Enable Vista's hidden administrator account, and password-protect its equivalent in XP
15811
Get an added level of protection by activating this backup administrator account in Vista, and safeguarding it in XP.
158629
(InfoWorld) - MicrosoftÂ has released the beta of a tool that will test business PCs to see if they are compatible with Windows Vista. Users can download the Windows Vista Hardware Assessment 2.0 Public Beta online now. The application helps business users see how much effort it will take to migrate desktops in a company to Vista by testing the hardware and device-driver capability of PCs against the OS and issuing reports about those results, according to Microsoft's internal Windows Vista blog. In addition to testing hardware for Vista, the software also will check to see if a PC is compatible with the Office 2007 suite, according to Microsoft. To download the beta, users need a Windows Live or Passport log-on so they can first register for the beta program. Since making Windows Vista available to business customers last November, Microsoft has offered a host of tools to help customers with the deployment of the new OS with two more coming earlier this week at its TechEd 2007 conference in Orlando. Released at the show, the Data Encryption Toolkit for Mobile PCs helps IT administrators set encryption policies for laptops in an enterprise using the encrypting file system and new BitLocker features of Windows Vista, while the Virtual Hard Drive Test Drive allows enterprises to run a virtual version of Vista on PCs to see how it will interact with existing applications.
662461
A Windows Vista feature designed to simplify computing for disabled users has security implications, according to a McAfee researcher.
321146
Fornisce password e indicazioni per esaminare i computer
735291
Many computer users prefer to install their operating system "clean" by simply using their old Windows disc to verify they own a copy of the software. However, that appears to no longer be possible using an Upgrade version of Windows Vista.
340263
(InfoWorld) - A security vendor is offering an add-on product for Windows Vista's User Account Control feature, which has been flagged as a threat to business users because it can be easily bypassed by hackers. BeyondTrust's Privilege Manager 3.0, which will be available on March 19 and costs $30 per user, protects enterprise desktops running Vista with User Account Control in two major ways, said John Moyer, CEO of BeyondTrust. First, it grants elevated privileges to certain applications and functions transparently to end users, instead of involving them in the process with dialogue boxes, he said. Hackers can use these dialogue boxes to trick users into unknowingly allowing malicious code to run on the machine. Security vendor Symantec recently released research thatÂ outlined some of Vista's security holes and listed User Account Control as one of them for the reason Moyer outlined. Microsoft has said it is evaluating Symantec's research about Vista and will take steps to fix any vulnerabilities in the OS. Microsoft included User Account Control in Vista to add security by limiting the access individual users have to applications or functions. While this is an enhancement for home users, it presents a security problem for business users because in order to access certain applications that are beyond the scope of their limited privileges, they must set up and use administrator passwords to set higher access rights, Moyer said. These dialogue boxes that ask them for passwords provide a way for hackers to get in, he said. The second feature of Privilege Manager that helps prevent intrusion through User Access Control gives IT administrators centralized administration of setting the elevation of privileges for users, even though Privilege Manager itself runs locally, Moyer said. BeyondTrust's application connects to the group policy features of Vista to allow for this type of administration, he said. BeyondTrust spun off from Desktop Standards, a company which Microsoft announced it had purchased on Oct. 2. Twenty employees of DesktopStandard took the Policy Maker Application Security product and became BeyondTrust. That product later was rebranded Privilege Manager, Moyer said.
454144
PC owners will be able to download a major security update for Windows XP as from Wednesday.
61296
Don&#39;t have Windows XP? Listen up anyway, because there&#39;s a lesson to learn, not to mention sly put downs you can use to annoy your Windows-XP-using-friends so they&#39;ll finally break down and admit
162252
Despite reports to the contrary, Microsoft has confirmed to BetaNews that it has made no changes to its Windows Genuine Advantage program to lock out users with invalid or pirated keys. "Microsoft has no plans to lock users out of their PCs, nor does it have the technical capacity to do so," the company told BetaNews.
144976
Microsoft will patch a flaw in the Windows operating system Tuesday that could give attackers access to passwords on a victim&#39;s system, according to security vendor SkyRecon Systems.&quot;During our ongoing research into the Windows LPC (Local Procedure Call) interface, we found an important vulnerability which could be used to gain elevated privilege and then execute code in the LSASS process,&quot; SkyRecon said in a statement e-mailed to IDG News.The flaw will be patched in&#160;Microsoft&#39;s upcoming set of security patches, set to be released around 11 a.m. Pacific time Tuesday, the company said.The LSASS (Local Security Authority Subsystem Service) process is used by Windows to manage account credentials in Windows. A LSASS bug was famously exploited by the Sasser worm in 2004, but this latest flaw appears to be far less serious.That&#39;s because, unlike the Sasser vulnerability, this bug does not allow a remote attacker to run unauthorized software on a victim&#39;s computer. &quot;If the vulnerability is exploited, there is a potential for saved passwords to be accessed by users that did not originally posses the proper credentials to access this sensitive information,&quot; SkyRecon said.The flaw affects Windows 2000, XP, and 2003 Server operating systems, and was reported to Microsoft in the last few months, according to SkyRecon, a security software vendor based in Paris.Microsoft&#39;s public relations agency declined to comment on SkyRecon&#39;s alert, but last Thursday the software giant said that it planned to patch an important &quot;local elevation of privilege&quot; flaw that affected these three versions of Windows.Because an attacker would first need to have a way of running software on the victim&#39;s system, the vulnerability is &quot;semi-serious,&quot; said Eric Schultze, chief technology officer with Shavlik Technologies. &quot;Let&#39;s say you are hosting your Web site at an ISP and that ISP keeps many Web sites on that same server,&quot; he said via instant message. &quot;If you can do that, you can upload the exploit, then run it via your Web server... and then access passwords that you shouldn&#39;t be allowed to access.&quot;Microsoft hasn&#39;t said much about the other security update it expects to release tomorrow, except to say that it is a critical bug-fix for Windows Vista and XP users because the vulnerability it fixes could be used by attackers to install unauthorized software on a victim&#39;s computer. This update is rated important for Windows Server 2003 users and considered moderate for Windows 2000.In December, SkyRecon was credited with discovering another elevation of privilege flaw, this one in Windows Vista, that was fixed in Microsoft&#39;s last set of security updates.&#160;
478392
(InfoWorld) - A Windows feature designed to simplify computing for disabled users could be misused in Vista, a McAfee researcher reported Monday. Attackers could use this feature, called StickyKeys, to trick a user into launching unauthorized software on the Vista machine, according to Vinoo Thomas, a McAfee researcher who blogged about the issue on Monday. StickyKeys is launched when a Windows user hits a modifier key like Shift or Alt five times. This makes the modifier key "sticky" so commands like Shift-F1 can be launched without having to hit two keys simultaneously. An attacker could replace the sethc.exe file used to launch StickyKeys with some other executable, like the Windows command utility, Thomas wrote. This backdoor vulnerability was already known to exist in Windows 2000 and Windows XP, according to Thomas. Although it is interesting that Vista is also vulnerable, it's not clear how useful the backdoor would be to an attacker because one must first gain access to the machine in order to replace the StickyKeys file. Thomas believes that it could be used by an inside attacker to bypass log-in on terminal servers and workstations. Microsoft executives were not immediately available to comment on the issue. To avoid the problem, "one can uninstall the Accessibility Tools feature, which is installed by default, to avoid this fairly simple, yet potentially serious built-in backdoor," he wrote. "And don't forget to hit the shift key five times and see what pops up on your desktop."
195221
Windows XP Service Pack 2 promises to raise the security bar for the sometimes beleaguered operating system. Unfortunately, one of the new features could be spoofed so that it reports misleading information
469822
InfoWorld - Microsoft&#160;finally rolled its&#160;Vista operating system out the door Tuesday, billing it as its most secure operating system ever, but what are the security features that will really matter to enterprise users?
530074
With automatic download of Microsoft's (Nasdaq: MSFT) enormous SP2 security patch to the Windows XP operating system set to begin, the industry still waits to understand its ramifications. Home users that have their preferences set to receive operating-system updates as they are made available by Microsoft may be surprised to learn that some of the software they already run on their systems could be disabled by SP2 or may run very differently.
42408
Vista, schmista. If you're not interested in switching, just follow our tips for optimizing and maintaining your Windows XP setup -- and yes, even getting some of Vista's security and interface improvements in XP.
548753
(InfoWorld) - MicrosoftÂ finally rolled itsÂ Vista operating system out the door Tuesday, billing it as its most secure operating system ever, but what are the security features that will really matter to enterprise users? To answer this question, IDG News Service asked Russ Humphries, a senior program manager with the Vista security team, to list the three Vista features that will have the biggest effect. Here's his list: 1) UAC (user account control) Before Vista, Windows automatically gave users too much power over their systems, Microsoft has said. With UAC, Windows will require a few extra steps before the user can do things such as install new programs. The feature will make it much easier for corporate administrators to lock down desktops and prevent users, or malicious programs, from messing around with the system or installing unauthorized software. UAC has been one of Vista's most controversial features with early testers complaining that they were overwhelmed with pop-up messages warning them about every little change they made to the system. But these warnings will not slow down most enterprise users because they won't be installing device drivers or software, Humphries said. "Most corporate users are going to get a corporate image that will have all their applications already installed on the image," he said. 2) Windows Defender With Vista, Microsoft has built a defense against pop-up ads and unwanted spyware right into the operating system. AlthoughÂ Defender has been criticized for not being as effective as commercial products, the fact that it will be so widely deployed is bound to improve things. "Adware is a huge annoyance, a security risk, and a bit of a machine hog, " Humphries said. "This has benefits for home users, small and medium-sized enterprises, and even large organizations." 3) BitLocker There have been more than 100 million U.S. victims of data breaches over the past two years, according to Privacy Rights Clearinghouse. BitLocker aims to prevent the next 100 million from getting hit quite so quickly by giving corporate users a way to encrypt and password-protect their data. With BitLocker encrypting Vista's data, a stolen PC doesn't turn into a front-page data breach story,Â as was the case with the U.S. Department of Veterans Affairs last year. BitLocker can also ensure that the operating system hasn't been tampered with at boot-up time, but customers seem to particularly appreciate the fact that it will help keep their companies out of the newspapers every time a laptop is lost. "I've had a lot of thank-yous from our customers," Humphries said.
58499
(InfoWorld) - When Windows Vista ships next year, customers might have a tougher time getting their security software to work properly, executives from Symantec said Wednesday. At issue are two new features being introduced with Vista: an enhanced Windows Security Center as well as a feature in the 64-bit version of Vista called PatchGuard. Microsoft says it is adding these features to lock down the operating system, but Symantec believes that they will be harmful to customers by making it harder for them to use third-party software. "There's no question that they're leveraging a monopolistic position to limit customer choice," said Chris Paden a Symantec spokesman. While Symantec executives did accuse Microsoft of being more difficult to work with on Vista than with previous operating system introductions, they stopped short of accusing Microsoft of antitrust violations. "It's not anti-competitive behavior, because Vista hasn't even hit the market yet, " Paden said. Security vendors like Symantec are in a state of heightened sensitivity these days as they've begun to compete with Microsoft head-on, and the specter of further antitrust actions looms over Microsoft's every move in the security space. Last week the European Union's spokesman on competition, Jonathan Todd, warned that theÂ market could be threatenedÂ if Microsoft doesn't allow security vendors a fair chance of competing. Symantec and other security vendors dislike PatchGuard because it prevents them from accessing the Windows kernel. They say it will stop them from delivering important features like Symantec's "anti-tampering" technology, which prevents malicious programs from modifying Symantec's own software. PatchGuard will also make it more difficult for security vendors to protect against malicious software that takes advantage of kernel-level bugs, said Eric Sites, vice president of research and development with Sunbelt Software. "There are a lot of new exploits coming out that exploit kernel-level drivers, " he said. "If we're able to get into the kernel, we can watch for things like that, but with what Microsoft is doing we can't do that." Microsoft declined to be interviewed for this article, but in an interview with IDG News last week a Microsoft executive said that PatchGuard was simply an effort toÂ prevent the kernel from being misused. "We think that there's a significant amount of confusion around... certain security features in the product that we think raise the foundation," said Stephen Toulouse a senior product manager in the Security Technology Unit. "What we're doing is we're walling off the kernel from attackers, because the functionality that is currently there was never meant to be used by anybody -- by software vendors or attackers." But PatchGuard is enabled only in the 64-bit version of Windows. Because there are few 64-bit applications written for Vista, most of Vista's initial users are expected to run the operating system in 32-bit mode, and their security software will still be able to access the kernel. A more immediate issue for Symantec is many Vista users will find that both the Windows Security Center and Symantec warnings will pop up simultaneously. This doesn't happen with Windows XP because Symantec's software is able to automatically disable the Windows warnings, but with Vista users will have to turn off the Security Center themselves. This will make things unnecessarily complicated for many customers, said Rowan Trollope, Symantec's vice president of consumer engineering. "Most users can't figure out how to do that," he said. With two warnings popping up, each with different wording, users will be confused at best, and may simply begin ignoring security warnings altogether, said Sites. Some observers have speculated that Symantec may press the EU for action against Microsoft in this matter, but Trollope and Paden wouldn't say what Symantec planned to do to address these problems. "We're looking at all the possibilities now," said Trollope, "And none of them are good for customers."ADVERTISEMENTMAKE SOA REAL WITH IBM WEBSPHERE PODCASTStreamline processes and maximize efficiency within a proven service oriented architecture. Take back control of your business processes with IBM WebSphere.