09.08.09

Gemini version available ♊︎

Eye on Microsoft: The Security Comedy Resumes

Posted in Microsoft, Security, Windows at 2:46 am by Dr. Roy Schestowitz

Penguin bubbles

Summary: A roundup of Microsoft’s latest examples of poor performance at securing its software

Microsoft’s incapability with security has already cost the economy trillions of dollars. Some days ago we wrote about the impact on parts of national operations that are funded by taxpayers; they too pay the toll.

Conficker borks London council

[...]

The May incident took several days to clean-up and landed the west London council with a bill of £500,000 in lost revenue and repairs, The Guardian reports. Because IT systems were borked, the council was unable to process more than 1,800 parking tickets, at an estimated cost of £90,000, libraries lost out on £25,000 in fines and booking fees, council property rent went uncollected, and £14,000 was spent in overime sorting out delayed housing benefit claims.

Some time ago we also wrote about IIS coming under siege. It is getting worse:

New IIS attacks (greatly) expand number of vulnerable servers

[...]

Attackers have begun actively targeting an unpatched hole in Microsoft’s Internet Information Services webserver using new exploit code that greatly expands the number of systems that are vulnerable to the bug.

3rd parties jump to Microsoft’s (or their customers’/users’) rescue. This is also covered in:

Exploit code affecting the FTP module for certain versions of Microsoft IIS has been posted online. US-CERT recommends taking countermeasures.

Another press release heralds another security problem in Microsoft’s stack. Microsoft is investigating and denying it.

For more than a year, Microsoft has been sitting on a purported SQL Server vulnerability that could enable a malicious insider to obtain users’ passwords, claims database security vendor Sentrigo.

There is also coverage in Dark Reading and net-security.org, which states:

Sentrigo has discovered a vulnerability in Microsoft SQL Server that allows any user with administrative privileges to openly see the unencrypted passwords of other users, or the credentials presented by applications accessing the server using SQL Server authentication.

More reasons are given to believe that Vista 7 will persist with the same security problems of Vista. A company warns about UAC.

While changes to Windows 7’s UAC benefit the home user market, enterprises must be aware that the new “slider” feature is only for administrators and may increase security risks.

Applications with an anti-viral goal still show that they may cause more trouble than it’s all worth.

McAfee false alert snares innocent JavaScript files

[...]

Faulty virus definition updates from McAfee that flagged legitimate JavaScript files as potentially malign caused a headache for some sysadmins earlier this week.

In other news:

Compromised Computers Host an Average of 3 Malware Families

[...]

Unfortunately, we are talking about infected files and not doughnuts. According to security company ESET, the average compromised machine is home to 13 infected files as well as malicious programs from three different malware families.

Liability issues linger on:

An Illinois district court has allowed a couple to sue their bank on the novel grounds that it may have failed to sufficiently secure their account, after an unidentified hacker obtained a $26,500 loan on the account using the customers’ user name and password.

Given the scale of botnets, nobody should be left surprised. Systems which were not built to be secure in the first place can never be properly secured.

“Our products just aren’t engineered for security.”

Brian Valentine, Microsoft executive

Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Reddit
  • email

Decor ᶃ Gemini Space

Below is a Web proxy. We recommend getting a Gemini client/browser.

Black/white/grey bullet button This post is also available in Gemini over at this address (requires a Gemini client/browser to open).

Decor ✐ Cross-references

Black/white/grey bullet button Pages that cross-reference this one, if any exist, are listed below or will be listed below over time.

Decor ▢ Respond and Discuss

Black/white/grey bullet button If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

DecorWhat Else is New


  1. 2023 is the Year Taxpayers' Money Goes to War and Energy Subsidies, Not Tech

    Now that a lot of powerful and omnipresent ‘tech’ (spying and policing) companies are rotting away we have golden opportunities to bring about positive change and maybe even recruit technical people for good causes



  2. Getting Back to Productive Computer Systems Would Benefit Public Health and Not Just Boost Productivity

    “Smartphoneshame” (shaming an unhealthy culture of obsession with “apps”) would potentially bring about a better, more sociable society with fewer mental health crises and higher productivity levels



  3. Links 04/02/2023: This Week in KDE and Many More Tech Layoffs

    Links for the day



  4. Dotcom Boom and Bust, Round 2

    The age of technology giants/monopolies devouring everything or military-funded (i.e. taxpayers-subsidised) surveillance/censorship tentacles, in effect privatised eyes of the state, may be ending; the United States can barely sustain that anymore and raising the debt ceiling won't solve that (buying time isn't the solution)



  5. Society Would Benefit From a Smartphoneshame Movement

    In a society plagued by blackmail, surveillance and frivolous lawsuits it is important to reconsider the notion of “smart” phone ownership; these devices give potentially authoritarian companies and governments far too much power over people (in the EU they want to introduce new legislation that would, in effect, ban Free software if it enables true privacy)



  6. IRC Proceedings: Friday, February 03, 2023

    IRC logs for Friday, February 03, 2023



  7. IRC Proceedings: Thursday, February 02, 2023

    IRC logs for Thursday, February 02, 2023



  8. Links 03/02/2023: Proton 7.0-6 Released, ScummVM 2.7 Testing

    Links for the day



  9. Links 03/02/2023: OpenSSH 9.2 and OBS Studio 29.0.1

    Links for the day



  10. Links 03/02/2023: GNU C Library 2.37

    Links for the day



  11. Sirius Finished

    Yesterday I was sent a letter approving my resignation from Sirius ‘Open Source’, two months after I had already announced that I was resigning with immediate effect; they sent an identical letter to my wife (this time, unlike before, they remembered to also change the names!!)



  12. The Collapse of Sirius in a Nutshell: How to Identify the Symptoms and Decide When to Leave

    Sirius is finished, but it's important to share the lessons learned with other people; there might be other "pretenders" out there and they need to be abandoned



  13. Links 03/02/2023: WINE 8.1 and RapidDisk 9.0.0

    Links for the day



  14. Links 02/02/2023: KDE Gear 22.12.2 and LibreOffice 7.5

    Links for the day



  15. Linux News or Marketing Platform?

    Ads everywhere: Phoronix puts them at the top, bottom, navigation bar, left, and right just to read some Microsoft junk (puff pieces about something that nobody other than Microsoft even uses); in addition there are pop-ups asking for consent to send visitors’ data to hundreds of data brokers



  16. Daily Links at Techrights Turn 15, Time to Give Them an Upgrade

    This year we have several 15-year anniversaries; one of them is Daily Links (it turned 15 earlier this week) and we've been working to improve these batches of links, making them a lot more extensive and somewhat better structured/clustered



  17. Back to Focusing on Unified Patent Court (UPC) Crimes and Illegal Patent Agenda, Including the EPO's

    The EPO's (European Patent Office, Europe's second-largest institution) violations of constitutions, laws and so on merit more coverage, seeing that what's left of the "media" not only fails to cover scandalous things but is actively cheering for criminals (in exchange for money)



  18. European Patent Office Staff Votes in Favour of Freedom of Association (97% of Voters in Support)

    The Central Staff Committee (CSC) at the EPO makes a strong case for António Campinos to stop breaking and law and actually start obeying court orders (he’s no better than Benoît Battistelli and he uses worse language already)



  19. Links 02/02/2023: Glibc 2.37 and Go 1.20

    Links for the day



  20. IRC Proceedings: Wednesday, February 01, 2023

    IRC logs for Wednesday, February 01, 2023



  21. Links 01/02/2023: Security Problems, Unrest, and More

    Links for the day



  22. Links 01/02/2023: Stables Kernels and Upcoming COSMIC From System76

    Links for the day



  23. IRC Proceedings: Tuesday, January 31, 2023

    IRC logs for Tuesday, January 31, 2023



  24. Links 31/01/2023: Catchup Again, Wayland in Xfce 4.20

    Links for the day



  25. Links 31/01/2023: elementary OS 7

    Links for the day



  26. Intimidation Against Nitrux Development Team Upsets the Community and Makes the Media Less Trustworthy

    Nitrux is being criticised for being “very unappealing”; but a look behind the scenes reveals an angry reviewer (habitual mouthpiece of the Linux Foundation and Linux foes) trying to intimidate Nitrux developers, who are unpaid volunteers rather than “corporate” developers



  27. Links 31/01/2023: GNOME 44 Wallpapers and Alpha

    Links for the day



  28. Free and Open Source Software Developers' European Meeting (FOSDEM) and KU Leuven Boosting Americans and Cancellers of the Father of Free Software

    The Free Software Foundation (FSF) and its founder, Richard M. Stallman (RMS), along with the SFLC one might add, have been under a siege by the trademark-abusing FSFE and SFC; Belgium helps legitimise the ‘fakes’



  29. Techrights in the Next 5 or 10 Years

    Now that I’m free from the shackles of a company (it deteriorated a lot after grabbing Gates Foundation money under an NDA) the site Techrights can flourish and become more active



  30. 60 Days of Articles About Sirius 'Open Source' and the Long Road Ahead

    The Sirius ‘Open Source’ series ended after 60 days (parts published every day except the day my SSD died completely and very suddenly); the video above explains what’s to come and what lessons can be learned from the 21-year collective experience (my wife and I; work periods combined) in a company that still claims, in vain, to be “Open Source”


RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts