Bonum Certa Men Certa

Windows Back Doors Spin Out of Control, End up in Black Market

Everyone is a forensic expert now

Tank



Summary: Free access for everybody; Microsoft's back-door keys are now available for everyone to download and new issues about Windows security raise serious questions about liability

Credit goes to Bruce Schneier, who warned about this when it was first introduced publicly. He predicted exactly what would happen with Microsoft's back doors (also learn about CIPAV), which it foolishly believed it could keep under exclusive police control. According to this from Gizmodo:



Apparently Microsoft's COFEE software that helps law enforcement grab data from password protected or encrypted sources is leaking all over the internet. So not only can you steal the software, but break the law by using it too.


More here:

Siren.gif: Microsoft COFEE law enforcement tool leaks all over the Internet~!



[..]

It was one of the most sought after applications on the Internet until it was leaked earlier today. And now that it’s out there—and it is all over the place, easily findable by anyone able to use a search engine—we can all move on with our lives. Yes, Microsoft COFEE, the law enforcement tool that mystified so many of us (including Gizmodo~! and Ars Technica~!), is now available to download. If only there were a “bay” of some sort where, I don’t know, pirates hang out…


Law does not directly interfere with behaviour, so mere threats against COFEE downloaders will not undo the damage which is coming.

The amusing thing is that Robert Scoble mocked me for writing about this back in 2006 when it was secret. Being a Microsoft evangelist (lead AstroTurfer), it was probably his duty to deny the existence of such back doors, which are now available for access by anyone who is interested and determined enough to find the trap door binaries.

The police is said to be carrying the software on USB drives, so how inevitable was such a leak really? It's a stupid idea to begin with, just like AutoRun, which was removed by Microsoft for doing more harm than good (infection upon insertion). That was Microsoft's admission of failure with its security approach and the Washington Post has a whole new article about it:

What Windows Autorun Has Wrought



[...]

A new report by Microsoft shows that the two most prevalent threats to Windows PCs in the first half of 2009 were malicious programs that have been aided mightily in their spread by a decision by Microsoft to allow the contents of removable media -- such as USB thumb drives -- to load automatically when inserted into Windows machines.

In its latest "Security Intelligence Report," Microsoft counted the number of threats detected by its anti-malware desktop products, and found that the Conficker worm, along with a Trojan horse program called Taterf which steals passwords and license keys for popular computer games, were detected on 5.21 million and 4.91 million Windows computers, respectively.


NASA's operations in space were affected by this (computer viruses passing via USB drives in Windows, maybe with AutoRun doing its magic). It's even too much for the FBI. Free Software Magazine now asks: "Are Microsoft to blame for 'hidden' malware costs and will Windows 7 make any difference?"

A couple of stories have hit the headlines this year concerning the huge cost that some UK Local Governments incurred when dealing with malware attack on their Windows machines. If you missed them, Manchester City Council had a single USB infected with the infamous Conficker worm and it cost them — brace yourself — £1.5m ($2.4m) of which £1.2m (US$1.9m) was spent on IT, of which a staggering €£600,000 (US$980k) went on consultancy fees including money to Microsoft. A while later, Ealing Borough Council were hit with a cost of €£500000 (about US$ 800k) when they were also hit by a single USB stick containing conficker. Some in the industry tweeted and blogged this as being a “hidden cost of using Microsoft Windows”. In the ensuing discussion, many pointed out that the high cost was really due to the lack of a proper patching and disaster recovery policy at the council. So which is right? Is dealing with malware a hidden cost of using Windows or of a poor IT strategy?

[...]

Regardless of your software choice, a poor patching policy is a very bad idea if you value system integrity. But if you going to argue your case on TCO, Microsoft, don’t then try to dodge talk of the additional costs for maintaining, patching and clearing a Windows-based system.


To answer the main question, Vista 7 will make no difference. It is just as insecure as predecessors (one might say it is even less secure). Evidence includes:

  1. Cybercrime Rises and Vista 7 is Already Open to Hijackers
  2. Vista 7: Broken Apart Before Arrival
  3. Department of Homeland Security 'Poisoned' by Microsoft; Vista 7 is Open to Hijackers Again
  4. Vista 7 Security “Cannot be Fixed. It's a Design Problem.”
  5. Why Vista 7 Could be the Least Secure Operating System Ever
  6. journalists say
  7. Vista 7 Vulnerable to Latest “Critical” Flaws
  8. Vista 7 Seemingly Affected by Several More “Critical” Flaws This Month
  9. Reason #1 to Avoid Vista 7: Insecurity
  10. Vista 7 Left Hijackable Again (Almost a Monthly Recurrence)


To address the question of liability, here we have a collection of external references. Some journalists say that Microsoft should be held accountable for these damages.

