Google Headhunting for Windows Security Guru

I wonder if Gord Mangione would be interested in this job listing from Google:

Google is looking for an enthusiastic individual that can live, breathe, and eat Windows security. If Windows security is what you love, then we would love to see your resume. This position is focus is in the Operations organization, but you will work with everyone in the company to bring good operating standards to Google.

Responsibilities:
* Design and implement security on the internal Windows infrastructure.

* Audit existing infrastructure and software to ensure proper setup, application of patches, and policy compliance.

* Evaluate security advisories for their impact to Google.

* Review designs for new Windows products and software implementations.

* Evangelize security within Google.

* Be a resource to Googlers regarding Windows security.

It sounds like Google is finally paying attention to security after this, this and this.

Responsible, Irresponsible

Take a look at this line from this security advisory issued this evening by Microsoft in response to today's today's zero-day exploit drama:

"This issue was originally publicly reported in May as being a stability issue that caused the browser to close."

That's essentially an admission from Microsoft that the vulnerability was reported six months ago but remains unpatched. Whenever I ask Microsoft about these old denial-of-service bugs, I'm always bothered by the flippant dismissal of these issues.

To paraphrase a typical Microsoft response: "All it does is close the browser. You open a new browser session and that's that. No vulnerability to see here."

Well, look what we have here. Someone figures out that it's not simply a denial-of-service flaw. In fact, it's a nasty code execution issue. Remember, this is something that Microsoft has known for six months. Isn't that more than enough time for Microsoft to figure this out themselves?

Hard to be sympathetic to Microsoft's pleas for responsible disclosure when their own actions here are incredibly irresponsible.

Safety Center Scans for Rootkits

Matthew Braverman: "The [Windows Live] Safety Center includes a frequently updated, on-demand virus scanner which you can use to scan your machine for such threats as worms, Trojans, backdoors, and some user-mode rootkits."

Windows Live Safety Center

As part of the Windows "Live" MSN-rename shindig today, a new (beta) service called Windows Live Safety Center also saw daylight. It is described as a free service designed to help ensure the health of your PC.

- Check for and remove viruses
- Learn about threats
- Improve your PC's performance
- Get rid of junk on your hard disk

Use the full service scan to check everything, or turn to the scanners and information in the service centers to meet your specific needs.

UPDATE: Just tried testing it and it won't work. Probably because there's no Firefox support. Blah.

MS Anti-Malware Bloggers

The Microsoft Anti-Malware Engineering Team has joined the blogosphere. This is the unit at Redmond responsible for building Microsoft's anti-virus and anti-spyware technology (along with anti-rootkit, anti-bot tools). The team regularly updates the malicious software removal tool and is working directly on the Windows AntiSpyware app.