01.15.10
Microsoft Flaws — Not Adobe Flaws — Responsible for China’s Attack on Google; Microsoft Takes China’s Side, as Usual
Summary: Microsoft’s very special relationship with another suppressive entity and the blame games in China’s crack attack
LAST NIGHT we showed that Microsoft Windows zombies were responsible for the attacks on Google. There are hundreds of millions of such zombie PCs and according to IDG, “DDoS Attacks Are Back (and Bigger Than Before)”
Distributed denial-of-service (DDoS) attacks are certainly nothing new. Companies have suffered the scourge since the beginning of the digital age. But DDoS seems to be finding its way back into headlines in the past six months, in thanks to some high-profile targets and, experts say, two important changes in the nature of the attacks.
The targets are basically the same — private companies and government websites. The motive is typically something like extortion or to disrupt the operations of a competing company or an unpopular government. But the ferocity and depth of the attacks have snowballed, thanks in large part to the proliferation of botnets and a shift from targeting ISP connections to aiming legitimate-looking requests at servers themselves.
IDG also shows that the attack on Google relies on Microsoft flaws (page rendering as malicious execution and the notion of clicking attachments to execute data files). “Adobe may be off the hook,” says this report:
IE Exploit Used to Launch Chinese Attacks on Google
[...]
Early speculation focused on the Abobe Reader zero-day exploit as the source of the Chinese attacks on Google and other corporations earlier this week, but Adobe may be off the hook–or at least share the blame. Microsoft has determined that an unknown flaw in Internet Explorer was one of the holes used to launch the attacks which have led to Google threatening to shut down its Chinese operations.
To Google, there is no real solution here; to leave China would be a case of staging a protest, but it would neither secure Google nor be practicable.
Here’s an interesting scenario: If Google does stick to its guns and leaves China because the country continues to insist on censoring web search results and blocking websites, will it also pull Android cellphones from the Chinese market?
Let’s not forget that Google relies on cheap Chinese workforce to make its profitable products (like phones and appliances). The West is generally far too dependent on Chinese labour and export.
Microsoft — not surprisingly — has no problem with what China is doing and as IDG’s Erik Larkin puts it, to Microsoft it’s just another technical case of patches (never mind if exploiters/crackers are supported by the Chinese government). Microsoft does not even address the problem immediately, so in the mean time it just externalises the costs, also to Google and Google’s clients.
Ballmer: Microsoft Will Stay in China
Microsoft does not plan to follow Google’s lead in pulling out of China, the software giant’s CEO told news outlets on Thursday.
Like China, Microsoft China disregards copyright law and Microsoft has special relationships in China. McCain (of the Republican party) comes to mind here; Bill Gates is a friend of the China regime and McCain recommended Steve Ballmer for the Chinese ambassador position. Microsoft and China are similar in many ways; neither tolerates contest and they both repress clients/citizens. Microsoft removes its competition — including GNU/Linux and Apple — from search results, as systematically proven before.
One of our readers, who is more of a hardliner by some people’s judgment, wrote to us the following:
Contempt, perjury or treason?
http://www.theinquirer.net/inquirer/news/…
http://news.cnet.com/China-looks-into…
http://www.maximumpc.com/article/…Add to that the incident where Gates intercepted China’s President Hu, which Hu went along with, on his first official visit in office to the United States.
http://windowsitpro.com/article/…
Maybe Gates’ recent visit to the Whitehouse was about pleading for his life more than about begging for a too-big-to-fail corporate welfare handout.
http://www.theregister.co.uk/2000/…
title=”http://www.aaxnet.com/news/M000714.html
http://windowsitpro.com/article/articleid/18007/…
http://www.dailymail.co.uk/news/article-…
http://www.cnn.com/2007/US/11/30/china.us/…
http://www.navytimes.com/news/2008/01/…Seriously, could Osama bin Laden himself arranged better? If it doesn’t beat all that Gates and his minions aren’t even hiding in caves. The perpetraitors {sic} are still on free foot and even getting puff-pieces in the media. There is some corrective action:
http://mae.pennnet.com/display_article/…
http://www.fcw.com/Articles/2008/03/06…There are at least three sides to the cyberwar that started last year: China, Microsoft and the US. The first two appear to be in an uneasy aliance to bring down the third after which the first will easily take down the second.
More thoughts would be welcome. Views are not being suppressed. █
Yuhong Bao said,
January 15, 2010 at 4:40 pm
“Microsoft Flaws — Not Adobe Flaws”
It is MS AND Adobe flaws, and Google isn’t the only one attacked by China, BTW.
Roy Schestowitz Reply:
January 15th, 2010 at 4:44 pm
I didn’t say it was only Google (see yesterday’s post) and IDG says it’s IE/Windows.
Yuhong Bao Reply:
January 15th, 2010 at 4:53 pm
OK, I have read the source, and I know what it is coming from now, and I know the logic behind it. I am thinking of posting it as a comment to the original source too. AFRIK often targeted attacks like this one use multiple exploits.
Roy Schestowitz Reply:
January 15th, 2010 at 5:08 pm
Flaws are a complicated issue but monoculture helps it a lot.
Yuhong Bao said,
January 15, 2010 at 4:45 pm
“(page rendering as malicious execution and the notion of clicking attachments to execute data files)”
Is the latter really a Microsoft flaw? In fact, the former is not really a MS-specific flaw, it is just in this case it happened in MS code, so MS can indeed be blamed.
Roy Schestowitz Reply:
January 15th, 2010 at 4:49 pm
In UNIX/Linux, execution is very restricted. See the recent flamewar at Fedora.
Yuhong Bao Reply:
January 15th, 2010 at 5:02 pm
OK, I get that UNIX has an execute permission bit, and that it is indeed a real advantage over Windows that you could point out.
Roy Schestowitz Reply:
January 15th, 2010 at 5:09 pm
Here is Nicholas Petreley’s excellent report on the subject:
http://www.theregister.co.uk/2004/10/22/security_report_windows_vs_linux/