Windows: Insecure by design
- Reference: 1719563409
- News link: https://www.theregister.co.uk/2024/06/28/windows_insecure_by_design/
- Source link:
But no. It's only gotten worse – much worse.
In June 2023, Chinese hacking group Storm-0558 [1]stole US government "secure" messages from Microsoft's Exchange Online . I was only surprised that the Feds managed to catch them – Microsoft certainly didn't figure it out.
[2]
Former senior White House cyber policy director AJ Grotto said it best: he asserted it was fair to classify Microsoft and its products as a national security concern.
[3]
[4]
Think about it for a minute. What other business could get away with having products that are so bad that every month – every month – we have a day, Patch Tuesday, devoted to the latest fixes to their seemingly endless flaws?
These problems don't tend to be small corner cases either. No, take for example the latest one: [5]CVE-2024-30080 , a Microsoft Message Queuing (MSMQ) remote code execution (RCE) issue, which earned a 9.8 out of 10 CVSS severity rating. A 9.8 on that scale, for those who don't know it, is a "Patch it now or you will be pwned" level.
[6]
Let's not forget [7]CVE-2024-30078 , a Wi-Fi driver remote code execution hole, rated 8.8. Microsoft admitted this one could enable an attacker to hack your PC to remotely, silently, and wirelessly run malware or spyware.
Boy, does that make me feel warm and fuzzy about Microsoft or what!?
Really, that's just life with Windows. In the decades I've been covering technology, I've seen this level of security crapola over and over again.
[8]
What's really annoying me today is the security holes Microsoft is adding – by design – into Windows.
I mean of course Microsoft Recall. This delightful AI addition to the next generation of Windows PCs would have taken [9]regular snapshots of everything you do on your computer .
Let me emphasize the word "everything." Your bank account numbers, your passwords, your cheat codes, your My Little Pony porn stash, how much money you lost betting on real-life ponies, etc. What would your partner think if they could scroll through your entire online life? Your mom? Or your boss using Microsoft Purview?
GDPR? What's that?
But, hey, who needs to worry? It's all safe on your computer, right? No one could get into your PC over Wi-Fi and start hoovering up all your Recall data, right?
[10]The Land Before Linux: Let's talk about the Unix desktops
[11]The battle between open source and 'sort of' open source is as old as software
[12]Who writes Linux and open source software?
[13]Get over it: Microsoft is a Linux and open source company these days
Oh, wait.
Recall, [14]which will now be optional , is a security hole pretending to be a feature. Even if it were not such an invitation for privacy invasion, I'm hard pressed to imagine what practical use it would be for anyone. We have more than enough useless data clogging up our drives without adding even more.
Finally, thinking of over-filling our storage, in another "What were they thinking!?" moment, with the latest releases Microsoft made it nigh on impossible to install Windows 11 without a Microsoft online account. I'm not happy about that, but I could tolerate it.
What I can't stand is Microsoft [15]automatically sets up OneDrive to back up my folders whether I want it to or not. Not cool, Microsoft! Not cool at all. If I want to back up my files, I'll decide where I want them to go – not you.
I only have 5GB of free OneDrive storage, while I have terabytes of data in my personal directories. And, no, I won't be paying you for more storage, thank you very much. Instead, I'll use one of my Rocky Linux servers running Nextcloud, and I won't have to worry about Microsoft looking over my shoulder.
Besides, consider what the OneDrive automatic backup could do if paired with Recall? I, for one, don't want all my files open to Microsoft or Windows hackers. Do you?
Is it any wonder I've been a Linux desktop user for over 30 years? The only question I have is: Will any of these latest Windows security fiascos finally get the rest of you to join me? I mean, how much punishment are you willing to take? ®
Get our [16]Tech Resources
[1] https://www.theregister.com/2024/06/14/brad_smith_microsoft_hearing/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Zn6Jv@fAMliw71gKD6tbIQAAAk0&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Zn6Jv@fAMliw71gKD6tbIQAAAk0&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Zn6Jv@fAMliw71gKD6tbIQAAAk0&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2024/06/12/june_patch_tuesday/
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Zn6Jv@fAMliw71gKD6tbIQAAAk0&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2024/06/12/june_patch_tuesday/
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Zn6Jv@fAMliw71gKD6tbIQAAAk0&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[9] https://www.theregister.com/2024/05/22/windows_recall/
[10] https://www.theregister.com/2024/01/27/opinion_column/
[11] https://www.theregister.com/2023/10/27/open_source_vs_sort_of_open_source/
[12] https://www.theregister.com/2023/02/24/who_writes_open_source/
[13] https://www.theregister.com/2022/07/13/microsoft_linux_company/
[14] https://www.theregister.com/2024/06/14/microsoft_recall_release_delayed/
[15] https://www.theregister.com/2024/06/26/microsoft_makes_onedrive_avoidance_trickier/
[16] https://whitepapers.theregister.com/
Re: how much punishment are you willing to take?
Work will be interesting. Not my problem, I'm a user, I can only use what they provide me with, and work around some of the most annoying things. Thankfully our goup's main admin is a long term Windows admin (and a long term Linux developer), so I do have both a shoulder to cry on and somebody to roll out internal solutions that actually work for developers...
Re: how much punishment are you willing to take?
Medal's in the post.
I hear you loud and clear
Windows is a cancer to my IT life that I will excise once and for all when I retire in less than a decade now.
Until then, as a freelance programming consultant, I unfortunately must have the same platform my customers use and, for some strange reason, none of them are on Linux.
Remark, if only one of them were, I'd be in a pickle. I guess I'd have to have a second work laptop. And no, I'm not going to VM Linux into my Windows or vice-versa. I'm not a systems administrator.
That is why I have scheduled my Linux conversion to when I'll have the time to deal with it.
Until then, well, I roll with the punches, I guess.
Re: I hear you loud and clear
"That is why I have scheduled my Linux conversion to when I'll have the time to deal with it."
Unlike John Lumic's Cybus Industries' upgrade offering your Linux conversion will be an illuminating step on the road to Damascus. ;)
Having looked at application coding and systems programming under Windows at various times I don't envy you. Like most BOFHs the only practical use I have for windows is for the defenestrating of irritating items (people, printers.)
Re: I hear you loud and clear
I guess I'd have to have a second work laptop. And no, I'm not going to VM Linux into my Windows or vice-versa. I'm not a systems administrator.
Dual boot?
Really running in a VM is easy provided you don't need any specialised hardware support or fancy graphics acceleration. These days I run Linux as my desktop and spin up one of a handful of Windows VM for specific software as needed.
Linux is not totally trouble free, but the more I see the decline of windows post-XP onwards (with 7 as brief respite) the happier I am not to have much to do with it.
Re: I hear you loud and clear
I'll drink to that!
And my retirement is nine years closer ]:-)
What other business could get away with having products so bad ?
Masses of political donations on Capitol Hill is what business. Which means the Microsoft $product is used everywhere, including the DOD, DOS, DHS, DoD, FBI, HHS, IRS, NASA and the VA. With it now being stuffed with AI and hosted in the “Cloud”, it doesn't look like its going to get any safer anytime soon.
Re: I'm hard pressed to imagine what practical use it would be for anyone.
It's a Trojan horse. The unthinking masses will think it's cool to be able to find something easily from last month. Meanwhile cloud originated requests will be asking the AI if the user has a copy of any CSAM, terrorist material, competitors' industrial secrets, politically unacceptable material, kompromat, etc, etc, etc.
Re: I'm hard pressed to imagine what practical use it would be for anyone.
but, but, but... if you have nothing to hide, you have nothing to fear, citizen!
(remind me, are we at war with Eastasia or Oceana this week?)
Re: I'm hard pressed to imagine what practical use it would be for anyone.
What do you mean 'this week'? We are at war with Easasia. We have always been at war with Eastasia.
Oh dear, "wacky ideas"
> how you could steal data from your coworker's spreadsheets using Object Linking and Embedding (OLE)
Perhaps that one should have been left forked until it was really well-cooked enough to be spooned out to us.
how much punishment are you willing to take?
At work, where the choice of OS is out of one's hands? Whatever can't be avoided.
At home? Linux user for decades.