EditorsAbout the SiteComes vs. MicrosoftUsing This Web SiteSite ArchivesCredibility IndexOOXMLOpenDocumentPatentsNovellNews DigestSite NewsRSS

01.22.10

Microsoft Security Negligence Confirmed: Critical Internet Explorer Flaw Known and Ignored for 4 Months

Posted in Deception, Microsoft, Security, Windows at 4:12 pm by Dr. Roy Schestowitz

Summary: The newest facts show that Microsoft knowingly refused to fix flaws that led to tremendous damage; lies from Microsoft (about its competition) are refuted as well

IN MANY RECENT posts about Internet Explorer [1, 2, 3, 4, 5, 6, 7, 8], we have pointed out Microsoft’s pattern of negligence [1, 2, 3], which always passes costs (damages) to the public. Microsoft should probably be sued for it, rather than make money from it. Microsoft — like Goldman Sachs — is making a lot of money out of a crisis caused by its own risk-taking.

Here are some self-explanatory news headlines:

Microsoft lies to your face about browser security

Microsoft’s Head of Security and Privacy in the UK has told TechRadar that people who jump ship from Internet Explorer after the recent spate of bad headlines risk ending up on a less secure browser. With France and Germany both advising a move away from Internet Explorer, things are far from rosy for Microsoft’s browser [...yet] Microsoft’s UK security chief Cliff Evans insists that a non-Microsoft browser is the worse option. “The net effect of switching [from IE] is that you will end up on less secure browser,” insisted Evans. “The risk [over this specific] exploit is minimal compared to Firefox or other competing browsers… you will be opening yourself up to security issues.

Let’s fight FUD with facts…

Vulnerability Report: Mozilla Firefox 3.5.x
Unpatched: 0

Vulnerability Report: Google Chrome 3.x
Unpatched: 0

Vulnerability Report: Opera 10.x
Unpatched: 0

Vulnerability Report: Apple Safari 4.x
Unpatched: 0

Vulnerability Report: Microsoft Internet Explorer 6.x
Unpatched: 24
Most Critical Unpatched: Extremely critical

Vulnerability Report: Microsoft Internet Explorer 7.x
Unpatched: 11
Most Critical Unpatched: Extremely critical

Vulnerability Report: Microsoft Internet Explorer 8.x
Unpatched: 4
Most Critical Unpatched: Extremely critical

My recommendation if you use Windows: make sure the version of IE that’s installed (because you can’t uninstall it!) is the latest/least vulnerable (IE8) and then install at least one of the non-IE browsers listed (personally I always recommend Firefox :) and then use THAT. Of course, you could always switch to a Mac or Linux…

Microsoft patches IE, admits it knew of bug last August

As Microsoft patched the Internet Explorer (IE) vulnerability that was used to break into Google’s network, it also acknowledged that it had known of the bug since August 2009, when an Israeli security company reported the flaw.

MS knew of Aurora exploit four months before Google attacks

Microsoft first knew of the bug used in the infamous Operation Aurora IE exploits as long ago as August, four months before the vulnerability was used in exploits against Google and other hi-tech firms in December, it has emerged.

Redmond’s security gnomes finally got around to patching the exploit on Thursday. the hack attacks against Google et al targeted IE 6, a browser first released in 2001. Exploits involved tricking users of vulnerable browsers into visiting booby-trapped websites. These sites downloaded the Hydraq backdoor Trojan and other malicious components onto compromised PCs.

[...]

A quick search of Secunia’s database, via its PSI patching tool, reveals a problem with an unpatched ActiveX control that looks just as bad, for example.

Emergency IE patch goes live as exploits proliferate

Microsoft released an emergency security update for all versions of Internet Explorer on Thursday as attacks exploiting a critical vulnerability in the widely used browser spread to hundreds of websites.

[...]

While some of the sites hosting the attacks were free services that had been co-opted, others appeared to be domains of legitimate companies that had been compromised.

[...]

In an admission that’s sure to spark criticism, Microsoft said it learned of the critical bug more than three months ago.

[...]

The unscheduled bulletin fixes a memory corruption flaw in most versions of the widely used browser that allows attackers to execute malicious code simply by luring victims to a booby-trapped website. It fixes seven other privately reported vulnerabilities, some of which also made remote code execution possible, that Microsoft had been planning to issue next month during its next regularly scheduled patch release.

[...]

Systems compromised by the sites reported by Symantec were infected with a backdoor that collected registry settings and other system information and sent it to an email address that was under the control of attackers. That email address has since been disabled, Talbot said.

Widespread Attacks Exploit Newly Patched IE Bug

The first widespread attack to leverage a recently patched flaw in Microsoft’s Internet Explorer browser has surfaced.

Starting late Wednesday, researchers at antivirus vendor Symantec’s Security Response group began spotting dozens of Web sites that contain the Internet Explorer attack, which works reliably on the IE 6 browser, running on Windows XP. The attack installs a Trojan horse program that is able to bypass some security products and then give hackers access to the system, said Joshua Talbot, a security intelligence manager with Symantec.

Once it has infected a PC, the Trojan sends a notification e-mail to the attackers, using a U.S.-based, free e-mail service that Symantec declined to name.

Make the right browser update: Firefox 3.6

Neolithic Windows security hole alive and well in Windows 7

One of the reasons I’ve never liked Windows is that it was never made to deal with the security problems of working in a networked, multi-user world. As a direct result, Windows has been fundamentally insecure for more than a decade. Even so, I was surprised to find that there’s a 17-year old security hole that’s been in Windows since NT and it’s still present today in Windows 7.

Wow. Even I’m shocked by this latest example of just how rotten Windows security is. It just reminds me again though that while Microsoft keeps adding features and attempting to patch its way out of security problems to Windows, Windows’ foundation is built on sand and not on the stone of good, solid design.

[...]

Be that as it may, the code’s still in there. An attacker can trigger the vulnerability through a variety of means. The end-result is, surprise, another Windows machine that’s totally owned by the attacker. Once in charge, they can vacuum down your files, install malware, and all the other usual tricks.

Vista 7 was never secure to begin with. See the examples below.

  1. Cybercrime Rises and Vista 7 is Already Open to Hijackers
  2. Vista 7: Broken Apart Before Arrival
  3. Department of Homeland Security ‘Poisoned’ by Microsoft; Vista 7 is Open to Hijackers Again
  4. Vista 7 Security “Cannot be Fixed. It’s a Design Problem.”
  5. Why Vista 7 Could be the Least Secure Operating System Ever
  6. Journalists Suggest Banning Windows, Maybe Suing Microsoft Over DDoS Attacks
  7. Vista 7 Vulnerable to Latest “Critical” Flaws
  8. Vista 7 Seemingly Affected by Several More “Critical” Flaws This Month
  9. Reason #1 to Avoid Vista 7: Insecurity
  10. Vista 7 Left Hijackable Again (Almost a Monthly Recurrence)
Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Reddit
  • email
  • Slashdot

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

A Single Comment

  1. uberVU - social comments said,

    January 22, 2010 at 9:26 pm

    Social comments and analytics for this post…

    This post was mentioned on Twitter by schestowitz: Critical Internet Explorer Flaw Known and Ignored for 4 Months http://boycottnovell.com/2010/01/22/refusing-to-fix-ie-flaws/

What Else is New


  1. Links 26/10/2020: Linux 5.10 RC1 and Loongsoon Laptops

    Links for the day



  2. The Downfall of Free Software Leaders (and Their Projects or Missions)

    "Cancel George Orwell, and happy hacking."



  3. IRC Proceedings: Sunday, October 25, 2020

    IRC logs for Sunday, October 25, 2020



  4. Links 25/10/2020: Kodi 18.9, ScummVM Android Love, Cutelyst 2.13

    Links for the day



  5. [Meme] Captain Zemlin and Neil McGovern's Ugly Legacy in GNOME (His Predecessors Work for Microsoft Directly Now)

    The Linux Foundation is already ‘sold’ and Microsoft Tim‘s interview with Neil McGovern, published a few days ago, was rather revealing (comments on the article/interview were also harsh)



  6. How Microsoft is Still Worse Than Google

    "I have decided that we should not publish these extensions. We should wait until we have a way to do a high level of integration that will be harder for the likes of Notes, Wordperfect to achieve, and which will give Office a real advantage."



  7. 'President Bill Gates' Wants to Punish Not Only Google After Using “Extensions” to the Web to Reinforce Microsoft's Monopoly (Antitrust Violations Are a Microsoft Thing)

    In gross distortion of facts and of history and in a rather incredible fashion (very shameless and insulting) the corporate media tries to paint Bill Gates as an antitrust hero that will save the world from monopolies



  8. Donald Trump Helped Bill Gates Increase His Wealth by More Than 50%, Especially During the Pandemic

    Contrary to ridiculous narratives disseminated by nutty accounts all around the Web, Gates and Trump are no foes but 'partners in crime'



  9. Our 14th Birthday is Coming

    We're turning 14 shortly and we need ideas from readers (things that can be done to mark the event and celebrate 'on-line')



  10. In Spite of IBM's Difficult Past and Particularly Dark History, Under Arvind Krishna’s Leadership It Has Only Shown Signs of Improving

    This winter, 6 months after Arvind Krishna’s tenure as CEO began, we can generally say that things seem to have improved and we look forward to further improvements



  11. Links 25/10/2020: GNU Taler's IETF Milestone, RISC OS 5.28 and New Ubuntu Community Council

    Links for the day



  12. IRC Proceedings: Saturday, October 24, 2020

    IRC logs for Saturday, October 24, 2020



  13. Links 24/10/2020: GDB 10.1, Kodachi 7.4, Wine 5.20

    Links for the day



  14. Celebrating Code of Conduct Violations

    Reprinted with permission from Daniel Pocock



  15. The Militarised Elephant in the Room Still Commands a Lot of Free Software Development

    We take a difficult (albeit in-depth and perfectly factual) look at IBM's past and present; considering this is the company that controls Red Hat (which in turn controls many key projects in GNU/Linux) we need a better understanding of the real context, not PR fluff and marketing



  16. Juve Patent's Love of Patent Trolls and Their Misinformation

    The press 'gutter' known as Juve (basically propaganda disguised as 'news' since years ago) has gotten to the point where the publisher is just an extension of lawyers and liars



  17. IRC Proceedings: Friday, October 23, 2020

    IRC logs for Friday, October 23, 2020



  18. Look How Many Tux I Give!

    "Long live rms, long live (Hyperbola) GNU/BSD, and happy hacking."



  19. Embrace, Extend, and Extensions: Two New Reasons to Delete GitHub, Which Microsoft Ruined for Everyone (Except the Copyright Cartel and Other Censors)

    GitHub is being turned into a garbage dump with malicious masters (or monsters, or mobsters); many people are denied access for using the 'wrong' browser and developers/projects are being censored (not for doing anything wrong or illegal, either)



  20. [Meme] When EPO Staff Claims to be 'Ill' or 'Sick'... During a Pandemic's European Peak

    Gotta check and verify that those 'lazy' EPO examiners aren't just faking being ill (in order to not meet "production" targets)



  21. The EPO Has Relegated or Lowered Itself to Extremely Poor Standards

    Today's EPO continues to reaffirm the image of global weakness; having failed to improve the working conditions and quality of the work (its actions did the exact opposite), it's nowadays begging China to send over lots of workload irrespective of quality or merit and it is outsourcing the functions of the Office to the United States



  22. Links 23/10/2020: Turing Pi 2, GNU Parallel 20201022

    Links for the day



  23. IRC Proceedings: Thursday, October 22, 2020

    IRC logs for Thursday, October 22, 2020



  24. Links 23/10/2020: 'Groovy Gorilla' Everywhere in the News

    Links for the day



  25. For Better 'Tech Rights' in the United States (and the World at Large) the 'Orange Man' Needs to Go

    With less than a fortnight before election day we explain our stance from a purely tech-related rationale



  26. [Meme] Microsoft Never 'Brought' Skype to GNU/Linux (It Just Bought Skype) and It Never 'Brought' Edge to GNU/Linux Either (Google Did)

    Foolish media or gullible 'journalists' are giving Microsoft credit for other people's work; this isn't the first time either, but it helps perpetuate lies such as "Microsoft loves Linux" (so who cares about facts anyway?)



  27. It's Going to be a Long, Long Winter

    Today we revert back to lock-down mode; we're reflecting and pondering what comes next



  28. TechRadar is an Irresponsible Clickbait and Misinformation Site Disguised as 'News'

    TechRadar is no tech and no radar, either. It's just an opportunistic click-harvesting machine, disguised as a source of "news"; today we deal with the latest example (among many).



  29. Links 22/10/2020: LibreOffice 6.4.7, Septor 2020.5, Ubuntu 20.10 Released, FreeBSD Quarterly Status Report

    Links for the day



  30. IRC Proceedings: Wednesday, October 21, 2020

    IRC logs for Wednesday, October 21, 2020


RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts