EditorsAbout the SiteComes vs. MicrosoftUsing This Web SiteSite ArchivesCredibility IndexOOXMLOpenDocumentPatentsNovellNews DigestSite NewsRSS

09.08.09

Eye on Microsoft: The Security Comedy Resumes

Posted in Microsoft, Security, Windows at 2:46 am by Dr. Roy Schestowitz

Penguin bubbles

Summary: A roundup of Microsoft’s latest examples of poor performance at securing its software

Microsoft’s incapability with security has already cost the economy trillions of dollars. Some days ago we wrote about the impact on parts of national operations that are funded by taxpayers; they too pay the toll.

Conficker borks London council

[...]

The May incident took several days to clean-up and landed the west London council with a bill of £500,000 in lost revenue and repairs, The Guardian reports. Because IT systems were borked, the council was unable to process more than 1,800 parking tickets, at an estimated cost of £90,000, libraries lost out on £25,000 in fines and booking fees, council property rent went uncollected, and £14,000 was spent in overime sorting out delayed housing benefit claims.

Some time ago we also wrote about IIS coming under siege. It is getting worse:

New IIS attacks (greatly) expand number of vulnerable servers

[...]

Attackers have begun actively targeting an unpatched hole in Microsoft’s Internet Information Services webserver using new exploit code that greatly expands the number of systems that are vulnerable to the bug.

3rd parties jump to Microsoft’s (or their customers’/users’) rescue. This is also covered in:

Exploit code affecting the FTP module for certain versions of Microsoft IIS has been posted online. US-CERT recommends taking countermeasures.

Another press release heralds another security problem in Microsoft’s stack. Microsoft is investigating and denying it.

For more than a year, Microsoft has been sitting on a purported SQL Server vulnerability that could enable a malicious insider to obtain users’ passwords, claims database security vendor Sentrigo.

There is also coverage in Dark Reading and net-security.org, which states:

Sentrigo has discovered a vulnerability in Microsoft SQL Server that allows any user with administrative privileges to openly see the unencrypted passwords of other users, or the credentials presented by applications accessing the server using SQL Server authentication.

More reasons are given to believe that Vista 7 will persist with the same security problems of Vista. A company warns about UAC.

While changes to Windows 7’s UAC benefit the home user market, enterprises must be aware that the new “slider” feature is only for administrators and may increase security risks.

Applications with an anti-viral goal still show that they may cause more trouble than it’s all worth.

McAfee false alert snares innocent JavaScript files

[...]

Faulty virus definition updates from McAfee that flagged legitimate JavaScript files as potentially malign caused a headache for some sysadmins earlier this week.

In other news:

Compromised Computers Host an Average of 3 Malware Families

[...]

Unfortunately, we are talking about infected files and not doughnuts. According to security company ESET, the average compromised machine is home to 13 infected files as well as malicious programs from three different malware families.

Liability issues linger on:

An Illinois district court has allowed a couple to sue their bank on the novel grounds that it may have failed to sufficiently secure their account, after an unidentified hacker obtained a $26,500 loan on the account using the customers’ user name and password.

Given the scale of botnets, nobody should be left surprised. Systems which were not built to be secure in the first place can never be properly secured.

“Our products just aren’t engineered for security.”

Brian Valentine, Microsoft executive

Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Reddit
  • email
  • Slashdot

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

What Else is New


  1. In Spite of IBM's Difficult Past and Particularly Dark History, Under Arvind Krishna’s Leadership It Has Only Shown Signs of Improving

    This winter, 6 months after Arvind Krishna’s tenure as CEO began, we can generally say that things seem to have improved and we look forward to further improvements



  2. Links 25/10/2020: GNU Taler's IETF Milestone, RISC OS 5.28 and New Ubuntu Community Council

    Links for the day



  3. IRC Proceedings: Saturday, October 24, 2020

    IRC logs for Saturday, October 24, 2020



  4. Links 24/10/2020: GDB 10.1, Kodachi 7.4, Wine 5.20

    Links for the day



  5. Celebrating Code of Conduct Violations

    Reprinted with permission from Daniel Pocock



  6. The Militarised Elephant in the Room Still Commands a Lot of Free Software Development

    We take a difficult (albeit in-depth and perfectly factual) look at IBM's past and present; considering this is the company that controls Red Hat (which in turn controls many key projects in GNU/Linux) we need a better understanding of the real context, not PR fluff and marketing



  7. Juve Patent's Love of Patent Trolls and Their Misinformation

    The press 'gutter' known as Juve (basically propaganda disguised as 'news' since years ago) has gotten to the point where the publisher is just an extension of lawyers and liars



  8. IRC Proceedings: Friday, October 23, 2020

    IRC logs for Friday, October 23, 2020



  9. Look How Many Tux I Give!

    "Long live rms, long live (Hyperbola) GNU/BSD, and happy hacking."



