Bonum Certa Men Certa

U.S. Military Hit by Windows, Learns Nothing From Microsoft Negligence

Flag and tank



Summary: Failures to name the culprit after a serious military intrusion; new examples where Microsoft knowingly ignores and leaves open holes inside Windows

“LOOKS Like Microsoft is Doing Damage Control on Virus Attacks” was the title of this post from last week. There has been a hot debate about it recently, but owing to Slashdot spin not much was done to call out Windows. The DOD/Pentagon ought to say more about the role of Microsoft software, but even the original article from Wired only speaks about "worm" and "USB"/"flash drive", neglecting to say that only Windows can be affected. Here's the opening:



In the fall of 2008, a variant of a three year-old, relatively-benign worm began winding its way through the U.S. military’s networks, spread by troops using thumb drives and other removable storage media. Now, the Pentagon says the infiltration — first reported by Danger Room — was a deliberate attack, launched by foreign spies. It’s a claim that some of the troops who worked to contain the worm are finding hard to back up.

In the upcoming issue of Foreign Affairs, Deputy Defense Secretary William Lynn writes that the worm entered the military’s classified systems “when an infected flash drive was inserted into a U.S. military laptop at a base in the Middle East. The flash drive’s malicious computer code, placed there by a foreign intelligence agency, uploaded itself onto a network run by the U.S. Central Command.”


Why could Slashdot not state that this is a Windows issue? Should one just assume (magically, by default) that when no operating system is mentioned it must be Microsoft Windows? They do name and shame the operating system when it's not Windows.

Slashdot should know better because only yesterday it wrote about a data-stealing bug which is specific to Internet Explorer 8 (Windows only): [via]

There's an unpatched vulnerability in Internet Explorer 8 that enables simple data-stealing attacks by Web-based attackers and could lead to an attacker hijacking a user's authenticated session on a third-party site. The flaw, which a researcher said may have been known since 2008, lies in the way that IE 8 handles CSS style sheets.


We have written a great deal this year about Microsoft negligence [1, 2, 3] that led to security disasters, e.g. after Microsoft had ignored known Internet Explorer flaws for 6 months [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12] (Microsoft is the worst in the regard, so Google banned Windows earlier this year).

"Researcher told Microsoft of Windows apps zero-day bugs 6 months ago," says this new headline from Gregg Keizer [1, 2], who adds yet another example of Microsoft ignoring problems for half a year (not even automatic patchers/trackers would help in such cases). Some things just never change.

Microsoft has said this year that for improved security users should consider moving to 64-bit Windows, but "Rootkit with Blue Screen history now targets 64-bit Windows," says this news headline.

A new version of the malware that crippled Windows PCs last February sidesteps safeguards designed to block rootkits from hijacking machines running 64-bit editions of Windows, researchers said Thursday.


Proprietary software for Windows is another problem (Adobe and Apple being prime examples), but Free software too, e.g. Mozilla Firefox, may sometimes suffer only from flaws that are inherited from Windows, not Linux/UNIX. Microsoft in the stack is a real troublemaker and Apple is not helping:

A security researcher has uncovered a new vulnerability in Apple QuickTime that can be used to bypass some security protections in Microsoft Windows.


Code needs to be openly audited/auditable to be trustworthy. Why did the U.S. military make the mistake of relying on Windows?

"Thanks to Mr. Gates, we now know that an open Internet with protocols anyone can implement is communism; it was set up by that famous communist agent, the US Department of Defense."

--Richard Stallman



Comments

Recent Techrights' Posts

Why We Publish Information About the SLAPPs (But Not About the Legal Process), an Abuse of Process by Americans Trying to Silence Critics of Their Employer, Microsoft
It doesn't take thousands of pages to explain something simple
 
Links 02/09/2025: Attacks on Unions, Microsoft TCO, and DDoSing a Growing Problem
Links for the day
Internet Relay Chat Didn't Fall Off a Cliff
IRC will turn 40 in less than 3 years from now
The UEFI 9/11 - Part V - This is Not a Drill (Disable "SecureBoot" Now)
A "9/11" Coming
There's No Obligation to Speak to Anybody
The very fact that "bkuhn" is till spending time in social control media says a lot about his poor judgment
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Monday, September 01, 2025
IRC logs for Monday, September 01, 2025
The Register MS Says "AI Web Crawlers Are Destroying Websites", So Why Does The Register MS Help 'AI' Companies? (Spoiler: Money)
People need to call out The Register MS on its hypocrisy
Microsoft Trying to Force People to Resign (Amid Mass Layoffs) a Strategy That Takes Its Toll
Microsoft seems to be circling down the drain and the "final flush" will be the moment the "hey hi" (AI) bubble implodes completely
Google Simply Cannot Be Trusted
Only fools would trust GAFAM
Admission That a Third Party (or Parties) Funds the SLAPPs Against Techrights
This can end up costing them over a million dollars
Modifying and Writing One's Own Computer Programs is Not a Crime (or: Google Proves That Stallman Was Right)
We're generally gratified to see so many positive mentions of him
Why We Stopped Publishing Videos (for Now)
We'll probably get back to videos one day, but it's hard to say when or to what extent
What Animal Rights Activism Teaches Us About Sympathy and Focus
It's possible to believe that the planet is warming, that we must do something about it, and still eat eggs and butter
When You Turn Web Sites About Tech Into Political Sites
A lot of people fall into the trap of catering only for particular groups
Gemini Links 02/09/2025: ROOPHLOCH 2025 and Lagrange 1.19 Released
Links for the day
Gemini Links 01/09/2025: News Corp. WSJ and A Month With NixOS
Links for the day
Slopfarms Already Peaked, They Will Die When Slop Companies Run Out of Money to Borrow
slopfarms will lack an actual "engine"
“Sideloading” Never Killed Anybody
There are many online discussions this week about the misnomer "sideloading"
Slopwatch: Google News as FUD Vector Against Linux and Plagiarism Enhancer, Serial Slopper (SS) Uses LLMs to Googlebomb "Linux"
Slop destroys the Web not just by screwing with search engines and helping plagiarists. It's also responsible for de facto DDoS attacks...
Links 01/09/2025: "Attacks on Science" and China's "Soft Power" Grows
Links for the day
Links 01/09/2025: Fresh Backlash Against Slop and "Norway’s Electricity Crisis is About to Hit Britain"
Links for the day
Writing and Coding Isn't Always Enough
Last year we had to assume a role we didn't have before: litigants
Links 01/09/2025: Catching Up (Mostly via Deutsche Welle), "Windows TCO" Effect in UK
Links for the day
Gemini Links 01/09/2025: Linguistic Barriers and "Web 1.0 Hosting"
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Sunday, August 31, 2025
IRC logs for Sunday, August 31, 2025
Autumn Has Come
Autumn should be exciting in all sorts of ways; it'll also mark our anniversary
The UEFI 9/11 - Part IV - External Interference
They all seem to be playing a role in crushing Software Freedom and self-determination for users
Links 31/08/2025: Baggage Claim Scams, an Insurrectionist’s War on Culture, and a Sudden Robotics Hype
Links for the day
Gemini Links 31/08/2025: Reviewing Netsurf and Slightly Less Historic Ada Design
Links for the day
IBM Has Taken Control of GNOME
Don't expect a successor to be found any time soon
Links 31/08/2025: Google Gmail Data Breach and LF Puff Pieces for Pay
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Saturday, August 30, 2025
IRC logs for Saturday, August 30, 2025
This is What Google News Has Become
Moments ago