Summary: Windows grows increasingly rusty and the consequences are serious flaws that pose a danger to national security

IT is always interesting to see the coverage which accompanies Microsoft Windows. It has been an extremely slow news week for Windows. Looking at some recent news (the past 8 days), we have not found a single headline about "Vista". We found just about 10 clusters on "Windows 7" (including repetitions), which is exceptionally little.

“The main news about Windows this week is probably all the security holes.”Microsoft has relied on many fake "leaks" recently, but this one of SP1 for Vista 7 is not likely to serve a marketing purpose [1, 2, 3, 4, 5, 6, 7]. Microsoft would like people to think that access to an early version is something special, but it is already possible (legally) with GNU/Linux distributions. It's still possible this this Windows leak is deliberate, with the intention of creating anticipation and sending out the message that SP1 will come "real soon now".

The main news about Windows this week is probably all the security holes. It dominates the news, for sure. Microsoft claims that 25 vulnerabilities currently exist, but experience suggests that Microsoft is lying about the numbers. Microsoft claims that there are five "critical" security holes and 25 Windows vulnerabilities this time around [1, 2, 3, 4].

Microsoft is due fix a total of 25 bugs in its upcoming patch next week.

More on the "critical" ones [1, 2]:

MS preps 5 Windows critical fixes for busy Patch Tuesday

[...]

Microsoft has lined up 11 patches that collectively address 25 security vulnerabilities as part of its April Patch Tuesday security update.

Five of the scheduled patches fix critical flaws, all involving Windows vulnerabilities. All supported versions of Windows are addressed by this much heavier than usual update batch. "Important" patches for Microsoft Office and Microsoft Exchange are also being loaded up for delivery next week.

What about hidden fixes (not disclosed)? Either way, given that the high proportion of Windows installations are already hijacked, the following new report is not entirely shocking.

1-in-10 Windows PCs still vulnerable to Conficker worm

[...]

More than a year after doomsday reports hinted that the Conficker worm would bring down the Internet, one-in-10 Windows PCs still have not been patched to plug the hole the worm wriggles through, new data shows.

And 25 of every 1,000 systems are currently infected with the worm.

Cyber war remains a national threat and it depends on availability of zombie PCs running Windows. As a timely new reminder we observe:

In his new book, Cyber War, Richard Clarke says nations are building up their online armies and weapons largely far from public view, increasing the danger of a deliberate or accidental cyberwar, which in turn could trigger violent conflicts across the globe.

We already have examples from east Europe (nothing was put in place to prevent recurrence), but the problem is being denied by Howard Schmidt from Microsoft, who works for the US government now [1, 2]. ⬆