09.05.10

U.S. Military Hit by Windows, Learns Nothing From Microsoft Negligence

Posted in Apple, Free/Libre Software, Microsoft, Security, Windows at 8:34 pm by Dr. Roy Schestowitz

Flag and tank

Summary: Failures to name the culprit after a serious military intrusion; new examples where Microsoft knowingly ignores and leaves open holes inside Windows

“LOOKS Like Microsoft is Doing Damage Control on Virus Attacks” was the title of this post from last week. There has been a hot debate about it recently, but owing to Slashdot spin not much was done to call out Windows. The DOD/Pentagon ought to say more about the role of Microsoft software, but even the original article from Wired only speaks about “worm” and “USB”/”flash drive”, neglecting to say that only Windows can be affected. Here’s the opening:

In the fall of 2008, a variant of a three year-old, relatively-benign worm began winding its way through the U.S. military’s networks, spread by troops using thumb drives and other removable storage media. Now, the Pentagon says the infiltration — first reported by Danger Room — was a deliberate attack, launched by foreign spies. It’s a claim that some of the troops who worked to contain the worm are finding hard to back up.

In the upcoming issue of Foreign Affairs, Deputy Defense Secretary William Lynn writes that the worm entered the military’s classified systems “when an infected flash drive was inserted into a U.S. military laptop at a base in the Middle East. The flash drive’s malicious computer code, placed there by a foreign intelligence agency, uploaded itself onto a network run by the U.S. Central Command.”

Why could Slashdot not state that this is a Windows issue? Should one just assume (magically, by default) that when no operating system is mentioned it must be Microsoft Windows? They do name and shame the operating system when it’s not Windows.

Slashdot should know better because only yesterday it wrote about a data-stealing bug which is specific to Internet Explorer 8 (Windows only): [via]

There’s an unpatched vulnerability in Internet Explorer 8 that enables simple data-stealing attacks by Web-based attackers and could lead to an attacker hijacking a user’s authenticated session on a third-party site. The flaw, which a researcher said may have been known since 2008, lies in the way that IE 8 handles CSS style sheets.

We have written a great deal this year about Microsoft negligence [1, 2, 3] that led to security disasters, e.g. after Microsoft had ignored known Internet Explorer flaws for 6 months [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12] (Microsoft is the worst in the regard, so Google banned Windows earlier this year).

“Researcher told Microsoft of Windows apps zero-day bugs 6 months ago,” says this new headline from Gregg Keizer [1, 2], who adds yet another example of Microsoft ignoring problems for half a year (not even automatic patchers/trackers would help in such cases). Some things just never change.

Microsoft has said this year that for improved security users should consider moving to 64-bit Windows, but “Rootkit with Blue Screen history now targets 64-bit Windows,” says this news headline.

A new version of the malware that crippled Windows PCs last February sidesteps safeguards designed to block rootkits from hijacking machines running 64-bit editions of Windows, researchers said Thursday.

Proprietary software for Windows is another problem (Adobe and Apple being prime examples), but Free software too, e.g. Mozilla Firefox, may sometimes suffer only from flaws that are inherited from Windows, not Linux/UNIX. Microsoft in the stack is a real troublemaker and Apple is not helping:

A security researcher has uncovered a new vulnerability in Apple QuickTime that can be used to bypass some security protections in Microsoft Windows.

Code needs to be openly audited/auditable to be trustworthy. Why did the U.S. military make the mistake of relying on Windows?

“Thanks to Mr. Gates, we now know that an open Internet with protocols anyone can implement is communism; it was set up by that famous communist agent, the US Department of Defense.”

Richard Stallman

Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Reddit
  • email

This post is also available in Gemini over at:

gemini://gemini.techrights.org/2010/09/05/us-military-hit-by-windows-learns-nothing-from-microsoft-negligence/

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

A Single Comment

  1. twitter said,

    September 5, 2010 at 10:59 pm

    Gravatar

    Windows use by the US military is the result of corruption. Competent people, such as Richard Clarke, and institutions like West Point, know that Microsoft is insecure. Instructors from the US Military Academy at West Point say they use “as little Windows as possible”. Clarke blames US military use on “a small army of lobbyists” and knows how insecure the OS is but would use the problem to bring government control to the internet and computing. It would be better to continue with the original design of the Internet, robustness trough redundancy, diversity and freedom.

What Else is New


  1. Links 18/6/2021: Mir 2.4, ActivityWatch 0.11, Microsoft Breaks Its Own Repos

    Links for the day



  2. [Meme] When the 'Court' Drops

    As the EPO sneakily outsourced courts to American companies and parties in dispute depend on their ISP for “access to justice” there’s a catastrophic impact on the very concept of justice or the right to be heard (sometimes you don’t hear anything and/or cannot be heard)



  3. The EPO's Virtual Injustice and Virtual ('News') Media

    A discussion of this morning's post (part 10 in a series) about the shallow media/blog coverage that followed or accompanied last month's notorious EPO hearing



  4. Links 18/6/2021: LibreOffice 7.2 Beta, Elementary OS 6.0 Beta 2, and Linux Mint 20.2 “Uma” Beta

    Links for the day



  5. The Self-Hosting Song

    Cautionary tales about outsourcing one's systems to companies that could not care less about anyone but themselves



  6. IRC Proceedings: Thursday, June 17, 2021

    IRC logs for Thursday, June 17, 2021



  7. [Meme] Swedish Justice

    The EPO‘s patent tribunals have been mostly symbolic under the Benoît Battistelli and António Campinos regimes; giving them back their autonomy (and removing those who help Battistelli and Campinos attack their autonomy) is the only way to go now



  8. Virtual Injustice -- Part 10: Vapid and Superficial Coverage in the 'IP' Blogosphere

    The media has come under attack by Benoît Battistelli; during the term of António Campinos most of the media critical of the EPO has mostly vanished already; so one needs to look carefully at comments and social control media



  9. Links 18/6/2021: RasPad 3 and Pushing Rust Into the Linux Kernel

    Links for the day



  10. Heli Pihlajamaa Promoting Software Patents to Patent Maximalists

    "Ms Pyjamas" from the EPO is promoting illegal software patents to a bunch of patent zealots (CIPA)



  11. The Lying by Team UPC, Led Again by Kevin Mooney

    Team UPC, or specifically Mr. Mooney, lies to the public about the prospects of the UPC; similarly, EPO and EU officials keep bringing up false claims about the UPC, so while the UPC itself has likely died for good the lies have not



  12. Links 17/6/2021: Cutelyst 3 and Lenovo Move Towards ThinkPad BIOS Configuration From Within Linux

    Links for the day



  13. Too Much Noise and/or Distraction and General Loss of Focus (on the Real and Urgent Issues, Such as the Ongoing Anti-FSF 'Coup')

    The media is full of Microsoft fluff and technical blog posts still focus on the Freenode fiasco, among other things that don't matter all that much; but we certainly need to talk about steps undertaken to undermine the FSF's power because long-term ramifications may be huge



  14. [Meme] The Enlarged Bored People With Presidential Decrees

    The laughable state of the EPO‘s EBA (or EBoA) is rarely commented on anymore, not even in so-called ‘IP’ blogs; maybe they’re just so eager to see patents on everything, even European software patents, so tyrants who destroy the courts (with UPC lobbying and removal of EBA independence) don’t bother them so much anymore



  15. Response to Misinformation From EPO Officials

    Opponents of European software patents are clearly being mischaracterised by EPO officials, who also use meaningless buzzwords to promote such patents; as an aside or footnote that relates to our ongoing series we’re making this quick video, which is days late



  16. [Meme] Tilting the Scales for Software Patents

    Shovelling up lots of patents, even worthless patents such as software patents, dooms the EPO (EPC violations, lawlessness), dooms European professionals, but the wrong people have been put in charge and courts are being intimidated by them



  17. Virtual Injustice -- Part 9: Heli, the EPO's Nordic Ice-Queen

    Team Campinos is full of people who instead of grasping and working to promote innovation are boosting the agenda of litigation (scientists are not being employed)



  18. IRC Proceedings: Wednesday, June 16, 2021

    IRC logs for Wednesday, June 16, 2021



  19. Links 17/6/2021: elementary OS 6 Beta 2 and JingPad Linux Tablet Crowdfunding

    Links for the day



  20. Techrights Statement on IRC

    Freenode needs to explain what the hell happened this week and why communities that make up the network weren't informed or consulted



  21. IRC Proceedings: Tuesday, June 15, 2021

    IRC logs for Tuesday, June 15, 2021



  22. Virtual Injustice -- Part 8: A Well-Connected 'IP' Maximalist

    The EPO‘s lobbying for European software patents goes all the way to the top, including António Campinos and his circle



  23. Links 16/6/2021: Alpine 3.14.0 and DXVK 1.9

    Links for the day



  24. Links 15/6/2021: Debian Installer Bullseye RC 2 and Zink Updates

    Links for the day



  25. IRC Proceedings: Monday, June 14, 2021

    IRC logs for Monday, June 14, 2021



  26. Virtual Injustice -- Part 7: Musical Chairs and Revolving Doors

    Cross pollination in Alicante and Munich serves to show that people aren't picked for their skills and experience; it's like a private club or a clique



  27. Hardly Shocking and Not At All Surprising That Thugs Who Run the EPO Hired External Thugs to Help Them Oppress Aggrieved Staff

    With the EPO's management flooding the bank accounts of aggressive law firms (at our expense) we need to ask serious questions about how such a "Mafia" (what EPO staff calls the management) managed to metastasise inside Europe's second-largest institution and how to remove this "Mafia" as soon as possible (some arrests too are well overdue)



  28. [Meme] There Are No Elections in Mafia-Type Regimes; It's About Family and Friends...

    With no real concept or notion of "elections" (the so-called 'mafia' members choose their successors and colleagues) the EPO's patent examiners clearly need outside intervention, e.g. inquest by the EU authorities (the EPC died and maybe the EPO too; it's unregulated and it grants false patents that harm Europe because the courts don't function, either)



  29. Today's Linux Standing for the Opposite of What Linux Users Stand for

    The so-called 'Linux' Foundation or the "Corporate Linux Foundation" is alienating many of the original users of GNU/Linux and it still insults their intelligence; it's rewriting history, it still distorts the objectives, and before we know Linux will perish and lose momentum because all the excitement associated with the brand will fizzle away



  30. Links 14/6/2021: Kdenlive 21.04.2 and Raspberry Pi 400 Support in Linux

    Links for the day


RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts