Bonum Certa Men Certa

Conficker is Alive, Windows Vista is Critically Vulnerable and Microsoft Office Likewise

Magaphone
Patchy Tuesdays always get you down



Summary: New evidence for the lingering pattern of vulnerability, arrogance, and lack of responsibility at Microsoft

Conficker has been a colossal PR problem for Microsoft and security headache to its customers. For the uninitiated, here are some previous posts that we wrote about Conficker:



Microsoft would rather pretend that Conficker is history, but it's far from history. In fact, new variants of it are now appearing and Symantec has issued warnings. For the latest details, see:

i. Conficker Worm Strikes Back With New Variant

The Conficker/Downadup worm managed to slither onto millions of PCs worldwide at its height, but after it initially infected a computer it only really acted to spread itself, and didn't cause further harm. Until now.

Symantec reports today that it has found a new variant of the virulent worm that will identify antivirus software or security analysis tools running on the infected PC, and attempt to shut down those programs. This is a strong signal that the worm's mysterious creators haven't abandoned their creation in the face of worldwide attention, as some in the industry have theorized, but may still have plans to make a buck off their work.


ii. Conficker gets upgraded with defenses

Researchers at Symantec have discovered what could be a significant development in the ongoing Conficker worm saga: a new module that is being pushed out to some infected systems.

In a couple of ways, the new component is designed to harden infected machines against an industry consortium that is actively trying to contain the prolific worm. For one, the update targets antivirus software and security analysis tools to prevent them from removing the malware. Not only does it try to disable anti-malware titles, it also goes after programs such as Wireshark and regmon.


It gets worse. The illusion that Windows Vista can be secured is long dead, so no update or upgrade can redeem the user from becoming a zombie (even Vista 7 is open to hijackers [1, 2, 3], long before release). It's the same old routine now that Windows Vista is discovered to be suffering from another "critical" flaw (or set thereof) which has not been patched yet.

March's Patch Tuesday will see yet another critical fix for Microsoft's flagship operating systems.


Users of Microsoft Office will be left vulnerable for at least another month:

Vole said that it will not be fixing a critical Excel vulnerability, which allows attackers to launch malicious code remotely on users' computers via an infected Excel spreadsheet file.


From IDG:

Microsoft Corp. today said it will deliver three security updates on Tuesday, one of them ranked as "critical," but will not fix an Excel flaw that attackers are now exploiting.

All three updates spelled out in today's notice will tackle vulnerabilities in Windows, but as is its practice, Microsoft did not drill any deeper than to specify which versions will be affected.


As usual, Microsoft is hiding the real scale and the real number of vulnerabilities. InformationWeek wrote about this also.

"Our products just aren't engineered for security."

--Brian Valentine, top Windows executive



"It is no exaggeration to say that the national security is also implicated by the efforts of hackers to break into computing networks. Computers, including many running Windows operating systems, are used throughout the United States Department of Defense and by the armed forces of the United States in Afghanistan and elsewhere."

--Jim Allchin, top Windows executive

Comments

Recent Techrights' Posts

A Lot of Technological 'Progress' Has Been Nothing But Buzzwords
Free software does not try to excite people people over nothing
Proprietary Software: Here Today, Gone Tomorrow
Proprietary software has an entirely different mindset, revolving around business models rather than science
Web Hostnames Down to Lowest Number in More Than 7 Years!
the number of hostnames is falling rapidly (they hide this by choosing logarithmic scale)
Over at Tux Machines...
2 days' worth
Stop Begging Companies That Don't Value Your Freedom to Stop Pushing You Around
That's not freedom
The forbidden topics
There are forbidden topics in the hacker community
Curation and Preservation Work
The winter is coming soon and this means our anniversary is near
 
Links 30/09/2023: Bing Almost Offloaded Due to Failure/Losses, Nvidia Raided
Links for the day
Community is the Lifeblood of Freedom in the GNU/Linux World
Removing or undoing the "cancerd" (systemd) is feasible but increasingly difficult
Richard Stallman Says He Will Probably Live Many More Years
"Richard Stallman has cancer. Fortunately it is slow-growing and manageable follicular lymphona, so he will probably live many more years nonetheless. But he now has to be even more careful not to catch Covid-19."
Quitting 'Clown Computing' and GAFAM is Only the Start
The Web and the Net at large became far too centralised
They Say Free Software is Like Communism When They, the Proprietary Software Giants, Constantly Pursue Government Bailouts (Subsidies From Taxpayers)
At the moment Ukraine is at most risk due to its dependence on Microsoft (inside its infrastructure)
Social Control Media Has No Future, It Was Always Doomed to Fail (Also Promoted Based on Lies)
Recent events, including developments at Twitter, meant that they lost a lot of their audience and then, in turn, sponsors/advertisers
They're Been Trying to 'Kill' Richard Stallman for Years (by Mentally Tormenting Him)
Malicious tongue wanted to do him what had been done to Julian Assange
We Temporarily Have Two Gemini Capsules
They're both authentic and secure, but they're not the same
Consumerism is Lying and Revisionism
We need to reject these liars and charlatans
Links 30/09/2023: Open VFS Framework, CrossOver 23.5, Dianne Feinstein Dies
Links for the day
Security Leftovers
GNU/Linux, Microsoft, and more
Microsoft Down on the World Wide Web, Shows Survey
down by a lot in this category
IRC Proceedings: Friday, September 29, 2023
IRC logs for Friday, September 29, 2023
A Society That Fails Journalists Does Not Deserve Journalism
It's probably too later to save Julian Assange as a working publisher (he might never recover from the mental torture), but as a person and a father we can wish and work towards his release
Almost Nothing To Go With Your Morning's Cup Of Coffee
Newspaper? What newspaper?
Techrights Was Right About the Chaff Bots (They Failed to Live up to Their Promise)
Those who have been paying attention to news of substance rather than fashionable "tech trends" probably know that GNU/Linux grew a lot this year
Selling Out to Microsoft Makes You Dead Beef
If all goes as well as we've envisioned, Microsoft will get smaller and smaller
Mobile Phones Aren't Your Friend or a Gateway to Truly Social Life
Newer should not always seem more seductive, as novelty is by default questionable and debatable
Links 29/09/2023: Disinformation and Monopolies
Links for the day
iFixit Requests DMCA Exemption…To Figure Out How To Repair McDonald’s Ice Cream Machines
Reprinted with permission from Ryan Farmer
Jim Zemlin Thinks the World's Largest Software Company Has 200 Staff, Many of Whom Not Technical at All
biggest ego in the world
Microsoft GitHub Exposé — In the Alex Graveley Case, His Lawyer, Rick Cofer, Appears to Have Bribed the DA to Keep Graveley (and Others) Out of Prison
Is this how one gets out of prison? Hire the person who bribes the DA?
Richard Stallman's Public Talk in GNU's 40th Anniversary Ceremony
Out now
Links 29/09/2023: Linux Foundation Boasting, QLite FDW 2.4.0 Released
Links for the day
Red Hat Does Not Understand Community and It's Publicly Promoting Microsoft's Gartner
RedHat.com is basically lioning a firm that has long been attacking GNU/Linux in the private and public sectors at the behest of Microsoft
A 'Code of Conduct' Typically Promoted by Criminal Corporations to Protect Crimes From Scrutiny
We saw this in action last week
Objections to binutils CoC
LXO response to proposed Code of Conduct
Conde Nast (Reddit), Which Endlessly Defamed Richard Stallman and Had Paid Salaries to Microsoft-Connected Pedophiles, Says You Must Be Over 18 to See 'Stallman Was Right'
Does this get in the way of their Bill Gates-sponsored "Bill Gates says" programme/schedule?
Techrights Extends Wishes of Good Health to Richard M. Stallman
Richard Stallman has cancer
endsoftwarepatents.org Still Going, Some Good News From Canada
a blow to software patents in Canada
The Debian Project Leader said the main thing Debian lacked was more contributors
The Debian Project Leader said the main thing Debian lacked was more contributors
IRC Proceedings: Thursday, September 28, 2023
IRC logs for Thursday, September 28, 2023
Links 28/09/2023: Openwashing and Patent Spam as 'News'
Links for the day
Links 28/09/2023: Preparing Red Hat Enterprise Linux 8.9 and 9.3 Beta
Links for the day
We Need to Liberate the Client Side and Userspace Too
Lots of work remains to be done
Recent IRC Logs (Since Site Upgrade)
better late than never
Techrights Videos Will be Back Soon
We want do publish video without any of the underlying complexity and this means changing some code
Microsoft is Faking Its Financial Performance, Buying Companies Helps Perpetuate the Big Lies (or Pass the Debt Around)
Our guess is that Microsoft will keep pretending to be huge, even as the market share of Windows (and other things) continues to decrease
Techrights Will Tell the Story (Until Next Year!) of How Since 2022 It Has Been Under a Coordinated Attack by a Horde of Vandals and Nutcases
People like these belong in handcuffs and behind bars (sometimes they are) and our readers still deserve to know the full story. It's a cautionary tale for other groups and sites
Why It Became Essential to Split GNU/Linux Stories from the Rest
These sites aren't babies anymore. In terms of age, they're already adults.
Losses and Gains in an Age of Oligarchy - A Techrights Perspective
If you don't even try to fix something, there's not even a chance it'll get fixed
Google (and the Likes Of It) Will Cause Catastrophic Information Loss Rather Than Organise the World's Information
Informational and cultural losses due to technological plunder
Links 28/09/2023: GNOME 45 Release Party, 'Smart' Homes Orphaned
Links for the day
Security Leftovers
Xen, breaches, and more
GNOME Console Won’t Support Color Palettes or Profiles; Will Support Esperanto
Reprinted with permission from Ryan Farmer