Microsoft wants your Opinion?

In the continuing effort to improve computer and network security, Microsoft has developed the End to End Trust initiative. As a part of that initiative, Microsoft is seeking input from users and information security professionals to help answer the questions that need to be addressed in order to evolve computer security such as How should we enhance security on the Internet without undermining social values, such as privacy and anonymity? There are more questions to be answered in the End to End Trust Forums. Scott Charney, Microsoft's Corporate Vice President of Trustworthy Computing, has developed a white paper entitled Establishing End to End Trust which provides more details on Microsoft's vision.

While  it is not beyond the stretch of a reasonable person's imagination that a giant of the industry would want to keep it's users secure. The employees and designers of microsoft have showed a lack of willingness to address serious security issues, and wrap every tiny piece of security as the next big step in computing. Rather than the required software that all of this should have been back in Windows 98. It seems that every time Microsoft attempts security, it undoubtedly blows up in it's face. So I would encourage you to voice your opinion to microsoft- Let them know you value your security, as well as your wallet.

Microsoft Vista Security... Yeah Right!

Lately, Microsoft has been trumping the myriad of new security measures that have been included in Windows Vista. However, IT techs have been screaming their guts out that between the lack of any substantial changes (aside from a circular start bar), the forced User Account Control, and big brother like computing- That everyone should stay with XP. Well, now we have actual basis for this. Notice how that Microsoft is quick to shift ALL the blame to the incompetent user.  

                The claim that Vista is less secure than Windows 2000 was made last week by security vendor PC Tools, which said that over the past six months Vista had suffered 639 unique threats, whereas Windows 2000 has suffered 586. PC Tools's research was conducted by collecting data from customers using its ThreatFire behavioural detection software. "Ironically, the new operating system has been hailed by Microsoft as the most secure version of Windows to date," said Simon Clausen, the chief executive of PC Tools last week. "However, recent research conducted with statistics from over 1.4 million computers within the ThreatFire community has shown that Windows Vista is more susceptible to malware than the eight-year-old Windows 2000 operating system, and only 37 percent more secure than Windows XP," Clausen said.

        However, Microsoft strongly hit back at the claims, blaming users for executing malicious code on their machines. On Tuesday, Technet blogger and Microsoft evangelist Michael Kleef said the number of infections found by PC Tools was an indication of poor user behaviour


639 unique threats? This coming from the billion dollar brain-trust that spent four years to develop a circular start bar? I am truly, truly stunned.

Microsoft A Good Guy?

In a recent set of closed door meetings, Microsoft met with Law Enforcement Officials to help solve a rash of crimes. Although Microsoft has generally gotten a bad-wrap for Bullying opponents out of the market place, it seems all that consolidation of resources is finally paying off. They gave a tool to the Officials that allows them to track botnets as they progress! How is this achieved you may ask? By tracking your computer :) Thats right- The Malicious Software Removal Tool is now Identifying you to law enforcement as a part of a global botnet! Oh Happy Day! We don't know exactly what the name is, what technology it uses, or even if it really exists- The Microsoft spokesperson offered this explanation: " Although Microsoft is reluctant to give out details on its botnet buster -- the company said that even revealing its name could give cyber criminals a clue on how to thwart it "

All my indicators went off at that comment- It seems that Microsoft is now engaging in the Propoganda market. We know who you are but we aren't going to do anything! Okay.

From a Microsoft White Paper:
With regard to phishing and spam, for example, it engaged in broad consumer education campaigns and worked on developing technological solutions such as phishing filters and SenderID. For both phishing and botnets, Microsoft began working more extensively with law enforcement to identify phishers and botnet herders in an attempt to create deterrent to such activity, even though the deterrent effect is limited by the current environment because it is hard to find offenders, and criminal penalties may be applied without sufficient force.

Automated SQL Injection,

If your in a Jam and need to know what this is fast- A SQL Injection is defined as: A form of attack on a database-driven Web site in which the attacker executes unauthorized SQL commands by taking advantage of insecure code on a system connected to the Internet.

Basically a SQL Injection allows an attacker to bypass security measures such as Logons, Admin Panels, and/or retrieve sensitive customer Data from your web-attached database. An example of a SQL injection would be:
statement := "SELECT * FROM users WHERE name = '" + userName + "';"
This would allow an attacker to pull up stats on a specified username.
What this most recent attack (Listed below) does is it can automatically run a series of common SQL Exploits to gain access to your server and run malicious code giving them access to any of your customer's computers. More to come later



Tens of thousands of Web sites have been compromised by an automated SQL injection attack, and although some have been cleaned, others continue to serve visitors a malicious script that tries to hijack their PCs using multiple exploits, security experts said this weekend.

View Story