Two-way Vista Firewall

Ed Bott has the skinny on the fact that Windows Vista will feature a two-way firewall.

Rotten Apple

Microsoft security guru Michael Howard thinks that Apple's just-released QuickTime update presents one of those OMFG, APPLY THE PATCH!! scenarios. On the heels of the recent problems with these kinds of image-parsing bugs, he might be right.

It's somewhat amusing, in a sad way, that Apple chose to sneak out the QuickTime update on Microsoft's patch day. I've already written about this tactic, which has its pros and cons. Someone just mentioned to me that the QuickTime patch coincided with the MacWorld festivities, when everyone was looking the other way.

Zero Day Alive and Well

Long before the release of Microsoft's patch for the Web fonts flaw, researcher Piotr Bania had already started working on a blow-by-blow description of the vulnerability. More proof that the zero day is very much alive, and even more dangerous.

* Via Daily Dave.

The Win2K SP3 Dilemma

If you are like a certain West Coast city government (I'm withholding the identity to avoid placing them at risk of targeted attacks) and you haven't migrated yet from Windows 2000 SP3 because of app compatibility problems, you'll have to fork out upwards of $200,000 to get custom support and, by extension, a patch for the WMF vulnerability.

Microsoft likes to slickly say that they'll continue to provide patches for Windows 2000 but that's not entirely true. Patches are only available for Windows 2000 SP4. Joris Evers mentions some others in a blog entry but still misses the fact that Windows 2000 SP3 users are also left out in the cold.

That's why I recently asked if Microsoft would tell us how many Zotob infections occured on Windows 2000 SP3. I suspect the answer is startling.

UPDATE: Paul Roberts finds Microsoft playing word games with severity ratings and older OS versions.

Hi, I'm Mike Nash

And I approve this message:

"With the update available today, you certainly have the choice of deploying now or waiting until your normal release process. If it were my decision, I would move up the schedule. That is what we are doing in our IT operation here at Microsoft."

The Problem With Ilfak's Patch

I see that third-party distribution of the third-party WMF patch has started. How soon before a fake malicious version of this 'patch' gets into the ecosystem? Sigh.

Fearmongering Redux

The SANS Internet Storm Center is conducting a poll on the impact of the WMF exploit. 80% of the 1142 respondents said they had not seen an exploit. Yet, if you read the nonstop diary entries, you'd think we're seeing a blended Blaster/Slammer/Sasser attack.

* Very uncharacteristic.

WMF Risk Management

This man should be writing the MSRC security bulletins. Seriously.

Fearmongering

Matthew Murphy on why talking heads with doom-n-gloom soundbites are the people you should most avoid.

Here's a beauty from the oft-quoted privacy/security expert Richard Smith:

"We could see the mother of all worms here. My big fear is we’re going to wake up in the next week or two and have people warning users not to read their e-mail because something is going around that’s extremely virulent."

Racing Against the (WMF) Clock

The last time Microsoft was notified of a remote code execution bug in the rendering of WMF (Windows Metafile) images, it took 7+ months before a patch was made available.

At the time, the MSRC's Stephen Toulouse explained the lengthy delay:

"The graphics rendering system is an extremely important component of the operating system. It's critical to functioning of operating system. Any time you make a change to such an important component, you absolutely have to ensure you're not introducing new problems."

I can't imagine the MSRC having that kind of luxury this time around.

Most Vulnerable OS

According to US-CERT statistics, the operating system with the most vulnerabilities in 2005 was not Windows.

98% Unsafe

Bruce Schneier: "Internet Explorer sucks."

MSRT vs Hacker Defender

holy_father, the creator of the Hacker Defender rootkit, claims the MSRT (Microsoft Software Removal Tool) cannot successfully detect newer versions of the offensive rootkit:

"Microsoft claims that Windows Malicious Software Removal Tool for XP/2000/2003 (MSRT) can detect Hacker Defender. I always test the latest MSRT with Hacker Defender, and the latest MSRT does not even detect the latest public version of Hacker Defender (hxdef 1.0.0 revisited), which was published weeks ago and is available for download to everyone, with full source code."

Home Office Security Checklist

Here's an excellent home office security checklist from Microsoft that's worth sharing with everyone you know.

When Silent Fixes Backfire

On the SecuriTeam Blog, Matthew Murphy provides an extreme example of why it's important for software vendors like Microsoft to be totally transparent about the way security vulnerabilities are handled and fixed.

He explains how a security bug in a Visual Studio was reported to Microsoft in 2002 but remained unfixed for a long time. Eventually, Micosoft silently fixed the flaw but declined to provide information on the fix to customers or partners. That caused anti-virus vendor Trend Micro to unwittingly use the vulnerable code in its products, putting its customers at risk of code execution attacks.

Trend Micro, at the end of 2005, claims it has "recently become aware" of the flaw which Murphy says he reported to Microsoft in July 2002.

The lesson:

"While this is an extreme example, it goes to show just how important information is in shaping response. Security fixes cannot simply be made and forgotten: they need effective distribution and uptake to have real-world impact. It wasn't the lack of a fix, but poor distribution and uptake of a security patch that enabled Blaster to infect 25 million Windows PCs, and bring entire networks to their knees. And… what better way is there to cripple uptake rates than to simply not inform users of the availability of a fix?

We can only hope Microsoft has learned its lesson... if approaches like this remain the norm there, we’re going to be dealing with more viruses, more sleepless nights, and more pounding headaches for quite a while before they ever get it right."

Password Strength Guidance Redux

Microsoft's Stephen Toulouse corrects my inference that the company's guidance on passwords is conflicting and offers some thoughts of his own on the issue:

"No one should be saying "always write your passwords down", just as no one should be saying "never write your passwords down" because there is no absolute guidance for all users on that point. You have to pick what works for you, balancing the risks in creating complex passwords. If you have no need to keep a password system in your head, then it makes sense to write things down if that's the only way you can do complexity. Just be aware that while you are reducing your risk of a single password being cracked and compromising everything, you are increasing your risk that anyone who finds the paper (or papers if you are smart) has the complete keys to the kingdom. If you take careful enough precautions with the paper then on the balance writing it down can carry less risk because of the gain in randomness and complexity."

On a related note, I don't think Microsoft's password strength checker is working properly. It's telling me that passphrases of more then 50 characters are 'weak' passwords.

Protect Your PC Pledge

Microsoft has started a "Protect Your PC in 2006" pledge as a "fun, informal way to get more people actively thinking about online security without getting intimidated."

URL Typo-Squatting Data

Here is the raw data from Microsoft Research on the URL typo-squatting scheme that Google continues to deftly ignore.

Jesper's Other PC

I snapped this shot of Jesper Johansson's laptop cover at Microsoft's Security Summit East in Washington, DC.

Zotob and Windows 2000

I wonder if Microsoft knows (and if they do, if they'd tell us) how many Zotob infections occured on Windows 2000 SP3.