Microsoft's OneCare flunks anti-virus test
77467
Least among equals Microsoft's Live OneCare placed last in a test on the effectiveness of anti-virus security packages by Austrian researchers.â¦
71569
(InfoWorld) - Microsoft's Office software is under attack again, this time with anÂ unpatched flaw in the Windows 2000 version of Office 2000 being usedÂ by hackersÂ to run unauthorized software on a victim's computer. Microsoft confirmed on Tuesday that the bug exists, but it would not say when it plans to fix the problem. The critical vulnerability wasÂ first reported by SymantecÂ to users of its DeepSight threat notification service. Attackers are exploiting the flaw by sending malicious Word documents to victims, Symantec said. When these documents are opened, Word is tricked into installing malicious software on the PC. Symantec is calling this malware Trojan.MDropper. Trojan.MDropper installs malicious software on the computer, which in turn installs another Trojan horse program "which turns out to be new variant of Backdoor.Femo," Symantec said in an Web posting. Symantec testers had not been able to exploit the problem on more up-to-date versions of Office or Windows. On Tuesday Microsoft said that the bug was confined to Microsoft Word 2000. Microsoft is investigating the issue and may issue a patch once that investigation is completed, according to the company's public relations agency. Microsoft has spent a lot of timeÂ investigating and patching Office applications this year. Over the past few months there have been several reports concerning very targeted attacks, similar to this latest Office issue. Microsoft's last few security updatesÂ have been filled with patches for Office flaws, many of which had already been used in attacks.
399769
Microsoft Corp.'s homegrown Windows Live OneCare anti-virus software came in last place in testing of 17 similar applications against hundreds of thousands of worms, viruses, Trojan horses and other malware, according to an Austrian anti-virus researcher
533030
Windows security tools fail tests to see if active viruses can successfully infect the software.
382727
Microsoft's security software has failed an independent test to see if it can spot Windows viruses.
15038
A rash of users of Microsoft's new Windows Live OneCare service, launched last January 30, have been reporting on Microsoft's support forums that virus scans performed by the service have resulted in the deletion of their OUTLOOK.PST files - the local, centralized repositories of e-mail, scheduling, and collaboration data used by Outlook.
525318
Is Microsoft's anti-malware giveaway part of a master plan to flush out software pirates?
416302
(InfoWorld) - Symantec published a series of four research reports on Feb 28 that critique various security elements of Microsoft's new Windows Vista operating system, including the software's ability to ward off existing malware threats. Unsurprisingly, the security software maker, which still derives the bulk of its revenues from the estimated $3.6 billion market for technologies used to defend Windows computers, found a fair number of shortcomings in the latest iteration of Microsoft's dominant OS. One of the biggest problems is that Vista remains vulnerable to existing malware attacks designed to take advantage of flaws in earlier versions of the OS, according to the reports. However, the Cupertino, Calif.-based antivirus market leader also highlighted a number of features built into the product that it said will advance end-user security. An area where Symantec researchers said Microsoft has greatly improved security is related to the mitigation of virus attacks aimed at code-level vulnerabilities. Previous versions of Windows have been shipped with scads of coding errors that allowed hackers to deliver malware threats, but work on the part of Microsoft -- such as through its Security Development Lifecycle program -- has helped lower the volume of available vulnerabilities, according to the reports. The immediate benefit to Vista users will be the reduction of threats that use common infection techniques like buffer overflows and heap manipulations to deliver their payloads, Symantec predicted. Another area where Symantec recognizes security improvement on the part of Microsoft is in the use of its reduced user privilege model in Vista, which is aimed at preventing virus attacks from upping the administrative status of infected PCs to boost malware proliferation and related damage. While arguing that there may be the ability for hackers to disable Vista's new User Access Control, which is designed to keep users abreast of any changes attempted on their PCs by unknown software programs, Symantec concedes that the security tool should help fight malware attacks, including worm viruses. Despite the praise and its submission that Vista thus far appears to be the safest operating system ever produced by Microsoft, the Symantec reports levels a great deal of criticism at many other aspects of the OS. Vista is a more secure product than previous versions of Windows, but there is still plenty of need for users to buy the layered security defense products the security company markets, said Ollie Whitehouse, a researcher with Symantec's Security Response team. "Vista is a security evolution, but not a revolution," Whitehouse said. "Microsoft did invest a lot of time and resources into the development of Windows XP SP2, and Vista is a continuation of that, and they addressed a number of core issues, such as buffer overflows, but it is still only an OS, not a security solution itself." Vista may help stop some traditional types of attacks, such as worms, but Symantec maintains that newly emerging threats, integration problems with third-party Windows applications, and a range of other issues will keep users in the market for additional security tools. One area that remains a sore spot from Symantec's perspective is Microsoft's use of new features to protect the Vista kernel against root kits and other attacks. In 2006, a major controversy broke out between the two firms and other security technology providers based on the fact that Vista's PatchGuard system, available only in 64-bit versions of the OS, prevents any programs -- including Symantec's security applications -- from patching the software's kernel memory. Symantec and rival McAfee, among others, argued at that time that not being allowed to access the kernel as they have in prior iterations of Windows would prevent their advanced behavior-based technologies from working properly. But Microsoft and the security firms claim to have solved the problem using a set of APIs. In the research reports, Symantec repeats its contention that PatchGuard may also be easily bypassed, defeating its very purpose and allowing kernel-altering attacks, including root kits, to live on. Labeling the combination of PatchGuard and two other Vista kernel protection technologies, known as Driver Signing and Code Integrity, as a mere "bump in the road" for attackers, Symantec said that a single researcher bypassed all three features in one week's time, further proving their vulnerability. "Microsoft has made good strides with kernel protection, but again, it's not perfect," Whitehouse said. "PatchGuard has and will be broken, and while it is obviously better than nothing, people who have an interest will find ways to get around these features." Another area where Symantec leveled criticism at Microsoft is in relation to Vista's ASLR (Address Space Layout Randomization) feature, which is designed to help obscure programs stored in the operating system's memory to make it harder for attackers to isolate vulnerabilities. Symantec said the feature has a flaw that prevents it from working properly. Here again, Symantec mixed praise and calls for concern in outlining its observations of ASLR. "When implemented correctly, this technology is extremely effective in mitigating the exploitation of memory corruption and memory manipulation vulnerabilities," reads the Symantec report. However, the research contends that Symantec has already found that one element of ASLR that means to randomize and hide software components does not work consistently, therein making it easier for attackers to guess where vulnerabilities may lie. Symantec said further that Microsoft has confirmed the issue and pledged to fix it when it issues a Windows Vista SP1 update. Both the PatchGuard and ASLR issues feed into another Vista problem cited in the Symantec research: integration with third-party products. In addition to the potential problems introduced by PatchGuard to its own products, Symantec said that the third-party drivers provided by Microsoft may be targeted as a means of gaining kernel-level access on compromised machines. ASLR has been highlighted by at least one other security company as a potential weak point in Vista. Just as Symantec maintains that many of Vista's security features won't help protect end-users unless third-party software makers can effectively integrate with the tools, penetration testing specialists Core Security, based in Boston, published a report on Feb. 6 that highlighted a well-known vulnerability existing in CA's BrightStor backup software that it said could still be exploited on machines running Vista. Because the CA software had not been updated to integrate with ASLR and other Vista security features -- although CA said it would soon have a new version of the product to market and Microsoft officials disputed the issue -- the operating systems' onboard defense features won't help protect such legacy systems, Core said. Symantec's report repeatedly highlights the third-party integration issue as a major weak point for Vista's security goals. Microsoft officials stuck to their long-standing defense that Vista goes a long way toward mitigating many common PC security issues and that the company will continue to bring new security features to bear on the OS and future products. Microsoft said it is further investigating several specific product flaws cited in the Symantec report, including the ASLR problem. "It is important to note that none of the security features in Windows Vista, either individually or collectively, are intended as a 'Silver Bullet' solution to the problem of computer security," said Russ Humphries, senior product manager, Windows Vista Security. "We believe Microsoft has developed the right balance and made the right decisions when evaluating the tradeoffs between usability and security," Humphries said. "[Symantec's] report does not properly address the fact that many of the Window Vista security technologies have numerous options that allow for a user to make their own judgments as to their need for security balanced against usability."
208035
A year out, Windows Live OneCare gets low marks for security from analysts and users.
503690
(InfoWorld) - Antivirus software is frequently tested for performance, so picking a top product should be straightforward: Select the No. 1 vendor whose software kills off all of the evil things circulating on the Internet. You're good to go then, right? Not necessarily. The increasing complexity of security software is causing vendors to gripe that current evaluations do not adequately test other technologies in the products designed to protect machines. Relations between vendors and testing organizations are generally cordial but occasionally tense when a product fails a test. Representatives in both camps agree that the testing regimes need to be overhauled to give consumers a more accurate view of how different products compare. "I don't think anyone believes the tests as they are run now ... are an accurate reflection of how one product relates to the other," said Mark Kennedy, an antivirus engineer with Symantec. Representatives of Symantec, F-Secure,Â and Panda SoftwareÂ agreed last month at the International Antivirus Testing Workshop in Reykjavik, Iceland, to design a new testing plan that would better reflect the capabilities of competing products. They hope all security vendors will agree on a new test that can be applied industrywide, Kennedy said. A preliminary plan should be drawn up by September, Kennedy said. One of the most common tests involves running a set of malicious software samples through a product's antivirus engine. The antivirus engine contains indicators, called signatures, that enable it to identify harmful software. But antivirus products have changed over the last couple years, and "now many products have other ways of detecting and blocking malware," said Toralv Dirron, security lead system engineer for McAfee Inc. Signature-based detection is important, but an explosion in the number of unique malicious software programs created by hackers is threatening its effectiveness. As a result, vendors have added overlapping defenses to catch malware. Vendors are employing behavioral detection technology, which may identify a malicious program if it undertakes a suspicious action on a machine. A user may unwittingly download a malicious software program that is not detected through signatures. But if the program starts sending spam, the activity can be identified and halted. Also, a program can be halted if it tries to exploit a buffer overflow vulnerability, where an error in memory can allow a bad program to run. Host-based, intrusion-prevention systems, which can employ firewalls and packet inspection techniques, can also stop attacks. The ways in which a computer can be infected also make comprehensive testing complex. For example, users may infect their computers by opening malicious e-mail attachments or visiting harmful Web sites designed to exploit known vulnerabilities in a Web browser. The different modes of attack also involve different defenses, all of which would need to be tested to arrive at an accurate ranking, analysts said. By contrast, signature-based tests can take as little as five minutes. "This is a very basic test," said Andreas Marx of AV-Test.org, who wrote his master's degree thesis on antivirus testing. "It's easy, and it's cheap." Other concerns remain, over sample sets of malicious software, the age of the samples and the relative threat those samples pose on the Internet as they become older. Security vendors also think tests should check how well security applications remove bad programs, a process that can affect a computer's performance. For vendors, a failed test can be embarrassing, since the testing companies often issue news releases highlighting the latest results. Testing companies make money in various ways. AV-Test.org is often commissioned by technology magazines such as PC World (a magazine owned by IDG). Virus Bulletin licenses its logo to companies for use in promotional material and publishes a monthly online magazine. Earlier this month, Virus Bulletin announced that its latest round of testing produced some "big-name failures," including products from Kaspersky Lab and Grisoft SRO. The company's VB100 tests antivirus engines against malware samples collected by the Wildlist Organization International, a group of security researchers who collect and study malware. To pass the VB100, products must detect all samples. Kaspersky briefly removed a signature for a worm out of its product for "optimization" purposes on the day of the test, wrote Roel Schouwenberg, senior research engineer for Kaspersky, in an e-mail. The signature has since been put back in, he said. "Obviously, we would have rather passed than failed," Schouwenberg wrote. "Had the test been conducted a day earlier or a day later, we would have passed." Similarly, F-Secure initially failed its test also because of a technicality, but the failed rating was later reversed. All vendors are told after testing which samples they failed to detect, thus most end up adding signatures to their products. So what should a user do? John Hawes, a technical consultant for Virus Bulletin, cautioned that the signature-based tests are "not enormously representative of the way things are in the real world." But Hawes also noted that signature-based tests can indicate the reliability and consistency of a vendor's software. Virus Bulletin also writes reviews of AV suites, which take into account aspects such as usability, which may be just as important as detection for consumers. The company is developing more advanced tests that will test new security technologies. AV-Test.org is already performing more comprehensive tests, although it uses between 30 to 50 malware samples, a much smaller sample set compared to the Wildlist, which uses more than 600,000 samples, Marx said. Those tests may give a better indication of how a security software suite performs. At a bare minimum, through, users should install some security software, as computers without it can face high risks, Marx said. Several free suites are available that may be fine for light Internet use, he said. Ironically, Marx doesn't use any antivirus software. That's because AV-Test.org collects malware for its testing, most of which comes through e-mail from other researchers. "I'm getting about 1,000 viruses a day," he said. "It [antivirus software] would be counterproductive." Â
764362
Glitches between Windows XP Service Pack 2 (SP2) and critical applications continue to emerge, with McAfee admitting its flagship VirusScan product prior to version 7.1 requires a customised patch to be operational with Windows Security Center, part of SP2
251576
(InfoWorld) - Microsoft Corp. has opened up testing of a new Web-based service that allows parents to control what their kids do on the Internet. The service, called Windows Live OneCare Family Safety, is now available for trial in the U.S., according to Microsoft. It can be downloaded on the WindowsÂ Live Ideas Web site. "While we are still in the testing and development phase, OneCare Safety will offer some great features to help families create a safer and enjoyable online experience," Microsoft said in aÂ blog posting on the software's release. The Family Safety service has been available to a limited set ofÂ beta testers since earlier this year, but this is the first time that Microsoft has opened up to the general public. The company is not saying when users outside of the U.S. will be able to try out this product, but more information about that will be released, "very soon," Microsoft said. Family Safety lets parents block their kids from viewing sites relating to inappropriate subjects like pornography or alcohol. They can also get activity reports on what Web sites their children have been visiting. Because Family Safety is a Web-based service, parents can adjust settings or check in on their kids from any Internet-enabled PC. Microsoft is also offering guidelines on how children can safely use the Internet and tips on how parents can talk to kids about their online activity. Future versions of the service will let parents create "allow" lists to help them control their children's use of other Windows Live services such as instant messaging. The Windows Live services are part of Microsoft's broader effort to take on competitors like Google Inc., which has focused on creating new software that is hosted on the Internet, rather than written for Microsoft's Windows operating system. REFERENCES:Microsoft tests Windows Live parental controls, Feb. 23, 2006
168622
(InfoWorld) - CA Inc. caused some headaches this week after its antivirus software inadvertently flagged part of the Windows OS as malware. The SANS Internet Storm CenterÂ reported the problem Friday saying that an overnight update to CA's eTrust Antivirus signatures had caused the software to flag a security-related process in Windows as malicious. The faulty update caused some Windows 2003 servers to crash and become unusable, SANS said. The problem was that eTrust Antivirus was mistakenly flagging the Windows Lsass.exe process, said Bob Gordon, a CA spokesman. "CA quickly discovered and fixed an issue which temporarily caused some customers to detect a problem in their Lsass.exe files," he said in an e-mail. According to Gordon, it took CA less than seven hours to fix the mix-up. The problem was introduced in the 30.3.3054 update, released at 2:53 a.m. Eastern Standard Time (EST) and fixed in the 30.3.3056 update, which was issued at 9:34 a.m. EST.Â CA's latest updatesÂ  are online. The Lsass.exe process is part of Windows' security mechanism. So users who had set their eTrust Antivirus to automatically remove malicious software may have found that their systems crashed and were unable to boot up Windows once Lsass.exe was removed. CA offers online guidance for users who have been experiencing crashes as a result of the buggy update. Antivirus software like CA's uses digital fingerprints, called signatures, to identify malicious software. In this case, eTrust Antivirus apparently mistook Lsass.exe for the Win32/Lassrv.B virus. It is not unheard of for signature files to mistakenly identify legitimate software as malware, but it is remarkable that CA's software made the mistake with a well-known Windows component, according to Johannes Ullrich, chief research officer at SANS. CA should have been able to detect the problem in its quality-assurance testing, he said. The mixup apparently did not disrupt a large number of users, but it still reflects poorly on vendors like CA, Ullrich said. "It's another loss in trust toward the antivirus business," he said. "It tells you that the antivirus vendors don't do the testing."
359809
(InfoWorld) - There was a little surprise buried inÂ Microsoft's monthly security bulletins Tuesday. It turns out that Microsoft had quietly slipped out one of the February fixes just days before its Jan. 30 Vista launch. The fix was for a bug in Microsoft's Malware Protection Engine, used by products like Windows Defender, OneCare, and Antigen to scan for malware. Microsoft had discovered that the engine could possibly be tricked into running unauthorized code if it scanned a specially crafted PDF file. Nobody has actually launched such an attack, but since these products are always automatically scanning for malware in the background, the vulnerability could have led to some pretty nasty exploits. Still, it's strange that Microsoft waited so long to notify its customers of the patch. It's rare for Microsoft to release one of these out-of-cycle updates, but since it adoptedÂ its monthly patch process back in October 2003, it generally lets people know about them as soon as they're released. Microsoft's Mark Griesi told me that the company decided to send out the malware engine fix as soon as it was ready on January 26 and that this kind of quick fix is standard practice with most security software. But he said there was no particular reason why the company decided to wait until February 13 to tell people about it. Microsoft just hasn't been in the position of having to patch its security software since rolling out the monthly patch process, he added. "It was one of those first-time situations: 'Should we say something now or should we just wait,'" he told me. "This time we decided to wait. We won't do it again." From a PR perspective, it wasn't a bad move. Microsoft has touted Defender as one of the top three Vista security features. It wouldn't have been much fun to be talking about a major security flaw in the product just days before the Vista launch, would it?
115619
What is this thing you call heuristics? Antivirus software is getting worse at protecting users from new threats, according to two reports which found malware authors are getting better at disguising their creations.â¦
43279
Microsoft today said human error, not a hardware failure or outage, disrupted its Windows Genuine Advantage validation service last Friday and Saturday.
236050
'Virtual security solution' is designed to slow virus and malware attacks.