Bonum Certa Men Certa

Microsoft Deserves a Medal for Being Worst at Security (the Media Deserves a Medal for Cover-up)

posted by Roy Schestowitz on Sep 26, 2023

Subscribe, Registration, Signup

THE mainstream media and Bill Gates-bribed 'media' (like BillBC) probably won't mention it, but some tech- and security-oriented Web sites did mention the latest Microsoft data breach [1-3] and yet another leak of business secrets [4] (i.e. the usual).

There are still corruptible/bribed publishers that quote Microsoft staff like they're security gurus and there's some collective stupidity associated with such a ludicrous narrative.

Apple is hardly better in that regard [5] and Google conflates automatic updates with "security" [6] (you cannot turn these down).

Cybersecurity, as it turns out, is no longer a hot job [7], the White House resorts to more/mere formalities [8] (yet hasn't formulated rules like a Microsoft ban), and proprietary software leaves a mess anywhere is goes [9-10]. Analyses and honeypots in Microsoft-centric sites try to blame underlying frameworks and networks, distracting from the bad programming of proprietary tools [11]. For instance, they like blaming "Go" for malware that's merely written in Go and if it gets onto GNU/Linux systems through holes in proprietary junk like VMware, they try to blame "Linux", not VMware.

If bad (misleading) media becomes the normal, then we should call out and shun it. The click-baiting word slingers have only themselves to blame for the general public becoming cynical about the media.

Related/contextual items from the news:

  1. Microsoft AI Researchers Expose 38TB of Data, Including Keys, Passwords and Internal Messages

    Exposed data includes backup of employees workstations, secrets, private keys, passwords, and over 30,000 internal Microsoft Teams messages.

  2. Microsoft accidentally exposes 38TB of internal data via GitHub repository
    Microsoft Corp. has accidentally made 38 terabytes of internal data, including passwords, publicly accessible through a GitHub repository. The data leak was detailed today by researchers from venture-backed cloud security startup Wiz Inc. The company originally discovered the issue on June 22 and reported it to Microsoft shortly thereafter.
  3. Microsoft AI researchers exposed sensitive signing keys, internal messages

    The 38 TB of data available via GitHub included 30,000 Teams messages and would've allowed an attacker to inject malicious code in AI models.

  4. Alleged Xbox Series X Refresh Revealed in Colossal FTC Court Docs Leak
    Microsoft is dropping the internal Blu-ray drive on the Xbox Series X refresh, upgrading the wireless radios, and improving power effiency.
  5. Apple Patches Three New 0-Day Vulnerabilities Affecting iOS/iPadOS/watchOS/macOS, (Thu, Sep 21st)

    This update patches three already exploited vulnerabilities:
    (1) CVE-2023-41993 Remote code execution in WebKit. This could be used as an initial access vector
    (2) CVE-2023-41992 Privilege Escalation. A follow-up after the initial access was achieved via the first vulnerability
    (3) CVE-2023-41991 Certificate Validation Issue. A malicious app installed via 1 and 2 may be more difficult to detect due to this vulnerability

  6. Google Extends Chromebook Lifespan, Promises 10 Years of Automatic Updates

    Google Chromebooks released from 2021 and onwards will receive automatic updates, including security patches, for 10 years.

  7. On the Cybersecurity Jobs Shortage

    In April, Cybersecurity Ventures reported on extreme cybersecurity job shortage:

    Global cybersecurity job vacancies grew by 350 percent, from one million openings in 2013 to 3.5 million in 2021, according to Cybersecurity Ventures. The number of unfilled jobs leveled off in 2022, and remains at 3.5 million in 2023, with more than 750,000 of those positions in the U.S. Industry efforts to source new talent and tackle burnout continues, but we predict that the disparity between demand and supply will remain through at least 2025.

  8. White House grapples with harmonizing thicket of cybersecurity rules

    The regulatory road to harmonizing regulations for 16 critical infrastructure sectors is long and treacherous one.

  9. Using Hacked LastPass Keys to Steal Cryptocurrency

    Remember last November, when hackers broke into the network for LastPass—a password database—and stole password vaults with both encrypted and plaintext data for over 25 million users?

  10. Security flaws in an SSO plugin for Caddy
    By Maciej Domanski, Travis Peters, and David Pokora We identified 10 security vulnerabilities within the caddy-security plugin for the Caddy web server that could enable a variety of high-severity attacks in web applications, including client-side code execution, OAuth replay attacks, and unauthorized access to resources.
  11. Scanning for Laravel - a PHP Framework for Web Artisants, (Sat, Sep 23rd)

    Today while reviewing my honeypot logs, I noticed an HTTP request for a directory this week I had not noticed before that included Laravel:

Other Recent Techrights' Posts

Over at Tux Machines...
GNU/Linux news
The Myth of an Aging (or Dying) GNU/Linux Leadership
Self-fulfilling prophecies as a tactic?
Links 07/12/2023: More EPO Patents Squashed, More Pfizer COVID-19 Vaccine "Glitches" Found
Links for the day
Still Not 'Canceled'
Ted Ts'o, Jan Kara, Linus Torvalds last month
Google is Googlebombing the Term "Gemini"
Could Google not pick a name that's already "taken"?
Links 06/12/2023: Bitcoin Rebound, China Downgraded by American Firm, Yahoo! Layoffs Again
Links for the day
Shooting the Messenger Using Bribes and Secrecy Bonds
We seem to live in a world where accountability for the rich and well-connected barely exists anymore
Links 06/12/2023: Many More December Layoffs
Links for the day
IRC Proceedings: Tuesday, December 05, 2023
IRC logs for Tuesday, December 05, 2023
PipeWire 1.0: Linux audio comes of age
Once upon a time, serious audio users like musicians and audio engineers had real trouble with Linux
This is How 'Linux' Foundation Presents Linux to the World
Right now it even picks Windows over Linux in some cases
Links 05/12/2023: Microsoft's Chatbot as Health Hazard
Links for the day
There's Nothing "Funny" About Attacking Free Speech and Software Freedom
persistent focus on the principal issues is very important
Professor Eben Moglen Explained How Software Patent Threats Had Changed Around 2014 (Alice Case) and What Would Happen Till 2025
clip aged reasonably well
GNU/Linux Adoption in Africa, a Passageway Towards Freedom From Neo-Colonialism
Digi(tal)-Colonialism and/or Techolonialism are a thing. Can Africa flee the trap?
CNN Contributes to Demolition of the Open Web
Reprinted with permission from Ryan Farmer
Eben Moglen on Encryption and Anonymity
The alternate net we need, and how we can build it ourselves
Yet More Microsofters Inside the Board of Mozilla (Which Has Just Outsourced Firefox Development to Microsoft's Proprietary Prison)
Do you want a browser controlled (and spied on) by such a company?
IRC Proceedings: Monday, December 04, 2023
IRC logs for Monday, December 04, 2023
GNU/Linux Now Exceeds 3.6% Market Share on Desktops/Laptops, According to statCounter
things have changed for Windows in China
Over at Tux Machines...
GNU/Linux news
Links 05/12/2023: Debt Brake in Germany and Layoffs at Condé Nast (Reddit, Wired, Ars Technica and More)
Links for the day