Bonum Certa Men Certa

Microsoft Security Negligence Confirmed: Critical Internet Explorer Flaw Known and Ignored for 4 Months



Summary: The newest facts show that Microsoft knowingly refused to fix flaws that led to tremendous damage; lies from Microsoft (about its competition) are refuted as well

IN MANY RECENT posts about Internet Explorer [1, 2, 3, 4, 5, 6, 7, 8], we have pointed out Microsoft's pattern of negligence [1, 2, 3], which always passes costs (damages) to the public. Microsoft should probably be sued for it, rather than make money from it. Microsoft -- like Goldman Sachs -- is making a lot of money out of a crisis caused by its own risk-taking.



Here are some self-explanatory news headlines:

Microsoft lies to your face about browser security

Microsoft’s Head of Security and Privacy in the UK has told TechRadar that people who jump ship from Internet Explorer after the recent spate of bad headlines risk ending up on a less secure browser. With France and Germany both advising a move away from Internet Explorer, things are far from rosy for Microsoft’s browser [...yet] Microsoft’s UK security chief Cliff Evans insists that a non-Microsoft browser is the worse option. “The net effect of switching [from IE] is that you will end up on less secure browser,” insisted Evans. “The risk [over this specific] exploit is minimal compared to Firefox or other competing browsers… you will be opening yourself up to security issues.

Let’s fight FUD with facts…

Vulnerability Report: Mozilla Firefox 3.5.x Unpatched: 0

Vulnerability Report: Google Chrome 3.x Unpatched: 0

Vulnerability Report: Opera 10.x Unpatched: 0

Vulnerability Report: Apple Safari 4.x Unpatched: 0

Vulnerability Report: Microsoft Internet Explorer 6.x Unpatched: 24 Most Critical Unpatched: Extremely critical

Vulnerability Report: Microsoft Internet Explorer 7.x Unpatched: 11 Most Critical Unpatched: Extremely critical

Vulnerability Report: Microsoft Internet Explorer 8.x Unpatched: 4 Most Critical Unpatched: Extremely critical

My recommendation if you use Windows: make sure the version of IE that’s installed (because you can’t uninstall it!) is the latest/least vulnerable (IE8) and then install at least one of the non-IE browsers listed (personally I always recommend Firefox :) and then use THAT. Of course, you could always switch to a Mac or Linux…


Microsoft patches IE, admits it knew of bug last August

As Microsoft patched the Internet Explorer (IE) vulnerability that was used to break into Google's network, it also acknowledged that it had known of the bug since August 2009, when an Israeli security company reported the flaw.


MS knew of Aurora exploit four months before Google attacks

Microsoft first knew of the bug used in the infamous Operation Aurora IE exploits as long ago as August, four months before the vulnerability was used in exploits against Google and other hi-tech firms in December, it has emerged.

Redmond's security gnomes finally got around to patching the exploit on Thursday. the hack attacks against Google et al targeted IE 6, a browser first released in 2001. Exploits involved tricking users of vulnerable browsers into visiting booby-trapped websites. These sites downloaded the Hydraq backdoor Trojan and other malicious components onto compromised PCs.

[...]

A quick search of Secunia's database, via its PSI patching tool, reveals a problem with an unpatched ActiveX control that looks just as bad, for example.


Emergency IE patch goes live as exploits proliferate

Microsoft released an emergency security update for all versions of Internet Explorer on Thursday as attacks exploiting a critical vulnerability in the widely used browser spread to hundreds of websites.

[...]

While some of the sites hosting the attacks were free services that had been co-opted, others appeared to be domains of legitimate companies that had been compromised.

[...]

In an admission that's sure to spark criticism, Microsoft said it learned of the critical bug more than three months ago.

[...]

The unscheduled bulletin fixes a memory corruption flaw in most versions of the widely used browser that allows attackers to execute malicious code simply by luring victims to a booby-trapped website. It fixes seven other privately reported vulnerabilities, some of which also made remote code execution possible, that Microsoft had been planning to issue next month during its next regularly scheduled patch release.

[...]

Systems compromised by the sites reported by Symantec were infected with a backdoor that collected registry settings and other system information and sent it to an email address that was under the control of attackers. That email address has since been disabled, Talbot said.


Widespread Attacks Exploit Newly Patched IE Bug

The first widespread attack to leverage a recently patched flaw in Microsoft's Internet Explorer browser has surfaced.

Starting late Wednesday, researchers at antivirus vendor Symantec's Security Response group began spotting dozens of Web sites that contain the Internet Explorer attack, which works reliably on the IE 6 browser, running on Windows XP. The attack installs a Trojan horse program that is able to bypass some security products and then give hackers access to the system, said Joshua Talbot, a security intelligence manager with Symantec.

Once it has infected a PC, the Trojan sends a notification e-mail to the attackers, using a U.S.-based, free e-mail service that Symantec declined to name.


Make the right browser update: Firefox 3.6

Neolithic Windows security hole alive and well in Windows 7

One of the reasons I've never liked Windows is that it was never made to deal with the security problems of working in a networked, multi-user world. As a direct result, Windows has been fundamentally insecure for more than a decade. Even so, I was surprised to find that there's a 17-year old security hole that's been in Windows since NT and it's still present today in Windows 7.

Wow. Even I'm shocked by this latest example of just how rotten Windows security is. It just reminds me again though that while Microsoft keeps adding features and attempting to patch its way out of security problems to Windows, Windows' foundation is built on sand and not on the stone of good, solid design.

[...]

Be that as it may, the code's still in there. An attacker can trigger the vulnerability through a variety of means. The end-result is, surprise, another Windows machine that's totally owned by the attacker. Once in charge, they can vacuum down your files, install malware, and all the other usual tricks.


Vista 7 was never secure to begin with. See the examples below.

  1. Cybercrime Rises and Vista 7 is Already Open to Hijackers
  2. Vista 7: Broken Apart Before Arrival
  3. Department of Homeland Security 'Poisoned' by Microsoft; Vista 7 is Open to Hijackers Again
  4. Vista 7 Security “Cannot be Fixed. It's a Design Problem.”
  5. Why Vista 7 Could be the Least Secure Operating System Ever
  6. Journalists Suggest Banning Windows, Maybe Suing Microsoft Over DDoS Attacks
  7. Vista 7 Vulnerable to Latest “Critical” Flaws
  8. Vista 7 Seemingly Affected by Several More “Critical” Flaws This Month
  9. Reason #1 to Avoid Vista 7: Insecurity
  10. Vista 7 Left Hijackable Again (Almost a Monthly Recurrence)

Comments

Recent Techrights' Posts

Sheriff of Cork & Debian Edward Brocklesby or Brockelsby Street confusion
Reprinted with permission from Daniel Pocock
Who Is This Backup FOR, the NSA?
As Admfubar put it, "backups for everyone..."
Microsoft's Siege of Libya Coming to an End
One might be tempted to guess the users deleted Windows and installed something else
New Talk by Dr. Richard Stallman Published Two Days Ago By CeSIUM - Centro de Estudantes de Engenharia Informática da Universidade do Minho (Portugal)
The FSF no longer mentions Richard Stallman's talks, but we will
Name the Threats and Threat Actors
Looking back to 2006, there was Novell and gregkh (partly salaried by Microsoft), so these are familiar territories
The "Other" SPLC
You know you're winning the debate when censorship is explored
Microsoft: By Default, Destroy Linux
Here is what the very "polite" Microsoft Boccassi had to say
 
The Open Source Initiative (OSI) is Openwashing, Ben Cotton (Fedora) Acknowledges It, Fails to See How Bribes Led to That
As if... it "just happened"
Microsoft Falling to New Lows in Aruba
Being below 20% in America is the exception, not the norm
Links 25/06/2024: RAM Stress, COVID Graft
Links for the day
Gemini Links 25/06/2024: Hey Hi Punditry and Right to Repair
Links for the day
Links 25/06/2024: Julian Assange Freed From Prison, "AI" Bubble Imploding Some More
Links for the day
Three Points About Julian Assange Plea Deal
There is still a secret problem
[Meme] EFF Became a 'Bunch of Pussies' Working for GAFAM (and Sponsored by GAFAM)
It won't protect people, except very rich people's interests
IBM Does Not Care for the Blind (Wayland Harms Accessibility)
What a punch in the gut
Tux Machines Past 20: Still Thriving
Now 20 years and 2 weeks old
[Meme] Microsoft is Coming /Home
"LOL, REAL SORRY!!!"
Gemini Links 25/06/2024: Old Computer Challenge; An Opinionated GNU/Linux Guide
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Monday, June 24, 2024
IRC logs for Monday, June 24, 2024
IEEE Computer Society on Andrew Tanenbaum, Winner of ACM Award, Who Also Inspired Linux Development
10 years ago
FSF Looking to Raise Money by Adding 200 New Members by July 19
The FSF is in good shape, according to Alexandre Oliva
Not Only Does It Not Add Security... (UEFI as a 'Bug Door')
SecureCore?
Data From Monaco Should Alarm Microsoft
Just how many people are deleting Windows and installing something else this year?
Linux in Central Sahel (Burkina Faso, Mali and Niger)
Vast area, vast number of "Linux users" (if one counts Android as such)
[Meme] Gagging One's Own Staff as a Signal of Corporate Distress
Censorship at Microsoft
Staying the Course
censorship isn't easy against sites that understand ways to resist it
The 'All-Seeing' Microsoft Eye
Microsofters are observing us closely
Links 24/06/2024: Long COVID and "How I Write Blogs"
Links for the day
Allegations That Microsoft is Covering Up Employee Dissatisfaction and Using a Survey to Catch 'Risk' to the Cult Mentality
This favours or gradually socially-engineers a company for sociopathy
'Linux Hint' Inactive for Nearly a Month (It Used to be Very Active)
Their Twitter account hasn't been active for a long time and it's not too clear what's going on
An Unexpected GNU/Linux Trend
Burkina Faso is changing and not just politically
Android (Linux) at New Highs in Burkina Faso, Now Measured at 72% (Windows Was Measured at 98% 15 Years Ago)
based on this month's estimates
With 0.76% for ChromeOS and 3.7% for GNU/Linux (4.5% Total) Burkina Faso Approaches 5% for 'Linux'
More if one counts Android as "Linux"
Gemini Links 24/06/2024: Being Dull and OpenSSH Autoban
Links for the day
EPO Issues in The Hague
a report dated 4 days ago about a meeting that took place 12 days ago
[Meme] Garbage in, Garbage Out (EPO Patent Quality)
"Get back to work"
When the Employer Makes You Too Sick to Go to Work (New EPO Document)
"registering when you are sick"
Perens on a Stick
Remember what Novell did and how few (barely anyone) sided with Novell
Andrew Tanenbaum Gets an Award for His Work on MINIX
ACM one week ago
Twitter's Fall to Irrelevancy in Europe
Musk bought a dud
[Meme] 'Useless' Kids of EPO Examiners
malnourished?
Granting Loads of Monopolies in Europe (to Foreign Corporations of Epic Size and Far Too Much Power Inside Europe) is Vastly More Important Than Raising European Kids Properly?
"Efficiency" first? Whose? Corporations or families? No wonder so many young families are hesitant to have any kids these days; that's particularly true in east Asia and also in north America, not just Europe
[Meme] Putin's Red Flags
Firefox ESR or Firefox USSR
The Corporate/Mainstream Media and Even Social Control Media is Distorting the Record About What Mozilla Actually Did (It Originally Surrendered to Vladimir Putin)
Mozilla being avoided for purely technical reasons (sites not being compatible with it) is one thing. Foolishly, Mozilla is giving people more political reasons to also shun Mozilla. This is suicide.
GNU/Linux Up Some More This Morning, Windows Down Sharply Even in Rich Countries
Microsoft is in trouble in the Muslim world
United Arab Emirates (UAE) Rising... Towards 5% for ChromeOS and GNU/Linux
the latest numbers show it growing from about 0.1% to around 2.4% for GNU/Linux, plus 2.01% for Chromebooks (ChromeOS), i.e. about 5% in total.
Techrights in the Coming Decade: The Free Speech (Online) Angle
Free speech is a fundamental tenet of a free society
Links 24/06/2024: New Research, New Attacks on Justices Sceptical of Patent Maximalists, European Commission for Copyright Maximalists
Links for the day
[Meme] 12 Years a Fedora Volunteer
IBM gives me a 'free' Fedora badge as recognition
IBM Slavery: Not a New Problem
When IBM got rid of Ben Cotton it showed the world how much it valued Fedora
Why They Want to Abolish Master/Slave Terminology (Because This is What They're Turned Free Software Into)
It used to be about community; GAFAM turned that into exploitation and worse
Roy and Rianne's Righteously Royalty-free RSS Reader (R.R.R.R.R.R.) Version 0.2 is Released
They say summer "officially" started some days ago
Torvalds' Number Two Quit Linux a Decade Ago and Has Since Then Earned an Honorary Doctorate
Revisiting Fuzix and Alan Cox
GNU/Linux Reaches All-Time High in Tunisia
Based on statCounter
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Sunday, June 23, 2024
IRC logs for Sunday, June 23, 2024
Edward Brocklesby (ejb) & Debian: Hacking expulsion cover-up in proximity to Oxford and GCHQ
Reprinted with permission from Daniel Pocock
You Know the Microsoft Products Really Suck When...
"Qualcomm and Microsoft go 'beyond the call of duty' to stop independent Copilot+ PC reviews"
IBM and "Regime Change"
Change of regime is not the same as freedom
Microsoft Windows in Nicaragua: From 98% to Less Than 25%
Operating System Market Share Nicaragua
Techrights in the Coming Decade: The Community Angle
Somebody needs to call them out on their BS
Techrights in the Coming Decade: The Software Angle
Gemini Protocol has just turned 5 - i.e. roughly the same age as our Git repositories
Techrights in the Coming Decade: The Patent Angle
Next month marks 10 years since we began covering EPO leaks
Wookey, Intrigeri, Cryptie & Debian pseudonyms beyond Edward Brocklesby
Reprinted with permission from Daniel Pocock
[Meme] Choice Versus Freedom
So When Do I Start Having Freedom? Freedom is choice between the GAFAMs
Digital Liberation of Society at Times of Armed Conflicts and Uncertainty
We have technical contributions, not just written output
Links 23/06/2024: More Microsoft Cancellations, Growing Repression Worldwide
Links for the day
Gemini Links 23/06/2024: The Magician and the Hacker, tmux Tips
Links for the day
Links 23/06/2024: Twitter/X Wants Your Money, Google Reports a Billion DMCA Takedowns in Four Months
Links for the day
Digital Restrictions (Like DRM) Don't Have Brands, We Need to Teach People to Hate the Underlying Restrictions, Not Companies That Typically Come and Go
Conceptually, the hens should fear humans, not the farmer who cages them
Going Above 4% Again
Maybe 4% (or above) by month's end?
[Meme] Debian's 'Cannon Fodder' Economics
Conflicts of interest don't matter
Conviction, jail for Hinduja family, Debian exploitation comparison
Reprinted with permission from Daniel Pocock
According to Microsoft, It's Not a Code of Conduct Violation to Troll Your Victims Whose Files You Are Purging
The group of vandals from Microsoft think it's "funny" (and for a "nominal fee") to troll Microsoft critics
Microsoft Inside Debian is Sabotaging Debian and Its Many Hundreds of Derivatives With SystemD (Microsoft/GitHub Slopware With Catastrophic Bugs is Hardly a New Problem)
What is the moral of the story about The Scorpion and the Frog?
Links 23/06/2024: Hey Hi (AI) Scrapers Gone Very Rogue, Software Patents Squashed at EPO
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Saturday, June 22, 2024
IRC logs for Saturday, June 22, 2024
Gemini Links 23/06/2024: LoRaWAN and Gemini Plugin for KOReade
Links for the day