So, Microsoft refers to a report that just happens to be written by one of its employees, but without mentioning that fact.
It's a convenient fiction that buying everything from one vendor makes life easier. It may make installation and integration between programs easier, but that ease leads to single points of failure. Hijacking a browser is nice, but using the browser to dig deep into the OS, to have that hijacking facilitated by a too-close tie between the browser and the OS? Even better.
This is the first time I’ve seen Microsoft prominently admit to silently fixing vulnerabilities in its bulletins — a controversial practice that effectively reduces the number of publicly documented bug fixes (for those keeping count) and affects patch management/deployment decisions.
Forget for a moment whether Microsoft is throwing off patch counts that Microsoft brass use to compare its security record with those of its competitors. What do you think of Redmond’s silent patching practice?
Sorry, but Microsoft's self-evaluating security counting isn't really a good accounting.
[...]
The point: Don't count on security flaw counting. The real flaw is the counting.
When Didier Stevens recently took a closer look at some Internet Explorer malware that he had found, something surprised him somwehat. He discovered that the IE-targeted malware had been obfuscated with null-bytes (0x00) and when run against VirusTotal, he found that fewer than half of the products identified the sample as malware (15 of 32). When all null-bytes were removed, the chances of successful detection improved, though not as much as would normally be expected (25 of 32 detections).
"This type of vulnerability has been very popular with malicious attacks in the past, and we expect to see its usage increase substantially, now that exploit code is publicly available," security vendor Websense. warned in a note published Monday.
The vulnerability relates to the message IE displays when Web page loading is aborted, Raff wrote. An attacker can rig the message by creating a malicious link. The message will offer a link to retry loading the page; hitting it brings up the attacker's page, but showing an arbitrary Web address, he wrote.
It's bad enough when crooks exploit bugs to ruin a home computer, but the consequences of a successful attack can be much worse. A substitute teacher in Norwich, Connecticut, found that out when a computer she was using in her classroom suddenly started showing pornographic pop-up ads to everyone in the class. She now faces up to 40 years in prison after being convicted of willfully showing her students the images. A security expert hired by her defense, however, says he found malicious software on the PC.
Opinion: Microsoft used the January 2007 security update to induce users to try Internet Explorer 7.0 whether they wanted to or not. But after discovering they had been involuntarily upgraded to the new browser, they next found that application incompatibility effectively cut them off from the Internet.
All recent versions of Windows are vulnerable when all recent versions of IE, including IE 7, are in use, according to Microsoft.
As many organisations may not feel compelled to turn off automatic updates, they should be prepared to face this is issue when Internet Explorer 7 is downloaded and installed automatically.
"But browser testers may already be at risk, according to security researcher Tom Ferris. Late Tuesday, Ferris released details of a potential security flaw in IE 7. An attacker could exploit the flaw by crafting a special Web page that could be used to crash the browser or gain complete control of a vulnerable system, Ferris said in an advisory on his Web site. Microsoft had no immediate comment on Ferris' alert."
The flaw stems from error in the handling of redirections for URLs with the "mhtml:" URI handler. Security notification firm Secunia reports that the same bug was discovered six months ago in IE6 but remains unresolved.
First of all, you need to visit an infection site using Internet Explorer - this exploit doesn't work in Firefox, for example.
First reported by Florida-based Sunbelt Software Tuesday, the bug has already been used to compromise PCs and load them with scores of adware and spyware programs, as well as other malicious code. Users surfing with IE 6 and earlier can be infected simply by viewing the wrong site.
This is the second unpatched flaw found in IE over the past week. On Sept. 14, researchers posted code that could be used to exploit a different vulnerability in a multimedia component of the Web browser. Microsoft is still investigating that flaw and is not saying whether it too will be patched next month.
The exploit uses a bug in VML in Internet Explorer to overflow a buffer and inject shellcode. It is currently on and off again at a number of sites.
Security researchers at Microsoft have been informed.
Computer code that could be used to hijack Windows PCs via a yet-to-be-patched Internet Explorer flaw has been posted on the Net, experts have warned.
In the SmartWare test, Microsoft's Internet Explorer 7 blocked 690 known phishing sites, or 66.35 percent of the total. In contrast, Firefox blocked 78.85 percent when using a local antiphishing database and 81.54 percent when using the online database.
"Mozilla is forthcoming about vulnerabilities," Levy said, whereas "it takes Microsoft far longer to acknowledge vulnerability."
How much longer? "In the last reporting period, the second half of last year, Microsoft had acknowledged 13 vulnerabilities. We've now revised it to 31. The difference is that now Microsoft has acknowledged these vulnerabilities."
[...]
"Mozilla can turn around on a dime," Levy said. "Open-source programmers can recognize a problem and patch it in days or weeks."
And as for Microsoft?
"If a vulnerability is reported to Microsoft, Microsoft doesn't acknowledge it for at least a month or two. There's always a certain lag between knowing about a bug and acknowledging it," Levy said.
What the press statement didn't mention is that Aruba mobility controllers run the Linux operating system which Microsoft has aggressively targeted as being inferior to Windows as part of its "Get the Facts" marketing campaign.
[...]
Pandey's appraisal of Aruba's technology is in stark contrast to Microsoft's "Get the Facts" rhetoric which places Windows as a more secure, and higher-performing choice over Linux.
The funny thing is, The site is hosted on Debian Linux...
This month's announcement by Microsoft to acquire digital marketing services firm aQuantive has revealed little on how the companies will integrate their IT, but inside information indicates the deal may be Redmond's largest commitment to free software.
[...]
Whether the businesses are complementary or not, Microsoft's integration work will no doubt involve a lot of open source software used by aQuantive.
Information available from Atlas' Web site indicates the Internet software company employs extensive use of open source software including Linux, Apache, MySQL, and Solaris.
Software engineers at Atlas' Raleigh office do client/server development in C and C++, software maintenance and "scripting", and developing and maintaining custom reporting capabilities.
”While Microsoft controls the media, buys the media, and even buys voices on the Internet, nobody can be trusted.“As promised, returning to the original point of this post, Microsoft can deny the truth all it wants, but we ought to judge things for ourselves. While Microsoft controls the media, buys the media, and even buys voices on the Internet, nobody can be trusted. The antitrust exhibit known as "Effective Evangelism" [PDF] shows that Microsoft has for a long time intended to hire analyst whose output only appears to be independent. One need only look a month back for a live demonstration.
Going a year into the past, Redmond Kool-Aid seems likely to have played a role in another story which turned out to be an anti-Firefox lie. It did a lot of damage even after it was called a lie, by admission of the claim's own so-called 'hacker'. More information here.
Lately, I read the headline: "Open Source browser Firefox is so critically flawed that it is impossible to fix, according to two hackers." Further on, in the ZDNet article I read: "The hackers claim they know of about 30 unpatched Firefox flaws. They don't plan to disclose them, instead holding onto the bugs."
Since that sounds suspicious, I decided to start searching for connections with MS. Easy enough, here it is...
This is a small subset of all the vulnerabilities, because the vulnerabilities that are found through the QA process and the vulnerabilities that are found by the security folks they engage as contractors to perform penetration testing are fixed in service packs and major updates. For Microsoft this makes sense because these fixes get the benefit of a full test pass which is much more robust for a service pack or major release than it is for a security update.