Bonum Certa Men Certa

Eye on Microsoft: The Security Comedy Resumes

Penguin bubbles



Summary: A roundup of Microsoft's latest examples of poor performance at securing its software

Microsoft's incapability with security has already cost the economy trillions of dollars. Some days ago we wrote about the impact on parts of national operations that are funded by taxpayers; they too pay the toll.

Conficker borks London council



[...]

The May incident took several days to clean-up and landed the west London council with a bill of €£500,000 in lost revenue and repairs, The Guardian reports. Because IT systems were borked, the council was unable to process more than 1,800 parking tickets, at an estimated cost of €£90,000, libraries lost out on €£25,000 in fines and booking fees, council property rent went uncollected, and €£14,000 was spent in overime sorting out delayed housing benefit claims.


Some time ago we also wrote about IIS coming under siege. It is getting worse:

New IIS attacks (greatly) expand number of vulnerable servers



[...]

Attackers have begun actively targeting an unpatched hole in Microsoft's Internet Information Services webserver using new exploit code that greatly expands the number of systems that are vulnerable to the bug.


3rd parties jump to Microsoft's (or their customers'/users') rescue. This is also covered in:



Exploit code affecting the FTP module for certain versions of Microsoft IIS has been posted online. US-CERT recommends taking countermeasures.


Another press release heralds another security problem in Microsoft's stack. Microsoft is investigating and denying it.

For more than a year, Microsoft has been sitting on a purported SQL Server vulnerability that could enable a malicious insider to obtain users' passwords, claims database security vendor Sentrigo.


There is also coverage in Dark Reading and net-security.org, which states:

Sentrigo has discovered a vulnerability in Microsoft SQL Server that allows any user with administrative privileges to openly see the unencrypted passwords of other users, or the credentials presented by applications accessing the server using SQL Server authentication.


More reasons are given to believe that Vista 7 will persist with the same security problems of Vista. A company warns about UAC.

While changes to Windows 7’s UAC benefit the home user market, enterprises must be aware that the new “slider” feature is only for administrators and may increase security risks.


Applications with an anti-viral goal still show that they may cause more trouble than it's all worth.

McAfee false alert snares innocent JavaScript files



[...]

Faulty virus definition updates from McAfee that flagged legitimate JavaScript files as potentially malign caused a headache for some sysadmins earlier this week.


In other news:

Compromised Computers Host an Average of 3 Malware Families



[...]

Unfortunately, we are talking about infected files and not doughnuts. According to security company ESET, the average compromised machine is home to 13 infected files as well as malicious programs from three different malware families.


Liability issues linger on:

An Illinois district court has allowed a couple to sue their bank on the novel grounds that it may have failed to sufficiently secure their account, after an unidentified hacker obtained a $26,500 loan on the account using the customers’ user name and password.


Given the scale of botnets, nobody should be left surprised. Systems which were not built to be secure in the first place can never be properly secured.

"Our products just aren't engineered for security."

--Brian Valentine, Microsoft executive

Recent Techrights' Posts

Video: University in Peru Honours Richard Stallman
Tomorrow, January 20, Richard Stallman speaks in France
FOSDEM is Called "FOSDEM" Because of Richard Stallman (RMS)
The overlap there seems timely; yesterday RMS spoke in French-speaking (in part) Switzerland where questions in French were accepted
January 20: Richard Stallman Talk in Europe
evening time in Europe, around midday in the United States and Canada
 
FTC Realises Microsoft Buying Fake 'Clients' to Fake "Revenue" (Microsoft 'Buying' Services and Products From Itself!)
Ponzi scheme
Total Lock-down Ambitions - Part III - The Web Browser as DRM Pusher
A lot of "streaming" stuff is DRM
IBM Termination Story and Information From Microsoft About Mass Layoffs
In 2 weeks of 2025 Microsoft already had 2 waves of layoffs
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Saturday, January 18, 2025
IRC logs for Saturday, January 18, 2025
Links 18/01/2025: Restoring the Great Wall of China and Economic Expansion in China
Links for the day
Guardian Digital (linuxsecurity.com) is Spamming the Web With Microsoft's Promotional LLM Slop About UEFI 'Secure' Boot (Which is Against Real Security)
This is an attack on honest journalism
Links 18/01/2025: TikTok's Endgame, "Car Freedom", and Spying in Cars 'Fines' GM (Settlement)
Links for the day
Links 18/01/2025: Apple Getting Out of Hey Hi (AI) Slop (Too Much Misinformation), Chaffbots/Chatbots Try to Settle Copyright Infringement Lawsuits
Links for the day
What Fake News Sites Are Doing to GNU/Linux
The LLM slop about Linux serves two purposes
Links 18/01/2025: Microsofters Upset at Microsoft's Ridiculous Rebrands (Excuse for Massive Price Hikes), Chaffbot Company ('Open'AI) Faces More Lawsuits
Links for the day
Gemini Links 18/01/2025: Surge in Illnesses, ctags, and Gemsync
Links for the day
Slopwatch: Too Lazy to Write Real Articles, Offloading to Chatbots Instead (LLM Slop About "Linux")
The Web was already full of garbage before the LLM frenzy. Now it's even worse.
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Friday, January 17, 2025
IRC logs for Friday, January 17, 2025
RMS 'Inauguration' in Montpellier (Government Administration) on January 20th
Happy hacking
Even Technical Articles and HowTos From UNIXMen Nowadays Seem to be LLM Slop
We've just permanently removed the RSS feed of UNIXMen
The FSF's 2024 End-of-Year Fundraiser Succeeds: Over $400k to Support Software Freedom
That's worth bringing up again because the SFC is trying to 'crash' this achievement of the FSF
[Meme] Fentanylware (TikTok) Banned in the United States, Next Up European Union (EU)
And the United Kingdom (UK)
President Biden is Right, "Free Press is Crumbling" and the United States Exports Its Media-Hostile Culture to Other Continents
perhaps Biden should pay closer attention to how Donald Trump-inspired Americans take their battles to other continents
Links 17/01/2025: TikTok Banned by the United Stated (SCOTUS Rejects Appeal)
Links for the day
Software Freedom Conservancy Inc (SFC) Makes It Obvious It's Just a Copycat Trying to Exploit or Leech Off the FSF's (and GNU's) Work
They swim next to the rich people (who "match")
Links 17/01/2025: Fentanylware (TikTok) Herds Its (Drug) Users Into Even More Harmful "Apps"
Links for the day
Guardian Digital, Inc (linuxsecurity.com) Uses Microsoft-Controlled Front Groups and LLM Slop in Order to Spread Microsoft-Directed Anti-Linux FUD
Microsoft garbage likely produced by Microsoft LLMs, spewing out Microsoft FUD
Likely Fake 'Article' About Linux Mint 22.1
BetaNews fired up its plagiarism machine (LLM)
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Thursday, January 16, 2025
IRC logs for Thursday, January 16, 2025