Infosecurity.US

Information Security & Occasional Forays Into Adjacent Realms

  • Web Log

Astonishing Incompetence: The Microsoft Way

March 11, 2021 by Marc Handelman in Incompetence, Security Cruft, Lazy Security Engineering, Blatant Stupidity

As a former corporate customer, and, after experiencing the excruciatingly ponderous level of incompetence exhibited by Microsoft Corporation (NASDAQ: MSFT) Security, Service & Systems engineers, we've terminated our contracts with the company, and moved to proven, fundamentally more secure platforms to facilitate our business. This move included our enterprise messaging infrastructure, CMS, Office 365 and Data Storage, and Lab Environment; accomplished several months ago, we are quite pleased with the landscape, free of the MSFT two-step. Absolutely no Microsoft bits in our business.

At this point, in the Microsoft Litany of Incompetence that is playing out, perhaps you might take a couple of minutes and read a story, gathered by the highly respected security author and bon vivant Richi Jennings (a fellow author at Security Boulevard), in which, the Right Honorable Mr. Jennings details (with the assistance of those with knowledge of the situation) the enormity of the nearly complete lack of competencey within the twin realms of Information and Cyber Security exhibited by the scurrying about of the attendants to the Redmond Leviathan's highfalutin' demands. Richi's story begins below, with a link to that litany's completion at Security Boulevard).

Now, briefly, the issue of leadership raises it's noggin' - in this instance - personified by an individual whom I generally refer to as 'The Great Apologizer', Satya Narayana Nadella, CEO of Microsoft Corporation. Don't think of this as an ad hominem diatribe, rather, focus on the physics of the situation, dammit... Just remember, whilst most solids and liquids flow downhill, the chunky detritus of a company which fails to successfully execute it's mission with exquisite competence possesses a tendency to perform in the opposite, that is to say, to flow uphill, flouting gravity and whatnot, directly focusing that faliure of leadership - to the very topmost leader - in this case - CEO Nadella. Thus, those individuals caught by what I like to call the failure tsunami, are typically found on the lecture circuit within a couple of years. To sum up, closing my one-good eye, I can see it now, a short & sweet 15 minutes at TEDx Seattle for Mr. Nadella, and his version of Code Complete. Avoid that - me buckos - at all cost.

........

via the inimitable Richi Jennings, writing at Security Boulevard:

"If you thought last week’s news was bad, you ain’t seen nothin’ yet. Countless organizations using Microsoft Exchange are scrambling to undo the damage caused by Chinese “Hafnium” hackers over the past two months. And many more don’t even know they’ve been penetrated. It’s all Microsoft’s fault. Let’s not sugar-coat it: Microsoft knew about this vulnerability more than two months ago, yet didn’t tell anyone, for fear of … what? Damaging shareholder returns? Microsoft should be ashamed of itself. In today’s SB Blogwatch, we watch Redmond reap the whirlwind."

March 11, 2021 /Marc Handelman
Incompetence, Security Cruft, Lazy Security Engineering, Blatant Stupidity

Zooms' Security Fails Common Knowledge To The Company's 'Partners'

April 22, 2020 by Marc Handelman in Information Security, Lies Lies and Damn Lies, Security Cruft, Must Read

Begs the question as how effective the company's 'Business Partners' security programs were, as well. Today's Must Read via The New York Times journalists Natasha Singer and Nicole Perlroth.

April 22, 2020 /Marc Handelman
Information Security, Lies Lies and Damn Lies, Security Cruft, Must Read

Ladies and Gentlemen, Girls and Boys: The Redmondian Leviathan

Microsoft Quality Control Problems: The Litany

January 27, 2020 by Marc Handelman in Security Cruft, Operating System Security, Operating Systems, Code Incomplete

via the inimitable Lawrence Abrams, writing at Bleeping Computer, comes the bad news for Microsoft Corporation (NASDAQ: MSFT) and Windows users worldwide. The latest Zero Day IE fix has apparently broken printing for a large number of users of the Windows operating system. What has happended to the once highly respected QA groups at the Redmondian Leviathan? Read more...

'On January 17th, 2020, Microsoft disclosed a zero-day remote code execution vulnerability in Internet Explorer 11, 10, and 9 that was being used in "limited targeted attacks". As no update is available yet, Microsoft released a temporary fix that involves changing the owner of the %windir%\system32\jscript.dll and denying access to the file for the Everyone group.' - via Lawrence Abrams, writing at Bleeping Computer

January 27, 2020 /Marc Handelman
Security Cruft, Operating System Security, Operating Systems, Code Incomplete

Take The Google Pill

June 14, 2019 by Marc Handelman in User Interface Stupidity, Security Cruft

What genius at Google, Inc. (Nasdaq: GOOG) decided this was a good idea?

"On Wednesday, Google is addressing this last drawback with a new method that brings Android keys to iPhone and iPad users. It relies on the Google Smart Lock app running on the iOS device that communicates over Bluetooth with the built-in key stored on the user’s Android phone or tablet. (The app, which is also used to make FIDO-based crypto keys work with iOS devices, has user ratings of just 2.2 out of 5.) Google has additional instructions here. Company representatives declined to provide interviews for this post." - via Dan Goodin, writing at Ars Technica

June 14, 2019 /Marc Handelman
User Interface Stupidity, Security Cruft