere" promise that the Java platform makes, showing that they don't serve the same purpose. The reason the CLR can't make that promise is because it is actually not a small OS in its own right. The CLR doesn't have it's own system related security policies. It doesn't even define how a hosted process can access the underlying file system. That is all defined by the underlying OS the CLR runs on top of, and the APIs it exposes.

The CLR certainly defines security policies specifically related to code execution (code trust, monitoring buffer overruns, etc), but it isn't really responsible for the sandbox itself. I'd think it's more accurate to attribute the sandboxing mechanisms of WP directly to the OS rather than the runtime environment.

Anyway, I mention this only because I'd prefer people to think of security policies as being OS and API (WinRT) related, rather than attributing it to a runtime environment, which for many is a very abstract idea.

 

[SteveNoza]

Wow, great discussion, quite educational for end users like me.

 

[awilliams1701]

Backwards compatibility is the only reason windows gets viruses in the first place. Since phones use ARM processors instead of x86/x64 processors that backwards compatibility is removed right off the bat. Only the new apps have cross platform support. I don't think you could create a metro based virus and if this is true, then the phone will never get a virus.

Interesting, I was under the impression that Windows 10 would be one operating system that will run all devices, desktop and mobile. That seemed to be the message Microsoft was conveying. Didn't know that there would be Windows 10 and Windows 10 Mobile.

So in essence, does that mean that there is no major change from the current situation with Windows 10? Currently, we have Windows 8 and Windows Phone 8. With Windows 10 we will pretty much have the same situation, except that Microsoft will be calling its phone operating system also as Windows 10.

 

[Reflexx]

Backwards compatibility is the only reason windows gets viruses in the first place. Since phones use ARM processors instead of x86/x64 processors that backwards compatibility is removed right off the bat. Only the new apps have cross platform support. I don't think you could create a metro based virus and if this is true, then the phone will never get a virus.

This isn't completely accurate, because it's not about backwards compatibility. New programs are still made for x86.

A virus is really called a virus because it's able to spread from where it started and adversely affect other things on your computer.

In computers, we're really dealing with coding languages. All programs, including viruses, are just sets of instructions. It's something communicating with the computer and telling it to do things.

So you can think of a virus like a manipulative spy or con-man. Something that is really good at communicating and getting the computer to do things that will end up hurting itself.

What happens in traditional Windows is that the spy has access to the President. The spy (virus) can use his ability to manipulate language to convince the President to give him access to the country's most secure systems. The spy then uses that information to gain power for itself and lock out the President. The spy then replicates itself by having lots of spy babies and sends them off to do the same thing.

In the Modern side of Windows, the spy does not have access to the President. Instead, the spy is limited to his/her own house. Sure, they have a house in the country, but they don't have any power. They do have some avenues for communication under special government monitored phone lines (APIs). But that communication is limited. There are only certain things that the spy is allowed to ask for. And the spy is limited in what it's allowed to "do" to other things (like files and pictures). And this permission is only given after a review by national security (MS) of what it is asking and what it wants to do. And last, but not least, in the Modern Windows the spy can simply be eliminated if it is causing problems. It can't replicate itself and hide in the shadows. It's stuck in a house with a known address where a drone will come in and blow it away.

 

[awilliams1701]

metro apps are platform independent. They run in a virtual machine just like java. They are not specifically targeting x86, which is why they can run on ARM as well. However its the classic win32 platform where the virus attacks are made. This has been around since windows 3.1. It was an addon back then and was included in win95.

This isn't completely accurate, because it's not about backwards compatibility. New programs are still made for x86.

A virus is really called a virus because it's able to spread from where it started and adversely affect other things on your computer.

In computers, we're really dealing with coding languages. All programs, including viruses, are just sets of instructions. It's something communicating with the computer and telling it to do things.

So you can think of a virus like a manipulative spy or con-man. Something that is really good at communicating and getting the computer to do things that will end up hurting itself.

What happens in traditional Windows is that the spy has access to the President. The spy (virus) can use his ability to manipulate language to convince the President to give him access to the country's most secure systems. The spy then uses that information to gain power for itself and lock out the President. The spy then replicates itself by having lots of spy babies and sends them off to do the same thing.

In the Modern side of Windows, the spy does not have access to the President. Instead, the spy is limited to his/her own house. Sure, they have a house in the country, but they don't have any power. They do have some avenues for communication under special government monitored phone lines (APIs). But that communication is limited. There are only certain things that the spy is allowed to ask for. And the spy is limited in what it's allowed to "do" to other things (like files and pictures). And this permission is only given after a review by national security (MS) of what it is asking and what it wants to do. And last, but not least, in the Modern Windows the spy can simply be eliminated if it is causing problems. It can't replicate itself and hide in the shadows. It's stuck in a house with a known address where a drone will come in and blow it away.

 

[anon(9057135)]

I hope so. I got a 1520 and still waiting for Denim. I wish MS be more clear about there updates!

That's off topic, He was talking about viruses on Windows 10/Windows Phone 10

 

[techiez]

Hi, I am just curious since Microsoft announced that there will only be one operating system, Windows 10, across all devises, whether Windows viruses will now work on Windows phones when Windows 10 is released?

It is NOT the same OS, they are built on same core but will still be different, WP10 will not have native Desktop applications support.

 

[WanderingTraveler]

It is NOT the same OS, they are built on same core but will still be different, WP10 will not have native applications support.

Native desktop application support, to be accurate.

 

[techiez]

Native desktop application support, to be accurate.

yes, I edited now

 

[Abdul Muhaymin Arif]

Time to Develop 'Universal' Viruses

 

[awilliams1701]

I believe the way metro apps (universal apps are metro apps) work prevents them from taking over.

Time to Develop 'Universal' Viruses

 

[startrunner]

No way. The only software that will run on both mobile and desktop are the modern/RT apps and libraries. They are sandboxed and cannot contain viruses. Your phone won't run the classic Win32 programs and libraries(the ones with the viruses).

 

[Abdul Muhaymin Arif]

No way. The only software that will run on both mobile and desktop are the modern/RT apps and libraries. They are sandboxed and cannot contain viruses. Your phone won't run the classic Win32 programs and libraries(the ones with the viruses).

I know... just trolling