12.25.08

Gemini version available ♊︎

The (Microsoft) Nightmare Before Christmas

Posted in Microsoft, Security, Servers, Windows at 11:28 am by Dr. Roy Schestowitz

No, not the film

THIS TYPE OF THING happens almost every year. It’s another familiar ‘emergency Christmas’ that may lead to higher blood pressure.

Data in Microsoft Databases Under Threat

Just before the holiday, Microsoft decided to give people fewer reasons to rest well, having recently patched half a dozen critical flaws.

Desktop users running the Microsoft SQL Server 2000 Desktop Engine or SQL Server 2005 Express could be at risk in some circumstances, Microsoft said.

They have been negligent enough not to fix this in 8 months. Microsoft keeps known flaws to itself until it's too late and damage is being done.

Microsoft Corp. today confirmed that it has been working on a critical vulnerability in SQL Server for more than eight months, but declined to say whether it has had a patch ready since September, as an Austrian security researcher has alleged.

Another emergency patch (almost the third in a month [1, 2, 3]) is likely on its way. Microsoft Fanalysts [sic] are explaining the severity of this as well.

News Analysis. Microsoft has warned of a zero-day vulnerability affecting SQL Server. Do take Microsoft’s security advisory seriously.

Remember SQL Server slammer, which struck nearly six years ago? IT administrators were lucky the worm spread a month after Christmas. The new SQL Server vulnerability could bring coal to your Christmas stocking, if left untended.

Scareware and Fakes

There are other new attacks that piggyback on Microsoft.com.

Miscreants are exploiting weaknesses in more than one million webpages operated by the federal government, media companies, and even Microsoft to trick unwitting visitors into installing harmful software that takes over their computers.

More here:

Fake Antivirus Peddlers Helped by Microsoft, IRS

Just weeks after the U.S. Federal Trade Commission shut down two companies accused of selling fake antivirus software, a new player has moved into the market, aided by glitches in the Microsoft and U.S. Internal Revenue Service Web sites.

As always, there are fake greeting cards too, whose harm is only Windows compatible (where “clicking” translates to “executing”, frequently with full system privileges).

A new worm has emerged that could be much worse than the notorious Storm worm, which ruled the botnet world for nearly two years.

Zombies on the Cloud

We wrote extensively about the threat of zombie PCs. Botnets seem to have recruited almost one in two Windows PCs although most nodes in this network remain unused, so the seriousness remains mostly uncovered — for now. 98% of the Windows PCs out there are potentially ripe for hijacking, according to Secunia, so it’s down to the mercy — or wrath — of botmasters.

This has serious ramifications when it comes to security and the United States too can be crushed by botnets, according to this new simulated attack.

US cybersecurity defences fail to thwart mock cyberattack

The basic scenario involved exercises in electronic disruption accompanying a national emergency, a sequence of events played out in Estonia last year and more recently in Georgia. Defenders drew on established defence procedures but these turned out to be inadequate, for reasons not explained in any detail by participants.

Speaking of security, problems may also be introduced by Microsoft’s so-called ‘cloud’ (Azure), which we remarked on in [1, 2, 3, 4].

Amitabh: Microsoft provides a computing infrastructure on which developers can build applications. It is the responsibility of the developer to ensure that their applications, content and services comply with applicable laws and do not engage in malicious conduct. For more information refer to http://www.microsoft.com/azure/termswindowsazure.mspx

Looking at that URL:

# Indemnification.

[...]

You agree to indemnify, pay the defense costs of, and hold Microsoft and its successors, officers, directors and employees harmless from and against any and all claims, demands, costs, liabilities, judgments, losses, expenses and damages (including attorneys’ fees)

[...]

# Modifying the Terms.

[...]

Microsoft may at its sole discretion modify this agreement at any time. You can access the most current version of the agreement via the link

That’s not so reassuring. For similar reasons, we constantly warn about Microsoft's so-called "open source" licences. Microsoft totally controls the way they evolve.

International database

Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Reddit
  • email

Decor ᶃ Gemini Space

Below is a Web proxy. We recommend getting a Gemini client/browser.

Black/white/grey bullet button This post is also available in Gemini over at this address (requires a Gemini client/browser to open).

Decor ✐ Cross-references

Black/white/grey bullet button Pages that cross-reference this one, if any exist, are listed below or will be listed below over time.

Decor ▢ Respond and Discuss

Black/white/grey bullet button If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

7 Comments

  1. Bryant said,

    December 25, 2008 at 11:39 am

    Gravatar

    “You agree to indemnify, pay the defense costs of, and hold Microsoft and its successors, officers, directors and employees harmless from and against any and all claims, demands, costs, liabilities, judgments, losses, expenses and damages (including attorneys’ fees)”

    That passage is standard issue in all Terms of Service. The whole point is that if you’re doing something that gets Microsoft sued, Microsoft should have the right to sue you for the legal woes you imposed on them.

    Amazon Web Services has a similar clause:
    http://aws.amazon.com/agreement/#12

  2. Roy Schestowitz said,

    December 25, 2008 at 11:43 am

    Gravatar

    Thank you. I did not know this and it’s valuable to bear in mind.

  3. amd-linux said,

    December 25, 2008 at 12:24 pm

    Gravatar

    Hey Roy,

    guess you are aware that MS is sponsoring your site? :-)

    I get a large banner ad for MS Office when I view this page – and of course, I HAD to check out what MS office has to offer for a Linux user (just to find out that it still is not much, compared to OO.org and the price tag…) and clicked on it….

    Merry Christmas to verybody, and thanks to MS for sponsoring :-)

  4. Roy Schestowitz said,

    December 25, 2008 at 12:36 pm

    Gravatar

    We’re blocking Microsoft and Novell domains, but this doesn’t prevent their channel partners from penetrating through Google. What was the site’s domain? Let us know so that Shane can add it to the blocklist.

  5. Shane Coyle said,

    December 25, 2008 at 12:38 pm

    Gravatar

    Yup, we’re fully aware – we even have reports of Novell ads here from time to time.

    As evidenced by the comments here, we have a regular community of folks from all sides of the Microsoft-Novell deal – supporters, haters, and some who are indifferent or have not yet made up their mind. If Microsoft and Novell wish to try and make their case, they can feel free.

    Please, as always – do not commit click fraud, if you are genuinely interested in an ad, great. If not, (depending on your browser) you may consider an ad blocker or proxy filter setup in order to avoid the ads altogether – that’s what I do.

    Ads are a necessary evil here, we’ve discussed it before and I still can’t see a way around it, we get alot of traffic, and sometimes we melt the servers with some of the stories that get Dugg or Slashdotted.

    Just recently, technocrat.net fell by the wayside due to similar pressures and inviability, and while we are not in danger of that presently, I was close to broke not long ago and may be once again…

  6. Shane Coyle said,

    December 25, 2008 at 12:44 pm

    Gravatar

    For the record, novell.com microsoft.com and moreinterop.com should not come through. After that, it became too tedious to filter in Adsense…

  7. Roy Schestowitz said,

    December 25, 2008 at 12:49 pm

    Gravatar

    I didn’t realise that MoreInterop used to sneak in. Heh. “More Interop”… kind of like “More dead” of “F-” (as though standards are a relative thing)

DecorWhat Else is New


  1. IRC Proceedings: Tuesday, February 07, 2023

    IRC logs for Tuesday, February 07, 2023



  2. When the Pension Vanishes

    Today we commenced a multi-part mini-series about pensions and what happens when they suddenly vanish and nobody is willing to explain where all the money went



  3. Sirius 'Open Source' Pensiongate: An Introduction

    The Sirius ‘Open Source’ series continues in the form of a mini-series about pensions; it’s part of an ongoing investigation of a deep mystery that impacts people who left the company quite a long time ago and some of the lessons herein are applicable to any worker with a pension (at times of financial uncertainties)



