12.14.09

Gemini version available ♊︎

Microsoft Hides Its Own Flaws, Cheats Customers

Posted in Deception, Microsoft, Security, Windows at 6:48 am by Dr. Roy Schestowitz

Haha, very funny pig
Even swine flu vaccines are delivered
more quickly than Microsoft patches

Summary: Microsoft delivers patches only after customers are attacked (despite having prior warnings) and then cheats when it comes to the number of patches it issues

ACCORDING TO PC Magazine, Microsoft neglects to look for its own bugs.

Sotirov noted that it’s TippingPoint’s and VeriSign’s customers who were paying for this research and that Microsoft should be paying too. Surely, I asked, Microsoft does vulnerability research on their own product. At this point another famous researcher, Dino Dai Zovi, piped in to say no: “Apple is the only vendor that I know of that releases patches for vulns found internally.”

This rang true; I know I’ve read Apple advisories that credited internal research and I couldn’t recall a Microsoft advisory that credited their own. I looked and not a single vulnerability disclosure (so far) in 2009 was credited explicitly to Microsoft. I asked Microsoft about it.

Their answer… Well, of course they look for and find these things, but not so much.

Microsoft’s negligence may justify lawsuits. To make matters worse, Microsoft lies about security, usually by hiding known flaws. The following new report from IDG is very damaging: “Microsoft knew of just-patched IE zero-day for months”

Microsoft may not have hustled as fast as researchers thought when the company patched a zero-day bug in Internet Explorer (IE) just 18 days after exploit code went public.

According to VeriSign iDefense, Microsoft had information about the browser bug nearly six months before the researcher dubbed “K4mr4n” posted attack code to the Bugtraq security mailing list on Nov. 20.

More hidden patches have just arrived.

Microsoft Releases Surprise Advisory

Hidden behind the Patch Tuesday updates, Microsoft released two separate security advisories and one set of updates that were not mentioned in the advance notification.

Regarding the latest Internet Explorer (IE) flaw that we wrote about before [1, 2, 3], Microsoft gives too little, too late, and being a zero-day flaw, damage has already been done.

Probably the most important update for most users is the one for Internet Explorer, which corrects five critical flaws in IE 6, 7 and 8. These are vulnerabilities that attackers could exploit to quietly install malicious software on your machine if you browse with IE to a hacked or booby-trapped site.

This only justifies the use of non-IE Web browsers. The way in which Microsoft delivers security updates is already being exploited [1, 2] to actually push malware rather than a fix.

Malware distributors continue resorting to the fake software update lure for their email spam campaigns. The latest attack poses as a notification regarding a Windows security bulletin, which links to a malicious executable.

The rogue emails impersonate Steve Lipner, Microsoft’s Director of Security Assurance, who allegedly informs the receiver about a high-priority security update for all versions of Windows. “Please notice that Microsoft company has recently issued a Security Update for OS Microsoft Windows. The update applies to the following OS versions: Microsoft Windows 2000, Microsoft Windows Millenium [sic], Microsoft Windows XP, Microsoft Windows Vista and Microsoft Windows 7,” the fake message reads.

It remains the job of some GNU/Linux-powered gateways to keep Windows more secure.

Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Reddit
  • email

Decor ᶃ Gemini Space

Below is a Web proxy. We recommend getting a Gemini client/browser.

Black/white/grey bullet button This post is also available in Gemini over at this address (requires a Gemini client/browser to open).

Decor ✐ Cross-references

Black/white/grey bullet button Pages that cross-reference this one, if any exist, are listed below or will be listed below over time.

Decor ▢ Respond and Discuss

Black/white/grey bullet button If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

DecorWhat Else is New


  1. IRC Proceedings: Tuesday, October 19, 2021

    IRC logs for Tuesday, October 19, 2021



  2. Links 19/10/2021: Karanbir Singh Leaves CentOS Board, GPL Violations at Vizio

    Links for the day



  3. [Meme] Giving the Knee

    The 'knee' champion Kratochvìl and 'kneel' champion Erlingsdóttir are simply crushing the law; they’re ignoring the trouble of EPO staff and abuses of the Office, facilitated by the Council itself (i.e. facilitated by themselves)



  4. Josef Kratochvìl Rewarded Again for Covering Up EPO Corruption and the EPO Bribes the Press for Lies Whilst Also Lying About Its Colossal Privacy Violations

    Corrupt officials and officials who actively enable the crimes still control the Office and also the body which was supposed to oversee it; it's pretty evident and clear judging by this week's press statements at the EPO's official Web site



  5. [Meme] Sorry, Wrong Country (Or: Slovenia isn't Great Britain)

    Team UPC is trying to go ahead with a total hoax which a high-level European court would certainly put an end to (if or when a referral is initiated)



  6. How Denmark, Iceland, Finland, Norway and Sweden Voted on Patently Unlawful Regulations at the EPO

    We look back and examine what happened 8 years ago when oppressed staff was subjected to unlawful new “regulations” (long enjoyed by António Campinos, the current EPO autocrat)



  7. The EPO’s Overseer/Overseen Collusion — Part XVII: The Non-Monolithic Nordic Bloc

    We start our investigation of how countries in northern Europe ended up voting on the unlawful “Strike Regulations” at the EPO and why



  8. Proof That Windows “11” is a Hoax

    Guest post by Ryan, reprinted with permission



  9. Firefox Becomes as Morally Reprehensible as Apple, Facebook, or Uber

    Guest post by Ryan, reprinted with permission



  10. Links 19/10/2021: GNU dbm 1.22 and Godot 3.4 RC 1

    Links for the day



  11. [Meme] [Teaser] GitHub an Expensive and Dangerous Trap (Also: Misogyny Hub)

    The ongoing Microsoft GitHub exposé will give people compelling reasons to avoid GitHub, which is basically just a subsidised (at a loss) trap



  12. Norway Should Have Voted Against Benoît Battistelli's Illegal (Anti-)'Strike Regulations' at the European Patent Office

    Benoît Battistelli‘s EPO faced no real and potent opposition from Norwegian delegates, who chose to abstain from the vote on the notorious and illegal so-called ‘Strike Regulations’ (they’re just an attack on strikes, an assault on basic rights of labourers)



  13. Links 19/10/2021: Sequoia PGP LGPL 2.0+, Open RAN Adoption

    Links for the day



  14. [Meme] [Teaser] Benoît Battistelli, King of Iceland

    Later today we shall see how the current deputy of the head of the EPO‘s overseeing body was in fact likely rewarded for her complicity in Benoît Battistelli‘s abuses against EPO staff, including staff from Iceland



  15. IRC Proceedings: Monday, October 18, 2021

    IRC logs for Monday, October 18, 2021



  16. Links 19/10/2021: MyGNUHealth 1.0.5 and Ubuntu 22.04 Now Developed

    Links for the day



  17. [Meme] [Teaser] Thrown Under the Bus

    Tomorrow we shall look at Danish enablers of unlawful EPO regulations, Jesper Kongstad and Anne Rejnhold Jørgensen



  18. The World Needs to Know What Many Austrians Already Know About Rude Liar, the Notorious 'Double-Dipper'

    Today we publish many translations (from German) about the Austrian double-dipper, who already became the subject of unfavourable press coverage in his home country; he’s partly responsible for crushing fundamental rights at the EPO under Benoît Battistelli‘s regime



  19. The EPO’s Overseer/Overseen Collusion — Part XVI: The Demise of the Austrian Double-Dipper

    Friedrich ‘Rude Liar’ Rödler is notorious in the eyes of EPO staff, whom he was slandering and scandalising for ages while he himself was the real scandal



  20. Links 18/10/2021: Porteus Kiosk 5.3 and Ventoy 1.0.55

    Links for the day



  21. [Meme] [Teaser] More to Life Than Patents

    Greedy sociopaths oughtn’t be put in charge of patent offices; this is what’s dooming the EPO in recent years (all they think about is money



  22. Microsoft GitHub Exposé — Part II — The Campaign Against GPL Compliance and War on Copyleft Enforcement

    Microsoft contemplated buying GitHub 7.5 years ago; the goal wasn’t to actually support “Open Source” but to crush it from the inside and that’s what Microsoft has been doing over the past 2.5 years (we have some details from the inside)



  23. Links 18/10/2021: Linux 5.15 RC6 and 7 New Stable Kernels

    Links for the day



  24. [Meme] The Austrian School of Friedrich Rude Liar

    With reference to the Austrian School, let’s consider the fact that Friedrich Rude Liar might in fact be standing to personally gain by plundering the EPO‘s staff by demonising them while helping Benoît Battistelli crush them



  25. IRC Proceedings: Sunday, October 17, 2021

    IRC logs for Sunday, October 17, 2021



  26. How (Simple Technical Steps) to Convince Yourself That DuckDuckGo is Just Spyware Connected to Microsoft, Falsely Advertised as 'Privacy'

    In recent days we published or republished some bits and pieces about what DuckDuckGo really is; the above reader dropped by to enlighten us and demonstrate just how easy it is to see what DuckDuckGo does even at the client side (with JavaScript); more people need to confront DuckDuckGo over this and warn colleagues/friends/family (there’s more here)



  27. Austria's Right-Wing Politicians Displaying Their Arrogance to EPO Examiners

    The EPO‘s current regime seems to be serving a money-hungry lobby of corrupt officials and pathological liars; tonight we focus on Austria



  28. [Meme] Friedrich Rödler's Increasingly Incomprehensible Debt Quagmire, Years Before EPO Money Was Trafficked Into the Stock Market

    As it turns out, numerous members of the Administrative Council of the EPO are abundantly corrupt and greedy; They falsely claim or selfishly pretend there’s a financial crisis and then moan about a "gap" that does not exist (unless one counts the illegal gambling, notably EPOTIF, which they approved), in turn recruiting or resorting to scabs that help improve ‘profit margins’



  29. The EPO’s Overseer/Overseen Collusion — Part XV: Et Tu Felix Austria…

    Prior to the Benoît Battistelli and António Campinos regime the EPO‘s hard-working staff was slandered by a corrupt Austrian official, Mr. Rödler



  30. Links 17/10/2021: Blender 2.93.5, Microsoft Bailouts

    Links for the day


RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts