Bonum Certa Men Certa

Eye on Security: 'Fun' with Zombies, Press Ignorance, and Bizarre Solutions

"Our products just aren't engineered for security."

--Brian Valentine, Microsoft executive



Microsoft software is not exactly renowned for being secure, despite attempts to manipulate journalists. The software is notorious for being deficient or defective. To Microsoft, security and networking were an afterthought, not a design consideration, as shown here. Granted, trouble should be anticipated.



Zombies Conundrum



Stories about Windows zombies are a dime a dozen, just like zombie nodes. It is estimated that about 320 million Windows PCs are zombies. Here is the latest story on this never-ending (and very costly) battle.

Researchers at Trend reported that 500,000 unique hosts have been infected across the globe. Macalintal said that because of the behavior of the worm, he expected to see the botnet grow bigger and produce more variants.


That's small potatoes compared to the whole, but it just happens to be a new example. Not so long ago we witnessed hospitals and army bases becoming botnets, as well. It's a hugely serious subject that results in many untold deaths.

Insecure by Design



As prior links demonstrate (we strive to avoid repetition), it is agreed even by Microsoft's biggest of fans that Windows fails at security because it's just bad at it. It's nothing to do with market share and those lies are running thin. In the following new article, Microsoft's security model comes under fire.

When Microsoft released an emergency patch last month for a critical vulnerability in the server service in Windows, administrators and security teams in enterprises around the world scrambled to test the fix, schedule downtime and get the patch distributed as quickly as possible. If ever there was an occasion to use all due haste in deploying a patch, this was it. Not only was the vulnerability present in every supported version of Windows, but Microsoft officials had warned that it was a prime candidate for a worm.


Here is another one from the news.

Security Manager's Journal: When is a patch not really a patch?



[...]

If you don't reboot a Windows server after a patch is applied, the patch doesn't take effect, but SMS doesn't notice that failure to reboot. This insistence on rebooting is one of the things I dislike about Windows. In the Unix world, all that's usually required is that a particular process be restarted.


There has been lots of chatter about a flaw in Mozilla Firefox, but like many previous ones, this new vulnerability only applies to Windows, where Firefox inherits some risky behaviour which it sometimes attempts to mimic due to necessity. Why isn't the press covering this properly?

Bad, wicked Firefox, bad wicked open source...except that this trojan *only* works on Windows...which means it's bad wicked Windows, yet again. But the article never mentions this, of course.

[...]

And yes, you guessed it, it only works on Windows. So that bit about "[t]he most remarkable feature of the episode may not be the breach of security, but the cost of dealing with it" is really about the cost of using Windows - well, it's The Economist, what do you expect, accuracy? When will they ever learn?


As Glyn Moody shows, there are rare exceptions among the reporters.

The Web Vector



Adding to a mountain of reasons for infection:

1. Facebook hit by virus

"Koobface" that uses the social network's messaging system to infect PCs, then tries to gather sensitive information such as credit card numbers.


2. Most recent Windows infections result from the same simple trick

BitDefender's Top 10 E-Threats Report identifies just one type of attack as being responsible for more than a third of Windows infections in the past month: fake anti-virus scans, also known as scareware.


Attacking the Outcome, Not the Cause



Here is a good and short article titled "Punishment vs. Prevention."

Finally, I feel compelled to issue the warning, "Be careful what you wish for, because you might just get it." If the government takes over Internet security, there is sure to be a large amount of new regulation imposed. And this could mean security companies like F-Secure would have to devote a lot of resources towards compliance. I think it would be much better for us to take responsibility for finding solutions ourselves.


This is a hot topic at the moment because concerned authorities ponder tackling the zombies issues by making punishment for those caught a lot more severe. But it's totally the wrong way of addressing the issue. As Carla argues very rightly: ""Instead of Throwing Everyone In Jail, Fix Your Lousy Products"

Have any of them-- has one single vendor, whether it's Symantec or Trend or McAfee or F-Secure or anyone-- ever said "Quit throwing your money down a rathole-- stop using Windows, or at least don't put it on the Internet"? Wouldn't that little tidbit of honesty be refreshing? But no, they'll never do that. If the same conditions existed in, say, the small home appliances industry people would be getting electrocuted by their toasters and hair dryers every day, and the manufacturers would advise them to learn correct handling of live wires, and a thriving industry of insulated safety garments would prey on the survivors. If they made safety gear for swimmers it would be so bulky and uncomfortable they either wouldn't use it, or they would drown under the weight of it.

Following current trends, anyone who criticized them would be persecuted under the DMCA.


Instead of pointing a finger at those who produce and sell shoddy software, those who suffer are blamed for negligence and stricter rules are devised as means of punishment (false cure), not prevention. It won't work. The systems need to be changed, as opposed to just their side-effects.

Recent Techrights' Posts

Gemini Links 10/04/2025: "Secret of Happiness" and Overthinking POSSE
Links for the day
Microsoft's "Linux" Foundation Pays Writers to Publish Propaganda and Then LLM Slop Sites (Slopfarms) Repeat the Propaganda, Using Microsoft LLMs
consider the latest LLM slop
Alleged Layoffs at IBM Consulting in Australia
IBM loses many government contracts these days
The Rumours Were Likely True: Sixth Wave of Microsoft Mass Layoffs in 2025 (Days After "50" Anniversary and About 5,000 Layoffs)
5 hours ago, by Ashley Stewart
 
Slopwatch: A Sea of LLM Slop About SparkyLinux, Kubernetes, Ubuntu, and Linux Kernel
Welcome to the future? The future of the Web?
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Thursday, April 10, 2025
IRC logs for Thursday, April 10, 2025
Links 10/04/2025: NNCPNET Email Network, RSS Readers, and IRS as 'Immigration Enforcer'
Links for the day
IBM Layoffs in Markham (Canada) Apparently Still Happening
"Still going on... Got laid off today. TEL Canada, Band 9, 19 years with IBM."
Links 10/04/2025: Fentanylware (TikTok) Perils and Internet Shutdown
Links for the day
Once You Slop You Can't Stop and If You're a Serial Slopper Nobody Will Believe You Really Wrote an Article (Even If You Did)
It's a lot like, "if you're a serial liar people won't believe you even when you say some truth" (or "once a cheater, always a cheater")
Pressing Against SLAPPs (From Americans Who Strangle Women While Microsoft Pays Their Salaries) is a High Priority for Us
We also need to ensure that greedy firms/people that facilitate the SLAPPs get "disbarred" or "struck off"
Mozilla Firefox Already Down to 1% in Brazil
Don't people crave the surveillance and the slop?
Links 10/04/2025: Hardware, Politics, and Internet
Links for the day
Gemini Links 10/04/2025: Creativity and Agitation, Life in the USA, CSS Naked Day 2025
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Wednesday, April 09, 2025
IRC logs for Wednesday, April 09, 2025
Malware in Proprietary Software - Latest Additions
Original by Free Software Foundation, Inc.
Links 09/04/2025: More Trade Wars and Wars, Chinese Army Troops Found Fighting in Ukraine
Links for the day
Linux Clickbait by Slop
Give it up for Brian Fagioli, the Serial Slopper
IBM and MCC: Layoffs Coming Again to Metro Connect Company Limited (MCC) as Tariffs Bite and IBM's Shares Fall
Blacklists applicable to Chinese suppliers also mean that IBM can no longer cooperate with key partners in Asia
Microsoft's Entire Premise for Its Future Existence Goes Up in Flames
32 minutes ago
GNU/Linux on a High in Colombia
Stereotypes much?
Go Static
Please don't Go(lang) or JavaScript or PHP or...
Techrights Be Like...
K.I.S.S.
Gemini Links 09/04/2025: Autism, Cybersecurity, and LLMs Attacking Services Online
Links for the day
GNU/Linux Would be Measured at Over 5% Globally (by statCounter) Had the Data in India Not Been Changed
GNU/Linux grew a lot in many countries and has expanded since then
Keeping Track of Microsoft Layoffs in 2025
So here's a quick roundup of 2025
The Sixth Anniversary of the Lightweight Alternative to the Web (Gemini Protocol)
Now 11 short of 3,000 active capsules. 65 short of 4,500 total.
Links 09/04/2025: Quartz Fires All Writers (Shutdown, LLM Slop or Slopfarm Instead), "Bitcoin Is Crashing Hard"
Links for the day
People Are Sick of LLM Slop. Offer Them Alternatives.
We never used LLM slop for anything and we never will
Web Surveyor statCounter Sees Apple's macOS Falling From 5.6% to 3.6% in Two Months, It Might Soon be Smaller Than GNU/Linux
Apple's "value" (faked, exaggerated) is back to "pandemic times"
UK House of Lords Recognises the SLAPP Issue in the UK and EFF Pursues "Bill (That) Could Put A Stop To Censorship By Lawsuit" in the US
"A House of Lords inquiry into how the news industry can survive into the future has accused the government of “failing to prioritise” action on strategic lawsuits against public participation (SLAPPs)."
Open Source Initiative (OSI) Privacy Fiasco in Detail: Seeking Class Action Against the OSI
"LETTER SEEKING CLASS ACTION REPRESENTATION"
The Value of Slop, by Alexandre Oliva
Original by Alexandre Oliva
Gemini Links 09/04/2025: Neocities, Tinylogs, and Inter-community Protocols
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Tuesday, April 08, 2025
IRC logs for Tuesday, April 08, 2025
You Can Be an A--hole to Women (Even Strangle Women) as Long as You Work for Microsoft
Recalling the Mark Shuttleworth origin story
Canonical is a Proprietary Software Reseller With a 'Debian Base'
"Canonical Ubuntu" is just Debian with some proprietary things sold on top of it