EditorsAbout the SiteComes vs. MicrosoftUsing This Web SiteSite ArchivesCredibility IndexOOXMLOpenDocumentPatentsNovellNews DigestSite NewsRSS

07.23.10

Microsoft Hides Security Flaws, Then Brags About Transparency

Posted in Microsoft, Security, Windows at 8:10 am by Dr. Roy Schestowitz

Armour

Summary: Security news from Microsoft and the facts Microsoft carries on hiding

MICROSOFT’S practice of silent patching (fixing security bugs without ever telling anyone about it) does not prevent the company from lying about disclosure [1, 2] and even bragging about “transparency”. What a nerve they have when they produce reports that daemonise Red Hat based on incomplete data which Microsoft itself is knowingly hiding.

Today we look at some recent security problems, starting with one which was covered before:

Microsoft’s problems with Token Kidnapping [.pdf] on the Windows platform aren’t going away anytime soon.

“Microsoft gives up on Windows security flaw,” says the headline of another report.

DEVELOPER OF INSECURE SOFTWARE Microsoft has seemingly given up on finding a solution to a security vulnerability that takes advantage of the way Windows uses shortcuts.

As The INQUIRER reported on Monday, just about every operating system released by the Vole in the past decade is affected by the security flaw, which allows hackers to remotely execute code on Windows systems. Microsoft was relatively quick to admit to the problem, saying that the fault lies with the fact that “Windows incorrectly parses shortcuts”.

The risk was increased by removable and network storage mechanisms such as USB memory drives, which can be ‘autoplayed’ when connected. Due to a dodgy digital certificate in a driver, users would be none the wiser as control of their system was being outsourced to someone else.

From Slashdot (the summary):

Microsoft Has No Plans To Patch New Flaw

“Microsoft has acknowledged the vulnerability that the new malware Stuxnet uses to launch itself with .lnk files, but said it has no plans to patch the flaw right now. The company said the flaw affects most current versions of Windows, including Vista, Server 2008 and Windows 7 32- and 64-bit. Meanwhile, the digital certificate that belonging to Realtek Semiconductor that was used to sign a pair of drivers for the new Stuxnet rootkit has been revoked by VeriSign. The certificate was revoked Friday, several days after news broke about the existence of the new malware and the troubling existence of the signed drivers.”

Glyn Moody explains that “after all, with all the others [flaws], who will notice?”

Dell is now shipping computers with a hardware trojan that only affects Microsoft Windows. The New Scientist does not call out Windows, but the malware name is self explanatory.

Further information posted on Dell’s community forum reveals that the trojan in the affected motherboards is stored in onboard flash memory rather than firmware ROMs. And the malware at issue is called w32.spybot.worm, which normally spreads using file-sharing networks and an internet chat client.

Social networks are now being blamed for merely carrying messages that are used to control Microsoft Windows botnets. One should say “Windows botnet” and “Windows malware”, not just “malware”; these things are not universal. They specifically exploit Microsoft’s bad engineering. “Time to Get Rid of That Other OS,” argues Pogson.

The latest outrage is an attack that exploits another form of “autorun” for shortcuts/links on USB drives. That other OS lets the malware walk right in even if the user does not click on any of the links. That other OS tries to be so helpful…

The original article does name Windows as the problem (also in the headline).

Hackers have developed malware that spreads via USB sticks using a previously unknown security weakness involving Windows’ handling of shortcut files.

“Don’t Call the Police,” Pogson concludes.

There is no limit to how bad malware can be. It can range all the way from sending spam e-mail from your machines to selling all customer lists and sabotaging data by rot over a long period of time so that by the time you catch it weeks of work could go down the drain. The worst case is killing your operation through lawsuits charging negligence in allowing disaster to happen when reasonable people know you do not allow malware to run on your systems.

Running Windows is truly a liability. Windows was never designed to be secure.

“There was no strategic direction from Bill and Ballmer about these two things. It was like, ‘Well we have these two things, DOS and Windows, and do we have to run on top of this new multitasking DOS? Are we running on top of DOS 3.0 and we just ignore those guys?’ That went on for a year, this lack of strategic direction. And we just made our own decisions.”

Steve Wood, one of the first Microsoft developers

Share this post: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Digg
  • del.icio.us
  • Reddit
  • co.mments
  • DZone
  • email
  • Google Bookmarks
  • LinkedIn
  • NewsVine
  • Print
  • Technorati
  • TwitThis
  • Facebook

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

What Else is New


  1. In Attempt to Promote the Horrific UPC (Poor Quality of Patents Everywhere), Minnoye and Casado Cerviño Attack Their Own Staff for Saying the Truth

    An attack on truth itself -- the disintegration of the European Patent Office (EPO) -- carries on, after staff found the courage to tell delegates what had happened due to Battistelli's policies and incredible oppression that prevails and expands



  2. Another Likely Casualty of the Battistelli Regime at the EPO: Validity of Decisions of Terrified Boards of Appeal Judges

    Under pressure and habitual intervention from a demoralising, overreaching, and out-of-control President (from an entirely different division), examiners and judges 'normalise' the practice of granting patents on genetics -- a very slippery slope in terms of patent scope



  3. Benoît Battistelli 'Pulls an Erdoğan' Faster Than Erdoğan

    An explanation of what the imminent departure of Minnoye (this summer) will mean for Benoît Battistelli and his confidants, who now resemble some of the world's most ruthless dictatorships



  4. With Important Supreme Court Decisions Looming, Mainstream Media Tackles Patent Trolls

    The US Supreme Court (SCOTUS) will soon rule on TC Heartland and Lexmark, potentially restricting abusive patent behaviour even further (making room for freedom to innovate and for competition)



  5. IAM Magazine is Very Blatantly Promoting Patent Trolls and Their Agenda

    IAM Media, which produces a magazine every now and then while posting online every day, maintains its pro-trolls agenda, which is becoming so clear to see that it is definitely worth documenting yet again



  6. A “Perfect Recipe for Fraud” at the European Patent Office (EPO)

    How the world's leading patent office became a world-leading source of abuse, corruption, nepotism, injustice, incompetence, censorship, alleged bribery, pure deception, distortion of media, defamation, and suicides (among many other things)



  7. Techrights Was Right About the Unitary Patent (UPC)

    No Unified Patent Court in the UK and probably nothing like it in the rest of Europe any time soon (if ever)



  8. Patents on Life and Patents on Software Serve to Show That EPO Patent Quality Fell Well Behind the US (PTO)

    Anything goes at the EPO, except dissent; any patent application seems to be grantable, provided one uses simple tricks and persists against overworked examiners who are pressured to increase so-called 'production'



  9. Links 28/3/2017: Linux 4.11-rc4 Kernel Released, Red Hat Surge on Sales

    Links for the day



  10. The Crook Goes to Brussels to Lie About the Unitary Patent (UPC)

    The person who spent years lying about the UPC and severely attacking critics (usually by blatantly lying about them) goes to Brussels for another nose extension



  11. The EPO's HR Roadmap Retrospective

    A look back at the terrible ‘accomplishments’ of the Jesper Kongstad-led Administrative Council, which still issues hogwash and face-saving lies, as one might expect from a protector of Battistelli that lies to national representatives and buries inconvenient topics



  12. Links 26/3/2017: Debian Project Leader Elections, SecureDrop and Alexandre Oliva FSF Winners

    Links for the day



  13. His Master's Voice, Jesper Kongstad, Blocks Discussion of Investigative and Disciplinary Procedures at the EPO

    The Chairman of the Administrative Council of the European Patent Organisation is actively preventing not just the dismissal of Battistelli but also discussion of Battistelli's abuses



  14. Heiko Maas and the State of Germany Viewed as Increasingly Complicit in EPO Scandals and Toxic UPC Agenda

    It is becoming hard if not impossible to interpret silence and inaction from Maas as a form of endorsement for everything the EPO has been doing, with the German delegates displaying more of that apathy which in itself constitutes a form of complicity



  15. With IP Kat Coverage of EPO Scandals Coming to an End (Officially), Techrights and The Register Remain to Cover New Developments

    One final post about the end of Merpel’s EPO coverage, which is unfortunate but understandable given the EPO’s track record attacking the media, including blogs like IP Kat, sites of patent stakeholders, and even so-called media partners



  16. Everyone, Including Patent Law Firms, Will Suffer From the Demise of the EPO

    Concerns about quality of patents granted by the EPO (EPs) are publicly raised by industry/EPO insiders, albeit in an anonymous fashion



  17. Yes, Battistelli's Ban on EPO Strikes (or Severe Limitation Thereof) is a Violation of Human Rights

    Battistelli has curtailed even the right to strike, yet anonymous cowards attempt to blame the staff (as in patent examiners) for not going out of their way to engage in 'unauthorised' strikes (entailing dismissal)



  18. Even the EPO's Administrative Council No Longer Trusts Its Chairman, Battistelli's 'Chinchilla' Jesper Kongstad

    Kongstad's protection of Battistelli, whom he is supposed to oversee, stretches to the point where national representatives (delegates) are being misinformed



  19. Thanks to Merpel, the World Knows EPO Scandals a Lot Better, But It's a Shame That IP Kat Helped UPC

    A look back at Merpel's final post about EPO scandals and the looming threat of the UPC, which UPC opportunists such as Bristows LLP still try hard to make a reality, exploiting bogus (hastily-granted) patents for endless litigation all around Europe



  20. EPO Critics Threatened by Self-Censorship, Comment Censorship, and a Growing Threat to Anonymity

    Putting in perspective the campaign for justice at the EPO, which to a large degree relies on whistleblowers and thus depends a great deal on freedom of the press, freedom of speech, and anonymity



  21. Links 25/3/2017: Maru OS 0.4, C++17 Complete

    Links for the day



  22. Judge and Justice Bashing in the United States, EPC Bashing at the EPO

    Enforcement of the law based on constitutional grounds and based on the European Patent Convention (EPC) in an age of retribution and insults -- sometimes even libel -- against judges



  23. Looking for EPO Nepotism? Forget About Jouve and Look Closely at Europatis Instead.

    Debates about the contract of Jouve with the EPO overlook the elephants in the room, which include companies that are established and run by former EPO chiefs and enjoy a relationship with the EPO



  24. Depressing EPO News: Attacks on Staff, Attacks on Life, Brain Drain, Patents on Life, Patent Trolls Come to Germany, and Spain Being Misled

    A roundup of the latest developments at the EPO combined with feedback from insiders, who are not tolerating their misguided and increasingly abusive management



  25. It Certainly Looks Like Microsoft is Already Siccing Its Patent Trolls, Including Intellectual Ventures, on Companies That Use Linux (Until They Pay 'Protection' Money)

    News about Intellectual Ventures and Finjan Holdings (Microsoft-funded patent trolls) reinforces our allegations -- not mere suspicions anymore -- that Microsoft would 'punish' companies that are not paying subscription fees (hosting) or royalties (patent tax) to Microsoft and are thus in some sense 'indebted' to Microsoft



  26. Links 24/3/2017: Microsoft Aggression, Eudyptula Challenge Status Report

    Links for the day



  27. Bernhard Rapkay, Former MEP and Rapporteur on Unitary Patent, Shoots Down UPC Hopes While UPC Hopefuls Recognise That Spain Isn't Interested Either

    Germany, the UK and Spain remain massive barriers to the UPC -- all this in spite of misleading reports and fake news which attempted to make politicians believe otherwise (for political leverage, by means of dirty lobbying contingent upon misinformation)



  28. Links 23/3/2017: Qt 5.9 Beta, Gluster Storage 3.2

    Links for the day



  29. The Administrative Council of the European Patent Organisation Has Just Buried an Innocent Judge That Battistelli Does Not Like

    An innocent judge (never proven guilty of anything, only publicly defamed with help from Team Battistelli and dubious 'intelligence' gathering) is one of the forgotten casualties of the latest meeting of the Administrative Council (AC), which has become growingly complicit rather than a mere bystander at a 'crime' scene



  30. Nepotism at the European Patent Office and Suspicious Absence of Tenders for Big Projects

    Carte blanche is a French term which now perfectly describes the symptoms encountered in the European Patent Office, more so once led by a lot of French people (Battistelli and his friends)


CoPilotCo

RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

CoPilotCo

Recent Posts