EditorsAbout the SiteComes vs. MicrosoftUsing This Web SiteSite ArchivesCredibility IndexOOXMLOpenDocumentPatentsNovellNews DigestSite NewsRSS

11.13.14

Windows ‘Update’ and NSA Back Doors, Including a 19-Year Bug Door in Microsoft Windows

Posted in Microsoft, Security, Windows at 12:22 pm by Dr. Roy Schestowitz

Summary: The back doors-enabled Microsoft Windows is being revealed and portrayed as the Swiss cheese that it really is after massive holes are discovered (mostly to be buried by a .NET propaganda blitz)

Windows ‘Update’, which essentially translates into Microsoft manipulating binaries on people’s machines without any changelog (at least not in source code form), is making the news again this month. Windows ‘Update’ is happening quite often (a monthly recurrence), but this time there is a lot to say about it.

The British NHS, which holds full medical records of very many individuals, recently received a lot of flack for sticking with an unsupported operating system that was released when I was a teenager instead of upgrading to recently-built Free software like GNU/Linux. Guess what happened to the NHS? “NHS XP patch scratch leaves patient records wide open to HACKERS” says the British press, meaning that not only the NSA gets access to NHS data:

Thousands of patient records could be left exposed to hackers, as up to 20 NHS trusts have failed to put an agreement in place with Microsoft to extend security support for Windows XP via a patch, The Register can reveal.

Another story of a botched update of Windows says that “Crypto attack that hijacked Windows Update goes mainstream in Amazon Cloud”:

Underscoring just how broken the widely used MD5 hashing algorithm is, a software engineer racked up just 65 cents in computing fees to replicate the type of attack a powerful nation-state used in 2012 to hijack Microsoft’s Windows Update mechanism.

That’s what one gets when using weak ciphers that the NSA promotes and Microsoft willingly spreads. Windows Update is a dangerous tool for many reasons not just because it is bricking Linux devices these days but because it’s a tool that gives the NSA a lot of power. Before an update kicks in the NSA is given information that allows it to take full control of PCs with Windows, remotely even (this is done every month). This may sound benign until one learns about Stuxnet (weaponised malware of the NSA) and considers this latest Patch Tuesday:

Microsoft is issuing the largest number of monthly security advisories since June 2011, five of them critical and affecting all supported versions of Windows. And applying the patches will be time consuming, experts say.

“Next week will tell us how many CVEs are involved but suffice to say, this patch load will be a big impact to the enterprise,” says Russ Ernst, the director of product management for Lumension.

CBS, being not just a proponent of espionage, mass surveillance, assassination and violent wars but also a proponent of back doors, had its site ZDNet downplay the above. “So far in calendar year 2014,” it said, “Microsoft has fixed 215 vulnerabilities in Internet Explorer” (lots of potential NSA back doors). Then come some lame excuses and damage control from Microsoft in the update, trying to make its bad record look like a positive, neglecting that fact that Microsoft has been secretly patching holes to yield fake numbers and give a false sense of security. Here is the full summary:

So far in calendar year 2014, Microsoft has fixed 215 vulnerabilities in Internet Explorer, with more coming out today. There have been security updates to Internet Explorer every month this year except for January.

This other report, titled “Potentially catastrophic bug bites all versions of Windows. Patch now”, does not entertain the possibility of back/bug doors in Microsoft Windows being exploited, despite that fact that Microsoft already told the NSA (prodifing exploit knowledge), which undoubtedly engages in illegal intrusions/cracking. A report from IDG notes that this bug is nearly two decades old and add that only “[w]ith help from IBM, Microsoft has patched a critical Windows vulnerability that flew under the radar for nearly two decades. ”

“How many times might this flaw have been exploited by now?”So IBM, despite having no access to source code (as far as we can tell), was perhaps the only reason why Microsoft addressed this issue two decades late, eh? How many times might this flaw have been exploited by now? A reader of us, alluding to that nonsense .NET PR, explains: “Perhaps a big reason for the PR teams trumpeting the open-core or freemium model?”

It sure serves as a good distraction. When Windows XP support (patches) came to an end a Microsoft-connected firm immediately (on the very same day) started throwing brands and logos in relation to an OpenSSL bug, stealing the show and spreading FUD for many months, generalising it so as to appear like a serious, inherent issue in FOSS.

Watch this critical remote code execution flaw in Windows. It is extremely serious, but there is no logo or brand for it (unlike FOSS FUD like “Heartbleed” or “Shellshock” — with a brand that was even perpetuated by the Russia-based Mandriva the other day).

Share this post: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Digg
  • del.icio.us
  • Reddit
  • co.mments
  • DZone
  • email
  • Google Bookmarks
  • LinkedIn
  • NewsVine
  • Print
  • Technorati
  • TwitThis
  • Facebook

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

What Else is New


  1. Links 20/7/2019: Weston 7.0 Alpha, Nageru 1.9.0

    Links for the day



  2. Companies That Collapse Because the European Patent Office (EPO) Gave Them Fake Patents in a Hurry

    False hopes and false promises won’t do any favours to European Patents, whose legal certainty suffers because Campinos and Battistelli measure nothing but ‘production’ (quantity) rather than quality of patents



  3. Slack Committed a Very Major Crime That Can Cost Many Billions If Not Trillions in Damages for Years to Come

    The inevitable has happened to Slack, which no longer deserves to exist as a company; moreover, the people who ran the company must be held criminally accountable



  4. Demand for European Patents Will Continue to Decrease If a Lot of European Patents Turn Out to be Invalid, Worthless

    The EPO's abandonment of patent justice and quality (in pursuit of so-called 'production' targets) is likely to doom the Office as the whole or render it vastly less relevant to the rest of the world



  5. 35 U.S.C. § 101 Still in Tact in the United States and Software Patents Rot Away

    The United States, where the number of granted patents decreased last year, becomes more productive; there are more signs that patent maximalism (patent litigation, patent scope etc.) has receded



  6. Links 19/7/2019: Deepin 15.11 and GNU/Linux Back on GPD MicroPC

    Links for the day



  7. Violence is Not Free Speech and Laws Exist Against Violence

    Free speech is certainly under attack and the debate is being framed within the context of Nazism; but this overlooks the fact that there are actual death threats and calls for genocide in the mix



  8. Links 19/7/2019: Oracle Linux 8.0, Latte Dock 0.9 Beta and PCLinuxOS KDE Darkstar 2019.07

    Links for the day



  9. Why Does Jim Zemlin Publicly Congratulate Microsoft?

    The signs aren't particularly encouraging when one considers that the leadership of the Linux Foundation is a fan of Microsoft and sometimes connected to Microsoft



  10. 2 Days Later (Case in Progress) and Still Media Silence About G 2/19

    The very legitimacy of years' worth of rulings and the EPO's abusive attacks on judges are under the microscope; but the media isn't paying any attention, perhaps deliberately



  11. The 'Linux' Foundation is Acting Like a Microsoft ISV Now, Commitment to Linux and FOSS Deteriorates Even Further

    The Linux Foundation has just announced a new Microsoft-funded initiative that's pushing GitHub and CLAs (passing copyrights on code to corporations)



  12. Links 18/7/2019: OPNsense 19.7, Krita 4.2.3 and KDevelop 5.3.3 Released

    Links for the day



  13. Index: G 2/19 (Enlarged Board of Appeal, EPO)

    G 2/19 (Enlarged Board of Appeal, EPO)



  14. EPO Looney Tunes – Part 4: G 2/19 - Faites Vos Jeux…

    "Josefsson needs to bring in the “desired result” for his political masters in the Administrative Council if he wants to be in with a chance of reappointment."



  15. Media Not Interested in G 2/19, Which Demonstrates Patent Justice is Nowadays Impossible at the EPO

    The EPO spreads patent injustices to other countries and courts; the media is miraculously enough not interested, almost as though there's a coordinated blackout



  16. Librethreat Database Updated

    Database which keeps track of variants of attack vectors on Free/libre software now includes two more forms of threat



  17. A Look Back (and Forward) at Friendly Programming

    Historical perspective on computer languages and how to do better



  18. Red Hat's Freedom Reduced to Just Online Partner Enablement Network (OPEN) and Microsoft as a Close Partner; Canonical's Ubuntu Just an 'App' for Windows?

    Free software is being snapped up by proprietary software giants and patent bullies that treat it as little more than an 'add-on' for their proprietary offerings



  19. Linux Foundation Apparently Celebrates Sysadmin Day With a Microsoft Windows Site!

    The Linux Foundation shows ‘love’ to actual GNU/Linux (the real thing) by apparently rejecting it and badmouthing it



  20. EPO Looney Tunes – Part 3: The Legal Line-up for G 2/19

    The deck appears to have already been stacked for G 2/19, a decision on EPO judges' exile to Haar (veiled disciplinary action/collective punishment by those whom the judges are supposed to 'oversee')



  21. Links 17/7/2019: VirtualBox 6.0.10 and Mageia 7.1 Releases, Mint Betas

    Links for the day



  22. Links 16/7/2019: Btrfs Gets 'Cleaned Up', Clonezilla Live 2.6.2-15

    Links for the day



  23. EPO Looney Tunes - Part 2: The “Difficult Legacy” and Its Dark Historical Shadow

    Assuming that he was informed, then it seems fair to say that Battistell’s little “joke” at the expense of the Boards was in very bad taste



  24. EPO Noise Machine Turned On as Haar Hearing Kicks Off, Patrick Corcoran Defamed Again

    The EPO does not want people to hear about Haar; it just wants people to hear about how wonderful the EPO is and there are some who have just decided to slander Patrick Corcoran again



  25. Microsoft is 'Doing Kamikaze' (神風) on Linux

    An analogy for what the Linux (only in name!) Foundation and Microsoft mean to Linux — or by extension to GNU/Linux and Free software whose largest repository Microsoft took control of



  26. The 'New' Linux.com Sometimes Feels Like a Microsoft Promotion Site

    Anything that the ‘Linux’ Foundation touches seems to turn into its proprietors’ agenda; one of those proprietors is Microsoft, which has a "Jihad" against Linux



  27. IBM is a Threat to the Internet, Not Just to Software Development (Due to Software Patents Aggression)

    IBM continues its aggression against technology — a fact that’s even more distressing now that IBM calls the shots at Red Hat



  28. EPO Looney Tunes - Part 1: Is D-Day Approaching for Battistelli’s “Difficult Legacy”?

    European patent justice isn’t working within the premises of EPOnia; a bunch of ‘show trials’ may in fact turn out to be just that — a show



  29. Links 16/7/2019: LXD 3.15, Q4OS 3.8 and D9VK 0.13f

    Links for the day



  30. Links 15/7/2019: Vulkan 1.1.115 and Facebook Openwashing

    Links for the day


RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts