Bonum Certa Men Certa

“Tens of Thousands of [Microsoft IIS] Sites” Are Being Compromised

Weird poem



Summary: Another live example of Microsoft 'security' at work; debunking the latest Linux lies from Ed Bott

"SECURITY through obscurity" sounds like a good idea in theory. As we recently found out (and had confirmed by Microsoft), part of this obscurity is lack of disclosure. Microsoft is silently patching flaws that it never discloses, which is dishonest if not fraudulent when Microsoft issues security reports based on such oversight.



According to this new article, "tens of thousands of sites" running Microsoft's software are paying the price for having 'secret' vulnerabilities:

There's a large-scale attack underway that is targeting Web servers running Microsoft's IIS software, injecting the sites with a specific malicious script. The attack has compromised tens of thousands of sites already, experts say, and there's no clear indication of who's behind the campaign right now.

The attack, which researchers first noticed earlier this week, already has affected a few high-profile sites, including those belonging to The Wall Street Journal and The Jerusalem Post. Some analyses of the IIS attack suggest that it is directed at a third-party ad management script found on these sites.


This must be the latest example of why nobody gets fired for avoiding Microsoft.

Speaking of Windows security, "Juniper Networks Protects Customers From New Microsoft Vulnerabilities" after Juniper became filled with Microsoft managers [1, 2, 3]. It's just something to bear in mind.

There is some bad FUD about Linux security at the moment (coming primarily from Ed Bott). SJVN has already responded to this FUD:

Here's what really happened. UnrealIRCd, a rather obscure open-source IRC (Internet Relay Chat) server, wasn't so much hacked as the program it was letting people download has been replaced by one with a built-in security hole. Or, as they explained on their site,


Microsoft boosters like Bott have been desperate to show that GNU/Linux is not more secure than Windows. As companies like Google dump Windows for security reasons, Microsoft will carry on with this FUD campaign but rely on peripherals/extensions (like Bott) to do the attacks]. That's just how Microsoft operates when it needs FUD. See the "smoking gun" below.

"As discussed in our PR meeting this morning. David & I have spoken with Maureen O'Gara (based on go ahead from BrianV) and planted the story. She has agreed to not attribute the story to us....

"[...] Inform Maureen O' Gara (Senior Editor Client Server News/LinuxGram) or John Markoff (NYT) of announcement on Aug 28, 2000. Owner dougmil (Approval received from BrianV to proceed)

"Contact Eric Raymond, Tim O'Reilly or Bruce Perrins to solicit support for this going against the objectives of the Open Source movement. Owner: dougmil [Doug Miller]. Note that I will not be doing this. Maureen O'Gara said she was going to call them so it looks better coming from her."

Microsoft uses reporters as attackers

Recent Techrights' Posts

EPO Staff Explains Why It Cannot Issue EPC-Compliant European Patents (in Other Words, Why Many Fake Patents Get Issued)
chaos inside
 
Chris Rutter, Winchester College, Clare College choir, Arm Ltd, underage workers & Debian accidental deaths
Reprinted with permission from Daniel Pocock
Gemini Links 25/02/2024: Blocking Crawlers and Moving to gemserv
Links for the day
IRC Proceedings: Saturday, February 24, 2024
IRC logs for Saturday, February 24, 2024
Over at Tux Machines...
GNU/Linux news for the past day
[Meme] Objective Objection at the EPO
No more quality control
Links 24/02/2024: More Sanctions Against BRICS, Software Patents Squashed
Links for the day
Microsoft's Demise on the Server Side Continues Unabated This Month
Netcraft says so
Bonnie B. Dalzell Explains Her Experience With Richard Stallman
new essay
Gemini Links 24/02/2024: OpenBSD Advocacy and Nonfree Firmware Debated
Links for the day
Mark Shuttleworth & Debian Day Volunteer Suicide cover-up
Reprinted with permission from Daniel Pocock
IRC Proceedings: Friday, February 23, 2024
IRC logs for Friday, February 23, 2024
Over at Tux Machines...
GNU/Linux news for the past day
Links 24/02/2024: EA Planning Layoffs and 'Liquor Regulators Are Seeking Revenge on Bars That Broke Pandemic Rules'
Links for the day
Gemini Links 24/02/2024: In Defense of Boilerplate and TinyWM Broke
Links for the day
Microsoft's Pearls of Wisdom: Layoffs Are Growth
Microsoft boss: layoffs are "long-term growth."
[Meme] Hide the Bodies
hiding EPO's role in funding Lukashenko
Josef Kratochvíl and All the European Patent Organisation's Chiefs (at the Administrative Council Too) Notified That Over 1,000 Members of Staff Demand Action on Patent Quality and Compliance (Industry Too is Alarmed That Many Invalid Patents Get Granted)
Huge corruption
Microsoft Lacks a Solid Strategic Plan Other Than Buying Its Own Stock (and Paying Staff in Shares)
Beware and be cautious of bubbles
Debian trademark canceled
Debian trademark canceled
Links 23/02/2024: Feed Aggregator and 2 Years of Invasion, Alexei Navalny’s Mother Blackmailed
Links for the day
Gemini Links 23/02/2024: Getting 'Sick' of Modern Tech and Deletion of One's Reddit Account
Links for the day
Links 23/02/2024: 227 Microsoft Layoffs Noted in Santa Clara and Disaster in Rivian
Links for the day
IRC Proceedings: Thursday, February 22, 2024
IRC logs for Thursday, February 22, 2024
Over at Tux Machines...
GNU/Linux news for the past day