02.14.11

Gemini version available ♊︎

Whitewashing Inherent Windows Flaws

Posted in Microsoft, Security, Windows at 2:33 pm by Dr. Roy Schestowitz

Light effects

Summary: New examples of security reports that lack an important ingredient which is an explanation about them being applicable to just one platform

LONG-ESTABLISHED platforms like UNIX and Linux offer more security than Windows and the recent bad news for Microsoft is just yet more proof of that. Techrights keeps urging people to call out Windows because it is indeed part of the problem (ease of cracking) and despite Richard A. Clarke saying the truth (among other security folks whose opinion is similar, as our security category ought to show), there are persistent denials and gagging by Microsoft. Looking at the news over the weekend, there is an issue which was mentioned here before and is still being brought up, this time by The Register:

Many users remain infected with computer malware – despite the fact that the vast majority are running machines protected by anti-virus software.

A study by European Union statistics agency EUROSTAT found that one third of PC users (31 per cent) had the pox even though the vast majority (84 per cent) were running security software (anti-virus, anti-spam, firewall) on their PCs. Of the survey’s respondents, 3 per cent reported financial loss as a result of farming or phishing attacks, while a further 4 per cent reported privacy violations involving data sent online.

This reports neglects to name Windows. It’s embarrassing that Windows and Microsoft are conspicuously missing, which means that people may never learn. Also from the news, there is a lot of talk about “malware” with no attribution to Windows and Microsoft.

McAfee has identified the tools, techniques, and network activities used in these attacks, which continue on to this day. These attacks have involved an elaborate mix of hacking techniques including social engineering, spear-phishing, Windows exploits, Active Directory compromises, and the use of remote administration tools (RATs).

Here is another new example of someone reporting about Stuxnet and blaming those who take advantage of it, not those who left the holes.

Last night, a member of hacker group Anonymous – a devious 4chan-spawned Internet coalition known for increasingly serious web-based attacks – announced on Twitter that the group was in possession of the Stuxnet virus.

Stuxnet is a subject that we covered in the posts below. It is becoming very costly to many economies.

  1. Ralph Langner Says Windows Malware Possibly Designed to Derail Iran’s Nuclear Programme
  2. Windows Viruses Can be Politically Motivated Sometimes
  3. Who Needs Windows Back Doors When It’s So Insecure?
  4. Windows Insecurity Becomes a Political Issue
  5. Windows, Stuxnet, and Public Stoning
  6. Stuxnet Grows Beyond Siemens-Windows Infections
  7. Has BP Already Abandoned Windows?
  8. Reports: Apple to Charge for (Security) Updates
  9. Windows Viruses Can be Politically Motivated Sometimes
  10. New Flaw in Windows Facilitates More DDOS Attacks
  11. Siemens is Bad for Industry, Partly Due to Microsoft
  12. Microsoft Security Issues in The British Press, Vista and Vista 7 No Panacea
  13. Microsoft’s Negligence in Patching (Worst Amongst All Companies) to Blame for Stuxnet
  14. Microsoft Software: a Darwin Test for Incompetence
  15. Bad September for Microsoft Security, Symantec Buyout Rumours
  16. Microsoft Claims Credit for Failing in Security
  17. Many Windows Servers Being Abandoned; Minnesota Goes the Opposite Direction by Giving Microsoft Its Data
  18. Windows Users Still Under Attack From Stuxnet, Halo, and Zeus
  19. Security Propaganda From Microsoft: Villains Become Heroes
  20. Security Problems in iOS and Windows
  21. Eye on Security: BBC Propaganda, Rootkits, and Stuxnet in Iran’s Nuclear Facilities
  22. Eye on Security: ClamAV Says Windows is a Virus, Microsoft Compromises Mac OS X, and Stuxnet Runs Wild
  23. Windows Kernel Vulnerability for Thanksgiving, Insecurity Used for Surveillance Again
  24. Cablegate Reveals Government Requesting Access to Microsoft Data, Kill Switches
  25. Use Microsoft Windows, Get Assassinated
  26. Iran Shows the Downside of Using Proprietary Software
Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Reddit
  • email

Decor ᶃ Gemini Space

Below is a Web proxy. We recommend getting a Gemini client/browser.

Black/white/grey bullet button This post is also available in Gemini over at this address (requires a Gemini client/browser to open).

