EditorsAbout the SiteComes vs. MicrosoftUsing This Web SiteSite ArchivesCredibility IndexOOXMLOpenDocumentPatentsNovellNews DigestSite NewsRSS

01.22.10

Microsoft Security Negligence Confirmed: Critical Internet Explorer Flaw Known and Ignored for 4 Months

Posted in Deception, Microsoft, Security, Windows at 4:12 pm by Dr. Roy Schestowitz

Summary: The newest facts show that Microsoft knowingly refused to fix flaws that led to tremendous damage; lies from Microsoft (about its competition) are refuted as well

IN MANY RECENT posts about Internet Explorer [1, 2, 3, 4, 5, 6, 7, 8], we have pointed out Microsoft’s pattern of negligence [1, 2, 3], which always passes costs (damages) to the public. Microsoft should probably be sued for it, rather than make money from it. Microsoft — like Goldman Sachs — is making a lot of money out of a crisis caused by its own risk-taking.

Here are some self-explanatory news headlines:

Microsoft lies to your face about browser security

Microsoft’s Head of Security and Privacy in the UK has told TechRadar that people who jump ship from Internet Explorer after the recent spate of bad headlines risk ending up on a less secure browser. With France and Germany both advising a move away from Internet Explorer, things are far from rosy for Microsoft’s browser [...yet] Microsoft’s UK security chief Cliff Evans insists that a non-Microsoft browser is the worse option. “The net effect of switching [from IE] is that you will end up on less secure browser,” insisted Evans. “The risk [over this specific] exploit is minimal compared to Firefox or other competing browsers… you will be opening yourself up to security issues.

Let’s fight FUD with facts…

Vulnerability Report: Mozilla Firefox 3.5.x
Unpatched: 0

Vulnerability Report: Google Chrome 3.x
Unpatched: 0

Vulnerability Report: Opera 10.x
Unpatched: 0

Vulnerability Report: Apple Safari 4.x
Unpatched: 0

Vulnerability Report: Microsoft Internet Explorer 6.x
Unpatched: 24
Most Critical Unpatched: Extremely critical

Vulnerability Report: Microsoft Internet Explorer 7.x
Unpatched: 11
Most Critical Unpatched: Extremely critical

Vulnerability Report: Microsoft Internet Explorer 8.x
Unpatched: 4
Most Critical Unpatched: Extremely critical

My recommendation if you use Windows: make sure the version of IE that’s installed (because you can’t uninstall it!) is the latest/least vulnerable (IE8) and then install at least one of the non-IE browsers listed (personally I always recommend Firefox :) and then use THAT. Of course, you could always switch to a Mac or Linux…

Microsoft patches IE, admits it knew of bug last August

As Microsoft patched the Internet Explorer (IE) vulnerability that was used to break into Google’s network, it also acknowledged that it had known of the bug since August 2009, when an Israeli security company reported the flaw.

MS knew of Aurora exploit four months before Google attacks

Microsoft first knew of the bug used in the infamous Operation Aurora IE exploits as long ago as August, four months before the vulnerability was used in exploits against Google and other hi-tech firms in December, it has emerged.

Redmond’s security gnomes finally got around to patching the exploit on Thursday. the hack attacks against Google et al targeted IE 6, a browser first released in 2001. Exploits involved tricking users of vulnerable browsers into visiting booby-trapped websites. These sites downloaded the Hydraq backdoor Trojan and other malicious components onto compromised PCs.

[...]

A quick search of Secunia’s database, via its PSI patching tool, reveals a problem with an unpatched ActiveX control that looks just as bad, for example.

Emergency IE patch goes live as exploits proliferate

Microsoft released an emergency security update for all versions of Internet Explorer on Thursday as attacks exploiting a critical vulnerability in the widely used browser spread to hundreds of websites.

[...]

While some of the sites hosting the attacks were free services that had been co-opted, others appeared to be domains of legitimate companies that had been compromised.

[...]

In an admission that’s sure to spark criticism, Microsoft said it learned of the critical bug more than three months ago.

[...]

The unscheduled bulletin fixes a memory corruption flaw in most versions of the widely used browser that allows attackers to execute malicious code simply by luring victims to a booby-trapped website. It fixes seven other privately reported vulnerabilities, some of which also made remote code execution possible, that Microsoft had been planning to issue next month during its next regularly scheduled patch release.

[...]

Systems compromised by the sites reported by Symantec were infected with a backdoor that collected registry settings and other system information and sent it to an email address that was under the control of attackers. That email address has since been disabled, Talbot said.

Widespread Attacks Exploit Newly Patched IE Bug

The first widespread attack to leverage a recently patched flaw in Microsoft’s Internet Explorer browser has surfaced.

Starting late Wednesday, researchers at antivirus vendor Symantec’s Security Response group began spotting dozens of Web sites that contain the Internet Explorer attack, which works reliably on the IE 6 browser, running on Windows XP. The attack installs a Trojan horse program that is able to bypass some security products and then give hackers access to the system, said Joshua Talbot, a security intelligence manager with Symantec.

Once it has infected a PC, the Trojan sends a notification e-mail to the attackers, using a U.S.-based, free e-mail service that Symantec declined to name.

Make the right browser update: Firefox 3.6

Neolithic Windows security hole alive and well in Windows 7

One of the reasons I’ve never liked Windows is that it was never made to deal with the security problems of working in a networked, multi-user world. As a direct result, Windows has been fundamentally insecure for more than a decade. Even so, I was surprised to find that there’s a 17-year old security hole that’s been in Windows since NT and it’s still present today in Windows 7.

Wow. Even I’m shocked by this latest example of just how rotten Windows security is. It just reminds me again though that while Microsoft keeps adding features and attempting to patch its way out of security problems to Windows, Windows’ foundation is built on sand and not on the stone of good, solid design.

[...]

Be that as it may, the code’s still in there. An attacker can trigger the vulnerability through a variety of means. The end-result is, surprise, another Windows machine that’s totally owned by the attacker. Once in charge, they can vacuum down your files, install malware, and all the other usual tricks.

Vista 7 was never secure to begin with. See the examples below.

  1. Cybercrime Rises and Vista 7 is Already Open to Hijackers
  2. Vista 7: Broken Apart Before Arrival
  3. Department of Homeland Security ‘Poisoned’ by Microsoft; Vista 7 is Open to Hijackers Again
  4. Vista 7 Security “Cannot be Fixed. It’s a Design Problem.”
  5. Why Vista 7 Could be the Least Secure Operating System Ever
  6. Journalists Suggest Banning Windows, Maybe Suing Microsoft Over DDoS Attacks
  7. Vista 7 Vulnerable to Latest “Critical” Flaws
  8. Vista 7 Seemingly Affected by Several More “Critical” Flaws This Month
  9. Reason #1 to Avoid Vista 7: Insecurity
  10. Vista 7 Left Hijackable Again (Almost a Monthly Recurrence)
Share this post: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Digg
  • del.icio.us
  • Reddit
  • co.mments
  • DZone
  • email
  • Google Bookmarks
  • LinkedIn
  • NewsVine
  • Print
  • Technorati
  • TwitThis
  • Facebook

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

A Single Comment

  1. uberVU - social comments said,

    January 22, 2010 at 9:26 pm

    Social comments and analytics for this post…

    This post was mentioned on Twitter by schestowitz: Critical Internet Explorer Flaw Known and Ignored for 4 Months http://boycottnovell.com/2010/01/22/refusing-to-fix-ie-flaws/

What Else is New


  1. Links 27/6/2016: Linux 4.7 RC 5, OpenMandriva Lx 3.0 Beta 2

    Links for the day



  2. From Alleged Organised Crime to Vice-President of the European Patent Office (EPO)

    Željko Topić's situation in Croatia illuminated by means of recent documents from the authorities



  3. Battistelli May Still be on the Way Out as Pressure Grows in Germany, UPC in Shambles

    Pressure on Battistelli is growing even from within circles that are traditionally protective of him and a long letter is sent to Dr. Christoph Ernst, who some believe will replace Battistelli



  4. Caricature: European Patent Office (EPO) Under Battistelli

    The latest caricature about the state of the European Patent Office (EPO)



  5. Techrights (Almost) at 10: From Software Patents to Novell and to Present Focus on EPO

    A short story about how and why we ended up writing so much about the European Patent Office (EPO) and the impact beyond Europe



  6. Patents Roundup: Bad Quality (USPTO), Bad Analysis (India), Bad Microsoft, Bad Actors (Trolls), Bad Scope (Software Patents), and the Ugly

    A mishmash of news about patents, mostly regarding the United States, and what can be deduced at the moment



  7. Links 26/6/2016: IceCat 38.8.0, Wine 1.9.13

    Links for the day



  8. With UPC Dead for Battistelli's Entire Remaining Term, No Reason for the EPO or the Administrative Council to Keep Battistelli Around

    Thoughts about what happens to the EPO's leadership after 'Brexit' (British exit from the EU), which severely undermines Battistelli's biggest project that he habitually used to justify his incredible abuses



  9. Links 24/6/2016: Xen Project 4.7, Cinnamon 3.0.6

    Links for the day



  10. Benoît Battistelli Should Resign in Light of New Leak of Decision in His Vendetta Against Truth-Telling Judge (Updated)

    Benoît Battistelli continues to break the EPO's own rules, not just national laws, as a new decision helps reveal



  11. Fake Patents on Software From Fake Australian 'Inventor' of Bitcoin and the Globally-Contagious Nature of EPO Patent Scope

    News from Australia regarding software patents that should not be granted and how patent lawyers from Australia rely on European patent law (EPO and UK-IPO) for guidance on patent scope



  12. Patent Lawyers Love (and Amplify) Halo and Enfish, Omit or Dismiss Cuozzo and Alice

    By misinterpreting the current situation with respect to software patents and misusing terms like "innovation" patent lawyers and others in the patent microcosm hope to convince the public (or potential clients) that nothing in effect has changed and software patents are all fine and dandy



  13. Looks Increasingly Plausible That Battistelli is Covering up Bogus and/or Illegally-Obtained 'Evidence' From the EPO's Investigative Unit

    Why we believe that Benoît Battistelli is growingly desperate to hide evidence of rogue evidence-collecting operations which eventually landed himself -- not the accused -- in a catastrophic situation that can force his resignation



  14. As Decision on the UK's EU Status Looms, EPO Deep in a Crisis of Patent Quality

    Chaotic situation at the EPO and potential changes in the UK cause a great deal of debate about the UPC, which threatens to put the whole or Europe at the mercy of patent trolls from abroad



  15. Another Demonstration by European Patent Office (EPO) Staff on Same Day as Administrative Council's Meeting

    SUEPO (staff union of the EPO) continues to organise staff actions against extraordinary injustice by Benoît Battistelli and his flunkies whom he gave top positions at the EPO



  16. Links 23/6/2016: Red Hat Results, Randa Stories

    Links for the day



  17. Interview With FOSSForce/All Things Free Tech

    New interview with Robin "Roblimo" Miller on behalf of FOSSForce



  18. Links 22/6/2016: PulseAudio 9.0, GNOME 3.21.3 Released

    Links for the day



  19. IP Europe's UPC Lobbying and the EPO Connection

    The loose but seemingly ever-growing connections between AstroTurfing groups like IP Europe (pretending to represent SMEs) and EPO staff which is lobbying-centric



  20. EPO “Recruitment of Brits is Down by 80%”

    Letter says that “recruitment of Brits is down by 80%” and "the EPO lost 7% of UK staff in one year"



  21. The Conspiracy of Patent Lawyers for UPC and Battistelli's Role in Preparing by Firing People

    The parasitic firms that lobby for the UPC and actually create it -- firms like those that pass money to Battistelli's EPO -- are doing exactly the opposite of what Europe needs



  22. Patent Lawyers, Having Lost Much of the Battle for Software Patents in the US, Resort to Harmful Measures and Spin

    A quick glance at how patent lawyers and their lobbyists/advocates have reacted to the latest decision from the US Supreme Court (Justice Breyer)



  23. Links 21/6/2016: Fedora 24 and Point Linux MATE 3.2 Officially Released

    Links for the day



  24. Supreme Court on Cuozzo v Lee Another Major Loss for Software Patents in the United States

    Much-anticipated decision on the Cuozzo v Lee case (at the highest possible level) serves to defend the appeal boards which are eliminating software patents by the thousands



  25. As Alice Turns Two, Bilski Blog Says 36,000 (Software) Patent Applications Have Been Rejected Thanks to It

    A look back at the legacy of Alice v CLS Bank and how it contributed to the demise of software patents in the United States, the birthplace of software patents



  26. EPO Self-Censorship by IP Kat or Just Censorship of Opinions That IP Kat Does Not Share/Accept (Updated)

    ree speech when it's needed the most (EPO scandals) needs to be respected; or why IP Kat shoots itself in the foot and helps the EPO's management by 'sanitising' comments



  27. Caricature: Bygmalion Patent Office

    The latest cartoon regarding Battistelli's European Patent Office



  28. Links 21/6/2016: GNU/Linux in China's HPC, Linux 4.7 RC4

    Links for the day



  29. Under Battistelli's Regime the EPO is a Lawless, Dark Place

    How the EPO's Investigative Unit (IU) and Control Risks Group (CRG), which is connected to the Stasi through Desa, made the EPO virtually indistinguishable from East Germany (coat of arms/emblem above)



  30. New Paper Demonstrates That Unitary Patent (UPC) is Little More Than a Conspiracy of Patent 'Professionals' and Their Self Interest

    Dr. Ingve Björn Stjerna's latest paper explains that the UPC “expert teams” are in fact not experts but people who are using the UPC as a Trojan horse by which to promote their business interests and corporate objectives


CoPilotCo

RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

CoPilotCo

Recent Posts