01.22.10

Microsoft Security Negligence Confirmed: Critical Internet Explorer Flaw Known and Ignored for 4 Months

Posted in Deception, Microsoft, Security, Windows at 4:12 pm by Dr. Roy Schestowitz

Summary: The newest facts show that Microsoft knowingly refused to fix flaws that led to tremendous damage; lies from Microsoft (about its competition) are refuted as well

IN MANY RECENT posts about Internet Explorer [1, 2, 3, 4, 5, 6, 7, 8], we have pointed out Microsoft’s pattern of negligence [1, 2, 3], which always passes costs (damages) to the public. Microsoft should probably be sued for it, rather than make money from it. Microsoft — like Goldman Sachs — is making a lot of money out of a crisis caused by its own risk-taking.

Here are some self-explanatory news headlines:

Microsoft lies to your face about browser security

Microsoft’s Head of Security and Privacy in the UK has told TechRadar that people who jump ship from Internet Explorer after the recent spate of bad headlines risk ending up on a less secure browser. With France and Germany both advising a move away from Internet Explorer, things are far from rosy for Microsoft’s browser [...yet] Microsoft’s UK security chief Cliff Evans insists that a non-Microsoft browser is the worse option. “The net effect of switching [from IE] is that you will end up on less secure browser,” insisted Evans. “The risk [over this specific] exploit is minimal compared to Firefox or other competing browsers… you will be opening yourself up to security issues.

Let’s fight FUD with facts…

Vulnerability Report: Mozilla Firefox 3.5.x
Unpatched: 0

Vulnerability Report: Google Chrome 3.x
Unpatched: 0

Vulnerability Report: Opera 10.x
Unpatched: 0

Vulnerability Report: Apple Safari 4.x
Unpatched: 0

Vulnerability Report: Microsoft Internet Explorer 6.x
Unpatched: 24
Most Critical Unpatched: Extremely critical

Vulnerability Report: Microsoft Internet Explorer 7.x
Unpatched: 11
Most Critical Unpatched: Extremely critical

Vulnerability Report: Microsoft Internet Explorer 8.x
Unpatched: 4
Most Critical Unpatched: Extremely critical

My recommendation if you use Windows: make sure the version of IE that’s installed (because you can’t uninstall it!) is the latest/least vulnerable (IE8) and then install at least one of the non-IE browsers listed (personally I always recommend Firefox :) and then use THAT. Of course, you could always switch to a Mac or Linux…

Microsoft patches IE, admits it knew of bug last August

As Microsoft patched the Internet Explorer (IE) vulnerability that was used to break into Google’s network, it also acknowledged that it had known of the bug since August 2009, when an Israeli security company reported the flaw.

MS knew of Aurora exploit four months before Google attacks

Microsoft first knew of the bug used in the infamous Operation Aurora IE exploits as long ago as August, four months before the vulnerability was used in exploits against Google and other hi-tech firms in December, it has emerged.

Redmond’s security gnomes finally got around to patching the exploit on Thursday. the hack attacks against Google et al targeted IE 6, a browser first released in 2001. Exploits involved tricking users of vulnerable browsers into visiting booby-trapped websites. These sites downloaded the Hydraq backdoor Trojan and other malicious components onto compromised PCs.

[...]

A quick search of Secunia’s database, via its PSI patching tool, reveals a problem with an unpatched ActiveX control that looks just as bad, for example.

Emergency IE patch goes live as exploits proliferate

Microsoft released an emergency security update for all versions of Internet Explorer on Thursday as attacks exploiting a critical vulnerability in the widely used browser spread to hundreds of websites.

[...]

While some of the sites hosting the attacks were free services that had been co-opted, others appeared to be domains of legitimate companies that had been compromised.

[...]

In an admission that’s sure to spark criticism, Microsoft said it learned of the critical bug more than three months ago.

[...]

The unscheduled bulletin fixes a memory corruption flaw in most versions of the widely used browser that allows attackers to execute malicious code simply by luring victims to a booby-trapped website. It fixes seven other privately reported vulnerabilities, some of which also made remote code execution possible, that Microsoft had been planning to issue next month during its next regularly scheduled patch release.

[...]

Systems compromised by the sites reported by Symantec were infected with a backdoor that collected registry settings and other system information and sent it to an email address that was under the control of attackers. That email address has since been disabled, Talbot said.

Widespread Attacks Exploit Newly Patched IE Bug

The first widespread attack to leverage a recently patched flaw in Microsoft’s Internet Explorer browser has surfaced.

Starting late Wednesday, researchers at antivirus vendor Symantec’s Security Response group began spotting dozens of Web sites that contain the Internet Explorer attack, which works reliably on the IE 6 browser, running on Windows XP. The attack installs a Trojan horse program that is able to bypass some security products and then give hackers access to the system, said Joshua Talbot, a security intelligence manager with Symantec.

Once it has infected a PC, the Trojan sends a notification e-mail to the attackers, using a U.S.-based, free e-mail service that Symantec declined to name.

Make the right browser update: Firefox 3.6

Neolithic Windows security hole alive and well in Windows 7

One of the reasons I’ve never liked Windows is that it was never made to deal with the security problems of working in a networked, multi-user world. As a direct result, Windows has been fundamentally insecure for more than a decade. Even so, I was surprised to find that there’s a 17-year old security hole that’s been in Windows since NT and it’s still present today in Windows 7.

Wow. Even I’m shocked by this latest example of just how rotten Windows security is. It just reminds me again though that while Microsoft keeps adding features and attempting to patch its way out of security problems to Windows, Windows’ foundation is built on sand and not on the stone of good, solid design.

[...]

Be that as it may, the code’s still in there. An attacker can trigger the vulnerability through a variety of means. The end-result is, surprise, another Windows machine that’s totally owned by the attacker. Once in charge, they can vacuum down your files, install malware, and all the other usual tricks.

Vista 7 was never secure to begin with. See the examples below.

  1. Cybercrime Rises and Vista 7 is Already Open to Hijackers
  2. Vista 7: Broken Apart Before Arrival
  3. Department of Homeland Security ‘Poisoned’ by Microsoft; Vista 7 is Open to Hijackers Again
  4. Vista 7 Security “Cannot be Fixed. It’s a Design Problem.”
  5. Why Vista 7 Could be the Least Secure Operating System Ever
  6. Journalists Suggest Banning Windows, Maybe Suing Microsoft Over DDoS Attacks
  7. Vista 7 Vulnerable to Latest “Critical” Flaws
  8. Vista 7 Seemingly Affected by Several More “Critical” Flaws This Month
  9. Reason #1 to Avoid Vista 7: Insecurity
  10. Vista 7 Left Hijackable Again (Almost a Monthly Recurrence)
Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Reddit
  • email

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

A Single Comment

  1. uberVU - social comments said,

    January 22, 2010 at 9:26 pm

    Social comments and analytics for this post…

    This post was mentioned on Twitter by schestowitz: Critical Internet Explorer Flaw Known and Ignored for 4 Months http://boycottnovell.com/2010/01/22/refusing-to-fix-ie-flaws/

What Else is New


  1. Links 15/1/2021: KaOS 2021.01, Whisker Menu 2.5.2, Istio 1.8.2

    Links for the day



  2. InteLeaks – Part XV: Intel is Blind to Blind and Colour-Blind People

    Intel does not seem to grasp very basic concepts associated with accessibility; nevertheless, Intel shamelessly tries painting itself as "woke" and a "justice warrior" (policing speech while overlooking much-needed practical work)



  3. Links 15/1/2021: GStreamer 1.18.3 and Proton 5.13-5

    Links for the day



  4. IRC Proceedings: Thursday, January 14, 2021

    IRC logs for Thursday, January 14, 2021



  5. Links 14/1/2021: Wine 6.0, Debian 11 Freeze, and Alpine Linux 3.13

    Links for the day



  6. Patent Propaganda and UPC Jingoism Instead of Actual News

    Today's so-called 'news' about the EPO (Europe's second-largest institution) and the failed UPC is nothing short of shameless propaganda



  7. Links 14/1/2021: Season of KDE 2021 Selection, Mesa 21.0.0-RC1, Tor Browser 10.0.8

    Links for the day



  8. InteLeaks – Part XIV: Technical Incompetence and Incoherence Leading to Alienation and Brain Drain

    The idea that Intel "loves Linux" or "supports Linux" is somewhat of a sham; one needs only to consider what Intel insiders are saying about that, having witnessed it firsthand



  9. IRC Proceedings: Wednesday, January 13, 2021

    IRC logs for Wednesday, January 13, 2021



  10. Links 13/1/2021: $150 RISC-V Computer With GNU/Linux, Intel Replaces CEO Again, and New Fedora 34 Plans

    Links for the day



  11. Unitary Patent is Dead and Lies About the Unified Patent Court (UPC) Aren't Ending

    Not "Russian agents" but concerned European citizens are beginning to see the truth behind the Unified Patent Court, which the 'media' has wrongly called "Unitary Patent Court" three times in 2 days



  12. InteLeaks – Part XIII: GNU/Linux Documentation From People Who Never Even Use GNU/Linux

    Inside Intel there's a whole bunch of embarrassing secrets about the Developer/Development eXperience ("DX") team; no wonder documentation efforts have been lacking and far too much time wasted putting such documentation together



  13. Links 13/1/2021: Mozilla VPN, NeoChat 1.0.1 and Sci-Hub Under Attack

    Links for the day



  14. IRC Proceedings: Tuesday, January 12, 2021

    IRC logs for Tuesday, January 12, 2021



  15. GNOME Foundation is Still Participating in the Attack on Richard Stallman

    GNOME's supposed 'representatives' (close-knit friends with Microsoft connections) continue to attack RMS (Richard Stallman), the founder of GNU (the G in GNOME) and the Free Software Movement



  16. Links 12/1/2021: GTK 4.0.1 Released, Jailbroken iPhone 7 Running Ubuntu

    Links for the day



  17. InteLeaks – Part XII: Intel Isn't Interested in Improving and Instead It's Shooting the Messengers Who Highlight Areas for Improvement

    It seems rather clear that Intel (quite frankly like many other companies but perhaps even more so than the rest) isn't interested in self-assessment and instead it's looking to muzzle or even oust constructive critics



  18. IRC Proceedings: Monday, January 11, 2021

    IRC logs for Monday, January 11, 2021



  19. Tiger Computing Ltd Afraid of Being Seen as Close to the British Military, Resorts to SLAPP Against Blogger and GNU/Linux Developer

    Tiger Computing Ltd (UK) has resorted to baseless legal threats against critics and sceptics, based on clear and obvious misuse of trademark or copyright laws (they don't even seem to know the difference)



  20. Marketing Companies (Disguised as News Sites) Badmouth Linux, Go, Monero and More

    Another day, another shallow piece associating “Linux” with security risks based on something that has nothing to do with GNU/Linux and generally boils to nothing like a real threat (unlike Windows back doors)



  21. The Media is Slurring and Misleading Linux Users Instead of Just Telling the Mundane and Objective News

    The "big sites" or the so-called 'news' sites seem incapable of just objectively covering the news (in line with journalism/journalistic standards)



  22. Links 11/1/2021: Kdenlive 20.12.1, fwupd 1.5.5, Microsoft Offline Again

    Links for the day



  23. InteLeaks – Part XI: Accountability Issues and Disdain for Views/Opinions of Actual GNU/Linux Users/Developers/Communities

    The truth about internal affairs at Intel and developers' struggle with "low/non-tech involvement," as told by insiders



  24. Links 11/1/2021: Linux 5.11 RC3, Firefox Integrates More Patent Traps

    Links for the day



  25. As Microsoft Windows Drops to Just 30% Market Share the Microsoft-Connected 'Net Applications' Wants You to Think Windows Still Has Over 90% of the Market

    StatCounter says Windows is down to 30% this month (Android is at over 42%) and it’s time to talk about the lies which are still being spread by Net Applications (many so-called ‘news’ sites helped spread those lies last year, including so-called ‘Linux’ sites)



  26. IRC Proceedings: Sunday, January 10, 2021

    IRC logs for Sunday, January 10, 2021



  27. People Sponsored by Google Are Hiding Sponsorship by Google and Hiding Google Critics

    FOSDEM mailing list hides the critics of Google; it's becoming part of a familiar pattern



  28. Alex Oliva's Departure is a Massive Loss to the Free Software Foundation

    The FSF (Free Software Foundation, established 1985) is losing not only Mr. Oliva; it loses some credibility as the departure contributes to the general perception that there's still an ongoing coup, reinventing the FSF in the image not of its very own founder



  29. InteLeaks – Part X: Replacing Free Software With Microsoft, Turning One-Minute Processes Into Days Long

    Processes that were entirely Free software-centric were rejected and replaced by truly antithetical spyware of companies that aren't Intel and give Intel no autonomy or self-determination



  30. Alex Oliva's Resignation From the FSF Board

    At the advice of friendly FSF board members, I turned in the following letter to the FSF president, asking him to pass it on to directors and voting members at a suitable time...


RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts