EditorsAbout the SiteComes vs. MicrosoftUsing This Web SiteSite ArchivesCredibility IndexOOXMLOpenDocumentPatentsNovellNews DigestSite NewsRSS

02.22.10

Microsoft Resorts to Blame Games (Against Exploiters of Microsoft’s Own Flaws and Against Google)

Posted in Google, Microsoft, Security, Windows at 7:32 am by Dr. Roy Schestowitz

Chinese girl in beijing

Summary: Microsoft is transforming the debate from one which is centered on Microsoft’s inability to secure Windows to one that focuses on external factors (the press is blaming Chinese schoolchildren)

“Blame someone else” is the Microsoft mantra/motto [1, 2]. As we found out yesterday, Microsoft's legal team plays the same type of game. Microsoft is already downplaying the TPM crack and it goes further than this by blaming crackers for blue screens of death. In a world where almost half the machines that run Windows (that's 1 in 2) are confirmed/estimated to be infected, Microsoft can blame the crackers all it wants, but how and why do they manage to intrude other people’s PCs in the first place? According to this message (relating to Microsoft's proposal of Internet driver's licences):

We are sitting on an Internet with *at least* a hundred million fully-compromised, fully-owned systems. Personally, I suspect that the number is closer to double that. Others have postulated still higher values. Whatever that number is, though, it’s (a) big and (b) getting bigger. And there’s no reason, at present, to suspect that the trend will reverse, because nobody’s doing anything that appears to — in any significant way — to be an effective countermeasure.

The new owners of those systems have unfettered access to ANY credentials present on or used on those systems. The overwhelming majority of them are end-user systems, of course, but how many login or email or other access credentials does the average user have? A work email account? One for home? A freemail account? Some number of social networking accounts? How about banks? Utilities? Shopping sites? VPN for a client?

So, according to the above, it’s safe to expect any second Windows PC to be a zombie (the statistics still vary depending on the source). It’s not even improving. Here are some news articles from the weekend:

Cybercriminals Exploit Haiti Tragedy with Malware

There was no let up in spamming and phishing activities last month even as the entire world watched with sympathy the tragedy in Haiti. To add to the sorrow behind the devastating earthquake on January 12, cybercriminals took advantage of the tragedy to launch spamming and phishing attacks.

Chuck Norris Botnet Karate-chops Routers Hard

If you haven’t changed the default password on your home router, you may be in for an unwanted visit from Chuck Norris — the Chuck Norris botnet, that is.

Discovered by Czech researchers, the botnet has been spreading by taking advantage of poorly configured routers and DSL modems, according to Jan Vykopal, the head of the network security department with Masaryk University’s Institute of Computer Science in Brno, Czech Republic.

Olympic skier Begg-Smith known as ‘spam king’

Kneber Botnet: What You Need to Know Right Now

Everything you ever wanted to know about Xbox hacking

Malware – usually in the form of fake point generators – often comes into play. “Fake points generators that run on your PC promise free Microsoft points in return for your login details,” Boyd explained. “Of course, what happens is your data is sent back to base via email should you enter it into the program. Typically, the phishers will also hijack YouTube accounts and place fake ‘it works’ messages on the videos promoting them [phishing tricks],” he added.

BSODs are not the major problem, but their relevance to the cracking cannot be ignored.

The point the author makes about the problem would have been fixed long ago in Linux, or any other FOSS software, is the most important part of the article, in my opinion. The way the situation is today, you have a few people at Microsoft trying to keep up with security issues.

Obviously, people talk about the BSOD issue as one involving Microsoft’s attempt to secure machines, but those machines are already compromised. It means that the discussion has been completely warped [1, 2] and Microsoft’s blame-shifting game has worked effectively (with help from Amarillo). SJVN correctly points out that Microsoft is not off the hook because those BSODs were caused by Microsoft’s inability to secure Windows in the first place.

More than a week after Microsoft released an XP patch that seemed to cause BSODs (Blue Screen of Death), Microsoft announced that the immediate cause was the Alureon rootkit. Fair enough, but what about the 17-year old Windows security hole that the rootkit was exploiting?

I mean, come on. This bug dates back to 1993 when Windows for Workgroups 3.11 and Windows NT 3.1 instead of Windows 7 were the hot new versions of Windows. Many of you have never even seen those operating systems much less used them. Since Microsoft has left this security hole open almost long enough for it to be old enough to vote, shouldn’t they get some of the blame?

After all, the hackers behind Alureon, aka TDSS, Tidserv and TDL3, botnet were able to fix their malware to work around the Windows’ fix before Microsoft finally figured it out. Maybe Microsoft should hire them to work on Windows security instead of relying on their own in-house software engineers. Nah. They’re probably making more money from their botnets than Microsoft is willing to pay them.

Specifically, the problem was caused when Microsoft finally fixed a Windows memory call that no longer could be used to call a specific address.

[...]

Unsupported? After 17-years, I’d say, for better of worse, it was part and parcel of Windows. Of course, if Windows were an open operating system like Linux there wouldn’t be any ‘unsupported’ ways of addressing memory. Heck, maybe someone besides a malicious hacker would have found the bug back before the turn of the century and fixed it.

[...]

The only real fix to this problem is to dump Windows. This is just another of the endless examples of how easy Windows is to attack. Even as Microsoft took care of this problem, it was revealed that the Windows-based Kneber botnet has attacked more than 374 U.S. firms and government agencies. Proper patching might have slowed it down — most of the systems getting hit by it seem to be running Windows XP SP2.

Still, the bottom line is that Windows is being exploited every day and as the Alureon/XP patch mess showed, Microsoft isn’t capable of keeping up with the hackers or their threats.

In another example of blame-shifting, the attacks on Google which were caused by Internet Explorer [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12] and Microsoft’s own negligence [1, 2, 3] are now being attributed to only those who exploited the flaws, allegedly two schools in China [1, 2, 3, 4, 5, 6]. We say “allegedly” because the schools are denying it. From yesterday’s news: “Two schools in China where computers were reportedly linked to cyberattacks on Google and other companies have denied involvement in the hack, Chinese state media said Sunday.” Here again is misplaced focus on people who exploited Microsoft’s defective software which Microsoft refused to patch for almost half a year despite knowing about it. The Washington Post says: “Some of the computer codes used in the recent attacks on the networks of Google and dozens of other major U.S. companies were developed by a diverse group of Chinese hackers, including security professionals, consultants and temporary contractors, according to an industry source.”

But does it really matter? Once again the focus is being shifted to crackers rather than the company which facilitated those attack. Microsoft relied on the same spin when Conficker inflicted huge damage. It’s the blame game being played with PR and once again Microsoft is left off the hook.

Elsewhere in the news we find that Microsoft blames Google for the broken business model of newspapers. “Microsoft Man To Publishers: Google Punches Holes In Your Paywall, But Bing Won’t,” says the headline. We saw this before [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13]. That’s Microsoft playing the blame game in order to get its rivals sued/banned/excluded.

Microsoft plays this game not only in print media but also in books. Here is Google with some publishers and authors defending Google’s side.

Google Inc. and a group of publishers and authors urged a federal judge to accept a $125 million settlement that would create the world’s biggest digital book library.

Among the companies opposing the Google book settlement there is now Amazon, which joins Microsoft just like Yahoo! did.

Microsoft Inc. (MSFT), Amazon.com Inc. (AMZN) and others urged a federal judge Thursday to reject a revised settlement among Google Inc. (GOOG) and publisher and author groups over digital copies of books.

It’s the DRM-loving Amazon, which has been filled with several Microsoft executives as we showed many times before (there is also the geographical factor when it comes to Amazon). It’s funny how allies of Microsoft are typically among those opposing the settlement and blaming Google for the failure of the once-scarce-and-now-abundant information industry.

Share this post: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Digg
  • del.icio.us
  • Reddit
  • co.mments
  • DZone
  • email
  • Google Bookmarks
  • LinkedIn
  • NewsVine
  • Print
  • Technorati
  • TwitThis
  • Facebook

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

What Else is New


  1. IRC Proceedings: Wednesday, November 13, 2019

    IRC logs for Wednesday, November 13, 2019



  2. Links 13/11/2019: Docker Enterprise Bought, WordPress 5.3, Qt 5.12.6 Released

    Links for the day



  3. Rebranding Malware and Spyware as 'Linux' to Dilute the Brand (and the News)

    Signal-to-noise ratio continues to be reduced, as a lot of "Linux" news has nothing to do with GNU/Linux or even with Free software



  4. Understanding Thierry Breton: In the Beginning...

    Career roundup of Thierry Breton, possibly the next EU Commissioner



  5. Startpage Has Been Delisted, But it Ought to be Blacklisted

    Startpage has just warned its fans (I am a former fan) of what Startpage itself covertly became months back



  6. IRC Proceedings: Tuesday, November 12, 2019

    IRC logs for Tuesday, November 12, 2019



  7. Links 12/11/2019: Plasma 5.17.3, More Intel Defects, Bytecode Alliance

    Links for the day



  8. You've Gotta Go When You've Gotta Go

    How most staff of the European Patent Office (EPO) feels these days



  9. Teaser: Thierry Breton and His Disquieting Past

    "The company attracted notoriety and loathing in the UK for its role in assessing disability benefit eligibility."



  10. EPO and EU: People Behind the Faces

    It’s no secret that the EPO breaks the law and European officials have taken no concrete steps to intervene; to make matters worse, potentially new EPO allies may soon be put in charge of the EU Commission



  11. Maintaining the 'Delete Github' page

    "This list really is a starting point, which can hopefully increase awareness about the issue of concern."



  12. Linux Foundation Picking Money

    The dating standards of the Linux Foundation



  13. Microsoft 'Borrows' the Linux Brand

    With help from the likes of the Linux Foundation Microsoft continues to misuse and ‘dilute’ the Linux brand (and registered trademark)



  14. EPO Corruption Compared to Cocaine Scandals in Antwerp

    Days after the Dutch protest discussion is sort of 'uncorked' regarding EPO corruption (published, as usual, in the form of anonymous comments)



  15. SUEPO Showed That the Media Won't Cover EPO Corruption Until Half the Workers March in the Streets

    What ought to have been a central (if not 'the' central) issue of debate in Europe is still being treated as borderline irrelevant or marginal



  16. Meanwhile in California

    News from California is being spun by Microsoft this week, owing to weak journalism that's more like PR than journalism



  17. Privacy-Centric Services and Even Drupal/Acquia Defect to the Camp of Mass Surveillance

    In search of money [pun intended] companies and services that are supposed to respect their customers and users turn out to be doing the opposite; this merits research and public discussions



  18. IRC Proceedings: Monday, November 11, 2019

    IRC logs for Monday, November 11, 2019



  19. Links 12/11/2019: Sparky 2019.11 Special Editions and Twisted 19.10.0 Released

    Links for the day



  20. Microsoft's Abduction of the Voice of Its Opposition Highlights the Urgency of the Movement/Campaign to Delete GitHub

    Microsoft understands that by entrapping FOSS and GNU/Linux inside proprietary software platforms like GitHub and Azure it can utilise the false perception that it somehow speaks on behalf of both (whilst attacking both)



  21. IRC Proceedings: Sunday, November 10, 2019

    IRC logs for Sunday, November 10, 2019



  22. SUEPO Protests Against Management of the European Patent Office Brought Back Discussions About Corruption

    The atmosphere at the second-largest institution in Europe has long been toxic; now it is becoming a lot more visible again and comments highlight the reasons for the cover-up (gross misuse of billions of euros)



  23. Links 11/11/2019: Linux 5.4 RC7, HandBrake 1.3.0 and Analysis of XFCE

    Links for the day



  24. Links 10/11/2019: digiKam 6.4.0, OpenMandriva Lx 4.1 Alpha and OpenZFS Plans

    Links for the day



  25. Video: Dutch Media on EPO Protest

    The new video added by SUEPO on Saturday in order to show Dutch media coverage of last week's protest in The Hague



  26. Politics in the Workplace Are Not Paradoxical and Outside the Workplace They Are Free Speech

    The safest space is one in which no other human (or creature) exists, but in reality we must make compromises and accept that not everyone will agree with us 100% of the time (so we must learn to live with that)



  27. IRC Proceedings: Saturday, November 09, 2019

    IRC logs for Saturday, November 09, 2019



  28. Thick Skin Makes Strong Communities

    Learning to coexist with people who don't agree on everything is a strength and successful societies encourage that (the alternative is blind conformity on all matters)



  29. Training (Proprietary Software) Versus Teaching (Free Software)

    Education necessitates software freedom — a fact that companies like Adobe, Apple and Microsoft try hard to distract from



  30. The Linux Foundation Brought as Keynote Speakers People Vastly Worse Than Those Whom It Now 'Cancels' for Purely Political Reasons

    A lot of people are very upset about the Linux Foundation's alleged 'witch-hunt' and even press coverage has caught up with the outrage; but our position is that it distracts from vastly bigger Linux Foundation scandals


RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts