12.23.09
Government Shoots Itself in the Foot by Letting Microsoft Control Insecurity Departments
Summary: President Obama puts a fox in change of the hen house with yet another appointment of Microsoft for security; Microsoft helps malware writers
THE United States government is not engineered for security because it hires "security" people from the very same company that causes a lot of the problems. The DHS is already affected and Obama pondered making Scott Charney, head of Microsoft’s cybersecurity division, the US cybersecurity czar. Eventually he picked another person from Microsoft for this job (also in [1, 2, 3, 4]):
The White House is naming a former Microsoft and eBay executive as the government’s new cyber security coordinator. Former Bush administration official Howard Schmidt will lead the effort to shore up the country’s computer networks.
More here:
Obama names former Microsoft exec new U.S. cybersecurity czar
President Obama this morning named a new U.S. cybersecurity coordinator: Howard Schmidt, a longtime computer security specialist who has worked as an executive for companies including Microsoft and eBay, and as a security adviser to the administration of George W. Bush.
How shameful. We have already explained why this is a mistake and when poor decisions are made in the future it may be possible to blame them on bias. One reader of ours wrote in relation to this news: “If they already have the technical knowledge, then why haven’t they made a computer that can’t be compromised to be used in botnets, merely by clicking on a URL or opening an e-mail attachment?
Also in yesterday’s news we now find:
• Microsoft AV advice may aid attackers, researcher warns
A security researcher is taking Microsoft to task for advising customers to exclude certain files and folders from anti-virus scanning, arguing the practice could be exploited by pushers of malware.
• Microsoft shows malware writers where to hide
In a document published on its support site, Microsoft suggests that users do not need to scan some files and folders for malware as a way to improve performance in Windows 2000, XP, Vista, Windows 7, Server 2003, Server 2008 and Server 2008 R2. “These files are not at risk of infection. If you scan these files, serious performance problems may occur because of file locking,” the Vole said.
• Microsoft accused of helping virus writers [via]
Security firm Trend Micro has accused Microsoft of giving malware writers a helping hand by advising users not to scan certain files on their PC.
In an article published on Microsoft’s Support site the company claims it’s safe to exclude certain file types from virus scans because “they are not at risk of infection”. Microsoft claims ignoring these files will help improve scanning performance and avoid unnecessary conflicts.
Yes, Microsoft does not seem to have a clue about security.
Microsoft’s influence in the United States government is increasing and this is becoming a matter of national security. They spread that so-called “Microsoft religion” to areas that are mostly UNIX- and Linux-based. They ignore many decades of good practices. █
“It is no exaggeration to say that the national security is also implicated by the efforts of hackers to break into computing networks. Computers, including many running Windows operating systems, are used throughout the United States Department of Defense and by the armed forces of the United States in Afghanistan and elsewhere.”
–Jim Allchin, Microsoft
Needs Sunlight said,
December 23, 2009 at 9:26 am
The US government is shooting more than its foot in this mistake. Schmidt, for his role as an insecurity specialist, and for his ongoing role in spreading Microsoft malware throughout the US economy should be sitting in jail awaiting arraignment. Or if the scope of and forethought behind the damage is taken into the equation, maybe Camp X-Ray is more appropriate.
Yuhong Bao said,
December 26, 2009 at 4:00 am
Well, looks like this is a case where MS advised specific areas to be excluded from scanning, and anytime you exclude areas from scanning from AV software, there always is a risk that viruses may hide in there. So you should always be careful when you do that.
“If they already have the technical knowledge, then why haven’t they made a computer that can’t be compromised to be used in botnets, merely by clicking on a URL or opening an e-mail attachment?”
Well, non-admin would help a lot on both Windows and Linux. Admin users can compromise the entire computer, non-Admin users can only compromise only the user account itself.