Vista's UAC warnings can hide a rat, Symantec says
119952
The User Account Control built into Windows Vista is supposed to help make the new operating system safer. But it can be spoofed, undermining the very mission for which it was created, according to Symantec.
611897
(InfoWorld) - Security researcher Joanna Rutkowska has demonstrated several methods that sophisticated rootkits can use to hide from even the most reliable detection method currently available -- hardware-based products that read a system's RAM. Rutkowska is a researcher with security firm Coseinc Advanced Malware Labs. She recently outlined several ways of getting around the UAC (User Account Control) feature introduced in Windows Vista. Several researchers have identified problems with UAC. The demonstration, given at the Black Hat security conference in Arlington, Va., indicates that if a rootkit is advanced enough, there currently is no way it can be reliably detected, Rutkowska said. Rootkits are designed to hide some activity from observers and have recently been used to conceal the presence of Trojans and hacker backdoors -- not to mention Sony BMG's copy-protection software. Several hardware-based systems exist for acquiring an image of a computer's RAM, the most reliable way to detect the presence of certain kinds of rootkits, Rutkowska said. Those include Tribble, Komoku's CoPilot, and RAM Capture Tool from BBN Technologies, but she said none are particularly easy to find. Rutkowska's findings mean system designers may need to come up with a system architecture better suited to forensic analysis, such as an interface dedicated to memory acquisition. "We live in the 21st century, but apparently can't reliably read the memory of our computers," she said at the presentation. "Maybe we should rethink the design of our computer systems, so that they were somehow verifiable." Rutkowska's presentation outlined three types of attacks, one that crashes the machine when RAM acquisition is attempted, a "covering attack" that allows the acquisition tool to see only garbage when it inspects certain parts of physical memory, and a "full replacing attack" that allows the tool to see false information when it scans parts of physical memory. The denial-of-service attack could leave investigators legally liable for crashing the system, Rutkowska said. The "covering attack" might allow investigators to see the malware's "hooks" in some cases, but would make it impossible for investigators to analyze the malware. And the "full replacing attack" could simply mean that the malware is never detected at all, she said.
363843
In an interview with BetaNews, Sophos senior security consultant Ron O'Brien talks about PatchGuard, a new Microsoft feature of Windows Vista that is the subject of a recent round of complaints by security vendor Symantec. While Symantec says PatchGuard gives Microsoft a platform for abusing its competitors, Sophos says it doesn't see a problem, for some compelling reasons.
259263
Symantec - an IT security company - warned on Wednesday that computers running Microsoft Windows XP can be infected by a new Trojan horse, even though it is patched with Microsoft&#39;s latest Service Pack 2.
145834
Accessing the beta version of Yahoo Mail on a PC with Symantec's updated antivirus software incorrectly causes alarm bells to go off.
252232
According to some industry analysts, as many as 90 percent of all enterprise businesses currently assign oversight of anti-virus technologies to their desktop management teams, rather than ceding the work to security specialists.The reasons behind this fact are simple, market watchers maintain, as the process of keeping AV agents up-to-date, distributing new virus signatures to end points, and monitoring PC configurations for anomalies are exactly the types of tasks that IT operations teams are expected to carry out.If you add in the fact that many companies are looking at their IT security and management functions from the perspective of handling regulatory compliance demands, experts say, it becomes clear how much commonality exists between the security and management camps.As such, it should come as no surprise that a growing number of organizations are beginning to view much of their traditional security work -- in specific chores that don't involve warding off attacks -- from a systems management standpoint.That's the reason why security market leader Symantec plunked down $830 million for management software vendor Altiris in Jan. 2007, and why so many IT management technology providers are dipping their toes in the security waters, said Neil MacDonald, analyst with researcher firm Gartner."In most cases clients are looking to reduce complexity and costs, and improve overall systems manageability; today it's very hard to configure and manage security products made by multiple vendors, so we're seeing this trend toward what you might call Darwinistic operationalization," MacDonald said.Based on the growing management headaches created by the presence of so many security tools in the modern enterprise, businesses are looking for ways to centralize oversight of the various technologies and hand off their control to operational specialists, the analyst said.That is why Symantec and McAfee are pushing expanded management capabilities, and why so many companies with management backgrounds -- such as BigFix, Kace, and LanDesk -- are now actively marketing their security skills, MacDonald said."This is a very important trend, because most security issues actually arise in systems management, and even if you love Symantec and are on a path to acquire their various products, there's a pretty good chance that you'd at least consider the security solutions being offered by these other providers coming from more of an operational side," the analyst said."These companies on the operational side will definitely come head-to-head with the security companies, and really, that's a good thing for everyone," MacDonald said. "Because the endgame is that users should end up with more integrated functionality at a lower price."Of course, major IT systems management platform providers including CA, EMC, IBM, and Microsoft are also competing in the security market, and are doing so with increasing success based on their management skills, the analyst said."If a security person can do a better job by using management applications, and vice versa, then why not; even though these companies look at things through a different lens, there's a great amount of value in eliminating duplication of tasks such as inventory management," MacDonald said. "All the management vendors have a great case to make; convergence may be too strong of a word, but there will certainly be increased integration across security and operations-type applications."Strategy leaders at Symantec agreed that the confluence of security and systems management is seemingly unavoidable, especially as each of the processes becomes so much a part of the other.The shift is the primary reason why the massive AV and systems defense company was compelled to make such a significant investment in management expertise through its buyout of Altiris, executives said."When we looked at this area and how we wanted to approach the market, we saw management as changing the entire game right now because of a number of factors," said Tim Brown, senior director of architecture and strategy for Symantec."The bar for management has risen in the last few years with issues such as virtualization placing a heavier demand for coordination between security and management," Brown said. "We really needed to become a leader in both disciplines and offer a consistent fashion through which customers can manage and remediate their systems in a tightly integrated way."Symantec has been helping companies manage compliance issues for a decade, Brown noted, but alerting customers to problems that auditors might find is no longer enough, he contends, because users are also asking the vendor to provide the mechanisms necessary to remediate any issues it finds.Emerging technologies such as network access control (NAC) that involve everything from testing systems configuration to updating AV tools won't be as broadly adopted by end-users if vendors such as Symantec can't offer the ability to cover both the security and management tasks they require, the executive said.Leaders of systems management companies such as LanDesk echo Symantec's observation that their products are increasingly becoming the tools through which customers handle a great deal of security work."Many of our customers are having a hard time differentiating between systems and security management as so much of what they do to secure the device is around traditional systems management work," said Steve Daly, who took over as general manager at LanDesk at the beginning of 2007."Customers are looking for tools that give them a view into inventory, the known state of their systems, to do the remediation and bring everything into compliance, which is really the traditional realm of systems management," Daly said. "They're talking about moving to service management, but the reality is that they're caught up being reactive in break-fix mode; they want to move into more of an over-arching process focus, and that's driving a philosophical change for IT and how we deliver our products."Those factors are the very reason that a systems management specialists such as LanDesk was pushed to launch its maiden host intrusion protection system (HIPs) earlier this year, Daly said."Our opportunity comes from being able to lock down the device and watch the device and defend it in a preemptive manner, versus after an attack hits the device," Daly said. "I think it will be more of a challenge for the Symantecs of the world to build a single client that covers both security and management, coming from their side of the business."Other management technology vendors said that they have long considered security as one of their core strengths, even if they didn't market their products as such.Marty Kacin, co-founder and chief technology officer at systems management appliance vendor Kace, said that midsize companies have been approaching the issue from a more unified standpoint for years, and that enterprises are merely beginning to follow suit in viewing the issues together.Along with covering issues of inventory and systems image provisioning, Kace's appliances provide features including security patch distribution and desktop vulnerability assessment."We've never differentiated security from management from the get-go, yet we never marketed around security until recently when it became clear that this was a message that resounds with customers," Kacin said. "And really when you think about it, it's not just that patching and configuration management relate to security, the issue is that the processes of systems management and security are fundamentally interdependent."Companies such as BigFix, which has marketed itself as a security and management vendor for some time, claim that their existing business models illustrate the very approach that enterprises must take when approaching the individual strategies."When your job is to sit on the end point and tell it how it needs to look and behave, it's clear that we're ideally suited to tackle both of these problems from a management perspective," said Greg Toto, vice president of products and operations at BigFix."CIOs are annoyed with the volume, complexity and integration issues driven by the use of all these security and management point products in unison," Toto said. "The value proposition of a company like ours is to provide control for a broad range of these agents via a single management console."
409051
'Lacks seriousness and sincerity' We were skeptical on Monday when Symantec said it would atone for a bug that crippled the PCs of tens of thousands Chinese users by giving them free software. "Cockroach in your salad, sir? Have some free salad," was how we put it.â¦
360314
Windows XP and Windows Vista systems can be exploited if they haven't been updated with Redmond's first patch of 2008, says security firm.
236933
The feature creeps Symantec and Adobe have raised objections to the inclusion of security software and electronic document technology in Windows Vista. Adobe has asked the European Commission to prevent the bundling of PDF document creation and reading tools that compete with its software.â¦
177244
Symantec issued an alert after exploit code was posted to the Securityfocus Web site. The alert raised the urgency and severity of an earlier warning about the security holes in ARCServe Backup versions 9.01 through 11.5 SP1, as well as CA's Business Protection Suite software.
236872
Over the past month, a new type of malicious software has emerged, using a decades-old technique to hide itself from antivirus software.The malware, called Trojan.Mebroot by Symantec, installs itself on the first part of the computer&#39;s hard drive to be read on startup, then makes changes to the Windows kernel, making it hard for security software to detect it.Criminals have been installing Trojan.Mebroot, known as a master boot record rootkit, since mid-December, and were able to infect nearly 5,000 users in two separate attacks, staged on Dec. 12 and Dec. 19, according to Verisign&#39;s iDefense Intelligence Team. In order to install the software on a victim&#39;s computer, attackers first lure them to a compromised Web site, which then launches a variety of attacks against the victim&#39;s computer in hopes of finding a way to run the rootkit code on the PC.Once installed, the malware gives attackers control over the victim&#39;s machine.The group behind this latest rootkit is the same one responsible for the Torpig Trojan, and it is believed to have already installed more than 250,000 Trojan programs, iDefense said in a report on the rootkit published Monday.The interesting thing about Trojan.Mebroot is that it installs itself on the master boot record (MBR). This is the first sector of the computer&#39;s hard drive and it is the place the computer goes to first whenever it wants to boot up the operating system. &quot;Basically, if you can control the MBR, you can control the operating system and therefore the computer it resides on,&quot; wrote Symantec researcher Elia Florio in a blog posting on Trojan.Mebroot.The criminals are using several different versions of this attack code, some of which are not currently being detected by some antivirus products, iDefense said.&quot;At the moment the AV detection is hit and miss across the board, however in the last day a number of vendors have added detection for it already,&quot; said Andrew Storms, director of security operations with nCircle Network Security. &quot;As for penetration, so far many people are showing it as having a low overall distribution. The concern is that the group which may be preparing to distribute the rootkit is well-prepared.&quot;Malicious software that infected the master boot record was common during the MS-DOS era, but it has not been used much in attacks in recent years.In 2005, however, researchers at eEye Digital Security gave a talk at the Black Hat security conference, showing how a rootkit could hide itself on the MBR. This Trojan.Mebroot software is derived from that code, iDefense said.Getting this kind of malicious software to work reliably is a technical challenge, and there have generally been easier ways for the bad guys to take over PCs in recent years, said Marc Maiffret, an independent security researcher who was chief technology officer at eEye when the code was first developed.Attackers were given a hand last year, however, when researchers at NV Labs published a proof of concept MBR rootkit.Maiffret said that while we may soon see more of these MBR rootkits, &quot;it won&#39;t take long for all the antivirus companies to react.&quot;&quot;It&#39;s not some new attack vector that&#39;s going to be hard to prevent,&quot; he said. &quot;It&#39;s just something that people haven&#39;t really paid attention to.&quot;
478392
(InfoWorld) - A Windows feature designed to simplify computing for disabled users could be misused in Vista, a McAfee researcher reported Monday. Attackers could use this feature, called StickyKeys, to trick a user into launching unauthorized software on the Vista machine, according to Vinoo Thomas, a McAfee researcher who blogged about the issue on Monday. StickyKeys is launched when a Windows user hits a modifier key like Shift or Alt five times. This makes the modifier key "sticky" so commands like Shift-F1 can be launched without having to hit two keys simultaneously. An attacker could replace the sethc.exe file used to launch StickyKeys with some other executable, like the Windows command utility, Thomas wrote. This backdoor vulnerability was already known to exist in Windows 2000 and Windows XP, according to Thomas. Although it is interesting that Vista is also vulnerable, it's not clear how useful the backdoor would be to an attacker because one must first gain access to the machine in order to replace the StickyKeys file. Thomas believes that it could be used by an inside attacker to bypass log-in on terminal servers and workstations. Microsoft executives were not immediately available to comment on the issue. To avoid the problem, "one can uninstall the Accessibility Tools feature, which is installed by default, to avoid this fairly simple, yet potentially serious built-in backdoor," he wrote. "And don't forget to hit the shift key five times and see what pops up on your desktop."
662461
A Windows Vista feature designed to simplify computing for disabled users has security implications, according to a McAfee researcher.
117953
A new Trojan horse - named Phel - that punishes users of Microsoft Windows XP operating system is in the wild. Security software firm Symantec has issued a bulletin warning Windows XP users to be on the look
254458
Microsoft is taking security risks with its forthcoming Vista operating system, says software firm McAfee.
145780
Symantec&#39;s Security Response has issued a warning about three new &quot;serious&quot; vulnerabilities discovered in the Windows operating system.
548753
(InfoWorld) - MicrosoftÂ finally rolled itsÂ Vista operating system out the door Tuesday, billing it as its most secure operating system ever, but what are the security features that will really matter to enterprise users? To answer this question, IDG News Service asked Russ Humphries, a senior program manager with the Vista security team, to list the three Vista features that will have the biggest effect. Here's his list: 1) UAC (user account control) Before Vista, Windows automatically gave users too much power over their systems, Microsoft has said. With UAC, Windows will require a few extra steps before the user can do things such as install new programs. The feature will make it much easier for corporate administrators to lock down desktops and prevent users, or malicious programs, from messing around with the system or installing unauthorized software. UAC has been one of Vista's most controversial features with early testers complaining that they were overwhelmed with pop-up messages warning them about every little change they made to the system. But these warnings will not slow down most enterprise users because they won't be installing device drivers or software, Humphries said. "Most corporate users are going to get a corporate image that will have all their applications already installed on the image," he said. 2) Windows Defender With Vista, Microsoft has built a defense against pop-up ads and unwanted spyware right into the operating system. AlthoughÂ Defender has been criticized for not being as effective as commercial products, the fact that it will be so widely deployed is bound to improve things. "Adware is a huge annoyance, a security risk, and a bit of a machine hog, " Humphries said. "This has benefits for home users, small and medium-sized enterprises, and even large organizations." 3) BitLocker There have been more than 100 million U.S. victims of data breaches over the past two years, according to Privacy Rights Clearinghouse. BitLocker aims to prevent the next 100 million from getting hit quite so quickly by giving corporate users a way to encrypt and password-protect their data. With BitLocker encrypting Vista's data, a stolen PC doesn't turn into a front-page data breach story,Â as was the case with the U.S. Department of Veterans Affairs last year. BitLocker can also ensure that the operating system hasn't been tampered with at boot-up time, but customers seem to particularly appreciate the fact that it will help keep their companies out of the newspapers every time a laptop is lost. "I've had a lot of thank-yous from our customers," Humphries said.