EditorsAbout the SiteComes vs. MicrosoftUsing This Web SiteSite ArchivesCredibility IndexOOXMLOpenDocumentPatentsNovellNews DigestSite NewsRSS

04.09.09

Insecurity Through Obscurity

Posted in GNU/Linux, Microsoft, Security, Windows at 6:34 am by Dr. Roy Schestowitz

Locked girl

Summary: Windows renders E-mail chaotic and the U.S. electrical grid gets cracked

Nothing beats a brand-new explanation from Microsoft itself about the impact of its poor security skills, which continue to this date.

More than 97% of all e-mails sent over the net are unwanted, according to a Microsoft security report.

This report from Microsoft probably neglects to mention that the vast majority of SPAM is spewed from Microsoft Windows botnets. And speaking of poor security (inherent in secret code), here is another new report, among many similar ones.

Chinese and Russian cyberspies have hacked into the U.S. electrical grid and have left behind software that could be used to interfere with the system, a report said Wednesday.

The original report comes from the Wall Street Journal (thus requiring subscription), but the message is clear. This facility runs a legacy proprietary system that experts have warned about for quite some time.

Here ends another daily lesson about security and obscurity. They have a reverse relationship. There is evidence that shows GNU/Linux to be more secure.

“Two security researchers have developed a new technique that essentially bypasses all of the memory protection safeguards in the Windows Vista operating system…”

Dennis Fisher

“It is no exaggeration to say that the national security is also implicated by the efforts of hackers to break into computing networks.”

Jim Allchin, Microsoft

Share this post: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Digg
  • del.icio.us
  • Reddit
  • co.mments
  • DZone
  • email
  • Google Bookmarks
  • LinkedIn
  • NewsVine
  • Print
  • Technorati
  • TwitThis
  • Facebook

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

7 Comments

  1. Yggdrasil said,

    April 9, 2009 at 11:39 am

    Gravatar

    You stole my tag line, but what’s worse, you misused it to smear Microsoft. “Security through obscurity” is generally only applicable to the operating system. It explains why Linux doesn’t make a good target because there are so few installations from which to run malicious code. It is however entirely possible to code a program that would stay hidden on a Linux machine and send out Spam or do other nasty things without the user taking notice. NOTHING in the design of Unix or any of it’s clones can prevent this from happening. It is also possible to set a program to run at boot without administrator privileges using some methods linked below this paragraph. This of course assumes there is not an inbound/outbound firewall in use on the machine and the user in question doesn’t routinely inspect their own system to see which of 90+ processes running on a Linux system do not belong.

    http://www.geekzone.co.nz/foobar/6229

    The articles you link make a few things clear that you did not mention. Many of these bot net machines were infected by users who either opened email attachments or were using outdated software that had been patched sometimes years in advance. Even the security vulnerability in the US power grid software was made public in May of last year:

    http://www.coresecurity.com/content/wonderware

    You would expect us to believe that if Wonderware were to open source (there fore not obscure, but in awareness, not numbers) it’s own software, then the operators of these power plants would have taken the time to read through the entire source code themselves and find the vulnerability long before it ever become a problem. You simply expect too much in a world where even when others take the time to find and make patches available, the end users sit on their backside. The only alternative would be to apply forced updates, but then your run into larger problems with people paranoid about their systems doing things they did not approve of. Computers security as as much a human problem as it is a software problem, but it’s so much easier to simply blame one large “evil” corporation.

    Roy Schestowitz Reply:

    You stole my tag line, but what’s worse, you misused it to smear Microsoft.

    Not only Microsoft is mentioned here.

    “Security through obscurity” is generally only applicable to the operating system.

    I disagree. An operating system is a very large program or a combination of many.

    It explains why Linux doesn’t make a good target because there are so few installations from which to run malicious code.

    Really?

    “Forty percent of servers run Windows, 60 percent run Linux…”

    Steve Ballmer (September 2008)

    It is however entirely possible to code a program that would stay hidden on a Linux machine and send out Spam or do other nasty things without the user taking notice. NOTHING in the design of Unix or any of it’s clones can prevent this from happening. It is also possible to set a program to run at boot without administrator privileges using some methods linked below this paragraph. This of course assumes there is not an inbound/outbound firewall in use on the machine and the user in question doesn’t routinely inspect their own system to see which of 90+ processes running on a Linux system do not belong.

    http://www.geekzone.co.nz/foobar/6229

    There were rebuttals to it. With secure Linux installations there are also sandboxes and it’s hard to compromise entire machines.

    The articles you link make a few things clear that you did not mention. Many of these bot net machines were infected by users who either opened email attachments or were using outdated software that had been patched sometimes years in advance.

    What about PowerPoint users right now (still unpatchable)? Or many unpatched flaws that required no user intervention? Where are attachments dispatched from in the first place? Windows botnets maybe?

    Even the security vulnerability in the US power grid software was made public in May of last year:

    http://www.coresecurity.com/content/wonderware

    Yes, already noted in my post.

    You would expect us to believe that if Wonderware were to open source (there fore not obscure, but in awareness, not numbers) it’s own software, then the operators of these power plants would have taken the time to read through the entire source code themselves and find the vulnerability long before it ever become a problem.

    This misses the core of the argument. Non-free software procrastinates fixes due to lack of a sense of urgency. The code is not visible.

    You simply expect too much in a world where even when others take the time to find and make patches available, the end users sit on their backside. The only alternative would be to apply forced updates, but then your run into larger problems with people paranoid about their systems doing things they did not approve of. Computers security as as much a human problem as it is a software problem, but it’s so much easier to simply blame one large “evil” corporation.

    The U.S. electrical grid is not a corporation. As for Microsoft, please explain why it says “our products just aren’t engineered for security.”

    Court exhibits show that this was never designed to be secure.

    Yggdrasil Reply:

    Again, you don’t look at the full picture, on purpose. 60 percent of servers run Linux? For that sake of argument, let’s assume that number is accurate. OK, great….. but as I’ve had to explain to you before, that’s a SMALL percentage of the TOTAL NUMBER of machines in use around the world. Servers normally don’t have people sitting in front of them shopping on eBay or playing Half-Life. The security issues that face servers are different than those that face home users. Can you grasp that? Can you get a handle on the numbers? As I stated:

    “Linux doesn’t make a good target because there are so few installations from which to run malicious code.”

    Is it accurate for me to say “so few”? Yes, Roy, because “60% of servers” is only impressive until you realize that servers make up a small percentage of ALL computers. Users outnumber servers, plain and simple. As unpleasant as it may be for you, the fact is that Linux is not a good target for botnets or malware because there are so few targets to choose from. There are security issues in Linux that will never need to be addressed because it will not achieve a majority market share.

    By the way, the last 2 links in your reply are broken. I’m sure you have a catalog of every anti-Microsoft article in existence, but it might be update it and get some fresh material. The quote you reference is from a 2002 article that referenced Windows 2000, but lacked any real technical specifics.

  2. Balrog said,

    April 9, 2009 at 12:29 pm

    Gravatar

    > The U.S. electrical grid is not a corporation. As for Microsoft, please explain why
    > it says “our products just aren’t engineered for security.”

    Looks like InfoWorld broke the link. See
    http://web.archive.org/web/20080209124930/http://www.infoworld.com/articles/hn/xml/02/09/05/020905hnmssecure.html
    for the article.

  3. Charles Oliver said,

    April 9, 2009 at 7:57 pm

    Gravatar

    Thanks for the link Balrog.

    One of the stand out quotes from that page was this:

    “Microsoft has also been employing new tools developed by Microsoft Research that are designed to detect errors in code during the development process, Valentine said.”

    I remember reading (possibly on el reg) about MS big upping another bug hunting tool just recently. It seems they’ve had a lot of these. I wonder why they don’t seem to help?

    Roy Schestowitz Reply:

    They tend to release prematurely; Apple does the same thing by the way. Even Wozniak ranted about it.

    Charles Oliver Reply:

    Kind of release early, release infrequently.

What Else is New


  1. Links 25/5/2020: Wrapland Redone, DebConf20 Plans, Many More Games

    Links for the day



  2. Media Covers WSL Like People Actually Use This Trash (a Failed Distro Which Only Works With Windows)

    Lots of abundantly redundant puff pieces have appeared in paid-for (by Microsoft) media this past week covering WSL/2, but that's grossly disproportional to the people who care and actually use those types of things (because money talks, not technical substance)



  3. Working From Home on Patent Monopolies Would Lower Their Quality and Perceived Legitimacy

    The patent system wherein people grant monopolies from their sofas and bedrooms isn't helping the already-eroded perception/image of patent offices that mostly grant patents to massive multinationals (and far too many patents overall)



  4. The Attitude of António Campinos Toward Courts and Toward Justice Same as Benoît Battistelli's

    6 years down the road we're still dealing with unaccountable tyrants who laugh at the law, laugh at lawmakers and disregard law enforcers (like the Trump regime across the Atlantic)



  5. IRC Proceedings: Sunday, May 24, 2020

    IRC logs for Sunday, May 24, 2020



  6. Asking Microsoft If It Loves Linux is Like Asking Google If It's Evil

    The media keeps bombarding us with lousy, weakly-sourced messages about Microsoft regretting its stance on “Open Source” and loving “Linux” (both are lies that are very easily debunked), so journalism has an existential problem and maybe too much dependence on ad money (a form of bribery) from “Big Tech” that does “clown computing” and “apps”



  7. Features Considered Harmful

    "But the benefits of Free software, free candy and new features are all meaningless, if the user isn't in control."



  8. Free, as in “App”

    "As everyday users, we need to be able to configure our applications, and this process must/needs to be made as easy and understandable as possible."



