04.09.09

Gemini version available ♊︎

Insecurity Through Obscurity

Posted in GNU/Linux, Microsoft, Security, Windows at 6:34 am by Dr. Roy Schestowitz

Locked girl

Summary: Windows renders E-mail chaotic and the U.S. electrical grid gets cracked

Nothing beats a brand-new explanation from Microsoft itself about the impact of its poor security skills, which continue to this date.

More than 97% of all e-mails sent over the net are unwanted, according to a Microsoft security report.

This report from Microsoft probably neglects to mention that the vast majority of SPAM is spewed from Microsoft Windows botnets. And speaking of poor security (inherent in secret code), here is another new report, among many similar ones.

Chinese and Russian cyberspies have hacked into the U.S. electrical grid and have left behind software that could be used to interfere with the system, a report said Wednesday.

The original report comes from the Wall Street Journal (thus requiring subscription), but the message is clear. This facility runs a legacy proprietary system that experts have warned about for quite some time.

Here ends another daily lesson about security and obscurity. They have a reverse relationship. There is evidence that shows GNU/Linux to be more secure.

“Two security researchers have developed a new technique that essentially bypasses all of the memory protection safeguards in the Windows Vista operating system…”

Dennis Fisher

“It is no exaggeration to say that the national security is also implicated by the efforts of hackers to break into computing networks.”

Jim Allchin, Microsoft

Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Reddit
  • email

Decor ᶃ Gemini Space

Below is a Web proxy. We recommend getting a Gemini client/browser.

Black/white/grey bullet button This post is also available in Gemini over at this address (requires a Gemini client/browser to open).

Decor ✐ Cross-references

Black/white/grey bullet button Pages that cross-reference this one, if any exist, are listed below or will be listed below over time.

Decor ▢ Respond and Discuss

Black/white/grey bullet button If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

7 Comments

  1. Yggdrasil said,

    April 9, 2009 at 11:39 am

    Gravatar

    You stole my tag line, but what’s worse, you misused it to smear Microsoft. “Security through obscurity” is generally only applicable to the operating system. It explains why Linux doesn’t make a good target because there are so few installations from which to run malicious code. It is however entirely possible to code a program that would stay hidden on a Linux machine and send out Spam or do other nasty things without the user taking notice. NOTHING in the design of Unix or any of it’s clones can prevent this from happening. It is also possible to set a program to run at boot without administrator privileges using some methods linked below this paragraph. This of course assumes there is not an inbound/outbound firewall in use on the machine and the user in question doesn’t routinely inspect their own system to see which of 90+ processes running on a Linux system do not belong.

    http://www.geekzone.co.nz/foobar/6229

    The articles you link make a few things clear that you did not mention. Many of these bot net machines were infected by users who either opened email attachments or were using outdated software that had been patched sometimes years in advance. Even the security vulnerability in the US power grid software was made public in May of last year:

    http://www.coresecurity.com/content/wonderware

    You would expect us to believe that if Wonderware were to open source (there fore not obscure, but in awareness, not numbers) it’s own software, then the operators of these power plants would have taken the time to read through the entire source code themselves and find the vulnerability long before it ever become a problem. You simply expect too much in a world where even when others take the time to find and make patches available, the end users sit on their backside. The only alternative would be to apply forced updates, but then your run into larger problems with people paranoid about their systems doing things they did not approve of. Computers security as as much a human problem as it is a software problem, but it’s so much easier to simply blame one large “evil” corporation.

    Roy Schestowitz Reply:

    You stole my tag line, but what’s worse, you misused it to smear Microsoft.

    Not only Microsoft is mentioned here.

    “Security through obscurity” is generally only applicable to the operating system.

    I disagree. An operating system is a very large program or a combination of many.

    It explains why Linux doesn’t make a good target because there are so few installations from which to run malicious code.

    Really?

    “Forty percent of servers run Windows, 60 percent run Linux…”

    Steve Ballmer (September 2008)

    It is however entirely possible to code a program that would stay hidden on a Linux machine and send out Spam or do other nasty things without the user taking notice. NOTHING in the design of Unix or any of it’s clones can prevent this from happening. It is also possible to set a program to run at boot without administrator privileges using some methods linked below this paragraph. This of course assumes there is not an inbound/outbound firewall in use on the machine and the user in question doesn’t routinely inspect their own system to see which of 90+ processes running on a Linux system do not belong.

    http://www.geekzone.co.nz/foobar/6229

    There were rebuttals to it. With secure Linux installations there are also sandboxes and it’s hard to compromise entire machines.

    The articles you link make a few things clear that you did not mention. Many of these bot net machines were infected by users who either opened email attachments or were using outdated software that had been patched sometimes years in advance.

    What about PowerPoint users right now (still unpatchable)? Or many unpatched flaws that required no user intervention? Where are attachments dispatched from in the first place? Windows botnets maybe?

    Even the security vulnerability in the US power grid software was made public in May of last year:

    http://www.coresecurity.com/content/wonderware

    Yes, already noted in my post.

    You would expect us to believe that if Wonderware were to open source (there fore not obscure, but in awareness, not numbers) it’s own software, then the operators of these power plants would have taken the time to read through the entire source code themselves and find the vulnerability long before it ever become a problem.

    This misses the core of the argument. Non-free software procrastinates fixes due to lack of a sense of urgency. The code is not visible.

    You simply expect too much in a world where even when others take the time to find and make patches available, the end users sit on their backside. The only alternative would be to apply forced updates, but then your run into larger problems with people paranoid about their systems doing things they did not approve of. Computers security as as much a human problem as it is a software problem, but it’s so much easier to simply blame one large “evil” corporation.

    The U.S. electrical grid is not a corporation. As for Microsoft, please explain why it says “our products just aren’t engineered for security.”

    Court exhibits show that this was never designed to be secure.

    Yggdrasil Reply:

    Again, you don’t look at the full picture, on purpose. 60 percent of servers run Linux? For that sake of argument, let’s assume that number is accurate. OK, great….. but as I’ve had to explain to you before, that’s a SMALL percentage of the TOTAL NUMBER of machines in use around the world. Servers normally don’t have people sitting in front of them shopping on eBay or playing Half-Life. The security issues that face servers are different than those that face home users. Can you grasp that? Can you get a handle on the numbers? As I stated:

    “Linux doesn’t make a good target because there are so few installations from which to run malicious code.”

    Is it accurate for me to say “so few”? Yes, Roy, because “60% of servers” is only impressive until you realize that servers make up a small percentage of ALL computers. Users outnumber servers, plain and simple. As unpleasant as it may be for you, the fact is that Linux is not a good target for botnets or malware because there are so few targets to choose from. There are security issues in Linux that will never need to be addressed because it will not achieve a majority market share.

    By the way, the last 2 links in your reply are broken. I’m sure you have a catalog of every anti-Microsoft article in existence, but it might be update it and get some fresh material. The quote you reference is from a 2002 article that referenced Windows 2000, but lacked any real technical specifics.

  2. Balrog said,

    April 9, 2009 at 12:29 pm

    Gravatar

    > The U.S. electrical grid is not a corporation. As for Microsoft, please explain why
    > it says “our products just aren’t engineered for security.”

    Looks like InfoWorld broke the link. See
    http://web.archive.org/web/20080209124930/http://www.infoworld.com/articles/hn/xml/02/09/05/020905hnmssecure.html
    for the article.

  3. Charles Oliver said,

    April 9, 2009 at 7:57 pm

    Gravatar

    Thanks for the link Balrog.

    One of the stand out quotes from that page was this:

    “Microsoft has also been employing new tools developed by Microsoft Research that are designed to detect errors in code during the development process, Valentine said.”

    I remember reading (possibly on el reg) about MS big upping another bug hunting tool just recently. It seems they’ve had a lot of these. I wonder why they don’t seem to help?

    Roy Schestowitz Reply:

    They tend to release prematurely; Apple does the same thing by the way. Even Wozniak ranted about it.

    Charles Oliver Reply:

    Kind of release early, release infrequently.

DecorWhat Else is New


  1. The EPO’s Overseer/Overseen Collusion — Part XVI: The Demise of the Austrian Double-Dipper

    Friedrich ‘Rude Liar’ Rödler is notorious in the eyes of EPO staff, whom he was slandering and scandalising for ages while he himself was the real scandal



  2. Links 18/10/2021: Porteus Kiosk 5.3 and Ventoy 1.0.55

    Links for the day



  3. [Meme] [Teaser] More to Life Than Patents

    Greedy sociopaths oughtn’t be put in charge of patent offices; this is what’s dooming the EPO in recent years (all they think about is money



  4. Microsoft GitHub Exposé — Part II — The Campaign Against GPL Compliance and War on Copyleft Enforcement

    Microsoft contemplated buying GitHub 7.5 years ago; the goal wasn’t to actually support “Open Source” but to crush it from the inside and that’s what Microsoft has been doing over the past 2.5 years (we have some details from the inside)



  5. Links 18/10/2021: Linux 5.15 RC6 and 7 New Stable Kernels

    Links for the day



  6. [Meme] The Austrian School of Friedrich Rude Liar

    With reference to the Austrian School, let’s consider the fact that Friedrich Rude Liar might in fact be standing to personally gain by plundering the EPO‘s staff by demonising them while helping Benoît Battistelli crush them



  7. IRC Proceedings: Sunday, October 17, 2021

    IRC logs for Sunday, October 17, 2021



  8. How (Simple Technical Steps) to Convince Yourself That DuckDuckGo is Just Spyware Connected to Microsoft, Falsely Advertised as 'Privacy'

    In recent days we published or republished some bits and pieces about what DuckDuckGo really is; the above reader dropped by to enlighten us and demonstrate just how easy it is to see what DuckDuckGo does even at the client side (with JavaScript); more people need to confront DuckDuckGo over this and warn colleagues/friends/family (there’s more here)



  9. Austria's Right-Wing Politicians Displaying Their Arrogance to EPO Examiners

    The EPO‘s current regime seems to be serving a money-hungry lobby of corrupt officials and pathological liars; tonight we focus on Austria



  10. [Meme] Friedrich Rödler's Increasingly Incomprehensible Debt Quagmire, Years Before EPO Money Was Trafficked Into the Stock Market

    As it turns out, numerous members of the Administrative Council of the EPO are abundantly corrupt and greedy; They falsely claim or selfishly pretend there’s a financial crisis and then moan about a "gap" that does not exist (unless one counts the illegal gambling, notably EPOTIF, which they approved), in turn recruiting or resorting to scabs that help improve ‘profit margins’



  11. The EPO’s Overseer/Overseen Collusion — Part XV: Et Tu Felix Austria…

    Prior to the Benoît Battistelli and António Campinos regime the EPO‘s hard-working staff was slandered by a corrupt Austrian official, Mr. Rödler



  12. Links 17/10/2021: Blender 2.93.5, Microsoft Bailouts

    Links for the day



  13. Links 17/10/2021: GhostBSD 21.10.16 and Mattermost 6.0

    Links for the day



  14. IRC Proceedings: Saturday, October 16, 2021

    IRC logs for Saturday, October 16, 2021



  15. [Meme] First Illegally Banning Strikes, Then Illegally Taking Over Courts

    The vision of Team Battistelli/Campinos is a hostile takeover of the entire patent system, not just patent offices like the EPO; they’d stop at nothing to get there



  16. Portuguese Network of Enablers

    Instead of serving Portuguese people or serving thousands of EPO workers (including many who are Portuguese) the delegation from Portugal served the network of Campinos



  17. In Picture: After Billions Spent on Marketing, With Vista 11 Hype and Vapourware, No Real Gains for Windows

    The very latest figures from Web usage show that it’s hardly even a blip on the radar; Windows continues bleeding to death, not only in servers



  18. [Meme] [Teaser] Double-Dipping Friedrich Rödler

    As we shall see tomorrow night, the EPO regime was supported by a fair share of corrupt officials inside the Administrative Council



  19. The EPO’s Overseer/Overseen Collusion — Part XIV: Battistelli's Iberian Facilitators - Portugal

    How illegal “Strike Regulations” and regressive ‘reforms’ at the EPO, empowering Benoît Battistelli to the detriment of the Rule of Law, were ushered in by António Campinos and by Portugal 5 years before Campinos took Battistelli’s seat (and power he had given himself)



  20. Links 16/10/2021: SparkyLinux Turns 10 and Sculpt OS 21.10

    Links for the day



  21. “Facebook Whistleblowers” Aside, It Has Been a Dying Platform for Years, and It's Mentally Perverting the Older Generation

    Guest post by Ryan, reprinted with permission



  22. [Meme] Microsoft Has Always Been About Control Over Others

    Hosting by Microsoft means subjugation or a slavery-like relationship; contrary to the current media narrative, Microsoft has long been censoring LinkedIn for China’s autocratic regime; and over at GitHub, as we shall show for months to come, there’s a war on information, a war on women, and gross violations of the law



  23. EFF Pushes for Users to Install DuckDuckGo Software After Being Paid to Kill HTTPS Everywhere

    Guest post by Ryan, reprinted with permission



  24. The Reign in Spain

    Discussion about the role of Spain in the EPO‘s autocratic regime which violates the rights of EPO staff, including Spanish workers



  25. [Meme] Spanish Inquisition

    Let it be widely known that Spain played a role in crushing the basic rights of all EPO workers, including hundreds of Spaniards



  26. Why You Shouldn’t Use SteamOS, a Really Incompetent GNU/Linux Distribution With Security Pitfalls (Lutris is a Great Alternative)

    Guest post by Ryan, reprinted with permission



  27. IRC Proceedings: Friday, October 15, 2021

    IRC logs for Friday, October 15, 2021



  28. Links 16/10/2021: Xubuntu 21.10 and DearPyGui 1.0.0

    Links for the day



  29. DuckDuckGo’s HQ is Smaller Than My Apartment

    Guest post by Ryan, reprinted with permission



  30. Post About Whether Vivaldi is a GPL violation Was Quietly Knifed by the Mods of /r/uBlockOrigin in Reddit

    Guest post by Ryan, reprinted with permission


RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts