EditorsAbout the SiteComes vs. MicrosoftUsing This Web SiteSite ArchivesCredibility IndexOOXMLOpenDocumentPatentsNovellNews DigestSite NewsRSS

12.11.08

Nothing New Under the Microsoft

Posted in Microsoft, Security, Windows at 6:28 am by Dr. Roy Schestowitz

Cracker

Microsoft’s handling of security is a cyclic routine that goes like this:

  1. Many flaws get reported, accumulated, and then mostly ignored
  2. Attacks on the unpatched flaws begin, so Microsoft ‘kindly’ bothers to work on patches in a rush
  3. Patch Tuesday arrives and Microsoft delivers a slew of patches (occasionally delivering nothing critical for bragging rights in the press, only to deliver a massive number of critical patches the following month, i.e. deferral)
  4. Patches arrive too late, after many servers and desktop have already been hijacked
  5. A number of zero-day flaws emerge, some of which exploiting vulnerabilities Microsoft has been aware of for a long time
  6. Patches turn out to be dysfunctional and consequently many computers are left out of services
  7. Microsoft reworks the patches and then delivers a patch to the broken patches
  8. Repeat (1)

This month was no exception. Microsoft delivered half a dozen “critical” patches (usually meaning that the vulnerability they patch enables crackers to seize full control of a to-be-compromised machine).

Appended below are reports from the past couple of days alone. The lies need to end because everyone suffers.

____
[1] Another Microsoft Bug Revealed on Huge Patch Day

Along with its biggest patch release in five years, Microsoft warned on Tuesday of another potentially dangerous vulnerability in its software.

The problem lies within the WordPad Text Converter for Word 97 files, Microsoft said in an advisory.

The systems affected include Windows 2000 Service Pack 4, Windows XP Service Pack 2, Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2, Microsoft said. XP Service Pack 3 and the Vista operating systems are not affected.

[2] Two new zero-day exploits dent Microsoft’s Patch Tuesday

Microsoft’s Patch Day delivered eight updates, but has been overshadowed by newly discovered zero day holes, which are apparently not closed by the new updates.

[3] New Web Attack Exploits Unpatched IE Flaw

As Microsoft readies its latest set of security updates, online attackers have begun exploiting a new flaw in the company’s Internet Explorer (IE) browser.

[4] Third Zero Day exploit appears

Microsoft has confirmed it is investigating another zero day exploit.

[5] Security vulnerability found in MS SQL Server 2000

SEC Consult say Microsoft has been aware of the problem since April this year. Despite the promise of a patch by September, a release date for the patch remains uncertain.

Share this post: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Digg
  • del.icio.us
  • Reddit
  • co.mments
  • DZone
  • email
  • Google Bookmarks
  • LinkedIn
  • NewsVine
  • Print
  • Technorati
  • TwitThis
  • Facebook

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

3 Comments

  1. pcolon said,

    December 11, 2008 at 6:47 am

    Gravatar

    MS can spin this to increase their server footprint without having to embrace Apache by claiming “MS has the real “A-Patchy” servers .

  2. Richard Mclaughlin said,

    December 11, 2008 at 5:41 pm

    Gravatar

    actually, it’s more like this.
    Patches are released.
    smart people and IT departments install them.
    average joe blow doesn’t.
    Hacker looks at the hole the patch fixed and attacks the hole.
    systems go down because people didn’t upgrade when the patch came out.

    Having run call centers for 15+ years, I know this to be a fact.

  3. Roy Schestowitz said,

    December 11, 2008 at 5:53 pm

    Gravatar

    How many of those “smart people” actually get ‘burned’ for installing bad patches? Quality counts too.

    The lateness of some patches is another issue that is raised above. As the new references show, Windows is already vulnerable again and no patches will have arrived until next month.

What Else is New


  1. Links 5/6/2020: LibreELEC (Leia) 9.2.3, Rust 1.44.0, and Hamburg's Pivot to Free/Libre Software

    Links for the day



  2. This Article About GitHub Takeover Never Appeared (Likely Spiked by Microsoft and Its Friends Inside the Media)

    And later they wonder why people distrust so much of the media (where paying advertisers set the agenda/tone)



  3. Raw: How Microsoft and/or the EPO Killed an Important EPO Story About Their SLAPP Against Techrights and Others

    Spiking a story about spiked stories about corruption



  4. The Linux Foundation 'Bootcamp' -- Badly Timed and Badly Named in June 2020 -- Only Uses Linus Torvalds Like a 'Prop' (for Legitimacy) While Promoting Militarised Monopolies

    Sometimes a picture says a lot more than words, especially in light of political events in the US and a certain Chinese anniversary we cannot name (Microsoft censors mentions of it)



  5. IRC Proceedings: Thursday, June 04, 2020

    IRC logs for Thursday, June 04, 2020



  6. The Gates Press (GatesGate) -- Part II: When Media That You Bribe Calls All Your Critics 'Conspiracy Theorists' (to Keep Them Silenced, Marginalised)

    The assault on the media by Bill Gates is a subject not often explored by the media (maybe because a lot of it is already bribed by him); but we're beginning to gather new and important evidence that explains how critics are muzzled (even fired) and critical pieces spiked, never to see the light of day anywhere



  7. GitHub is Not Sharing But 'Theft' by Microsoft

    Microsoft buying GitHub does not demonstrate that Microsoft loves Open Source (GitHub is not Open Source and may never be) but that it loves monopoly and coercion (what GitHub is all about and why it must be rejected)



  8. The Huge Damage (Except for Patent Lawyers' Bottom Line) Caused by Fake European Patents

    The European Patent Office (EPO) keeps granting fake patents that cause a lot of real harm (examiners are pressured to play along and participate in this unlawful agenda); nobody is happy except those who profit from needless, frivolous lawsuits



  9. Red Hat/IBM Got 'Tired' of RMS. Is It Getting 'Tired' of GPL/Copyleft Too?

    After contributing to the cancellation of Richard Stallman (RMS) based on some falsehoods perpetuated in the media we're seeing the sort of thing one might expect from IBM (more so now that it totally controls Fedora and RHEL)



  10. Links 4/6/2020: Proton 5.0-8 Release Candidate, GNU Linux-libre 5.7

    Links for the day



  11. IRC Proceedings: Wednesday, June 03, 2020

    IRC logs for Wednesday, June 03, 2020



  12. Social Engineering of Free Software, Based on Corporate Criteria

    What "professional" nowadays means in the context of coding and honest assessment of technical work



  13. Weakening GNU/Linux by Disempowering Its Leaders and Founders, Replacing Them With Microsoft Employees and GNU/Linux-Hostile Moles

    The coup to remove (or remove power from) Stallman and Torvalds, the GNU and Linux founders respectively, is followed by outsourcing of their work to Microsoft’s newly-acquired monopoly (GitHub) and appointment of Microsoft workers or Microsoft-friendly people, shoehorning them into top roles under the disingenuous guise of "professionalism"



  14. Sword Group Violates Its Own Commitment by Working for the EPO

    The European Patent Office (EPO) keeps outsourcing its work to outside contractors (for-profit private entities) to the tune of hundreds of millions if not billions — all this without any oversight



  15. In 2020 Canonical No Longer Fights for Freedom

    Freedom requires a GNU/Linux distro other than Ubuntu, which seems unwilling or unable/incapable of speaking about and promoting the ideals of GNU/Linux



  16. We Need to Use the F Word (Freedom) to Promote Adoption of GNU/Linux

    "People get the government their behavior deserves. People deserve better than that." -Richard Stallman



  17. People Who Want to Explore GNU/Linux With Ubuntu See This Today

    "Wait, am I in a GNU/Linux blog or another Windows blog," a visitor might think... or, is Microsoft 'taking over' messaging at Canonical? (Same with code)



  18. Links 4/6/2020: Septor 2020.3, Nextcloud and Blender 2.83

    Links for the day



  19. Hey, Where's Red Hat (IBM)?

    Red Hat is conspicuously silent at these critical times (in its home country); Must be too busy hailing and cashing in on Trump's military (state) while dishing out shallow and self-contradictory diversity PR/fluff…



  20. Microsoft's Latest Vapourware About Supercomputers

    Microsoft has spent almost two decades dropping supercomputers vapourware on the media, but those misinformation dumps always turn out to be 100% hot air, no substance



  21. 2020: A Time for Resolutions or Revolutions?

    There are nonviolent means by which the current system can be corrected; we need to convince peers and relatives to change the way they behave and not cooperate with unjust elements of the system



  22. IRC Proceedings: Tuesday, June 02, 2020

    IRC logs for Tuesday, June 02, 2020



  23. The Gates Press (GatesGate) -- Part I: Lost the Job After Writing an Article Critical of Bill Gates for Attacking Some Actual, Legitimate Charities (Because They Had Spread GNU/Linux)

    The sociopaths from the fake 'charity' of Bill Gates would go to great lengths to squash criticism and also to eliminate critics; this series tells the story of some of those personally affected



  24. Don't Fall for the Spin, Microsoft is Laying Off Workers and It's Not Just Because of the Pandemic





  25. All They Want is Litigation, Not Innovation

    It's getting difficult to ignore or to overlook the fact that the 'litigation lobby' (the likes of Team UPC and today's EPO management, guided by groups like the Licensing Executives Society International) doesn't care about innovation and is in fact looking to profit by crushing innovation



  26. Reminder: Microsoft Profits From Crushing Protesters for Donald Trump

    Don't lose sight of the fact that what's going on in the United States right now is very profitable to Microsoft



  27. No, GNU/Linux Isn't at 3% and Windows Isn't at Over 90%, Either

    This ludicrous idea that "Linux" (however one defines it) enjoys just 3% of the "market" is false and it should be treated as laughable spin (it is being widely promoted this week, often by Microsoft boosters looking to make charts where Windows stays at above 90% and Vista 10 is 'gaining'... at the expense of Windows)



  28. Links 3/6/2020: Devuan Beowulf 3.0.0 and Tails 4.7 Released

    Links for the day



  29. Links 2/6/2020: New Firefox Release (77), Debian-based MX Linux 19.2, KDevelop 5.5.2, GNU/Linux Growth on Desktops/Laptops

    Links for the day



  30. Techrights Can Figure Out Source Protection/Anonymisation Whilst Operating Very Transparently

    We're still quite radically transparent whilst at the same time enjoying 100% source protection record; we're also improving the software we use to publish more quickly and efficiently


RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts