MS customers get 'cold feet' on software assurance
511321
One in four corporates plan to ditch maintenance contracts - Forrester Microsoft has hit back at criticism that its Software Assurance maintenance contracts offer poor value for money and may be dropped by many enterprise customers.â¦
301505
Microsoft has advised customers using its SharePoint collaborative working products to apply newly released software patches designed to provide performance and security improvements.
338253
A flaw in Microsoft&#39;s security server software could allow an attacker to fool business users into thinking that malicious content can be trusted, the software giant warned on Tuesday.
641498
Microsoft last week faced accusations of short-changing its Software Assurance customers following its decision to strip core features from the next major Windows client operating system, codenamed Longhorn.
13352
While security experts applaud Microsoft&#39;s recently released Service Pack 2, some companies that distribute their software over the Web are watching the product&#39;s introduction with dread and suspicion.
698181
(InfoWorld) - Nearly a year after Microsoft introduced Windows Live OneCare, the company's first foray into the security market is still getting low marks from analysts and users. A recent report comparing the antivirus products of various vendors ranked Microsoft's product at the bottom in terms of detecting potential security threats. At the same time, users are complaining that OneCare, which includes firewall, antivirus, backup, and antispyware software, quarantines the entire mail store of their Outlook and Outlook Express programs, making it impossible for them to retrieve e-mail. AV-Comparatives, a project in Austria overseen by security researcher Andreas Clementi, published the antivirus comparison report, which also looked at products from Symantec, McAfee, Kaspersky Lab, BitDefender, Fortinet, F-Secure, and several other antivirus products from smaller vendors. In detecting Windows viruses, worms, macros, scripts, and other OS threats, Microsoft ranked last out of the 15 vendors tested, detecting them 91 percent of the time. G Data Software AG's Anti-Virus Kit (AVK) ranked first with 99.6 percent detection, while products from three vendors -- Kaspersky Anti-Virus, MicroWorld Technologies eScan, and F-Secure Anti-Virus -- tied for second with 99 percent detection. TrustPort Antivirus Workstation from AED came in third with 98.9 percent detection. In preventing intrusion through backdoors, Trojans and in other malware detection, Windows OneCare also ranked last out of 13 vendors, with 79.6 percent detection. TrustPort came in first at 99.5 percent detection; AVK came in second with 99.4 percent detection; and AVIRA GmbH's AntiVir Personal Edition Premium came in third with 98.9 percent detection. If ranking low in its rates of malware and virus detection isn't enough to irk users, a recent update to the product has been quarantining the Outlook.PST file, which stores mail in Outlook and Outlook Express, users reported recently on a Microsoft Windows user form. "This is the most unacceptable act Microsoft has ever committed," groused one user on the forum. "I run a small business, and I am screwed. I have no way to respond to e-mails because I made the mistake of trusting Microsoft ... and all of my e-mails and contacts are gone." Microsoft confirmed the problem Friday and said it will update the Windows Live OneCare engine to fix the problem as part of its monthly patch release cycle. The company also offered the following step-by-step fix to recover lost e-mail in the meantime: *Â Close Outlook or Outlook Express *Â Click change OneCare settings in the main OneCare user interface *Â Click on the viruses and spyware tab *Â Click on the quarantine button, and then select the pst or dbx file, and then click on restore. To ensure that the problem does not continue until the next update, Microsoft said users should also do the following: *Â Click change OneCare setting in the main user interface *Â Click viruses and spyware tab *Â Click on the exclusions button *Â Click on the add folder button *Â Navigate to the specific folder that contains the .dbx or .pst file to be excluded. *Â Click OK.
544298
As malware gets more aggressive, security software companies seek to set standards for products and evaluations.
261643
InfoWorld - IT procurement managers are finding that Microsoft&#39;s Software Assurance maintenance program may not save them money as hoped, according to a survey by Forrester Research.
561076
Microsoft must comply with behavioral remedies imposed by the European Commission, but observers are skeptical of the difference they will make.
55085
Microsoft advised users of its Mac version of Microsoft Office that a security patch inadvertently issued through its software update service was not ready for release. It advised those that may have applied the patch to uninstall the update.
156569
Worries about how well SP2 will work with existing software, combined with concerns about possible security vulnerabilities, have led many corporates to hold back from installing the security update.
192219
Software maker has its eye on consumers who might be ready to make the switch from Windows.
166587
For some security researchers who uncover flaws in leading computer programs, a nod of appreciation from software companies is no longer enough.
587941
Microsoft Corp. has quietly begun giving some of its largest customers early warning of security problems with its products. -AP
58499
(InfoWorld) - When Windows Vista ships next year, customers might have a tougher time getting their security software to work properly, executives from Symantec said Wednesday. At issue are two new features being introduced with Vista: an enhanced Windows Security Center as well as a feature in the 64-bit version of Vista called PatchGuard. Microsoft says it is adding these features to lock down the operating system, but Symantec believes that they will be harmful to customers by making it harder for them to use third-party software. "There's no question that they're leveraging a monopolistic position to limit customer choice," said Chris Paden a Symantec spokesman. While Symantec executives did accuse Microsoft of being more difficult to work with on Vista than with previous operating system introductions, they stopped short of accusing Microsoft of antitrust violations. "It's not anti-competitive behavior, because Vista hasn't even hit the market yet, " Paden said. Security vendors like Symantec are in a state of heightened sensitivity these days as they've begun to compete with Microsoft head-on, and the specter of further antitrust actions looms over Microsoft's every move in the security space. Last week the European Union's spokesman on competition, Jonathan Todd, warned that theÂ market could be threatenedÂ if Microsoft doesn't allow security vendors a fair chance of competing. Symantec and other security vendors dislike PatchGuard because it prevents them from accessing the Windows kernel. They say it will stop them from delivering important features like Symantec's "anti-tampering" technology, which prevents malicious programs from modifying Symantec's own software. PatchGuard will also make it more difficult for security vendors to protect against malicious software that takes advantage of kernel-level bugs, said Eric Sites, vice president of research and development with Sunbelt Software. "There are a lot of new exploits coming out that exploit kernel-level drivers, " he said. "If we're able to get into the kernel, we can watch for things like that, but with what Microsoft is doing we can't do that." Microsoft declined to be interviewed for this article, but in an interview with IDG News last week a Microsoft executive said that PatchGuard was simply an effort toÂ prevent the kernel from being misused. "We think that there's a significant amount of confusion around... certain security features in the product that we think raise the foundation," said Stephen Toulouse a senior product manager in the Security Technology Unit. "What we're doing is we're walling off the kernel from attackers, because the functionality that is currently there was never meant to be used by anybody -- by software vendors or attackers." But PatchGuard is enabled only in the 64-bit version of Windows. Because there are few 64-bit applications written for Vista, most of Vista's initial users are expected to run the operating system in 32-bit mode, and their security software will still be able to access the kernel. A more immediate issue for Symantec is many Vista users will find that both the Windows Security Center and Symantec warnings will pop up simultaneously. This doesn't happen with Windows XP because Symantec's software is able to automatically disable the Windows warnings, but with Vista users will have to turn off the Security Center themselves. This will make things unnecessarily complicated for many customers, said Rowan Trollope, Symantec's vice president of consumer engineering. "Most users can't figure out how to do that," he said. With two warnings popping up, each with different wording, users will be confused at best, and may simply begin ignoring security warnings altogether, said Sites. Some observers have speculated that Symantec may press the EU for action against Microsoft in this matter, but Trollope and Paden wouldn't say what Symantec planned to do to address these problems. "We're looking at all the possibilities now," said Trollope, "And none of them are good for customers."ADVERTISEMENTMAKE SOA REAL WITH IBM WEBSPHERE PODCASTStreamline processes and maximize efficiency within a proven service oriented architecture. Take back control of your business processes with IBM WebSphere.
644765
Criticized for a program that only provided some of its largest customers with warnings on security problems in its products, Microsoft Corp.
275748
(InfoWorld) - A wave of attacks targeting Microsoft's Office 2003 last year taught the company some tough security lessons it's now aggressively applying, a Microsoft software engineer said Friday. "When Office 2003 shipped, we thought we'd done some good work and that it would be a secure product," said David LeBlanc, a senior software development engineer with the Office team. "For the first two years after release, it held up really well, only two bulletins. [But] then people shifted their tactics and started finding problems in fairly large numbers." LeBlanc, one of the proponents of Microsoft's SDL (Security Development Lifecycle) initiative, and Michael Howard, the co-author of Writing Secure Code for Vista, referred to the spate of attacks in 2006 that exploited numerous vulnerabilities in Office 2003's file formats. The suite's core applications -- Word, Excel, and PowerPoint -- were all patched multiple times last year. "I can't gloss this over. You can look up the security bulletins that apply to Office 2003 yourself." The attacks, and the flaws they exposed, not only prompted immediate patches -- and the release this week of Office 2003 Service Pack 3 (SP3) -- but pushed Microsoft to step up efforts to track down bugs before shipping code. "We realized that fuzzing needed to be a much bigger part of what we did," said LeBlanc. "We were already on the road to doing that, but we had to do more of it, and get smarter at it." Fuzzing" is a process used by security researchers trolling for vulnerabilities and by developers looking for flaws in their code before it goes public. Armed with fuzzers -- automated tools that drop data into applications, file formats or operating system components to see if, and where, they fail -- programmers stress-test software. LeBlanc calls it "exercising the code." Office 2007, especially its file formats, was extensively fuzzed during its development, often with custom-built fuzzers written by the teams responsible for specific file formats, said LeBlanc. In turn, that led Microsoft's developers to go back into Office 2003 to run the same level of fuzzing against its code as was done with Office 2007. Fixes for flaws uncovered during the repeat round of testing were incorporated in SP3. The work's necessary, said LeBlanc, because of the length of time that Microsoft supports its corporate titles. "Do the math," he said. "Products are in mainstream support for five years, in extended support for another five. We're going to have to support something in the field for up to 10 years." That led to the realization that if it was to properly protect customers, Microsoft had to do more than just react to attackers' moves. "Part of our job is to try to figure out where the attackers are going and try to get there ahead of them," LeBlanc said. It's not an easy job, he admitted. "We shipped Office [2007] in early 2007, so mainstream support expires in early 2012. I can't possibly predict right now what the attackers are going to be doing and the techniques they'll be using in 2012. I wouldn't bet more than a beer that there won't be something in 2012 that I don't look back and go, 'Wow, I didn't see that coming'," LeBlanc said. Fuzzing as a preventative measure Among the ways the Office team is trying to get a step on attackers, said LeBlanc, is with stepped up fuzzing. He pointed to a presentation at last month's Black Hat security conference that described using generic algorithms to cover more code during fuzzing, a technique he said Microsoft had been working on for a couple of years. "Right now, [the technique] is only able to exercise relatively simple network protocols like HTML, which is a lot simpler than a Word document," said LeBlanc. "Given five years, will [attackers] figure out a way to scale that? Our job is to figure out [if they will] so we can protect our customers for the life of the product." Even the most diligent efforts, however, won't find every flaw, LeBlanc admitted. "One of the problems with fuzzing is it's really hard to say when you're done. Have you exercised the code sufficiently?" A good example of something testing didn't spot during Office 2007's development -- not to mention the even earlier work on Office 2003 -- was the bug in Excel's file format disclosed by the July security bulletin MS07-036. The vulnerability, which existed across the Office line, from version 2000 to 2007, was, said the bulletin, "in the way Excel handles malformed Excel files." It was the first bug in a core Office 2007 application's file format. "Something slipped through the cracks," LeBlanc acknowledged after looking over the MS07-036 advisory. "We like to stop these things, and overall, I think we did a pretty good job fuzzing Office 2007. This is the first one. It's kind of an example of why we need to continue to get smarter and apply more horsepower to this particular problem." Bottom line, he said, is that the developers working on Office know they have to crank it up a notch. "We're going to be continuing to push the envelope to find new ways to make the product as secure as possible," LeBlanc said. "We need to get way, way out in front of those guys." Computerworld is an InfoWorld affiliate