08.12.09
No Lessons Learned from Windows-imposed Web Turbulence
Summary: Nothing at all — except debate — has truly changed as a result of Windows botnets running amok
THE INTERNET as we know it may be stranded at a bit of a crossroad. The persistent DDoS attacks against Twitter have stirred up a discussion about Windows zombies and ways of battling them [1, 2, 3, 4, 5].
Few technologists seem to believe that Windows can ever be secured and the question of liability arose again. Glyn Moody asked whether “Microsoft [should] be liable for its flaws.”
The recent attacks on Twitter and Facebook, probably using Windows botnets, have highlighted an old issue: whether Microsoft should be held responsible for the flaws in its software that cause such costly global downtimes.
At first glance, it’s an attractive option. After all, it could be argued that the company has made billions of dollars of profit from software that has caused billions of dollars of losses for users around the world, and so it would be only fair if some of that unjustly gained dosh were redistributed to those who have suffered at its hands.
Moody is looking for insights and calling for opinions from readers. At the same time, the world learns that Microsoft is patching no less than five “critical” flaws which are remotely exploitable. It never ends.
Microsoft released the expected nine patches – five critical – as part of a busy August Patch Tuesday update that focuses primarily on client-side vulnerabilities.
Here are some more gory details.
The critical holes, which could allow an attacker to remotely run code on a PC and take control of it, affect Windows 2000, Windows XP, Windows Vista, Windows Server 2003 and 2008, Windows Client for the Mac, Office 2000, XP and 2003, Microsoft Office Small Business Accounting 2006, Visual Studio .NET 2003, Microsoft Internet Security and Acceleration Server 2004 and 2006, and BizTalk Server 2002, according to a Microsoft security advisory.
Those new remotely-exploitable Microsoft holes include [1, 2, 3, 4, 5]. Users looking for a secure operating system should have a look at GNU/Linux. █
“Anyone wonder why the Microsoft SQL server is called the sequel server? Is that because no matter what version it’s at there’s always going to be a sequel needed to fix the major bugs and security flaws in the last version?”
–Unknown
