EditorsAbout the SiteComes vs. MicrosoftUsing This Web SiteSite ArchivesCredibility IndexOOXMLOpenDocumentPatentsNovellNews DigestSite NewsRSS

07.10.09

The Windows Security Theatre

Posted in Apple, Microsoft, Security, Windows at 1:43 am by Dr. Roy Schestowitz

Airport

Summary: Many security reports from The Register and little more of the rest

McAfee is far from a friend of Free software [1, 2] and its remedies for Windows may sometimes cause more harm than good. Here is a fresh new example of why this paradigm of sold-separately bolted-on security software simply does not work. To quote, “IT admins across the globe are letting out a collective groan after servers and PCs running McAfee VirusScan were brought down when the anti-virus program attacked their core system files. In some cases, this caused the machines to display the dreaded blue screen of death.”

One of our readers says that “admins use Knoppix to fix borked McAfee antivirus” and he points to this new example where someone suggests: “For servers with BSOD we have used knoppix live cd to move files from quarantine to original place…”

In other news, Microsoft is preparing patches for flaws that enable hijacking of Windows, probably remotely. These flaws are very serious. Some of them are already being actively exploited (without a solution available).

Microsoft on Tuesday plans to release updates patching three critical Windows security vulnerabilities, two of which are already under attack.

Attacks must always precede reaction in Microsoft's case.

Why might this happen? Well, maybe because, according to some more news, Microsoft has knowingly ignored a serious flaw for a year. It is so typical.

Microsoft knew of nasty IE bug a year before attacks

The disclosure comes as attacks targeting the MSVidCtl ActiveX control vulnerability have increased exponentially. On Monday, online ads distributed by through the Giant Realm network on popular gaming websites began including code that exploits the bug, according to security firm ScanSafe. The ads mean that anyone using IE to browse sites such as diii.net and incgamers.com are risk if they run the XP or 2003 versions of Windows and have not yet installed a quick fix.

We have already shown that Microsoft deliberately hides its flaws. Victims of this careless, selfish behaviour are all of us who receive spam from hundreds of millions of Windows zombies. To rephrase the news (The Register again), spam levels have returned to normal.

Victims may include more hospitals too, according to this last bit of news from The Register.

The leader of a malicious hacker collective who used his job as a security guard to breach sensitive Texas hospital computers has been arrested just days before his group planned a “massive DDoS” attack for the July 4 Independence Day holiday.

Hospitals are hit by Windows viruses on a very regular basis this year [1, 2, 3, 4] and according to this article from Sam Varghese Microsoft is profiteering from it.

How Microsoft benefits from Conficker

Microsoft experts were among consultants called in by the council – and they took home some of the £1.2 million which the body paid out to get the problem resolved. Exactly how much was paid to the different consultants was not divulged.

In reference to some of these shocking figures, one of our readers asks, “What can be bought?” He uses Manchester as an example:

There was a recent article about the UK city of Manchester which just paid nearly $2.5 million in clean up for the Windows worm Conficker. That’s one worm in one city.

If we take some numbers for the sake of argument and play with them, what could we buy with $2.5 million.

Say for the sake of argument that top developers (in several fields of computing) and UI designers cost $100,000 apiece including insurance, pensions, equipment and work space rental. That would provide for a team of 10 for 25 years, or a team of 25 for 10 years, etc.

So for a decade, for the same price, Manchester could work out a re-packaging of Fedora and some needed applications:

5 development engineers
5 deployement engineers
5 HCI specialists
10 half-time support
3 full-time support
2 managers / marketeers

The magnitude of the money lost pursuing the Windows ideology is mind-boggling.

Contrary to common belief (mind the interesting comments), Microsoft could really use some money which is made through its own incompetence. The reality of the matter is that Microsoft has faltered for years (even financially) and it now amasses some debt.

But going back to this subject of security, Heise reports show that Apple is no role model either, not with its proprietary, DRM-locked phones.

iPhone 3GS cracked

[...]

The Dev Team are well known for their free iPhone jailbreaking and unlocking tools (QuickPwn, PwnageTool, Yellowsn0W, etc.), however, they have yet to release a tool that’s compatible with the 3GS and version 3.0 of the iPhone software.

Symbian faces challenges too. Symbian is still proprietary (in phases of transition).

Security on Symbian mobiles: Early signs of crumbling

[...]

At the recent Pwn2Own 2009 security contest, none of the competitors succeeded in hacking a Symbian mobile.

Free Software Magazine has a good new comic on that subject of security.

Share this post: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Digg
  • del.icio.us
  • Reddit
  • co.mments
  • DZone
  • email
  • Google Bookmarks
  • LinkedIn
  • NewsVine
  • Print
  • Technorati
  • TwitThis
  • Facebook

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

2 Comments

  1. David Gerard said,

    July 10, 2009 at 6:01 am

    Gravatar

    There are enough people in Symbian trying to make it really open source and to operate as a bazaar, not a cathedral (as Netscaspe and OpenOffice fell into). It’s a long haul, though, for an owned corporate open source project. Remember that the “cathedral” examples in The Cathedral And The Bazaar were free software, not proprietary.

    Roy Schestowitz Reply:

    I think it was David (Woods?) from Symbian who made remarks that are hostile towards the GPL and factually incorrect. Symbian is more into “open source” (Eclipse). Then there’s DRM and their landmark software patents case in the UK.

What Else is New


  1. Links 13/11/2019: Docker Enterprise Bought, WordPress 5.3, Qt 5.12.6 Released

    Links for the day



  2. Rebranding Malware and Spyware as 'Linux' to Dilute the Brand (and the News)

    Signal-to-noise ratio continues to be reduced, as a lot of "Linux" news has nothing to do with GNU/Linux or even with Free software



  3. Understanding Thierry Breton: In the Beginning...

    Career roundup of Thierry Breton, possibly the next EU Commissioner



  4. Startpage Has Been Delisted, But it Ought to be Blacklisted

    Startpage has just warned its fans (I am a former fan) of what Startpage itself covertly became months back



  5. IRC Proceedings: Tuesday, November 12, 2019

    IRC logs for Tuesday, November 12, 2019



  6. Links 12/11/2019: Plasma 5.17.3, More Intel Defects, Bytecode Alliance

    Links for the day



  7. You've Gotta Go When You've Gotta Go

    How most staff of the European Patent Office (EPO) feels these days



  8. Teaser: Thierry Breton and His Disquieting Past

    "The company attracted notoriety and loathing in the UK for its role in assessing disability benefit eligibility."



  9. EPO and EU: People Behind the Faces

    It’s no secret that the EPO breaks the law and European officials have taken no concrete steps to intervene; to make matters worse, potentially new EPO allies may soon be put in charge of the EU Commission



  10. Maintaining the 'Delete Github' page

    "This list really is a starting point, which can hopefully increase awareness about the issue of concern."



  11. Linux Foundation Picking Money

    The dating standards of the Linux Foundation



  12. Microsoft 'Borrows' the Linux Brand

    With help from the likes of the Linux Foundation Microsoft continues to misuse and ‘dilute’ the Linux brand (and registered trademark)



  13. EPO Corruption Compared to Cocaine Scandals in Antwerp

    Days after the Dutch protest discussion is sort of 'uncorked' regarding EPO corruption (published, as usual, in the form of anonymous comments)



  14. SUEPO Showed That the Media Won't Cover EPO Corruption Until Half the Workers March in the Streets

    What ought to have been a central (if not 'the' central) issue of debate in Europe is still being treated as borderline irrelevant or marginal



  15. Meanwhile in California

    News from California is being spun by Microsoft this week, owing to weak journalism that's more like PR than journalism



  16. Privacy-Centric Services and Even Drupal/Acquia Defect to the Camp of Mass Surveillance

    In search of money [pun intended] companies and services that are supposed to respect their customers and users turn out to be doing the opposite; this merits research and public discussions



  17. IRC Proceedings: Monday, November 11, 2019

    IRC logs for Monday, November 11, 2019



  18. Links 12/11/2019: Sparky 2019.11 Special Editions and Twisted 19.10.0 Released

    Links for the day



  19. Microsoft's Abduction of the Voice of Its Opposition Highlights the Urgency of the Movement/Campaign to Delete GitHub

    Microsoft understands that by entrapping FOSS and GNU/Linux inside proprietary software platforms like GitHub and Azure it can utilise the false perception that it somehow speaks on behalf of both (whilst attacking both)



  20. IRC Proceedings: Sunday, November 10, 2019

    IRC logs for Sunday, November 10, 2019



  21. SUEPO Protests Against Management of the European Patent Office Brought Back Discussions About Corruption

    The atmosphere at the second-largest institution in Europe has long been toxic; now it is becoming a lot more visible again and comments highlight the reasons for the cover-up (gross misuse of billions of euros)



  22. Links 11/11/2019: Linux 5.4 RC7, HandBrake 1.3.0 and Analysis of XFCE

    Links for the day



  23. Links 10/11/2019: digiKam 6.4.0, OpenMandriva Lx 4.1 Alpha and OpenZFS Plans

    Links for the day



  24. Video: Dutch Media on EPO Protest

    The new video added by SUEPO on Saturday in order to show Dutch media coverage of last week's protest in The Hague



  25. Politics in the Workplace Are Not Paradoxical and Outside the Workplace They Are Free Speech

    The safest space is one in which no other human (or creature) exists, but in reality we must make compromises and accept that not everyone will agree with us 100% of the time (so we must learn to live with that)



  26. IRC Proceedings: Saturday, November 09, 2019

    IRC logs for Saturday, November 09, 2019



  27. Thick Skin Makes Strong Communities

    Learning to coexist with people who don't agree on everything is a strength and successful societies encourage that (the alternative is blind conformity on all matters)



  28. Training (Proprietary Software) Versus Teaching (Free Software)

    Education necessitates software freedom — a fact that companies like Adobe, Apple and Microsoft try hard to distract from



  29. The Linux Foundation Brought as Keynote Speakers People Vastly Worse Than Those Whom It Now 'Cancels' for Purely Political Reasons

    A lot of people are very upset about the Linux Foundation's alleged 'witch-hunt' and even press coverage has caught up with the outrage; but our position is that it distracts from vastly bigger Linux Foundation scandals



  30. An Open Letter to Richard Stallman

    "It's past the time for the official cornerstones of the Free software movement to return to their full operational capacity, and to take the gear out of neutral."


RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts