EditorsAbout the SiteComes vs. MicrosoftUsing This Web SiteSite ArchivesCredibility IndexOOXMLOpenDocumentPatentsNovellNews DigestSite NewsRSS

01.22.10

Microsoft Security Negligence Confirmed: Critical Internet Explorer Flaw Known and Ignored for 4 Months

Posted in Deception, Microsoft, Security, Windows at 4:12 pm by Dr. Roy Schestowitz

Summary: The newest facts show that Microsoft knowingly refused to fix flaws that led to tremendous damage; lies from Microsoft (about its competition) are refuted as well

IN MANY RECENT posts about Internet Explorer [1, 2, 3, 4, 5, 6, 7, 8], we have pointed out Microsoft’s pattern of negligence [1, 2, 3], which always passes costs (damages) to the public. Microsoft should probably be sued for it, rather than make money from it. Microsoft — like Goldman Sachs — is making a lot of money out of a crisis caused by its own risk-taking.

Here are some self-explanatory news headlines:

Microsoft lies to your face about browser security

Microsoft’s Head of Security and Privacy in the UK has told TechRadar that people who jump ship from Internet Explorer after the recent spate of bad headlines risk ending up on a less secure browser. With France and Germany both advising a move away from Internet Explorer, things are far from rosy for Microsoft’s browser [...yet] Microsoft’s UK security chief Cliff Evans insists that a non-Microsoft browser is the worse option. “The net effect of switching [from IE] is that you will end up on less secure browser,” insisted Evans. “The risk [over this specific] exploit is minimal compared to Firefox or other competing browsers… you will be opening yourself up to security issues.

Let’s fight FUD with facts…

Vulnerability Report: Mozilla Firefox 3.5.x
Unpatched: 0

Vulnerability Report: Google Chrome 3.x
Unpatched: 0

Vulnerability Report: Opera 10.x
Unpatched: 0

Vulnerability Report: Apple Safari 4.x
Unpatched: 0

Vulnerability Report: Microsoft Internet Explorer 6.x
Unpatched: 24
Most Critical Unpatched: Extremely critical

Vulnerability Report: Microsoft Internet Explorer 7.x
Unpatched: 11
Most Critical Unpatched: Extremely critical

Vulnerability Report: Microsoft Internet Explorer 8.x
Unpatched: 4
Most Critical Unpatched: Extremely critical

My recommendation if you use Windows: make sure the version of IE that’s installed (because you can’t uninstall it!) is the latest/least vulnerable (IE8) and then install at least one of the non-IE browsers listed (personally I always recommend Firefox :) and then use THAT. Of course, you could always switch to a Mac or Linux…

Microsoft patches IE, admits it knew of bug last August

As Microsoft patched the Internet Explorer (IE) vulnerability that was used to break into Google’s network, it also acknowledged that it had known of the bug since August 2009, when an Israeli security company reported the flaw.

MS knew of Aurora exploit four months before Google attacks

Microsoft first knew of the bug used in the infamous Operation Aurora IE exploits as long ago as August, four months before the vulnerability was used in exploits against Google and other hi-tech firms in December, it has emerged.

Redmond’s security gnomes finally got around to patching the exploit on Thursday. the hack attacks against Google et al targeted IE 6, a browser first released in 2001. Exploits involved tricking users of vulnerable browsers into visiting booby-trapped websites. These sites downloaded the Hydraq backdoor Trojan and other malicious components onto compromised PCs.

[...]

A quick search of Secunia’s database, via its PSI patching tool, reveals a problem with an unpatched ActiveX control that looks just as bad, for example.

Emergency IE patch goes live as exploits proliferate

Microsoft released an emergency security update for all versions of Internet Explorer on Thursday as attacks exploiting a critical vulnerability in the widely used browser spread to hundreds of websites.

[...]

While some of the sites hosting the attacks were free services that had been co-opted, others appeared to be domains of legitimate companies that had been compromised.

[...]

In an admission that’s sure to spark criticism, Microsoft said it learned of the critical bug more than three months ago.

[...]

The unscheduled bulletin fixes a memory corruption flaw in most versions of the widely used browser that allows attackers to execute malicious code simply by luring victims to a booby-trapped website. It fixes seven other privately reported vulnerabilities, some of which also made remote code execution possible, that Microsoft had been planning to issue next month during its next regularly scheduled patch release.

[...]

Systems compromised by the sites reported by Symantec were infected with a backdoor that collected registry settings and other system information and sent it to an email address that was under the control of attackers. That email address has since been disabled, Talbot said.

Widespread Attacks Exploit Newly Patched IE Bug

The first widespread attack to leverage a recently patched flaw in Microsoft’s Internet Explorer browser has surfaced.

Starting late Wednesday, researchers at antivirus vendor Symantec’s Security Response group began spotting dozens of Web sites that contain the Internet Explorer attack, which works reliably on the IE 6 browser, running on Windows XP. The attack installs a Trojan horse program that is able to bypass some security products and then give hackers access to the system, said Joshua Talbot, a security intelligence manager with Symantec.

Once it has infected a PC, the Trojan sends a notification e-mail to the attackers, using a U.S.-based, free e-mail service that Symantec declined to name.

Make the right browser update: Firefox 3.6

Neolithic Windows security hole alive and well in Windows 7

One of the reasons I’ve never liked Windows is that it was never made to deal with the security problems of working in a networked, multi-user world. As a direct result, Windows has been fundamentally insecure for more than a decade. Even so, I was surprised to find that there’s a 17-year old security hole that’s been in Windows since NT and it’s still present today in Windows 7.

Wow. Even I’m shocked by this latest example of just how rotten Windows security is. It just reminds me again though that while Microsoft keeps adding features and attempting to patch its way out of security problems to Windows, Windows’ foundation is built on sand and not on the stone of good, solid design.

[...]

Be that as it may, the code’s still in there. An attacker can trigger the vulnerability through a variety of means. The end-result is, surprise, another Windows machine that’s totally owned by the attacker. Once in charge, they can vacuum down your files, install malware, and all the other usual tricks.

Vista 7 was never secure to begin with. See the examples below.

  1. Cybercrime Rises and Vista 7 is Already Open to Hijackers
  2. Vista 7: Broken Apart Before Arrival
  3. Department of Homeland Security ‘Poisoned’ by Microsoft; Vista 7 is Open to Hijackers Again
  4. Vista 7 Security “Cannot be Fixed. It’s a Design Problem.”
  5. Why Vista 7 Could be the Least Secure Operating System Ever
  6. Journalists Suggest Banning Windows, Maybe Suing Microsoft Over DDoS Attacks
  7. Vista 7 Vulnerable to Latest “Critical” Flaws
  8. Vista 7 Seemingly Affected by Several More “Critical” Flaws This Month
  9. Reason #1 to Avoid Vista 7: Insecurity
  10. Vista 7 Left Hijackable Again (Almost a Monthly Recurrence)
Share this post: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Reddit
  • email
  • Google Bookmarks

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

A Single Comment

  1. uberVU - social comments said,

    January 22, 2010 at 9:26 pm

    Social comments and analytics for this post…

    This post was mentioned on Twitter by schestowitz: Critical Internet Explorer Flaw Known and Ignored for 4 Months http://boycottnovell.com/2010/01/22/refusing-to-fix-ie-flaws/

What Else is New


  1. Indoors Society, Shut the Windows

    Times are changing in all sorts of ways; it seems like GNU/Linux and other Free/libre operating systems may emerge as winners when the 'dust settles'



  2. Allegation That Microsoft Adopted the Mentality of Suicide Bombers Against Linux, Leaks Reveal

    Looking at leaked E-mails from around the time Microsoft used Cyanogen as a 'proxy', we're finding some stunning admissions or speculation about the real motivations



  3. [Humour] A Union in Whose Interests?

    The union-busting 'yellow union' (the one that helped Benoît Battistelli marginalise SUEPO) is unable to represent staff any longer



  4. FFPE EPO Has Rendered Itself Obsolete by Liaising With Benoît Battistelli

    FFPE EPO has been left out of staff representation, demonstrating that liaising with the oppressor is a self-deprecating move which must be avoided (the only remaining potent union is SUEPO)



  5. Links 4/7/2020: LibreOffice 7.0 'Personal Edition', Atari VCS Coming Soon

    Links for the day



  6. [Humour/Meme] The 'New' Edge (Chrome Copycat) is Already Dead, So Microsoft is Trying to Just Kill the Competition

    Edge market share is so minuscule that it doesn’t even make it into this chart (it’s in “other”); no wonder Microsoft now bullies Windows users into using it, for users reject it even after months of endless advertising/AstroTurfing and aggressive exploitation/appropriation



  7. Fourth of July in the United Kingdom and the United States

    In these bizarre times Independence Day is still being celebrated, even as so many people are out of work, running out of hope and being fed xenophobia in social control media with a racist 'celebrity' president (the "user in chief")



  8. [Humour] Bigger is Always Better When You're a Deluded Maximalist

    The EPO totally lost sight of its mission; it's just speeding everything up, very carelessly, not minding quality and accuracy/certainty/legal validity



  9. 'Managing Intellectual Property' Managing to Become Uncritical Parrot of EPO Management

    Managing to amplify the EPO's lies isn't hard; one just needs to copy, paste, edit a little; then they call it 'journalism', irrespective of the proven track record of EPO management lying to staff and to the media



