07.10.09
The Windows Security Theatre
Summary: Many security reports from The Register and little more of the rest
McAfee is far from a friend of Free software [1, 2] and its remedies for Windows may sometimes cause more harm than good. Here is a fresh new example of why this paradigm of sold-separately bolted-on security software simply does not work. To quote, “IT admins across the globe are letting out a collective groan after servers and PCs running McAfee VirusScan were brought down when the anti-virus program attacked their core system files. In some cases, this caused the machines to display the dreaded blue screen of death.”
One of our readers says that “admins use Knoppix to fix borked McAfee antivirus” and he points to this new example where someone suggests: “For servers with BSOD we have used knoppix live cd to move files from quarantine to original place…”
In other news, Microsoft is preparing patches for flaws that enable hijacking of Windows, probably remotely. These flaws are very serious. Some of them are already being actively exploited (without a solution available).
Microsoft on Tuesday plans to release updates patching three critical Windows security vulnerabilities, two of which are already under attack.
Attacks must always precede reaction in Microsoft's case.
Why might this happen? Well, maybe because, according to some more news, Microsoft has knowingly ignored a serious flaw for a year. It is so typical.
Microsoft knew of nasty IE bug a year before attacks
The disclosure comes as attacks targeting the MSVidCtl ActiveX control vulnerability have increased exponentially. On Monday, online ads distributed by through the Giant Realm network on popular gaming websites began including code that exploits the bug, according to security firm ScanSafe. The ads mean that anyone using IE to browse sites such as diii.net and incgamers.com are risk if they run the XP or 2003 versions of Windows and have not yet installed a quick fix.
We have already shown that Microsoft deliberately hides its flaws. Victims of this careless, selfish behaviour are all of us who receive spam from hundreds of millions of Windows zombies. To rephrase the news (The Register again), spam levels have returned to normal.
Victims may include more hospitals too, according to this last bit of news from The Register.
The leader of a malicious hacker collective who used his job as a security guard to breach sensitive Texas hospital computers has been arrested just days before his group planned a “massive DDoS” attack for the July 4 Independence Day holiday.
Hospitals are hit by Windows viruses on a very regular basis this year [1, 2, 3, 4] and according to this article from Sam Varghese Microsoft is profiteering from it.
How Microsoft benefits from Conficker
Microsoft experts were among consultants called in by the council – and they took home some of the £1.2 million which the body paid out to get the problem resolved. Exactly how much was paid to the different consultants was not divulged.
In reference to some of these shocking figures, one of our readers asks, “What can be bought?” He uses Manchester as an example:
There was a recent article about the UK city of Manchester which just paid nearly $2.5 million in clean up for the Windows worm Conficker. That’s one worm in one city.
If we take some numbers for the sake of argument and play with them, what could we buy with $2.5 million.
Say for the sake of argument that top developers (in several fields of computing) and UI designers cost $100,000 apiece including insurance, pensions, equipment and work space rental. That would provide for a team of 10 for 25 years, or a team of 25 for 10 years, etc.
So for a decade, for the same price, Manchester could work out a re-packaging of Fedora and some needed applications:
5 development engineers
5 deployement engineers
5 HCI specialists
10 half-time support
3 full-time support
2 managers / marketeersThe magnitude of the money lost pursuing the Windows ideology is mind-boggling.
Contrary to common belief (mind the interesting comments), Microsoft could really use some money which is made through its own incompetence. The reality of the matter is that Microsoft has faltered for years (even financially) and it now amasses some debt.
But going back to this subject of security, Heise reports show that Apple is no role model either, not with its proprietary, DRM-locked phones.
iPhone 3GS cracked
[...]
The Dev Team are well known for their free iPhone jailbreaking and unlocking tools (QuickPwn, PwnageTool, Yellowsn0W, etc.), however, they have yet to release a tool that’s compatible with the 3GS and version 3.0 of the iPhone software.
Symbian faces challenges too. Symbian is still proprietary (in phases of transition).
Security on Symbian mobiles: Early signs of crumbling
[...]
At the recent Pwn2Own 2009 security contest, none of the competitors succeeded in hacking a Symbian mobile.
Free Software Magazine has a good new comic on that subject of security. █
Content is available under CC-BY-SA
David Gerard said,
July 10, 2009 at 6:01 am
There are enough people in Symbian trying to make it really open source and to operate as a bazaar, not a cathedral (as Netscaspe and OpenOffice fell into). It’s a long haul, though, for an owned corporate open source project. Remember that the “cathedral” examples in The Cathedral And The Bazaar were free software, not proprietary.
Roy Schestowitz Reply:
July 10th, 2009 at 6:20 am
I think it was David (Woods?) from Symbian who made remarks that are hostile towards the GPL and factually incorrect. Symbian is more into “open source” (Eclipse). Then there’s DRM and their landmark software patents case in the UK.