01.22.10

Microsoft Security Negligence Confirmed: Critical Internet Explorer Flaw Known and Ignored for 4 Months

Posted in Deception, Microsoft, Security, Windows at 4:12 pm by Dr. Roy Schestowitz

Summary: The newest facts show that Microsoft knowingly refused to fix flaws that led to tremendous damage; lies from Microsoft (about its competition) are refuted as well

IN MANY RECENT posts about Internet Explorer [1, 2, 3, 4, 5, 6, 7, 8], we have pointed out Microsoft’s pattern of negligence [1, 2, 3], which always passes costs (damages) to the public. Microsoft should probably be sued for it, rather than make money from it. Microsoft — like Goldman Sachs — is making a lot of money out of a crisis caused by its own risk-taking.

Here are some self-explanatory news headlines:

Microsoft lies to your face about browser security

Microsoft’s Head of Security and Privacy in the UK has told TechRadar that people who jump ship from Internet Explorer after the recent spate of bad headlines risk ending up on a less secure browser. With France and Germany both advising a move away from Internet Explorer, things are far from rosy for Microsoft’s browser [...yet] Microsoft’s UK security chief Cliff Evans insists that a non-Microsoft browser is the worse option. “The net effect of switching [from IE] is that you will end up on less secure browser,” insisted Evans. “The risk [over this specific] exploit is minimal compared to Firefox or other competing browsers… you will be opening yourself up to security issues.

Let’s fight FUD with facts…

Vulnerability Report: Mozilla Firefox 3.5.x
Unpatched: 0

Vulnerability Report: Google Chrome 3.x
Unpatched: 0

Vulnerability Report: Opera 10.x
Unpatched: 0

Vulnerability Report: Apple Safari 4.x
Unpatched: 0

Vulnerability Report: Microsoft Internet Explorer 6.x
Unpatched: 24
Most Critical Unpatched: Extremely critical

Vulnerability Report: Microsoft Internet Explorer 7.x
Unpatched: 11
Most Critical Unpatched: Extremely critical

Vulnerability Report: Microsoft Internet Explorer 8.x
Unpatched: 4
Most Critical Unpatched: Extremely critical

My recommendation if you use Windows: make sure the version of IE that’s installed (because you can’t uninstall it!) is the latest/least vulnerable (IE8) and then install at least one of the non-IE browsers listed (personally I always recommend Firefox :) and then use THAT. Of course, you could always switch to a Mac or Linux…

Microsoft patches IE, admits it knew of bug last August

As Microsoft patched the Internet Explorer (IE) vulnerability that was used to break into Google’s network, it also acknowledged that it had known of the bug since August 2009, when an Israeli security company reported the flaw.

MS knew of Aurora exploit four months before Google attacks

Microsoft first knew of the bug used in the infamous Operation Aurora IE exploits as long ago as August, four months before the vulnerability was used in exploits against Google and other hi-tech firms in December, it has emerged.

Redmond’s security gnomes finally got around to patching the exploit on Thursday. the hack attacks against Google et al targeted IE 6, a browser first released in 2001. Exploits involved tricking users of vulnerable browsers into visiting booby-trapped websites. These sites downloaded the Hydraq backdoor Trojan and other malicious components onto compromised PCs.

[...]

A quick search of Secunia’s database, via its PSI patching tool, reveals a problem with an unpatched ActiveX control that looks just as bad, for example.

Emergency IE patch goes live as exploits proliferate

Microsoft released an emergency security update for all versions of Internet Explorer on Thursday as attacks exploiting a critical vulnerability in the widely used browser spread to hundreds of websites.

[...]

While some of the sites hosting the attacks were free services that had been co-opted, others appeared to be domains of legitimate companies that had been compromised.

[...]

In an admission that’s sure to spark criticism, Microsoft said it learned of the critical bug more than three months ago.

[...]

The unscheduled bulletin fixes a memory corruption flaw in most versions of the widely used browser that allows attackers to execute malicious code simply by luring victims to a booby-trapped website. It fixes seven other privately reported vulnerabilities, some of which also made remote code execution possible, that Microsoft had been planning to issue next month during its next regularly scheduled patch release.

[...]

Systems compromised by the sites reported by Symantec were infected with a backdoor that collected registry settings and other system information and sent it to an email address that was under the control of attackers. That email address has since been disabled, Talbot said.

Widespread Attacks Exploit Newly Patched IE Bug

The first widespread attack to leverage a recently patched flaw in Microsoft’s Internet Explorer browser has surfaced.

Starting late Wednesday, researchers at antivirus vendor Symantec’s Security Response group began spotting dozens of Web sites that contain the Internet Explorer attack, which works reliably on the IE 6 browser, running on Windows XP. The attack installs a Trojan horse program that is able to bypass some security products and then give hackers access to the system, said Joshua Talbot, a security intelligence manager with Symantec.

Once it has infected a PC, the Trojan sends a notification e-mail to the attackers, using a U.S.-based, free e-mail service that Symantec declined to name.

Make the right browser update: Firefox 3.6

Neolithic Windows security hole alive and well in Windows 7

One of the reasons I’ve never liked Windows is that it was never made to deal with the security problems of working in a networked, multi-user world. As a direct result, Windows has been fundamentally insecure for more than a decade. Even so, I was surprised to find that there’s a 17-year old security hole that’s been in Windows since NT and it’s still present today in Windows 7.

Wow. Even I’m shocked by this latest example of just how rotten Windows security is. It just reminds me again though that while Microsoft keeps adding features and attempting to patch its way out of security problems to Windows, Windows’ foundation is built on sand and not on the stone of good, solid design.

[...]

Be that as it may, the code’s still in there. An attacker can trigger the vulnerability through a variety of means. The end-result is, surprise, another Windows machine that’s totally owned by the attacker. Once in charge, they can vacuum down your files, install malware, and all the other usual tricks.

Vista 7 was never secure to begin with. See the examples below.

  1. Cybercrime Rises and Vista 7 is Already Open to Hijackers
  2. Vista 7: Broken Apart Before Arrival
  3. Department of Homeland Security ‘Poisoned’ by Microsoft; Vista 7 is Open to Hijackers Again
  4. Vista 7 Security “Cannot be Fixed. It’s a Design Problem.”
  5. Why Vista 7 Could be the Least Secure Operating System Ever
  6. Journalists Suggest Banning Windows, Maybe Suing Microsoft Over DDoS Attacks
  7. Vista 7 Vulnerable to Latest “Critical” Flaws
  8. Vista 7 Seemingly Affected by Several More “Critical” Flaws This Month
  9. Reason #1 to Avoid Vista 7: Insecurity
  10. Vista 7 Left Hijackable Again (Almost a Monthly Recurrence)
Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Reddit
  • email

This post is also available in Gemini over at:

gemini://gemini.techrights.org/2010/01/22/refusing-to-fix-ie-flaws/

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

A Single Comment

  1. uberVU - social comments said,

    January 22, 2010 at 9:26 pm

    Social comments and analytics for this post…

    This post was mentioned on Twitter by schestowitz: Critical Internet Explorer Flaw Known and Ignored for 4 Months http://boycottnovell.com/2010/01/22/refusing-to-fix-ie-flaws/

What Else is New


  1. The Death of Freenode Would Be Freenode's Own Fault

    Freenode is going dark and now it’s asking people to create accounts at IRC.com (just to get back into the network that they may have already occupied for decades) as if Freenode owns “IRC” as a whole



  2. Links 31/7/2021: KDE Progress and Activision Catastrophe

    Links for the day



  3. IRC Proceedings: Friday, July 30, 2021

    IRC logs for Friday, July 30, 2021



  4. The Smartest Meter of All

    Yesterday a lady came over to take our power readings (electric/gas meter); secure these people's jobs as they help protect people's privacy (dignity) at home



  5. [Meme] A Web of False Dichotomies

    A reminder that Techrights is fully available (all blog posts and wiki pages) in gemini://



  6. Freenode Shrinks by Another Quarter and Gemini Continues to Grow (For Techrights at Least)

    Freenode continues to perish faster than we've imagined; it's a good thing that we've had contingencies set up; regarding the monopolised and increasingly centralised Web, we're still making baby steps towards weaning ourselves off it



  7. Links 31/7/2021: Wine 6.14 and Chrome 93 Beta

    Links for the day



  8. European Media Does Not Care About Europe's Second-Largest Institution Crushing Basic Laws and Fundamental Rights

    New video about the latest publication from SUEPO (the EPO’s staff union); it was published yesterday, seeing that the “Mafia” (what EPO staff actually calls the management!) hasn’t done anything to comply with a wide-ranging set of court rulings from ILO-AT; why has the media said nothing about this and what does that say about today’s media? The material is all in the public domain, in widely understood languages, and SUEPO spoke about it more than 3 weeks ago.



  9. Links 30/7/2021: Distro Comparisons and Tootle Introduced

    Links for the day



  10. [Meme] Enforcing ILO-AT Rulings...

    We’re still waiting for a statement — any statement (direct or indirect) — from EPO management, seeing that almost a month has passed



  11. 'Open Source' as a Failed Initiative

    A closer look at the dire state of the Open Source Initiative, or OSI, which no longer protects Open Source (let alone software freedom) but instead helps openwashing, Microsoft entrapment, and a coup against the FSF



  12. [Meme] Rowan and António Sittin' on a Tree...

    How much longer can Team Campinos keep issuing tons of noisy and self-congratulatory puff pieces to (perhaps) distract from the elephant in the 10th floor of the Isar building (EPO HQ)? Staff won't wait for eternity.



  13. IRC Proceedings: Thursday, July 29, 2021

    IRC logs for Thursday, July 29, 2021



  14. Half the People in This Letter Are IBM Employees

    IBM seems to be continuing its war on the FSF because IBM wants to own everything (CentOS being ‘canned’ was just part of the plan)



  15. The OSI Song

    The sad demise of OSI, which has become little but a front group of proprietary software companies in pursuit of openwashing services (and outsourcing to proprietary disservices looking to eradicate copyleft)



  16. [Meme] OSI is Doing Just Fine

    So what if OSI is run by someone who raised money from Microsoft (to sell Microsoft a keynote slot in a copyleft event — the thing that Microsoft attacks through GitHub!) while funnelling the OSI's funds to a serial GPL violator?



  17. The OSI's Defunct Elections (Privacy Breach), Conflict of Interest (Nicholson), and Other Lingering Problems

    The above, together with an email from the OSI below, serves to show they’re re-running a bad election and — yet worse! — there appears to be a conflict of interest implicating the OSI’s sole member of staff!



  18. Links 30/7/2021: Audacity 3.0.3 and KD Chart 2.8.0

    Links for the day



  19. Links 29/7/2021: siduction 2021.2 and Xubuntu 21.10 Dev Update

    Links for the day



  20. GitHub is Racism

    Microsoft has the world's most racist code hosting repository; it wasn't like this when Microsoft took over as the racist policies were added to impress Donald Trump, who would later rig a procurement/tendering process to bail out Microsoft (10 billion dollars from the Pentagon, i.e. taxpayers)



  21. [Meme] António Lost His Power Over Patent Examiners

    Team Campinos at the EPO must be rather stressed at the moment; the people who do all the work can go on strike any time (or all the time, until/unless demands are met)



  22. European Patent Office is Going on Strike (or Strikes)

    The staff of the EPO is ready to strike like never before (dissatisfaction and outrage over 8 years of gross injustice, namely Battistelli's breach of fundamental rights, including the right to strike)



  23. Crying “Wolf!” About Systemd is Only Beneficial to IBM and Systemd Developers/Pushers

    Microsoft controls Systemd only to the extent that Systemd is controlled by GitHub, which is in turn controlled by Microsoft; But Systemd has long been on that proprietary platform (its developers don’t truly value software freedom) and this has long been a problem, even before Microsoft hijacked it for coercive power



  24. Links 29/7/2021: Mesa 21.2 RC3, FSF Responds to Microsoft's 'Hey Hi' Attack on Copyleft

    Links for the day



  25. IRC Proceedings: Wednesday, July 28, 2021

    IRC logs for Wednesday, July 28, 2021



  26. [Meme] No Crime Goes Unrewarded at the EPO

    It is more or less undeniable that from a legal and functional perspective the EPO is already defunct and is still perishing under a couple of Mafiosos whose sole interest is cover-up and grifting/plunder (of what’s left of the Office after almost 40 years of goodwill/reputation); the recent G 1/21 fiasco was just icing on the cake and the EU’s insistence on a patently unconstitutional UPC (more legal powers for chronic EPC violators) actually weakens unity in Europe (by discrediting the Union)



  27. [Meme] There's Always a Way (When Financial Results Are Not So Good...)

    Too many US ‘tech’ companies still lie to their investors. They choose financial engineering instead of real engineering.



  28. Links 28/7/2021: OPNsense 21.7 and MX Linux 21 Beta

    Links for the day



  29. The One Reason I Cannot Get 'Google News' (or Google) Completely Out of My Life

    Google has got almost a monopoly on (nearly) real-time news syndication; this is why, for our Daily Links at least, we still rely on Google News to a certain extent



  30. [Meme] When Sociopaths or Psychopaths Run Europe's Second-Largest Institution

    The EPO has a very profound issue because it is run (and ruined) by insecure thugs with inferiority complex, so they form cliques of friends of theirs instead of actually qualified people, in effect creating personality cults that laugh at the law and disregard any obligations to the institutions/staff they were entrusted to manage


RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts