Tuesdays With Microsoft

Tuesdays are the day when we patch the holey Microsoft products.

Patch Tuesday leaves Duqu 0-day for another day

November marked a light Patch Tuesday with just four bulletins, only one of which tackles a critical flaw.

All four advisories relate to problems in Windows. None is related to the zero-day vulnerability related to Duqu, the highly sophisticated worm reckoned to be related to the infamous Stuxnet pathogen.

See also:
Microsoft Security Bulletin Summary for November 2011
Microsoft Patch Tuesday Fixes Critical Windows 7 Bug, Leaves Out Duqu Zero-Day
Microsoft Fixes Four Bugs for November Patch Tuesday
Microsoft offers simple patch Tuesday for election day
Microsoft fails to patch Duqu, but fixes critical hole in Windows TCP/IP stack
One critical bulletin, no Duqu patch, in November 2011 Patch Tuesday updates
A mild November Patch Tuesday from Microsoft
Light Patch Tuesday May Lead To Out-of-Band Patch
Microsoft fixes gaping hole in Windows TCP/IP stack
Microsoft patches critical Windows bug, but not Duqu flaw
Microsoft patches critical Windows 7 bug, downplays exploit threat
Microsoft Leaves Duqu Worm Exploit Unpatched
Windows Update

I find it more than interesting that Microsoft is unable or unwilling to patch for the Duqu Virus. Is it intentional?

/anyway, you know the drill, get on with it

Advertisements

Have We Attacked China Yet?

No sooner was it publicly revealed that the United States would now treat damaging cyberattacks by other nations as an act of war, threatening retaliation with conventional weapons, the new, bold, some say foolish, policy, was immediately put to the test.

China Google hackers’ goal: Spying on U.S. Govt.

It’s the second time Google has blamed a major computer hacking scheme on China, reports CBS News correspondent Wyatt Andrews.

This time Google says unknown hackers from Jinan, China, a city with a military command center, stole the personal Gmail passwords of hundreds of senior U.S .government officials.

Google said the hackers’ “goal” was to eavesdrop on the officials — “to monitor the content of the users’ emails.”

That suggestion — of spying — rang alarm bells in the Administration.

“These allegations are very serious,” said Secretary of State Hillary Clinton. “We take them seriously. We’re looking into them.”

See also:
Clinton: Google’s China Hacking Claims ‘Very Serious’
Hillary Clinton says FBI will probe Gmail hacker attack
US Investigating Google Claim of China Hacking
FBI Investigating Google Claim that China Hacked Them
Google breach gives way to diplomatic, high-tech tensions
China Denies Accessing High Profile Gmail Accounts
Google’s groundless accuses hurt global trust on Internet
The Google-China Saga Continues
Admin: Gmail phishers stalked victims for months
Gmail Hack Targeted White House
Cyber war: Google, China in fresh spat over email hacking
Google, what exactly is the China connection for the phishing scare?
Is Google an agent of the US Government? It certainly gives that impression

So far, the U.S. has uncovered a successful espionage phishing expedition, against top level U.S. Government officials, tracked back to a specific Chinese city. Why aren’t we bombing China, isn’t this a perfect situation to show how our new military policy will treat hacking intrusions like this as acts of war? Unfortunately for us, China denies the attack and, as I pointed out yesterday, it’s extremely difficult to be absolutely sure as to the origins of cyberattacks like this, so we do nothing and our brand new policy looks foolish and radiates national weakness.

/instead of making toothless threats to send missile strikes in response to hack attacks, why don’t we just send the Chinese back a nice Stuxnet worm or take down Baidu with a complimentary DoS attack