EditorsAbout the SiteComes vs. MicrosoftUsing This Web SiteSite ArchivesCredibility IndexOOXMLOpenDocumentPatentsNovellNews DigestSite NewsRSS

03.08.09

Conficker is Alive, Windows Vista is Critically Vulnerable and Microsoft Office Likewise

Posted in Microsoft, Office Suites, Security, Vista, Vista 7, Windows at 10:01 am by Dr. Roy Schestowitz

Magaphone
Patchy Tuesdays always get you down

Summary: New evidence for the lingering pattern of vulnerability, arrogance, and lack of responsibility at Microsoft

Conficker has been a colossal PR problem for Microsoft and security headache to its customers. For the uninitiated, here are some previous posts that we wrote about Conficker:

Microsoft would rather pretend that Conficker is history, but it’s far from history. In fact, new variants of it are now appearing and Symantec has issued warnings. For the latest details, see:

i. Conficker Worm Strikes Back With New Variant

The Conficker/Downadup worm managed to slither onto millions of PCs worldwide at its height, but after it initially infected a computer it only really acted to spread itself, and didn’t cause further harm. Until now.

Symantec reports today that it has found a new variant of the virulent worm that will identify antivirus software or security analysis tools running on the infected PC, and attempt to shut down those programs. This is a strong signal that the worm’s mysterious creators haven’t abandoned their creation in the face of worldwide attention, as some in the industry have theorized, but may still have plans to make a buck off their work.

ii. Conficker gets upgraded with defenses

Researchers at Symantec have discovered what could be a significant development in the ongoing Conficker worm saga: a new module that is being pushed out to some infected systems.

In a couple of ways, the new component is designed to harden infected machines against an industry consortium that is actively trying to contain the prolific worm. For one, the update targets antivirus software and security analysis tools to prevent them from removing the malware. Not only does it try to disable anti-malware titles, it also goes after programs such as Wireshark and regmon.

It gets worse. The illusion that Windows Vista can be secured is long dead, so no update or upgrade can redeem the user from becoming a zombie (even Vista 7 is open to hijackers [1, 2, 3], long before release). It’s the same old routine now that Windows Vista is discovered to be suffering from another “critical” flaw (or set thereof) which has not been patched yet.

March’s Patch Tuesday will see yet another critical fix for Microsoft’s flagship operating systems.

Users of Microsoft Office will be left vulnerable for at least another month:

Vole said that it will not be fixing a critical Excel vulnerability, which allows attackers to launch malicious code remotely on users’ computers via an infected Excel spreadsheet file.

From IDG:

Microsoft Corp. today said it will deliver three security updates on Tuesday, one of them ranked as “critical,” but will not fix an Excel flaw that attackers are now exploiting.

All three updates spelled out in today’s notice will tackle vulnerabilities in Windows, but as is its practice, Microsoft did not drill any deeper than to specify which versions will be affected.

As usual, Microsoft is hiding the real scale and the real number of vulnerabilities. InformationWeek wrote about this also.

“Our products just aren’t engineered for security.”

Brian Valentine, top Windows executive

“It is no exaggeration to say that the national security is also implicated by the efforts of hackers to break into computing networks. Computers, including many running Windows operating systems, are used throughout the United States Department of Defense and by the armed forces of the United States in Afghanistan and elsewhere.”

Jim Allchin, top Windows executive

Share this post: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Digg
  • del.icio.us
  • Reddit
  • co.mments
  • DZone
  • email
  • Google Bookmarks
  • LinkedIn
  • NewsVine
  • Print
  • Technorati
  • TwitThis
  • Facebook

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

18 Comments

  1. Jose_X said,

    March 8, 2009 at 11:41 am

    Gravatar

    “Not engineered for security” is why you have a zillion variants of bugs around. Do they “patch” one hole by moving it around to a different hiding place?

    I’m guessing their situation is horrible, but can you actually patch Windows against all the bugs at once, or will the different patches undue work done in other patches as these holes are moved around?

    [I think the answer is that the above is true for some holes but not all. When you don't engineer for security, you have to crudely keep redefining names and numbers to keep the malware guessing.]

  2. pcolon said,

    March 8, 2009 at 4:44 pm

    Gravatar

    @Jose_X: It’s sounds like the old “Whack-a-mole” game.

