EditorsAbout the SiteComes vs. MicrosoftUsing This Web SiteSite ArchivesCredibility IndexOOXMLOpenDocumentPatentsNovellNews DigestSite NewsRSS

07.23.10

Microsoft Hides Security Flaws, Then Brags About Transparency

Posted in Microsoft, Security, Windows at 8:10 am by Dr. Roy Schestowitz

Armour

Summary: Security news from Microsoft and the facts Microsoft carries on hiding

MICROSOFT’S practice of silent patching (fixing security bugs without ever telling anyone about it) does not prevent the company from lying about disclosure [1, 2] and even bragging about “transparency”. What a nerve they have when they produce reports that daemonise Red Hat based on incomplete data which Microsoft itself is knowingly hiding.

Today we look at some recent security problems, starting with one which was covered before:

Microsoft’s problems with Token Kidnapping [.pdf] on the Windows platform aren’t going away anytime soon.

“Microsoft gives up on Windows security flaw,” says the headline of another report.

DEVELOPER OF INSECURE SOFTWARE Microsoft has seemingly given up on finding a solution to a security vulnerability that takes advantage of the way Windows uses shortcuts.

As The INQUIRER reported on Monday, just about every operating system released by the Vole in the past decade is affected by the security flaw, which allows hackers to remotely execute code on Windows systems. Microsoft was relatively quick to admit to the problem, saying that the fault lies with the fact that “Windows incorrectly parses shortcuts”.

The risk was increased by removable and network storage mechanisms such as USB memory drives, which can be ‘autoplayed’ when connected. Due to a dodgy digital certificate in a driver, users would be none the wiser as control of their system was being outsourced to someone else.

From Slashdot (the summary):

Microsoft Has No Plans To Patch New Flaw

“Microsoft has acknowledged the vulnerability that the new malware Stuxnet uses to launch itself with .lnk files, but said it has no plans to patch the flaw right now. The company said the flaw affects most current versions of Windows, including Vista, Server 2008 and Windows 7 32- and 64-bit. Meanwhile, the digital certificate that belonging to Realtek Semiconductor that was used to sign a pair of drivers for the new Stuxnet rootkit has been revoked by VeriSign. The certificate was revoked Friday, several days after news broke about the existence of the new malware and the troubling existence of the signed drivers.”

Glyn Moody explains that “after all, with all the others [flaws], who will notice?”

Dell is now shipping computers with a hardware trojan that only affects Microsoft Windows. The New Scientist does not call out Windows, but the malware name is self explanatory.

Further information posted on Dell’s community forum reveals that the trojan in the affected motherboards is stored in onboard flash memory rather than firmware ROMs. And the malware at issue is called w32.spybot.worm, which normally spreads using file-sharing networks and an internet chat client.

Social networks are now being blamed for merely carrying messages that are used to control Microsoft Windows botnets. One should say “Windows botnet” and “Windows malware”, not just “malware”; these things are not universal. They specifically exploit Microsoft’s bad engineering. “Time to Get Rid of That Other OS,” argues Pogson.

The latest outrage is an attack that exploits another form of “autorun” for shortcuts/links on USB drives. That other OS lets the malware walk right in even if the user does not click on any of the links. That other OS tries to be so helpful…

The original article does name Windows as the problem (also in the headline).

Hackers have developed malware that spreads via USB sticks using a previously unknown security weakness involving Windows’ handling of shortcut files.

“Don’t Call the Police,” Pogson concludes.

There is no limit to how bad malware can be. It can range all the way from sending spam e-mail from your machines to selling all customer lists and sabotaging data by rot over a long period of time so that by the time you catch it weeks of work could go down the drain. The worst case is killing your operation through lawsuits charging negligence in allowing disaster to happen when reasonable people know you do not allow malware to run on your systems.

Running Windows is truly a liability. Windows was never designed to be secure.

“There was no strategic direction from Bill and Ballmer about these two things. It was like, ‘Well we have these two things, DOS and Windows, and do we have to run on top of this new multitasking DOS? Are we running on top of DOS 3.0 and we just ignore those guys?’ That went on for a year, this lack of strategic direction. And we just made our own decisions.”

Steve Wood, one of the first Microsoft developers

Share this post: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Digg
  • del.icio.us
  • Reddit
  • co.mments
  • DZone
  • email
  • Google Bookmarks
  • LinkedIn
  • NewsVine
  • Print
  • Technorati
  • TwitThis
  • Facebook

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

What Else is New


  1. Management by Intimidation Has Caused Deaths at the European Patent Office (EPO)

    An accurate diagnosis of the conditions created at the European Patent Office (EPO) by Benoît Battistelli and his cronies, who have essentially hijacked the Organisation -- not just the Office -- then attacked every 'enemy', either real or perceived



  2. The Difference Between Alain Pompidou and Benoît Battistelli as EPO President

    The different approaches adopted by Pompidou and Battistelli; one pursued amicable mediation and training, whereas the other resorted to vindicative witch-hunts, kangaroo courts, and a culture of terror which resulted in many suicides



  3. The Darker Past of the Next President of the EPO - Part IV: Links Between CGD (Former Employer of António Campinos) and the INPI

    More information about connections between CGD and the Portuguese Intellectual Property Office (INPI)



  4. Links 21/10/2017: Purism Against ME, Pop!_OS Ready

    Links for the day



  5. US Patents Appeal Board Attacked by the Patent 'Industry', Defended by Federal Courts, and Dodged by Patent Trolls

    PTAB, the branch or the 'court' responsible for eliminating bad patents, is coming under attacks from those who rely on poor patent quality and receives praises from everyone else, as usual



  6. In the United States, the Patent 'Industry' is a Dying Breed and China Adopts This Destructive Force

    The decaying patent microcosm, or the pipeline of low-quality patents and frivolous lawsuits these entail, loses its grip on the US; China, much to the astonishment of people who actually create things, is attempting to attract that ruinous microcosm (which preys on real, producing companies)



  7. Microsoft and Nokia's Patent Trolls by Proxy: First Conversant, Now Provenance Asset Group Holdings LLC

    Microsoft's shell game with patents (passing Android-hostile patents to trolls) carries on and publishers funded by these trolls offer the details, albeit vaguely and with obvious spin



  8. Anonymous Professionals Speak of Benoît Battistelli's Destruction of the EPO, But Why Does the Media Turn a Blind Eye?

    Everyone in the circles of EPO staff and EPO stakeholders knows that dysfunction has become the norm; European media, however, remains suspiciously silent about what otherwise would be a major European scandal (bigger than FIFA or Dieselgate)



  9. The Darker Past of the Next President of the EPO - Part III: More Details About Caixa Geral de Depósitos, Former Employer of Campinos

    The side of Campinos which he prefers to conceal, or rather his association with a rather notorious Portuguese bank



  10. UPC Looks Like More of a Distant Dream (or Nightmare) as Germany Adds Another Two Months' Delay

    The likelihood that the UPC will be altogether scuttled is growing as delays keep piling up and more complaints are being filed by public interest groups (as opposed to Team UPC, which hoped to shove the UPCA down everyone's throats behind closed doors)



  11. Patent Trolls Roundup: BlackBerry, Dominion Harbor, IPNav, IP Bridge

    A quick review of recent news regarding patent trolls or entities which resemble (and sometimes feed) these



  12. Battistelli's Destruction of the EPO is Bad for Everyone, Even Patent Attorneys

    The collapse of the European patent system, owing primarily to Battistelli's totalitarian style and deemphasis on patent quality, means that "the war is lost," as one professional puts it



  13. Links 19/10/2017: Mesa 17.2.3, New Ubuntu Release, Samsung Flirts With GNU/Linux Desktops

    Links for the day



  14. Some of the USPTO's Most Ridiculous Patents Are Scrutinised by “Above the Law” While Dennis Crouch Attempts to Tarnish Alice

    Controversies over patent scope and level of novelty required for a patent; as usual, public interest groups try to restrict patent scope, whereas those who make money out of abundance of patents attempt to remove every barrier



  15. Microsoft's Software Patents Aggression in Court (Corel Again)

    Microsoft's tendency to not only abuse the competition but also to destroy it with patent lawsuits as seen in Corel's case



  16. The Spanish Supreme Court Rejects the EPO's “Problem and Solution Approach” While Quality of European Patents Nosedives

    European Patents (EPs) aren't what they used to be and their credibility is being further eroded and even detected as such



  17. Europe is Being Robbed by Team Battistelli and the UPC/PPH Would Make Things Worse

    The European Patent Office (EPO) has put litigation at the forefront, having implicitly decided to no longer bother with proper patent examination and instead issue lots of patents for judges and lawyers to argue about (at great expense to the public)



  18. Team UPC Continues to Promote Illusion of UPC Progress Where There's None

    The core members of Team UPC in the UK spread obvious falsehoods in the media, probably in an effort to attract 'business' (consultation regarding something that does not exist)



  19. António Campinos: A True EPO Reformer or More of the Same?

    More unfortunate reminders that Campinos and Battistelli don't quite diverge on the big issues, they're just more than two decades apart in age (but the same nationality)



  20. Juve Has Confirmed That António Campinos is French

    The relationship between Campinos and Battistelli has a nationality aspect to it, not even taking into account the interpersonal connection which goes a long way back



  21. The Darker Past of the Next President of the EPO - Part II: António Campinos at Banco Caixa Geral de Depósitos

    A look at the largely-hidden banking career of the next President of the EPO and the career of the person who competed with him for this position



  22. SUEPO to the Media, Regarding Campinos: “No Comment, It’s Too Dangerous”

    António Campinos, who is Benoît Battistelli's chosen successor at the EPO, as covered by German media earlier this month



  23. Staff Union of the EPO (SUEPO) Willing to Work With Campinos But Foresees Difficulties

    New message from SUEPO regarding Battistelli's successor of choice (Campinos)



  24. Links 18/10/2017: GTK+ 3.92, Microsoft Bug Doors Leaked

    Links for the day



  25. The Darker Past of the Next President of the EPO - Part I: Introduction

    Some new details about Mr. Campinos, who is Battistelli’s successor at the EPO



  26. Confessions of EPO Insiders Reveal That European Patents (EPs) Have Lost Their Legitimacy/Value Due to Battistelli's Policies

    A much-discussed topic at the EPO is now the ever-declining quality of granted patents, which make or break patent offices because quality justifies high costs (searches, applications, renewals and so on)



  27. Patent Firms From the United States Try Hard to Push the Unitary Patent (UPC), Which Would Foment Litigation Wars in Europe

    The UPC push seems to be coming from firms which not only fail to represent public interests but are not even European



  28. In the Age of Alice and PTAB There is No Reason to Pursue Software Patents in the United States (Not Anymore)

    The appeal board in the US (PTAB) combined with a key decision of the Supreme Court may mean that even at a very low cost software patents can be invalidated upon demand (petition) and, failing that, the courts will invalidate these



  29. IAM is Wrong, the Narrative Isn't Changing, Except in the Battistelli-Funded (at EPO's Expense) Financial Times

    The desperate attempts to change the narrative in the press culminate in nothing more than yet another misleading article from Rana Foroohar and some rants from Watchtroll



  30. The Federal Circuit Continues Squashing Software Patents

    Under the leadership of Sharon Prost the Court of Appeals for the Federal Circuit (CAFC) continues its war on software patents, making it very hard to remember the last time it tolerated any


CoPilotCo

RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

CoPilotCo

Recent Posts