RE: [Full-Disclosure] Microsoft and Security

From: Nancy Kramer (nekramer_at_mindtheater.net)
Date: 06/29/04

  • Next message: Steve Kudlak: "Re: [Full-Disclosure] Wanted: Sasser executable and derivatives" 
    To: "Burnes, James" <james.burnes@gwl.com>, <1@malware.com>, <bugtraq@securityfocus.com>
Date: Mon, 28 Jun 2004 20:09:45 -0400

    There are lots of sites written only for IE or clones of IE like
    Opera. Some large sites are written only for late model IEs. Many are
    from large companies. Big business thinks MS is the state of the art and
    the only way to go for business. You have a choice do it their way or
    don't get the benefits of their web site. They play to the user who has
    AOL, uses only IE and Outlook with all the defaults on because if MS does
    it it must be right and they really have no interest in changing things or
    knowing about them. People believe they are protected by big companies
    like MS. They are fools but then like a friend of mine always says
    "business people are stupid".

    They believe that the US government should protect them from hackers and
    spam. That cannot be done but they don't understand that and neither do
    the US legislators.

    Regards,

    Nancy Kramer
    Webmaster http://www.americandreamcars.com
    Free Color Picture Ads for Collector Cars
    One of the Ten Best Places To Buy or Sell a Collector Car on the Web

    At 05:23 PM 6/28/2004, Burnes, James wrote:
    >Well, this is an predictable, but interesting quote from IDefense...
    >
    >[IDefense linked the malicious attacks to a group by a different name
    >called the hangUP team, also from Russia and also believed to be
    >responsible for the recent string of Korgo worms, Dunham said.
    >
    >"These are hackers for hire and they commoditize every piece of
    >information they capture. This was a very complicated and sophisticated
    >attack," he said.
    >
    >Security experts were still trying to determine Friday how IIS servers
    >were compromised and whether applying the latest patches for IIS and
    >Internet Explorer would protect users from the attacks.
    >
    >"My gut feeling is (patching) doesn't protect you," Dunham said. "If I
    >were a home user, I'd consider using another Web browser, like Mozilla,
    >until a patch comes out," he said.] (nwfusion - 06/25/2004)
    >
    >Well, of course. By why go back to IE unless someone wrote apps that
    >only run on IE and what's the point of that. Might as well write them
    >in VB.
    >
    >jim burnes
    >security engineer
    >great-west, denver
    >
    >
    > > -----Original Message-----
    > > From: full-disclosure-admin@lists.netsys.com [mailto:full-disclosure-
    > > admin@lists.netsys.com] On Behalf Of http-equiv@excite.com
    > > Sent: Friday, June 25, 2004 9:41 AM
    > > To: bugtraq@securityfocus.com
    > > Cc: NTBugtraq@listserv.ntbugtraq.com; full-disclosure@lists.netsys.com
    > > Subject: [Full-Disclosure] Microsoft and Security
    > >
    > >
    > >
    > > Where is Microsoft now "protecting their customers" as they love
    > > to bray? Should not someone in authority of this public company
    > > step forward and explain themselves at this time?
    > >
    > > All of sudden panic is being created across the WWW with "IIS
    > > Exploit Infecting Web Site Visitors With Malware", "Mysterious
    > > Attack Hits Web Servers", "Researchers warn of infectious Web
    > > sites" all stemming from all news accounts from an
    > > unpatched "problem" with Internet Explorer now two weeks old and
    > > counting, which in fact in reality stems from 10 months ago,
    > > that being the adodb.stream safe for scripting control with
    > > write capabilities.
    > >
    > > What exactly is being done about this? Nothing. What does
    > > multiple billions of dollars buy you today. Nothing. However for
    > > $20 million you can almost fly to the moon.
    > >
    > > Someone ought to step forward and explaini what exactly is
    > > happening at this public company. The great "protector of their
    > > customers". One might even suggest that their entire "security"
    > > mandate be re-examined. What exactly do they consider a
    > > vulnerability? Something that suits them or something that's
    > > cost effective to fix. So what, a few people lose their
    > > identities, have a few dollars extracted from their bank
    > > accounts, have their home pages reset, we'll fix it when it
    > > suits us as we have to be on budget this quarter. The Big Boss
    > > says $40 billion isn't enough this year.
    > >
    > > A vulnerability:
    > >
    > > http://www.microsoft.com/technet/archive/community/columns/securi
    > > ty/essays/vulnrbl.mspx
    > >
    > > "A security vulnerability is a flaw in a product that makes it
    > > infeasible - even when using the product properly-to prevent an
    > > attacker from usurping privileges on the user's system,
    > > regulating its operation, compromising data on it, or assuming
    > > ungranted trust."
    > >
    > > what this gibberish? For the past 10 months the adobd.stream
    > > object is capable of writing files to the "all important
    > > customer's" computer. It has real world consequences. It rapes
    > > their computer. Does it fit into the gibberish custom
    > > definition. Plain and simple: "A security vulnerability is a
    > > flaw in a product that makes it infeasible". What kind of
    > > language is this. Reads like the financial department conjured
    > > it up.
    > >
    > > Disabling scripting won't solve it. Putting sites in one of the
    > > myriad of "zones' won't solve it. Internet Explorer can
    > > trivially be fooled into operating in the less than secure so-
    > > called "intranet zone" and it can be guided there remotely.
    > >
    > > What's happening here. Where is the Microsoft representative
    > > explaining all of this to the shareholders and "customers" they
    > > so dearly wish to protect. This is unacceptable. Someone must
    > > be held accountable.
    > >
    > >
    > > --
    > > http://www.malware.com
    > >
    > >
    > >
    > >
    > >
    > > _______________________________________________
    > > Full-Disclosure - We believe in it.
    > > Charter: http://lists.netsys.com/full-disclosure-charter.html
    >
    >_______________________________________________
    >Full-Disclosure - We believe in it.
    >Charter: http://lists.netsys.com/full-disclosure-charter.html

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: Steve Kudlak: "Re: [Full-Disclosure] Wanted: Sasser executable and derivatives"

    Relevant Pages

    • Whos Catching The Cybercrooks?
      ... Stopping Internet business crime may be too much for any one agency or ... computers and use those PCs simultaneously and repeatedly to request ... enabled the FBI to trace the attacks to 17-year-old Jasmine Singh ... the 17-year-old Cheema sat at the family's dining room table ...
      (alt.2600)
    • Re: Political or Economi Freedom?
      ... In contrast corruption in the Philippines is unstable? ... It is, in fact this is foreign businesse's gripe, hey I represent one, I ... They are there because the state wants to protect certain groups which ... consider that the places have better business environments. ...
      (soc.culture.filipino)
    • Re: Zone Alarm Pro: How to *ALLOW* incoming web access
      ... >> It's the fact that one has a personnel FW trying to protect a machine ... protection of a NAT router, which is going to stop a lot of attacks up ... resources to stop the attacks, which will slow the machine down in doing ... inbound ports, which you'll have to do on port 80. ...
      (comp.security.firewalls)
    • Re: How do I protect against rootkits
      ... cannot compromise any services running on my machine. ... attacks that try to modify the file system or exploit vulnerabilities ... grsecurity and PaX to protect the address space of running services. ... placed some kind of rootkit with a totally new technology. ...
      (comp.os.linux.security)
    • Re: Political or Economi Freedom?
      ... It is, in fact this is foreign businesse's gripe, hey I represent one, I ... They are there because the state wants to protect certain groups which ... consider that the places have better business environments. ... Liberalism is all about protecting that lazy government worker's inalienable right to sleep at work. ...
      (soc.culture.filipino)