10.29.21

Gemini version available ♊︎

Microsoft: Still a National Security Threat

Posted in Deception, Microsoft, Security at 1:10 am by Guest Editorial Team

Guest article by Mitchel Lewis

Windows ransomware

In 1998 for Computerworld and later in 2001 for PBS’s Frontline, Paul Strassmann, the former CIO of Xerox, NASA, and the DOD, highlighted an interesting analog between agricultural monocultures and software monocultures (monopolies), specifically Microsoft’s, in that they are naturally more susceptible to disease and pests, viruses and hackers if you will, than less prominent alternatives. Strassmann went on to suggest that Microsoft’s overly complex, defective, and vulnerable systems, which have become vastly more complex, defective, and vulnerable since this was written mind you, exacerbated this “monoculture effect” to the point of embodying a new threat to the national security and systematic reliability of our computer-based society.

Microsoft-National-Security-Threat-by-Paul Strassmann

Never one to stay quiet and in response to Strassmann’s monoculture analogy and designation of Microsoft as a national security threat, Microsoft, by way of Steve Lipman and Howard Schmidt, insinuated that “the analysis made in his paper suffers both from a fundamentally flawed assumption and from a series of errors in analyzing the state of computer security and its causes.”. And much like a squid deploying their ink, Microsoft went on to insist that “Computers aren’t potatoes”, and opted to drag this discussion into the ontological weeds with a few buzzwords thrown in for good measure. And everyone pretty much left it at that.

“Given Microsoft’s modern monopoly on botnet, malware, ransomware, virus, and zero-day exploits along with rudimentary brute-force attacks and advanced phishing schemes, none of which is proportional to their market share, it’s painfully evident that Strassmann not only won this debate but that his monoculture analog and his reasoning hold up to this day.”Much to the chagrin of Microsoft though, to say that Strassmann’s analogy and assessments have aged well is an understatement. Given Microsoft’s modern monopoly on botnet, malware, ransomware, virus, and zero-day exploits along with rudimentary brute-force attacks and advanced phishing schemes, none of which is proportional to their market share, it’s painfully evident that Strassmann not only won this debate but that his monoculture analog and his reasoning hold up to this day.

That said, I think enough time has elapsed to confirm that Paul Strassmann is an authority on such matters and that Microsoft is precisely who he said they were. Further and with hindsight in our pocket, it seems as if Microsoft was merely projecting when they said Strassmann’s paper was flawed and that he made errors in analyzing the state of computer security and its causes in light of their 95–99% monopoly on ransomware infections alone and that ransomware is already considered to be a national security threat.

However, this should have been everyone’s assumption by default when a rebuttal is as poorly framed and laden with fallacies as Microsoft’s was presented as a counter-argument to Strassmann. With regard to rhetoric, fallacies of this magnitude are not only smoke signals for bad arguments, but can also be indicative of superior ignorance, zeal, and/or nefarious motives aimed at gaslighting and subverting the truth for profit which is essentially what corporate counsel and PR, Microsoft or otherwise, exists to accomplish.

Monocultures

For example, Microsoft kicks off their rebuttal with a straw man/reduction to absurdity fallacy with a low-key ad hominem attack minced in by stating that Strassmann confused potatoes for computers for the purposes of re-framing his argument into something absurd while discrediting him as confused rather than addressing the validity of his argument; Microsoft didn’t want one bit of that smoke. Meanwhile, Strassmann was merely suggesting that there is an overlap on the Venn Diagram between farms and information systems at scale.

“…Microsoft kicks off their rebuttal with a straw man/reduction to absurdity fallacy with a low-key ad hominem attack…”In the same paragraph, Microsoft also asserted that farms and potatoes are natural systems, which is categorically false, and that there was no option to alter the attributes of potatoes and the like to resist new threats, also false; even GMO foods were already around for a decade by then.

For those unaware, there’s no such thing as a natural farm. All of our food has been genetically engineered by humans via selective breeding over the course of thousands of years to look, feel, taste, smell, and transport to our liking while being cultivated on things called “farms” that have to be vigorously maintained because they are unnatural and constantly under attack by nature. Genetic engineering of food has only sped up this process while giving us a few new tools.

Vulnerabilities

Ironically and as shown to the left, Microsoft goes on to showcase just how little they know about farming by describing the inorganic nature of managing computers in a manner that is eerily similar to that of…farming. And in doing so, Microsoft inadvertently offered further agricultural analogs in support of Strassmann’s monoculture analog.

Call me crazy, but didn’t we engineer our food in a manner that forced it to evolve to our standards? Aren’t farms built, operated, and maintained by teams of skilled people? Don’t farmers and agriculture workers, many of whom have technical and scientific degrees mind you, apply expertise in various specialties, including the security, development, operation, and maintenance of their farms in a hostile environment? Or if a particular crop or patch of land is vulnerable to a specific sort of attack, then can’t farmers also intervene and change those properties in pursuit of profit?

Don’t Sysadmins and the like spend a lot of their time optimizing and doing disease/pest control just as farmers are planning, spraying, weeding, trapping, and crop-dusting? Hell, has anyone else referred to a collection of servers as a server farm? I have, even while working at Microsoft. It’s almost like potatoes and computers are relatable to some extent or something.

“Another glaring problem with their fleet analogy is that it’s hard to see how everyone wouldn’t be dead if we drove cars or flew in planes that were engineered and manufactured by Microsoft given their fast and loose approach to quality.”Adding insult to injury, Microsoft then proceeded to liken their products to that of fleets of trucks and aircraft and that their prominence is the result of “fleet operators” (businesses) flocking to them after being deemed “best of breed”. One immediate problem with this analogy is that it doesn’t take into account Microsoft’s anti-competitive heritage and that is notorious for impeding free markets and grenading merit-based assessments. From their products being designed for maximal lock-in to Microsoft finding all matter of ways to drown out their competition rather than having to meet them on merit alone, Microsoft is built in the image of Bill Gates, for subversion and domination, and appear to be genuinely terrified of an honest, head-on competition.

Another glaring problem with their fleet analogy is that it’s hard to see how everyone wouldn’t be dead if we drove cars or flew in planes that were engineered and manufactured by Microsoft given their fast and loose approach to quality. One consequence of an anticompetitive monopoly, especially in the technology space, is that they have little to no regulations, especially in 1998, don’t have to compete on quality, and consequently have a much higher rate of defect than entities like Boeing or Ford who have far more regulations, competition, and oversight than Microsoft. But if you’re waiting for Microsoft employees to admit their anticompetitive DNA, a monopoly share, or even quality issues plaguing their entire ecosystem then you had better pack a lunch.

Later in this rebuttal, Microsoft exclaimed that when they get exploited, it’s not just Microsoft solutions getting exploited but other interconnected solutions from other vendors too that are necessary to secure Microsoft solutions being exploited before ultimately exploiting Microsoft. While this is absolutely true, most of these vendors are monocultures in their own right, are also Microsoft partners, and are suffering the same fate as Microsoft because of this while others are merely filling Microsoft’s competence gaps. However, none of them have anywhere near the rate of defect, overall complexity, or threat surface as the Microsoft ecosystem. And it’s often the complex architecture of the Microsoft ecosystem itself that necessitates their involvement in the first place. Simpler environments mitigate the necessity of many of these vendors.

Failure-prone code

Digging the hole deeper, Microsoft also insisted that Strassmann was basing his analogy on one virus in the desktop market, the “I Love You” virus to be exact. Besides drawing his critique from a core set of fundamental principles that are apparently omitted from the University of Phoenix curriculum where Schmidt graduated, Strassmann clearly and correctly anticipated similar problems for Microsoft’s Web and cloud ambitions. In fact, almost half of his article on Computerworld covers Microsoft’s ambitions beyond that of the desktop market while neither this article nor his follow-up on PBS’s frontline mentioned Windows by name. Oddly enough, Microsoft appears to be the one focusing on the desktop space, not Strassmann.

“Oddly enough, Microsoft appears to be the one focusing on the desktop space, not Strassmann.”Microsoft went on to say that they’re too heavily invested in the enhancement of the security of their products to even list all of their accolades. One problem with this is that they cannot be invested in maximizing security without also being simultaneously being invested in complexity, cost, defect, and instability reduction. And upon accepting Microsoft’s aforementioned monopoly on <insert attack here> for the past 25 years on top of them consistently offering the most complex, expensive, defective, and unstable solutions available, it’s difficult to dignify such claims without sacrificing one’s credibility in the process.

Microsoft then proceeded to assert that being large simply makes them an easy target and that many of the problems they face would be faced by Linux, Unix, and the like, which is true to some extent. But while Linux and Unix aren’t fool-proof, their rate of exploit per attack is far below that of Windows. This isn’t because they’re attacked less, but because they have open sources and are under constant quality revision from countless perspectives. Meanwhile at Microsoft, source code is a trade secret and SDETs, QAs, and the like are hard to come by, further exacerbating Microsoft’s quality woes.

Microsoft concluded their rebuttal with the following:

Security and responsibility

While the majority of this is unimpeachable, it’s hard to consider Microsoft a strong supplier when it’s mostly just good at getting its way by bullying competition and dragging things out forever in court like some affluenza’d son of a prominent Halliburton attorney instead of simply shipping the best products possible. And this is especially the case when the company was founded by Bill Gates, who is literally the affluenza’d son of a Halliburton attorney whose firm also represented the slimy likes of Wells Fargo, Bank of America, Goldman Sachs, Blackwater, Merrill Lynch, Microsoft, and god knows who else; what a mensch.

In summary and rather than refuting Strassmann’s monoculture analogy, Microsoft ignorantly fortified his stance with their fleet analogy in their counter-argument after invoking several fallacies about Strassmann confusing computers for potatoes. Rather than refuting Strassmann’s assessment that Microsoft’s software monoculture and the horrid approach towards quality has culminated into a national security threat, Microsoft’s offered irrational counter-arguments and a glimpse into the extreme level of ignorance, delusion, and denialism one must embody in order to work at Microsoft, let alone climb its ranks; similar to those within the vatican ignoring the ritualistic rape of children among countless other atrocities.

ransomware-by-system

As far as Microsoft being a national security threat is concerned, given that ransomware has been deemed a national security threat while Microsoft is home to 95–99% of all ransomware attacks, it’s not exactly a reach to saddle Microsoft with part of the blame and designate their systems as threats to national security just as same Strassmann did decades ago. And this argument only becomes more compelling when you begin to consider their monopoly on countless other attacks in the desktop and cloud spaces.

For what it’s worth, I also don’t think it’s a coincidence that the countries exploiting the United States via the Microsoft ecosystem the most, China and Russia, happen to be the same countries migrating away from the Microsoft ecosystem in favor of Linux. Although they’ve never stated their reasoning, I can’t help but think that national security wasn’t a motivational force behind such moves given their international exploits with Windows.

There was some truth to Microsoft’s rebuttal though. They are indeed targeted largely in part due to how big their market share is, but this is equally due to how defective they are. But upon agreeing on this, you can easily mitigate the onslaught of attacks that Microsoft solutions attract by simply migrating away from them to Linux and macOS. Although the entry burden to these alternatives can be high, this is due in part to Microsoft’s lock-in tactics (re: anti-competition), the long-term effect is an IT infrastructure that is less expensive, simpler, more secure, attacked less, and exploited at a lesser rate than anything that slithers down Microsoft’s leg.

I’d act like I’m perplexed by the government’s lackluster response to Microsoft’s blatant monopoly or the threat their systems pose to national security, but just as history teaches us that Strassmann was spot-on, history also shows us that governments all around the world have a penchant for turning a blind eye to the behavior of monopolies, hence why there are so many monopolies at present, and this is especially true of their relationship with Microsoft.

To be fair, it’s easy to see why they do nothing given how successfully regulating Microsoft in a manner they truly deserve, regulating them out of existence, would almost immediately create a multi-trillion dollar burden for the government to modernize IT infrastructure that is presently standardized on Microsoft legacy solutions. Rumor has it that taking Microsoft to court can be quite expensive and time-consuming too.

Besides this, Microsoft’s partner network alone employs over 17 million IT professionals around the world and this doesn’t even account for the majority of privately retained IT professionals in Microsoft-centric positions; many of these jobs would disappear if Microsoft were to be regulated. And let’s also not forget that Microsoft is a defense contractor, biting and scratching for government contracts, and a major IT vendor for the government as a whole and I can’t imagine that regulating bodies don’t consider the impact to the government when evaluating charges.

But without Microsoft being sanctioned and without businesses/government entities being heavily incentivized to migrate to Linux and macOS to balance out the market share, I don’t see Microsoft’s dominance or the threat said dominance poses to the US or anyone else around the world relying on their systems going anywhere anytime soon.

With Microsoft unchecked and given the relationship between cryptocurrency and ransomware, we might have to consider banning cryptocurrency instead. But in doing this, we would only be removing the financial incentive for digital pirates to attack business and government entities who would otherwise remain vulnerable to foreign governments seeking to exploit our weak IT infrastructure for reasons beyond that of immediate financial gain.

However, I’d like to think that Microsoft would get creative if the government were to sanction Microsoft by allowing allow citizens and businesses impacted by ransomware to bill Microsoft for the cost of the ransom and their losses in productivity. And although Microsoft cannot be faulted for the attacks, they can be faulted for their shit-in-hand approach to quality and security while sanctioning them until they actually take a common-sensical approach to quality and security appears to be the simplest means of combating ransomware and mitigating the threat it poses to our national security.

Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Reddit
  • email

Decor ᶃ Gemini Space

Below is a Web proxy. We recommend getting a Gemini client/browser.

Black/white/grey bullet button This post is also available in Gemini over at this address (requires a Gemini client/browser to open).

Decor ✐ Cross-references

Black/white/grey bullet button Pages that cross-reference this one, if any exist, are listed below or will be listed below over time.

Decor ▢ Respond and Discuss

Black/white/grey bullet button If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

DecorWhat Else is New


  1. IRC Proceedings: Tuesday, February 07, 2023

    IRC logs for Tuesday, February 07, 2023



  2. When the Pension Vanishes

    Today we commenced a multi-part mini-series about pensions and what happens when they suddenly vanish and nobody is willing to explain where all the money went



  3. Sirius 'Open Source' Pensiongate: An Introduction

    The Sirius ‘Open Source’ series continues in the form of a mini-series about pensions; it’s part of an ongoing investigation of a deep mystery that impacts people who left the company quite a long time ago and some of the lessons herein are applicable to any worker with a pension (at times of financial uncertainties)



  4. Links 07/02/2023: Endless OS 5.0 and Voice.AI GPL Violations

    Links for the day



  5. No Doubt Microsoft Unleashed Another 'Tay', Spreading Bigotry Under the Guise of Hey Hi (AI)

    Reprinted with permission from Ryan



  6. Links 07/02/2023: Fedora 39 Development Plans Outlines

    Links for the day



  7. IRC Proceedings: Monday, February 06, 2023

    IRC logs for Monday, February 06, 2023



  8. Links 06/02/2023: Escuelas Linux 8.0 and Many Political Issues

    Links for the day



  9. Links 06/02/2023: Sparky 6.6 and IPFire 2.27 – Core Update 173

    Links for the day



  10. Taking Back Control or Seizing Autonomy Over the News Cycle (Informing People, Culling the Marketing)





  11. Reality Versus Fiction: EPO Insiders Versus EPO Web Site and UPC 'Churnalists'

    The "official" sources of the European Patent Office (EPO), as well as the sedated "media" that the EPO is bribing for further bias, cannot tell the truth about this very large institution; for proper examination of Europe's largest patent office one must pursue the interpretation by longtime veterans and insiders, who are increasingly upset and abused (they're being pressured to grant patents in violation of the charter of the EPO)



  12. Links 06/02/2023: Linux 6.2 RC7 and Fatal Earthquake

    Links for the day



  13. IRC Proceedings: Sunday, February 05, 2023

    IRC logs for Sunday, February 05, 2023



  14. Links 05/02/2023: Wayland in Bookworm and xvidtune 1.0.4

    Links for the day



  15. Links 05/02/2023: Pakistan Blocks Wikipedia, Musharraf Dies

    Links for the day



  16. IRC Proceedings: Saturday, February 04, 2023

    IRC logs for Saturday, February 04, 2023



  17. Links 04/02/2023: FOSDEM Happening and Ken Thompson in SoCal Linux Expo

    Links for the day



  18. 2023 is the Year Taxpayers' Money Goes to War and Energy Subsidies, Not Tech

    Now that a lot of powerful and omnipresent ‘tech’ (spying and policing) companies are rotting away we have golden opportunities to bring about positive change and maybe even recruit technical people for good causes



  19. Getting Back to Productive Computer Systems Would Benefit Public Health and Not Just Boost Productivity

    “Smartphoneshame” (shaming an unhealthy culture of obsession with “apps”) would potentially bring about a better, more sociable society with fewer mental health crises and higher productivity levels



  20. Links 04/02/2023: This Week in KDE and Many More Tech Layoffs

    Links for the day



  21. Dotcom Boom and Bust, Round 2

    The age of technology giants/monopolies devouring everything or military-funded (i.e. taxpayers-subsidised) surveillance/censorship tentacles, in effect privatised eyes of the state, may be ending; the United States can barely sustain that anymore and raising the debt ceiling won't solve that (buying time isn't the solution)



  22. Society Would Benefit From a Smartphoneshame Movement

    In a society plagued by blackmail, surveillance and frivolous lawsuits it is important to reconsider the notion of “smart” phone ownership; these devices give potentially authoritarian companies and governments far too much power over people (in the EU they want to introduce new legislation that would, in effect, ban Free software if it enables true privacy)



  23. IRC Proceedings: Friday, February 03, 2023

    IRC logs for Friday, February 03, 2023



  24. IRC Proceedings: Thursday, February 02, 2023

    IRC logs for Thursday, February 02, 2023



  25. Links 03/02/2023: Proton 7.0-6 Released, ScummVM 2.7 Testing

    Links for the day



  26. Links 03/02/2023: OpenSSH 9.2 and OBS Studio 29.0.1

    Links for the day



  27. Links 03/02/2023: GNU C Library 2.37

    Links for the day



  28. Sirius Finished

    Yesterday I was sent a letter approving my resignation from Sirius ‘Open Source’, two months after I had already announced that I was resigning with immediate effect; they sent an identical letter to my wife (this time, unlike before, they remembered to also change the names!!)



  29. The Collapse of Sirius in a Nutshell: How to Identify the Symptoms and Decide When to Leave

    Sirius is finished, but it's important to share the lessons learned with other people; there might be other "pretenders" out there and they need to be abandoned



  30. Links 03/02/2023: WINE 8.1 and RapidDisk 9.0.0

    Links for the day


RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts