02.18.10
Here Come Many More Microsoft Windows Attacks
Summary: A lot of security headaches caused to lot of people, all due to Microsoft Windows being so vulnerable
Yesterday we wrote about Microsoft's risk that impacts people's lives. Blame Microsoft’s utter negligence [1, 2, 3] for it. Where there is deliberate negligence there is also liability and responsibility.
It has been surprising to some network experts that the Internet has yet not come under an attack that fragments or altogether suspends it at root level [1, 2]. It’s not as though it is impossible; it’s just that nobody has dared to trigger it just yet and the United States considers bombing (in the physical sense) any botmaster who may attempt this. According to this latest report, the United States is not prepared for an attack from Windows botnets.
During the simulated cyber attack that took place yesterday in Washington and was recorded by the CNN, one thing became clear: the US are still not ready to deflect or mitigate such an attack to an extent that would not affect considerably the everyday life of its citizens.
Already, there are some notable attacks that show up in the news. Here is an article that will appear in the New York Times tomorrow:
A malicious software program has infected the computers of more than 2,500 corporations around the world, according to NetWitness, a computer network security firm.
It’s a John Markoff article, so neither Microsoft nor Windows are mentioned, as usual. Under some pressure he once made an exception. Here is a similar report from Reuters:
Virus has breached 75,000 computers: study
A new type of computer virus is known to have breached almost 75,000 computers in 2,500 organizations around the world, including user accounts of popular social network websites, according Internet security firm NetWitness.
Here is another Windows disaster unfolding:
City of Norfolk hit with code that takes out nearly 800 PCs
Malicious code that mysteriously found its way onto an internal virtual print server took out nearly 800 computers used by the city of Norfolk, Virginia, last week.
The code apparently was activated when workers shut down their computers, said Hap Cluff, IT director for the city of Norfolk. “It was triggered by the action of logging off,” he said. ”
The code nearly wiped out the C drives of the 784 affected computers and essentially deleted the Windows operating system. The contents of the system folders on those machines, normally about 1.5GB in size, shrunk to 500 MB, he said.
Yes, all the above indicates that it’s a Windows problem. More here:
Hap Cluff, director of the information technology department for the City of Norfolk, said the incident began on Feb. 9, and that the city has been working ever since to rebuild 784 PCs and laptops that were hit (the city manages roughly 4,500 systems total).
Wonderful, eh? Here is an article about source of vulnerabilities, based on data that we mentioned in yesterday's post about security.
Just as they did last year, over thirty international security organisations have come together, to publish a list of the 25 most dangerous programming errors leading to vulnerabilities that can be exploited for cybercrime and espionage. The 2010 CWE/SANS Top 25 Most Dangerous Programming Errors has been updated with a number of improvements to how the errors are graded, prioritised and categorised. For example, new “Focus Profiles” allow readers to quickly see the listed errors sorted for particular professionals’ interests.
As we pointed out yesterday, Microsoft is not well positioned here and its general programming practices and use cases (e.g. clicking attachment to execute) are part of the problem. One might add to this the fact that Microsoft’s patches vulnerabilities poorly and sloppily, often hiding known flaws until they are actively exploited. █
“Our products just aren’t engineered for security.”
–Brian Valentine, Microsoft executive
Needs Sunlight said,
February 19, 2010 at 2:13 am
Hmm “Blame Microsoft’s utter negligence”? It’s no longer MIcrosoft’s fault at this point. The company’s complete product line is well known. Now it is the fault of the managers who allow Microsoft product in their work environment and the fault of the employees that roll out Microsoft products.
Look at it this way. It’s perfectly fine to manufacture and sell lead salts. It’s not fine to use them as artificial sweeteners.
Roy Schestowitz Reply:
February 19th, 2010 at 5:10 am
Blame false advertising then. I am going to have some posts on the subject shortly.
Robotron 2084 Reply:
February 19th, 2010 at 10:49 am
It’s not the fault of any one group. Everyone is to blame to some extent, including users and the computer experts who try to help them. This article from Reuters talks about users who become so baffled by computer jargon that they become completely turned off to learning about security.
http://www.reuters.com/article/idUSTRE61I2OB20100219