Privacy, Security Archive

In order to protect itself from DDoS attacks, Microsoft is using the Akamai service to distribute its load. Ironically, as a result, the domain www.microsoft.com is now listed in the Netcraft report as being Linux running IIS. Netcraft has received so much mail asking about that, and the irony of Linux-bashing Microsoft now depending on "enterprise-class" Linux servers has generated so much discussion, Netcraft has posted a page explaining what's happening.

Sun's EVP of Software Jonathan Schwartz uses the popular metaphor of the natural ecosystem to describe the IT world. Most corporate IT departments are what ecologists call a "monoculture." As various blights and famines have proven, when there is too much of the same plant growing in one place, it's suceptable to being wiped out by a disease. Stressing the need for "genetic diversity on the desktop" to combat security threats, Schwartz points to a non-Microsoft desktop as a viable solution. The difficulty in implementing the new OS? Says Schwartz, "you might have to train the user that a home directory named 'My Computer' on Windows has been renamed 'This Computer' . . . "

I am a "Technologist", a Technology enthusiast that is usually the one that is called should a major catastrophe strike an end user. My saga of computer rescues becomes a plot that is ever so thickening, if not only for the fact that's it's becoming incredibly easy for hackers and malicious code writers these days to invade personal property to find, seek, and destroy. Each year, virus and hacker threats increase, and in addition the damage trail left behind is something of a problem. Not to forget, a majority of "PC Panic" cases I've come across are often times the same common, "major" problem.

Scott Charney, chief security strategist at Microsoft, told developers at the TechEd 2003 conference in Brisbane, that information collected by Dr Watson, the company's reporting tool, revealed that "half of all crashes in Windows are caused not by Microsoft code, but third-party code" . . . Charney also reinforced Microsoft's message to developers and network administrators that they needed to build secure applications and networks "from the ground up"

"This week, however, Linux was also awarded with CC security certification, and as one might expect, this announcement greeted with cheers from the open source community. There's just one catch: Linux got a lower security rating than Windows 2000 did last year." Read it at WinInformant. Update: The WinInformant article is a little slanted in its reporting, since the ratings discussed have little to do with how secure either OS is in real-world use. Keep in mind that to achieve the higher rating, the computer is not allowed to be connected to any network, since network-connected computers are inherently vulnerable. A CNN article shoots a little straighter on the subject. The certification is not a contest to see which is more secure, simply a test to see if the OS matches a certain objective set of criteria. You have to severely cripple a modern OS to make it meet government high security certification.

For over an hour today, the Microsoft website was brought offline. Reports indicate that it was a standard Denial of Service attack, rather than an exploit in their hosting platform itself (Windows Server 2003, at last check). However, there is a certain likelyhood that the launch-points for this attack were themselves exploited Windows-based computers. The Department of Homeland Security today issued an unprecedented second warning regaring recent Windows exploits. Is this an isolated incident, or is it an ominous indication of pending cyber attacks on popular internet sites?

Researchers outline a way to speed the cracking of alphanumeric Windows passwords, reducing the time to break such codes to an average of 13.6 seconds from 1 minute 41 seconds.

Visionaries are using photons to develop data-security systems that may prove the ultimate defense against eavesdropping hackers.

Following Vnunet's "Linux hacks hit all-time high" article a few days back, mi2g once again copped criticism from the wider IT security community. Nonetheless, the original data upon which their report was based illustrates that concerns about Open Source security complacency may have some merit.

Microsoft is expanding its security business unit with a group that will establish new software development processes and create tools for its programmers so that future Microsoft products will have fewer security flaws, a Microsoft executive said.

Microsoft faces a possible investigation and significant fines for a security lapse that could have exposed the personal information of millions of consumers.

An interesting Palladium editorial is at Linux-mag, going through the pros and cons of the technology.

A key code for installing Microsoft's Windows Server 2003 has leaked onto the Internet, a loss that could lead to widespread piracy of the OS. In the meantime, the battle for "Trustworthy Computing" is still on.

Columnist Tim Mullen from SecurityFocus wrote an interesting editorial about how the media are overeacting on some thought exploits/holes found on Windows 2k/XP, while in his opinion, other platforms/apps are also as vulnerable but they don't get as agressive reporting: "This kind of thing damages overall security. It clouds the issue, and rains on the wrong parade. The media should give its readers all the information-- not slant it in an effort to make Microsoft look like the bad guy every time."