07.10.09

Gemini version available ♊︎

The Windows Security Theatre

Posted in Apple, Microsoft, Security, Windows at 1:43 am by Dr. Roy Schestowitz

Airport

Summary: Many security reports from The Register and little more of the rest

McAfee is far from a friend of Free software [1, 2] and its remedies for Windows may sometimes cause more harm than good. Here is a fresh new example of why this paradigm of sold-separately bolted-on security software simply does not work. To quote, “IT admins across the globe are letting out a collective groan after servers and PCs running McAfee VirusScan were brought down when the anti-virus program attacked their core system files. In some cases, this caused the machines to display the dreaded blue screen of death.”

One of our readers says that “admins use Knoppix to fix borked McAfee antivirus” and he points to this new example where someone suggests: “For servers with BSOD we have used knoppix live cd to move files from quarantine to original place…”

In other news, Microsoft is preparing patches for flaws that enable hijacking of Windows, probably remotely. These flaws are very serious. Some of them are already being actively exploited (without a solution available).

Microsoft on Tuesday plans to release updates patching three critical Windows security vulnerabilities, two of which are already under attack.

Attacks must always precede reaction in Microsoft's case.

Why might this happen? Well, maybe because, according to some more news, Microsoft has knowingly ignored a serious flaw for a year. It is so typical.

Microsoft knew of nasty IE bug a year before attacks

The disclosure comes as attacks targeting the MSVidCtl ActiveX control vulnerability have increased exponentially. On Monday, online ads distributed by through the Giant Realm network on popular gaming websites began including code that exploits the bug, according to security firm ScanSafe. The ads mean that anyone using IE to browse sites such as diii.net and incgamers.com are risk if they run the XP or 2003 versions of Windows and have not yet installed a quick fix.

We have already shown that Microsoft deliberately hides its flaws. Victims of this careless, selfish behaviour are all of us who receive spam from hundreds of millions of Windows zombies. To rephrase the news (The Register again), spam levels have returned to normal.

Victims may include more hospitals too, according to this last bit of news from The Register.

The leader of a malicious hacker collective who used his job as a security guard to breach sensitive Texas hospital computers has been arrested just days before his group planned a “massive DDoS” attack for the July 4 Independence Day holiday.

Hospitals are hit by Windows viruses on a very regular basis this year [1, 2, 3, 4] and according to this article from Sam Varghese Microsoft is profiteering from it.

How Microsoft benefits from Conficker

Microsoft experts were among consultants called in by the council – and they took home some of the £1.2 million which the body paid out to get the problem resolved. Exactly how much was paid to the different consultants was not divulged.

In reference to some of these shocking figures, one of our readers asks, “What can be bought?” He uses Manchester as an example:

There was a recent article about the UK city of Manchester which just paid nearly $2.5 million in clean up for the Windows worm Conficker. That’s one worm in one city.

If we take some numbers for the sake of argument and play with them, what could we buy with $2.5 million.

Say for the sake of argument that top developers (in several fields of computing) and UI designers cost $100,000 apiece including insurance, pensions, equipment and work space rental. That would provide for a team of 10 for 25 years, or a team of 25 for 10 years, etc.

So for a decade, for the same price, Manchester could work out a re-packaging of Fedora and some needed applications:

5 development engineers
5 deployement engineers
5 HCI specialists
10 half-time support
3 full-time support
2 managers / marketeers

The magnitude of the money lost pursuing the Windows ideology is mind-boggling.

Contrary to common belief (mind the interesting comments), Microsoft could really use some money which is made through its own incompetence. The reality of the matter is that Microsoft has faltered for years (even financially) and it now amasses some debt.

But going back to this subject of security, Heise reports show that Apple is no role model either, not with its proprietary, DRM-locked phones.

iPhone 3GS cracked

[...]

The Dev Team are well known for their free iPhone jailbreaking and unlocking tools (QuickPwn, PwnageTool, Yellowsn0W, etc.), however, they have yet to release a tool that’s compatible with the 3GS and version 3.0 of the iPhone software.

Symbian faces challenges too. Symbian is still proprietary (in phases of transition).

Security on Symbian mobiles: Early signs of crumbling

[...]

At the recent Pwn2Own 2009 security contest, none of the competitors succeeded in hacking a Symbian mobile.

Free Software Magazine has a good new comic on that subject of security.

Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Reddit
  • email

Decor ᶃ Gemini Space

Below is a Web proxy. We recommend getting a Gemini client/browser.

Black/white/grey bullet button This post is also available in Gemini over at this address (requires a Gemini client/browser to open).

Decor ✐ Cross-references

Black/white/grey bullet button Pages that cross-reference this one, if any exist, are listed below or will be listed below over time.

Decor ▢ Respond and Discuss

Black/white/grey bullet button If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

2 Comments

  1. David Gerard said,

    July 10, 2009 at 6:01 am

    Gravatar

    There are enough people in Symbian trying to make it really open source and to operate as a bazaar, not a cathedral (as Netscaspe and OpenOffice fell into). It’s a long haul, though, for an owned corporate open source project. Remember that the “cathedral” examples in The Cathedral And The Bazaar were free software, not proprietary.

    Roy Schestowitz Reply:

    I think it was David (Woods?) from Symbian who made remarks that are hostile towards the GPL and factually incorrect. Symbian is more into “open source” (Eclipse). Then there’s DRM and their landmark software patents case in the UK.

DecorWhat Else is New


  1. Links 25/03/2023: Gordon Moore (of Moore's Law) is Dead

    Links for the day



  2. Links 25/03/2023: Decade of Docker, Azure Broken Again

    Links for the day



  3. [Meme] Money Deducted in Payslips, But Nothing in Pensions

    Sirius ‘Open Source’ has stolen money from staff (in secret)



  4. IRC Proceedings: Friday, March 24, 2023

    IRC Proceedings: Friday, March 24, 2023



  5. The Corporate Media is Not Reporting Large-Scale Microsoft Layoffs (Too Busy With Chaffbot Puff Pieces), Leaks Required to Prove That More Layoffs Are Happening

    Just as we noted days ago, there are yet more Microsoft layoffs, but the mainstream media gets bribed to go “gaga” over vapourware and chaffbots (making chaff like “Bill Gates Says” pieces) instead of reporting actual news about Microsoft



  6. Sirius 'Open Source' Pensiongate: Time to Issue a Warrant of Arrest and Extradite the Fake 'Founder' of Sirius

    Sirius ‘Open Source’ is collapsing, but that does not mean that it can dodge accountability for crimes (e.g. money that it silently stole from its staff since at least 12 years ago)



  7. Links 24/03/2023: Microsoft's Fall on the Web and Many New Videos

    Links for the day



  8. IRC Proceedings: Thursday, March 23, 2023

    IRC logs for Thursday, March 23, 2023



  9. Links 24/03/2023: Social Control Media Bans Advancing

    Links for the day



  10. Links 24/03/2023: GNU Grep 3.10 and Microsoft Accenture in a Freefall

    Links for the day



  11. Links 23/03/2023: RSS Guard 4.3.3 and OpenBSD Webzine

    Links for the day



  12. Experiencing 15 Years of LibrePlanet Celebration Firsthand as a Volunteer: 2023 - Charting the Course

    Article by Marcia K Wilbur



  13. [Meme] Grabinski the Opportunity

    Reports of European Patents being invalidated (judges do not tolerate fake patents) have become so common that a kangaroo court becomes a matter of urgency for the EPO‘s Benoît Battistelli and António Campinos; will the EU and the EPO’s Administrative Council go along with it, helping to cover up more than a decade of profound corruption?



  14. Union Syndicale Fédérale Cautions the EPO's Administrative Council About Initiating an Illegal Kangaroo Court System for Patents (UPC) While EPO Breaks Laws and Sponsors the Ukraine Invasion

    Union Syndicale Fédérale (USF) is once again speaking out in support of the staff union of Europe's second-largest institution, which lacks oversight and governance because of profound corruption and regulatory capture



  15. Investigation Underway: Sirius 'Open Source' Embezzled/Stole Money, Robbed Its Own Staff

    In light of new developments and some progress in an investigation of Sirius ‘Open Source’ (for fraud!) we take stock of where things stand



  16. [Meme] Sirius 'Open Source' Pensions: Schemes or Scams? Giving a Bad Name to Open Source...

    What Sirius ‘Open Source’ did to its staff is rightly treated as a criminal matter; we know who the perpetrators are



  17. Sirius 'Open Source' Under Investigation for Pension Fraud, Several Pension Providers Examine the Facts

    2 pension providers are looking into Sirius ‘Open Source’, a company that defrauded its own staff; stay tuned as there’s lots more to come. Is this good representation for “Open Source”? From a company that had many high-profile clients in the public sector?



  18. Links 23/03/2023: Sparky 2023.03 Special Editions and SUSE Changes CEO (Dirk-Peter van Leeuwen)

    Links for the day



  19. Links 23/03/2023: Linux 6.2.8 and XWayland 23.1.0

    Links for the day



  20. IRC Proceedings: Wednesday, March 22, 2023

    IRC logs for Wednesday, March 22, 2023



  21. Apple 'Porn' Filter

    Guest post by Ryan Farmer: Apple and US State Governments Developing System to Require People to Report Themselves for Watching Porn.



  22. 3.5 Years Later Gemini Protocol and Geminispace Are Still 100% Community-Controlled

    Community-centric alternatives to the World Wide Web have gained traction; one of them, Gemini Protocol, continues to grow in 2023 and we're pleased to report progress and expansion



  23. Windows Falls to 16% Market Share in India (It was 97% in 2009), Microsoft Layoffs Reach India Too

    This month’s picture from the world’s most populous nation does not look good for Microsoft (it looks good for GNU/Linux); anonymous rumour mills online say that Microsoft isn’t moving to India but is actually firing staff based in India, so it’s a case of shrinking, not offshoring. When even low-paid (much lower salaries) staff is discarded it means things are very gloomy.



  24. Links 22/03/2023: GNOME 44 “Kuala Lumpur”

    Links for the day



  25. Microsoft Has Also Infiltrated the OSI's Board of Directors After Rigged Elections

    Weeks ago we warned that this would happen and for the third or fourth time in 2 years the OSI’s election process broke down; today the Open Source Initiative (OSI) writes: “The polls just closed, the results are in. Congratulations to the returning directors Aeva Black…” (Microsoft employee)



  26. Links 22/03/2023: Official Thunderbird Podcast Starts

    Links for the day



  27. IRC Proceedings: Tuesday, March 21, 2023

    IRC logs for Tuesday, March 21, 2023



  28. Many More Microsoft Layoffs Later Today

    Yesterday we shared rumours about Microsoft layoffs being planned for later today (there were 3 waves of layoffs so far this year). There are several more people here who say the same. How much noise will Microsoft make in the “media” in order to distract? Will the chaffbot "ChatGPT" help create enough chaff?



  29. Links 21/03/2023: JDK 20 and GNOME 43.5

    Links for the day



  30. Germany's Lobbyists-Infested Government Sponsors the War on Ukraine via the European Patent Office (EPO)

    The chief UPC ‘judge’ is basically seeking to break the law (and violate constitutions, conventions etc.) to start a kangaroo court while dodging real courts, just like Vladimir Putin does


RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts