Microsoft's Fathi OK with Vista bugs so far
126613
(InfoWorld) - Microsoft's Ben Fathi has a new job now that Vista has shipped, but the man who led the company's Security Technology Unit is still focused on keeping the bad guys away from your PC. Fathi is now corporate vice president of development with the Windows Core Operating System Division, and is in charge of building the guts of the OS -- things like the kernel, networking, and security. IDG News Service sat down with him recently to discuss the future of Windows security. With the first Vista bugs now being reported, Fathi says it looks like Vista is on track to meet his own stated goal of having half the flaws that plagued XP during its first year. Following is an edited transcript of the interview, conductedÂ last week at theÂ RSA ConferenceÂ in San Francisco. IDGNS: What's going to be the big security story in 2007? Fathi: What we've done in previous OS releases and Vista and what our security partners are doing has treated security as a defensive measure. It's a way of stopping people from attacking you. What we want to do now is move to a world where we actually enable and simplify collaboration between different individuals, by making sure that those connections are end-to-end, that you can provide very fine grained control over the people, the applications and the resources that you give access to. IDG: So what are you doing to make that happen? Fathi: There are a number of things we are working on. For example, isolation. We look at isolation in terms of network isolation, whether it's IPsec [Internet Protocol security] or putting in firewalls, or SSL VPN [Secure Sockets Layer Virtual Private Network]. What we want to do is provide a better layer of isolation at the operating system level. We're looking at putting hypervisors underneath the operating system and building attestation and building a hardware root of trust on the machine. What that means is that today, if a rootkit makes it onto your machine, it can do a hyperjacking. It can take over the OS or it can even get underneath the OS so that any software you're running, like Kernel Patch Protection, won't even know that it's being lied to by a piece of malware underneath. What we want to do is put the hypervisor there and use things like the TPM [Trusted Platform Module] chip to make sure that the entire boot path is protected and secure and we can trust it and it hasn't been tampered with. This also gives you the ability to create isolation by creating partitions on the machine. Let's say you're running a server. If you consolidate your server workloads onto a single big machine -- you have a Web workload and a file server workload and a database workload. You want to protect that database workload because you're running your line-of-business apps on it. Just because somebody broke into your Web server doesn't mean they should be getting access to your database or your file server. IDGNS: Are you surprised by the number of Vista bugs that you've had reported since the launch? Fathi: I made a statement six or nine months ago that I would like to see half as many vulnerabilities as XP in the first year. Obviously I'd like less than that. I'd be happy with zero. But I think it's reasonable to say, given the additional complexity and given the additional size of Vista, that half as many would be a great goal. Am I surprised with the number? No, I think it's been a relatively small number of vulnerabilities in the three months we've been out. And given the fact that we proactively went out to the Black Hat conference and handed out copies of this, and that a couple of million people have been using Vista in test versions for the past year or so, that tells me that there are already hackers out there that are trying to attack it. So given that there are less than a handful of vulnerabilities discovered, I think that's good progress. IDGNS: And you're on track for that half as many? Fathi: I think so. Ask me again in six months. Â
329387
By Pete Bach, The Post-Crescent, Appleton, Wis.  Feb. 20--Microsoft's new Vista operating system is wowing buyers less  intensely than expected, but a couple of Fox Cities computer professionals say  it's got a lot of pluses.
434862
After more than five years of  development, over 50 million lines of software code, a $6  billion investment and a few headaches, Microsoft Corp.'s   Windows Vista finally reaches consumers this week.
562421
Microsoft has provided further details on its plans to more broadly release the first release candidate of Windows Vista, however criticism of the build has come from some unlikely sources.
442477
Now that Windows Vista has been unleashed onto an expecting public, a number of minor issues have cropped up in the new operating system. Microsoft has already posted a handful of hotfixes for those running into issues, although they aren't critical enough to be published on Microsoft Update.
241911
(InfoWorld) - Microsoft has touted Vista as aÂ more secure version of Windows, but on the day ofÂ Vista's official launch, a security company has identified malware already in circulation that can infect computers running the OS. Sophos identified three viruses typically spread through e-mail that can infect Vista customers who use a third party Web e-mail client. While Vista's e-mail client stops Stratio-Zip, Netsky-D, and MyDoom-O, the malware slips past Vista's defenses when users receive infected messages through a Web-based e-mail service, Sophos said. Stratio-Zip topped Sophos' list of malware affecting computer users in the month of November, accounting for 33.3 percent of malware in circulation. Combined, the three viruses that can affect Vista users make up 39.7 percent of all malware in circulation during the month, Sophos said. However, even if the malware Sophos identified slips through in an e-mail, customers won't necessarily be affected, another researcher said. Additional Vista security mechanisms should protect users, said Mikko HyppÃ¶nen, chief research officer at F-Secure. If a customer opens an infected malware file, Vista would warn and question the user before allowing the malware to wreak havoc. "These particular examples of malware probably wouldn't still be able to successfully infect the machine unless the user specifically allows it," he wrote in an e-mail exchange. Sophos applauded the security improvements in Vista, saying that the variety of popular third party applications used by consumers inevitably will open doors to hackers. Other anti-virus companies haven't been so kind.Â McAfee has been highly criticalÂ of changes in the operating system that it says will make Vista less secure than previous versions of Windows. Symantec said itÂ has discovered vulnerabilitiesÂ in Vista's networking software which makes it less stable than Windows XP. Sophos found that overall, the proportion of infected e-mail remained low in November at 0.28 percent, but identified a record number of new threats, 7,612, during the month.
411910
(InfoWorld) - Microsoft has released its monthly set of security patches , fixing problems in Windows, Internet Explorer and in the SSL (Secure Sockets Layer) software used for secure Web browsing. In total, Microsoft released six sets of patches, called updates, fixing 15 flaws in its products. Four of these updates are rated critical and administrators should patch them as soon as possible, security experts said Tuesday. Many of the flaws that Microsoft patched on Tuesday can be exploited via the Web. In particular the MS07-033 update, which fixes bugs in Internet Explorer and MS07-031 , which addresses a critical flaw in the SSL libraries used by Windows. The SSL flaw is particularly interesting because it affects users who are visiting supposedly trustworthy Web sites, and because it could also affect non-Microsoft browsers like Firefox and Opera, said Amol Sarwate, manager of Qualys, Inc.'s vulnerability research lab. "It will affect all the browsers that call the libraries that are in the Windows operating system," he said. Although Microsoft warned that this flaw could be used by attackers to run unauthorized software on the victim's computer, this would be hard to do. "Attempts to exploit this vulnerability would most likely result in the Internet Web browser or application exiting," Microsoft wrote in its MS07-031 bulletin. "The system would not be able to connect to Web sites or resources using SSL ... until a restart of the system." The two other critical updates are MS07-035 , which fixes a bug in the core Windows operating system's Win32 API (application programming interface), and MS07-034 , which fixes bugs in Outlook Express and Windows Mail. Because MS07-035 could be exploited via the Web, it should also be patched as soon as possible, Sarwate said. The other updates released Tuesday fix less-critical flaws in Windows Vista and Microsoft's Visio drawing software. The Vista update is noteworthy because it marks the first time that Microsoft has patched a flaw that was introduced in the Vista operating system, Sarwate said. Previous Vista patches have repaired "legacy" code that was written for earlier versions of Windows, and then reused in Vista. But the MS07-032 update applies to Vista only. This flaw, rated "moderate" by Microsoft, could allow an attacker to gain unauthorized access to information such as administrative passwords stored within Windows.
317610
Multiple Microsoft sources have confirmed that the first beta test editions of Service Pack 1 for Windows Vista were distributed to a select group of about 12,000 testers today. BetaNews learned these are indeed exclusive invitees, not merely a subset of the company's MSDN or TechNet subscriber base.
420940
(InfoWorld) - As Windows VistaÂ appeared in computer stores worldwide, Microsoft said Tuesday that part of the design of the new operating system is the work of the European Commission. "Following discussions with European Commission, Microsoft committed to make a number of changes to the Windows Vista operating system prior to release," the software maker said in a statement, pointing to three functions of the operating system: security, search, and fixed document formats. Windows Security Center (WSC), which looks like a dashboard, gives the user an overview of what security software is running on the system and the status of checks and upgrades of firewalls and antispyware protection. Rival security software firms and the Commission suspected this could give WSC an unfair advantage. Microsoft said it agreed to develop a new set of APIsÂ for release in the first service pack, scheduled for later this year, which can be invoked by third-party security programs to turn off the alerts presented by WSC. Similarly, PatchGuard -- software that protects against the modification of the kernel of the operating system -- has been added to Vista. Some security vendors have in the past made modifications to the kernel as part of the implementation of their security software. PatchGuard prevents such modifications in the 64-bit version. Microsoft is now working with vendors to develop new kernel-level APIs that will provide programmatic access to the kernel to address this issue, Microsoft said. The APIs will be available in Windows Vista 64 with the first service pack, scheduled for later this year. Regarding search, Microsoft has changed the way default settings are made for Internet search within both Windows Vista and Internet Explorer 7 (IE7). "These changes now ensure for users that they are able -- through a series of windows and options -- to make a clear, conscious, and open decision on their default search provider. Furthermore, users will retain at all times the ability to change this and all further defaults in the operating system at will," Microsoft said. Microsoft's own fixed document format software is known as XPS. "In response to the Commission's concerns, the company has made fundamental changes to the licensing structure of the XPS fixed-format technology and has committed to submit the technology to an international standards body for adoption as an open industry standard," Microsoft said. The XPS standard will be made available under licensing terms that do not exclude any industry or licensing model including the GPL (general public license), it said. "In response to Commissioner Kroes' letter of March 2006, Microsoft created a singleÂ API so that independent software developers can create applications to allow users to save documents in XPS or other formats, such as Adobe's PDF," Microsoft said. Microsoft said it has also disclosed through a licensing program the relevant information to enable the implementation of XPS technology on competing client and server operating systems. Microsoft has also responded to a further Commission demand to submit XPS (as well as future extensions) to a standards-setting body. Microsoft will submit XPS to the Ecma International. Microsoft said it will also enable the implementation of XPS under an open-source business model (GPL) through use of a covenant not to sue -- a model that Microsoft has applied to Web services and open XMLÂ  document formats and that has, it said, "been welcomed by the open-source community." European customers and OEMs will be able to buy a version of Vista that has Microsoft's Media Player stripped out. This unbundled version of the operating system complies with the 2004 European antitrust ruling, which ordered the company to offer two separate versions of both the home and professional versions of the operating system. "In compliance with the European Commission's decision of March 2004, home and professional editions of Windows Vista without Media Player functionality will be released in Europe on the same schedule as the Windows Vista general availability launch," Microsoft said. These are called the 'N' versions -- denoting "no media player," the company said.
149087
Despite being released to manufacturing last week, Windows Vista Service Pack 1 is not being made available to all customers because Microsoft is trying to resolve an issue in which hardware devices may stop functioning after SP1 is installed.
642533
(InfoWorld) - MicrosoftÂ released its February set of security updates Tuesday, including critical fixes for bugs in Office and the scanning engine used by the company's security products. The security software flaw is of particular concern because it could, in theory, be very easily exploited by an attacker to run unauthorized software on a victim's PC. The bug has to do with the way that Microsoft's Malware Protection Engine, used by Windows Live One Care and Windows Defender, processes PDF files. Windows Defender is available for free and ships with Microsoft's Vista operating system. "An attacker could exploit the vulnerability by constructing a specially crafted PDF File that could potentially allow remote code execution when the target computer system receives, and the Microsoft Malware Protection Engine scans, the PDF file," Microsoft said in its bulletin on the patch. This engine is also used by Microsoft's Antigen and Windows Forefront Security products, meaning that Exchange servers running these products could also be compromised. Although there is not yet any known attack that exploits this flaw, it could become a serious problem for Windows users running Microsoft's security products, according to Amol Sarwate, vulnerability lab manager at Qualys. "These attacks are very difficult to avoid," he said. "These products run automatically in the background." Symantec rated this scanning engine flaw the most critical of the vulnerabilities patched on Tuesday. Microsoft actually released the patch for this flaw on Jan. 26, although it did not notify customers of this bug until Tuesday's bulletin, said Mark Griesi, a security program manager with the company's Trustworthy Computing group. Griesi said that there was no particular reason why Microsoft declined to notify customers of the update. But the fact that this was Microsoft's first security product patch since implementing its monthly system apparently contributed to the decision. "It was one of those first-time situations: 'Should we say something now or should we just wait,'" he said. "This time we decided to wait. We won't do it again." In total, six of Microsoft's 12 updates are rated as "critical," the other six have the less-serious rating of "important." Among the patches is a widely anticipated update for Microsoft Word , which fixes six bugs in Microsoft's word processing software. Hackers had been exploiting a number of these bugs in very targeted attacks over the past few months. The updates fix 20 bugs in total, including all four of the Word flaws that hackers had been exploiting, Griesi said. Other critical patches fix bugs in the ActiveX HTML Help control and Microsoft Data Access Components, both used by Windows, as well as flaws in Office and Internet Explorer.
746570
(InfoWorld) - AfterÂ several delays, it appears Microsoft may get theÂ next generation of its Windows operating system to customers according to its current schedule. As was expected, the company made Windows Vista Release Candidate 1 available on Friday, which means the OS is in its final round of bug fixes and tweaks before it will be ready for release to the general public. Windows Vista RC1 is available to TechBeta and Technology Adoption Program (TAP) program subscribers Friday, but MSDN (Microsoft Developer Network) and TechNet subscribers won't get the OS until next week, Microsoft said. Microsoft has said since March that Vista will be available to business users in November and consumers in January 2006. With the last major upgrade to Windows, Windows XP, it was about two months between RC1 and the product's release to manufacturing. If Vista follows a similar schedule, with RC1 out Friday, the release to manufacturing -- and a release to business customers -- could happen as soon as early November. OEMs (original equipment manufacturers) typically need about six weeks to get the OS installed and tested on PCs before putting those machines on the market. If Windows Vista makes it to manufacturing by the end of November, it could hit its January release date for consumers. Online retailer Amazon.com isÂ already taking pre-orders for Vista, and has listed availability of the OS as Jan. 30, 2007 on its Web site. In a letter to TechBeta subscribers on Friday, Jim Allchin, Microsoft co-president of the Platforms and Services Group, thanked them for their support and feedback, and mentioned several improvements to the OS that have been made since Beta 2 was released in May. "Weâve made some UI [user interface] adjustments, added more device drivers and enhanced performance," Allchin wrote in the letter. He added that Microsoft will continue to work on Vista's "application compatibility, as well as fit and finish" until its release to manufacturing, which is yet to be determined. Allchin also advised ISVs (independent software vendors) to use RC1 to certify its applications to run on Windows Vista, and asked for more feedback from testers to improve the OS before its final release. "Windows Vista is going to touch hundreds of millions of lives all around the world," he wrote. "Thanks for everything youâre doing to help us give them the best experience possible." Allchin's letter is available on theÂ Windows Vista team blog .
566345
The Microsoft operating system is improved by SP1, but Windows Vista still is missing some features we'd like to see.
522714
(InfoWorld) - oMicrosoft released six sets of security patches Tuesday that address critical flaws in its products, including a bug in Active Directory software. The software vendor also fixed critical vulnerabilities in Excel and the .Net Framework as well as less-critical bugs in Microsoft Office Publisher, Internet Information Services (IIS), andÂ the Vista firewall. The six updates addressed a total of 11 bugs. The MS07-039 Active Directory update, which is for Windows 2000 Server and Windows Server 2003 systems, should be at the top of enterprise IT administrators' lists, said Eric Schultze, chief security architect with Shavlik Technologies. "That one scares me because those are the crown jewels there. And it looks like you're caught with your pants down at the moment." The flaw deals with the way Active Directory processes LDAP client requests. Attackers could create a malicious LDAP request that would then allow them to "take complete control of an affected system," Microsoft warned in its advisory on the flaw. Active Directory enables LDAP by default, but there are factors that mitigate a possible attack. The flaw can be exploited by an anonymous user attacking a Windows 2000 Server, but with Windows Server 2003 a hacker would need to have user credentials for the attack to work. Also, Windows Active Directory servers are typically protected by the firewall, so the attacker would most likely have to be inside the corporate network, Schultze said. The Excel and .Net Framework updates each fix three vulnerabilities in these products and are both rated critical by Microsoft because they could be exploited by attackers to install unauthorized software on a victim's computer. Two of the less-critical patches are also noteworthy. The MS07-041 patch fixes a flaw that could allow an attacker to take over a Windows XP-based Web server by sending specially crafted URLÂ requests. Microsoft rated this flaw as "important" rather than "critical," however, because it only affects XP systems, and IIS is not installed by default on XP. Microsoft also patched a flaw in the Windows Vista firewall. The bug, which is in Vista's Teredo IPv6 tunneling protocol, would allow an attacker to find out if a Vista computer is on the network. Normally the Vista firewall should simply block unsolicited traffic trying to communicate over the Teredo interface. The bug could not be exploited to take over a Vista machine and is considered low risk, Schultze said. "If Teredo is turned on, something within it would give a response back, even though the firewall is turned on," he said. Microsoft has released 41 updates so far in 2007. That's a little ahead of the 39 updates it had released by this time last year.
474379
(InfoWorld) - Thursday was finally windows Vista launch day. But though banners were flying in downtown Manhattan on the big day, celebrating the launch of Vista, Office 2007 and Exchange 2007, CEO Steve Ballmer made it clear that the company is anxious to move on, while business customers pegged for Vista adoption wondered whether there was really much to celebrate. âThereâs a bunch of work we still need to do,â Ballmer said of the next Windows client OS. Supporting the shift from single-core to multicore chips and improvements in network infrastructure are priorities. Microsoft also wants to add more features to meet the needs of IT administrators, software developers and end-users. âHow we do software plus service within Windows is going to continue to be a big theme,â Ballmer said. Enterprise customers were wary. âSure itâs a big day for Microsoft, but what are we really getting?â asks Paul Lindo, an independent New York IT consultant. âWith all the delays and features being dropped, this looks to me like it might just be Windows XP with a prettier face.â Vista suffered several features âadjustmentsâ as well as a lengthier-than-expected road to shrink, including the infamous 2004 dumping of WinFS and a ground-up re-programming effort. But now that the day is finally here, Microsoft is well pleased with its new OS offering. âIt may have been a long road, but watching how our early adopters are responding to the platform, we know weâve got a winner,â said Brad Goldberg, Microsoftâs general manager of client product management. Responding to views such as Lindoâs, Goldberg said he remained assured. âVista was designed specifically to give business users recognizable benefits over the last generation platform,â he said. âThat includes productivity, security, networking and noticeably less reliance on IT.â Those last two items especially represent significant development efforts, covering the new UAC authentication model, updated internal diagnostics (including error messages that actually speak English), a completely revamped networking client and new IT tools such as the Reliability Monitor -- a quick dashboard of system reliability. These features were built specifically so users would spend less time talking to the help desk, thus decreasing overall IT spending. Windows is far better prepared for initial deployment than its predecessors, Goldberg said, citing more than a year of overall QA effort, by far the longest QA period in Microsoftâs history. Despite the enterprise focus of some features, it will still be consumers who lead the charge on Vista adoption. According to a report released by IDC last week, Vista will account for 90 percent of new Windows client deployments in 2007 by home users, compared with just 35 percent of new Windows client deployments by businesses.
273075
Microsoft confirmed Thursday that its invite-only group of about 15,000 testers has had the final version of Windows Vista Service Pack 1 (SP1) for the past two weeks.Other Vista users, however, will have to wait until March to obtain a legal copy of the release-to-manufacturing (RTM) version of Vista SP1, the company reiterated.According to a Microsoft spokeswoman, the build designated Vista SP1 RC Refresh 2, which was seeded to testers on Jan. 24, is identical to&#160;the code that company developers shipped&#160;out the door on Monday as RTM.&quot;In final stages of a product, Microsoft likes to get as much validation as possible before releasing,&quot; the spokeswoman said in an e-mail. &quot;The release candidate ended up being a high enough quality to be approved to release to manufacturing.&quot;The shift in nomenclature, but not bits, is common. Eventually, a vendor must approve a build as &quot;gold code,&quot; at which point that edition becomes the shipping version. Last November, for example, Apple Inc. issued a test build of Mac OS X 10.5.1 to developers one day, then called it good to go and posted it for download the next.However, users who weren&#39;t part of the SP1 testing group must wait until March to get their hands on the update, the spokeswoman repeated today. In five to six weeks -- mid-March according to Microsoft -- the service pack will be offered via Windows Update as a 65MB optional update and posted to Download Center as a 450MB stand-alone installer that supports five languages. A month later, in mid-April, Windows Update will automatically download and install SP1 on Vista-equipped PCs whose users have set Automatic Updates to do hands-off updating.Subscribers to the Microsoft Developer Network (MSDN) and TechNet will get a slight jump on the general public. &quot;In early March, MSDN and TechNet subscribers will be able to get the &#39;Windows Vista with SP1&#39; full DVD,&quot; the same spokeswoman said in another e-mail. The updated operating system will be offered to MSDN and TechNet subscribers through their respective download centers.Microsoft is holding SP1 so that it can identify device drivers that won&#39;t reinstall -- as they must -- during the service pack update process. On Monday morning, Mike Nash, vice president of Windows product management, said that while SP1 had met the RTM criteria, it would not be available for several weeks because of the&#160;driver problems.That generated a firestorm of criticism from users, who vented by posting over 200 comments to Nash&#39;s announcement, calling the decision &quot;stupid&quot; and &quot;one of the all-time worst moves&quot; by Microsoft.Judging by the tone of nearly 120 comments left on Microsoft&#39;s official TechNet blog, IT professionals and developers are even angrier. The subscribers called the withholding of SP1 &quot;boneheaded&quot; and a &quot;slap in the face,&quot; or dubbed it &quot;the Vista SP1 RTM Debacle.&quot; Others questioned the value of their TechNet subscriptions, admitted that they had had to download a pirated copy using BitTorrent so that they could start testing, and said they would postpone Vista deployments for months because of the delay.Several wondered why reviewers in the press had the finished bits before they did.But a commenter identified only as Joe put it most succinctly: &quot;This is the lamest decision since Microsoft Bob. I get this the same time as my mom?&quot;The backlash may have gotten through to Microsoft. On Monday night, Kathy Dixon, the TechNet Plus team member who normally writes the blog, said that she was looking into the possibility of moving up the availability date of SP1. But as of Thursday night, she had no solution for users. &quot;I have escalated this and am continuing to push internally for a solution ASAP,&quot; Dixon wrote around 8 p.m. EST. &quot;Please hang in there, I should have something more specific soon.&quot;Computerworld is an InfoWorld affiliate.
565330
Install, spin three times, buy a monkey and wait Microsoft is now letting the common rabble get its mitts on the latest beta build of Windows Vista Service Pack 1.â¦