02.17.11

MSBBC Cracked, Canadian Government Cracked, Microsoft Blames Users, and .NET-based Aviation System Crashes

Posted in Microsoft, Servers, Windows at 2:39 pm by Dr. Roy Schestowitz

When system crashes can lead to plane crashes

Aeroplane

Summary: Another atrocious week for Microsoft’s security and reliability record

“Thanks to Windows’ built-in insecurity, its easy to create huge Windows botnets,” wrote the honourable SJVN a few days ago. It is widely recognised that Microsoft is largely responsible for many of Windows’ security failings, but Microsoft pressures journalists not to call out Windows using techniques that we covered here before.

MSBBC’s music sites have just been cracked and they turned hostile towards site visitors who use Windows. As the report puts it, “other top name insecurity vendors like Sophos, McAfee and even Microsoft’s anti-virus tools didn’t register the hack at all. That is an appalling detection rate from both free and paid-for anti-virus kits and, as of yesterday, Websense reckoned the anti-virus toolkits were still vulnerable.” This is just a Windows problem and someone who informed us that the Canadian government had just been cracked too says that 99% of the systems there run Windows (we cannot verify this claim, but if anyone can, please leave a comment).

It is unclear whether the attackers managed to compromise other departmental computer networks, including those that contain Canadians’ sensitive personal information such as tax and health records.

Once the attack was detected, government cybersecurity officials immediately shut down all internet access in both departments in an attempt to stop stolen information from being sent back to the hackers over the net.

It is obvious what’s happening here. A suicidal dependence on poor systems (such as Windows) is a crucial factor that can easily affect national security or suspend emergency services like dispatch of ambulances. The latter new example speaks of Windows viruses leading to a likely loss of lives (although disruption to service is denied by the face-saving officials). What is Microsoft’s response to all of this? As we noted yesterday, the company’s lobbyist from the government [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13] is trying to blame the users and there are strong responses to it again, such as:

Microsoft Vice President Scott Charney, a longtime advocate of a coordinated approach to cybersecurity, describes a vision of Internet health:

“We broke Windows. It’s your problem now.”

At least, that’s how I interpret his comments. Charney wants to have users pass a kind of “health test” for their computer before they can use web services.

“Security is not a problem that can be addressed fully by individual consumers, or even individual companies or governments. That is what led to the development of my public health model proposal, which calls for collective defense against cyber threats,” he said.

Charney uses a public health model to support his new idea. Basically, in order to access web services (say, your bank – or cloud services, maybe even social networking like Facebook) you first need to let the provider run their virus check on your computer. Intrusive? I think so. Would you let a web site run their code (virus scan) on your machine before you are allowed to use their web application? I think I smell more malware coming.

Charney’s appalling remarks are also mentioned by Lia Timson at ITWire and Lia’s colleague Sam Varghese, who writes:

Passing the buck is a game at which Microsoft is adept. In the computer security industry, one needs to have tons of chutzpah to hold others responsible for one’s own security stuff-ups.

The good folk at Redmond possess this quality in spades.

Probably the best example of chutzpah that I can recall came from a young Bill Gates many years ago when the company was getting off the starting blocks. As Paul Allen, the other co-founder, had also taken up a job as head of software at MITs, the maker of the Altair, Gates argued that since he was working for Microsoft only and Allen was dividing his time, he (Gates) should have 64 percent of the founders’ shares and Allen should only get 36 percent.

Shortly after the division was done this way, young Bill went to MITs founder Ed Roberts and got a job there as well, for $US10 an hour. Microsoft’s culture has always been defined by Gates.

Scott Charney’s comments at the ongoing RSA conference are a good example of the blithe manner in which Microsoft tries to force the rest of the world to carry the can for the abysmal security of its products.

The monoculture otherwise known as Windows is in the main responsible for the plethora of viruses, worms, malware, scumware and other such $wares that plague the internet. DDoS attacks come, more often than not, from armies of Windows machines grouped in a botnet.

Sure, there are other operating systems involved too but they are in a minority. A very small minority. Windows is the main problem and everyone, his/her dog, his/her cat and his/her goldfish is aware of that.

Dr. Glyn Moody links to the article “Microsoft has a change of heart on how to keep Internet safe” and he adds: “or how about if Microsoft just wrote some decent code?”

“Will Virgin do the same thing as LSE following this daunting incident?”Yes, journalists too recognise that this is Microsoft’s fault, as stated at the beginning. The gullible, weak ones just bend to Microsoft PR agents and deceive the public about it. These are the sorts of people who do the scaremongering regarding “cyber war” so that companies like Microsoft and suppressive regimes can find good excuses for taking more control over people’s computers, spying on PCs of Windows users for example.

There is another timely example of the failed design of Microsoft software. It’s a major .NET failure just like the ones in LSE (a former Microsoft poster child). Not so long ago it turned out that a plane crash had been caused by Windows malware (with Microsoft boosters blaming IBM in vain [1, 2]) and amid other plane crashes and downtimes in airports [1, 2] it became evident that Microsoft belongs nowhere near aviation. Virgin made the mistake of going with Microsoft and watch what happens:

This latest computer crash, which looks to be as serious as the 2010 fiasco, will place more question marks around the integrity and robustness of the .NET based Navitaire New Skies system which claims to be able to handle load spikes and scale easily as passenger volumes increase.

The crash also raises questions about the level of redundancy built into Navitaire, which is supposed to provide back-up systems in the event of failure.

Will Virgin do the same thing as LSE following this daunting incident?

Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Reddit
  • email

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

5 Comments

  1. twitter said,

    February 17, 2011 at 6:18 pm

    Gravatar

    Another good reason for governments to dump Microsoft comes from the Aaron Barr, HBGary disclosures. The exploits he advertised are almost all Microsoft problems or software that runs on Windows He brags about screwing private companies, governments, presumably the US included, as well as the “progressive groups” targeted by the US Chamber of Commerce and Bank of America.

    If I want to gain access to the Exelon plant up in Pottsdown PA I only have to go as far as LinkedIn to identify Nuclear engineers being employed by Exelon in that location. Jump over to Facebook to start doing link analysis and profiling. Add data from twitter and other social media services. I have enough information to develop a highly targeted exploitation effort.

    I can and have gained access to various government and government contractor groups in the social media space using this technique (more detailed but you get the point). Given that people work from home, access home services from work — getting access to the target is just a matter of time and nominal effort.

    As usual, the crooks go for the softest target and that is people’s home computers running Windows. One of the reasons Barr targeted family members of his targets was to gain access to company and organizational networks. In one of the images he’s quoted as saying, “An example. Richard probably has a home network. Richard and [his wife] probably share the same network, maybe even the same home computer. Either way. [sic] If I can exploit her account through one of her social connections I can exploit the home network/system.” The nasty things he does with such information and control are well documented, harass, demoralize, fracture, discredit and destroy the targeted groups and people.

    The best way for governments, companies and progressives alike to avoid this kind of screw over is for them to all start using free software which is miles ahead of non free software in all ways related to security, privacy and attribution. People using free software can easily sign or encrypt their communications and documents to assure privacy and authorship. That eliminates many of the social attacks Microsoft boosters will try to highlight in order to deflect attention from Microsoft flaws, the old “all software is crap, blame the user” misdirection. The number of free software exploits is vanishingly small because of inherently better design, continuous, rapid improvement and diversity based on architecture and distribution. Non free software was designed to exploit the user with unjust demands, so it is no surprise that backdoors and other treachery are more common than things users want.

  2. twitter said,

    February 18, 2011 at 1:00 am

    Gravatar

    NASDAQ was also cracked the other day. No, not the GNU/Linux trading computers, something called Directors Desk that they foolishly ran on Windows. NASDAQ and Slashdot both fail to call out Windows, and the Slashdot submitter disgraced themselves by saying, “the attackers are winning, and even well-funded organizations like NASDAQ can’t secure their networks reliably.” No one can secure Windows or any network with Windows on it. Google figured this out and banned Windows from their networks. When will other companies get with it?

    Dr. Roy Schestowitz Reply:

    I put that in daily links as I could not confirm that Windows was to blame.

    twitter Reply:

    Oh my, here’s Forbes rushing to Microsoft’s rescue. Mention of EU privacy violations is interesting but not as much fun as the estimated year of penetration “hackers” had to the supposed treasure trove of information on 10,000 board of directors, including Fortune 500 companies. The forbes rescue is that this attack had to be State-Sponsored because of how long it went undetected! It was an “Advanced Persistant Threat attack” (APT)!! The author splurges on,

    The security measures advertised on the Directors Desk website such as compliance with ISO27001, firewalls, IDS, and strong passwords are useless against APT because attacks are specifically designed to bypass everything that the target has put in place; even encryption. … NASDAQ needs to consult with security experts who understand and work APT attacks as soon as possible. If you’re a Directors Desk LLC customer, you should probably do the same.

    Call the author right away because he “provides custom security solutions that focus exclusively on the special needs of C-level and other senior executives.”

    News about the hack is ranked high in Google search results for “NASDAQ Directors Desk” but none of the articles in the first two pages call out Windows. This one (USA Today) thinks a poison pdf might have been planted but fails to mention the target would be Adobe Reader on Windows or that the attack was against a crappy Windows server. Instead the author calls Director’s desk a, “no-nonsense social network for very privileged users. Nasdaq describes it as a “complete turnkey, fully hosted online board technology solution”. Right. The author then details how a poison pdf would have been slipped it from a board member’s “PC” that got p0wnt by someone who had done a little HBGary style research, as Windows PCs often are. No mention is made of Windws, however. That Windows is insecure on desktops or servers is simply too easy a solution, a non story that won’t sell any fancy insecurity products. Network World fails to call out Windows, but comments do. There’s no mention of Windows here or in the New York Times or The Wall Street Journal.

    By not calling out Windows, all of these big publishers create panic without a reasonable solution, and set people up for great harm. Readers are invited to panic as they realize that criminals have penetrated all sorts of networks, private and government. They would not be so scared if they simply ditched Microsoft. Instead, I’m afraid Microsoft is going to use their failures to gain yet more power. People, ignorant of the cause of their problems, will be fleeced by snake oil vendors and Microsoft’s “public health” proposals will be used to discriminate against people who don’t use Windows and don’t have the problems. The snake oil solutions are a never ending story that Microsoft has pushed since the early days of MSDOS.

    Dr. Roy Schestowitz Reply:

    Google knew better and also named Windows.

What Else is New


  1. Showing Solidarity With FSFE Survivors

    What does justice look like?



  2. IBM is Throwing Away Red Hat's 'de Facto Standard' Status in Servers, Wrongly Assuming People Can't (or Won't) Go Elsewhere

    This new video is over half an hour long and it’s a discussion of IBM’s self-harming (shot-in-the-foot) move, which it already seems to regret



  3. Why 6 Screens and 6 Virtual Desktops

    An explanation of how I use computers and how I distribute tasks (across screens and across virtual desktops)



  4. Red Hat Developer Network Promoting Microsoft's Proprietary Software, Sometimes by Mass-Mailing People

    Red Hat is doing a disservice to people who subscribe to E-mail newsletters; those people are almost never into Microsoft's proprietary software, which they want to get away from



  5. IRC Proceedings: Tuesday, January 26, 2021

    IRC logs for Tuesday, January 26, 2021



  6. Links 26/1/2021: Mozilla Firefox 85.0, Tails 4.15, Zentyal Server 7.0, GNOME 40 Alpha

    Links for the day



  7. Instead of Making Access to COVID-19 Solutions Easier Bill Gates Has Made It Harder (Patent Profits)

    Counterproductively — and at a great cost to human civilisation — Bill Gates has once again put profits and monopoly ahead of global goals such as collective health



  8. We Need More Documents Leaked to Know Intel (From the) Inside

    We invite more leaks from the belly of the beast "chipzilla", seeing that it is becoming a drone of Microsoft again, yearning for the "Wintel" days instead of moving on to a world dominated by GNU/Linux and Free/libre software



  9. Why GNU/Linux Users (and the Public at Large) Should Support Leaking/Whistleblowing Sites (Including Wikileaks)

    To demonstrate the value of "scientific journalism" (a term apparently coined by Wikileaks) we take a look at Red Hat's response to embarrassing leaks (demonstrating what a scam their certification and examination programmes really are)



  10. EPO President António Campinos is Still Not Listening, According to Internal EPO Documents

    Increasingly arrogant and unaccountable management of Europe's second-largest institution (EPO) has left staff disillusioned but still defiant; there's clearly unsuitable or unfit-for-purpose management at the EPO, self-selecting based on nepotism/loyalty so as to cover up abuses



  11. Why You Should Give Falkon (the Web Browser) a Chance on GNU/Linux, BSD, or Windows

    In this crazy new world where advertisers are the real customers and Web users ("audiences") have been reduced to mere products we need a browser that isn't controlled by a company; try Falkon



  12. Kluwer Patent Spin and Distortion of Facts (Regarding UPC and More)

    Kluwer Patent Blog disgraces the firm that puts its name on it; instead of sticking to facts they're distorting the facts and the sole/principal goal is to manipulate/mislead the public and public servants



  13. Links 26/1/2021: 4MLinux 35.1, GParted 1.2, Gnuastro 0.14

    Links for the day



  14. IRC Proceedings: Monday, January 25, 2021

    IRC logs for Monday, January 25, 2021



  15. It's Wrong to Assume Red Hat Competes With Microsoft

    The community ought to stop pretending that one monopoly seeks to replace another despite close partnerships (some would say "collusion") between the two



  16. EPO Staff Representation Complains That EPO Management Exploits Pandemic and 'House Arrests' to Overwork Staff, Lower Quality

    The EPO keeps breaking its promises to workers; not only are key employees seeing their net salary cut (inflation factored in) but pensioners too are being robbed and in the meantime the total time spent on work is increasing



  17. Fake News is Not a 'Wing' Thing

    The two-party corporate-led system (and media) would have us obsess/bicker about accuracy of news based on some binary/dual system of blind loyalty rather than underlying facts and priorities



  18. Links 25/1/2021: Huawei on GNU/Linux, NuTyX 20.12.1, Whisker Menu 2.5.3, Lutris 0.5.8.3, Linux 5.11 RC5

    Links for the day



  19. Fear, Uncertainty, and Doubt (FUD) in ZDNet is the Norm

    ZDNet continues to emit lots of garbage 'journalism', in effect Microsoft PR and what's known as "black PR" for Linux; just like Bleeping Computer, which ZDNet hired this writer from, there's no adherence to facts, just smears and innuendo



  20. Truth Tellers Aren't an Enemy of Free Software

    There's a perpetual attack on people who speak out against actors and corporations in positions of great power, however subtle and indirect those attacks may seem on the surface (they don't wish to be held accountable for defaming activists)



  21. The Linux Foundation, With Over 124 Million Dollars in Annual Revenue, is in Trouble Because of the Pandemic, So It's Trying to Reinvent Itself as Training and Certifications Outfit

    With mountains of cash and a Public Relations (PR) or marketing business model the so-called 'Linux' Foundation became reliant on travel, lodging, booths and speeches on sale; COVID-19 is a great risk to that business model



  22. IRC Proceedings: Sunday, January 24, 2021

    IRC logs for Sunday, January 24, 2021



  23. Our Move Further Away From the World Wide Web, the Browser Monopolies, HTTP, and HTML

    The World Wide Web (WWW) is going down a bad path and a clearly regressive direction; the solution isn't going 'retro' but exploring more sophisticated systems which are robust to censorship (localised or globalised) and downtime (related to censorship) while reducing surveillance by leveraging encryption at the endpoints



  24. Important Issues Not Entertained in the Community, Especially Critics of the Status Quo

    here's corporate infiltration inside communities (for oligarchy hunts volunteer, unpaid labour) and those who speak about that as a threat to our cause and objectives are painted as misguided outcasts who must be ignored



  25. Internet Origins of the Mob

    Reprinted with permission from Daniel Pocock



  26. When Proprietary Software Users Dictate the Freedom-Leaning Communities

    Fedora doesn't care about software freedom and its steward (or parent company) is sometimes imposing proprietary software on staff; they've quit caring



  27. In 2020 Onwards 'Open Source' is Just a Marketing Ploy of Monopolies, Unlike Free Software

    More people are nowadays seeing or witnessing 'Open Source' for what it truly is; the term has become a misleading marketing term of proprietary software firms looking to rebrand as "ethical" (e.g. by sharing some code with other proprietary software firms, over proprietary platforms such as GitHub)



  28. Microsoft: The Year After We Bought GitHub There Was a Significant Decline in Number of New Projects on GitHub

    Microsoft has just admitted that in 2019 GitHub saw a very significant decline in number of new projects (and users, which it is conveniently miscounting by adding 'phantom' ones) on the site. Just what we had heard before they confirmed it (and they foresaw this effect of the takeover, hence the lies about "loving" Linux).



  29. Social Control Media is a Passing Fad, We Should All Go Back to Blogging and Subscribing to RSS Feeds

    The whole "social control media" phenomenon has been oversold or promoted using lies; in reality, as a mountain of evidence serves to show, it's a way to manage society at a macro scale



  30. As Andrei Iancu Removes Himself From the Patent and Trademark Office All Eyes Are on Biden's Next Nomination

    Patent zealots and their front groups already lobby Joe Biden to put one of them in charge of the U.S. Patent and Trademark Office; we'll soon see if Joe Biden "means business" or simply means monopoly/large corporations (and their law firms/departments)


RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts