EditorsAbout the SiteComes vs. MicrosoftUsing This Web SiteSite ArchivesCredibility IndexOOXMLOpenDocumentPatentsNovellNews DigestSite NewsRSS

07.23.10

Microsoft Hides Security Flaws, Then Brags About Transparency

Posted in Microsoft, Security, Windows at 8:10 am by Dr. Roy Schestowitz

Armour

Summary: Security news from Microsoft and the facts Microsoft carries on hiding

MICROSOFT’S practice of silent patching (fixing security bugs without ever telling anyone about it) does not prevent the company from lying about disclosure [1, 2] and even bragging about “transparency”. What a nerve they have when they produce reports that daemonise Red Hat based on incomplete data which Microsoft itself is knowingly hiding.

Today we look at some recent security problems, starting with one which was covered before:

Microsoft’s problems with Token Kidnapping [.pdf] on the Windows platform aren’t going away anytime soon.

“Microsoft gives up on Windows security flaw,” says the headline of another report.

DEVELOPER OF INSECURE SOFTWARE Microsoft has seemingly given up on finding a solution to a security vulnerability that takes advantage of the way Windows uses shortcuts.

As The INQUIRER reported on Monday, just about every operating system released by the Vole in the past decade is affected by the security flaw, which allows hackers to remotely execute code on Windows systems. Microsoft was relatively quick to admit to the problem, saying that the fault lies with the fact that “Windows incorrectly parses shortcuts”.

The risk was increased by removable and network storage mechanisms such as USB memory drives, which can be ‘autoplayed’ when connected. Due to a dodgy digital certificate in a driver, users would be none the wiser as control of their system was being outsourced to someone else.

From Slashdot (the summary):

Microsoft Has No Plans To Patch New Flaw

“Microsoft has acknowledged the vulnerability that the new malware Stuxnet uses to launch itself with .lnk files, but said it has no plans to patch the flaw right now. The company said the flaw affects most current versions of Windows, including Vista, Server 2008 and Windows 7 32- and 64-bit. Meanwhile, the digital certificate that belonging to Realtek Semiconductor that was used to sign a pair of drivers for the new Stuxnet rootkit has been revoked by VeriSign. The certificate was revoked Friday, several days after news broke about the existence of the new malware and the troubling existence of the signed drivers.”

Glyn Moody explains that “after all, with all the others [flaws], who will notice?”

Dell is now shipping computers with a hardware trojan that only affects Microsoft Windows. The New Scientist does not call out Windows, but the malware name is self explanatory.

Further information posted on Dell’s community forum reveals that the trojan in the affected motherboards is stored in onboard flash memory rather than firmware ROMs. And the malware at issue is called w32.spybot.worm, which normally spreads using file-sharing networks and an internet chat client.

Social networks are now being blamed for merely carrying messages that are used to control Microsoft Windows botnets. One should say “Windows botnet” and “Windows malware”, not just “malware”; these things are not universal. They specifically exploit Microsoft’s bad engineering. “Time to Get Rid of That Other OS,” argues Pogson.

The latest outrage is an attack that exploits another form of “autorun” for shortcuts/links on USB drives. That other OS lets the malware walk right in even if the user does not click on any of the links. That other OS tries to be so helpful…

The original article does name Windows as the problem (also in the headline).

Hackers have developed malware that spreads via USB sticks using a previously unknown security weakness involving Windows’ handling of shortcut files.

“Don’t Call the Police,” Pogson concludes.

There is no limit to how bad malware can be. It can range all the way from sending spam e-mail from your machines to selling all customer lists and sabotaging data by rot over a long period of time so that by the time you catch it weeks of work could go down the drain. The worst case is killing your operation through lawsuits charging negligence in allowing disaster to happen when reasonable people know you do not allow malware to run on your systems.

Running Windows is truly a liability. Windows was never designed to be secure.

“There was no strategic direction from Bill and Ballmer about these two things. It was like, ‘Well we have these two things, DOS and Windows, and do we have to run on top of this new multitasking DOS? Are we running on top of DOS 3.0 and we just ignore those guys?’ That went on for a year, this lack of strategic direction. And we just made our own decisions.”

Steve Wood, one of the first Microsoft developers

Share this post: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Digg
  • del.icio.us
  • Reddit
  • co.mments
  • DZone
  • email
  • Google Bookmarks
  • LinkedIn
  • NewsVine
  • Print
  • Technorati
  • TwitThis
  • Facebook

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

What Else is New


  1. Links 25/3/2019: Linux 5.1 RC2, Nano 4.0, PyPy 7.1

    Links for the day



  2. Links 24/3/2019: Microsoft Does Not Change; Lots of FOSS Leftovers

    Links for the day



  3. Just Published: Irrational Ignorance at the Patent Office

    Iancu and his fellow Trump-appointed "swamp" at the USPTO are urged to consult academics rather than law firms in order to improve patent quality in the United States



  4. Microsoft Paid the Open Source Initiative. Now (a Year Later) Microsoft is in the Board of the Open Source Initiative.

    The progression of Microsoft entryism in FOSS-centric institutions (while buying key "assets" such as GitHub) isn't indicative of FOSS "winning" but of FOSS being infiltrated (to be undermined)



  5. Jim Zemlin's Linux Foundation Still Does Not Care About Linux Desktops

    We are saddened to see that the largest body associated with Linux (the kernel and more) is not really eager to see GNU/Linux success; it's mostly concerned about its bottom line (about $100,000,000 per annum)



  6. Links 23/3/2019: Falkon 3.1.0 and Tails 3.13.1

    Links for the day



  7. The Unified Patent Court is Dead, But Doubts Remain Over the EPO's Appeal Boards' Ability to Rule Independently Against Patents on Nature and Code

    Patents used to cover physical inventions (such as engines); nowadays this just isn't the case anymore and judges who can clarify these questions lack the freedom to think outside the box (and disobey patent maximalists' dogma)



  8. Patent Law Firms Still Desperate to Find New Ways to Resurrect Dead Software Patents in the United States

    There's no rebound and no profound changes that favour software patents; in fact, judging by caselaw, there's nothing even remotely like that



  9. Links 22/3/2019: Libinput 1.13 RC2 and Facebook's Latest Security Scandal

    Links for the day



  10. Why the UK Intellectual Property Office (UK-IPO) Cannot Ignore Judges, Whereas the EPO Can (and Does)

    The European Patent Convention (EPC) ceased to matter, judges' interpretation of it no longer matters either; the EPO exploits this to grant hundreds of thousands of dodgy software patents, then trumpet "growth"



  11. The European Patent Office Needs to Put Lives Before Profits

    Patents that pertain to health have always posed an ethical dilemma; the EPO apparently tackled this dilemma by altogether ignoring the rights and needs of patients (in favour of large corporations that benefit financially from poor people's mortality)



  12. “Criminal Organisation”

    Brazil's ex-President, Temer, is arrested (like other former presidents of Brazil); will the EPO's ex-President Battistelli ever be arrested (now that he lacks diplomatic immunity and hides at CEIPI)?



  13. Links 21/3/2019: Wayland 1.17.0, Samba 4.10.0, OpenShot 2.4.4 and Zorin Beta

    Links for the day



  14. Team UPC (Unitary Patent) is a Headless Chicken

    Team UPC's propaganda about the Unified Patent Court (UPC) has become so ridiculous that the pertinent firms do not wish to be identified



  15. António Campinos Makes Up Claims About Patent Quality, Only to be Rebutted by Examiners, Union (Anyone But the 'Puff Pieces' Industry)

    Battistelli's propagandistic style and self-serving 'studies' carry on; the notion of patent quality has been totally discarded and is nowadays lied about as facts get 'manufactured', then disseminated internally and externally



  16. Links 20/3/2019: Google Announces ‘Stadia’, Tails 3.13

    Links for the day



  17. CEN and CENELEC Agreement With the EPO Shows That It's Definitely the European Commission's 'Department'

    With headlines such as “EPO to collaborate on raising SEP awareness” it is clear to see that the Office lacks impartiality and the European Commission cannot pretend that the EPO is “dafür bin ich nicht zuständig” or “da kenne ich mich nicht aus”



  18. Decisions Made Inside the European Patent Organisation (EPO) Lack Credibility Because Examiners and Judges Lack Independence

    The lawless, merciless, Mafia-like culture left by Battistelli continues to haunt judges and examiners; how can one ever trust the Office (or the Organisation at large) to deliver true justice in adherence or compliance with the EPC?



  19. Team UPC Buries Its Credibility Deeper in the Grave

    The three Frenchmen at the top do not mention the UPC anymore; but those who promote it for a living (because they gambled on leveraging it for litigation galore) aren't giving up and in the process they perpetuate falsehoods



  20. The EPO Has Sadly Taken a Side and It's the Patent Trolls' Side

    Abandoning the whole rationale behind patents, the Office now led for almost a year by António Campinos prioritises neither science nor technology; it's all about granting as many patents (European monopolies) as possible for legal activity (applications, litigation and so on)



  21. Where the USPTO Stands on the Subject of Abstract Software Patents

    Not much is changing as we approach Easter and software patents are still fool's gold in the United States, no matter if they get granted or not



  22. Links 19/3/2019: Jetson/JetBot, Linux 5.0.3, Kodi Foundation Joins The Linux Foundation, and Firefox 66

    Links for the day



  23. Links 18/3/2019: Solus 4, Linux 5.1 RC1, Mesa 18.3.5, OSI Individual Member Election Won by Microsoft

    Links for the day



  24. Microsoft and Its Patent Trolls Continue Their Patent War, Including the War on Linux

    Microsoft is still preying on GNU/Linux using patents, notably software patents; it wants billions of dollars served on a silver platter in spite of claims that it reached a “truce” by joining the Open Invention Network and joining the LOT Network



  25. Director Iancu Generally Viewed as a Lapdog of Patent Trolls

    As Director of the Office, Mr. Iancu, a Trump appointee, not only fails to curb patent trolls; he actively defends them and he lowers barriers in order to better equip them with bogus patents that courts would reject (if the targets of extortion could afford a day in court)



  26. Links 17/3/2019: Google Console and IBM-Red Hat Merger Delay?

    Links for the day



  27. To Team UPC the Unified Patent Court (UPC) Has Become a Joke and the European Patent Office (EPO) Never Mentions It Anymore

    The EPO's frantic rally to the very bottom of patent quality may be celebrated by obedient media and patent law firms; to people who actually produce innovative things, however, this should be a worrisome trend and thankfully courts are getting in the way of this nefarious agenda; one of these courts is the FCC in Germany



  28. Links 16/3/2019: Knoppix Release and SUSE Independence

    Links for the day



  29. Stopping António Campinos and His Software Patents Agenda (Not Legal in Europe) Would Require Independent Courts

    Software patents continue to be granted (new tricks, loopholes and buzzwords) and judges who can put an end to that are being actively assaulted by those who aren't supposed to have any authority whatsoever over them (for decisions to be impartially delivered)



  30. The Linux Foundation Needs to Speak Out Against Microsoft's Ongoing (Continued) Patent Shakedown of OEMs That Ship Linux

    Zemlin actively thanks Microsoft while taking Microsoft money; he meanwhile ignores how Microsoft viciously attacks Linux using patents, revealing the degree to which his foundation, the “Linux Foundation” (not about Linux anymore, better described as Zemlin’s PAC), has been compromised


CoPilotCo

RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

CoPilotCo

Recent Posts