Bonum Certa Men Certa

Bad September for Microsoft Security, Symantec Buyout Rumours

buying a book



Summary: As loads of security problems occupy the world of Windows, Microsoft resorts to seeking help from security firms it competes with and more botnets thrive nonetheless

Microsoft is having a tough month dealing with many security problems caused by its own weaknesses. This post is a quick accumulation of some issues from the past 2 weeks.



Viruses



Earlier in the month we wrote about the 'Here You Have' virus, which got a lot of news coverage [1, 2, 3]. It was politically motivated:

THE HACKER claiming credit for the 'Here you have' Trojan, written as a blow against the invasion and occupation of Iraq, might be located in Spain.


Cisco says that this virus caused brief havoc. It affects everyone to a certain extent.

Stuxnet



Stuxnet is real bummer which we covered in [1, 2, 3, 4, 5, 6, 7, 8, 9]. "Holes used by the Stuxnet worm remain in Windows XP," said this recent report (there are more) and it is exploiting zero-day flaws. Microsoft liaises with Kaspersky in hopes of tackling this problem. Eventually some patches arrived [1, 2, 3, 4] but only after a lot of damage had been done. It turns out that Symantec -- not just Kaspersky -- helped Microsoft here:

Microsoft has credited security partners at Kaspersky Lab and Symantec for helping to close a critical Windows vulnerability that was being exploited by a sophisticated worm that has attacked industrial plant


Symantec



Earlier this month Symantec created a tie-up with Microsoft's Fog Computing [1, 2]. Then came speculations that Microsoft was looking to buy Symantec. It was just a rumour (likely false), but investors took it seriously and Symantec surged [1, 2, 3, 4, 5]. The stock being driven up like this may always lead to suspicion that someone spread the rumour just to make money in a short-term period. That's illegal of course and the SEC should keep an eye open.

Speaking of acquisitions by Microsoft, "PopCap Rejected $5 Million Microsoft Buyout" says this one report among many more [1, 2, 3]. This one says that "Microsoft tried to convince PopCap it was only worth $5 million, but the studio didn't believe it." To quote another item, 'During an interview with Develop, Jason Kapalka, creative director at PopCap, explained how even Microsoft tried to buy them, but the offer price was a joke: "We had a couple of funny instances in the early years of PopCap where we were talking to Microsoft about a possible acquisition – I think it was in 2002 – and they sat us down and gave us this long speech about why our company was worth 5 million dollars, at a time when we had four million in the bank."'

Fakes



Back to insecurity, an older rogue antivirus attack gave trouble to Windows users this month [1, 2, 3, 4, 5]. It's a form of malware. In an operating system where antivirus software is not necessary, this would hardly be an issue.

ASP.NET



Microsoft is acknowledging that there is a security problem with ASP.NET, as mentioned here last week.

Microsoft has released a security advisory about a vulnerability affecting Web applications built on ASP.NET.


Here is another article about it.

It's already being exploited, based on today's reports:

Attackers have begun exploiting a recently disclosed vulnerability in Microsoft web-development applications that opens password files and other sensitive data to interception and tampering.

The vulnerability in the way ASP.Net apps encrypt data was disclosed last week at the Ekoparty Conference in Argentina. Microsoft on Friday issued a temporary fix for the so-called “cryptographic padding attack,” which allows attackers to decrypt protected files by sending vulnerable systems large numbers of corrupted requests.

Now, Microsoft security pros say they are seeing “limited attacks” in the wild and warned that they can be used to read and tamper with a system's most sensitive configuration files.


Malware



There are many new stories about malware, such as:

i. Report: More Than 1 Million Web Sites Serving Malware in Q2 [via]

Web anti malware firm Dasient has published data claiming that more than 1 million Web sites were compromised in the second quarter, 2010 - a sharp increase.

More than one million Web domains were infected with malicious code in the second quarter of 2010 - around one percent of all active Web domains, according to data released by Web security firm Dasient, Inc.


ii. Pirate Bay beset by tainted ads

The tainted ads exposed visiting surfers to Windows Trojans via drive-by download attacks. Pirate Bay has experienced similar problems in the past, and it's unclear how long it will take to clear up the latest issues.


iii. Study: 33% of SMBs Have Been Infected With Malware From Social Networks

About one-third of small and medium-sized businesses have been infected with malware from social networks like Facebook and Twitter, according to a recent study released by Panda Security, a company specializing in cloud security.


iv. Windows malware dwarfs other viral threats

The vast majority of malware - more than 99 per cent - targets Windows PCs, according to a new survey by German anti-virus firm G-Data.

G-Data reckons 99.4 per cent of all new malware of the first half of 2010 targeted Microsoft’s operating system. Just 0.6 per cent of the 1,017,208 new malware programs discovered in 1H2010 targeted other systems, such as Apple Mac boxes and servers running Unix.


Botnet



When one in two Windows computers is said to be a zombie PC, there is clearly a problem, especially when it goes on for years, still unresolved. Some of the latest Windows botnets stories are:

i. A botnet for hire springs up

Insecurity outfit Damballa revealed that the creatively named IMDDOS (I'm DDoS) botnet can be hired out as "pressure test software" by those who are willing to cough up some cash and download an application. The application is little more than dialogue box allowing the user to point the botnet to a particular IP address and port number and start hitting it with spurious requests.


ii. Microsoft Helps Cox Identify Infected Computers

iii. Microsoft gets legal might to target spamming botnets

iv. Microsoft gets superweapon for fighting botnets

Internet Explorer 8



The very latest version of Internet Explorer is still not so widely adopted because of Microsoft's hostility towards the Web which it still cannot reverse. Here is the latest vulnerability in Internet Explorer 8 [1, 2].

Late last week, a security flaw in Internet Explorer 8 was publicly disclosed to the Full Disclosure mailing list. The flaw allows attackers to steal private information from online services such as web mail and Twitter, allowing attackers to, for example, delete e-mails or send tweets from their victims' accounts.


Exchange



"Microsoft Exchange opens the door for hackers," says The Inquirer.

FIRMS RUNNING Microsoft's Exchange mail server could find that users of its Outlook Web Access (OWA) software have their sessions hijacked.

A security vulnerability in Exchange Server 2003 SP2 and Exchange Server 2007 SP1 and SP2 means that attackers can take control of a user's OWA session and issue commands up to the level permitted by security controls without the user knowing. OWA is a rich 'web mail' client that is offered by Exchange Server and has the look and feel of Microsoft's standalone Outlook software.


According to this, a well-selling Linux phone (not Ballnux) suffers from its reliance on Exchange.

There are rumors that the possible technical problem with the Microsoft Exchange is causing the delay of Android 2.2 Froyo push to Motorola Droid X devices. Multiple news outlets including Droid Life has confirmed the news.


Who needs Exchange anyway? It's just a brand. Android can do better than that and also avert the security problems.

Recent Techrights' Posts

Why We Publish Information About the SLAPPs (But Not About the Legal Process), an Abuse of Process by Americans Trying to Silence Critics of Their Employer, Microsoft
It doesn't take thousands of pages to explain something simple
 
The Register MS Says "AI Web Crawlers Are Destroying Websites", So Why Does The Register MS Help 'AI' Companies? (Spoiler: Money)
People need to call out The Register MS on its hypocrisy
Slopfarms Already Peaked, They Will Die When Slop Companies Run Out of Money to Borrow
slopfarms will lack an actual "engine"
Links 02/09/2025: Attacks on Unions, Microsoft TCO, and DDoSing a Growing Problem
Links for the day
Internet Relay Chat Didn't Fall Off a Cliff
IRC will turn 40 in less than 3 years from now
The UEFI 9/11 - Part V - This is Not a Drill (Disable "SecureBoot" Now)
A "9/11" Coming
There's No Obligation to Speak to Anybody
The very fact that "bkuhn" is till spending time in social control media says a lot about his poor judgment
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Monday, September 01, 2025
IRC logs for Monday, September 01, 2025
Microsoft Trying to Force People to Resign (Amid Mass Layoffs) a Strategy That Takes Its Toll
Microsoft seems to be circling down the drain and the "final flush" will be the moment the "hey hi" (AI) bubble implodes completely
Google Simply Cannot Be Trusted
Only fools would trust GAFAM
Admission That a Third Party (or Parties) Funds the SLAPPs Against Techrights
This can end up costing them over a million dollars
Modifying and Writing One's Own Computer Programs is Not a Crime (or: Google Proves That Stallman Was Right)
We're generally gratified to see so many positive mentions of him
Why We Stopped Publishing Videos (for Now)
We'll probably get back to videos one day, but it's hard to say when or to what extent
What Animal Rights Activism Teaches Us About Sympathy and Focus
It's possible to believe that the planet is warming, that we must do something about it, and still eat eggs and butter
When You Turn Web Sites About Tech Into Political Sites
A lot of people fall into the trap of catering only for particular groups
Gemini Links 02/09/2025: ROOPHLOCH 2025 and Lagrange 1.19 Released
Links for the day
Gemini Links 01/09/2025: News Corp. WSJ and A Month With NixOS
Links for the day
“Sideloading” Never Killed Anybody
There are many online discussions this week about the misnomer "sideloading"
Slopwatch: Google News as FUD Vector Against Linux and Plagiarism Enhancer, Serial Slopper (SS) Uses LLMs to Googlebomb "Linux"
Slop destroys the Web not just by screwing with search engines and helping plagiarists. It's also responsible for de facto DDoS attacks...
Links 01/09/2025: "Attacks on Science" and China's "Soft Power" Grows
Links for the day
Links 01/09/2025: Fresh Backlash Against Slop and "Norway’s Electricity Crisis is About to Hit Britain"
Links for the day
Writing and Coding Isn't Always Enough
Last year we had to assume a role we didn't have before: litigants
Links 01/09/2025: Catching Up (Mostly via Deutsche Welle), "Windows TCO" Effect in UK
Links for the day
Gemini Links 01/09/2025: Linguistic Barriers and "Web 1.0 Hosting"
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Sunday, August 31, 2025
IRC logs for Sunday, August 31, 2025
Autumn Has Come
Autumn should be exciting in all sorts of ways; it'll also mark our anniversary
The UEFI 9/11 - Part IV - External Interference
They all seem to be playing a role in crushing Software Freedom and self-determination for users
Links 31/08/2025: Baggage Claim Scams, an Insurrectionist’s War on Culture, and a Sudden Robotics Hype
Links for the day
Gemini Links 31/08/2025: Reviewing Netsurf and Slightly Less Historic Ada Design
Links for the day
IBM Has Taken Control of GNOME
Don't expect a successor to be found any time soon
Links 31/08/2025: Google Gmail Data Breach and LF Puff Pieces for Pay
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Saturday, August 30, 2025
IRC logs for Saturday, August 30, 2025
This is What Google News Has Become
Moments ago