Worm worries grow with release of Windows hacks

TalkBack 37 of 48:

Next »

« Previous

• Thread View
• Flat View

Wish you'd tell this to Microsoft.

From an article on www.zd.net 8/13/03, concerning Microsoft's inability to apply its own patches:

"The software giant had been hit hard by the SQL Slammer worm, a self-spreading program that took advantage of a six-month-old flaw that even Microsoft hadn't completely excised from its systems."

From an article on www.zd.net 8-13-03 (regarding the LovSan outbreak primarily).

"While businesses usually know of software flaws and the need to patch their systems, they don't always have time. Companies often do not patch their systems immediately, because they need time to test the fixes, said Brian Burns, manager of security operations for network device maker NetScreen.

"'Microsoft patches don't receive enough QA (quality assurance) as they should,' he said. 'There have been times that a patch has been applied, and then the administrator has to spend hours rolling it back, because it has crashed the machine.'"

Microsoft hacked again
By: Kieren McCarthy
Posted: 06/11/2000 at 11:23 GMT

"Just one week after Microsoft admitted to a major breach of its security, another hacker by the name of Dimitri claims to have gained access to several of its Web servers.

"Using a known security hole in M$' Internet Information Server software - which should have been fixed with its own patch - Dimitri hacked into the servers and uploaded a text file called Hack the Planet. He claims to have been able to alter files on Microsoft's download site and, if he so wished, add Trojan horses to software. The implications are obvious.

"On top of this, Dimitri claimed to have possession of an encrypted file containing administrative user names and passwords. He could decode it, he said, but wouldn't. Other interesting info: Microsoft's server domain is called Houston (and now it has a problem) and all the Web servers are set up in the same way. Tut tut."

Wednesday, September 03, 2003
The Blaster School of Hard Knocks
By Mary Jo Foley

"Secondly, Microsoft needs to take its own patching medicine. I have it on pretty good authority that even though Microsoft made the security patch that could have headed off Blaster available weeks before the worm hit, it didn't patch all of its own servers inside the company. I've heard 47 servers running Microsoft's Passport Internet-authentication software had to be taken down on August 12 (day two of Blaster) for 'emergency maintenance.'"

* * * * * *

There you have it, folks--the company producing the patches can't seem to get the hang of applying their own patches. Yet, they expect the rest of us to be able to?

There are plenty more examples in my security archives.

Posted by: Yen_z   Posted on: 04/29/04 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Building the Virtualized Enterprise with VMware Iinfrastructure VMware VMware virtualization software has been adopted by over 120,000 enterprise ... Download Now
• The True Costs of Virtual Server Solutions VMware In an economic environment that is repeatedly heralding the message "do ... Download Now
• Can your business work smarter? IBM Today, productivity is at a premium and IT budgets are at a minimum. Work ... Download Now