EditorsAbout the SiteComes vs. MicrosoftUsing This Web SiteSite ArchivesCredibility IndexOOXMLOpenDocumentPatentsNovellNews DigestSite NewsRSS

01.22.10

Microsoft Security Negligence Confirmed: Critical Internet Explorer Flaw Known and Ignored for 4 Months

Posted in Deception, Microsoft, Security, Windows at 4:12 pm by Dr. Roy Schestowitz

Summary: The newest facts show that Microsoft knowingly refused to fix flaws that led to tremendous damage; lies from Microsoft (about its competition) are refuted as well

IN MANY RECENT posts about Internet Explorer [1, 2, 3, 4, 5, 6, 7, 8], we have pointed out Microsoft’s pattern of negligence [1, 2, 3], which always passes costs (damages) to the public. Microsoft should probably be sued for it, rather than make money from it. Microsoft — like Goldman Sachs — is making a lot of money out of a crisis caused by its own risk-taking.

Here are some self-explanatory news headlines:

Microsoft lies to your face about browser security

Microsoft’s Head of Security and Privacy in the UK has told TechRadar that people who jump ship from Internet Explorer after the recent spate of bad headlines risk ending up on a less secure browser. With France and Germany both advising a move away from Internet Explorer, things are far from rosy for Microsoft’s browser [...yet] Microsoft’s UK security chief Cliff Evans insists that a non-Microsoft browser is the worse option. “The net effect of switching [from IE] is that you will end up on less secure browser,” insisted Evans. “The risk [over this specific] exploit is minimal compared to Firefox or other competing browsers… you will be opening yourself up to security issues.

Let’s fight FUD with facts…

Vulnerability Report: Mozilla Firefox 3.5.x
Unpatched: 0

Vulnerability Report: Google Chrome 3.x
Unpatched: 0

Vulnerability Report: Opera 10.x
Unpatched: 0

Vulnerability Report: Apple Safari 4.x
Unpatched: 0

Vulnerability Report: Microsoft Internet Explorer 6.x
Unpatched: 24
Most Critical Unpatched: Extremely critical

Vulnerability Report: Microsoft Internet Explorer 7.x
Unpatched: 11
Most Critical Unpatched: Extremely critical

Vulnerability Report: Microsoft Internet Explorer 8.x
Unpatched: 4
Most Critical Unpatched: Extremely critical

My recommendation if you use Windows: make sure the version of IE that’s installed (because you can’t uninstall it!) is the latest/least vulnerable (IE8) and then install at least one of the non-IE browsers listed (personally I always recommend Firefox :) and then use THAT. Of course, you could always switch to a Mac or Linux…

Microsoft patches IE, admits it knew of bug last August

As Microsoft patched the Internet Explorer (IE) vulnerability that was used to break into Google’s network, it also acknowledged that it had known of the bug since August 2009, when an Israeli security company reported the flaw.

MS knew of Aurora exploit four months before Google attacks

Microsoft first knew of the bug used in the infamous Operation Aurora IE exploits as long ago as August, four months before the vulnerability was used in exploits against Google and other hi-tech firms in December, it has emerged.

Redmond’s security gnomes finally got around to patching the exploit on Thursday. the hack attacks against Google et al targeted IE 6, a browser first released in 2001. Exploits involved tricking users of vulnerable browsers into visiting booby-trapped websites. These sites downloaded the Hydraq backdoor Trojan and other malicious components onto compromised PCs.

[...]

A quick search of Secunia’s database, via its PSI patching tool, reveals a problem with an unpatched ActiveX control that looks just as bad, for example.

Emergency IE patch goes live as exploits proliferate

Microsoft released an emergency security update for all versions of Internet Explorer on Thursday as attacks exploiting a critical vulnerability in the widely used browser spread to hundreds of websites.

[...]

While some of the sites hosting the attacks were free services that had been co-opted, others appeared to be domains of legitimate companies that had been compromised.

[...]

In an admission that’s sure to spark criticism, Microsoft said it learned of the critical bug more than three months ago.

[...]

The unscheduled bulletin fixes a memory corruption flaw in most versions of the widely used browser that allows attackers to execute malicious code simply by luring victims to a booby-trapped website. It fixes seven other privately reported vulnerabilities, some of which also made remote code execution possible, that Microsoft had been planning to issue next month during its next regularly scheduled patch release.

[...]

Systems compromised by the sites reported by Symantec were infected with a backdoor that collected registry settings and other system information and sent it to an email address that was under the control of attackers. That email address has since been disabled, Talbot said.

Widespread Attacks Exploit Newly Patched IE Bug

The first widespread attack to leverage a recently patched flaw in Microsoft’s Internet Explorer browser has surfaced.

Starting late Wednesday, researchers at antivirus vendor Symantec’s Security Response group began spotting dozens of Web sites that contain the Internet Explorer attack, which works reliably on the IE 6 browser, running on Windows XP. The attack installs a Trojan horse program that is able to bypass some security products and then give hackers access to the system, said Joshua Talbot, a security intelligence manager with Symantec.

Once it has infected a PC, the Trojan sends a notification e-mail to the attackers, using a U.S.-based, free e-mail service that Symantec declined to name.

Make the right browser update: Firefox 3.6

Neolithic Windows security hole alive and well in Windows 7

One of the reasons I’ve never liked Windows is that it was never made to deal with the security problems of working in a networked, multi-user world. As a direct result, Windows has been fundamentally insecure for more than a decade. Even so, I was surprised to find that there’s a 17-year old security hole that’s been in Windows since NT and it’s still present today in Windows 7.

Wow. Even I’m shocked by this latest example of just how rotten Windows security is. It just reminds me again though that while Microsoft keeps adding features and attempting to patch its way out of security problems to Windows, Windows’ foundation is built on sand and not on the stone of good, solid design.

[...]

Be that as it may, the code’s still in there. An attacker can trigger the vulnerability through a variety of means. The end-result is, surprise, another Windows machine that’s totally owned by the attacker. Once in charge, they can vacuum down your files, install malware, and all the other usual tricks.

Vista 7 was never secure to begin with. See the examples below.

  1. Cybercrime Rises and Vista 7 is Already Open to Hijackers
  2. Vista 7: Broken Apart Before Arrival
  3. Department of Homeland Security ‘Poisoned’ by Microsoft; Vista 7 is Open to Hijackers Again
  4. Vista 7 Security “Cannot be Fixed. It’s a Design Problem.”
  5. Why Vista 7 Could be the Least Secure Operating System Ever
  6. Journalists Suggest Banning Windows, Maybe Suing Microsoft Over DDoS Attacks
  7. Vista 7 Vulnerable to Latest “Critical” Flaws
  8. Vista 7 Seemingly Affected by Several More “Critical” Flaws This Month
  9. Reason #1 to Avoid Vista 7: Insecurity
  10. Vista 7 Left Hijackable Again (Almost a Monthly Recurrence)
Share this post: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Digg
  • del.icio.us
  • Reddit
  • co.mments
  • DZone
  • email
  • Google Bookmarks
  • LinkedIn
  • NewsVine
  • Print
  • Technorati
  • TwitThis
  • Facebook

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

A Single Comment

  1. uberVU - social comments said,

    January 22, 2010 at 9:26 pm

    Social comments and analytics for this post…

    This post was mentioned on Twitter by schestowitz: Critical Internet Explorer Flaw Known and Ignored for 4 Months http://boycottnovell.com/2010/01/22/refusing-to-fix-ie-flaws/

What Else is New


  1. More Utter Shame Unveiled at Battistelli's EPO: Intimidation Tactics With Help From 'Control Risks'

    The unaccountable thugs who run the EPO have hired London-based spooks to help silence their opposition and their critics



  2. GNU/Linux Still Under Attack From Apple and Microsoft, Patents Remain the Weapon of Choice

    A timely reminder of the importance of patent matters, for they are being used to eliminate the zero-cost advantage of Free/libre software and make it more proprietary, privacy-infringing, and user-hostile (as a result of blackmail)



  3. Gartner Group and NASSCOM: Will Lie for FUD, on Behalf of Microsoft and Proprietary Software

    Some of the latest arguments against Free/libre software turn out to be arriving from couriers of Microsoft and its agenda



  4. Windows is a Franchise in Demise, Don't Believe the Hype

    Ongoing propaganda about Vista 10, 'cloud', and other buzzwords or brands are put in perspective



  5. Links 21/5/2015: Fedora 22 RC2, CERN Chooses OpenStack

    Links for the day



  6. Microsoft is Again Showing Its Hatred of Free/Open Source Software by Lobbying the Indian Government to Drop a Rational National Policy

    Microsoft decides to attack Free/Open Source software (FOSS) in India, where the corporate media is very much complicit in misleading the public



  7. Links 20/5/2015: Containers, OpenStack, and EXT4 Corruption

    Links for the day



  8. The PATENT Act, Distraction of Trolls, and Lobbying for Software Patents by Protectionists

    Only large corporations and their lawyers are able to formally change the US patent system through public officials and politicians, despite recent rulings from very high courts



  9. Corporate Media and Friends of Microsoft Are Still Lying About the Cost of Vista 10

    In a desperate effort to beat operating systems that are Free (libre) and free (gratis), such as GNU/Linux or Android, Microsoft shores up the illusion of 'free' (gratis) Windows



  10. Links 19/5/2015: Linux 4.1 RC4, Thunderbird 31.7.0, OpenStack Event

    Links for the day



  11. Links 18/5/2015: Russia Chooses Jolla, Many New Distro Releases, Meizu Devices

    Links for the day



  12. Even Converting an Image to Greyscale is Now a Patent

    Simple mathematics becoming patented as Fujifilm claims 'ownership' of photographic conversion to greyscale



  13. Grooming of the World's Biggest Patent Troll, Nathan Myhrvold of Microsoft and Intellectual Ventures

    UCLA and Microsoft-linked media are framing big thugs as heroes, doing a great disservice to both academia and journalism



  14. The EPO's Fight to Bring Software Patents Into Europe is One Step Closer to a 'Victory' (for Multinationals)

    Opposition to the Unified Patent Court (UPC) is being crushed and Italy is one of the latest actors to have fallen in the battle



  15. Microsoft's 'Former' Staff Continues With His Anti-Google Rhetoric at CBS

    A Microsoft intern, who has moved on to journalism, is still showing his affinity for Microsoft with apologetics and spin



  16. More of Microsoft's False Claims About Cost of Vista 10 and More Layoffs

    Vista 10 is still being marketed using lies and Microsoft may be going down the same route as Nokia



  17. Microsoft Remotely Bricks -- Intentionally -- Xbox One

    Microsoft is showing off its kill switches, kills consoles of people whom it doesn't like



  18. IRC Proceedings: May 3rd - May 16th, 2015

    Many IRC logs



  19. Links 17/5/2015: NuTyX Saravane 15.05, Panasonic and Firefox OS

    Links for the day



  20. Links 16/5/2015: MAME Free Software. Rust 1.0, New Wine

    Links for the day



  21. Links 15/5/2015: GNOME 3.16.2, GNU Guix 0.8.2

    Links for the day



  22. Links 15/5/2015: Skrooge Releases, Linux 3.14.42, Linux 3.10.78

    Links for the day



  23. "VENOM" FUD Attack -- Like "Heartbleed" FUD Attack -- Linked to Microsoft

    Why CrowdStrike™ is motivated to smear Free software and establish a stigma of insecurity in Free software-based virtual machines/'clouds'



  24. Spinning Microsoft's Inability to Sell Windows (or Office) as a Strength

    The 'cloud' mindset, which is promoted by surveillance fanatics, increasingly used to pretend that Microsoft has a bright future, despite declining sales



  25. New Windows Ransomware: No Branding, Not Even a Mention of Windows

    New example of media bias which completely omits Windows and spares Microsoft as that may lead to bad publicity



  26. VENOM® is Not a Serious Bug, It's Just a Marketing Campaign From CrowdStrike

    Many journalists bamboozled into becoming couriers of CrowdStrike, an insecurity firm which tries to market itself using a name and logo for a very old bug



  27. Links 13/5/2015: GNU/Linux PCs in Russia, Fedora 22 Freeze

    Links for the day



  28. Does Anyone Still View Cyanogen as Anything But a Microsoft Proxy?

    The marriage of convenience between Microsoft and Cyanogen helps reaffirm CyanogenMod's status as a Microsoft Trojan horse which must be rejected



  29. Open Source Revisionism of GNU and Free Software History

    Media mistreatment of the very roots of Free/Open Source software (FOSS), which is now approaching 35 years in age and increasingly thriving



  30. Microsoft Wants GNU/Linux Users and Developers Addicted to Microsoft APIs by Means of Cross-Platform Proprietary Software

    Microsoft's proprietary software, such as Visual Studio Code and PowerShell, thrown at GNU/Linux users in an effort to promote Microsoft's way of doing things and re-enforce lock-in


CoPilotCo

RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

CoPilotCo

Recent Posts