12.25.08

Gemini version available ♊︎

The (Microsoft) Nightmare Before Christmas

Posted in Microsoft, Security, Servers, Windows at 11:28 am by Dr. Roy Schestowitz

No, not the film

THIS TYPE OF THING happens almost every year. It’s another familiar ‘emergency Christmas’ that may lead to higher blood pressure.

Data in Microsoft Databases Under Threat

Just before the holiday, Microsoft decided to give people fewer reasons to rest well, having recently patched half a dozen critical flaws.

Desktop users running the Microsoft SQL Server 2000 Desktop Engine or SQL Server 2005 Express could be at risk in some circumstances, Microsoft said.

They have been negligent enough not to fix this in 8 months. Microsoft keeps known flaws to itself until it's too late and damage is being done.

Microsoft Corp. today confirmed that it has been working on a critical vulnerability in SQL Server for more than eight months, but declined to say whether it has had a patch ready since September, as an Austrian security researcher has alleged.

Another emergency patch (almost the third in a month [1, 2, 3]) is likely on its way. Microsoft Fanalysts [sic] are explaining the severity of this as well.

News Analysis. Microsoft has warned of a zero-day vulnerability affecting SQL Server. Do take Microsoft’s security advisory seriously.

Remember SQL Server slammer, which struck nearly six years ago? IT administrators were lucky the worm spread a month after Christmas. The new SQL Server vulnerability could bring coal to your Christmas stocking, if left untended.

Scareware and Fakes

There are other new attacks that piggyback on Microsoft.com.

Miscreants are exploiting weaknesses in more than one million webpages operated by the federal government, media companies, and even Microsoft to trick unwitting visitors into installing harmful software that takes over their computers.

More here:

Fake Antivirus Peddlers Helped by Microsoft, IRS

Just weeks after the U.S. Federal Trade Commission shut down two companies accused of selling fake antivirus software, a new player has moved into the market, aided by glitches in the Microsoft and U.S. Internal Revenue Service Web sites.

As always, there are fake greeting cards too, whose harm is only Windows compatible (where “clicking” translates to “executing”, frequently with full system privileges).

A new worm has emerged that could be much worse than the notorious Storm worm, which ruled the botnet world for nearly two years.

Zombies on the Cloud

We wrote extensively about the threat of zombie PCs. Botnets seem to have recruited almost one in two Windows PCs although most nodes in this network remain unused, so the seriousness remains mostly uncovered — for now. 98% of the Windows PCs out there are potentially ripe for hijacking, according to Secunia, so it’s down to the mercy — or wrath — of botmasters.

This has serious ramifications when it comes to security and the United States too can be crushed by botnets, according to this new simulated attack.

US cybersecurity defences fail to thwart mock cyberattack

The basic scenario involved exercises in electronic disruption accompanying a national emergency, a sequence of events played out in Estonia last year and more recently in Georgia. Defenders drew on established defence procedures but these turned out to be inadequate, for reasons not explained in any detail by participants.

Speaking of security, problems may also be introduced by Microsoft’s so-called ‘cloud’ (Azure), which we remarked on in [1, 2, 3, 4].

Amitabh: Microsoft provides a computing infrastructure on which developers can build applications. It is the responsibility of the developer to ensure that their applications, content and services comply with applicable laws and do not engage in malicious conduct. For more information refer to http://www.microsoft.com/azure/termswindowsazure.mspx

Looking at that URL:

# Indemnification.

[...]

You agree to indemnify, pay the defense costs of, and hold Microsoft and its successors, officers, directors and employees harmless from and against any and all claims, demands, costs, liabilities, judgments, losses, expenses and damages (including attorneys’ fees)

[...]

# Modifying the Terms.

[...]

Microsoft may at its sole discretion modify this agreement at any time. You can access the most current version of the agreement via the link

That’s not so reassuring. For similar reasons, we constantly warn about Microsoft's so-called "open source" licences. Microsoft totally controls the way they evolve.

International database

Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Reddit
  • email

Decor ᶃ Gemini Space

Below is a Web proxy. We recommend getting a Gemini client/browser.

Black/white/grey bullet button This post is also available in Gemini over at this address (requires a Gemini client/browser to open).

Decor ✐ Cross-references

Black/white/grey bullet button Pages that cross-reference this one, if any exist, are listed below or will be listed below over time.

Decor ▢ Respond and Discuss

Black/white/grey bullet button If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

7 Comments

  1. Bryant said,

    December 25, 2008 at 11:39 am

    Gravatar

    “You agree to indemnify, pay the defense costs of, and hold Microsoft and its successors, officers, directors and employees harmless from and against any and all claims, demands, costs, liabilities, judgments, losses, expenses and damages (including attorneys’ fees)”

    That passage is standard issue in all Terms of Service. The whole point is that if you’re doing something that gets Microsoft sued, Microsoft should have the right to sue you for the legal woes you imposed on them.

    Amazon Web Services has a similar clause:
    http://aws.amazon.com/agreement/#12

  2. Roy Schestowitz said,

    December 25, 2008 at 11:43 am

    Gravatar

    Thank you. I did not know this and it’s valuable to bear in mind.

  3. amd-linux said,

    December 25, 2008 at 12:24 pm

    Gravatar

    Hey Roy,

    guess you are aware that MS is sponsoring your site? :-)

    I get a large banner ad for MS Office when I view this page – and of course, I HAD to check out what MS office has to offer for a Linux user (just to find out that it still is not much, compared to OO.org and the price tag…) and clicked on it….

    Merry Christmas to verybody, and thanks to MS for sponsoring :-)

  4. Roy Schestowitz said,

    December 25, 2008 at 12:36 pm

    Gravatar

    We’re blocking Microsoft and Novell domains, but this doesn’t prevent their channel partners from penetrating through Google. What was the site’s domain? Let us know so that Shane can add it to the blocklist.

  5. Shane Coyle said,

    December 25, 2008 at 12:38 pm

    Gravatar

    Yup, we’re fully aware – we even have reports of Novell ads here from time to time.

    As evidenced by the comments here, we have a regular community of folks from all sides of the Microsoft-Novell deal – supporters, haters, and some who are indifferent or have not yet made up their mind. If Microsoft and Novell wish to try and make their case, they can feel free.

    Please, as always – do not commit click fraud, if you are genuinely interested in an ad, great. If not, (depending on your browser) you may consider an ad blocker or proxy filter setup in order to avoid the ads altogether – that’s what I do.

    Ads are a necessary evil here, we’ve discussed it before and I still can’t see a way around it, we get alot of traffic, and sometimes we melt the servers with some of the stories that get Dugg or Slashdotted.

    Just recently, technocrat.net fell by the wayside due to similar pressures and inviability, and while we are not in danger of that presently, I was close to broke not long ago and may be once again…

  6. Shane Coyle said,

    December 25, 2008 at 12:44 pm

    Gravatar

    For the record, novell.com microsoft.com and moreinterop.com should not come through. After that, it became too tedious to filter in Adsense…

  7. Roy Schestowitz said,

    December 25, 2008 at 12:49 pm

    Gravatar

    I didn’t realise that MoreInterop used to sneak in. Heh. “More Interop”… kind of like “More dead” of “F-” (as though standards are a relative thing)

DecorWhat Else is New


  1. Links 8/12/2021: Linux 5.15.7 Out, Linux Mint 20.3 is Near

    Links for the day



  2. Links 8/12/2021: Zorin OS 16 Milestone and Calculate Linux 22 Released; Kubernetes 1.23

    Links for the day



  3. A Call for Sources and Whistleblowers From Microsoft's GitHub

    Remarks on our publications from this morning and a call for more leakers and whistleblowers, who know GitHub better than anybody else (including lots of fools who still outsource all of their hard labour to Microsoft through GitHub)



  4. [Teaser] Rape is Not a Joke

    Having just uploaded a police report, we’re starting to move the ongoing series to the next phase, which will still be — for the most part — weekly installments on Mondays (for months to come)



  5. [Teaser] Meet Microsoft’s Chief Architect of GitHub Copilot, Balabhadra (Alex) Graveley

    Alex Graveley, a serial abuser, has been protected by Microsoft; what does that say about Microsoft and about Nat Friedman, GitHub’s CEO whom Alex considers his "best friend"? Stay tuned as we have plenty more to show



  6. IRC Proceedings: Tuesday, December 07, 2021

    IRC logs for Tuesday, December 07, 2021



  7. Links 8/12/2021: FreeBSD 12.3, EasyOS 3.1.13, and WordPress 5.9 Beta 2

    Links for the day



  8. [Meme] EU Assurances

    The EPO‘s staff cannot be blamed for losing patience as elected public representatives completely fail to do their job (with few exceptions)



  9. Clare Daly (GUE/NGL) Does What Every Public Official in Europe Should Have Done About EPO Shenanigans

    There’s another (new) push to hold the EPO accountable, seeing that the overseers clearly do not do their job and instead cover up the abuses



  10. Links 7/12/2021: Firefox 96 Beta and Fedora 37 Abandons ARMv7

    Links for the day



  11. Links 7/12/2021: Plasma Mobile Gear 21.12 and Tails 4.25

    Links for the day



  12. All IRC Logs Now Available as GemText Over Gemini Protocol

    Today we've completed the transition from plain text over gemini:// to GemText over gemini:// for IRC logs



  13. IRC Proceedings: Monday, December 06, 2021

    IRC logs for Monday, December 06, 2021



  14. [Meme] Rowing to the Bottom of the Ocean

    The EPO‘s Steve Rowan (VP1) is failing EPO staff and sort of “firing” workers during times of crisis (not at all a crisis to the EPO’s coffers)



  15. EPO Gradually Reduced to 'Fee Collection Agency' Which Eliminates Its Very Own Staff

    Mr. Redundancies and Mr. Cloud are outsourcing EPO jobs to Microsoft and Serco as if the EPO is an American corporation, providing no comfort to long-serving EPO staff



  16. Linux Foundation 2021 Annual Report Made on an Apple Mac Using Proprietary Software

    Yes, you’re reading this correctly. They still reject both “Linux” and “Open Source” (no dogfooding). This annual report is badly compressed; each page of the PDF is, on average, almost a megabyte in size (58.8 MB for a report of this scale is unreasonable and discriminates against people in countries with slow Internet connections); notice how they’re milking the brand in the first page (straight after the cover page, the 1991 ‘creation myth’, ignoring GNU); remember that this foundation is named after a trademark which is not even its own!



  17. Links 7/12/2021: OpenIndiana Hipster 2021.10 and AppStream 0.15

    Links for the day



  18. Microsoft “Defender” Pretender Attacks Random Software That Uses NSIS for installation; “Super Duper Secure Mode” for Edge is a Laugh

    Guest post by Ryan, reprinted with permission



  19. Links 6/12/2021: LibreOffice Maintenance Releases, Firefox 95 Finalised

    Links for the day



  20. “Wintel” “Secure” uEFI Firmware Used to Store Persistent Malware, and Security Theater Boot is Worthless

    Guest post by Ryan, reprinted with permission



  21. No Linux Foundation IRS Disclosures Since 2018

    The publicly-available records or IRS information about the Linux Foundation is suspiciously behind; compared to other organisations with a "tax-exempt" status the Linux Foundation is one year behind already



  22. Jim Zemlin Has Deleted All of His Tweets

    The Linux Foundation‘s Jim Zemlin seems to have become rather publicity-shy (screenshots above are self-explanatory; latest snapshot), but years ago he could not contain his excitement about Microsoft, which he said was "loved" by what it was attacking. Days ago it became apparent that Microsoft’s patent troll is still attacking Linux with patents and Zemlin’s decision to appoint Microsoft as the At-Large Director (in effect bossing Linus Torvalds) at the ‘Linux’ Foundation’s Board of Directors is already backfiring. She not only gets her whole salary from Microsoft but also allegedly protects sexual predators who assault women… by hiring them despite repeated warnings; if the leadership of the ‘Linux’ Foundation protects sexual predators who strangle women (even paying them a salary and giving them management positions), how can the ‘Linux’ Foundation ever claim to represent inclusion and diversity?



  23. Microsoft GitHub Exposé — Part IX — Microsoft's Chief Architect of GitHub Copilot Sought to be Arrested One Day After Techrights Article About Him

    Balabhadra (Alex) Graveley has warrant for his arrest, albeit only after a lot of harm and damage had already been done (to multiple people) and Microsoft started paying him



  24. The Committee on Patent Law (PLC) Informed About Overlooked Issues “Which Might Have a Bearing on the Validity of EPO Patents.”

    In a publication circulated or prepared last week the Central Staff Committee (CSC) of the EPO explains a situation never explored in so-called 'media' (the very little that's left of it)



  25. Links 6/12/2021: HowTos and Patents

    Links for the day



  26. IRC Proceedings: Sunday, December 05, 2021

    IRC logs for Sunday, December 05, 2021



  27. Gemini Space/Protocol: Taking IRC Logs to the Next Level

    Tonight we begin the migration to GemText for our daily IRC logs, having already made them available over gemini://



  28. Links 6/12/2021: Gnuastro 0.16 and Linux 5.16 RC4

    Links for the day



  29. Links 5/12/2021: Touchpad Gestures in XWayland

    Links for the day



  30. Society Needs to Take Back Computing, Data, and Networks

    Why GemText needs to become 'the new HTML' (but remain very simple) in order for cyberspace to be taken away from state-connected and military-funded corporations that spy on people and abuse society at large


RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts