Posts Tagged ‘zero day exploit’

LinkSwarm For May 1, 2026

Friday, May 1st, 2026

Iran is beyond broke, more Trump assassination repercussions, FBI finally raids some fraudsters, racial carve-out congressional districts are unconstitutional, Russia loses more ships and planes, Cornyn amnesty pander unearthed, an oil theft ring busted, DEI earns some college pink slips, and a brand spanking new Microsoft Zero Day exploit.

It’s the Friday LinkSwarm!

  • Remember that today is Victims of Communism Day.

  • Iran’s economy is toast.

    The Wall Street Journal offers a deep dive into the state of Iran’s wartime economy. And it turns out that the mullahs are, effectively, broke:

    Government revenue has dried up just as the needs of its population are rising.

    The war has thrown around one million people out of work directly and another million indirectly, according to early estimates cited by Gholamhossein Mohammadi, an official at Iran’s Labor and Social-Affairs ministry. That is a significant portion of the roughly 25 million people who are normally employed in Iran.

    The cost of living has soared, with the annual inflation rate reaching 67 percent in the month through mid-April from the same period a year earlier, according to Iran’s central bank. The subsidized price of red meat, which was mostly imported through sea routes, has gone up to the equivalent of around $3.60 a pound, beyond the reach of most in a country where the minimum wage is around $130 a month.

    “Living is not affordable anymore,” said Mahdi Ghodsi of the Vienna Institute for International Economic Studies. “Iran is at its weakest point.”

    Businesses across the country — from manufacturers to retailers — are closing, residents said. The lack of steel and other raw materials is hampering production in various industries. Electronic goods, which are mostly imported, are in short supply and expensive.

    A 67 percent inflation rate? The worst we’ve experienced in recent memory was 9.1 percent in June 2022.

    Snip.

    “Iran’s rial weakened on Wednesday, with the dollar trading at around 1.8 million rials, according to market trackers. The rate reflects continued pressure on the local currency amid economic strains.” Back at the start of January, this newsletter informed you, “When Ruhollah Khomeini swept to power in 1979, one US dollar traded for 70 rials. Today, that same dollar commands a staggering 1,130,000 rials, more than 16,000-fold its price in 1979. In the last year alone, the rial has lost 50 percent of its value.” The Iran rial was the weakest currency in the world . . . back when one dollar could buy you 1.3 million rials.

    Plus the specter of hunger riots.

  • Our ridiculous media referred to the attempted Trump assassination as a “security incident” or “loud noise.”
  • The left is made up of horrible people. “Meet the teachers who decided to voice their displeasure that Trump wasn’t murdered over the weekend.”
  • The latest Trump assassination attempt and the left’s hate machine.

    The security establishment has promised and made better security arrangements after the two prior attempts on Trump’s life in 2024 in Butler, Pa., and West Palm Beach, Fla., the assassination of Charlie Kirk at an open-air Utah college campus in 2025, or the wounding of congressman practicing baseball at a suburban Washington field all the way back 2017.

    Those events – along with the BLM riots in summer 2020, the Antifa attacks on immigration agents, the execution of the United Health Care CEO and the attempted assassination of Justice Brett Kavanaugh near his personal home – have something more in common than just the exploitation of current security postures.

    They all, according to publicly released evidence, involved perpetrators influenced by a vast left-wing machinery that bombards social media, community protests and even establishment television with an unrelenting message of hatred and intolerance that can dehumanize the targets of violence and motivate armed actors to action, experts said.

    That machinery ranges from nonprofits like the Southern Poverty Law Center, which actually paid racist actors in the name of fighting extremism, to the organizers of the No Kings protests who unleashed hundreds of thousands of old and young protesters onto the streets on the false notion that America has somehow become a monarchy under Trump.

    In between, elitists and teachers have infused the nation with claims that America’s history is racist and unrighteous and that young Americans are predestined to fates determined as oppressors or the oppressed based on their skin color. And well-funded nonprofits consorting with America’s enemies in China and Cuba are openly fomenting a color revolution in hopes of securing a Marxist future on U.S. soil.

    Allen appears to have been influenced by some of that ideology, as well as Democrats’ incessant but unfounded claims that Trump was involved in the late Jeffrey Epstein’s sex trafficking.

    The manifesto police said Allen wrote suggested he was “no longer willing to permit a pedophile, rapist, and traitor to coat my hands with his crimes,” and that he subscribed to the Marxist paradigm of critical race theory that divides people into oppressors and the oppressed.

  • Who funded American Nazis and the KKK? You did, through USAID.

    (Hat tip: Instapundit.)

  • Finally: “FBI and DHS Raid Dozens of Minnesota Fraudsters, Including ‘Quality Learing Center.'”

    Federal officers are conducting raids of suspected fraudsters in Minneapolis on Tuesday, including the most infamous Somali-linked false front, the “Quality Learing Center.”

    The FBI and the Department of Homeland Security’s Homeland Security Investigations (HSI) are targeting more than 20 locations in their latest operation against the massive Minnesota fraud network, according to Fox News correspondent Bill Melugin, who said that he spoke with the Department of Justice (DOJ), the FBI’s parent agency. The size and scope of the Minnesota fraud scandal, which is heavily linked to the Somali community there, but also implicates multiple Democrat politicians, including Gov. Tim Walz, Attorney General Keith Ellison, and Rep. Ilhan Omar, continues to astound patriotic Americans.

    Melugin posted on X April 28, “Sources tell FOX the locations are largely Somali linked businesses, including the infamous ‘Quality Learning Center’. I’m told these are court approved search warrants being served and they are tied to fraud, not immigration enforcement. Fox is told 22 search warrants were executed in Minnesota this morning.”

    He also shared a statement from a DOJ spokesperson: “Today the FBI with federal, state and local law enforcement is involved in court-authorized law enforcement activity as part of an ongoing fraud investigation.”

    While investigating apparent false fronts for taxpayer-funded daycares in Minnesota, journalist Nick Shirley found one that had even misspelled “learning” in its own name on its sign, calling the place a “Quality Learing Center.” Tikki Brown, the commissioner of Minnesota’s Department of Children, Youth, and Families, then asserted that the childcare facility in question closed down the previous week, explaining why Shirley didn’t see any children there. But on Dec. 29, the same location was “packed with kids.” Apparently, some fraudster panicked and summoned children to provide a veneer of legitimacy. It’s The Truman Show in real life.

    (Hat tip: Stephen Green at Instapundit.)

  • Teacher’s unions are a huge funder of leftwing causes.

    A new pair of reports is shedding fresh light on how teachers unions across the country have quietly poured more than $1 billion into political causes over the past decade, with a top education watchdog warning the spending reflects a growing focus on activism rather than classroom priorities.

    According to research from Defending Education, national teachers unions alone have directed roughly $669 million toward left-wing political groups, advocacy organizations and campaigns since 2015. When state and local affiliates are included, that figure balloons to more than $1 billion in total political spending.

    The reports track spending from the two largest unions, the National Education Association (NEA) and the American Federation of Teachers (AFT), as well as their state-level affiliates, using federal filings and campaign finance records.

  • The Supreme Court strikes down racial gerrymandering.

    The Supreme Court just handed down one of the most consequential redistricting decisions in a generation — and Democrats are not going to like it one bit.

    In a 6-3 ruling in Louisiana v. Callais, the majority held that Louisiana’s congressional map — redrawn to include a second majority-black district — constitutes an unconstitutional racial gerrymander under the Fifteenth Amendment. The Court stopped short of striking down Section 2 of the Voting Rights Act entirely, but it dramatically narrowed the ways in which states may use race when drawing congressional maps.

    For Republicans eyeing the House in 2026, this is the kind of ruling that changes the math.

    I’m sure I don’t have to tell you which justices dissented.

    The ruling’s immediate implications are huge. As we’ve previously reported, Republicans could potentially pick up anywhere from 12 to 19 new House seats across the South, as states seize the opportunity to redraw maps that were previously constrained by Section 2 requirements.

    (Hat tip: Charlie Martin at Instapundit.)

  • “Southern Poverty Law Center donors include George Soros, JPMorgan, George Clooney — as nonprofit ‘funneled’ millions to hate group.”

    The Southern Poverty Law Center (SPLC) has been funded by big name businesses and philanthropists including George Soros, JPMorgan, ex-Apple CEO Tim Cook and George Clooney.

    The group — indicted Tuesday for allegedly funneling millions to the hate groups it says it is ideologically against — also holds over $786 million in assets, yet still solicits donations.

    In fact, it took in $106 million in donated cash 2024, according to its latest available financial disclosures, yet still ran “urgent” appeals for “emergency” cash.

    Over the years, donations have been made by big name donors, many of whom pledged to the organization after clashes at a 2017 by “Unite the Right” white supremacist rally in Virginia, which resulted in the death of one protester.

  • Tuapse hammered again. “Ukraine seems to hammer this every day now.”
  • Huge Strike on Russian Command Post: Nine Officers Eliminated. Another FSB Also Hit.” In Luhansk.
  • “Ukraine Advances 15km And Liberates Ternove Near Dnipro.”
  • Three Russian Ships & MiG-31 Hit By FP-2 Drones in Crimea.”
  • Iskander Storage Hit by FP-2 Drones in Crimea.” Not clear they penetrated the bunkers.
  • “Ukraine Hits Shadow Fleet Tanker Marquise with Marine Drones.” “The vessel was hit about 210 kilometers southeast of Tuapse, Russia” in the Black Sea.”
  • “A Su-57 stealth aircraft was destroyed by drones at Chelyabinsk, confirmed by satellite imagery with Ukraine reporting two destroyed and a Su-34.” This is some 1,600km away from Ukraine.
  • “After Al-Qaeda in Mali (JNIM) [Jama’at Nasr al-Islam wal Muslimin] & FLA [Azawad Liberation Front] took the city yesterday, the Russian Africa Corps & Malian soldiers fled to a military base outside town where they got surrounded…The Russians negotiated an exit from the [base] and fled. But the agreement didn’t include the Marian soldiers who were left behind. So, Russia once again abandoning its supposed allies as soon as the going gets tough.” Mali rebels also shot down a Russian helicopter.
  • Speaking of Mali: “Defense minister killed in united al-Qaeda and ISIS jihad attack, country on verge of collapse.”

    Mali was on the brink of collapse last year as al-Qaeda affiliate Jama’at Nusrat al-Islam wal-Muslimin (JNIM) unleashed attacks on the country. Then came a report that Jihad Watch covered yesterday about renewed attacks that injured 16 people, as efforts to create an Islamic state in Mali escalated. The new siege rapidly spiraled into much worse, with JNIM, ISIS and Northern rebels coordinating attacks. Mali’s defense minister was killed.

    I’m guessing the ISIS here is the Islamic State in the Greater Sahara.

    Mali’s military government, which Gen. Assimi Goïta leads, broke ties with France in 2021-2022 and hired the Russian Wagner Group (known as the Africa Corps) to fight the rebels.

    Technically, Wagner Group and Africa Corps are different Russian mercenary groups, though I’m sure a lot of soldiers for the former ended up in the latter.

    The siege also served as “a major blow to Russia as the mercenaries had no intelligence about the attacks and were unable to protect major cities.”

    Mali now faces an existential threat, which Kurdistan24 News characterized as “a profound failure for Mali’s Russian-backed military junta, signalling severe regional instability.”

    Governments in the Sahel have never been the most stable, but the Russian-backed coups there have made things measurably worse.

  • Dispatch from the Texas Senate Runoff: “Cornyn Touted Legalization for Illegal Aliens in 2020 Campaign Ad.”

    A resurfaced 2020 campaign ad shows U.S. Sen. John Cornyn promoting his support for the “legalization of Dreamers”—a message that has since been removed from his YouTube channel.

    In the Spanish-language ad, a narrator proclaims that, while Cornyn supports secure borders, he “firmly supports legalization of Dreamers.”

    The video, which was previously available on his official YouTube channel, was quickly removed after circulation on social media.

    Created by executive action under President Barack Obama in 2012, the Deferred Action for Childhood Arrivals (DACA) program allows certain individuals brought to the United States illegally as children, known as “Dreamers,” to remain in the country and shields them from deportation.

    The program was challenged by President Donald Trump and Attorney General Ken Paxton, who argued it was unconstitutional. The U.S. Supreme Court ultimately blocked the Trump administration’s attempt to end the program in a 5–4 ruling.

    The messaging aligns with comments Cornyn made on the Senate floor in 2020 regarding recipients of the Deferred Action for Childhood Arrivals program following that Supreme Court ruling.

    “DACA recipients must have a permanent legislative solution. They deserve nothing less,” Cornyn said at the time. “We need to take action and pass legislation that will unequivocally allow these young men and women to stay in the only home, in the only country, they’ve known.”

    Cornyn also described the uncertainty surrounding their status as “terrifying” and said many recipients have built careers and families in the United States.

    “These young people deserve better,” he added.

    The senator further noted he had been working with advocacy groups and stakeholders—including the Texas Hispanic Chambers of Commerce, LULAC, and Catholic bishops—to find a long-term solution.

    Cornyn has long been known as a squish on amnesty, but no Republican should be seeking the approval of the hard-left LULAC.

  • “Former Fauci Adviser Indicted for Allegedly Concealing Covid-Related Records.”

    David Morens, 78, worked under Fauci while he served as director of the National Institute of Allergy and Infectious Diseases. The DOJ charged Morens with conspiracy against the United States; destruction, alteration, or falsification of records in federal investigations; concealment, removal, or mutilation of records; and aiding and abetting. The case is being prosecuted by the U.S. Attorney’s Office for the District of Maryland.

    Morens, along with two unnamed co-conspirators, “concealed, removed, destroyed and caused the concealment, and removal of federal records to evade FOIA [Freedom of Information Act] and FRA [Federal Records Act],” according to the indictment.

    During his time at NIH, which ran from 2006 to 2022, Morens used his personal email account to conduct government business, specifically discussing the origins of Covid-19 with Manhattan-based nonprofit EcoHealth Alliance president Peter Daszak. Morens deleted said emails after sending them.

    He also spoke with NIH’s FOIA liaison, asking for tips on how to evade FOIA requests.

    Sure acts like he’s guilty, doesn’t he?

  • “Despite state law, we’re secretly keeping DEI.” College: “All right, then, enjoy this pink slip.”
  • “Poll: Trump’s approval rating among Catholics INCREASED after his scuffle with Pope Leo.”
  • “Overwhelming Opposition in Spain to Giving Amnesty to 500,000 Illegal Immigrants.”
  • This war goes to 11.
  • More rank Biden Admin dishonesty: “Biden SBA hid $90 million in loans to Planned Parenthood by calling them ‘Benghazi’ in emails.”
  • The UAE leaves OPEC.
  • Fourteen Indicted for Alleged Texas-New Mexico Permian Basin Oilfield Theft.”

    Fourteen defendants from Texas and New Mexico were federally indicted for large-scale oil theft in the Permian Basin.

    The United States Attorney’s Office for the Northern District of Texas announced on April 22 that the 14 conspirators were indicted for the alleged transport and theft of crude oil across the Texas-New Mexico border.

    The criminal activity allegedly took place in the Permian Basin, which is responsible for nearly 40 percent of all oil production in the U.S.

    Snip.

    The Texas defendants are Randell Wayne Reid, age 41, of Electra; his father, James Darrell Reid, 65, also of Electra; and Christopher Frederick Harris, 22, of Seminole. Randell Reid and James Reid are both owners of Reidco Enterprises, a Texas-based company.

    The defendants allegedly conspired to steal crude oil from the Permian Basin, “some of which was then stored on land that one of the conspirators leased from the United States government,” according to the U.S. Attorney’s Office. Stolen crude oil was then sold to the other conspirators well below the market value set by West Texas Intermediate (WTI) pricing. WTI is used as a benchmark to set crude oil prices in the region.

    The indictment of Randell and James Reid restates these claims, adding that the men conspired to trade oil across the state borders.

  • Spirit Airlines to cease operations tomorrow, thanks in part to Elizabeth Warren blocking a merger with JetBlue.
  • Sony will lock the games you’ve already paid for if you don’t log into the Internet every 30 days. (Update: Now Sony claims you only have to log in once.)
  • Another day, another another Microsoft zero day exploit, this one called BlueHammer.

    Not quite.

    The zero-day flaw combines a time-of-check to time-of-use (TOCTOU) race condition and path confusion in Windows Defender’s signature update system, according to an advisory from the Retail & Hospitality-Information Sharing and Analysis Center (RH-ISAC). If exploited successfully, a local user can access the Security Account Manager (SAM) database, obtain password hashes, and eventually gain administrator rights using the pass-the-hash technique, which would give the attacker full system control.

    Local user rather than remote, so that mitigates the potential attacker pool. (Hat tip: Borepatch.)

  • Louis Rossmann, call your office. “Conroe residents say city is stonewalling their requests for information on Flock Safety cameras.”

    People in Conroe are asking city officials for answers about how Flock cameras are being used and where the collected information ends up.

    Residents say they feel like they are not getting straight answers.

    Residents are working to learn how these cameras operate and, on Thursday, spoke to ABC13 about their demands for city officials to be more transparent, as they feel their questions are being ignored.

    “Everybody in the community wants to feel safe. Everyone agrees this could help with kidnappings and hit-and-runs. To me, I just haven’t seen the data that proves that,” said concerned citizen, James Fletes.

    Officials have said in the past that Flock cameras read license plates and alert police if the plates are linked to any crimes.

    This technology has been used in the greater Houston area for years. In Conroe, some people say they are worried about the number of cameras and the lack of information about them.

    Fletes says this concern led him to file a public records request with the city of Conroe. He asked questions such as how many cameras there are, how they work, where the data goes, and who can access it.

    He says the city told him it would cost $1,200 to release the information, so he and others in the community joined forces to cover the cost.

    “This is no longer just my request. It’s the people of Conroe’s request. They funded it, and we’re tired of being stonewalled,” said Fletes.

    The original request was sent in March. Now, it’s almost May, and he says no information has been released yet.

    “They were quick to take the money and very slow to provide the documents,” said Fletes.

    There seems to be a whole lot suspicious about the ways cities have surreptitiously rolled out AI-enabled cameras and hoped people wouldn’t notice. (Hat tip: TPPF.)

  • Google co-founder Sergey Brin rejects California’s billionaires tax and is drifting towards the Republicans. “I fled socialism with my family in 1979 and know the devastating, oppressive society it created in the Soviet Union. I don’t want California to end up in the same place.”
  • Part 2 of that Robert Rodriguez interview with Quintin Tarantino.
  • “Media Still Stumped As To Motive Of Gunman With Manifesto Titled ‘Why I’m Going To Kill Donald J. Trump.'”
  • “‘This Is A Both Sides Issue,’ Says Side That Shot President Trump, Assassinated Charlie Kirk, Tried To Assassinate Kavanaugh, Tried To Shoot Trump Again, Shot Steve Scalise, Firebombed Governor Shapiro, Tried To Shoot Trump A Third Time, (cont’d).”
  • “After Failed Assassination, Democrats Observe Customary 5-Minute Pause On Calling Trump ‘Hitler.'”
  • “In Blow To Democrats, SCOTUS Rules They Have To Stop Being Racist.”
  • “SPLC Says Funding KKK Only 3% Of What They Do.”
  • Vegan Crossfitter Cyclist Unsure What To Tell You About First.”
  • I’m still between jobs. Feel free to hit the tip jar if you’re so inclined.





    Microsoft Considered Harmful

    Monday, February 23rd, 2026

    Microsoft has long had a reputation of an abusive company, all the way back to its origins, when Gary Kildall accused Bill Gates of stealing parts of CP/M for DOS. The list of lawsuits against Microsoft for anti-competitive or shady business business practices is so extensive it has its own Wikipedia article. But it’s latest moves to force both subscription models and AI into every nook and crevice of its software may be the final straws that break the Borg’s back, as longtime Windows users finally seem to be abandoning ship.

    First up, this David Linthicum piece.

    Last month, I met with a mid-sized law firm facing a common dilemma. Their Windows 10 laptops were nearing the end of support and needed to be replaced. Typically, this meant buying new hardware and software—predictable and straightforward. But this time, Microsoft suggested a different approach: move to Windows 365 Cloud PCs, a PC that operates with a monthly subscription and is accessible from any device, scalable, secure, and AI-enhanced. The catch? The shift from ownership to a subscription model and reduced local control led their IT team to question how “personal” these computers truly were.

    Cloud subscriptions replace personal computing

    The experience of this law firm encapsulates a major industry shift: Today, you don’t buy Windows, you rent access to it. Windows 365 Cloud PCs began as a business-only experiment at Microsoft but have grown into its central product and are now the primary road map, with local Windows installations becoming a mere stepping stone to cloud-based desktops. With tools like Windows 365 Boot, users can bypass the traditional local operating system altogether, landing directly into a personalized, cloud-streamed environment, even on third-party or bring-your-own devices.

    Hardware no longer anchors the user’s experience; the familiar PC is now a portal into a metered utility controlled, updated, and managed by Microsoft. Windows 365 Switch blurs the line even further, allowing seamless migration between cloud and local environments. With each step, more user agency is surrendered in exchange for the convenience of a cloud-managed world.

    The AI revolution and hardware

    As if the cloud weren’t enough, artificial intelligence is muddying the waters. Microsoft is loud about a future built on AI PCs, touting Copilot integration, neural processing units (NPUs), and specialized hardware. But as Dell’s own product head recently admitted, customers aren’t flocking to buy these new devices for AI alone; the proposition is too abstract, and the day-to-day benefits too unclear. In reality, most significant leaps in AI are happening in the cloud, not on the desktop. Even Jeff Bezos framed the future simplistically: AI will appear everywhere, but it will live in the cloud.

    Meanwhile, Microsoft is aggressively pushing its users to rely on its AI-powered tools and ecosystem, with access controlled through subscriptions. Gone is the idea of installing and running your own AI applications locally; instead, users are nudged to rent access to AI services, hosted and updated in Microsoft’s cloud. The notion of the self-managed PC is fast giving way to a persistent, subscription-based rental of power and capability, with AI primarily serving as another tool for vendor lock-in.

    Hidden costs and loss of control

    Businesses and individuals face new economic realities. The traditional model—investing in hardware for five years—is replaced by an ever-escalating treadmill. A basic Windows 365 Cloud PC costs about $41 a month for 8GB, excluding Office or AI add-ons. Vendors pitch this as a trade-off against the hidden costs and complexity of managing local computers in hybrid work. Before long, subscription fees will become just another line item in ballooning IT expenses.

    Perhaps more concerning is the core loss of control. The local PC gave users the keys. They owned, updated, installed, and protected their own digital spaces. The new cloud-and-AI reality puts Microsoft in charge of software, identity, AI tools, and even privacy decisions. The old personal computer offered freedom; the new model is managed, metered, and routinely adjusted to fit Microsoft’s evolving business interests. Yes, security can benefit. Yes, patching and remote management are simplified for companies. But every user now sits one step further removed from the heart of their own computing experience.

    That was linked by this piece, which was linked from Borepatch, who has further thoughts.

    What this means is that you don’t own any Microsoft software. Sure, you may think that because you paid them money (most often when you bought your computer – some of that purchase price went to Microsoft in the form of a license fee for Windows). But you actually don’t own “your” copy of software. At all.

    Rather, you have the right to run the software on your computer. That may not seem like a big difference, but it is. The license agreement (you know, the one you didn’t read before you clicked “I Agree”) allows Microsoft to change the terms of the agreement at any time, at their pleasure.

    Microsoft has just done this in a big, big way. Key new stuff in Windows 11 is:

  • AI integrated with your operating system
  • Online presence is critical for lots of Windows now (e.g. AI)
  • Windows will nag you until you put all your data online (OneDrive) whether you want to or not.
  • The proper technical term for that first bullet point is that your Windows operating system is essentially now an “AI Agent” which if you are a regular reader you know is very, very bad security juju.

    Combine this enormous security hole with the requirement to essentially be online 100% of the time (bad security) and the liklihood that OneDrive will slurp all your data to some Internet black hole in a Microsoft data center, Windows is simply unsecurable.

    Yes, I know that is inflammatory, but there is simply no way that you can get assurance that your security is sane. I say that as someone who has spent decades inn Internet Security (and particularly in security assurance). Not to put too fine a point on it, but I don’t think that I could get decent assurance that things aren’t going “bump in the Net”. For most of the readers here, it’s not even worth trying.

    And that AI, Copilot, is not only widely loathed by users, but is creating brand spanking new security holes.

  • “We’ve been following Microsoft and all their massive missteps over the last several months. Most of it related to AI and pushing AI into consumer products and pushing it on to people who don’t want it.”
  • “There’s an error with Copilot. Apparently, it can can read your email. That’s great. And Copilot is sort of the bedrock of Windows 11. It’s very hard to get rid of Copilot. They want to put it in everything, including Notepad.”
  • “Copilot slows everything down. I would highly recommend you turn it off.” If you can figure out how. Kneon recommends Linux Mint if you want a Windows-like experience.
  • “Look, Microsoft is not secure. And just realize if you’re using it, especially for business, if you don’t want anybody to see it, you probably shouldn’t use their tools.”
  • “A work tab within Copilot chat had summarized email messages stored in a user’s draft and sent folders even when they had a sensitivity label on it and a data loss prevention policy configured to prevent unauthorized data sharing.” Sounds like Copilot is as indifferent to your privacy and security as Microsoft on the whole.
  • “I don’t know if you can hurt Xbox anymore, because Xbox is a dying brand, but the new boss, who comes from an AI background, promises not to flood it with soulless AI slop. This is Asha Sharma, formerly the head of Microsoft’s AI division, which is causing problems. Now she’s in charge of Xbox. She promises many more great games made by humans.”
  • Sharma blather about how Xbox will run across multiple platforms instead of a console snipped. “Are we seeing first signs that Xbox is dead and about to be consumed by Microsoft? I think that’s 100% what’s going to happen.”
  • “I think they’re going to basically AI themselves into the wood chipper. I think it’s very clear that that’s all they care about right now, if they’re putting the head of AI in charge of gaming and she’s talking cloud and AI and all that. Yeah, it’s over, man.”
  • Microsoft CEO Satya Nadella is facing some accusations of “Indian nepotism” for putting Sharma in charge of Xbox, especially since she has no background in gaming development. Of course, Microsoft has long been accused of abusing the H1-B visa system to bring over cheap workers. Indeed, this MSN India piece crows about it.

    According to official H-1B filings submitted to the US Department of Labor between 2012 and 2023, Microsoft filed over 50,000 H-1B visa applications, and approximately 70 to 80 percent of these applications were for Indian nationals. This makes Indians the largest group in Microsoft’s US-based technical talent pipeline. The data shows a consistent year-on-year trend where Indian engineers make up the majority of Microsoft’s skilled immigrant workforce.

    Snip.

    Multiple research estimates and workforce studies indicate that 26 to 30 percent of Microsoft’s global technical workforce is Indian or Indian-origin.

    Snip.

    Microsoft operates one of its biggest global R&D centres in Hyderabad, which works on products including Azure, Office, Windows, LinkedIn integration, AI/ML systems and cybersecurity. The India Development Center (IDC), established in 1998, is one of Microsoft’s oldest and largest development facilities outside Redmond. This drives significant recruitment of Indian engineers for advanced research and product development roles.

    Snip.

    A review of Microsoft’s global leadership roster shows notable Indian-origin executives including Satya Nadella (CEO), Rajesh Jha (EVP), Suresh Kumar (EVP), Anil Bhansali (VP Engineering), and dozens of corporate vice presidents and product heads. This demonstrates the substantial representation of Indian-origin professionals in high-level technical and management roles within the company.

    But Microsoft also has a Jeffrey Epstein problem. Do a search on founder and former CEO Bill Gates in the Epstein files and you get 2,616 results. Nor is he the only Epstein-connected person of interest high in the ranks of Microsoft. Financier and Democrat megadonor Reid Hoffman is still listed on the Microsoft board, despite being notoriously close to Epstein and showing up in the Epstein files 2,667 times. (Also on the board: Former Obama Commerce Department head Penny Pritzker, sister of Illinois Governor J.B. Pritzker and aunt to Epstein friend Tom Pritzker, whose name shows up 2,524 times in the Epstein files.)

    Even before Microsoft jumped on the AI bus (or, if you prefer, off the AI cliff), it was notorious for security holes in its software, and there’s precious little evidence that the AI age has made anything better. The latest “Patch Tuesday” featured fixes for no less than six Zero Day exploits.

    What all this amounts to: Anyone still on Windows should look to move to Linux if they have the technical chops to do so, or Apple if they don’t. Though Apple has dabbled with subscription services as well, they’re still overwhelmingly a hardware company that wants to sell you the latest shiny. And Apple has been dinged for its “lazy” approach to AI, which may turn put to be the smartest move after all. “Amazon, Microsoft, Meta Platforms, and Alphabet are projected to spend around $700 billion combined on capital expenditures in 2026, much of it on AI data centers and hardware — Apple plans just $14 billion.” That means they’re less likely to try and shove it into every damn thing. And I know my now-relatively-ancient MacBook Pro keeps working even when the Internet is down.

    If you’re still on Windows, now might be the time to get out while the getting is good…


    Hat tip to the title.

    Latest Microsoft Patch Fixes TEN Zero Day Exploits

    Wednesday, August 21st, 2024

    “Patch Tuesday” is when Microsoft (and other software companies) regularly release patches for their software on the second Tuesday of a month. A “zero day exploit” is a serious, previously undisclosed security flaw in a shipping piece of software. Not every Patch Tuesday includes a zero day fix, and sometimes the release only fixes one or two.

    The latest Microsoft Patch Tuesday fix, released last Tuesday, fixes ten zero day vulnerabilities, six of which were already being exploited in the wild.

    Attackers are actively exploiting as many as six of the 90 vulnerabilities that Microsoft disclosed in its security update for August, making them a top priority for administrators this Patch Tuesday.

    Another four CVEs in Microsoft’s update were publicly known before the Aug. 13 disclosure, which also make them zero-days of a sort, even though attackers have not yet begun exploiting them. Among them, an elevation of privilege (EoP) bug in Windows Update Stack, tracked as CVE-2024-38202, is particularly troubling because Microsoft does not yet have a patch for it.

    The unpatched flaw allows an attacker with “basic user privileges to reintroduce previously mitigated vulnerabilities or circumvent some features of Virtualization Based Security (VBS),” according to Microsoft. The company has assessed the bug as being only of moderate severity because an attacker would need to trick an administrator or user with delegated permissions into performing a system restore.

    However, Scott Caveza, staff research engineer at Tenable, says that if an attacker were to chain CVE-2024-38202 with CVE-2024-21302 (an EoP flaw in the current update that affects Windows Secure Kernel), they would be able to roll back software updates without the need for any interaction with a privileged user. “CVE-2024-38202 does require ‘additional interaction by a privileged user,’ according to Microsoft,” he says. “However, the chaining of CVE-2024-21302 allows an attacker to downgrade or roll back software versions without the need for interaction from a victim with elevated privileges.”

    Caveza says each vulnerability can be exploited separately, but when combined, they could potentially have a more significant impact.

    In all, seven of the bugs that Microsoft disclosed this week are rated as critical. The company rated 79 CVEs — including the zero-days that attackers are actively exploiting — as “Important,” or of medium severity, because they involve some level of user interaction or other requirement for an attacker to exploit. “While this isn’t the biggest release, it is unusual to see so many bugs listed as public or under active attack in a single release,” said Dustin Childs, head of threat awareness at Trend Micro’s Zero Day Initiative (ZDI), in a blog post.

    This is, to use a technical term, “bad.”

    I’m not an expert in Windows security, but ten zero day exploits sounds like a new record.

    And just who is exploiting this vulnerability in the wild? Well, in one case, North Korea.

    A Windows zero-day vulnerability recently patched by Microsoft was exploited by hackers working on behalf of the North Korean government so they could install custom malware that’s exceptionally stealthy and advanced, researchers reported Monday.

    Getting pwned by North Korea is like getting arrested for knocking over a liquor store because you posted a picture of yourself in front of the store holding up the stolen cash on Facebook.

    The vulnerability, tracked as CVE-2024-38193, was one of six zero-days—meaning vulnerabilities known or actively exploited before the vendor has a patch—fixed in Microsoft’s monthly update release last Tuesday. Microsoft said the vulnerability—in a class known as a “use after free”—was located in AFD.sys, the binary file for what’s known as the ancillary function driver and the kernel entry point for the Winsock API. Microsoft warned that the zero-day could be exploited to give attackers system privileges, the maximum system rights available in Windows and a required status for executing untrusted code.

    Microsoft warned at the time that the vulnerability was being actively exploited but provided no details about who was behind the attacks or what their ultimate objective was. On Monday, researchers with Gen—the security firm that discovered the attacks and reported them privately to Microsoft—said the threat actors were part of Lazarus, the name researchers use to track a hacking outfit backed by the North Korean government.

    “The vulnerability allowed attackers to bypass normal security restrictions and access sensitive system areas that most users and administrators can’t reach,” Gen researchers reported. “This type of attack is both sophisticated and resourceful, potentially costing several hundred thousand dollars on the black market. This is concerning because it targets individuals in sensitive fields, such as those working in cryptocurrency engineering or aerospace to get access to their employer’s networks and steal cryptocurrencies to fund attackers’ operations.”

    Monday’s blog post said that Lazarus was using the exploit to install FudModule, a sophisticated piece of malware discovered and analyzed in 2022 by researchers from two separate security firms: AhnLab and ESET. Named after the FudModule.dll file that once was present in its export table, FudModule is a type of malware known as a rootkit. It stood out for its ability to operate robustly in the deep in the innermost recess of Windows, a realm that wasn’t widely understood then or now. That capability allowed FudModule to disable monitoring by both internal and external security defenses.

    Rootkits are pieces of malware that have the ability to hide their files, processes, and other inner workings from the operating system itself and, at the same time, control the deepest levels of the operating system. To work, rootkits must first gain system privileges and go on to directly interact with the kernel, the area of an operating system reserved for the most sensitive functions. The FudModule variants discovered by AhnLabs and ESET were installed using a technique called “bring your own vulnerable driver,” which involves installing a legitimate driver with known vulnerabilities to gain access to the kernel.

    Earlier this year, researchers from security firm Avast spotted a newer FudModule variant that bypassed key Windows defenses such as Endpoint Detection and Response, and Protected Process Light. Microsoft took six months after Avast privately reported the vulnerability to fix it, a delay that allowed Lazarus to continue exploiting it.

    Whereas Lazarus used “bring your own vulnerable driver” to install earlier versions of FudModule, group members installed the variant discovered by Avast by exploiting a bug in appid.sys, a driver enabling the Windows AppLocker service, which comes preinstalled in Windows. Avast researchers said at the time the Windows vulnerability exploited in those attacks represented a holy grail for hackers because it was baked directly into the OS rather than having to be installed from third-party sources.

    As I’ve noted before, Internet security is hard. Neither Mac nor Linux are entirely free of such exploits, but they seem to be a lot less frequent. Log4J wasn’t a Linux kernel exploit, but everyone (rightly) freaked out over it because Log4j was used everywhere and it let attackers install malicious code on your server.

    Microsoft patching ten zero day exploits suggests that there’s a big problem up in Redmond. You would think the zero day vulnerability numbers would be going down, not up. I wonder if we might be seeing that start of widespread AI use to find vulnerabilities in software.

    China Carries Out Giant Microsoft Hack

    Tuesday, March 9th, 2021

    This isn’t good:

    At least 30,000 organizations across the United States — including a significant number of small businesses, towns, cities and local governments — have over the past few days been hacked by an unusually aggressive Chinese cyber espionage unit that’s focused on stealing email from victim organizations, multiple sources tell KrebsOnSecurity. The espionage group is exploiting four newly-discovered flaws in Microsoft Exchange Server email software, and has seeded hundreds of thousands of victim organizations worldwide with tools that give the attackers total, remote control over affected systems.

    On March 2, Microsoft released emergency security updates to plug four security holes in Exchange Server versions 2013 through 2019 that hackers were actively using to siphon email communications from Internet-facing systems running Exchange.

    Microsoft said the Exchange flaws are being targeted by a previously unidentified Chinese hacking crew it dubbed “Hafnium,” and said the group had been conducting targeted attacks on email systems used by a range of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs.

    In the three days since then, security experts say the same Chinese cyber espionage group has dramatically stepped up attacks on any vulnerable, unpatched Exchange servers worldwide.

    In each incident, the intruders have left behind a “web shell,” an easy-to-use, password-protected hacking tool that can be accessed over the Internet from any browser. The web shell gives the attackers administrative access to the victim’s computer servers.

    Speaking on condition of anonymity, two cybersecurity experts who’ve briefed U.S. national security advisors on the attack told KrebsOnSecurity the Chinese hacking group thought to be responsible has seized control over “hundreds of thousands” of Microsoft Exchange Servers worldwide — with each victim system representing approximately one organization that uses Exchange to process email.

    Microsoft’s initial advisory about the Exchange flaws credited Reston, Va. based Volexity for reporting the vulnerabilities. Volexity President Steven Adair said the company first saw attackers quietly exploiting the Exchange bugs on Jan. 6, 2021, a day when most of the world was glued to television coverage of the riot at the U.S. Capitol.

    But Adair said that over the past few days the hacking group has shifted into high gear, moving quickly to scan the Internet for Exchange servers that weren’t yet protected by the security updates Microsoft released Tuesday.

    “We’ve worked on dozens of cases so far where web shells were put on the victim system back on Feb. 28 [before Microsoft announced its patches], all the way up to today,” Adair said. “Even if you patched the same day Microsoft published its patches, there’s still a high chance there is a web shell on your server. The truth is, if you’re running Exchange and you haven’t patched this yet, there’s a very high chance that your organization is already compromised.”

    This is a huge problem, because Exchange is only used by just about every big business in America, not to mention numerous government agencies. It dominates the market so thoroughly that it’s hard to find market share reports on its competitors.

    This hack, of course, is the second big Chinese hack, following the office of Personnel and Management hack under the Obama Administration.

    Here’s a timeline of the hack. Evidently Chinese hackers exploited no less than four zero day exploits to pull off the hack.

    Internet security is hard, and no one in the Federal government (with the possible exception of DoD and certain three initial agencies) seems to take it seriously.