Comments

Recent Techrights' Posts

Microsoft's Bing Falls to Fourth in the Europe/Asia-Based Turkey, Share Halved Since LLM Hype, Now Only 1% (Sometimes Less)
Turkey (Eurasia) is another example of Microsoft failing with LLM hype and just burning a lot of energy in vain (investment without returns)
Backlash and Negative Press After Microsoft Tells Diversity, Equity, and Inclusion (DEI) People to DIE
Follow-up stories
Censorship as Signal of Opportunity for Reform
It remains sad and ironic that Wikileaks outsourced so much of its official communications to Twitter (now X)
The World Wide Web Has Been Rotting for Years (Quality, Accuracy, and Depth Consistently Decreasing)
In the past people said that the Web had both "good" and "bad" and that the good outweighed the bad
Comoros: Windows Plunges to Record Low of About 6% in Country of a Million People (in 2010 Windows Was 100%)
Many of these people earn a few dollars a day; they don't care for Microsoft's "Hey Hi PC" hype
The Mail (MX) Server Survey for July 2024 Shows Microsoft Collapsing to Only 689 Servers or 0.17% of the Whole (It Used to be About 25%)
Microsoft became so insignificant and the most astounding thing is how the media deliberate ignores it or refuses to cover it
Windows Down From 98.5% to 22.9% in Hungary
Android is up because more people buy smaller mobile devices than laptops
Microsoft Windows in Algeria: From 100% to Less Than 15%
Notice that not too long ago Windows was measured at 100%. Now? Not even 15%.
 
Joel Espy Klecker & Debian on Joe Biden's health and Donald Trump's assassination
Reprinted with permission from Daniel Pocock
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Wednesday, July 17, 2024
IRC logs for Wednesday, July 17, 2024
Links 18/07/2024: Hostname Pedantry and Retro Coding
Links for the day
Fedora Week of Diversity (FWD) 2024 Attracting 0.01% of the IBM Staff "Was a Success"
They expect volunteers (unpaid slaves) to do the PR for them...
African's Largest Population (Nigeria) Approaching 80% Android "Market Share" Amid Steady Monthly Increases While Microsoft Has Mass Layoffs in Nigeria
Microsoft- and Apple-sponsored Western (or English-speaking) media chooses to ignore that or treat it as irrelevant (a racist disposition in its own right)
[Meme] The Warlord's Catspaw
Thugs that troll us
Microsoft Misogyny Will be the Fall of Microsoft (Covering Up for Misogynists is a Huge Mistake and Highly Misguided Short-term Strategy)
Microsoft's undoing may in fact be its attitude towards women
Red Hat Keeps Behaving Like a Microsoft Reseller (for Proprietary Stuff!), Microsoft Employees as Authors in redhat.com
In some ways this reminds us of Novell
UEFI 'Secure Boot' Once Again Bricking PCs and Fake Security Models Are Perishing in Geminispace
Let's Encrypt has just fallen again
Links 17/07/2024: New Attacks on the Press, European Patents Squashed Even at Kangaroo Court (UPC)
Links for the day
Gemini Links 17/07/2024: Proponents of Censorship and New Arrivals at Gemini
Links for the day
Links 17/07/2024: School Budget Meltdown and Modern Cars as Tracking Nightmares
Links for the day
This Should Certainly be Illegal, But the Person Who Helped Microsoft Do This is Still Attacking the Critics of It
perhaps time for an "I told you so post"
[Meme] A Computer With an Extra Key on the Keyboard Isn't Everyone's Priority
(so your telling me meme)
Africa as an Important Reminder That Eradicating Microsoft Doesn't Go Far Enough
Ideally, if our top goal is bigger than "get rid of Microsoft", we need to teach people to choose and use devices that obey them, not GAFAM
Billions of Computers Run Linux and Many Use Debian (or a Derivative of It)
many devices never get updated or even communicate with the Net, so exhaustive tallies are infeasible
[Meme] Microsoft is Firing
Don't worry, Microsoft will have some new vapourware coming soon
More DEI (or Similar) Layoffs on the Way, According to Microsoft Team Leader
What happened shortly before Independence Day wasn't the end of it, apparently
[Meme] Many Volunteers Now Realise the "Open" in "OpenSUSE" or "openSUSE" Was Labour-Mining
Back to coding, packaging and testing, slaves
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Tuesday, July 16, 2024
IRC logs for Tuesday, July 16, 2024
Microsoft Windows "Market Share" in New Zealand Plunges to 25%
Android rising
[Meme] Ein Factory
A choice between "masters" (or "master race") is a false choice that results in mass exploitation and ultimately eradication (when there's little left to exploit)
Links 17/07/2024: Open Source Initiative Lies and Dark Net Thoughts
Links for the day
SUSE Goes Aryan: You May Not Use the Germanic Brand Anymore (It's Monopolised by the Corporation)
Worse than grammar Nazis
Media Distorting Truth to Promote Ignorance
online media is rapidly collapsing
Gratis But Not Free as in Freedom: How Let's Encrypt is Dying in Geminispace
Let's Encrypt is somewhat of a dying breed where the misguided CA model is shunned
Android Rises to New Highs of Almost 80% in Cameroon
How many dozens of nations will see Windows at under 10% this coming winter?
Links 16/07/2024: TikTok Ban in Europe and Yandex Split
Links for the day
Gemini Links 16/07/2024: On Packrafting and on Trump Shot
Links for the day
[Meme] Firefox Users Who Think They Know Better Than Mozilla
Enjoy Firebook
Firefox Used to Have About Half the Market in Switzerland, But It Doesn't Stand a Chance Anymore (Chrome Surging This Summer)
Mozilla has managed to alienate some of the biggest fans of Firefox
Microsoft's Biggest Losses Are in Europe This Summer
Microsoft's ability to milk a relatively rich Europe is fast diminishing
How to Make Software Suck and Discriminate Against People at the Same Time
ageism glorified
Bing Was at 2.6% in Russia When LLM Hype Started. Now It's Down to 0.8% (for 3 Months in a Row Already)
The sharp fall of Bing may mean that exiting the Russian market won't matter to anybody
[Meme] Microsoft Seems to be Failing to Comply With WARN Act (by Refusing to Announce Mass Layoffs as They Happen)
since when does Microsoft obey the law anyway?
Microsoft Layoffs Are Still Too Frequent to Keep Abreast of and Properly (or Exhaustively) Classify
The "HR" department knows what's happening, but whistleblowers from there are rare
Bahamas Joined the "5% Windows" Club
statCounter only traces back about 1 in 20 Web requests to Windows
Links 16/07/2024: Salesforce Layoffs and Microsoft's DMARC Fail
Links for the day
Antenna Abuse and Gemini Abuse (Self-hosting Perils)
Perhaps all this junk is a sign of Gemini growing up
Possibly Worse Than Bribes: US Politicians and Lawmakers Who Are Microsoft Shareholders
They will keep bailing out Microsoft to bail themselves out
The Software Freedom Conservancy Folks Don't Even Believe in Free Speech and They Act As Imposters (Also in the Trademark Arena/Sense)
Software Freedom Conservancy was already establishing a reputation for itself as a G(I)AFAM censor/gatekeeper
Djibouti Enters the Windows "10% Club" (Windows Was 99% in 2010)
In Africa in general Microsoft lost control
GNU/Linux Share Doubled in the United States of America (USA) in the Past 12 Months
Or so says statCounter
Even in North Korea (Democratic People's Republic Of Korea) Google Said to Dominate, Microsoft Around 1%
Google at 93.26%
[Meme] The Red Bait (Embrace... Extinguish)
They set centos on fire, then offer a (de facto) proprietary substitute for a fee
Shooting the Messenger to Spite the Message
segment of a Noam Chomsky talk
[Video] Boston Area Assange Defense (Yesterday)
It was published only hours ago
Guinea: Windows Down From 99.3% to 2.7% 'Market Share'
Guinea is not a small country
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Monday, July 15, 2024
IRC logs for Monday, July 15, 2024
What's Meant by "Antenna Abuse" (Gemini)
syndication is not a monopoly in Gemini and if one doesn't condone political censorship, then one can create one's own syndication service/capsule
Microsoft Layoffs and Entire Unit Termination: Diversity, Equity, and Inclusion
What an announcement to make just before Independence Day
Links 16/07/2024: Old Computer Challenge and One Page Dungeon Contest
Links for the day