McAfee says Vista's StickyKeys could be misused
478392
(InfoWorld) - A Windows feature designed to simplify computing for disabled users could be misused in Vista, a McAfee researcher reported Monday. Attackers could use this feature, called StickyKeys, to trick a user into launching unauthorized software on the Vista machine, according to Vinoo Thomas, a McAfee researcher who blogged about the issue on Monday. StickyKeys is launched when a Windows user hits a modifier key like Shift or Alt five times. This makes the modifier key "sticky" so commands like Shift-F1 can be launched without having to hit two keys simultaneously. An attacker could replace the sethc.exe file used to launch StickyKeys with some other executable, like the Windows command utility, Thomas wrote. This backdoor vulnerability was already known to exist in Windows 2000 and Windows XP, according to Thomas. Although it is interesting that Vista is also vulnerable, it's not clear how useful the backdoor would be to an attacker because one must first gain access to the machine in order to replace the StickyKeys file. Thomas believes that it could be used by an inside attacker to bypass log-in on terminal servers and workstations. Microsoft executives were not immediately available to comment on the issue. To avoid the problem, "one can uninstall the Accessibility Tools feature, which is installed by default, to avoid this fairly simple, yet potentially serious built-in backdoor," he wrote. "And don't forget to hit the shift key five times and see what pops up on your desktop."
630187
McAfee took a full-page advertisement in Monday's Financial Times to level charges that Microsoft is locking security companies out of the Vista kernel in an attempt to "hamstring" them. McAfee says it is the first time that Microsoft has made such a move.
312629
If the Vista kernel can't be spoofed, it appears some of its key Internet Protocol kernel drivers can be. An IBM security division discovered the problem, and this morning, Microsoft issued what it hopes will be a fix.
461237
(InfoWorld) - A Microsoft security executive released data Thursday showing that, six months after shipping Windows Vista, his company has left more publicly disclosed Vista bugs unpatched than it did with Windows XP. In total, Microsoft has patched 12 out of 27 disclosedÂ Vista vulnerabilitiesÂ in the six months after it first shipped last November. During XP's first six months, Microsoft's security team patched 36 out of 39 known bugs. The data was published by Jeff Jones, a Microsoft security strategy director, who said that overall, Vista was doing better than XP. "Windows Vista continues to show a trend of fewer total and fewer high-severity vulnerabilities at the six month mark compared to its predecessor product, Windows XP," he wrote. Jones didn't address the larger number of unpatched vulnerabilities, but he did note most of the unpatched Vista bugs were not critical. Microsoft had left only one high-severity Vista vulnerability unpatched during the period. At the end of XP's first six months, there were two high-severity bugs that were unpatched. Microsoft patched 23 high-severity XP bugs during its first six months, compared with only one high-severity Vista flaw. Jones argued that Vista had a lower number of vulnerabilities than competitive operating system products such as Red Hat Enterprise Linux and Mac OS X. He published the data in an effort to show how Microsoft's software development methodology, called the Security Development Lifecycle (SDL) is yielding dividends. But his method of comparing Windows to Linux and Mac OS X is problematic, according to some. "This is an apples-to-oranges comparison," said HD Moore, one of the hackers behind the popular Metasploit penetration testing toolkit. "If you want a more accurate view, try comparing the number of flaws between Microsoft-developed software and vendor-X-developed software. Most Linux vendors don't actually write the majority of the packages they include," he said via e-mail. "Alternatively, force Microsoft to include all vulnerabilities in common third-party software," he added. "For example, the thousands of exploitable ActiveX controls that... vendors include with a Windows system." According to Randy Abrams, director of technical education with antivirus vendor Eset, it will be more interesting to look at vulnerability statistics once Vista becomes more popular than XP, and the target of more hackers. But Microsoft has stepped up its security practices, he added. "I think their Security Development Lifecycle initiative has improved the quality of the code," he said. Â
356268
Windows Vista is still prone to attack by three notorious pieces of malware -- mainly because the threats in question rely on social engineering to launch their invasions.
736753
(InfoWorld) - An online criminal has offered to sell software that exploits an unpatched bug in Microsoft Corp.'s Windows Vista operating system, according to security vendor Trend Micro Inc. The code was offered for sale in an underground hacker discussion forum last month, said Raimund Genes, Trend Micro's chief technology officer. The asking price? US$50,000. Genes didn't know if the code actually worked as advertised, or whether it was even purchased, but he said that it would have been difficult for the seller to have been involved with this particular forum without providing at least one reliable sample. "I think that definitely he had something," Genes said. "The question is whether somebody paid for this." If the offer is legitimate it would be the first serious bug reported in Vista since it was released to business customers at the end of November. The consumer version of Vista is set to ship next month. Microsoft is investigating Trend's claims but has "not been contacted directly by any parties about this vulnerability report, nor are we directly involved in the forums in which vulnerabilities are reportedly traded," the company said in a statement. If someone did pay for the code -- called a "zero-day" exploit -- it was purchased at a premium price. According to Genes, a similar exploit for Internet Explorer would command about $5,000. "This was way more," he said. "Maybe the person said, 'This is the first working exploit on Vista, so I can charge a premium.'" Because Vista is not as widely adopted as Microsoft's XP or Windows Server 2003 operating systems, criminals would have fewer potential victims to attack with the code. "To be honest [the price for a Vista zero day] should probably be lower," said Joe Telafici, vice president of Avert operations with McAfee Inc. "There's nobody to infect with it." There have been far fewer vulnerability disclosures in the weeks up to Vista's commercial release than there were when XP was introduced, Telafici said. That's partially due to the expansion of the underground marketplace for software bugs, he said. While most hackers were motivated by the fame and glory just a few years ago, they growth of cybercrime has introduced a new breed of more stealthy professionals, security experts say. Criminals who plan to use Vista vulnerabilities "are going to be holding them close to their chest until they are ready to release them," Telafici said. "I wouldn't be amazed if we saw vulnerabilities popping up over the next year that were found now."
112380
(InfoWorld) - One day after patching a widely exploited flawÂ in its Internet Explorer browser, Microsoft Corp. has a new bug to worry about, this time in PowerPoint. Attackers have been exploiting a newly discovered bug in Microsoft's Office presentation software in extremely targeted attacks, McAfee Inc. reported Wednesday. Researchers were made aware of the attacks when a customer submitted two different malicious PowerPoint files, both of which exploited the same vulnerability, said Craig Schmugar, a virus researcher at McAfee. Both files installed malicious remote access Trojan software that then attempted to connect to an outside Web server, he said. Though McAfee is not releasing technical details of the exploit, the security vendor says that it has confirmed that the attack works on three versions of Office running on the Windows 2000 operating system: Office 2000, Office XP, and Office 2003. Other platforms and other Office applications may also be affected, but McAfee has not yet had time to complete its testing, Schmugar said. Schmugar has blogged about the issueÂ  . Microsoft issued a security advisory on the matter Wednesday, saying that the issue affects users of Microsoft Office 2000, Microsoft Office 2003, and Microsoft Office XP, as well as Microsoft PowerPoint 2004 for Mac. Microsoft's advisory can beÂ found here. As a workaround, Microsoft suggests that users open and view files using PowerPoint Viewer 2003. This software "does not contain the vulnerable code and is not susceptible to this attack," the advisory states. The PowerPoint viewer can beÂ downloaded here. Microsoft and other security vendors, including Symantec Corp. and McAfee, have added signatures to their security products so that they can detect this malicious code. Over the past few months, attackers have focused on Office, exploiting a number of undisclosed Office bugs in extremely targeted attacks, often on government agencies or contractors. These attacks usually take the form of an e-mail that has a malicious Office document attached and is sent to a small number of target victims This latest PowerPoint attack fits that pattern and was sent to a defense contractor, Schmugar said. He declined to provide further details on the intended victim. Because the attack has been extremely limited in scope it is considered to be a low risk for most users, Schmugar said. News of the attack comes the day afterÂ Microsoft issued an emergency patch for a widely exploited bug that affected the VML (Vector Markup Language) rendering engine used by Internet Explorer and Outlook. Hackers are exploiting this critical flaw in the browser via mass e-mail and on thousands of Web sites, security experts said. Microsoft's next set of security patches will be released Oct. 10. The software vendor did not say whether it plans to patch this latest PowerPoint flaw.
410364
User Account Control: insecure by design? Security researchers have taken issue with Microsoft's implementation of a security feature in Vista that is designed to stop users from routinely running systems in admin mode.â¦
677767
SEATTLE/SAN FRANCISCO  - Computer hackers are off  and running trying to find vulnerabilities in Microsoft Corp.'s   new Windows Vista operating system, putting to test  the software maker's claim that it is the most secure Windows  program ever.
184446
Tycho:  I don't know whose fault it is exactly, mine or theirs, but I won't be installing Vista anytime soon.  I would like some crazy shit to happen when I minimize something don't get me wrong.  I want my windows to go Waja-wajow(!) is possible.  But if there's a great reason to "trade horses midstream" or whatever the going metaphor is I haven't discovered it.
268428
McAfee Executive Vice President Bill Kerrigan acknowledged that there had been glitches in the roll out.
581203
More anti-virus false alarm madness A dodgy anti-virus update from McAfee on Wednesday wrongly identified legitimate JavaScript files as a virus in the second such screw-up by a major security vendor in less than a week.â¦
97191
A Chinese security group has released sample code to exploit two new unpatched flaws in Microsoft Windows. The advisory comes in the week before Christmas, a time when many companies and home users are least prepared to deal with the problems.
408632
Microsoft denied Wednesday that its software had arbitrarily changed Windows Vista's update settings, saying that users were responsible for the modifications that generated claims of unauthorized patch installs.Reacting to reports that first surfaced last Friday, a program manager for Windows Update said today that an investigation had turned up no evidence the Oct. 9 security fixes had switched settings in Vista's AU (Automatic Updates)."From the customer logs that we received, we found that none of the updates released as part of the October security release have made any changes to users' AU settings," said Nate Clinton in a post to a company blog. "In fact, in the logs we reviewed, AU in all cases was set to 'install updates automatically' prior to the October security release."Vista allows users to turn off AU entirely, tell the operating system to check for but neither download or install any fixes, instruct the mechanism to download files but not install them; or accept all patches without any additional approval.The claims that AU settings had mysteriously reverted to the "install automatically" setting began to trickle into a message forum on the AeroXperience Web site soon after the release last Tuesday of six security updates. Several users said that AU downloaded and installed patches even though they had specifically instructed Vista not to do so.But unlike last month, when a Windows newsletter revealed that Microsoft had updated users' PCs contrary to their instructions, the newest charges were limited to AeroXperience members. No similar reports, for example, were posted to the Windows Update support newsgroup hosted by Microsoft. During September's brouhaha, that newsgroup was thick with messages about the stealth updating.Certain that AU had not run amok and changed its own settings, Clinton fingered users for the altered state of AU. "I want to stress that the Windows Update client does not change AU settings without users' consent. However, AU settings can be set or changed in the following scenarios," he said, and then listed five; all require the user to take action or accept one option from several offered."During the installation of Windows Vista, the user chooses one of the first two recommended options in the 'Out of Box Experience' and elects to get updates automatically from Windows," Clinton said was one possibility. Another: "The user chooses to opt in to Microsoft Update during the installation or the first run experience of another Microsoft application such as Office 2007."Earlier, a Microsoft spokeswoman had been more blunt. "It may be more a case of someone clicking to change their AU settings but not realizing /remembering doing so," she said Tuesday.Users on AeroXperience writing to the forum after Microsoft wrapped up its investigation accepted Clinton's explanation. "The disparity between the Windows Update control panel applet and the OOBE (Out of Box Experience) update settings page (when first running Windows Vista) seems to be what's causing the confusion," said a member identified as Bryant.Computerworld is an InfoWorld affiliate
611813
A tool has been posted online that can apparently crack Vista's activation process by applying brute force -- and lots of time -- to come up with valid product keys. But the author is now telling users it's wrong to use it.
88476
Two recently disclosed vulnerabilities that affect Internet Explorer 7 and Windows Vista could let hackers nab user data.
714146
According to security researchers, Windows Vista's speech-recognition feature is flawed and hackers could use it to remotely force a PC to execute commands.