  10. Embrace, Extend, and Extensions: Two New Reasons to Delete GitHub, Which Microsoft Ruined for Everyone (Except the Copyright Cartel and Other Censors)

    GitHub is being turned into a garbage dump with malicious masters (or monsters, or mobsters); many people are denied access for using the 'wrong' browser and developers/projects are being censored (not for doing anything wrong or illegal, either)



  11. [Meme] When EPO Staff Claims to be 'Ill' or 'Sick'... During a Pandemic's European Peak

    Gotta check and verify that those 'lazy' EPO examiners aren't just faking being ill (in order to not meet "production" targets)



  12. The EPO Has Relegated or Lowered Itself to Extremely Poor Standards

    Today's EPO continues to reaffirm the image of global weakness; having failed to improve the working conditions and quality of the work (its actions did the exact opposite), it's nowadays begging China to send over lots of workload irrespective of quality or merit and it is outsourcing the functions of the Office to the United States



  13. Links 23/10/2020: Turing Pi 2, GNU Parallel 20201022

    Links for the day



  14. IRC Proceedings: Thursday, October 22, 2020

    IRC logs for Thursday, October 22, 2020



  15. Links 23/10/2020: 'Groovy Gorilla' Everywhere in the News

    Links for the day



  16. For Better 'Tech Rights' in the United States (and the World at Large) the 'Orange Man' Needs to Go

    With less than a fortnight before election day we explain our stance from a purely tech-related rationale



  17. [Meme] Microsoft Never 'Brought' Skype to GNU/Linux (It Just Bought Skype) and It Never 'Brought' Edge to GNU/Linux Either (Google Did)

    Foolish media or gullible 'journalists' are giving Microsoft credit for other people's work; this isn't the first time either, but it helps perpetuate lies such as "Microsoft loves Linux" (so who cares about facts anyway?)



  18. It's Going to be a Long, Long Winter

    Today we revert back to lock-down mode; we're reflecting and pondering what comes next



  19. TechRadar is an Irresponsible Clickbait and Misinformation Site Disguised as 'News'

    TechRadar is no tech and no radar, either. It's just an opportunistic click-harvesting machine, disguised as a source of "news"; today we deal with the latest example (among many).



  20. Links 22/10/2020: LibreOffice 6.4.7, Septor 2020.5, Ubuntu 20.10 Released, FreeBSD Quarterly Status Report

    Links for the day



  21. IRC Proceedings: Wednesday, October 21, 2020

    IRC logs for Wednesday, October 21, 2020



  22. Living Humbly (With Older Technology or None) is More Compatible With Privacy- and Freedom-Respecting Technological Lifestyle

    Simplicity sometimes trumps so-called 'novelty', especially when it comes to human rights and users' freedom



  23. Reasons Why You (and Everybody Else) Should Join the Fight for Software Freedom

    Society is being closely watched and controlled (more so during/after the latest pandemic) and people must carefully consider the true importance of resisting proprietary technology (controlled remotely by state actors)



  24. Ways and Means to Reduce One's Dependency on Google's Various Monopolies and Near-Monopolies

    Getting rid of Google means a lot more than embracing DumbDumbGo (DDG) or some other sites that spy just like Google; we're taking stock of some options



  25. The European Commission is Still M.I.A. Regarding EPO Corruption (and the EPO's Management Plays Dirty, as Always)

    There's no change in the EU; the EUIPO and EPO enjoy complete and total immunity/impunity, with the Commission being manned by those who are deeply complicit



  26. 10 Reasons Why All This 'Edge for Linux' Coverage is a Total Farce

    The fake hype surrounding "Edge" is an inauthentic hype/buzz campaign made to coincide with anti-Google sentiments spread by Microsoft front/pressure groups



  27. Microsoft's IIS Has Collapsed Again This Past Month (and IIS Will Not and Cannot Survive This Way)

    Netcraft shows that Microsoft's decline further accelerates in the Web servers space; IIS is becoming financially unviable



  28. Links 21/10/2020: Alpine 3.12.1, Tor Browser 10.0.2

    Links for the day



  29. [Meme] US Department of Justice Should Have Taken on Microsoft Again, Not Google

    When lobbying, connections and political sway determine the actions of the American government it's hardly surprising that Bill Gates gets the Trump administration to fight for him (to make him even richer)



  30. [Meme] Banning Words, Gaslighting Volunteers

    What happens when institutions are themselves in violation of a CoC (institutional violation) and massive corporations that fund such institutional violations are defending demonisation of the individual (squashing ‘uncomfortable’ voices, even volunteers’)


RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts