12.25.08
The (Microsoft) Nightmare Before Christmas
No, not the film
THIS TYPE OF THING happens almost every year. It’s another familiar ‘emergency Christmas’ that may lead to higher blood pressure.
Data in Microsoft Databases Under Threat
Just before the holiday, Microsoft decided to give people fewer reasons to rest well, having recently patched half a dozen critical flaws.
Desktop users running the Microsoft SQL Server 2000 Desktop Engine or SQL Server 2005 Express could be at risk in some circumstances, Microsoft said.
They have been negligent enough not to fix this in 8 months. Microsoft keeps known flaws to itself until it's too late and damage is being done.
Microsoft Corp. today confirmed that it has been working on a critical vulnerability in SQL Server for more than eight months, but declined to say whether it has had a patch ready since September, as an Austrian security researcher has alleged.
Another emergency patch (almost the third in a month [1, 2, 3]) is likely on its way. Microsoft Fanalysts [sic] are explaining the severity of this as well.
News Analysis. Microsoft has warned of a zero-day vulnerability affecting SQL Server. Do take Microsoft’s security advisory seriously.
Remember SQL Server slammer, which struck nearly six years ago? IT administrators were lucky the worm spread a month after Christmas. The new SQL Server vulnerability could bring coal to your Christmas stocking, if left untended.
Scareware and Fakes
There are other new attacks that piggyback on Microsoft.com.
Miscreants are exploiting weaknesses in more than one million webpages operated by the federal government, media companies, and even Microsoft to trick unwitting visitors into installing harmful software that takes over their computers.
More here:
Fake Antivirus Peddlers Helped by Microsoft, IRS
Just weeks after the U.S. Federal Trade Commission shut down two companies accused of selling fake antivirus software, a new player has moved into the market, aided by glitches in the Microsoft and U.S. Internal Revenue Service Web sites.
As always, there are fake greeting cards too, whose harm is only Windows compatible (where “clicking” translates to “executing”, frequently with full system privileges).
A new worm has emerged that could be much worse than the notorious Storm worm, which ruled the botnet world for nearly two years.
Zombies on the Cloud
We wrote extensively about the threat of zombie PCs. Botnets seem to have recruited almost one in two Windows PCs although most nodes in this network remain unused, so the seriousness remains mostly uncovered — for now. 98% of the Windows PCs out there are potentially ripe for hijacking, according to Secunia, so it’s down to the mercy — or wrath — of botmasters.
This has serious ramifications when it comes to security and the United States too can be crushed by botnets, according to this new simulated attack.
US cybersecurity defences fail to thwart mock cyberattack
The basic scenario involved exercises in electronic disruption accompanying a national emergency, a sequence of events played out in Estonia last year and more recently in Georgia. Defenders drew on established defence procedures but these turned out to be inadequate, for reasons not explained in any detail by participants.
Speaking of security, problems may also be introduced by Microsoft’s so-called ‘cloud’ (Azure), which we remarked on in [1, 2, 3, 4].
Amitabh: Microsoft provides a computing infrastructure on which developers can build applications. It is the responsibility of the developer to ensure that their applications, content and services comply with applicable laws and do not engage in malicious conduct. For more information refer to http://www.microsoft.com/azure/termswindowsazure.mspx
Looking at that URL:
# Indemnification.
[...]
You agree to indemnify, pay the defense costs of, and hold Microsoft and its successors, officers, directors and employees harmless from and against any and all claims, demands, costs, liabilities, judgments, losses, expenses and damages (including attorneys’ fees)
[...]
# Modifying the Terms.
[...]
Microsoft may at its sole discretion modify this agreement at any time. You can access the most current version of the agreement via the link
That’s not so reassuring. For similar reasons, we constantly warn about Microsoft's so-called "open source" licences. Microsoft totally controls the way they evolve. █
Bryant said,
December 25, 2008 at 11:39 am
“You agree to indemnify, pay the defense costs of, and hold Microsoft and its successors, officers, directors and employees harmless from and against any and all claims, demands, costs, liabilities, judgments, losses, expenses and damages (including attorneys’ fees)”
That passage is standard issue in all Terms of Service. The whole point is that if you’re doing something that gets Microsoft sued, Microsoft should have the right to sue you for the legal woes you imposed on them.
Amazon Web Services has a similar clause:
http://aws.amazon.com/agreement/#12
Roy Schestowitz said,
December 25, 2008 at 11:43 am
Thank you. I did not know this and it’s valuable to bear in mind.
amd-linux said,
December 25, 2008 at 12:24 pm
Hey Roy,
guess you are aware that MS is sponsoring your site?
I get a large banner ad for MS Office when I view this page – and of course, I HAD to check out what MS office has to offer for a Linux user (just to find out that it still is not much, compared to OO.org and the price tag…) and clicked on it….
Merry Christmas to verybody, and thanks to MS for sponsoring
Roy Schestowitz said,
December 25, 2008 at 12:36 pm
We’re blocking Microsoft and Novell domains, but this doesn’t prevent their channel partners from penetrating through Google. What was the site’s domain? Let us know so that Shane can add it to the blocklist.
Shane Coyle said,
December 25, 2008 at 12:38 pm
Yup, we’re fully aware – we even have reports of Novell ads here from time to time.
As evidenced by the comments here, we have a regular community of folks from all sides of the Microsoft-Novell deal – supporters, haters, and some who are indifferent or have not yet made up their mind. If Microsoft and Novell wish to try and make their case, they can feel free.
Please, as always – do not commit click fraud, if you are genuinely interested in an ad, great. If not, (depending on your browser) you may consider an ad blocker or proxy filter setup in order to avoid the ads altogether – that’s what I do.
Ads are a necessary evil here, we’ve discussed it before and I still can’t see a way around it, we get alot of traffic, and sometimes we melt the servers with some of the stories that get Dugg or Slashdotted.
Just recently, technocrat.net fell by the wayside due to similar pressures and inviability, and while we are not in danger of that presently, I was close to broke not long ago and may be once again…
Shane Coyle said,
December 25, 2008 at 12:44 pm
For the record, novell.com microsoft.com and moreinterop.com should not come through. After that, it became too tedious to filter in Adsense…
Roy Schestowitz said,
December 25, 2008 at 12:49 pm
I didn’t realise that MoreInterop used to sneak in. Heh. “More Interop”… kind of like “More dead” of “F-” (as though standards are a relative thing)