11.17.09
Impact of Microsoft Negligence/Incompetence (Links)
Summary: How Microsoft’s lack of desire to secure (maybe inability) affects the Internet — as newly-assembled links
• Does Microsoft care about their customers’ security? (on this latest negligence/liability issue, see [1, 2])
A few days before the launching of Microsoft’s last operating system, FSFE wondered about users’ security since an important vulnerability has been silently ignored. I then asked myself the question, in what way Free Software is different regarding security?
It appears that our allegations were true and should have been taken seriously. As an article in Computerworld reports, Microsoft finally issued a security advisory about that high-risk vulnerability three days ago. The problem is still not fixed though.
What’s important there is that this vulnerability already triggered a warning (en) by the BSI agency more than a month ago! Despite the consequences, Microsoft meanwhile decided not to tell its customers in order to avoid bad publicity around the launching of Windows7.
• Most security products fail to perform
Nearly 80 percent of security products fail to perform as intended when first tested and generally require two or more cycles of testing before achieving certification, according to a new ICSA Labs report. The “ICSA Labs Product Assurance Report” – co-authored by the Verizon Business Data Breach Investigations Report research team – details lessons gleaned from testing thousands of security products over 20 years.
The report found the number one reason why a product fails during initial testing is that it doesn’t adequately perform as intended. Across seven product categories core product functionality accounted for 78 percent of initial test failures. For example, an anti-virus product failing to prevent infection and for firewalls or an IPS product not filtering malicious traffic.
• Age of cyber warfare is ‘dawning’
Compiled by security firm McAfee, it bases its conclusion on analysis of recent net-based attacks.
• Spam net snared a quarter million bots, says conqueror
Over five days, 487,340 unique IP addresses reported to the ad-hoc server. Using findings derived from last year’s take-down of the separate Srizbi botnet, FireEye estimates that the figure translates to 248,590 unique machines.
• Gang sentenced for UK bank trojan
London’s Southwark Crown Court on Friday imposed sentences of as much as 4 and a half years on the men. According to IDG News, they used a trojan known as PSP2-BBB to stealthily monitor victims’ browsers. It inserted special fields into banking pages that asked for sensitive information and then sent it to the criminals when the user complied.