  3. David Gerard said,

    March 8, 2009 at 5:12 pm

    Gravatar

    The Iceland MCP story has three Slashdot firehose links – 1, 2, 3 – please vote up!

  4. Needs Sunlight said,

    March 9, 2009 at 4:35 am

    Gravatar

    One word: racketeering

    http://www.law.cornell.edu/uscode/html/uscode18/usc_sup_01_18_10_I_20_96.html

  5. Dave said,

    March 9, 2009 at 8:01 am

    Gravatar

    Wow, unbeleivable what an idiot you are Roy.
    You can’t even read the simplest of security advisories.

    The vunerability used by Conficker is NOT a critical vunerability for Vista.
    It is only critical for windows XP !!!!

    This blog is really a disgrace full of disinformation and lies !!!

  6. Dave said,

    March 9, 2009 at 8:03 am

    Gravatar

    And not to mention of course that the vunerability used by the Conficker worm has already been patched last year.

  7. Roy Schestowitz said,

    March 9, 2009 at 8:07 am

    Gravatar

    The dunce here is you, Dave.

    If you had read this post carefully, then you would realise that you are mixing together two completely isolated parts of it (Vista vulnerability and Conficker).

  8. David Gerard said,

    March 9, 2009 at 8:08 am

    Gravatar

    A patch was released, but unfortunately people don’t trust Microsoft patches any more because they accidentally break things way too often. (Not to mention deliberately sabotaging people’s machines with Windows Genuine Advantage and suchlike.)

    So people actually have to go through and check the machines. I had to do this at work (we have some Windows boxes for proprietary software that’s a required part of our production chain; we’re not happy about this). Ridiculously tedious.

    Furthermore, the patch last year only patches the Internet transmission vector for Conficker – it doesn’t actually disable the memory stick or CD vector (the autoplay problem).

    [And may I say also how much autoplay sucks. I have a 500GB drive full of ripped CDs in FLAC - I plug it into a Windows XP box and it pauses for a minute while it tries to work out how to autoplay the thing. WHAT.]

  9. Caitlin said,

    March 31, 2009 at 11:53 pm

    Gravatar

    Quite honestly, I thought it was some kind of scam for a cruel April Fools joke, but when I saw that it said in I believe, a CNN article “IF YOU RECEIVED AN UPDATE FROM MICROSOFT FOR SECURITY UPDATES, YOU SHOULD BE FINE”

    I immediately checked my Windows Update, and Lo and behold, the update was there.

    NOT INSTALLED.

    It’s now installing at 55% complete.

  10. Clump said,

    April 1, 2009 at 5:08 pm

    Gravatar

    If your computer is and has been set to automatically update then your computer itself is OK. Then you only have to worry about the systems out there holding your personal information!

    You’d think only a small percent of people wouldn’t have this patch already, but it seems about 30% of Windows users haven’t patched. North Americans will weather it better than Asians as most North American systems are patched while the big numbers of no-patch are in Asia, S. America etc.

    David Gerard Reply:

    Problem: Microsoft sends through too many patches that either (a) accidentally break things or (b) deliberately break things (WGA, which they just tried sending through again recently).

    So people just don’t trust Microsoft patches.

    Yggdrasil Reply:

    No, that is an overblown fear that some people have, but like many fears it’s irrational. Given the enormous number of Windows machines in place, problems due to updates are relatively small, though no software is perfect.

    I specifically remember trying to update a Ubuntu distro to 8.10. After it finished the machine rebooted, only to halt on the next boot complaining that it could not locate some file. Had I been using this machine for anything important, I would have been royally screwed. Updates “can” break installs or software on ANY OS. That’s the nature of computer software. Problems with Windows will always seem worse since there are more Windows machines in use.

    Try upgrading your Amiga 500 to OS 3.1, which includes having to replace a ROM chip, then find out your favorite game won’t work. Computers are complex machines. To assume you will never have problems using some other OS or hardware platform is purely delusional.

    For the record, in 12 years of using Windows machines, I have never had any update or security patch cause any serious problems. That includes the machines owned by my parents and sister. At the very worst, I might have had to update an older piece of software for some odd reason, but again…. that’s normal.

    David Gerard Reply:

    However, Microsoft really does deliberately send through patches designed to disable machines. At least when Ubuntu fucks up (and as an Ubuntu user, I am entirely too aware of how good they are at this) it’s not with deliberate malicious intent.

  11. Roy Schestowitz said,

    April 1, 2009 at 5:16 pm

    Gravatar

    People conveniently forget sometimes that this serious flaw was not supposed to exist in the first place.

    Gentoo User Reply:

    This wasn’t suppose to exist, either. But it does.

  12. jocaferro said,

    April 1, 2009 at 8:42 pm

    Gravatar

    March patch – MS09-006:
    “This security update resolves several privately reported vulnerabilities in the Windows kernel. The most serious vulnerability could allow remote code execution if a user viewed a specially crafted EMF or WMF image file from an affected system.”

    Yes, several (privately) vulnerabilities. Where?
    Windows kernel!
    2000, XP, 2003 Server, Vista.
    An unpatched Windows computer is a serious problem since the moment everyone knows about it. In the MS/Windows world this situation can take months even years until all computers become patched!
    How long MS (privately) know about this problem?
    Or, how long MS (privately) know about many problems without caring for a patch?

  13. jocaferro said,

    April 1, 2009 at 8:44 pm

    Gravatar

    ooopppss, sorry
    “2000, XP, 2003 Server, Vista.”
    – and 2008 Server too!

  14. Roy Schestowitz said,

    April 1, 2009 at 8:46 pm

    Gravatar

    Patches arrive when attacks commence.

What Else is New


  1. Links 22/3/2019: Libinput 1.13 RC2 and Facebook's Latest Security Scandal

    Links for the day



  2. Why the UK Intellectual Property Office (UK-IPO) Cannot Ignore Judges, Whereas the EPO Can (and Does)

    The European Patent Convention (EPC) ceased to matter, judges' interpretation of it no longer matters either; the EPO exploits this to grant hundreds of thousands of dodgy software patents, then trumpet "growth"



  3. The European Patent Office Needs to Put Lives Before Profits

    Patents that pertain to health have always posed an ethical dilemma; the EPO apparently tackled this dilemma by altogether ignoring the rights and needs of patients (in favour of large corporations that benefit financially from poor people's mortality)



  4. “Criminal Organisation”

    Brazil's ex-President, Temer, is arrested (like other former presidents of Brazil); will the EPO's ex-President Battistelli ever be arrested (now that he lacks diplomatic immunity and hides at CEIPI)?



  5. Links 21/3/2019: Wayland 1.17.0, Samba 4.10.0, OpenShot 2.4.4 and Zorin Beta

    Links for the day



  6. Team UPC (Unitary Patent) is a Headless Chicken

    Team UPC's propaganda about the Unified Patent Court (UPC) has become so ridiculous that the pertinent firms do not wish to be identified



  7. António Campinos Makes Up Claims About Patent Quality, Only to be Rebutted by Examiners, Union (Anyone But the 'Puff Pieces' Industry)

    Battistelli's propagandistic style and self-serving 'studies' carry on; the notion of patent quality has been totally discarded and is nowadays lied about as facts get 'manufactured', then disseminated internally and externally



  8. Links 20/3/2019: Google Announces ‘Stadia’, Tails 3.13

    Links for the day



  9. CEN and CENELEC Agreement With the EPO Shows That It's Definitely the European Commission's 'Department'

    With headlines such as “EPO to collaborate on raising SEP awareness” it is clear to see that the Office lacks impartiality and the European Commission cannot pretend that the EPO is “dafür bin ich nicht zuständig” or “da kenne ich mich nicht aus”



  10. Decisions Made Inside the European Patent Organisation (EPO) Lack Credibility Because Examiners and Judges Lack Independence

    The lawless, merciless, Mafia-like culture left by Battistelli continues to haunt judges and examiners; how can one ever trust the Office (or the Organisation at large) to deliver true justice in adherence or compliance with the EPC?



  11. Team UPC Buries Its Credibility Deeper in the Grave

    The three Frenchmen at the top do not mention the UPC anymore; but those who promote it for a living (because they gambled on leveraging it for litigation galore) aren't giving up and in the process they perpetuate falsehoods



  12. The EPO Has Sadly Taken a Side and It's the Patent Trolls' Side

    Abandoning the whole rationale behind patents, the Office now led for almost a year by António Campinos prioritises neither science nor technology; it's all about granting as many patents (European monopolies) as possible for legal activity (applications, litigation and so on)



  13. Where the USPTO Stands on the Subject of Abstract Software Patents

    Not much is changing as we approach Easter and software patents are still fool's gold in the United States, no matter if they get granted or not



  14. Links 19/3/2019: Jetson/JetBot, Linux 5.0.3, Kodi Foundation Joins The Linux Foundation, and Firefox 66

    Links for the day



  15. Links 18/3/2019: Solus 4, Linux 5.1 RC1, Mesa 18.3.5, OSI Individual Member Election Won by Microsoft

    Links for the day



  16. Microsoft and Its Patent Trolls Continue Their Patent War, Including the War on Linux

    Microsoft is still preying on GNU/Linux using patents, notably software patents; it wants billions of dollars served on a silver platter in spite of claims that it reached a “truce” by joining the Open Invention Network and joining the LOT Network



  17. Director Iancu Generally Viewed as a Lapdog of Patent Trolls

    As Director of the Office, Mr. Iancu, a Trump appointee, not only fails to curb patent trolls; he actively defends them and he lowers barriers in order to better equip them with bogus patents that courts would reject (if the targets of extortion could afford a day in court)



  18. Links 17/3/2019: Google Console and IBM-Red Hat Merger Delay?

    Links for the day



  19. To Team UPC the Unified Patent Court (UPC) Has Become a Joke and the European Patent Office (EPO) Never Mentions It Anymore

    The EPO's frantic rally to the very bottom of patent quality may be celebrated by obedient media and patent law firms; to people who actually produce innovative things, however, this should be a worrisome trend and thankfully courts are getting in the way of this nefarious agenda; one of these courts is the FCC in Germany



  20. Links 16/3/2019: Knoppix Release and SUSE Independence

    Links for the day



  21. Stopping António Campinos and His Software Patents Agenda (Not Legal in Europe) Would Require Independent Courts

    Software patents continue to be granted (new tricks, loopholes and buzzwords) and judges who can put an end to that are being actively assaulted by those who aren't supposed to have any authority whatsoever over them (for decisions to be impartially delivered)



  22. The Linux Foundation Needs to Speak Out Against Microsoft's Ongoing (Continued) Patent Shakedown of OEMs That Ship Linux

    Zemlin actively thanks Microsoft while taking Microsoft money; he meanwhile ignores how Microsoft viciously attacks Linux using patents, revealing the degree to which his foundation, the “Linux Foundation” (not about Linux anymore, better described as Zemlin’s PAC), has been compromised



  23. Links 15/3/2019: Linux 5.0.2, Sublime Text 3.2

    Links for the day



  24. The EPO and the USPTO Are Granting Fake Patents on Software, Knowing That Courts Would Reject These

    Office management encourages applicants to send over patent applications that are laughable while depriving examiners the freedom and the time they need to reject these; it means that loads of bogus patents are being granted, enshrined as weapons that trolls can use to extort small companies outside the courtroom



  25. CommunityBridge is a Cynical Microsoft-Funded Effort to Show Zemlin Works for 'Community', Not Microsoft

    After disbanding community participation in the Board (but there are Microsoft staff on the Board now) the "Linux Foundation" (or Zemlin PAC) continues to take Microsoft money and polishes or launders that as "community"



  26. Links 14/3/2019: GNOME 3.32 and Mesa 19.0.0 Released

    Links for the day



  27. EPO 'Results' Are, As Usual, Not Measured Correctly

    The supranational monopoly, a monopoly-granting authority, is being used by António Campinos to grant an insane amount of monopolies whose merit is dubious and whose impact on Europe will be a net negative



  28. Good News Everyone! UPC Ready to Go... in 2015!

    Benoît Battistelli is no longer in Office and his fantasy (patent lawyers' fantasy) is as elusive as ever; Team UPC is trying to associate opposition to UPC with the far right (AfD) once again



  29. Links 13/3/2019: Plasma 5.15.3,Chrome 73 and Many LF Press Releases

    Links for the day



  30. In the Age of Trumpism EFF Needs to Repeatedly Remind Director Iancu That He is Not a Judge and He Cannot Ignore the Courts

    The nonchalance and carelessness seen in Iancu's decision to just cherry-pick decisions/outcomes (basically ignoring caselaw) concerns technologists, who rightly view him as a 'mole' of the litigation 'industry' (which he came from)


CoPilotCo

RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

CoPilotCo

Recent Posts