Microsoft's OneCare flunks anti-virus test
77467
Least among equals Microsoft's Live OneCare placed last in a test on the effectiveness of anti-virus security packages by Austrian researchers.â¦
643524
Windows users got no holiday break from security concerns as Symantec said it had confirmed three more yet-to-be-patched vulnerabilities in the Microsoft operating system, some of which can be used to launch denial-of-service attacks.
31340
Consider anti-reconnaissance tools Hurwitz &amp; Associates has been running an IT security campaign: "AVID: Anti-Virus Is Dead" for some time. The argument is based on the principle that blacklists of signaturesâsmall files that contain a unique string of bits, or the binary pattern, that identifies all or part of a virusâdo not, and cannot, provide adequate protection against viruses. This is because the signature files can only be written once a virus or other form of malicious software program has been identified. When a new malware program is discovered, the race is on to write a signature file for protecting against that virus. It's like putting a plaster on an open wound, rather than taking care not to get cut in the first place.â¦
359809
(InfoWorld) - There was a little surprise buried inÂ Microsoft's monthly security bulletins Tuesday. It turns out that Microsoft had quietly slipped out one of the February fixes just days before its Jan. 30 Vista launch. The fix was for a bug in Microsoft's Malware Protection Engine, used by products like Windows Defender, OneCare, and Antigen to scan for malware. Microsoft had discovered that the engine could possibly be tricked into running unauthorized code if it scanned a specially crafted PDF file. Nobody has actually launched such an attack, but since these products are always automatically scanning for malware in the background, the vulnerability could have led to some pretty nasty exploits. Still, it's strange that Microsoft waited so long to notify its customers of the patch. It's rare for Microsoft to release one of these out-of-cycle updates, but since it adoptedÂ its monthly patch process back in October 2003, it generally lets people know about them as soon as they're released. Microsoft's Mark Griesi told me that the company decided to send out the malware engine fix as soon as it was ready on January 26 and that this kind of quick fix is standard practice with most security software. But he said there was no particular reason why the company decided to wait until February 13 to tell people about it. Microsoft just hasn't been in the position of having to patch its security software since rolling out the monthly patch process, he added. "It was one of those first-time situations: 'Should we say something now or should we just wait,'" he told me. "This time we decided to wait. We won't do it again." From a PR perspective, it wasn't a bad move. Microsoft has touted Defender as one of the top three Vista security features. It wouldn't have been much fun to be talking about a major security flaw in the product just days before the Vista launch, would it?
744587
(InfoWorld) - Microsoft will start to give some customers the benefit of the doubt with an updated version of its software antipiracy tool, Windows Genuine Advantage Notifications. The company has added a new category to the tool, "indeterminate," for instances where it can't be sure whether the OS running on a user's PC is legitimate or not, said Michala Alexander, Microsoft's head of antipiracy for the U.K. Previous versions of the software labelled an OS as either valid or invalid. In the latter case it would block the customer from downloading software updates, except for critical updates such as security patches. However, some users have complained that the Notifications tool incorrectly identified their copy of Windows as unlicensed. The new category aims to address that problem, in some cases not ruling one way or the other on whether a user's software is pirated. The issue has arisen partly because, through no fault of the customer, the wrong product activation key can sometimes be used to unlock a legitimate copy of the OS. For example, a PC repair shop might reinstall an OS on a customer's machine with a product key that it uses over and over, Alexander said. She said she saw one repair shop that had a product key written up on a whiteboard so it could be reused easily. Software pirates can also complicate matters, by generating fake product activation keys to try to unlock software. The Notifications tool checks the activation key on a customer's PC and compares it to a database of legitimate keys. A computer may pass the test at one time, but six months later it may fail it if other computers have subsequently been registered using the same product key, Alexander said. The situation makes it difficult sometimes for Microsoft to make a clear call. "The last thing we need are false positives," she said. When a customer's software is flagged as "indeterminate," they will be redirected to Microsoft's Web site for more information. One way out of the problem would be to re-enter a legitimate product key, which does not require the user to reinstall the OS, Alexander said. Microsoft will continue to update Notifications every three to four months, she said. Earlier this month it released an update through Windows XP's Automatic Updates. It also rolled out 21 localized versions of the program for countries including China, Portugal, Russia, and Korea. Complaints from usersÂ have prompted Microsoft to make several changes to Notifications since it debuted in July 2005. It dropped the persistent pop-up messages that used to warn people their software might be unlicensed, for example. Notifications is one prong of Microsoft's antipiracy strategy, which also involves suing counterfeiters and visiting PC stores to ensure that sellers are installing the OS properly.
202697
Release of anti-spyware tool, promise of virus removal software could spell trouble for antivirus software companies.
241353
The new flaw is unrelated to the help-file flaws discovered by a Chinese security company last week. Microsoft took the Chinese security group to task for disclosing the vulnerability without giving the company a chance to develop a fix.
231323
The virus, dubbed W64.Shruggle by Symantec, seems mainly to be an experiment to test the concept of a 64-bit infecter and is not actively spread, said Alfred Huger, senior director of security at Symantec.
391717
Microsoft denied it has turned on an anti-piracy measure in Vista that would stop  unlicensed OEM copies of the operating system from running, but did not rule out using it in the future.
395254
Microsoft's new operating system Vista  will not make it more difficult for anti-virus systems to work,  Russian computer security group and potential IPO candidate  Kaspersky Lab said on Friday, contradicting rivals.
71569
(InfoWorld) - Microsoft's Office software is under attack again, this time with anÂ unpatched flaw in the Windows 2000 version of Office 2000 being usedÂ by hackersÂ to run unauthorized software on a victim's computer. Microsoft confirmed on Tuesday that the bug exists, but it would not say when it plans to fix the problem. The critical vulnerability wasÂ first reported by SymantecÂ to users of its DeepSight threat notification service. Attackers are exploiting the flaw by sending malicious Word documents to victims, Symantec said. When these documents are opened, Word is tricked into installing malicious software on the PC. Symantec is calling this malware Trojan.MDropper. Trojan.MDropper installs malicious software on the computer, which in turn installs another Trojan horse program "which turns out to be new variant of Backdoor.Femo," Symantec said in an Web posting. Symantec testers had not been able to exploit the problem on more up-to-date versions of Office or Windows. On Tuesday Microsoft said that the bug was confined to Microsoft Word 2000. Microsoft is investigating the issue and may issue a patch once that investigation is completed, according to the company's public relations agency. Microsoft has spent a lot of timeÂ investigating and patching Office applications this year. Over the past few months there have been several reports concerning very targeted attacks, similar to this latest Office issue. Microsoft's last few security updatesÂ have been filled with patches for Office flaws, many of which had already been used in attacks.
610820
Though Microsoft Corp.'s new security update package is all about protecting systems from worms, viruses and spyware, it can't do much about what's already on computers - and that could pose a problem.
764362
Glitches between Windows XP Service Pack 2 (SP2) and critical applications continue to emerge, with McAfee admitting its flagship VirusScan product prior to version 7.1 requires a customised patch to be operational with Windows Security Center, part of SP2
532268
The reason it's called "beta testing" is to anticipate and isolate problems. But a big problem reported by some -- not all -- Vista SP1 testers is causing Microsoft to take a step back.
201469
(InfoWorld) - Microsoft Corp. has released a test version of its new Forefront Security for SharePoint software designed to support upcoming versions of Microsoft's portal software. The beta code, released Thursday, gives administrators a way to plug as many as five antivirus scanning engines into SharePoint Server 2007 and SharePoint Services 3.0 in order to root out malicious or unwanted documents. The product is based on theÂ Antigen softwareÂ Microsoft picked up in its June 2005 acquisition of Sybari Software. Another Sybari-based product, Forefront Security for Exchange went into beta in July. This latest SharePoint release features a new Microsoft Antivirus engine, performance enhancements, and better management features. It also comes with better support for languages other than English. "Until now we've only had English versions," said Joe Licari, director of product management for Forefront. "This release will localize in 11 languages including Japanese and Chinese." Microsoft is tying the rollout of Forefront Security of SharePoint to the release of its SharePoint Server 2007 and SharePoint Services 3.0 products. The commercial version will be available for download by year's end, and then on DVD during the first quarter of 2007. The beta release can beÂ downloaded here. Â
509953
During a weeklong period in mid-November, security experts with Symantec observed roughly 65,000 new applications being downloaded onto the computers of customers participating in a new research project -- based on their analysis of the software, as many as 60 percent of the programs were malicious.The involved timeframe represented a relative high point for the percentage of unknown applications being downloaded by Symantec's project participants, and the basis for the company's assessment of the programs as malicious was predicated largely on the programs' use of obfuscated naming conventions.However, the numbers point to a disturbing trend that the researchers say may force the security company to change its fundamental approach for warding off threats -- that being that the number of malicious applications coming to life on the Web appears to be outpacing the volume of legitimate programs.With malware authors using fuzzing tools to find holes in popular applications such as Web browsers, and testing their work against commercial anti-virus (AV) products to ensure that the attacks evade detection by the tools, leading researchers at Symantec admit that defending against threats using traditional methods has become something of a losing battle."The reality is that most new malware is going undetected by commercial security products, and not just Symantec's, but we have to recognize that like all other AV products we are probably missing a sizeable amount of this malware," said Carey Nachenberg, a member of the company's Security Response team who also wears the title of Symantec Fellow."Eventually we write [virus] signatures and get those out to customers, but it appears that a sizeable proportion of this malware never gets detected," he said. "Instead of distributing one copy of each malware program to thousands of people, they're producing a copy for as few as two or three people and then re-writing it; so, if we get one version we can remove it from a few computers, but not all the variants. The problem with this is that there is the potential over time for almost everyone to have some form of infestation, maybe in only a few years time."The trend toward malware authors using small runs of attacks to evade detection and hook as many victims as possible, known as server-side polymorphism, is forcing Symantec to reassess how it goes about protecting its users.Since it can't hope to keep up with every flavor of threat that is being created, traditional countermeasures such as the use of malware signatures or behavioral heuristics will need to be augmented with new tactics, Nachenberg said.One such alternative is the use of the same distributed data collection capabilities that Symantec is using to track the proliferation of malware. By creating a system of file and Web site reputation by studying applications usage patterns among its customers, the researcher said, Symantec hopes to use a community approach to help people determine which programs they decide to use, or avoid.Much as many people turn to the reviews section on Amazon.com or the buyer feedback system on eBay to get a real-world take on products before they decide to buy, Nachenberg contends that by watching how people are using various applications the security vendor can use a process of elimination for weeding out malware from legitimate software.If only a few people among the millions of Symantec customers who could contribute usage data to such a program were utilizing some application in question, it would be prudent to recommend that people avoid the program until its nature has been better determined, he said.Using opt-out tools that provide anonymous feedback on applications that were built into Symantec's existing Norton AntiVirus and Internet Security 2008 products, the company is already gathering the type of data necessary to create such a system of recommendation."Right now this is just a long-term research project, but we hope that as we get more users involved in the system, we can truly get a better idea of what is on people's computers so that we can identify malicious software based on the demographics of who is using it, versus what it does," Nachenberg said. "We're hoping to get more clarity through the large base of users we have; by collecting this data we should be able to get the most comprehensive view of the usage patterns to derive reputation information for everything they use."Faced with questions over potential privacy issues driven by Symantec's ability to watch just who is using what applications and how, the researcher reiterated that users must be made aware of the data collection, allowed to opt-out, and guaranteed that all the information aggregation is done in an anonymous fashion.By offering users the ability to decide whether or not to use an application based on demographics, versus simply blocking programs based on its own observations, the company will also give people more freedom to determine what tools they feel are appropriate to use, he said."If we know that only five people are using a program, given the tens of millions of users we ultimately hope to have in the system, we can be totally objective and recommend that people wait until it is scrutinized further before using it," the researcher said. "We will need to have some manual process for white-listing programs as well, but we think that using this approach we can deliver a reasonable amount of quality with a low false positive rate."If the volume of new malware strains arriving on the Web continues to outpace the proliferation of legitimate programs, Nachenberg said that AV vendors including Symantec may need to move to a white-listing approach in general, and focus more attention on identifying good applications instead of trying to chase down all the bad."If there is less software to analyze that is good, it makes more sense to spend our time scanning for good programs and simply telling our users to avoid everything else," he said. "We're considering models where we can produce the world's largest up-to-date white list of software, but it's not something we can put together in a year; maybe in two-to-three years time."
388867
In response to the growing number of viruses infecting computers, a spokesman for Germany's Federal Office for Information Security (BSI) has suggested that users consider alternatives to Microsoft Corp.'s Internet Explorer (IE) Web browser. But the agency did not recommend that users steer clear of Microsoft products, the spokesman said, refuting a press release issued Tuesday by browser developer Opera Software ASA.