  4. Links 07/02/2023: Endless OS 5.0 and Voice.AI GPL Violations

    Links for the day



  5. No Doubt Microsoft Unleashed Another 'Tay', Spreading Bigotry Under the Guise of Hey Hi (AI)

    Reprinted with permission from Ryan



  6. Links 07/02/2023: Fedora 39 Development Plans Outlines

    Links for the day



  7. IRC Proceedings: Monday, February 06, 2023

    IRC logs for Monday, February 06, 2023



  8. Links 06/02/2023: Escuelas Linux 8.0 and Many Political Issues

    Links for the day



  9. Links 06/02/2023: Sparky 6.6 and IPFire 2.27 – Core Update 173

    Links for the day



  10. Taking Back Control or Seizing Autonomy Over the News Cycle (Informing People, Culling the Marketing)





  11. Reality Versus Fiction: EPO Insiders Versus EPO Web Site and UPC 'Churnalists'

    The "official" sources of the European Patent Office (EPO), as well as the sedated "media" that the EPO is bribing for further bias, cannot tell the truth about this very large institution; for proper examination of Europe's largest patent office one must pursue the interpretation by longtime veterans and insiders, who are increasingly upset and abused (they're being pressured to grant patents in violation of the charter of the EPO)



  12. Links 06/02/2023: Linux 6.2 RC7 and Fatal Earthquake

    Links for the day



  13. IRC Proceedings: Sunday, February 05, 2023

    IRC logs for Sunday, February 05, 2023



  14. Links 05/02/2023: Wayland in Bookworm and xvidtune 1.0.4

    Links for the day



  15. Links 05/02/2023: Pakistan Blocks Wikipedia, Musharraf Dies

    Links for the day



  16. IRC Proceedings: Saturday, February 04, 2023

    IRC logs for Saturday, February 04, 2023



  17. Links 04/02/2023: FOSDEM Happening and Ken Thompson in SoCal Linux Expo

    Links for the day



  18. 2023 is the Year Taxpayers' Money Goes to War and Energy Subsidies, Not Tech

    Now that a lot of powerful and omnipresent ‘tech’ (spying and policing) companies are rotting away we have golden opportunities to bring about positive change and maybe even recruit technical people for good causes



  19. Getting Back to Productive Computer Systems Would Benefit Public Health and Not Just Boost Productivity

    “Smartphoneshame” (shaming an unhealthy culture of obsession with “apps”) would potentially bring about a better, more sociable society with fewer mental health crises and higher productivity levels



  20. Links 04/02/2023: This Week in KDE and Many More Tech Layoffs

    Links for the day



  21. Dotcom Boom and Bust, Round 2

    The age of technology giants/monopolies devouring everything or military-funded (i.e. taxpayers-subsidised) surveillance/censorship tentacles, in effect privatised eyes of the state, may be ending; the United States can barely sustain that anymore and raising the debt ceiling won't solve that (buying time isn't the solution)



  22. Society Would Benefit From a Smartphoneshame Movement

    In a society plagued by blackmail, surveillance and frivolous lawsuits it is important to reconsider the notion of “smart” phone ownership; these devices give potentially authoritarian companies and governments far too much power over people (in the EU they want to introduce new legislation that would, in effect, ban Free software if it enables true privacy)



  23. IRC Proceedings: Friday, February 03, 2023

    IRC logs for Friday, February 03, 2023



  24. IRC Proceedings: Thursday, February 02, 2023

    IRC logs for Thursday, February 02, 2023



  25. Links 03/02/2023: Proton 7.0-6 Released, ScummVM 2.7 Testing

    Links for the day



  26. Links 03/02/2023: OpenSSH 9.2 and OBS Studio 29.0.1

    Links for the day



  27. Links 03/02/2023: GNU C Library 2.37

    Links for the day



  28. Sirius Finished

    Yesterday I was sent a letter approving my resignation from Sirius ‘Open Source’, two months after I had already announced that I was resigning with immediate effect; they sent an identical letter to my wife (this time, unlike before, they remembered to also change the names!!)



  29. The Collapse of Sirius in a Nutshell: How to Identify the Symptoms and Decide When to Leave

    Sirius is finished, but it's important to share the lessons learned with other people; there might be other "pretenders" out there and they need to be abandoned



  30. Links 03/02/2023: WINE 8.1 and RapidDisk 9.0.0

    Links for the day


RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts