05.31.10

Microsoft Finally Admits Numbers of Vulnerabilities It Reports Are Fake

Posted in Deception, GNU/Linux, Microsoft, Red Hat, Security, Servers, Windows at 6:14 am by Dr. Roy Schestowitz

Microsoft lies

Summary: Mike Reavey, the director of the Microsoft Security Response Center, admits that Microsoft is silently patching vulnerabilities without ever reporting the problem

IT’S official. Microsoft is a liar. Again. Now there is even admission from Microsoft, confirming an issue which we first raised some weeks ago. Whenever Microsoft says it patches x number of flaws with y number of patches/bulletins, Microsoft ought to be assumed to be lying. Microsoft’s silent patching is a subject we have been covering for years and it helps explain why one in two Windows PCs is believed to be a zombie PC, despite Microsoft’s claims that all of its flaws are being addressed. All those fake comparisons against platforms like Red Hat Enterprise Linux (where Microsoft stacks up and aggregates numbers of flaws) can be thrown into the wastebasket. If convincing proof is needed, here it is. Microsoft first tried to spin it (for weeks) and now it gives up and tells the truth.

Microsoft Official Admits to Quiet Security Patching

Microsoft doesn’t report all security vulnerabilities that it fixes in its software. Bug comparisons between vendors therefore paint an incorrect picture.

“We don’t document every issue found,” Mike Reavey, director of the Microsoft Security Response Center (MSRC), said at a meeting with reporters at the company’s corporate headquarters in Redmond, Washington.

Microsoft will issue a Common Vulnerabilities and Exposures (CVE) number to a vulnerability for flaws that share the same severity, have an attack vector and a workaround. If several flaws share all the same properties, they will not be reported separately, Reavey said.

The nondisclosure of fixes was brought to light early this month by a company called Core Security Technologies. After studying the Microsoft patches MS10-024 and MS10-028, it noticed three silent fixes. Security bulletin MS10-028 addressed a flaw that would expose a user of Microsoft Visio to a buffer overflow attack, which would allow an attacker to take over control of the system.

Finally. Thanks for the honesty. So how much damage has been caused by Microsoft’s lies so far. Microsoft has been denying this for years, but not exactly denying, either. It was spinning and avoiding the actual question. It’s the art of lying without practically lying, just evading. Adobe is at least honest about its proprietary software being insecure garbage. As far as we are aware, Adobe hasn’t a long history of systematic lying, unlike Microsoft.

“Microsoft smacks patch-blocking rootkit second time,” says another new report from Gregg Keizer.

For the second month in a row, Microsoft has tried to eradicate a mutating rootkit that has blocked some Windows users from installing security updates.

Here is another one (also here):

Jerry Bryant, a group manager with the Microsoft Security Response Center (MSRC), said his team is looking into Raskin’s claims, but hinted that Microsoft wouldn’t be patching IE anytime soon. “I wouldn’t classify this as a ‘vulnerability’ though,” Bryant said in an e-mail answer to questions.

The followup says:

Will browser makers patch this? Unlikely. Microsoft’s Jerry Bryant, a general manager at the company’s security response center, said the issue isn’t a security vulnerability per se, and that Internet Explorer (IE) falls for the scam because that’s the way browsers work.

“Working with [Raskin's] proof-of-concept, as written, is expected,” he said in an e-mail Tuesday when asked whether Microsoft had a fix in mind for IE.

Let’s remember how much damage was caused this year because Microsoft had refused to patch known Internet Explorer flaws for five months [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12]. Where is the liability [1, 2, 3, 4, 5]? Watch what it happening in Denver right now.

Denver officials have asked the FBI, Denver police and Microsoft Corp. to help them identify the person or people who have hacked into the city’s website twice in the past week.

If Microsoft gets involved, then it almost must be a Windows server.

Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Reddit
  • email

This post is also available in Gemini over at:

gemini://gemini.techrights.org/2010/05/31/silent-patching-confirmed-by-msft/

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

A Single Comment

  1. twitter said,

    June 1, 2010 at 5:52 pm

    Gravatar

    Microsoft was cornered in two ways. First, people noticed a “silent patch”. The more fundamental bust, however, is that no one with a clue ever believed the “get the facts” propaganda. Only someone with a financial interest will tell you that Windows and GNU/Linux security are equivalent. Only someone without free software experience will believe them.

    Microsoft will go on telling the same lies. “Get the Facts” was not some kind of subtle spin. It was a direct lie, constructed of fabricated evidence, relentlessly pushed anywhere and everywhere people with computer purchasing power and developers had a discussion. Each point of the lie was refuted almost as many times. Someone might get fired for getting caught and Microsoft will keep telling the world that Windows is the most secure software ever.

What Else is New


  1. Links 27/2/2021: IPFS 0.8, OnionShare 2.3.1, and New Stuff in KDE

    Links for the day



  2. The Internet After Social Control Media (and Maybe After the World Wide Web Too)

    There seems to be a growing trend of protests and backlash against centralised Internet disservices; there's also growing dissatisfaction over bloat and spyware, which the Web rendered a 'norm'



  3. SCO's Darl McBride is Finished (Bankruptcy)

    Some news about the site and about the long-forgotten SCO, whose infamous old (and sacked) Darl McBride (responsible for decade-long attacks on Linux) loses everything, based on fresh legal documents



  4. IRC Proceedings: Friday, February 26, 2021

    IRC logs for Friday, February 26, 2021



  5. Links 26/2/2021: Wine 6.3, Genode OS Framework 21.02

    Links for the day



  6. Links 26/2/2021: GNU Poke 1.0 is Out and Rocky Linux Leaves Microsoft GitHub

    Links for the day



  7. Microsoft's Status in Web Servers is So Bad That It Has Fallen Off Charts, is Now Partly Delisted

    In several categories or criteria Microsoft is no longer even listed by Netcraft; the share has become rather minuscule during the pandemic, which convinced more companies to explore expense-cutting moves



  8. We Take Away Your Freedom for Your Own Safety...

    People are herded like cattle and protest/dissent will be demonised as part of the new norm; what will be the cost of the pandemic and will resistance to the status quo ever be permitted to resume?



  9. EPO President Pushes Illegal Software Patents in South America (Over the Telephone With a Misleading New Puff Piece)

    The EPO's "news" section has become worse than a form of distraction (from the EPO's internal rot); it celebrates illegal and unlawful practices, spreading them to other continents



  10. The Free Software Foundation Warns Against Using Twitter

    Richard Stallman said Twitter was OK because it was possible to use it without proprietary software; that's no longer the case, so the Free Software Foundation (FSF) speaks out against it. It speaks about it more than 3 months after the problem became a known one and also an irreversible one (maybe Twitter would have reversed the decision if the media or the FSF actually spoke about it early enough).



  11. IRC Proceedings: Thursday, February 25, 2021

    IRC logs for Thursday, February 25, 2021



  12. Stéphane Bortzmeyer Explains Gemini Protocol (February 2021)

    A recent talk from Stéphane Bortzmeyer about Gemini and what it is for (or why)



  13. Links 26/2/2021: Istio 1.7.8 Announced, Blender 2.92, Firebird 3.0 Language Reference, FSF Against Twitter

    Links for the day



  14. Special Thanks to Mogz

    Credit where it's due to Mogz



  15. Modifying WordPress to Include Gemini Links in All Articles (Assuming a Canonical URL Form)

    In order to promote the departure from the World Wide Web (where possible and suitable; sites with text don't typically need Web-like features) one can promote the analogous pages in one's Gemini capsule; we suggest a way of doing so in WordPress (the most widely used CMS)



  16. Links 25/2/2021: RHEL for Open-Source Infrastructure, GNOME 40 Beta, LXPanel 0.10.1

    Links for the day



  17. IBM and Qt Don't Understand Free Software and They Now Impose Terms and Conditions on Who Qualifies for Use of Free Software Free of Charge

    IBM and Qt Don't Understand Free Software and They Now Impose Terms and Conditions on Who Qualifies for Use of Free Software Free of Charge



  18. Techrights Gemini Capsule, Now With Over 35,000 Pages and Files

    Blog posts combined with static (plain text) files are now 36,000+ in number, just for Gemini protocol alone; that number keeps growing as our conversion proceeds and evolves (our software will be released under terms of the AGPLv3)



  19. Eventually, or Hopefully, Many People Will Come Back to What the Web Used to Be (Or Web Alternatives More Like the 'Old' Web)

    With RSS feeds making a comeback and a resurgence of personal blogs we can take back the Web from a cabal of tech/Internet giants and social control media, censored, curated and spied on by oligarchy



  20. If Wikipedia is Controlled by Corporations and Mobs, It Needs to Be 'Cancelled'

    Facts have never truly mattered in social control media sites; it certainly seems as though Wikipedia now suffers the very same issue/deficit, allowing oligarchs and their companies to define what goes on in the world and which people Wikipedia should regard as persona non grata



  21. GNU/Linux Reaffirms Its Status as the Universal and Inter-planetary Operating System

    The operating system made for and by scientists (not business sharks and marketing cults) is winning the battle, and not only in this planet



  22. IRC Proceedings: Wednesday, February 24, 2021

    IRC logs for Wednesday, February 24, 2021



  23. Links 25/2/2021: Kali Linux 2021.1, Wine Launcher 1.4.46, and Google's Security Posing

    Links for the day



  24. Links 24/2/2021: MariaDB 10.5.9, Krita 4.4.3 Beta, and Debuginfod Server for Debian

    Links for the day



  25. Self-Host Your Videos, Take Full Advantage of HTML5 and Video Attributes

    For self-hosting of videos over the World Wide Web (Gemini too can handle videos; its clients/browsers can, for example, link video files/URLs to external media players) it's worth reviewing the full set of features made available by the standards because a lot can be accomplished without JavaScript and without unnecessary bloat/complexity



  26. Trying Out NoiseTorch to Reduce Background Sound/Noise in GNU/Linux

    An introduction to noisetorch (or NoiseTorch), an application that helps create virtual microphones/devices with reduced background noise



  27. How the Big Banks and OIN Can Whitewash Software Patents and Do Nothing Concrete About Patent Trolls

    Response to the puff piece entitled "How the Big Banks and OIN Can Lock Out Patent Trolls with Enabled Publications"



  28. IRC Proceedings: Tuesday, February 23, 2021

    IRC logs for Tuesday, February 23, 2021



  29. How to Set Up a Gemini Server of Your Own, Even on a Simple Single-Board Computer

    Using Agate to start one's own Gemini capsule (self-hosted) is a lot simpler than one might be inclined to believe; this is a detailed HOWTO, hoping to encourage more people to join Gemini space, which is fast-growing and free of garbage



  30. Links 23/2/2021: Tails 4.16, Libinput 1.17, Fwupd 1.5.7, Firefox 86, NeoChat 1.1

    Links for the day


RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts