EditorsAbout the SiteComes vs. MicrosoftUsing This Web SiteSite ArchivesCredibility IndexOOXMLOpenDocumentPatentsNovellNews DigestSite NewsRSS

01.22.10

Microsoft Security Negligence Confirmed: Critical Internet Explorer Flaw Known and Ignored for 4 Months

Posted in Deception, Microsoft, Security, Windows at 4:12 pm by Dr. Roy Schestowitz

Summary: The newest facts show that Microsoft knowingly refused to fix flaws that led to tremendous damage; lies from Microsoft (about its competition) are refuted as well

IN MANY RECENT posts about Internet Explorer [1, 2, 3, 4, 5, 6, 7, 8], we have pointed out Microsoft’s pattern of negligence [1, 2, 3], which always passes costs (damages) to the public. Microsoft should probably be sued for it, rather than make money from it. Microsoft — like Goldman Sachs — is making a lot of money out of a crisis caused by its own risk-taking.

Here are some self-explanatory news headlines:

Microsoft lies to your face about browser security

Microsoft’s Head of Security and Privacy in the UK has told TechRadar that people who jump ship from Internet Explorer after the recent spate of bad headlines risk ending up on a less secure browser. With France and Germany both advising a move away from Internet Explorer, things are far from rosy for Microsoft’s browser [...yet] Microsoft’s UK security chief Cliff Evans insists that a non-Microsoft browser is the worse option. “The net effect of switching [from IE] is that you will end up on less secure browser,” insisted Evans. “The risk [over this specific] exploit is minimal compared to Firefox or other competing browsers… you will be opening yourself up to security issues.

Let’s fight FUD with facts…

Vulnerability Report: Mozilla Firefox 3.5.x
Unpatched: 0

Vulnerability Report: Google Chrome 3.x
Unpatched: 0

Vulnerability Report: Opera 10.x
Unpatched: 0

Vulnerability Report: Apple Safari 4.x
Unpatched: 0

Vulnerability Report: Microsoft Internet Explorer 6.x
Unpatched: 24
Most Critical Unpatched: Extremely critical

Vulnerability Report: Microsoft Internet Explorer 7.x
Unpatched: 11
Most Critical Unpatched: Extremely critical

Vulnerability Report: Microsoft Internet Explorer 8.x
Unpatched: 4
Most Critical Unpatched: Extremely critical

My recommendation if you use Windows: make sure the version of IE that’s installed (because you can’t uninstall it!) is the latest/least vulnerable (IE8) and then install at least one of the non-IE browsers listed (personally I always recommend Firefox :) and then use THAT. Of course, you could always switch to a Mac or Linux…

Microsoft patches IE, admits it knew of bug last August

As Microsoft patched the Internet Explorer (IE) vulnerability that was used to break into Google’s network, it also acknowledged that it had known of the bug since August 2009, when an Israeli security company reported the flaw.

MS knew of Aurora exploit four months before Google attacks

Microsoft first knew of the bug used in the infamous Operation Aurora IE exploits as long ago as August, four months before the vulnerability was used in exploits against Google and other hi-tech firms in December, it has emerged.

Redmond’s security gnomes finally got around to patching the exploit on Thursday. the hack attacks against Google et al targeted IE 6, a browser first released in 2001. Exploits involved tricking users of vulnerable browsers into visiting booby-trapped websites. These sites downloaded the Hydraq backdoor Trojan and other malicious components onto compromised PCs.

[...]

A quick search of Secunia’s database, via its PSI patching tool, reveals a problem with an unpatched ActiveX control that looks just as bad, for example.

Emergency IE patch goes live as exploits proliferate

Microsoft released an emergency security update for all versions of Internet Explorer on Thursday as attacks exploiting a critical vulnerability in the widely used browser spread to hundreds of websites.

[...]

While some of the sites hosting the attacks were free services that had been co-opted, others appeared to be domains of legitimate companies that had been compromised.

[...]

In an admission that’s sure to spark criticism, Microsoft said it learned of the critical bug more than three months ago.

[...]

The unscheduled bulletin fixes a memory corruption flaw in most versions of the widely used browser that allows attackers to execute malicious code simply by luring victims to a booby-trapped website. It fixes seven other privately reported vulnerabilities, some of which also made remote code execution possible, that Microsoft had been planning to issue next month during its next regularly scheduled patch release.

[...]

Systems compromised by the sites reported by Symantec were infected with a backdoor that collected registry settings and other system information and sent it to an email address that was under the control of attackers. That email address has since been disabled, Talbot said.

Widespread Attacks Exploit Newly Patched IE Bug

The first widespread attack to leverage a recently patched flaw in Microsoft’s Internet Explorer browser has surfaced.

Starting late Wednesday, researchers at antivirus vendor Symantec’s Security Response group began spotting dozens of Web sites that contain the Internet Explorer attack, which works reliably on the IE 6 browser, running on Windows XP. The attack installs a Trojan horse program that is able to bypass some security products and then give hackers access to the system, said Joshua Talbot, a security intelligence manager with Symantec.

Once it has infected a PC, the Trojan sends a notification e-mail to the attackers, using a U.S.-based, free e-mail service that Symantec declined to name.

Make the right browser update: Firefox 3.6

Neolithic Windows security hole alive and well in Windows 7

One of the reasons I’ve never liked Windows is that it was never made to deal with the security problems of working in a networked, multi-user world. As a direct result, Windows has been fundamentally insecure for more than a decade. Even so, I was surprised to find that there’s a 17-year old security hole that’s been in Windows since NT and it’s still present today in Windows 7.

Wow. Even I’m shocked by this latest example of just how rotten Windows security is. It just reminds me again though that while Microsoft keeps adding features and attempting to patch its way out of security problems to Windows, Windows’ foundation is built on sand and not on the stone of good, solid design.

[...]

Be that as it may, the code’s still in there. An attacker can trigger the vulnerability through a variety of means. The end-result is, surprise, another Windows machine that’s totally owned by the attacker. Once in charge, they can vacuum down your files, install malware, and all the other usual tricks.

Vista 7 was never secure to begin with. See the examples below.

  1. Cybercrime Rises and Vista 7 is Already Open to Hijackers
  2. Vista 7: Broken Apart Before Arrival
  3. Department of Homeland Security ‘Poisoned’ by Microsoft; Vista 7 is Open to Hijackers Again
  4. Vista 7 Security “Cannot be Fixed. It’s a Design Problem.”
  5. Why Vista 7 Could be the Least Secure Operating System Ever
  6. Journalists Suggest Banning Windows, Maybe Suing Microsoft Over DDoS Attacks
  7. Vista 7 Vulnerable to Latest “Critical” Flaws
  8. Vista 7 Seemingly Affected by Several More “Critical” Flaws This Month
  9. Reason #1 to Avoid Vista 7: Insecurity
  10. Vista 7 Left Hijackable Again (Almost a Monthly Recurrence)
Share this post: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Digg
  • del.icio.us
  • Reddit
  • co.mments
  • DZone
  • email
  • Google Bookmarks
  • LinkedIn
  • NewsVine
  • Print
  • Technorati
  • TwitThis
  • Facebook

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

A Single Comment

  1. uberVU - social comments said,

    January 22, 2010 at 9:26 pm

    Social comments and analytics for this post…

    This post was mentioned on Twitter by schestowitz: Critical Internet Explorer Flaw Known and Ignored for 4 Months http://boycottnovell.com/2010/01/22/refusing-to-fix-ie-flaws/

What Else is New


  1. Links 16/1/2017: Linux 4.10 RC4, Linux Mint 18.1 'Serena' KDE Edition Beta

    Links for the day



  2. 'Financial Director' Publishes Fake News About the Unitary Patent (UPC)

    Response to some of the latest UPC propaganda, which strives to misinform Financial Directors so as to enrich the author and his firm



  3. Independent and Untainted Web Sites About Patents Are Still Few and Rare

    Commentary about news sources that we rely on, as well as the known pitfalls or the vested interests deeply ingrained in them



  4. The 20% Rule: Patent Trolling Suffers Double-Digit Declines and Patent Troll Technicolor is Collapsing

    Significant demise or total catastrophe for the modus operandi (method) of going after companies with a pile of patents and threats of litigation



  5. US Supreme Court Did Not End Apple's Patent Disputes Over Android (Linux), More Cases Imminent

    An overview of some very recent news regarding the highest court in the United States, which has been dealing with cases that can determine the fate of Free/Open Source software in an age of patent uncertainty and patent thickets surrounding mobility



  6. Links 15/1/2017: Switching From OS X to GNU/Linux, Debian 8.7 Released

    Links for the day



  7. Number of New Patent Cases in the US Fell 25% Last Year, Thanks in Part to the Demise of Software Patent Trolls

    Litigation and prosecutions that rely on patents (failure to resolve disputes, e.g. by sharing ideas, out of court) is down very sharply, in part because firms that make nothing at all (just threaten and/or litigate) have been sinking after much-needed reform



  8. America Invents Act Improved Patent Quality, But Right Wingers Threaten to Make It Worse Again

    The past half a decade saw gradual improvement in assessment of patents in the United States, but there is a growing threat and pressure from the patent microcosm to restore patent maximalism and chaos



  9. PTAB -- Not Deterred by Courts -- Continues to Invalidate a Lot of Software Patents

    The Patent Trial and Appeal Board (PTAB) continues to make progress reforming the patent system by eliminating a lot of patents and setting an example (or new standards) for what is patent-eligible after Alice



  10. EPO Abuses Come Under Fire From Politicians in Luxembourg

    Luxembourg is the latest nation in which concerns about the EPO's serious abuses are brought up not only by the media but also by politicians



  11. Constitutionality as a Barrier and Brexit Barriers to UPC Keep the Whole Pipe Dream Deadlocked

    The UPC is still going nowhere fast, but the demise (or death) of the UPC as we know it must not be taken for granted



  12. Links 14/1/2017: Wine 2.0 RC5 and AryaLinux 2017 Released

    Links for the day



  13. Links 13/1/2017: Linux 4.9.3 and Linux 4.4.42

    Links for the day



  14. Brexit Means No UPC (Unified Patent Court)

    Now that Jo Johnson, Boris Johnson's brother, is officially declared the new minister for intellectual property in the UK everything that Lucy Neville-Rolfe wrote is as solid as paper bag on a rainy London day



  15. Patent Trolls and Software Patents: CloudTrade, Patent Practitioners Density, and Via Licensing

    Software patents armament from a British company, charted concentration of the patent microcosm in the United States, and US-leaning patent trolls that prey on China



  16. Patent Maximalism -- Like Copyright Maximalism -- Relies on Misconceptions and Mass Deception

    The latest examples of discussions about patent scope, courtesy of those looking to benefit financially by pushing such monopolies to the max



  17. Software Patents Still Promoted by IBM and Its Lobbyist (and Former Employee) David Kappos, in Defiance of Much-Needed US Patent Reform

    While the corporate media celebrates IBM as though it's some kind of 'champion' for hoarding patents that it then uses to attack companies which actually grow



  18. Brexit/Trump Effect: Patent Systems With Institutional Corruption and Nepotism

    Rumours about Britain's head of patents (and copyrights etc.) being the brother of the Brexit campaigner and Foreign Minister; meanwhile, on the other side of the Atlantic, rumours suggest that the corrupt judge Rader might be the next head of patents in the United States



  19. Links 11/1/2017: X.Org Server 1.19.1, GitHub's Atom 1.13

    Links for the day



  20. The Patent Microcosm is Already Sucking up to Donald Trump in an Effort to Enrich Itself at Everyone's Expense

    Four new examples of patent maximalists embracing/adopting the pseudo-populist slogan to advance their goals of increasing litigation (which they profit from) and undermining PTAB (which made patents great in the quality sense)



  21. Patent Quality in the United States Can Only be Assessed at the Patent Trial and Appeal Board (PTAB) and the Courts

    The travesty of patent offices in the US and China, where the goal or the accomplishment is measured in terms of the number of patents rather than their quality



  22. Gradual Collapse of Microsoft's Extensive (and External) Patent Trolling Operations

    The President of Microsoft Technology Licensing LLC (patent troll) leaves and the founder of Intellectual Ventures, Microsoft's largest peripheral patent troll, joins Sherpa Technology



  23. No End to Battistelli's Witch-hunts Against the Media, Against Staff, and Against Politicians

    Rumours about the fate of people who are (or have been) criticising Battistelli's reign of terror at the EPO



  24. Links 10/1/2017: Synfig 1.2, Kodachi Linux 3.7

    Links for the day



  25. With Help From the US Supreme Court (Key Cases), Patent Trolls Are Going Away

    The demise of patent trolls in the United States, a trend partly attributable to Alice and other Supreme Court decisions, will likely accelerate soon (later this year) as the future of the Eastern District of Texas courts is at stake



  26. Patent Maximalism on Display: Patent Aggressor IBM Celebrated in the Media

    The patent lust at IBM, which is suing if not just shaking down companies using software patents, earns plenty of puff pieces from the corporate media



  27. FFPE-EPO, the EPO Management's Pet/Yellow Union, Helps Union-Busting (Against SUEPO) in Letter to Notorious Vice-President

    In a letter to Elodie Bergot (as CC) and Željko Topić, who faces many criminal investigations, FFPE-EPO ringleaders reveal their allegiance not to EPO staff but to those who perpetually attack the staff



  28. Links 9/1/2017: Civilization VI Coming to GNU/Linux, digiKam 5.4.0 Released

    Links for the day



  29. Links 9/1/2017: Dell’s Latest XPS 13, GPD Pocket With GNU/Linux

    Links for the day



  30. Update on Patent Trolls and Their Enablers: IAM, Fortress, Inventergy, Nokia, MOSAID/Conversant, Microsoft, Intellectual Ventures, Faraday Future, A*STAR, GPNE, AlphaCap Ventures, and TC Heartland

    A potpourri of reports about some of the world’s worst patent trolls and their highly damaging enablers/facilitators, including Microsoft which claims that it “loves Linux” whilst attacking it with patents by proxy


CoPilotCo

RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

CoPilotCo

Recent Posts