Decor ✐ Cross-references

Black/white/grey bullet button Pages that cross-reference this one, if any exist, are listed below or will be listed below over time.

Decor ▢ Respond and Discuss

Black/white/grey bullet button If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

5 Comments

  1. TemporalBeing said,

    February 14, 2011 at 4:26 pm

    Gravatar

    Perhaps the F/OSS market should take a lesson from Apple’s book – and simply stop calling F/OSS enabled systems PC’s, perhaps calling them Penguins, or Devils (NetBSD), or something else instead. Just a thought…

    Dr. Roy Schestowitz Reply:

    Some companies do this (Pogoplug, Zonbu, TomTom, etc.)

    You can’t prescribe one universal brand for a system that’s not proprietary… and that’s OK.

    twitter Reply:

    That won’t solve the problem which is that reporters don’t mention Windows when they should. Apple too suffers from the perception that all software is “equally bad.” Only reporters being honest about reporting the facts will fix this false perception.

    So why don’t reporters do this and what can be done about it? The first thing to do is to politely ask. Email when you can and find out. I’ve been told by one or two that they consider the OS to be tangential and unimportant. This is essentially the same thing as the second excuse, which is that they really don’t think OS matter and are openly bigoted in Microsoft’s favor. IDG people respond rudely, others do better. You would think that such a basic fact would be part of any article about Windows security problems but Microsoft has worked hard to influence prominent reporters. Give reporters a breath of fresh air, they like it.

    Successful letters are posed as a question, contain careful research about the specific problem and the general issue, and point out that it’s not fair to call Windows problems “computer problems”. Ask them why they called the Windows X a “computer X”. Tell them X is a Windows only problem with links to various security sites that mention W32, XP, Vista/Windows 7 and no others. Then tell them it’s not fair to condemn the entire computer industry because Microsoft can’t fix their stuff. You might also link to reliable estimates of Windows compromise and the costs. The unavoidable story is that only Microsoft has problems and that everyone using Windows is greatly inconvenienced, if not robbed.

  2. Mikko said,

    February 14, 2011 at 5:28 pm

    Gravatar

    just call it “Computer”

    Dr. Roy Schestowitz Reply:

    It’s like calling Toyota a “car” in relation to bad brakes.

    “It has been reported that cars had a defective braking system.”

DecorWhat Else is New


  1. [Meme] Cannot Get a Phone to Work... in 2022

    Sirius ‘Open Source’ wasted hours of workers’ time just testing the phone after it had moved to a defective system of Google (proprietary); instead of a rollback (back to Asterisk) the company doubled down on the faulty system and the phones still didn’t work properly, resulting in missing calls and angst (the company just blamed the workers who all along rejected this new system)



  2. [Meme] Modern Phones

    Sirius ‘Open Source’ is mistaking “modern” for better; insecurity and a lack of tech savvy typically leads to that



  3. The ISO Delusion: Sirius Corporation Demonstrates a Lack of Understanding of Security and Privacy

    Sirius ‘Open Source’, emboldened by ISO ‘paperwork’ (certification), lost sight of what it truly takes to run a business securely, mistaking worthless gadgets for “advancement” while compelling staff to sign a new contract in a hurry (prior contract-signing scandals notwithstanding)



  4. Links 26/01/2023: LibreOffice 7.4.5 and Ubuntu Pro Offers

    Links for the day



  5. Links 26/01/2023: GNU poke 3.0 and PipeWire 0.3.65

    Links for the day



  6. IRC Proceedings: Wednesday, January 25, 2023

    IRC logs for Wednesday, January 25, 2023



  7. Companies Would Collapse Upon Abandoning Their Original Goals (That Attracted All the Productive Staff)

    Staff with technical skills won't stick around in companies that reject technical arguments and moreover move to proprietary software in a company that brands itself "Open Source"



  8. [Meme] Listen to Your Workers, Avert Disaster

    Companies that refuse to take input from staff are doomed to fail



  9. The ISO Delusion: When the Employer Doesn’t Understand the Company's Value Proposition (Building Systems) and Rejects Security

    Sirius ‘Open Source’ has failed to sell what it was actually good at; instead it hired unqualified people and outsourced almost everything



  10. Links 25/01/2023: NuTyX 23.01.1 and GNU Guile 3.0.9 Released

    Links for the day



  11. Links 25/01/2023: Stratis 3.5.0 and Many Political Links

    Links for the day



  12. New Record Low: Only One 'Linux' Article in ZDNet in More Than Two Weeks

    Only a few years ago ZDNet published about 3 “Linux” stories per day (mostly FUD pieces); now it’s a ghost town, painted in ‘alien green’; considering ZDNet’s agenda (and sponsors) maybe it’s better this way



  13. Links 25/01/2023: Pale Moon 32.0 and DXVK 2.1

    Links for the day



  14. IRC Proceedings: Tuesday, January 24, 2023

    IRC logs for Tuesday, January 24, 2023



  15. ISO Certification Hardly Tackles Any of the Real Issues

    The real-world threats faced by private companies or non-profit organisations aren't covered by the ISO certification mill; today we publish the last post on this topic before proceeding to some practical examples



  16. [Meme] Medical Data Sovereignty

    What happens when your medical records/data are accessible to a company based abroad after a mysterious NDA with the Gates Foundation? The International Organization for Standardization (ISO) does not mind.



  17. The ISO Delusion: Sirius Open Wash Ltd. and Medical Data/Projects at Risk/Peril

    Sirius ‘Open Source’ was good at gloating about “ISO” as in ISO certification (see our ISO wiki to understand what ISO truly is; ISO certification needs to be more widely condemned and exposed) while signing all sorts of dodgy deals and lying to clients (some, like the Gates Foundation, were never mentioned because of a mysterious NDA); security and privacy were systematically neglected and some qualified as criminal negligence (with fines/penalties likely an applicable liability if caught/reported)



  18. Links 24/01/2023: Wine 8.0 is Ready, FSF Bolsters Copyleft

    Links for the day



  19. Azure Has Layoffs Again, Microsoft Still Cutting

    Even supposed ‘growth’ areas at Microsoft are being culled (this growth is faked, it is a lie)



  20. Links 24/01/2023: Tails 5.9 and ArcoLinux v23.02

    Links for the day



  21. Links 24/01/2023: GStreamer 1.22 and Skrooge Gets New Site

    Links for the day



  22. IRC Proceedings: Monday, January 23, 2023

    IRC logs for Monday, January 23, 2023



  23. The Inside(r) Story of ISO 'Certification' Mills

    Based on my experiences inside Sirius ‘Open Source’ — as I was there for nearly 12 years — I finally tell what I’ve witnessed about ISO certification processes (see ISO wiki for prior experiences)



  24. [Meme] ISO Selling 'Reputation' to Small Businesses (for a Large Fee)

    As we’re hoping to demonstrate throughout the week, ISO certification is, in practice, worse than worthless (just a waste of small businesses’ resources, much like patents); call it the ‘ISO tax’, an artificial barrier to entry that boils down to money



  25. [Meme] ISO Certification for Paying for Certificates on Time

    ISO is a phony authority; it makes business by issuing mostly worthless paperwork that wastes people’s time and accomplishes nothing (except making ISO in rich Switzerland even richer)



  26. The ISO Train Wreck at Sirius 'Open Source'

    Before we proceed to showing how Sirius ‘Open Source’ blatantly ignored security and privacy we wish to show how ISO (see ISO wiki) basically ‘sold’ a certificate to Sirius — this is like a “diploma mill” but something that’s for businesses, not individuals



  27. Sirius Lying About ISO to Justify Giving the Technical Staff Some Classic 'Bullshit Jobs' While Censoring/Covering Up Incompetence

    Sirius ‘Open Source’ has long used “ISO” — and sometimes “GDPR” — as catch-all excuses for all sorts of nonsensical policies; does ISO realise the degree to which it is being misused by incompetent 'box tickers'?



  28. Links 23/01/2023: mozilla.org's 25th Anniversary and IceWM 3.3.1 Released

    Links for the day



  29. Report: The So-called 'Linux' Foundation is Reducing Focus on Linux

    The so-called ‘Linux’ Foundation is reducing its focus on Linux and is instead busy promoting Microsoft, Facebook, and other interests that GNU/Linux users strongly dislike



  30. Links 23/01/2023: Fwupd 1.8.10

    Links for the day


RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts