Vista security claim challenged
537751
Security experts cast doubt on claims that Microsofts Vista is "more secure" than other operating systems.
408632
Microsoft denied Wednesday that its software had arbitrarily changed Windows Vista's update settings, saying that users were responsible for the modifications that generated claims of unauthorized patch installs.Reacting to reports that first surfaced last Friday, a program manager for Windows Update said today that an investigation had turned up no evidence the Oct. 9 security fixes had switched settings in Vista's AU (Automatic Updates)."From the customer logs that we received, we found that none of the updates released as part of the October security release have made any changes to users' AU settings," said Nate Clinton in a post to a company blog. "In fact, in the logs we reviewed, AU in all cases was set to 'install updates automatically' prior to the October security release."Vista allows users to turn off AU entirely, tell the operating system to check for but neither download or install any fixes, instruct the mechanism to download files but not install them; or accept all patches without any additional approval.The claims that AU settings had mysteriously reverted to the "install automatically" setting began to trickle into a message forum on the AeroXperience Web site soon after the release last Tuesday of six security updates. Several users said that AU downloaded and installed patches even though they had specifically instructed Vista not to do so.But unlike last month, when a Windows newsletter revealed that Microsoft had updated users' PCs contrary to their instructions, the newest charges were limited to AeroXperience members. No similar reports, for example, were posted to the Windows Update support newsgroup hosted by Microsoft. During September's brouhaha, that newsgroup was thick with messages about the stealth updating.Certain that AU had not run amok and changed its own settings, Clinton fingered users for the altered state of AU. "I want to stress that the Windows Update client does not change AU settings without users' consent. However, AU settings can be set or changed in the following scenarios," he said, and then listed five; all require the user to take action or accept one option from several offered."During the installation of Windows Vista, the user chooses one of the first two recommended options in the 'Out of Box Experience' and elects to get updates automatically from Windows," Clinton said was one possibility. Another: "The user chooses to opt in to Microsoft Update during the installation or the first run experience of another Microsoft application such as Office 2007."Earlier, a Microsoft spokeswoman had been more blunt. "It may be more a case of someone clicking to change their AU settings but not realizing /remembering doing so," she said Tuesday.Users on AeroXperience writing to the forum after Microsoft wrapped up its investigation accepted Clinton's explanation. "The disparity between the Windows Update control panel applet and the OOBE (Out of Box Experience) update settings page (when first running Windows Vista) seems to be what's causing the confusion," said a member identified as Bryant.Computerworld is an InfoWorld affiliate
305362
Microsoft on Thursday flatly denied reports that one of Windows XP Service Pack 2&#39;s most touted features leaves users open to possible attacks.
480299
By SEAN YOONG  PUTRAJAYA, Malaysia - Malaysian authorities have begun raiding computer retail outlets offering pirated software amid concerns that illegal copies of Microsoft Corp.'s newest operating system, Windows Vista, are already on sale.
254458
Microsoft is taking security risks with its forthcoming Vista operating system, says software firm McAfee.
509701
A lawsuit that alleges Microsoft Windows Vista Capable users were misled about operating system's capabilities won't go to trial until October 2008. The planned trial date was set even though the judge in the case is still considering a motion from Microsoft to dismiss the case.
551921
(InfoWorld) - MicrosoftÂ on Thursday released an update to Windows Vista that will shut down unauthorized versions of the OS that allow users to skip the product's activation system. The move comes asÂ pirated copies of Vista are already making the rounds, mere weeks after the product was released to business customers. The update, which Microsoft has dubbed "frankenbuild," detects tampering of Windows Vista code that would allow users of the OS to work around the product's built-in activation system, which requires users to validate their copy of Vista with a product activation key to use the full version of the product after 30 days. Frankenbuild mixes files from various test and final versions of the software. It will require only systems in which it detects specific tampering to go through a validation check for authenticity, according to a posting on the Windows Genuine Advantage blog. If a version of Vista that has used a workaround to avoid product activation is detected, a user of that software will have 30 days before the OS goes into a reduced functionality mode, Microsoft said. In this mode, all users can do is access their existing files and surf the Web for an hour before having to log back on to the software. The pirating of Windows has been a perennial problem for Microsoft, particularly in developing countries. The company began coming down hard against piracy last year withÂ a widely criticized systemÂ it called Windows Genuine Advantage, which initially required users to validate their copies of Windows if they wanted to use Microsoft's update services. Microsoft took its antipiracy campaign one step further with Vista by building the validation system directly into the OS. This system requires a Windows Vista user to validate the software through a product activation key within 30 days of using the OS to avoid having the software go into reduced functionality mode.
208849
A report penned by one of Microsoft's top security experts argues that Windows Vista had fewer known security flaws in its first year of release than other major industry operating systems. On the blogs, skeptics abound.
703405
Microsoft Corp. defended its decision to limit support for three versions of the Windows Vista operating system to five years rather than the usual 10 years.
354687
Competitors say they should be able replace a Windows feature that tells people about the security status of their PC.
630187
McAfee took a full-page advertisement in Monday's Financial Times to level charges that Microsoft is locking security companies out of the Vista kernel in an attempt to "hamstring" them. McAfee says it is the first time that Microsoft has made such a move.
402563
(InfoWorld) - Microsoft blamed human error for aÂ Windows Genuine Advantage problem that identified legitimate Windows users as piratesÂ last week. "Nothing more than human error started it all," Alex Kochis, senior product manager for Windows Genuine Advantage at Microsoft wrote on the company blog Tuesday night. New software was accidentally loaded onto the live servers running the system, he said. That ultimately caused the servers to decline activation and validation requests that were good, he wrote. While Microsoft quickly noticed the problem and rolled back the changes within a half hour, the problem continued to affect the validation service, he said. The activation process was fixed in that time frame, he said. The company is implementing some changes to make sure a similar incident doesn't happen again. It is improving monitoring in order to find out sooner if there is a problem, he said. Microsoft is also adding checkpoints that should prevent accidental changes to the servers. Kochis' explanation is fine but the incident is still troubling, said Michael Cherry, an analyst at Directions on Microsoft. "I think it's unsettling for people when it doesn't validate," he said. While it's great that Microsoft has put some new procedures in place, Cherry was surprised that it was even "feasible" for someone to accidentally load the wrong code into the live environment. "It just raises the question of what other things have they not done," he said. In his blog post, Kochis clarified that an existing policy will automatically validate all users if the WGA servers are down but that in this case, the servers weren't down, so that policy didn't kick in. With that policy in place, Cherry wonders why Microsoft didn't just take the servers down while they were diagnosing and fixing the problem so that legitimate users wouldn't continue to have issues. The problem began on Friday evening and lasted through Saturday afternoon. During that time, some users incorrectly failed the validation process, leaving them unable to use certain features including Windows Aero, Windows ReadyBoost, and some features of Windows Defender and Windows Update. Affected users also saw a message in the corner of their screen that said "This copy of Windows is not genuine." WGA has been criticized since its unveiling in 2005. The system, which works for Windows XP and Vista users, is meant to help Microsoft disable software pirates, but some users say it's cumbersome. In addition, Microsoft faces two class action suits that characterize WGA as spyware and cite concerns over how Microsoft uses data it collects about users through the program.
181908
(InfoWorld) - Google's claims thatÂ Microsoft's built-in Vista desktop indexing and search tool violates its antitrust agreementÂ could be difficult to prove even if the software does slow down the performance of Google's competitive Google Desktop offering. As long as a user can run alternative software to Microsoft's Instant Search software, it's unlikely that U.S. federal antitrust officials would consider coming down on the software giant, analysts and users said. Google's claims are far different than the ones posed by Netscape during the browser wars that led to the Department of Justice's antitrust suit in the 1990s, said Rob Helm, research director at Directions on Microsoft. "Microsoft beat Netscape in part by leveraging its relationship with PC manufacturers," he said. "This is a lot subtler." Google seems to be alleging that "if two pieces of software don't play together, then it must be an anticompetitive tactic of Microsoft's," Helm said. "I don't recall any past antitrust cases asserting something so broad," he said. The presence of Microsoft's Vista desktop search could be slowing down Google's product merely as an accident of product design, not because of any malicious intent by Microsoft, Helm said. "Even if Microsoft's software was perfectly written, the way Google interacts with it might be bad, and either company might be at fault," he said. "They could have both done the right things in different ways that might conflict with each other." According to a report in The Wall Street Journal Monday, Google sent a white paper to U.S. federal and state antitrust officials in April to try to convince them that Vista makes it difficult for consumers to use rival desktop search software. In its white paper, Google claims that Vista's search boxes and bars -- available in several places in the OS, including the Start menu and in the Windows Explorer file manager -- work only with Microsoft's search and indexing tool. The company also said it is nearly impossible to turn off Vista's indexing, which means a competitor must add a second indexer that slows down a PC. Google spokesman Ricardo Reyes confirmed the company's charge against Microsoft Monday. Microsoft is disputing Google's charges and said that it has worked closely with federal officials to ensure its Vista OS, released to consumers in January, fosters rather than inhibits competition in the area of desktop search. Users can disable Vista's desktop search service, but the company has not made it simple for them to do so, acknowledged Jack Evans, a Microsoft spokesman. He said this is because the company designed Vista's desktop search specifically "to not affect performance and back off any other programs running" -- including any third-party desktop search software -- in a way that should resolve any claims of anticompetitive behavior, Evans said. Andrew Brust, chief, new technology of consulting firm Twentysix New York, said he used Google's desktop search when it first came out but switched to Microsoft's product when it became available for Windows XP because he preferred it. "Microsoft chose to integrate into Windows, whereas Google decided to be browser-based," he said. "Plus, at least back then, Google installed its own local Web server as part of the product and I really didn't like all that baggage. Microsoft's was just more useful." Brust, who has used Vista in beta form, said integrating desktop search into Vista is "common sense" and suggested that Google's complaints might be sour grapes over Microsoft's own antitrust charges against the search vendor when it unveiled plans toÂ purchase online advertising and marketing powerhouse DoubleClick. Samir Bhavnani, research director for analyst firm Current Analysis West, said that Microsoft's integration of desktop search into Vista was a response to Apple's inclusion of desktop search in their Mac OS, not a move against Google. He said it wouldn't be fair for Google to accuse Microsoft of being anticompetitive without leveling the same charge at Apple. However, Helm contradicted this reasoning and said that Apple was not found in a U.S. court to have a monopoly on PC OSes, while Microsoft was in the DoJ case. "I don't have the impression that Google is worried about Apple," he said.
47524
Another potential delay for Vista looms from the security front, as European Union regulators and Microsoft square off over planned features in the upcoming operating system.
746656
Even with the operating system released to the public, Microsoft cannot seem to catch a break with Windows Vista. The latest complaints come from game developers, who say the OS' parental controls are so strict they're disrupting gameplay.
583525
A lawsuit alleging that Microsoft Windows Vista Capable users were misled about the capabilities of the operating system will go to trial Oct. 28, 2008.
273145
Both involve vulnerabilities within Windows; one marked critical includes Windows Vista.