Microsoft Downplays Malware Warnings
21107
Despite Window Server vulnerability recently reported, company says there's no cause for alarm.
443882
Microsoft said some spyware could cause computers to freeze up upon installation of the SP2 update. Microsoft recommends that users clean their PCs of spyware and back up their data before
22770
Unpatched Windows machines are vulnerable to latest adware attack
314915
Microsoft plans to block access to some features by unlicensed versions of OS.
313376
(InfoWorld) - Banner advertisements for a security application said to report false or inflated threats appeared for at least a few days on Microsoft's instant messaging (IM) program, prompting warnings from security analysts. Microsoft appears to have removed the ads, which were displayed in the contacts panel for its IM program, Windows Live Messenger, said Sandi Hardmeier, a Microsoft Most Valued Professional, a designation the company gives to people who have expertise with its products. The progam, known as Winfixer, falsely warns a computer has been infected with malicious software, according to Symantec. It asks users to buy a program to remove the unwanted software. "Quite often, it reports files that are perfectly safe," Hardmeier said. "It uses a lot of false positives. Basically, it's a rip off." Other security companies, such as Sophos and McAfee, classify Winfixer as a "potentially unwanted application." Hardmeier, who notified Microsoft of the problem, said the ads that appeared on Windows Live Messenger tried two ways to get users to install Winfixer on their machine. The first was via a pop-up window offering to scan the computer for problems, she wrote. Depending on the version of Internet Explorer used, Winfixer would try to download itself through an Active X control, she said. The second way was through a banner advertisement that a user would have to click before being taken to a Web site offering Free PC-Secure, a program that is detected as Winfixer by most security software, she said. Winfixer goes by several different names, including ErrorSafe and DriveCleaner. Microsoft had done well preventing spyware programs from being advertised in banner ads on Windows Live Messenger, formerly known as MSN Messenger, Hardmeier wrote on her blog on her blog, Spyware Sucks. But Winfixer has proved a tricky foe. Advertising networks have had trouble with Winfixer ads suddenly being served up by their networks despite no affiliation with its creators, Hardmeier said. The suspicion is that organizations have falsely registered with the networks and substituted Winfixer ads -- hosted on their own servers -- instead of the advertisements they agreed to supply, she said. Microsoft officials contacted in London on Monday morning could not immediately comment.
758435
Security researchers Tuesday said they&#39;d discredited Microsoft&#39;s claim that the year&#39;s first critical Windows vulnerability would be &quot;difficult and unlikely&quot; to be exploited by attackers.On Tuesday, Immunity updated a working exploit for the TCP/IP flaw spelled out Jan. 8 in Microsoft&#39;s MS08-001 security bulletin, and posted&#160;a Flash demonstration of the attack&#160;on its Web site. The exploit, which was released to customers of its CANVAS penetration testing software -- but is not available to the public -- was a revised version of&#160;code first issued two weeks ago.&quot;This demonstrates conclusively that the MS08-001 IGMPv3 vulnerability is highly exploitable,&quot; said Dave Aitel, Immunity&#39;s chief technology officer, in a message to his Dailydave security mailing list.Aitel&#39;s assertion challenged Microsoft&#39;s earlier assessment that &quot;there are a number of factors that make exploitation of this issue difficult and unlikely in real-world conditions.&quot;Immunity did acknowledge that its newest exploit was not 100 percent reliable, however.Other security companies reacted to the revamped attack code and Flash proof by issuing new alerts. Symantec, for instance, sent a new warning to customers of its DeepSight threat network. &quot;The exploit demonstrates remote code execution,&quot; noted Symantec. &quot;The exploit works against Windows XP SP2 English Default [and shows] two Windows XP SP2 computers on a local subnet with firewall enabled being compromised.&quot;It urged users who have not already deployed the patches Microsoft issued Jan. 8 to do immediately.Previously, Aitel had called out the IGMP (Internet Group Management Protocol) vulnerability as a potential blockbuster for 2008. In a detailed analysis of the flaw and its exploitation, Symantec agreed that the reward to hackers would be large even if replicating Immunity&#39;s work might be tough.&quot;Although exploitation of a remote kernel flaw is considered quite difficult, over the past few years numerous papers have been released on the subject,&quot; the Symantec analysis noted. &quot;Examples of exploits successfully leveraging such flaws have also been released to the public. Therefore, we assume that this issue will be exploited in the wild to execute arbitrary code. Deploy patches immediately.&quot;Successful attacks by the Immunity exploit -- and any similar to it developed by others -- allows arbitrary code to execute within the context of the Windows kernel, said Symantec, an especially egregious scenario for Windows Vista.&quot;This is especially critical on Vista, due to its enhanced kernel security mechanisms,&quot; said Symantec. &quot;A local user, even an admin, may have difficultly introducing unsigned code into the kernel, but in this case, it can be done remotely without any authentication whatsoever.&quot;This vulnerability presents an opportunity to not only execute arbitrary code on the system, but also to install backdoors and other malicious tools as well as a rootkit, which may normally be more difficult with a typical remote userland vulnerability.&quot;In its Jan. 8 MS08-001 bulletin, Microsoft ranked the IGMP flaw as &quot;Critical&quot; for Windows XP SP2, Windows Vista, Windows Small Business Server and Windows Home Server. On other versions, including Windows Server 2003, the bug rated an &quot;Important&quot; label.Computerworld is an InfoWorld affiliate.&#160;
411156
Microsoft's consumer security software changes the AU (Automatic Updates) settings in Windows XP and Vista without telling users or getting their approval, a researcher said Thursday -- behavior that may explain recent reports of patches being installed and systems rebooting without permission.When Microsoft responded to new charges of silent changes last week, however, it denied that AU settings were ever altered without user approval, and it didn't mention OneCare as a possible culprit.Scott Dunn, an editor at the "Windows Secrets" newsletter, reported Thursday morning that OneCare silently changes AU settings as it installs. No matter what AU setting the user selected previously, OneCare's installer quietly changes it to the fully automatic option."Some security products have turned on AU in the past," said Dunn, who also tested several other current consumer suites, including Symantec's Norton 360 and Norton Internet Security, McAfee's Internet Security Suite, and Check Point Software's ZoneAlarm Internet Security Suite. "But OneCare was the only guilty party."OneCare's willful way with AU may be an explanation for the reports two weeks ago of machines downloading and installing the Oct. 9 set of security fixes even though their owners had explicitly instructed Windows to ignore all downloads or notify them before they were installed.Several days later, after it wrapped up an investigation, Microsoft said AU settings were never changed without user consent, and it blamed absent-minded users for making modifications and then forgetting that they had."I find this surprising and very disturbing," said Dunn. "If they're going to change [AU] settings, they should let you know."Four options, down to one In both Windows XP and Vista, users can select from four options in AU: Download and install all updates automatically; download files but do not install them without user consent; check for but neither download nor install without permission; and disable Automatic Updates entirely.OneCare, sold for $49.95 and offered as a free 90-day trial, sets AU to the first, and all-automatic, setting, said Dunn, on both operating systems. "It does that even if Automatic Updates is completely disabled," he added. If users later uninstall OneCare -- for instance, after a trial has expired -- the software does not return the machine to the earlier settings; they must be reset by the user."Worse, OneCare silently turns on [Windows] services that have been disabled by the user," Dunn said, referring to the two services that some users, frustrated at earlier incidents in which Windows retrieved and installed patches without permission, have manually turned off: Automatic Updates and Background Intelligent Transfer Service. The services can be switched off manually using the Windows services.msc utility. Normally, once disabled, they remain that way until the user manually turns them back on.ComputerWorld confirmed Dunn's account of OneCare's AU changes by installing the security suite on both Windows XP and Windows Vista.At no time during installation, said Dunn, does OneCare tell the user that the software will modify Windows' settings or provide an opt-in dialog. Nor do the various online documents -- including Microsoft's privacy statement and an addendum for OneCare -- that are offered up early during the process contain any information about the changes. "It turns out there's a brief mention of it buried deep in one of the OneCare help files," said Dunn. "But that's not the same as telling users upfront."The help file (select "What does Windows Live Update do to help manage and maintain my computer's software updates?" to view the pertinent section) acknowledges that OneCare makes changes without bothering to ask. "When you first install Windows Live OneCare, setup automatically enlists your computer in Microsoft Update and changes your computer's settings to download and install updates automatically using Automatic Updates," it reads.Who's 'forgetful' now? Although Microsoft was not immediately available for comment this morning, it made it clear last week that reports of unauthorized updates, and even PC reboots, could not be blamed on its software."I want to stress that the Windows Update client does not change AU settings without users' consent," said Nate Clinton, a program manager with the Microsoft Update team in a company blog entry a week ago. He went on to list five possible explanations; all require the user to take action or accept one option from several offered.Earlier, a Microsoft spokeswoman had been more blunt. "It may be more a case of someone clicking to change their AU settings but not realizing/remembering doing so," she said last Tuesday. She also called out OneCare's installation as one such possible moment and claimed that the security suite offered users the option of changing AU settings. It does not."This is just one more example of Microsoft having the attitude that we know better than you do, that you should just stop asking questions and let us do what we want," said Dunn.Computerworld is an InfoWorld affiliate
484861
On October 10, Microsoft will issue 11 security bulletins as part of this month's Patch Tuesday. Six of the updates affect Windows, with the highest severity being "critical." Another four patches will cover Microsoft Office, also with critical severity, while a moderate fix is slated for the .NET Framework.
104425
Security rival says Microsoft is withholding spyware APIs for the Windows update, but the software giant denies it.
510270
Mobile malware is consistently increasing but poses a much lower security threat than that aimed at PCs, says CEO.
698181
(InfoWorld) - Nearly a year after Microsoft introduced Windows Live OneCare, the company's first foray into the security market is still getting low marks from analysts and users. A recent report comparing the antivirus products of various vendors ranked Microsoft's product at the bottom in terms of detecting potential security threats. At the same time, users are complaining that OneCare, which includes firewall, antivirus, backup, and antispyware software, quarantines the entire mail store of their Outlook and Outlook Express programs, making it impossible for them to retrieve e-mail. AV-Comparatives, a project in Austria overseen by security researcher Andreas Clementi, published the antivirus comparison report, which also looked at products from Symantec, McAfee, Kaspersky Lab, BitDefender, Fortinet, F-Secure, and several other antivirus products from smaller vendors. In detecting Windows viruses, worms, macros, scripts, and other OS threats, Microsoft ranked last out of the 15 vendors tested, detecting them 91 percent of the time. G Data Software AG's Anti-Virus Kit (AVK) ranked first with 99.6 percent detection, while products from three vendors -- Kaspersky Anti-Virus, MicroWorld Technologies eScan, and F-Secure Anti-Virus -- tied for second with 99 percent detection. TrustPort Antivirus Workstation from AED came in third with 98.9 percent detection. In preventing intrusion through backdoors, Trojans and in other malware detection, Windows OneCare also ranked last out of 13 vendors, with 79.6 percent detection. TrustPort came in first at 99.5 percent detection; AVK came in second with 99.4 percent detection; and AVIRA GmbH's AntiVir Personal Edition Premium came in third with 98.9 percent detection. If ranking low in its rates of malware and virus detection isn't enough to irk users, a recent update to the product has been quarantining the Outlook.PST file, which stores mail in Outlook and Outlook Express, users reported recently on a Microsoft Windows user form. "This is the most unacceptable act Microsoft has ever committed," groused one user on the forum. "I run a small business, and I am screwed. I have no way to respond to e-mails because I made the mistake of trusting Microsoft ... and all of my e-mails and contacts are gone." Microsoft confirmed the problem Friday and said it will update the Windows Live OneCare engine to fix the problem as part of its monthly patch release cycle. The company also offered the following step-by-step fix to recover lost e-mail in the meantime: *Â Close Outlook or Outlook Express *Â Click change OneCare settings in the main OneCare user interface *Â Click on the viruses and spyware tab *Â Click on the quarantine button, and then select the pst or dbx file, and then click on restore. To ensure that the problem does not continue until the next update, Microsoft said users should also do the following: *Â Click change OneCare setting in the main user interface *Â Click viruses and spyware tab *Â Click on the exclusions button *Â Click on the add folder button *Â Navigate to the specific folder that contains the .dbx or .pst file to be excluded. *Â Click OK.
643524
Windows users got no holiday break from security concerns as Symantec said it had confirmed three more yet-to-be-patched vulnerabilities in the Microsoft operating system, some of which can be used to launch denial-of-service attacks.
278592
A REPORT last week said that Microsoft will not build the latest security features in Windows XP browser and expects customers to upgrade to the OS from previous software to gain prophylactic protection.
501620
Microsoft Corp. is flatly denying what it calls &quot;misguided reports&quot; of a flaw in its new Windows XP Service Pack 2 upgrade that exposes security information to hackers.
441332
Trojan horses are piggybacking on an antipiracy feature in Media Player, a security firm claims. But Microsoft denies it's a flaw.
359809
(InfoWorld) - There was a little surprise buried inÂ Microsoft's monthly security bulletins Tuesday. It turns out that Microsoft had quietly slipped out one of the February fixes just days before its Jan. 30 Vista launch. The fix was for a bug in Microsoft's Malware Protection Engine, used by products like Windows Defender, OneCare, and Antigen to scan for malware. Microsoft had discovered that the engine could possibly be tricked into running unauthorized code if it scanned a specially crafted PDF file. Nobody has actually launched such an attack, but since these products are always automatically scanning for malware in the background, the vulnerability could have led to some pretty nasty exploits. Still, it's strange that Microsoft waited so long to notify its customers of the patch. It's rare for Microsoft to release one of these out-of-cycle updates, but since it adoptedÂ its monthly patch process back in October 2003, it generally lets people know about them as soon as they're released. Microsoft's Mark Griesi told me that the company decided to send out the malware engine fix as soon as it was ready on January 26 and that this kind of quick fix is standard practice with most security software. But he said there was no particular reason why the company decided to wait until February 13 to tell people about it. Microsoft just hasn't been in the position of having to patch its security software since rolling out the monthly patch process, he added. "It was one of those first-time situations: 'Should we say something now or should we just wait,'" he told me. "This time we decided to wait. We won't do it again." From a PR perspective, it wasn't a bad move. Microsoft has touted Defender as one of the top three Vista security features. It wouldn't have been much fun to be talking about a major security flaw in the product just days before the Vista launch, would it?
525318
Is Microsoft's anti-malware giveaway part of a master plan to flush out software pirates?