EditorsAbout the SiteComes vs. MicrosoftUsing This Web SiteSite ArchivesCredibility IndexOOXMLOpenDocumentPatentsNovellNews DigestSite NewsRSS

12.03.07

FUD Alert: Microsoft’s Jeff Jones Aims His Lying Pistol at Firefox (Updated)

Posted in FUD, GNU/Linux, Security, Windows at 3:09 pm by Dr. Roy Schestowitz

More lies reveal new fears

Jim Powers wrote to point out this bit from Glyn Moody:

So, Microsoft refers to a report that just happens to be written by one of its employees, but without mentioning that fact.

This isn’t exactly new (Matt Asay pointed this out a couple of days ago), but it connects nicely to our observation that Microsoft uses its internal people and various hired ‘analysts’ to deceive the public. More on that in a moment, but first, here’s Asay’s take.

It’s a convenient fiction that buying everything from one vendor makes life easier. It may make installation and integration between programs easier, but that ease leads to single points of failure. Hijacking a browser is nice, but using the browser to dig deep into the OS, to have that hijacking facilitated by a too-close tie between the browser and the OS? Even better.

For reasons that were briefly mentioned a couple of days ago, Microsoft likes to hide its patches (or simply not patch at all) in order to keep up appearance. There are some recent examples of this, e.g.:

1. Skeletons in Microsoft’s Patch Day closet

This is the first time I’ve seen Microsoft prominently admit to silently fixing vulnerabilities in its bulletins — a controversial practice that effectively reduces the number of publicly documented bug fixes (for those keeping count) and affects patch management/deployment decisions.

2. Beware of undisclosed Microsoft patches

Forget for a moment whether Microsoft is throwing off patch counts that Microsoft brass use to compare its security record with those of its competitors. What do you think of Redmond’s silent patching practice?

Then, consider the invalidity of patch count.

Sorry, but Microsoft’s self-evaluating security counting isn’t really a good accounting.

[...]

The point: Don’t count on security flaw counting. The real flaw is the counting.

Only days ago, the weaknesses of Internet Explorer security were mentioned in the following article.

When Didier Stevens recently took a closer look at some Internet Explorer malware that he had found, something surprised him somwehat. He discovered that the IE-targeted malware had been obfuscated with null-bytes (0×00) and when run against VirusTotal, he found that fewer than half of the products identified the sample as malware (15 of 32). When all null-bytes were removed, the chances of successful detection improved, though not as much as would normally be expected (25 of 32 detections).

Going further back you’ll find that IE7 has already been the victim of quite a lot of “critical” flaws (the highest level of severity, which compromises the operating system remotely, with or without user intervention). Examples include:

1. Code posted for Internet Explorer attack

“This type of vulnerability has been very popular with malicious attacks in the past, and we expect to see its usage increase substantially, now that exploit code is publicly available,” security vendor Websense. warned in a note published Monday.

2. Microsoft probes possible IE 7 phishing hole

The vulnerability relates to the message IE displays when Web page loading is aborted, Raff wrote. An attacker can rig the message by creating a malicious link. The message will offer a link to retry loading the page; hitting it brings up the attacker’s page, but showing an arbitrary Web address, he wrote.

3. Critical IE Graphics Flaw Resurfaces

It’s bad enough when crooks exploit bugs to ruin a home computer, but the consequences of a successful attack can be much worse. A substitute teacher in Norwich, Connecticut, found that out when a computer she was using in her classroom suddenly started showing pornographic pop-up ads to everyone in the class. She now faces up to 40 years in prison after being convicted of willfully showing her students the images. A security expert hired by her defense, however, says he found malicious software on the PC.

4. Monthly Microsoft Patch Hides Tricky IE 7 Download

Opinion: Microsoft used the January 2007 security update to induce users to try Internet Explorer 7.0 whether they wanted to or not. But after discovering they had been involuntarily upgraded to the new browser, they next found that application incompatibility effectively cut them off from the Internet.

5. Attack code out for ‘critical’ Windows flaw

All recent versions of Windows are vulnerable when all recent versions of IE, including IE 7, are in use, according to Microsoft.

6. IE7 ‘critical update’ causes headaches for managed desktop environments

As many organisations may not feel compelled to turn off automatic updates, they should be prepared to face this is issue when Internet Explorer 7 is downloaded and installed automatically.

7. IE 7 bugs abound

“But browser testers may already be at risk, according to security researcher Tom Ferris. Late Tuesday, Ferris released details of a potential security flaw in IE 7. An attacker could exploit the flaw by crafting a special Web page that could be used to crash the browser or gain complete control of a vulnerable system, Ferris said in an advisory on his Web site. Microsoft had no immediate comment on Ferris’ alert.”

8. Information disclosure bug blights IE7 release

The flaw stems from error in the handling of redirections for URLs with the “mhtml:” URI handler. Security notification firm Secunia reports that the same bug was discovered six months ago in IE6 but remains unresolved.

9. IE Used to Launch Instant Messaging and Questionable Clicks

First of all, you need to visit an infection site using Internet Explorer – this exploit doesn’t work in Firefox, for example.

10. IE Exploit Could Soon Be Used By 10,000-plus Sites

First reported by Florida-based Sunbelt Software Tuesday, the bug has already been used to compromise PCs and load them with scores of adware and spyware programs, as well as other malicious code. Users surfing with IE 6 and earlier can be infected simply by viewing the wrong site.

11. Russian sites using new IE bug to install spyware

This is the second unpatched flaw found in IE over the past week. On Sept. 14, researchers posted code that could be used to exploit a different vulnerability in a multimedia component of the Web browser. Microsoft is still investigating that flaw and is not saying whether it too will be patched next month.

12. Seen in the wild: Zero Day exploit being used to infect PCs

The exploit uses a bug in VML in Internet Explorer to overflow a buffer and inject shellcode. It is currently on and off again at a number of sites.

Security researchers at Microsoft have been informed.

13. Attack code targets new IE hole

Computer code that could be used to hijack Windows PCs via a yet-to-be-patched Internet Explorer flaw has been posted on the Net, experts have warned.

Then, come to consider some comparisons, e.g.:

1. Which Is Safer: Internet Explorer 7 or Firefox 2.0

In the SmartWare test, Microsoft’s Internet Explorer 7 blocked 690 known phishing sites, or 66.35 percent of the total. In contrast, Firefox blocked 78.85 percent when using a local antiphishing database and 81.54 percent when using the online database.

2. Firefox Still Tops IE for Browser Security

“Mozilla is forthcoming about vulnerabilities,” Levy said, whereas “it takes Microsoft far longer to acknowledge vulnerability.”

How much longer? “In the last reporting period, the second half of last year, Microsoft had acknowledged 13 vulnerabilities. We’ve now revised it to 31. The difference is that now Microsoft has acknowledged these vulnerabilities.”

[...]

“Mozilla can turn around on a dime,” Levy said. “Open-source programmers can recognize a problem and patch it in days or weeks.”

And as for Microsoft?

“If a vulnerability is reported to Microsoft, Microsoft doesn’t acknowledge it for at least a month or two. There’s always a certain lag between knowing about a bug and acknowledging it,” Levy said.

Other recent articles state that Firefox may have its weak points, but often they are the result of attempts to mimic IE functionality on Windows, which means that the fragile layer is the operating system, not just the Web browser. On operating systems security, consider the following articles from the past year:

The great value of GNU/Linux is something that Microsoft itself cannot deny. In fact, it wasn’t long ago that it was ‘caught’ praising it. Microsoft’s campus is full of Linux devices that the company is happy with.

What the press statement didn’t mention is that Aruba mobility controllers run the Linux operating system which Microsoft has aggressively targeted as being inferior to Windows as part of its “Get the Facts” marketing campaign.

[...]

Pandey’s appraisal of Aruba’s technology is in stark contrast to Microsoft’s “Get the Facts” rhetoric which places Windows as a more secure, and higher-performing choice over Linux.

Let’s not forget that for many years, Microsoft has run its Web sites behind the Akamai clusters that are all GNU/Linux. As evidence, consider this recent blog post that contains a screenshot.

Microsoft has also bought companies whose entire infrastructure is based on GNU/Linux and Free software. Examples include the recent acquisition of Newsvine:

The funny thing is, The site is hosted on Debian Linux…

There is also the $6 billion acquisition of aQuantive:

This month’s announcement by Microsoft to acquire digital marketing services firm aQuantive has revealed little on how the companies will integrate their IT, but inside information indicates the deal may be Redmond’s largest commitment to free software.

[...]

Whether the businesses are complementary or not, Microsoft’s integration work will no doubt involve a lot of open source software used by aQuantive.

Information available from Atlas’ Web site indicates the Internet software company employs extensive use of open source software including Linux, Apache, MySQL, and Solaris.

Software engineers at Atlas’ Raleigh office do client/server development in C and C++, software maintenance and “scripting”, and developing and maintaining custom reporting capabilities.

Remember Hotmail, which ran a BSD for several years after Microsoft had acquired it? There are many more examples, but they would make this post extremely long.

”While Microsoft controls the media, buys the media, and even buys voices on the Internet, nobody can be trusted.“As promised, returning to the original point of this post, Microsoft can deny the truth all it wants, but we ought to judge things for ourselves. While Microsoft controls the media, buys the media, and even buys voices on the Internet, nobody can be trusted. The antitrust exhibit known as “Effective Evangelism” [PDF] shows that Microsoft has for a long time intended to hire analyst whose output only appears to be independent. One need only look a month back for a live demonstration.

Going a year into the past, Redmond Kool-Aid seems likely to have played a role in another story which turned out to be an anti-Firefox lie. It did a lot of damage even after it was called a lie, by admission of the claim’s own so-called ‘hacker’. More information here.

Lately, I read the headline: “Open Source browser Firefox is so critically flawed that it is impossible to fix, according to two hackers.” Further on, in the ZDNet article I read: “The hackers claim they know of about 30 unpatched Firefox flaws. They don’t plan to disclose them, instead holding onto the bugs.”

Since that sounds suspicious, I decided to start searching for connections with MS. Easy enough, here it is…

So, as you can see, the anti-Mozilla Firefox crusade has roots in the past. It remains to be seen how the media will respond to Microsoft’s latest attempt to spread Firefox FUD.

Update: A Mozilla senior, who is also a former Microsoft employee, spills the beans on Microsoft and reveals more information about the deception mentioned above.

This is a small subset of all the vulnerabilities, because the vulnerabilities that are found through the QA process and the vulnerabilities that are found by the security folks they engage as contractors to perform penetration testing are fixed in service packs and major updates. For Microsoft this makes sense because these fixes get the benefit of a full test pass which is much more robust for a service pack or major release than it is for a security update.

Share this post: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Digg
  • del.icio.us
  • Reddit
  • co.mments
  • DZone
  • email
  • Google Bookmarks
  • LinkedIn
  • NewsVine
  • Print
  • Technorati
  • TwitThis
  • Facebook

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

What Else is New


  1. Recognising the Death of Software Patents, Microsoft's Largest Ally in India Belatedly Joins the Linux-Centric Open Invention Network

    With the demise of software patents come some interesting new developments, including the decision at Infosys — historically very close to Microsoft and a proponent of software patents — to join the Open Invention Network (OIN)



  2. LG Not Only Suing Rivals Using Patents But is Also Passing Patents for Trolls Like Sentegra to Sue

    LG gives yet more reasons for a boycott, having just leveraged not just patents but also patent trolls in a battle against a competitor



  3. March 29th: The Day the Unitary Patent (UPC) Died

    Stating the obvious and proving us right amid Article 50 débâcle



  4. Kongstad and Battistelli Have Staged a Coup at the European Patent Organisation (EPO)

    Discussion about Battistelli and his chinchilla denying national representatives their rights and power to oust Battistelli, who is rapidly destroying not just the Office but also the whole Organisation, Europe's reputation, and the image of France



  5. Europe as the World's Laughing Stock When it Comes to Patent Quality/Scope and the Coming Appeals

    Criticism and embarrassing coverage for the EPO, which has just decided to grant patents even on genome, in defiance of a lot of things



  6. Links 29/3/2017: End of Linux Action Show, Top NSA Partner Pays Linux Foundation

    Links for the day



  7. In Attempt to Promote the Horrific UPC (Poor Quality of Patents Everywhere), Minnoye and Casado Cerviño Attack Their Own Staff for Saying the Truth

    An attack on truth itself -- the disintegration of the European Patent Office (EPO) -- carries on, after staff found the courage to tell delegates what had happened due to Battistelli's policies and incredible oppression that prevails and expands



  8. Another Likely Casualty of the Battistelli Regime at the EPO: Validity of Decisions of Terrified Boards of Appeal Judges

    Under pressure and habitual intervention from a demoralising, overreaching, and out-of-control President (from an entirely different division), examiners and judges 'normalise' the practice of granting patents on genetics -- a very slippery slope in terms of patent scope



  9. Benoît Battistelli 'Pulls an Erdoğan' Faster Than Erdoğan

    An explanation of what the imminent departure of Minnoye (this summer) will mean for Benoît Battistelli and his confidants, who now resemble some of the world's most ruthless dictatorships



  10. With Important Supreme Court Decisions Looming, Mainstream Media Tackles Patent Trolls

    The US Supreme Court (SCOTUS) will soon rule on TC Heartland and Lexmark, potentially restricting abusive patent behaviour even further (making room for freedom to innovate and for competition)



  11. IAM Magazine is Very Blatantly Promoting Patent Trolls and Their Agenda

    IAM Media, which produces a magazine every now and then while posting online every day, maintains its pro-trolls agenda, which is becoming so clear to see that it is definitely worth documenting yet again



  12. A “Perfect Recipe for Fraud” at the European Patent Office (EPO)

    How the world's leading patent office became a world-leading source of abuse, corruption, nepotism, injustice, incompetence, censorship, alleged bribery, pure deception, distortion of media, defamation, and suicides (among many other things)



  13. Techrights Was Right About the Unitary Patent (UPC)

    No Unified Patent Court in the UK and probably nothing like it in the rest of Europe any time soon (if ever)



  14. Patents on Life and Patents on Software Serve to Show That EPO Patent Quality Fell Well Behind the US (PTO)

    Anything goes at the EPO, except dissent; any patent application seems to be grantable, provided one uses simple tricks and persists against overworked examiners who are pressured to increase so-called 'production'



  15. Links 28/3/2017: Linux 4.11-rc4 Kernel Released, Red Hat Surge on Sales

    Links for the day



  16. The Crook Goes to Brussels to Lie About the Unitary Patent (UPC)

    The person who spent years lying about the UPC and severely attacking critics (usually by blatantly lying about them) goes to Brussels for another nose extension



  17. The EPO's HR Roadmap Retrospective

    A look back at the terrible ‘accomplishments’ of the Jesper Kongstad-led Administrative Council, which still issues hogwash and face-saving lies, as one might expect from a protector of Battistelli that lies to national representatives and buries inconvenient topics



  18. Links 26/3/2017: Debian Project Leader Elections, SecureDrop and Alexandre Oliva FSF Winners

    Links for the day



  19. His Master's Voice, Jesper Kongstad, Blocks Discussion of Investigative and Disciplinary Procedures at the EPO

    The Chairman of the Administrative Council of the European Patent Organisation is actively preventing not just the dismissal of Battistelli but also discussion of Battistelli's abuses



  20. Heiko Maas and the State of Germany Viewed as Increasingly Complicit in EPO Scandals and Toxic UPC Agenda

    It is becoming hard if not impossible to interpret silence and inaction from Maas as a form of endorsement for everything the EPO has been doing, with the German delegates displaying more of that apathy which in itself constitutes a form of complicity



  21. With IP Kat Coverage of EPO Scandals Coming to an End (Officially), Techrights and The Register Remain to Cover New Developments

    One final post about the end of Merpel’s EPO coverage, which is unfortunate but understandable given the EPO’s track record attacking the media, including blogs like IP Kat, sites of patent stakeholders, and even so-called media partners



  22. Everyone, Including Patent Law Firms, Will Suffer From the Demise of the EPO

    Concerns about quality of patents granted by the EPO (EPs) are publicly raised by industry/EPO insiders, albeit in an anonymous fashion



  23. Yes, Battistelli's Ban on EPO Strikes (or Severe Limitation Thereof) is a Violation of Human Rights

    Battistelli has curtailed even the right to strike, yet anonymous cowards attempt to blame the staff (as in patent examiners) for not going out of their way to engage in 'unauthorised' strikes (entailing dismissal)



  24. Even the EPO's Administrative Council No Longer Trusts Its Chairman, Battistelli's 'Chinchilla' Jesper Kongstad

    Kongstad's protection of Battistelli, whom he is supposed to oversee, stretches to the point where national representatives (delegates) are being misinformed



  25. Thanks to Merpel, the World Knows EPO Scandals a Lot Better, But It's a Shame That IP Kat Helped UPC

    A look back at Merpel's final post about EPO scandals and the looming threat of the UPC, which UPC opportunists such as Bristows LLP still try hard to make a reality, exploiting bogus (hastily-granted) patents for endless litigation all around Europe



  26. EPO Critics Threatened by Self-Censorship, Comment Censorship, and a Growing Threat to Anonymity

    Putting in perspective the campaign for justice at the EPO, which to a large degree relies on whistleblowers and thus depends a great deal on freedom of the press, freedom of speech, and anonymity



  27. Links 25/3/2017: Maru OS 0.4, C++17 Complete

    Links for the day



  28. Judge and Justice Bashing in the United States, EPC Bashing at the EPO

    Enforcement of the law based on constitutional grounds and based on the European Patent Convention (EPC) in an age of retribution and insults -- sometimes even libel -- against judges



  29. Looking for EPO Nepotism? Forget About Jouve and Look Closely at Europatis Instead.

    Debates about the contract of Jouve with the EPO overlook the elephants in the room, which include companies that are established and run by former EPO chiefs and enjoy a relationship with the EPO



  30. Depressing EPO News: Attacks on Staff, Attacks on Life, Brain Drain, Patents on Life, Patent Trolls Come to Germany, and Spain Being Misled

    A roundup of the latest developments at the EPO combined with feedback from insiders, who are not tolerating their misguided and increasingly abusive management


CoPilotCo

RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

CoPilotCo

Recent Posts