Why Does Microsoft Get a Free Pass on Malware?

It's a funny thing how Microsoft succeeds in getting their logo and the Windows logo plastered on everything-- computers, advertising, and even other companies' ads. That "We recommend Windows Vista!" blurb is on every darned ad and product catalog that exists, it seems. Every word that falls from the mouths of Bill Gates and Steve Ballmer is dutifully recorded and reported. And yet the news media go all forgetful when they're reporting on yet another malware outbreak. The most recent example of this is the mass worm outbreak at our largest U.S. military base in Afghanistan. Or perhaps it was military computer networks in other locations-- I read a couple dozen news stories on this, and each one is a little different. So my guess it's very widespread and they don't want to admit just how bad it is. But there is one fact that becomes apparent to the tech-educated reader with the wit to look up little clues dropped in those stories like breadcrumbs-- such as SillyFDC and agent.btx-- it's all Windows computers that are affected. And yet in all of those news stories I read, not one single story said this. The closest any of them came to naming names was this ZDNet article:

"Our military is dependent upon commodity desktops whose software shares an enormous amount of DNA with systems that sit on every workplace in the planet"

A masterpiece of weasel-wording. Is Microsoft's grip on the news media that tight? Why isn't this a huge scandal? Weird-looking old ladies with thick shoes trying to catch their planes are not threats to this country's security, though they are treated as such, but Windows is a proven threat, and yet Microsoft gets a free pass.

It's no accident that throughout history, the first act of any newly-minted tyrant is taking control of all communications. So it's no accident that since the Internet became available to the masses, world governments and our beloved, cuddly globalcorps have been doing their darndest to lock it down and control it. John Gilmore, one of the founders of Electronic Frontier Foundation and all-around awesome geek and activist, is often quoted as saying "The Net interprets censorship as damage and routes around it." But does it? The Internet is under the control of the companies who own the wires, which ain't us peons out here in the world.

Forbes magazine, in The Day The Web Went Dead, describes how a seriously silly-sounding dispute between Cogent and Sprint resulted in a several-day Internet outage for millions of customers. So where was the routing around the damage? Nowhere is where. The article treats this episode as an amusing duel between some good ole boys with a happy ending, rather than what it really is-- a childish tantrum that caused a lot of harm to a lot of people.

One of my favorite hobbies is scoffing at the worn-out claims of innovation by big business. Feh. The only thing they innovate is spiraling levels of baloney. How Comcast Controls Sony's Internet TV Plans relates the long sad tale of how Sony has been trying for five years to make a deal with Comcast to broadcast Sony programming over Comcast's networks:

"We've worked with the cable companies for five years to develop a system that would allow us and the rest of the television manufacturers to have alternative content on the TV," Mr. Glasgow said."

https://o1.qnsr.com/log/p.gif?;n=203;c=204657336;s=9478;x=7936;f=201808231619130;u=j;z=TIMESTAMP;a=20403940;e=i What's the hangup? Programming guides. The solution, after five years of arguing? Both parties get to offer users their own program guides. They seem to think it's a fair trade- fewer gadgets for customers to manage in return for more program guides. (Insert appropriate sarcastic face here.) Don't hold your breath, though, it's not coming anytime soon:

"All of these applications have to be tested by CableLabs and approved by your cable operator. That's the same crowd that took five years to agree to let Sony build its own electronic program guide."

Maybe they should requisition some adults to run these companies.

Another story that hit my grumpy button is Growth in Internet crime calls for growth in punishment, in which Mikko Hypponen, F-Secure's Chief Research Officer, calls for an "Internetpol" to deal with online crime. We wouldn't need an Internetpol if the so-called security companies would acquire some honesty and backbone and do their jobs. Instead they have this unhealthy dependence on the grand champion of enablers of Internet crime, Microsoft, and other big corporations. Want to get rid of 95% of online crime overnight? Banish every last Microsoft PC from the Internet, which will wipe out all the tens of thousands of Windows-powered botnets, and leave all those Internet crime rings high and dry, and without an easy way to get back in business.

You think I'm being mean to poor old F-Secure? You might recall how they gave Sony a free pass on their CD rootkit--F-Secure knew about it for a month before Mark Russinovich broke the story. If it were some foreign kid instead of a big corporation, you can bet they would have been all over it. To this day they soft-pedal it, and so do the other security vendors:

• F-Secure: "Although the software isn't directly malicious, the used rootkit hiding techniques are exactly the same used by malicious software to hide themselves. The DRM software will cause many similar false alarms with all AV software that detect rootkits."
• Symantec: "This rootkit was designed to hide a legitimate application, but it can be used to hide other objects, including malicious software."
• TrendMicro: "This hacking tool is a valid Digital Rights Management (DRM) software package developed by First 4 Internet Ltd. This software package is included as a copy protection mechanism for certain audio compact discs distributed by Sony BMG."

Speaking of Sony, one rootkit wasn't enough, so they released another one:

"The software for the drive was written by Taiwanese company FineArt, and Sony is claiming that they had no knowledge of this particular rootkit and did not intend for it to be released."

That's innovation in quality control, I guess.

So the moral of the story is yes Virginia, it is a war.

Carla Schroder is the author of the Linux Cookbook and the Linux Networking Cookbook, and the managing editor of LinuxPlanet.

This article was first published on LinuxPlanet.com.