McAfee Warns Against Vista Security Features
21101
Antivirus vendor cries foul, saying Microsoft locks out other vendors' products.
395210
Computerworld readers across the country have written in angered and frustrated by antipiracy features that are included in the new Vista operating system.
458779
A Windows feature designed to simplify computing for disabled users could be misused in Vista, a McAfee Inc. researcher reported Monday.
452780
McAfee says it's sorry for glitches in new security software.
273457
Microsoft says that speech recognition features in Vista could be hijacked so that a PC tells itself to delete files.
189384
Antivirus software company McAfee Inc. said on Monday that a new version of its VirusScan Enterprise software contains so-called "intrusion prevention" features that can protect computers from attacks such as buffer overflows, which are often used by viruses, worms and malicious hackers to compromise vulnerable Microsoft Corp. Windows machines.
564903
A serious security hole in a wide swath of the company's antivirus products could let an outsider crash or hijack a computer.
101286
The E.U. warned Microsoft against foreclosing competition in computer security software by tying new security features into Windows Vista.
514325
Microsoft Corp. MSFT.O warned Windows  users on Tuesday of two new "critical"-rated security flaws in  its software that could allow attackers to take control of a  computer and delete or copy information.
241911
(InfoWorld) - Microsoft has touted Vista as aÂ more secure version of Windows, but on the day ofÂ Vista's official launch, a security company has identified malware already in circulation that can infect computers running the OS. Sophos identified three viruses typically spread through e-mail that can infect Vista customers who use a third party Web e-mail client. While Vista's e-mail client stops Stratio-Zip, Netsky-D, and MyDoom-O, the malware slips past Vista's defenses when users receive infected messages through a Web-based e-mail service, Sophos said. Stratio-Zip topped Sophos' list of malware affecting computer users in the month of November, accounting for 33.3 percent of malware in circulation. Combined, the three viruses that can affect Vista users make up 39.7 percent of all malware in circulation during the month, Sophos said. However, even if the malware Sophos identified slips through in an e-mail, customers won't necessarily be affected, another researcher said. Additional Vista security mechanisms should protect users, said Mikko HyppÃ¶nen, chief research officer at F-Secure. If a customer opens an infected malware file, Vista would warn and question the user before allowing the malware to wreak havoc. "These particular examples of malware probably wouldn't still be able to successfully infect the machine unless the user specifically allows it," he wrote in an e-mail exchange. Sophos applauded the security improvements in Vista, saying that the variety of popular third party applications used by consumers inevitably will open doors to hackers. Other anti-virus companies haven't been so kind.Â McAfee has been highly criticalÂ of changes in the operating system that it says will make Vista less secure than previous versions of Windows. Symantec said itÂ has discovered vulnerabilitiesÂ in Vista's networking software which makes it less stable than Windows XP. Sophos found that overall, the proportion of infected e-mail remained low in November at 0.28 percent, but identified a record number of new threats, 7,612, during the month.
195221
Windows XP Service Pack 2 promises to raise the security bar for the sometimes beleaguered operating system. Unfortunately, one of the new features could be spoofed so that it reports misleading information
326581
Stoopid human Improved technology and design alone will not be enough to keep Windows Vista and Office 2007 users safe from hackers and identity thieves, according to Bill Gates.â¦
78617
Microsoft Corp's  upcoming Windows Vista computer operating system will include technology that is designed to prevent pirated copies from fully functioning, the software giant said.
416302
(InfoWorld) - Symantec published a series of four research reports on Feb 28 that critique various security elements of Microsoft's new Windows Vista operating system, including the software's ability to ward off existing malware threats. Unsurprisingly, the security software maker, which still derives the bulk of its revenues from the estimated $3.6 billion market for technologies used to defend Windows computers, found a fair number of shortcomings in the latest iteration of Microsoft's dominant OS. One of the biggest problems is that Vista remains vulnerable to existing malware attacks designed to take advantage of flaws in earlier versions of the OS, according to the reports. However, the Cupertino, Calif.-based antivirus market leader also highlighted a number of features built into the product that it said will advance end-user security. An area where Symantec researchers said Microsoft has greatly improved security is related to the mitigation of virus attacks aimed at code-level vulnerabilities. Previous versions of Windows have been shipped with scads of coding errors that allowed hackers to deliver malware threats, but work on the part of Microsoft -- such as through its Security Development Lifecycle program -- has helped lower the volume of available vulnerabilities, according to the reports. The immediate benefit to Vista users will be the reduction of threats that use common infection techniques like buffer overflows and heap manipulations to deliver their payloads, Symantec predicted. Another area where Symantec recognizes security improvement on the part of Microsoft is in the use of its reduced user privilege model in Vista, which is aimed at preventing virus attacks from upping the administrative status of infected PCs to boost malware proliferation and related damage. While arguing that there may be the ability for hackers to disable Vista's new User Access Control, which is designed to keep users abreast of any changes attempted on their PCs by unknown software programs, Symantec concedes that the security tool should help fight malware attacks, including worm viruses. Despite the praise and its submission that Vista thus far appears to be the safest operating system ever produced by Microsoft, the Symantec reports levels a great deal of criticism at many other aspects of the OS. Vista is a more secure product than previous versions of Windows, but there is still plenty of need for users to buy the layered security defense products the security company markets, said Ollie Whitehouse, a researcher with Symantec's Security Response team. "Vista is a security evolution, but not a revolution," Whitehouse said. "Microsoft did invest a lot of time and resources into the development of Windows XP SP2, and Vista is a continuation of that, and they addressed a number of core issues, such as buffer overflows, but it is still only an OS, not a security solution itself." Vista may help stop some traditional types of attacks, such as worms, but Symantec maintains that newly emerging threats, integration problems with third-party Windows applications, and a range of other issues will keep users in the market for additional security tools. One area that remains a sore spot from Symantec's perspective is Microsoft's use of new features to protect the Vista kernel against root kits and other attacks. In 2006, a major controversy broke out between the two firms and other security technology providers based on the fact that Vista's PatchGuard system, available only in 64-bit versions of the OS, prevents any programs -- including Symantec's security applications -- from patching the software's kernel memory. Symantec and rival McAfee, among others, argued at that time that not being allowed to access the kernel as they have in prior iterations of Windows would prevent their advanced behavior-based technologies from working properly. But Microsoft and the security firms claim to have solved the problem using a set of APIs. In the research reports, Symantec repeats its contention that PatchGuard may also be easily bypassed, defeating its very purpose and allowing kernel-altering attacks, including root kits, to live on. Labeling the combination of PatchGuard and two other Vista kernel protection technologies, known as Driver Signing and Code Integrity, as a mere "bump in the road" for attackers, Symantec said that a single researcher bypassed all three features in one week's time, further proving their vulnerability. "Microsoft has made good strides with kernel protection, but again, it's not perfect," Whitehouse said. "PatchGuard has and will be broken, and while it is obviously better than nothing, people who have an interest will find ways to get around these features." Another area where Symantec leveled criticism at Microsoft is in relation to Vista's ASLR (Address Space Layout Randomization) feature, which is designed to help obscure programs stored in the operating system's memory to make it harder for attackers to isolate vulnerabilities. Symantec said the feature has a flaw that prevents it from working properly. Here again, Symantec mixed praise and calls for concern in outlining its observations of ASLR. "When implemented correctly, this technology is extremely effective in mitigating the exploitation of memory corruption and memory manipulation vulnerabilities," reads the Symantec report. However, the research contends that Symantec has already found that one element of ASLR that means to randomize and hide software components does not work consistently, therein making it easier for attackers to guess where vulnerabilities may lie. Symantec said further that Microsoft has confirmed the issue and pledged to fix it when it issues a Windows Vista SP1 update. Both the PatchGuard and ASLR issues feed into another Vista problem cited in the Symantec research: integration with third-party products. In addition to the potential problems introduced by PatchGuard to its own products, Symantec said that the third-party drivers provided by Microsoft may be targeted as a means of gaining kernel-level access on compromised machines. ASLR has been highlighted by at least one other security company as a potential weak point in Vista. Just as Symantec maintains that many of Vista's security features won't help protect end-users unless third-party software makers can effectively integrate with the tools, penetration testing specialists Core Security, based in Boston, published a report on Feb. 6 that highlighted a well-known vulnerability existing in CA's BrightStor backup software that it said could still be exploited on machines running Vista. Because the CA software had not been updated to integrate with ASLR and other Vista security features -- although CA said it would soon have a new version of the product to market and Microsoft officials disputed the issue -- the operating systems' onboard defense features won't help protect such legacy systems, Core said. Symantec's report repeatedly highlights the third-party integration issue as a major weak point for Vista's security goals. Microsoft officials stuck to their long-standing defense that Vista goes a long way toward mitigating many common PC security issues and that the company will continue to bring new security features to bear on the OS and future products. Microsoft said it is further investigating several specific product flaws cited in the Symantec report, including the ASLR problem. "It is important to note that none of the security features in Windows Vista, either individually or collectively, are intended as a 'Silver Bullet' solution to the problem of computer security," said Russ Humphries, senior product manager, Windows Vista Security. "We believe Microsoft has developed the right balance and made the right decisions when evaluating the tradeoffs between usability and security," Humphries said. "[Symantec's] report does not properly address the fact that many of the Window Vista security technologies have numerous options that allow for a user to make their own judgments as to their need for security balanced against usability."
36580
Microsoft said people running a pirated version of its new Windows Vista operating system will be denied access to some features.
632400
(InfoWorld) - Windows Vista will be the most secure operating system that Microsoft Corp. has released, a company executive said Tuesday at a Vista launch event in Washington, D.C. Microsoft has listened to feedback from users, who disagreed with the decision to have some security features turned off by default in Windows XP, said Bill Veghte, Microsoft's corporate vice president for North America. "I won't mince words," Veghte said to an audience of nearly 3,000 people. "Every single time we had a trade-off between application compatibility or security, we went with security." ButÂ Windows VistaÂ also includes a feature that shows users which applications have problems after switching from an earlier version of Windows and the fixes that are available for those issues, Veghte said. Microsoft will also submit its Office SharePoint Server 2007 for U.S. Department of Defense (DOD) certification for electronic records management, Veghte said. Microsoft, working with partner Applied Information Sciences Inc., expects to have SharePoint Service compliant with DOD 5015.2 standard in May. The DOD standard focuses on secure records handling, requiring encryption on Web-based applications, the ability to schedule records to expire, and the ability to restrict user access to documents. Applied has developed a Records Management Center add-on pack to SharePoint Server, part of the MicrosoftÂ Office 2007 suite released Tuesday along with Vista. That add-on will allow users to comply with the DOD standard and have "military-grade" records management, said Russ Stalters, Applied's chief technology officer. The add-on package will allow customers to collaborate using SharePoint without buying third-party records-management software, as SharePoint users have had to do in the past, Stalters said. By complying with the DOD standard, the software package "sets the bar" for records management for customers in highly regulated industries, he said. In addition to the DOD compliance, Microsoft's new offerings contain several new security features, Veghte said in his speech. Microsoft has the responsibility of setting the standards for secure defaults and architecture in Vista, he said. Hackers are not standing still, and "we have to keep pace," he said. Among the new security features in Vista: -- System administrators can stop PCs from allowing USB (Universal Serial Bus) drives or other peripherals to be connected. -- Vista and Internet Explorer will warn users when a Web site attempts to install dangerous code. -- An antiphishing site, updated hourly, will warn users of e-mail messages that attempt to trick them into giving up their personal information. -- If a user manages to download malware, the Windows Defender security software is designed to block it from doing damage. -- The Enterprise and Ultimate versions of Vista will allow users to encrypt hard drives. Vista's BitLocker Drive Encryption feature is an attempt to address continuing problems with data breaches, often caused by lost laptops, Veghte said. About 660,000 laptops were lost or stolen in the U.S. in 2006, he said, leading to a lot of stories about such incidents that "ended up on the front page" of major newspapers.
631605
Microsoft can't stop crowing about new Vista security features. But the system still has holes. Here's how to plug them.