  10. IRC Proceedings: Friday, July 03, 2020

    IRC logs for Friday, July 03, 2020



  11. Monopoly Abuse, Still: Microsoft Pays Projects to Embrace/Move to C#, GitHub and Visual Studio

    Microsoft's greatest of efforts to lull regulators into inaction and fool us all into thinking that things have changed are undone by actual behaviour, which is abusive, anti-competitive and just... typical Microsoft



  12. Links 4/7/2020: Grml 2020.06 and diffoscope 150 Released

    Links for the day



  13. [Humour/Meme] Don't Let a COVID Crisis Go to Waste When You're Eager to Find Excuses for Many Layoffs and Shutdowns

    Microsoft business units that were defunct (long-failing, well before COVID-19) are being thrown out and Microsoft exploits a virus to rationalise these decisions while spicing up media coverage with "Hey Hi" (AI) and "virtual" experience or Facebook (to give the false impression that nothing really goes away)



  14. Free Software Tackles Political Issues. Political Tactics Are Also Being Weaponised Against Free Software.

    Divide-and-rule tactics seem to have been exploited to weaken collaborative work on Free/libre software; the response to these tactics needs to start with realisation that this is going on (even if it's done in a somewhat clandestine nature)



  15. Offence and Racism

    o those in positions of power and privilege (financial) you are controllable by guilt; dividing us and causing us to feel guilt and fear (over potential offence) is a powerful social control mechanism and pretext for dismissal, censorship, humiliation



  16. Links 3/7/2020: TrueNAS 12 Beta 1, Librem 13 Product Line

    Links for the day



  17. [Humour] European Patents Only Useful Outside the Legal Framework?

    Patents that aren't valid in the eyes of courts would best serve patent trolls that settle out of courts, en masse



  18. Microsoft's Share in Web Servers Rapidly Falls to Just 4.5% (Falling More Than 5% in a Single Month)

    Microsoft's share as measured at Netcraft (de facto authority in this area) is rapidly declining; expect IIS to go the way of the dodo some time in the coming years



  19. The Lock-downs Are Over and Still Zero Media Coverage About EPO Scandals and Corruption

    The appalling state of journalism in Europe (and to some extent in the world at large) means that the EPO's management can get away with all sorts of horrible crimes and fraud; the silencing of the media is, in its own right, quite scandalous



  20. IRC Proceedings: Thursday, July 02, 2020

    IRC logs for Thursday, July 02, 2020



  21. “Microsoft's Deadly Love” by Alessandro Ebersol (Agent Smith)

    Full credit goes to PCLOS Magazine for publishing this good piece, which we’re reproducing



  22. Links 2/7/2020: Microsoft Partner Says GNU/Linux Share in Desktops/Laptops at 4% Even After Lock-downs, OpenSUSE Leap 15.2 and Mageia 8 Alpha 1 Released

    Links for the day



  23. Why People Should Never Ever Use DuckDuckGo

    DuckDuckGo is another privacy abuser in disguise; the above forum thread enumerates key reasons



  24. After 2 Years and 2 Days António Campinos is a Perfect Leader, Fostering EPO Abuses While Smiling

    EPO corruption persists, but this time the corruption enjoys better marketing/PR and complicit (or at best silent) media



  25. [Humour] As If Monopolies for Life Will Save People's Lives...

    The mentality of monopoly or the mindset of patent maximalism has been quick to exploit the deaths of half a million



  26. IRC Proceedings: Wednesday, July 01, 2020

    IRC logs for Wednesday, July 01, 2020



  27. IBM-Funded FSF Censors Itself on Software Patents

    Donald Robertson’s article bemoaning and openly condemning the U.S. Patent and Trademark Office (USPTO) over software patents, which it illegally grants in some cases, was modified a week later; and why? One can only guess… (but remember that the FSF’s foremost sponsor is lobbying against 35 U.S.C. § 101 and for software patents)



  28. [Humour/Meme] Remember That As Recently as Last Year Microsoft Was Still Shaking Down and Even Suing Companies Over 'Linux Patent Infringement'

    There's no 'new Microsoft' except a (better at) lying Microsoft; its covert actions tell us a lot about its ongoing hatred of GNU/Linux, which it is assaulting in new and more sophisticated ways



  29. Contrary to Common Misconceptions, Free Software is More 'Corporate' or More 'Enterprise-Grade' Than Proprietary Abandonware (All Proprietary Software Will Die)

    Free software can leverage the superficial and bland boardroom lingo/slang to promote itself; it would definitely harm or dilute/weaken the terms which proprietary software giants like to leverage against us



  30. Social Control Media Will Not Exist One Day

    Digital obsolescence and Internet bitrot — that’s what Social Control Media is really good for; as many Google+ ‘users’ (useds) found out, they’re just being ‘farmed’ for their ‘content’, which is neither valuable nor resilient (definitely of no value to Google)


RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts