12.03.07

Gemini version available ♊︎

FUD Alert: Microsoft’s Jeff Jones Aims His Lying Pistol at Firefox (Updated)

Posted in FUD, GNU/Linux, Security, Windows at 3:09 pm by Dr. Roy Schestowitz

More lies reveal new fears

Jim Powers wrote to point out this bit from Glyn Moody:

So, Microsoft refers to a report that just happens to be written by one of its employees, but without mentioning that fact.

This isn’t exactly new (Matt Asay pointed this out a couple of days ago), but it connects nicely to our observation that Microsoft uses its internal people and various hired ‘analysts’ to deceive the public. More on that in a moment, but first, here’s Asay’s take.

It’s a convenient fiction that buying everything from one vendor makes life easier. It may make installation and integration between programs easier, but that ease leads to single points of failure. Hijacking a browser is nice, but using the browser to dig deep into the OS, to have that hijacking facilitated by a too-close tie between the browser and the OS? Even better.

For reasons that were briefly mentioned a couple of days ago, Microsoft likes to hide its patches (or simply not patch at all) in order to keep up appearance. There are some recent examples of this, e.g.:

1. Skeletons in Microsoft’s Patch Day closet

This is the first time I’ve seen Microsoft prominently admit to silently fixing vulnerabilities in its bulletins — a controversial practice that effectively reduces the number of publicly documented bug fixes (for those keeping count) and affects patch management/deployment decisions.

2. Beware of undisclosed Microsoft patches

Forget for a moment whether Microsoft is throwing off patch counts that Microsoft brass use to compare its security record with those of its competitors. What do you think of Redmond’s silent patching practice?

Then, consider the invalidity of patch count.

Sorry, but Microsoft’s self-evaluating security counting isn’t really a good accounting.

[...]

The point: Don’t count on security flaw counting. The real flaw is the counting.

Only days ago, the weaknesses of Internet Explorer security were mentioned in the following article.

When Didier Stevens recently took a closer look at some Internet Explorer malware that he had found, something surprised him somwehat. He discovered that the IE-targeted malware had been obfuscated with null-bytes (0×00) and when run against VirusTotal, he found that fewer than half of the products identified the sample as malware (15 of 32). When all null-bytes were removed, the chances of successful detection improved, though not as much as would normally be expected (25 of 32 detections).

Going further back you’ll find that IE7 has already been the victim of quite a lot of “critical” flaws (the highest level of severity, which compromises the operating system remotely, with or without user intervention). Examples include:

1. Code posted for Internet Explorer attack

“This type of vulnerability has been very popular with malicious attacks in the past, and we expect to see its usage increase substantially, now that exploit code is publicly available,” security vendor Websense. warned in a note published Monday.

2. Microsoft probes possible IE 7 phishing hole

The vulnerability relates to the message IE displays when Web page loading is aborted, Raff wrote. An attacker can rig the message by creating a malicious link. The message will offer a link to retry loading the page; hitting it brings up the attacker’s page, but showing an arbitrary Web address, he wrote.

3. Critical IE Graphics Flaw Resurfaces

It’s bad enough when crooks exploit bugs to ruin a home computer, but the consequences of a successful attack can be much worse. A substitute teacher in Norwich, Connecticut, found that out when a computer she was using in her classroom suddenly started showing pornographic pop-up ads to everyone in the class. She now faces up to 40 years in prison after being convicted of willfully showing her students the images. A security expert hired by her defense, however, says he found malicious software on the PC.

4. Monthly Microsoft Patch Hides Tricky IE 7 Download

Opinion: Microsoft used the January 2007 security update to induce users to try Internet Explorer 7.0 whether they wanted to or not. But after discovering they had been involuntarily upgraded to the new browser, they next found that application incompatibility effectively cut them off from the Internet.

5. Attack code out for ‘critical’ Windows flaw

All recent versions of Windows are vulnerable when all recent versions of IE, including IE 7, are in use, according to Microsoft.

6. IE7 ‘critical update’ causes headaches for managed desktop environments

As many organisations may not feel compelled to turn off automatic updates, they should be prepared to face this is issue when Internet Explorer 7 is downloaded and installed automatically.

7. IE 7 bugs abound

“But browser testers may already be at risk, according to security researcher Tom Ferris. Late Tuesday, Ferris released details of a potential security flaw in IE 7. An attacker could exploit the flaw by crafting a special Web page that could be used to crash the browser or gain complete control of a vulnerable system, Ferris said in an advisory on his Web site. Microsoft had no immediate comment on Ferris’ alert.”

8. Information disclosure bug blights IE7 release

The flaw stems from error in the handling of redirections for URLs with the “mhtml:” URI handler. Security notification firm Secunia reports that the same bug was discovered six months ago in IE6 but remains unresolved.

9. IE Used to Launch Instant Messaging and Questionable Clicks

First of all, you need to visit an infection site using Internet Explorer – this exploit doesn’t work in Firefox, for example.

10. IE Exploit Could Soon Be Used By 10,000-plus Sites

First reported by Florida-based Sunbelt Software Tuesday, the bug has already been used to compromise PCs and load them with scores of adware and spyware programs, as well as other malicious code. Users surfing with IE 6 and earlier can be infected simply by viewing the wrong site.

11. Russian sites using new IE bug to install spyware

This is the second unpatched flaw found in IE over the past week. On Sept. 14, researchers posted code that could be used to exploit a different vulnerability in a multimedia component of the Web browser. Microsoft is still investigating that flaw and is not saying whether it too will be patched next month.

12. Seen in the wild: Zero Day exploit being used to infect PCs

The exploit uses a bug in VML in Internet Explorer to overflow a buffer and inject shellcode. It is currently on and off again at a number of sites.

Security researchers at Microsoft have been informed.

13. Attack code targets new IE hole

Computer code that could be used to hijack Windows PCs via a yet-to-be-patched Internet Explorer flaw has been posted on the Net, experts have warned.

Then, come to consider some comparisons, e.g.:

1. Which Is Safer: Internet Explorer 7 or Firefox 2.0

In the SmartWare test, Microsoft’s Internet Explorer 7 blocked 690 known phishing sites, or 66.35 percent of the total. In contrast, Firefox blocked 78.85 percent when using a local antiphishing database and 81.54 percent when using the online database.

2. Firefox Still Tops IE for Browser Security

“Mozilla is forthcoming about vulnerabilities,” Levy said, whereas “it takes Microsoft far longer to acknowledge vulnerability.”

How much longer? “In the last reporting period, the second half of last year, Microsoft had acknowledged 13 vulnerabilities. We’ve now revised it to 31. The difference is that now Microsoft has acknowledged these vulnerabilities.”

[...]

“Mozilla can turn around on a dime,” Levy said. “Open-source programmers can recognize a problem and patch it in days or weeks.”

And as for Microsoft?

“If a vulnerability is reported to Microsoft, Microsoft doesn’t acknowledge it for at least a month or two. There’s always a certain lag between knowing about a bug and acknowledging it,” Levy said.

Other recent articles state that Firefox may have its weak points, but often they are the result of attempts to mimic IE functionality on Windows, which means that the fragile layer is the operating system, not just the Web browser. On operating systems security, consider the following articles from the past year:

The great value of GNU/Linux is something that Microsoft itself cannot deny. In fact, it wasn’t long ago that it was ‘caught’ praising it. Microsoft’s campus is full of Linux devices that the company is happy with.

What the press statement didn’t mention is that Aruba mobility controllers run the Linux operating system which Microsoft has aggressively targeted as being inferior to Windows as part of its “Get the Facts” marketing campaign.

[...]

Pandey’s appraisal of Aruba’s technology is in stark contrast to Microsoft’s “Get the Facts” rhetoric which places Windows as a more secure, and higher-performing choice over Linux.

Let’s not forget that for many years, Microsoft has run its Web sites behind the Akamai clusters that are all GNU/Linux. As evidence, consider this recent blog post that contains a screenshot.

Microsoft has also bought companies whose entire infrastructure is based on GNU/Linux and Free software. Examples include the recent acquisition of Newsvine:

The funny thing is, The site is hosted on Debian Linux…

There is also the $6 billion acquisition of aQuantive:

This month’s announcement by Microsoft to acquire digital marketing services firm aQuantive has revealed little on how the companies will integrate their IT, but inside information indicates the deal may be Redmond’s largest commitment to free software.

[...]

Whether the businesses are complementary or not, Microsoft’s integration work will no doubt involve a lot of open source software used by aQuantive.

Information available from Atlas’ Web site indicates the Internet software company employs extensive use of open source software including Linux, Apache, MySQL, and Solaris.

Software engineers at Atlas’ Raleigh office do client/server development in C and C++, software maintenance and “scripting”, and developing and maintaining custom reporting capabilities.

Remember Hotmail, which ran a BSD for several years after Microsoft had acquired it? There are many more examples, but they would make this post extremely long.

”While Microsoft controls the media, buys the media, and even buys voices on the Internet, nobody can be trusted.“As promised, returning to the original point of this post, Microsoft can deny the truth all it wants, but we ought to judge things for ourselves. While Microsoft controls the media, buys the media, and even buys voices on the Internet, nobody can be trusted. The antitrust exhibit known as “Effective Evangelism” [PDF] shows that Microsoft has for a long time intended to hire analyst whose output only appears to be independent. One need only look a month back for a live demonstration.

Going a year into the past, Redmond Kool-Aid seems likely to have played a role in another story which turned out to be an anti-Firefox lie. It did a lot of damage even after it was called a lie, by admission of the claim’s own so-called ‘hacker’. More information here.

Lately, I read the headline: “Open Source browser Firefox is so critically flawed that it is impossible to fix, according to two hackers.” Further on, in the ZDNet article I read: “The hackers claim they know of about 30 unpatched Firefox flaws. They don’t plan to disclose them, instead holding onto the bugs.”

Since that sounds suspicious, I decided to start searching for connections with MS. Easy enough, here it is…

So, as you can see, the anti-Mozilla Firefox crusade has roots in the past. It remains to be seen how the media will respond to Microsoft’s latest attempt to spread Firefox FUD.

Update: A Mozilla senior, who is also a former Microsoft employee, spills the beans on Microsoft and reveals more information about the deception mentioned above.

This is a small subset of all the vulnerabilities, because the vulnerabilities that are found through the QA process and the vulnerabilities that are found by the security folks they engage as contractors to perform penetration testing are fixed in service packs and major updates. For Microsoft this makes sense because these fixes get the benefit of a full test pass which is much more robust for a service pack or major release than it is for a security update.

Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Reddit
  • email

Decor ᶃ Gemini Space

Below is a Web proxy. We recommend getting a Gemini client/browser.

Black/white/grey bullet button This post is also available in Gemini over at this address (requires a Gemini client/browser to open).

Decor ✐ Cross-references

Black/white/grey bullet button Pages that cross-reference this one, if any exist, are listed below or will be listed below over time.

Decor ▢ Respond and Discuss

Black/white/grey bullet button If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

DecorWhat Else is New


  1. Links 28/9/2021: New Fedora Beta and LibreOffice's 11th Anniversary

    Links for the day



  2. [Meme] Joining Red Hat After Jim Whitehurst Left

    The screenshots above are minutes old; insiders don’t think too highly of long-term careers at Red Hat (the latter seems to be the same person as the former)



  3. IPFS: The Good, the Bad, and the Exceptionally Ugly

    A personal and occasionally arduous experience with a whole year of IPFS; it may come across — on the surface at least — as an unconstructive rant, but IPFS is still a promising technology, albeit it has severe limitations that need to be properly understood (some can be technically overcome, too)



  4. Links 28/9/2021: GnuCash 4.7 and SuperTuxKart 1.3 Release

    Links for the day



  5. IRC Proceedings: Monday, September 27, 2021

    IRC logs for Monday, September 27, 2021



  6. Links 28/9/2021: Inkscape 1.1.1 and 4MLinux 37.1 Release

    Links for the day



  7. “What the Heli, Battistelli?”

    "Ms Pyjamas" (Heli) and Ms Bergot, a notoriously "strong lady" (for marrying the 'right' man?)



  8. When It Comes to UPC, EPO is Still Stuck in Pre-Brexit Mindset (More Than Half a Decade in the Past)

    The sheer lunacy of Team UPC is up on display and the EPO links to a “webinar” from 5.5 years ago; they’re still living in a fantasy world



  9. Links 27/9/2021: Q4OS 4, Windows Breaks Itself

    Links for the day



  10. [Meme] Route de France

    At the EPO, facts catch up with you



  11. [Meme] Tech Companies: No Friends of Women

    Just another reminder that companies like IBM do not actually care about women; they are misusing genuine feminism for corporate objectives



  12. Links 27/9/2021: OpenSSH 8.8, Martine OS 2.0 and Airyx 0.2.2 Reviewed

    Links for the day



  13. GNU Turns 38 (Midday Today or 12:35:59 EST) and RMS Talks to Polish Medical Professionals This Evening

    Today GNU turns 38. Last week over 5,000 people watched the RMS talk in Ukraine using our WebM version of it; in a few hours RMS will speak in Poland and we’ll try to find a stream if one becomes available (we shall update this page).



  14. IRC Proceedings: Sunday, September 26, 2021

    IRC logs for Sunday, September 26, 2021



  15. Links 27/9/2021: Librem 14 Reviewed, Linux 5.15 RC3 is Out

    Links for the day



  16. Links 26/9/2021: GNU Wget2 2.0.0 and MenuLibre 2.2.3 Released

    Links for the day



  17. How Basic Laws and Fundamental Rights Got Crushed in the European Patent Office

    Our next series will show the sheer hypocrisy of the EPO, hiding behind the veil of (patent) law while so shamelessly violating just about every law in the books without facing any form of accountability



  18. Regrettable Acts of Self-Harm: OpenMandriva and Mozilla Being Outsourced to Microsoft Proprietary Software and Monopoly

    In another blow to software freedom, OpenMandriva and Mozilla decide to abandon their own systems and use proprietary software from Microsoft instead



  19. Links 26/9/2021: Mozilla Spends on PR, OpenMandriva Outsourcing to Microsoft

    Links for the day



  20. IRC Proceedings: Saturday, September 25, 2021

    IRC logs for Saturday, September 25, 2021



  21. Links 25/9/2021: GNU/Linux Recognition in Mainstream Media and Wine-Staging 6.18

    Links for the day



  22. Reminder: GNU Turns 38 This Monday Around Midday (When GNU's Founder Gives Talk in Poland)

    With media and Torvalds speaking again about anniversaries (this has gone on for the past week because Torvalds wrote about it yet again), it is important to recall the announcement that got the ball rolling and basically started it all (the GNU/Linux operating system) because it was in 1983, not 1991. We reproduce in full the announcement.



  23. Links 25/9/2021: Wine 6.18 and Chromium Complier Woes

    Links for the day



  24. [Meme] When the EPO Watches Everything ('Dissidents', Media, Etc.) and Isn't Being Watched by Anybody

    The EPO is taking Europe for a wild ride; Everything is a vehicle for the very same agenda, with nobody left to hold it accountable or ask any tough questions… (even the media is in the EPO’s back pocket or back seat)



  25. Virtual Oversight

    “eMeetings” that simulate an impression of oversight are like ‘ViCo’ to simulate access to justice; will that ever change and will oversight be restored at EPOnia, Europe’s second-largest institution?



  26. The Corporate Coup Against the Soul of the Free Software Community Is Not Over

    The erosion of community role in the development of GNU/Linux is a growing problem; part of the problem is that large corporations target technical and philosophical (perceived) leaders in coordinated smear campaigns, led by media they own



  27. IRC Proceedings: Friday, September 24, 2021

    IRC logs for Friday, September 24, 2021



  28. Links 24/9/2021: GNU Coreutils 9.0, BattlEye GNU/Linux Support

    Links for the day



  29. [Meme] 'Linux' Foundation is Greenwashing Microsoft Again, Misusing the Linux Brand Like Nobody's Business

    Microsoft has weaponised the Linux brand to dub a toxic company like itself (helping notoriously polluting companies and generating lots of waste, both directly and through planned obsolescence, inefficient software, DRM, etc.) as "green"



  30. Richard Stallman to Speak (in Person) in Poland, Dedicate the Talk to Medical Professionals

    Days after his talk in Ukraine Richard Stallman plans to do the same in Poland (just announced)


RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts