Vista security overview: too little too late
123278
But some progress has been made Review Microsoft has gone out on a limb to promote Vista not merely as "the most secure version of Windows ever" (every recent version is marketed with that tired slogan), but for the first time as an adequately secure version of Windows. "We've got the message and we've done our homework", the company says. So let's see if the reality lives up to the marketing hype.â¦
469822
InfoWorld - Microsoft&#160;finally rolled its&#160;Vista operating system out the door Tuesday, billing it as its most secure operating system ever, but what are the security features that will really matter to enterprise users?
119952
The User Account Control built into Windows Vista is supposed to help make the new operating system safer. But it can be spoofed, undermining the very mission for which it was created, according to Symantec.
35029
Unpatched vulnerabilities may leave computers open to remote attacks.
387750
Hackers have come up with a way to get around one of Microsoft's antipiracy mechanisms for Vista.
186367
Who needs a backdoor when users leave the Windows open? Security advances in Windows Vista are unlikely to frustrate cybercrime investigation, according to a leading computer forensics firm.â¦
461237
(InfoWorld) - A Microsoft security executive released data Thursday showing that, six months after shipping Windows Vista, his company has left more publicly disclosed Vista bugs unpatched than it did with Windows XP. In total, Microsoft has patched 12 out of 27 disclosedÂ Vista vulnerabilitiesÂ in the six months after it first shipped last November. During XP's first six months, Microsoft's security team patched 36 out of 39 known bugs. The data was published by Jeff Jones, a Microsoft security strategy director, who said that overall, Vista was doing better than XP. "Windows Vista continues to show a trend of fewer total and fewer high-severity vulnerabilities at the six month mark compared to its predecessor product, Windows XP," he wrote. Jones didn't address the larger number of unpatched vulnerabilities, but he did note most of the unpatched Vista bugs were not critical. Microsoft had left only one high-severity Vista vulnerability unpatched during the period. At the end of XP's first six months, there were two high-severity bugs that were unpatched. Microsoft patched 23 high-severity XP bugs during its first six months, compared with only one high-severity Vista flaw. Jones argued that Vista had a lower number of vulnerabilities than competitive operating system products such as Red Hat Enterprise Linux and Mac OS X. He published the data in an effort to show how Microsoft's software development methodology, called the Security Development Lifecycle (SDL) is yielding dividends. But his method of comparing Windows to Linux and Mac OS X is problematic, according to some. "This is an apples-to-oranges comparison," said HD Moore, one of the hackers behind the popular Metasploit penetration testing toolkit. "If you want a more accurate view, try comparing the number of flaws between Microsoft-developed software and vendor-X-developed software. Most Linux vendors don't actually write the majority of the packages they include," he said via e-mail. "Alternatively, force Microsoft to include all vulnerabilities in common third-party software," he added. "For example, the thousands of exploitable ActiveX controls that... vendors include with a Windows system." According to Randy Abrams, director of technical education with antivirus vendor Eset, it will be more interesting to look at vulnerability statistics once Vista becomes more popular than XP, and the target of more hackers. But Microsoft has stepped up its security practices, he added. "I think their Security Development Lifecycle initiative has improved the quality of the code," he said. Â
195221
Windows XP Service Pack 2 promises to raise the security bar for the sometimes beleaguered operating system. Unfortunately, one of the new features could be spoofed so that it reports misleading information
450389
Get a closer look at some of the new features in Vista Service Pack 1.
769541
Some widely used applications haven't been certified for use with Windows Vista, they may, nonetheless, work.
592673
Microsoft urged Windows Vista users to download a new security tool that automatically disables suspicious or malicious "gadgets," the small applets that mimic the "widgets" popular on Mac OS X.Dubbed "Windows Sidebar Protection," the 1MB download was added to Windows Update on Tuesday and classified as a "high-priority" update. Microsoft customers running Vista RTM -- the initial version that launched in late 2006 to businesses and early 2007 to consumers -- saw the update on the list starting Tuesday. The update is optional, but depending on what settings have been selected in Windows' Automatic Updates, it may be downloaded and installed without any additional user interaction.Windows Sidebar is a Vista-only panel that holds the miniature applications known as gadgets -- small single-purpose tools that, for instance, display the time and date or RSS feeds. The Windows gadgets are composed of HTML and various scripts.And there's the rub, said Microsoft."Vista treats gadgets like it treats all executable code," said the advisory that accompanied the update. "Gadgets are written using HTML and script, but this HTML is not located on an arbitrary remote server as Web pages are. HTML content in the gadget is downloaded first as part of a package of resources and configuration files and then executed from the local computer."In other words, gadgets could be dangerous, even malicious. The small applications are crafted not only by Microsoft but also by third-party developers and users; Microsoft distributes gadgets on its Web site, but it doesn't vet them."The update gives us a mechanism to prevent a malicious gadget from being installed first of all, and if it's installed, to block the gadget [from running]," said Austin Wilson, a director in the Windows client product management group. "We're being proactive here. We looked at the [security] landscape and wanted this in place in case a problem arises in the future."There are no known vulnerabilities in any existing gadgets, Wilson claimed, stressing that Microsoft knows of no purposefully malicious gadgets, either.When it detects a flawed, suspicious or malicious gadget, Microsoft will create a "kill bit" file that it will then push to users through Windows Update on the regular once-a-month patch day, said Wilson. Yesterday's update included no kill bit, stressed Wilson, but instead is the tool that generates a unique ID for each gadget, accepts the list from Windows Update and then blocks existing gadgets from running or newly-downloaded gadgets from installing.After a gadget has been identified as bad, its icon gets swapped out with one labeled "Bad Gadget." The icon also can't be dragged, and the tool tip shows it as a security risk.The Sidebar security update is already integrated in the bits that were distributed as Vista Service Pack 1's release candidate last month, said Wilson, and it will be included in the final when that launches in the coming weeks.Microsoft has posted a pair of documents on its support site that go into more detail: KB943411 includes the download links to the 32- and 64-bit versions of the tool; KB941411 walks users through the various dialog boxes they will see when the tool tries to bar or block a gadget.
208849
A report penned by one of Microsoft's top security experts argues that Windows Vista had fewer known security flaws in its first year of release than other major industry operating systems. On the blogs, skeptics abound.
714146
According to security researchers, Windows Vista's speech-recognition feature is flawed and hackers could use it to remotely force a PC to execute commands.
674795
(InfoWorld) - Itâs not easy being Ben Fathi. As corporate vice president of Microsoftâs Security Technology Unit, Fathi took the place of longtime STU leader Mike Nash in March amid a larger management shake-up just days after Microsoft announced that the shipment date for Vista was slipping yet again. After Nashâs high-profile tenure, Fathiâs charge is more subtle: building what he calls a âtrust ecosystemâ around Vista and its new security features and promoting the companyâs secure development practices. But first he must help get Vista out the door. Fathi sat down to talk with InfoWorld Senior Editor Paul Roberts at the recent Security Standard Conference in Boston about Vistaâs progress, and the world after Vista. InfoWorld: Recently thereâs been some back and forth with Symantec about issues such as Vistaâs Kernel Patch Protection feature for 64-bit systems, as well as some public criticism of Vista code for having security holes. What should enterprise folks make of that? Ben Fathi: First, on the paper Symantec published: We thank them for their input. I think itâs unusual for a partner to go public with a paper like this on a beta product, but they did identify a few issues. To the best of my knowledge, all those were already fixed in more recent beta releases. We love to hear feedback on beta products. Thatâs why weâre in beta. Itâs a test. Weâll fix them as long as they report them to us. As for the kernel patching, we fundamentally believe that the current model of kernel patching is broken and not sustainable. We never recommended it or supported it on any version of our operating systems. As weâve been telling our vendor partners, this is the only chance we have, as 64-bit computing becomes available, to start with a clean architecture and build on top of that. We want to work with you to find ways to extend the kernel functionality by having a clean architecture, APIs, and filters. â¦ instead of patching instructions and data structures in the kernel. In the long term, what we want to do is move a lot of these functionalities to a hypervisor that sits under the kernel to make the kernel even smaller and the trusted computing base even more secure. We still have a window of opportunity here. â¦ and weâre working with two or three vendors in the space to come up with that kind of architecture. One of the other comments thatâs been made is that [Kernel Patch Protection] is anti-trust. That weâll go back in with our own products and get around it. Thatâs absolutely not true. Weâd never do that. IW: You recently patched a beta version of Vista. Is it a bad sign that youâre patching beta Vista? BF: I believe that Vista is significantly more secure than any version of XP or anything else weâve shipped in the past. Just SDL (secure development lifecycle) in general and the process of penetration testing and hardening kernel services. These all created a stronger, defense in depth strategy. What I would say is, Yeah, there will be patches and vulnerabilities as we move forward. What weâre hoping is that by creating these layers of defense, weâre giving customers, especially enterprise customers, a longer time to test and make sure things are not broken. IW: Do you see your job description and responsibilities changing after Vista? BF: There are six different areas that we call âBig Betsâ that have been identified in my division. I will mention two. The first, Application ID, is a way to identify an application that includes an executable, the library it uses, configuration files, registry settings, any patches that are applied to it. So youâll have a cryptographically signed version of the application, and youâll be able to identify that and whitelist or blacklist that. When we talk about a trust ecosystem today, the ability to trust people based on an ID and trust machines based on an ID, we canât do that with applications. If itâs called powerpoint.exe, we go and run it. So having strong IDs based on the application and [making] sure they havenât been tampered with after download is an important investment for us. The second area is isolation. Creating guest operating systems that sit on top of hypervisors allow us to create better isolation mechanisms so that even if malware comes in, it only affects one subset of the machine and not everything else. Weâve done some great work on server hypervisors and server virtualization. We need to extend that to the client. Weâre seeing partners do that already, and so weâre going to invest in that space.
346050
But don't just blame Vista New technology such as Windows Vista and IP v6 may solve some security problems but will bring new security threats as well, according to a senior Cisco security expert.â¦
8774
Blog: ZoneAlarm 7.1 offers true two-way firewall protection for Windows Vista users.
24412
Even after Windows Vista SP1 is released, users should wait another six months before moving to the OS, says David Milman, the CEO of Rescuecom, a chain of onsite support franchises.