Bonum Certa Men Certa

Microsoft Finally Admits Numbers of Vulnerabilities It Reports Are Fake

Microsoft lies



Summary: Mike Reavey, the director of the Microsoft Security Response Center, admits that Microsoft is silently patching vulnerabilities without ever reporting the problem

IT'S official. Microsoft is a liar. Again. Now there is even admission from Microsoft, confirming an issue which we first raised some weeks ago. Whenever Microsoft says it patches x number of flaws with y number of patches/bulletins, Microsoft ought to be assumed to be lying. Microsoft's silent patching is a subject we have been covering for years and it helps explain why one in two Windows PCs is believed to be a zombie PC, despite Microsoft's claims that all of its flaws are being addressed. All those fake comparisons against platforms like Red Hat Enterprise Linux (where Microsoft stacks up and aggregates numbers of flaws) can be thrown into the wastebasket. If convincing proof is needed, here it is. Microsoft first tried to spin it (for weeks) and now it gives up and tells the truth.



Microsoft Official Admits to Quiet Security Patching



Microsoft doesn't report all security vulnerabilities that it fixes in its software. Bug comparisons between vendors therefore paint an incorrect picture.

"We don't document every issue found," Mike Reavey, director of the Microsoft Security Response Center (MSRC), said at a meeting with reporters at the company's corporate headquarters in Redmond, Washington.

Microsoft will issue a Common Vulnerabilities and Exposures (CVE) number to a vulnerability for flaws that share the same severity, have an attack vector and a workaround. If several flaws share all the same properties, they will not be reported separately, Reavey said.

The nondisclosure of fixes was brought to light early this month by a company called Core Security Technologies. After studying the Microsoft patches MS10-024 and MS10-028, it noticed three silent fixes. Security bulletin MS10-028 addressed a flaw that would expose a user of Microsoft Visio to a buffer overflow attack, which would allow an attacker to take over control of the system.


Finally. Thanks for the honesty. So how much damage has been caused by Microsoft's lies so far. Microsoft has been denying this for years, but not exactly denying, either. It was spinning and avoiding the actual question. It's the art of lying without practically lying, just evading. Adobe is at least honest about its proprietary software being insecure garbage. As far as we are aware, Adobe hasn't a long history of systematic lying, unlike Microsoft.

"Microsoft smacks patch-blocking rootkit second time," says another new report from Gregg Keizer.

For the second month in a row, Microsoft has tried to eradicate a mutating rootkit that has blocked some Windows users from installing security updates.


Here is another one (also here):

Jerry Bryant, a group manager with the Microsoft Security Response Center (MSRC), said his team is looking into Raskin's claims, but hinted that Microsoft wouldn't be patching IE anytime soon. "I wouldn't classify this as a 'vulnerability' though," Bryant said in an e-mail answer to questions.


The followup says:

Will browser makers patch this? Unlikely. Microsoft's Jerry Bryant, a general manager at the company's security response center, said the issue isn't a security vulnerability per se, and that Internet Explorer (IE) falls for the scam because that's the way browsers work.

"Working with [Raskin's] proof-of-concept, as written, is expected," he said in an e-mail Tuesday when asked whether Microsoft had a fix in mind for IE.


Let's remember how much damage was caused this year because Microsoft had refused to patch known Internet Explorer flaws for five months [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12]. Where is the liability [1, 2, 3, 4, 5]? Watch what it happening in Denver right now.

Denver officials have asked the FBI, Denver police and Microsoft Corp. to help them identify the person or people who have hacked into the city's website twice in the past week.


If Microsoft gets involved, then it almost must be a Windows server.

Comments

Recent Techrights' Posts

Why We Still Love Gemini Protocol
Gemini Protocol may seem like something "old" (it's actually very new) and something "nobody would use", but many people use it
This is the Man Who's Attacking Linus Torvalds et al in "a Disease" (Social Control Media)
One thing that Richard M. Stallman and Torvalds can agree on is that Social Control Media should be avoided
Unlike GAFAM, Free Software Serves You, It Does Not Serve Governments and MElons (Overlapping Forces)
Tired of oligarchy controlling your life through gadgets and "apps"?
When It Comes to Social Control Media, Linus Torvalds is Channeling Techrights
GAFAM workers know exactly who to aim at
New EPO Paper: Promoting (Rewarding) People Who Grant Many Illegal European Patents to Make More Money (at Europeans' Expense) While Patent Courts in the EU Are Themselves Illegal
now the coup is sort of complete and even the "courts" are part of the corruption
Slopwatch: Carnival of LLM Slop and FUD Spewed by Bots, Pasted in by MaKenna Hensley and Day
Welcome to the Web in 2025. Articles about "Linux", "Security", and the Web (e.g. "Firefox") are fake.
 
Richard Stallman (RMS) Does Not Have Media Companies and Lobbyists on His Side, But His Message Spreads Regardless
The message of RMS is spreading in spite of all the smears
GNU/Linux Rises to All-Time High in Chile
sharp rise for GNU/Linux in Chile
Links 09/02/2025: Hottest January on Record, Panama Blackmailed
Links for the day
Gemini Links 09/02/2025: "Died as a Mineral" and Game Interface for a Non-Game
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Saturday, February 08, 2025
IRC logs for Saturday, February 08, 2025
Links 08/02/2025: UK Back Doors and Religious Fundamentalists in Positions of Higher Power
Links for the day
Today's IBM (Red Hat) Isn't the Company That Fought a Microsoft-Sponsored SCO in Court
IBM is nowadays in a state of rapid disintegration
When You Simply Rebrand Almost Everything as "Hey Hi" ("AI"), "Hey Hi Workloads", "Hey Hi Datacentres" and Whatnot
The "growth" has been a growing lie for years if not decades
Microsoft Windows Falls to 12% in Myanmar
Remember that Microsoft is virtually 0% in mobile
Gemini Links 08/02/2025: "Thought Leaders" and Returns to Gemini Protocol
Links for the day
Links 08/02/2025: MElon Coup, Mass Layoffs at Facebook, and PlayStation Network Down
Links for the day
On Wars Against Founders
We need to insist that founders remain
Links 08/02/2025: News Corp Admits Traffic Declines, Wildlife Trafficking Tackled
Links for the day
Gemini Links 08/02/2025: Lamp and Notions
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Friday, February 07, 2025
IRC logs for Friday, February 07, 2025
Links 07/02/2025: Amazon’s Stock Collapses and US Government Being Dismantled (Still)
Links for the day
Gemini Links 07/02/2025: Mid-level Details and Simple Code
Links for the day
Links 07/02/2025: US 'Demolition Crew', e-ID Loopholes, and Sanctions
Links for the day
Professor Eben Moglen on How Social Control Media Metabolises Humans and Constrains Freedom of Thought
Nothing of value would be lost if all these data-harvesting giants (profiling people) vanished overnight
Social Control Media is Narcissism
Nowadays there's a lot more literature and even press coverage explaining the harms of Social Control Media
Debian Left Twitter (MElon "X"), We Think the Free Software Foundation (FSF) Should Do the Same
What would the FSF really lose if it stopped posting there?
statCounter Sees GNU/Linux Share Doubling in China Over the Past Year
It'll be interesting to see what data in the coming months shows
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Thursday, February 06, 2025
IRC logs for Thursday, February 06, 2025
Richard Stallman (RMS) Confirms Next Week's Talk in Europe
He gave at least 2 talks in Europe last month
Nationalism As A Service (NaaS) by Microsoft Azure, Gutting the US Government for Profit
Will Microsoft be receiving bailouts as a reward for all this?
Rumours of IBM Layoffs Apparently Confirmed Yesterday, IBM Canada Consulting Impacted (as Rumoured)
when IBM has layoffs we must also read it as Red Hat layoffs