Bonum Certa Men Certa

“Tens of Thousands of [Microsoft IIS] Sites” Are Being Compromised

Weird poem



Summary: Another live example of Microsoft 'security' at work; debunking the latest Linux lies from Ed Bott

"SECURITY through obscurity" sounds like a good idea in theory. As we recently found out (and had confirmed by Microsoft), part of this obscurity is lack of disclosure. Microsoft is silently patching flaws that it never discloses, which is dishonest if not fraudulent when Microsoft issues security reports based on such oversight.



According to this new article, "tens of thousands of sites" running Microsoft's software are paying the price for having 'secret' vulnerabilities:

There's a large-scale attack underway that is targeting Web servers running Microsoft's IIS software, injecting the sites with a specific malicious script. The attack has compromised tens of thousands of sites already, experts say, and there's no clear indication of who's behind the campaign right now.

The attack, which researchers first noticed earlier this week, already has affected a few high-profile sites, including those belonging to The Wall Street Journal and The Jerusalem Post. Some analyses of the IIS attack suggest that it is directed at a third-party ad management script found on these sites.


This must be the latest example of why nobody gets fired for avoiding Microsoft.

Speaking of Windows security, "Juniper Networks Protects Customers From New Microsoft Vulnerabilities" after Juniper became filled with Microsoft managers [1, 2, 3]. It's just something to bear in mind.

There is some bad FUD about Linux security at the moment (coming primarily from Ed Bott). SJVN has already responded to this FUD:

Here's what really happened. UnrealIRCd, a rather obscure open-source IRC (Internet Relay Chat) server, wasn't so much hacked as the program it was letting people download has been replaced by one with a built-in security hole. Or, as they explained on their site,


Microsoft boosters like Bott have been desperate to show that GNU/Linux is not more secure than Windows. As companies like Google dump Windows for security reasons, Microsoft will carry on with this FUD campaign but rely on peripherals/extensions (like Bott) to do the attacks]. That's just how Microsoft operates when it needs FUD. See the "smoking gun" below.

"As discussed in our PR meeting this morning. David & I have spoken with Maureen O'Gara (based on go ahead from BrianV) and planted the story. She has agreed to not attribute the story to us....

"[...] Inform Maureen O' Gara (Senior Editor Client Server News/LinuxGram) or John Markoff (NYT) of announcement on Aug 28, 2000. Owner dougmil (Approval received from BrianV to proceed)

"Contact Eric Raymond, Tim O'Reilly or Bruce Perrins to solicit support for this going against the objectives of the Open Source movement. Owner: dougmil [Doug Miller]. Note that I will not be doing this. Maureen O'Gara said she was going to call them so it looks better coming from her."

Microsoft uses reporters as attackers

Recent Techrights' Posts

Google, FSFE & Child labor
Reprinted with permission from the Free Software Fellowship
[Video] Trainline Finally Issues a Refund, But It Took 9 Days and Showed How 'Modern' Systems Fail Travelers
They treat people like a bunch of animals or cattle, not like valuable customers
 
Links 13/04/2024: Whistleblowers, OpenAI and Microsoft Leakers
Links for the day
'Our' Technology Inside the Home is Becoming Less Reliable and It Implements the Vision of Orwell's '1984' (Microphones and Cameras Inside Almost Every Room)
Technology controlled by who exactly?
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Friday, April 12, 2024
IRC logs for Friday, April 12, 2024
Links 13/04/2024: Huawei and Loongson PCs, IBM Layoffs
Links for the day
Gemini Links 13/04/2024: Specification Changes and Metaverse Newbie
Links for the day
Links 12/04/2024: Big Brother in the Workplace and Profectus Browser Alpha 0.3
Links for the day
WIPO UDRP D2024-0770 Debian vendetta response
Reprinted with permission from Daniel Pocock
Links 12/04/2024: Reporters Without Borders Rep Kicked Out of Hong Kong
Links for the day
Gemini Links 12/04/2024: Funny Thing, Manual Scripts, and More
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Thursday, April 11, 2024
IRC logs for Thursday, April 11, 2024
DebConf22 Kosovo segregation of women exposed
Reprinted with permission from disguised.work
Links 11/04/2024: Web Diversity and More Crackdowns in Russia
Links for the day
Gemini Links 11/04/2024: Activity and Motivation in Geminispace, gwit Implementations
Links for the day
First They Came for Iranian Developers...
Red Hat/IBM and 'cancel culture'
[Video] A Debian Project Leader Needs to Also be a Technical Project Leader
We do not vouch for one (or none) horse in this race
Aggressive Efforts (and Threats) for Those Who Speak About What Happened in the Balkans
Acting in this way in an effort to censor people typically results in a second scandal on top of the original scandal
How Kosovo won DebConf21
Reprinted with permission from Daniel Pocock
[Video] How the Media Blamed SSH and Linux (for Nearly a Whole Fortnight!) Instead of Microsoft's GitHub and Systemd
Microsoft-connected sites have said a whole bunch of lies
Anzacathon: a hackathon for Anzac day at home
Reprinted with permission from Daniel Pocock
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Wednesday, April 10, 2024
IRC logs for Wednesday, April 10, 2024
On Julian Assange, Now 5 Years in Belmarsh Prison: The Good News, the Bad News, and Ugly Noise
Some time this spring (or summer) we'll revisit the Appelbaum case