"Our products just aren't engineered for security."

--Brian Valentine, Microsoft executive

Summary: More timely reminders that Windows is simply not designed to be secure, irrespective of version, status of patching, etc.

GIVEN the exceptionally strong ties between Microsoft and the NSA we shouldn't be so shocked that Microsoft constantly lets the NSA know how to break into computers with Windows installed on them. That's a fact.

Samsung, perhaps realising that 'updating' Windows (or even 'upgrading' it) won't make it more secure decided to altogether abandon Windows Update. As IDG put it:

This week, it’s Samsung, which has been outed as intentionally disabling Windows Update. According to independent researcher Patrick Barker, he was trying to help a customer figure out why a PC kept randomly disabling Windows Update, which caused the system to be dangerously and continuously vulnerable to open security flaws.

Remember that Windows Update can also be used (or misused) to install new back doors at any time. Richard Stallman has repeatedly warned about the danger of any such mechanism. It's basically a remote control for one's PC, where the controller is not the user but the software vendor and potentially crackers (like NSA and the GCHQ, as well as non-government entities). When the article above says "vulnerable to open security flaws" it probably means security flaws that are provably known to cyber criminals not affiliated with governments.

"Remember that Windows Update can also be used (or misused) to install new back doors at any time."According to Microsoft Peter (Peter Bright), writing about how much of a farce Windows 'security' really is might be something that a research student cannot do. To quote the booster:

Willcox's research investigates ways in which Microsoft's EMET software can be bypassed. EMET is a security tool that includes a variety of mitigation techniques designed to make exploiting common memory corruption flaws harder. In the continuing game of software exploit cat and mouse, EMET raises the bar, making software bugs harder to take advantage of, but does not outright eliminate the problems. Willcox's paper explored the limitations of the EMET mitigations and looked at ways that malware could bypass them to enable successful exploitation. He also applied these bypass techniques to a number of real exploits.

The laws here have become so ridiculous that merely pointing out that some piece of software is 'Swiss cheese' and 'easy pickings' would potentially constitute a violation of the law. Microsoft Peter, writing another article about the failing Xbox business (billions in losses), shows how Microsoft secretly tried to deal with manufacturing flaws that may have led to loss of lives (there is a famous case involving a baby who died after an Xbox-induced house fire).

It often seems like Microsoft can get away with just about anything (surveillance by the back door, house fires etc.) as long as it colludes with the state against citizens. Anyone who still believe that Windows can be made secure (intrusions-resistant) clearly is deluded, or at least misinformed. ⬆