Archive for OS Security
Author: Dave Lewis
March 27, 2008 at 12:57 pm · Filed under OS Security, Vulnerability
I can’t say that I’m overly surprised. I had loaded up a copy of 2008 that I received at Black Hat last year into a virtual machine. I poked around in it for a couple minutes and shut it down. I just didn’t have the stomach to deal with it at the time. Well, it appears that others had the intestinal fortitude that I was sorely lacking.
From eWeek:
Cesar Cerrudo, founder and CEO of Argeniss Information Security, in Parana, Argentina, says the weaknesses could lead to privilege escalation attacks opens the door for a skilled hacker to take complete control of the operating system.
“[We found] from design issues that were not identified by Microsoft engineers during the Security Development Lifecycle (SDL), and allows accounts commonly used by Windows services — NETWORK SERVICE and LOCAL SERVICE — to bypass new Windows services protection mechanisms and elevate privileges, Cerrudo explained.
He said the discovery also affects Internet Information Services 7 in the default configuration, allowing ASP.NET applications to “completely compromise” operating system security.
Cerrudo, a security researcher who is highly regarded for his work on database security, said the problem also afects Windows Vista, Windows XP and Windows 2003.
“On Windows XP and Windows 2003 the problem is especially severe since any Windows service, even when running under a low privileged account, can potentially break through the security protections and fully compromise the operating system. This includes all web applications deployed on Internet Information Services 6,” he added.
He’ll be releasing details of his fun with Windows at HITB 2008 Dubai.
Article Link
Author: Dave Lewis
December 10, 2007 at 4:46 pm · Filed under How To, OS Security
Apparently, Microsoft feels it necessary to provide a primer on why/how IT managers should upgrade to Vista. I guess this means that Vista must be worse on sales than was initially ballyhooed. Circling the bowl like Britney’s career?
The primer that I mention, entitled “How to Justify a Desktop Upgrade”, appears on a web page found on their Microsoft Canada website (via Slashdot) which says,
“The problems with positioning upgrades is that, from a user perspective, the changes may not seem significant. But from an administrative perspective, some of the security features are huge,” he said.
“So, as an IT person, who is responsible for the security of the company from viruses and for making sure that everyone is safe, there are many features in Windows Vista that I like. It does a great job of keeping people from being able to browse certain sites. It protects from viruses, because there are a lot more things that will get locked down, and the lock down tends to be tighter. You have a tougher time having things happen accidentally. Probably the biggest hassle from a security perspective [with past technologies] is that users tended to run as administrators. In Vista, that’s not the default anymore.”
OK, so this is a patch for XP then? Is that the rationale? The article goes on to outline how XP is more expensive to run than Vista. Hmm, hardware upgrades must have come down in price and I missed it (yes, I’m being sarcastic).
I love this closing line from the document:
“The increase in security – the inability for users to just simply install stuff, means that you are decreasing the amount of reactive tasks that an administrator has to perform,” said Johnson. “This allows him to become proactive in all things you want in your company.”
Wow, I guess it’s time to upgrade…yes, more sarcasm.
This just tells me that Linux/Mac are beating Microsoft’s brains into the floor. No great shock there. I can only hope that the folks in Redmond spend a little less time with their Google fixation and get down to brass tacks.
Article Link
In case the page mysteriously vanishes in the night here is a .pdf of the original.
Tags: Vista Failure, Microsoft Selling Vista, Vista vs XP
Author: Dave Lewis
November 24, 2007 at 8:20 pm · Filed under OS Security, Patches
Windows Vista has been underwhelming folks since in left the dock. This OS smells like a load of dead fish. OK, a touch much. I had decided to give it a fair shake. I have a computer running Vista in my lab and I have been forcing myself using it off and one now for months. I just can’t take it anymore. The security approach is nutty. Death by a thousand pop ups. And, to be honest I find Linux and Mac OS X far more user friendly.
That being said, the news isn’t any more positive for the SP1.
From PC World New Zealand:
Devil Mountain ran its DMS Clarity Studio framework on a laptop Barth described as a “barn burner” — dual-core processor, dedicated graphics, and either 1GB or 2GB of memory — to compare performance of the SP1 release candidate that Microsoft released last week with the RTM version that hit general distribution last January. The Vista RTM was not updated with any of the bug fixes, patches or performance packs that Microsoft has pushed through Windows Update since the operating system’s debut.
“One gigabyte, 2GB [of memory], it didn’t make a difference,” said Barth. “SP1 was never more than 1% or 2% faster.”
The difference between Vista RTM and SP1 on Devil Mountain’s Microsoft Office-based test script was “statistically insignificant,” Barth said, while a multitasking test panel produced results for SP1 less than 1% faster than RTM.
“Our goal wasn’t to bash Vista,” said Barth. “We’ve been doing this for a while, we know how to do it, and we tried to be as clinical as possible. But SP1 is not going to be a panacea for any performance problems users have with Vista. If you’ve been disappointed with the performance of Windows Vista, you’re not going to be any happier with SP1.”
May not have been the goal. But, it was always a possible outcome. Bad luck that.
Article Link
Tags: Windows Vista SP1, Vista SP1
Author: Dave Lewis
November 22, 2007 at 11:42 am · Filed under OS Security
Microsoft came clean on the random number bug for XP.
It’s in there.
From ComputerWorld:
As recently as last Friday, Microsoft hedged in answering questions about whether XP and Vista could be attacked in the same way, saying only that later versions of Windows “contain various changes and enhancements to the random number generator.” Yesterday, however, Microsoft responded to further questions and acknowledged that Windows XP is vulnerable to the complex attack that Pinkas, Gutterman and Dorrendorf laid out in their paper, which was published earlier this month.
Windows Vista, Windows Server 2003 and the not-yet-released Windows Server 2008, however, apparently use a modified or different random number generator; Microsoft said they were immune to the attack strategy.
In addition, Microsoft said Windows XP Service Pack 3 (SP3), a major update expected sometime in the first half of 2008, includes fixes that address the random number generator problem.
So is Vista immune? I realize that Microsoft claims that it is but, last week they said XP was immune to it. Are we going to see another stealthy patch roll out? Ah yes, SP3. Right.
Article Link
Tags: Random Number Bug, Windows XP Random Number Bug, Random Number Generator Bug
Author: Dave Lewis
October 23, 2007 at 3:34 pm · Filed under OS Security
In a few days Apple will release their latest iteration of the Mac OS X. The latest version, Leopard, will have some changes to the way Mac users do things. There are some great apps that have been added in like Time Machine.
Here is a summary of the security features such as Time Machine in the new Apple OS X.
From TidBITS.com:
With the release last week of the feature list for Mac OS X 10.5 Leopard, the security world is buzzing about some extremely important updates that should, if they work as expected, significantly improve Mac security and will make me less nervous about connecting to wireless networks in Internet cafes.
Time Machine — Before we dig into Leopard’s advanced anti-exploitation technologies, we need to start with the biggest security feature that’s not listed with the rest: Time Machine. Information security is based on the principles of CIA. No, not the Central Intelligence Agency or the Culinary Institute of America. In the security world, CIA stands for Confidentiality, Integrity, and Availability. While we tend to focus on keeping people from seeing things we don’t want them to see (confidentiality) and changing things we don’t want changed (integrity), having our data and systems available to us is just as important.
A very nice run down of the upcoming features for the release available this Friday.
Read on.
Article Link
Tags: Apple Security, Mac OS X Security, Leopard Security
Author: Dave Lewis
September 13, 2007 at 9:39 am · Filed under OS Security, Patches
From Adrian Kingsley-Huges blog over on ZDNet:
I can now confirm that the stealth Windows Update that I blogged about yesterday actually exists - because I’ve detected its presence on a machine at the PC Doc HQ.
At the PC Doc HQ we have several systems set not to update. This is so that they are kept at a specific patch level for testing duties. Many of these systems are virtual machines but some are physical. When I heard about this stealth update I decided to take a look at one of these systems that don’t update automatically - and within seconds I found what I was looking for.
Wow, this is truly sucktastic. I have seen apps go completely sideways after some Microsoft patches were applied. Now, factor in this “stealth” update function. Now ponder those systems in your production environment.
Not cool.
For the full posting read on.
Article Link
Tags: Windows Updates, Windows Stealth Updates, Stealth Updates
Author: Dave Lewis
September 7, 2007 at 10:01 am · Filed under OS Security
The September advance bulletin for Microsoft’s Patch Tuesday is out. It falls on September 11th this year.
Quick highlights:
1 Critical (remote code execution)
4 Important (2 remote code execution, 2 elev priv)
Affected Software:
Windows (critical)
Visual Studio (important)
Windows Services for UNIX (important)
MSN Messenger (important)
Windows, SharePoint Server (important)
Article Link
Tags: Patch Tuesday, September 11, Microsoft September Patch Release
Author: Dave Lewis
August 14, 2007 at 4:17 pm · Filed under OS Security
Well, the Microsoft patches for August are out and there are 6 critical and 3 important.
Critical:
- MS07-042: Vulnerability in Microsoft XML Core Services Could Allow Remote Code Execution (936227)
- MS07-043: Vulnerability in OLE Automation Could Allow Remote Code Execution (921503)
- MS07-044: Vulnerability in Microsoft Excel Could Allow Remote Code Execution (940965)
- MS07-045: Cumulative Security Update for Internet Explorer (937143)
- MS07-046: Vulnerability in GDI Could Allow Remote Code Execution (938829)
- MS07-050: Vulnerability in Vector Markup Language Could Allow Remote Code Execution (938127)
Important:
- MS07-047: Vulnerability in Windows Media Player Could Allow Remote Code Execution (936782)
- MS07-048: Vulnerabilities in Windows Gadgets Could Allow Remote Code Execution (938123)
- MS07-049: Vulnerability in Virtual PC and Virtual Server Could Allow Elevation of Privilege (937986)
The overarching catch phrase here…remote code execution.
Tags: MS07-042, MS07-043, MS07-044, MS07-045, MS07-046, MS07-047, MS07-048, MS07-049, MS07-050
Author: Dave Lewis
August 10, 2007 at 12:57 pm · Filed under OS Security
From MSRC:
Next Tuesday, we’re currently planning to release nine security bulletins:
- Six Microsoft Security Bulletins affecting Microsoft Windows with a Maximum Severity rating of Critical. These updates will require a restart and will be detectable using the Microsoft Baseline Security Analyzer and the Enterprise Scan Tool.
- One Microsoft Security Bulletins affecting Microsoft Office with a Maximum Severity rating of Critical. These updates will not require a restart and will be detectable using the Microsoft Baseline Security Analyzer.
- One Microsoft Security Bulletin affecting Microsoft Office and Microsoft Windows a Maximum Severity rating of Critical. This update will require a restart and will be detectable using the Microsoft Baseline Security Analyzer.
- One Microsoft Security Bulletin affecting Microsoft Virtual PC and Microsoft Virtual Server with a Maximum Severity rating of Important. This update will require a restart and will be detectable using the Microsoft Baseline Security Analyzer and the Enterprise Scan Tool.
Article Link
Tags: Microsoft Patch Tuesday, Microsoft Advance Notice, Patch Tuesday
Next entries »
Explore
Security Bloggers Network
