McAfee Warns Against Vista Security Features
21101
Antivirus vendor cries foul, saying Microsoft locks out other vendors' products.
736753
(InfoWorld) - An online criminal has offered to sell software that exploits an unpatched bug in Microsoft Corp.'s Windows Vista operating system, according to security vendor Trend Micro Inc. The code was offered for sale in an underground hacker discussion forum last month, said Raimund Genes, Trend Micro's chief technology officer. The asking price? US$50,000. Genes didn't know if the code actually worked as advertised, or whether it was even purchased, but he said that it would have been difficult for the seller to have been involved with this particular forum without providing at least one reliable sample. "I think that definitely he had something," Genes said. "The question is whether somebody paid for this." If the offer is legitimate it would be the first serious bug reported in Vista since it was released to business customers at the end of November. The consumer version of Vista is set to ship next month. Microsoft is investigating Trend's claims but has "not been contacted directly by any parties about this vulnerability report, nor are we directly involved in the forums in which vulnerabilities are reportedly traded," the company said in a statement. If someone did pay for the code -- called a "zero-day" exploit -- it was purchased at a premium price. According to Genes, a similar exploit for Internet Explorer would command about $5,000. "This was way more," he said. "Maybe the person said, 'This is the first working exploit on Vista, so I can charge a premium.'" Because Vista is not as widely adopted as Microsoft's XP or Windows Server 2003 operating systems, criminals would have fewer potential victims to attack with the code. "To be honest [the price for a Vista zero day] should probably be lower," said Joe Telafici, vice president of Avert operations with McAfee Inc. "There's nobody to infect with it." There have been far fewer vulnerability disclosures in the weeks up to Vista's commercial release than there were when XP was introduced, Telafici said. That's partially due to the expansion of the underground marketplace for software bugs, he said. While most hackers were motivated by the fame and glory just a few years ago, they growth of cybercrime has introduced a new breed of more stealthy professionals, security experts say. Criminals who plan to use Vista vulnerabilities "are going to be holding them close to their chest until they are ready to release them," Telafici said. "I wouldn't be amazed if we saw vulnerabilities popping up over the next year that were found now."
189384
Antivirus software company McAfee Inc. said on Monday that a new version of its VirusScan Enterprise software contains so-called "intrusion prevention" features that can protect computers from attacks such as buffer overflows, which are often used by viruses, worms and malicious hackers to compromise vulnerable Microsoft Corp. Windows machines.
283180
(InfoWorld) - The honeymoon ended early for Microsoft's Vista operating system, after word spread Wednesday about a flaw that could allow remote attackers to take advantage of the new operating system's speech recognition feature. Microsoft researchers are investigating the reports of a vulnerability that could allow an attacker to use the speech recognition feature to run malicious programs on Vista systems using prerecorded verbal commands, the company said in an e-mail statement. The potential security hole was discovered after an online discussion prompted blogger George Ou to try out a speech-based hack. Ou reported on ZD Net on Tuesday that he was able to access the Vista Start menu and, conceivably, run programs using voice commands played over the system's speakers. The speech recognition flaw is novel and notable for being the first publicized hole in the new operating system since the public launch of Vista on Tuesday. The impact of the flaw, however, is expected to be small. Vista users would need to have the speech recognition feature enabled and have a microphone and speakers connected to their system. Successful attackers would need to be physically present at the machine, or figure out a way to trick the computer's owner to download and play an audio recording of the malicious commands. Even then, the commands would somehow have to be issued without attracting the attention of the computer's owner. Finally, attackersâ commands are limited to the access rights of the logged on user, which may prevent access to any administrative commands, Microsoft said in a statement. Microsoft recommends that users who are concerned about having their computer shout-hacked disable the speaker or microphone, turn off the speech recognition feature, or shut down Windows Media Player if they encounter a file that tries to execute voice commands on their system. Customers who believe they have been shout-hacked can contact Microsoft Product Support Services, the company said.
564903
A serious security hole in a wide swath of the company's antivirus products could let an outsider crash or hijack a computer.
580536
InfoWorld - The European Commission warned Microsoft again Tuesday that planned security features in the upcoming Windows Vista operating system could run afoul of EU antitrust laws, prompting Microsoft to say that an adverse ruling from European regulators could further delay Vista's ship date.
119952
The User Account Control built into Windows Vista is supposed to help make the new operating system safer. But it can be spoofed, undermining the very mission for which it was created, according to Symantec.
620954
Symantec published a series of four research reports on Feb 28 that critique various security elements of Microsoft's new Windows Vista operating system, including the software's ability to ward off existing malware threats.
58499
(InfoWorld) - When Windows Vista ships next year, customers might have a tougher time getting their security software to work properly, executives from Symantec said Wednesday. At issue are two new features being introduced with Vista: an enhanced Windows Security Center as well as a feature in the 64-bit version of Vista called PatchGuard. Microsoft says it is adding these features to lock down the operating system, but Symantec believes that they will be harmful to customers by making it harder for them to use third-party software. "There's no question that they're leveraging a monopolistic position to limit customer choice," said Chris Paden a Symantec spokesman. While Symantec executives did accuse Microsoft of being more difficult to work with on Vista than with previous operating system introductions, they stopped short of accusing Microsoft of antitrust violations. "It's not anti-competitive behavior, because Vista hasn't even hit the market yet, " Paden said. Security vendors like Symantec are in a state of heightened sensitivity these days as they've begun to compete with Microsoft head-on, and the specter of further antitrust actions looms over Microsoft's every move in the security space. Last week the European Union's spokesman on competition, Jonathan Todd, warned that theÂ market could be threatenedÂ if Microsoft doesn't allow security vendors a fair chance of competing. Symantec and other security vendors dislike PatchGuard because it prevents them from accessing the Windows kernel. They say it will stop them from delivering important features like Symantec's "anti-tampering" technology, which prevents malicious programs from modifying Symantec's own software. PatchGuard will also make it more difficult for security vendors to protect against malicious software that takes advantage of kernel-level bugs, said Eric Sites, vice president of research and development with Sunbelt Software. "There are a lot of new exploits coming out that exploit kernel-level drivers, " he said. "If we're able to get into the kernel, we can watch for things like that, but with what Microsoft is doing we can't do that." Microsoft declined to be interviewed for this article, but in an interview with IDG News last week a Microsoft executive said that PatchGuard was simply an effort toÂ prevent the kernel from being misused. "We think that there's a significant amount of confusion around... certain security features in the product that we think raise the foundation," said Stephen Toulouse a senior product manager in the Security Technology Unit. "What we're doing is we're walling off the kernel from attackers, because the functionality that is currently there was never meant to be used by anybody -- by software vendors or attackers." But PatchGuard is enabled only in the 64-bit version of Windows. Because there are few 64-bit applications written for Vista, most of Vista's initial users are expected to run the operating system in 32-bit mode, and their security software will still be able to access the kernel. A more immediate issue for Symantec is many Vista users will find that both the Windows Security Center and Symantec warnings will pop up simultaneously. This doesn't happen with Windows XP because Symantec's software is able to automatically disable the Windows warnings, but with Vista users will have to turn off the Security Center themselves. This will make things unnecessarily complicated for many customers, said Rowan Trollope, Symantec's vice president of consumer engineering. "Most users can't figure out how to do that," he said. With two warnings popping up, each with different wording, users will be confused at best, and may simply begin ignoring security warnings altogether, said Sites. Some observers have speculated that Symantec may press the EU for action against Microsoft in this matter, but Trollope and Paden wouldn't say what Symantec planned to do to address these problems. "We're looking at all the possibilities now," said Trollope, "And none of them are good for customers."ADVERTISEMENTMAKE SOA REAL WITH IBM WEBSPHERE PODCASTStreamline processes and maximize efficiency within a proven service oriented architecture. Take back control of your business processes with IBM WebSphere.
735989
Anti-virus company Symantec warned its customers about a number of critical holes in Windows that surfaced late Thursday and that could make their systems vulnerable to compromise by remote attackers.
632400
(InfoWorld) - Windows Vista will be the most secure operating system that Microsoft Corp. has released, a company executive said Tuesday at a Vista launch event in Washington, D.C. Microsoft has listened to feedback from users, who disagreed with the decision to have some security features turned off by default in Windows XP, said Bill Veghte, Microsoft's corporate vice president for North America. "I won't mince words," Veghte said to an audience of nearly 3,000 people. "Every single time we had a trade-off between application compatibility or security, we went with security." ButÂ Windows VistaÂ also includes a feature that shows users which applications have problems after switching from an earlier version of Windows and the fixes that are available for those issues, Veghte said. Microsoft will also submit its Office SharePoint Server 2007 for U.S. Department of Defense (DOD) certification for electronic records management, Veghte said. Microsoft, working with partner Applied Information Sciences Inc., expects to have SharePoint Service compliant with DOD 5015.2 standard in May. The DOD standard focuses on secure records handling, requiring encryption on Web-based applications, the ability to schedule records to expire, and the ability to restrict user access to documents. Applied has developed a Records Management Center add-on pack to SharePoint Server, part of the MicrosoftÂ Office 2007 suite released Tuesday along with Vista. That add-on will allow users to comply with the DOD standard and have "military-grade" records management, said Russ Stalters, Applied's chief technology officer. The add-on package will allow customers to collaborate using SharePoint without buying third-party records-management software, as SharePoint users have had to do in the past, Stalters said. By complying with the DOD standard, the software package "sets the bar" for records management for customers in highly regulated industries, he said. In addition to the DOD compliance, Microsoft's new offerings contain several new security features, Veghte said in his speech. Microsoft has the responsibility of setting the standards for secure defaults and architecture in Vista, he said. Hackers are not standing still, and "we have to keep pace," he said. Among the new security features in Vista: -- System administrators can stop PCs from allowing USB (Universal Serial Bus) drives or other peripherals to be connected. -- Vista and Internet Explorer will warn users when a Web site attempts to install dangerous code. -- An antiphishing site, updated hourly, will warn users of e-mail messages that attempt to trick them into giving up their personal information. -- If a user manages to download malware, the Windows Defender security software is designed to block it from doing damage. -- The Enterprise and Ultimate versions of Vista will allow users to encrypt hard drives. Vista's BitLocker Drive Encryption feature is an attempt to address continuing problems with data breaches, often caused by lost laptops, Veghte said. About 660,000 laptops were lost or stolen in the U.S. in 2006, he said, leading to a lot of stories about such incidents that "ended up on the front page" of major newspapers.
300776
'Secure Development Lifecycle' only goes so far Microsoft on Tuesday issued two security updates, one of them rated critical that fixes nasty bugs in Windows Vista that could allow an attacker to gain complete control over a user's machine.â¦
159626
McAfee this week plans to announce an add-on for its enterprise antivirus products to offer increased protection against spyware. Users of McAfee VirusScan Enterprise Edition versions 7.1 or 8.0i next month
356268
Windows Vista is still prone to attack by three notorious pieces of malware -- mainly because the threats in question rely on social engineering to launch their invasions.
340263
(InfoWorld) - A security vendor is offering an add-on product for Windows Vista's User Account Control feature, which has been flagged as a threat to business users because it can be easily bypassed by hackers. BeyondTrust's Privilege Manager 3.0, which will be available on March 19 and costs $30 per user, protects enterprise desktops running Vista with User Account Control in two major ways, said John Moyer, CEO of BeyondTrust. First, it grants elevated privileges to certain applications and functions transparently to end users, instead of involving them in the process with dialogue boxes, he said. Hackers can use these dialogue boxes to trick users into unknowingly allowing malicious code to run on the machine. Security vendor Symantec recently released research thatÂ outlined some of Vista's security holes and listed User Account Control as one of them for the reason Moyer outlined. Microsoft has said it is evaluating Symantec's research about Vista and will take steps to fix any vulnerabilities in the OS. Microsoft included User Account Control in Vista to add security by limiting the access individual users have to applications or functions. While this is an enhancement for home users, it presents a security problem for business users because in order to access certain applications that are beyond the scope of their limited privileges, they must set up and use administrator passwords to set higher access rights, Moyer said. These dialogue boxes that ask them for passwords provide a way for hackers to get in, he said. The second feature of Privilege Manager that helps prevent intrusion through User Access Control gives IT administrators centralized administration of setting the elevation of privileges for users, even though Privilege Manager itself runs locally, Moyer said. BeyondTrust's application connects to the group policy features of Vista to allow for this type of administration, he said. BeyondTrust spun off from Desktop Standards, a company which Microsoft announced it had purchased on Oct. 2. Twenty employees of DesktopStandard took the Policy Maker Application Security product and became BeyondTrust. That product later was rebranded Privilege Manager, Moyer said.
360314
Windows XP and Windows Vista systems can be exploited if they haven't been updated with Redmond's first patch of 2008, says security firm.
332636
In a Knowledgebase advisory to developers today, Microsoft is urging developers for Windows Vista who intend for their programs to run under Service Pack 1 not to assume the default search protocol being used by the system is Microsoft's.