  9. Links 25/5/2020: Linux 5.7 RC7 and TeleIRC 2.0.0

    Links for the day



  10. Links 24/5/2020: TUXEDO Computers on AMD, Ardour 6.0 is Out

    Links for the day



  11. Trust Microsoft With Everything Including Your Life

    A timely if not apt meme about the state of Windows-powered hospitals, which very often end up foreign-operated (taken over by crackers in another country)



  12. When the Response to Hospitals Being Systematically Cracked Through Microsoft Products Like Windows is... Blocking the Competition of Microsoft

    People keep dying because Microsoft Windows, poorly designed with NSA back doors in it, falls into the hands of malicious actors (sometimes overseas, sometimes using leaked tools of the NSA itself) and guess who takes the blame when hospitals grind to a halt due to this…



  13. IRC Proceedings: Saturday, May 23, 2020

    IRC logs for Saturday, May 23, 2020



  14. Ode to the 'Orange One'

    Bush Senior and Junior, Hillary/Bill Clinton and now António Battistelli (or Benoît Campinos); are we dealing with monarchies/monarchs and pledges of allegiance or with public institutions beholden to the public, to be governed by the law?



  15. Home Working at the EPO: Your Corporate, Global Monopolies Will Be Rubber-stamped From Private Homes

    We’re expected to believe that EPO employees working under the noses of Microsoft (in another continent!) with kids running around will be able to be both productive and professional; staff already complains about working until midnight and beyond, without any conceivable separation between career and personal life



  16. To Understand Why “Inner Source” is a Cheap Corporate Ploy if Not a Free Software-Hostile 'Scam' Look Who's Behind It

    It's rather easy to see that the O'Reilly-connected and Bill Gates-connected leadership of InnerSource Commons (ISC) doesn't register this fake 'charity' to promote Software Freedom but to fight against it under the guise of "open" (openwashing)



  17. Microsoft: We Were Wrong About Open Source and That's Why We 'Liberate' Code... From 1983 (and We Won't Accept Code Changes, Either!)

    The tiresome openwashing efforts from Microsoft verge on the farcical, but the Microsoft-funded media plays along with it all regardless



  18. The Unitary Patent and Unified Patent Court Book

    The Unified Patent Court (UPC) propaganda must be confronted; there's a book in the making about UPC lies and the anatomy of this legislative coup attempt by litigation fanatics (who profit from monopolies, patent trolls and so on)



  19. Links 23/5/2020: Oracle Solaris 11.4 SRU21, Wine-Staging 5.9

    Links for the day



  20. Spillover: Team UPC Trying to Fill Up the Cup 'Half Empty'

    The European Patent Office's (EPO) corruption is mirrored in UPC corruption; the former hasn't yet seen its downfall due to this corruption and the latter is already up in flames, no matter how media sites (are paid to) spin it, giving false hope for the sake of lobbying by Team UPC



  21. The EPO Continues to Publicly Brag About Granting Illegal Patents to Fake 'Production' (It's Not Really Production But Abuse of the Granting Authority)

    Patents on life, nature and mathematics serve to highlight the degree of corruption embraced by EPO management, eager to fake ‘production’ in order to hoard money, which is then stolen and misused in other ways



  22. GNOME Settlement With Patent Troll Fails to Address/Tackle the Software Patent and Software Patents in General

    GNOME settles with the troll on terms that are superficially friendly towards Free software; however, more could be done to actually defuse matters on legal if not precedential grounds



  23. IRC Proceedings: Friday, May 22, 2020

    IRC logs for Friday, May 22, 2020



  24. Fiduciary Technology: Why It's Often Impermissible to Use Microsoft (But It's Done Anyway)

    "As such and if your CTO isn’t actively moving tooling out of the Microsoft ecosystem like bailing water out of a sinking ship, then you should probably be looking for a new CTO."



  25. Links 23/5/2020: FreeBSD 11.4 RC1, Wine 5.9

    Links for the day



  26. Links 22/5/2020: App Icon Preview 2.0.0, dav1d 0.7.0, LibreOffice's New Icons

    Links for the day



  27. Freedom Is Not Possible Without Privacy

    Privacy was the subject of today's feature article; let's not forget how essential a concept it is to guard against encroachments, no matter the given excuses



  28. IRC Proceedings: Thursday, May 21, 2020

    IRC logs for Thursday, May 21, 2020



  29. How Surveillance Works: A Primer

    "We are expected to carry around devices that violate our rights and deprive us of liberty, against our wishes and despite reasonable and valid protest. These devices take something sacred from us -- they are an attack on our humanity, and they make us live more like livestock."



  30. The Industrial Revolution 5.0 (or 6.0) -- Symptom of Totally Incompetent Management at the European Patent Office

    European Patent Office (EPO) management is technically, in effect, incompetent; it's like the Office is run by a bunch of children with no skills other than name-dropping buzzwords and bullcrap


RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts