Another big updates from Microsoft

Microsoft issues mammoth security update, biggest in five years
Fixes 28 flaws in Windows, Office, IE, ActiveX development tools and more

By Gregg Keizer
December 9, 2008 (Article from: Computerworld)

Microsoft Corp. today patched 28 vulnerabilities, nearly all of them marked "critical," in the biggest batch of fixes it has issued since it switched to a regular monthly update schedule more than five years ago.

Of the 28 bugs quashed today, Microsoft ranked 23 of them critical, the top rating in its four-step scoring system. Of the five others, three were judged to be "important," the next step down, and two were pegged as "moderate." The patches were issued in eight updates for Windows, Internet Explorer, Office, SharePoint, Windows Media, and the company's most popular development tools, Visual Basic and Visual Studio.

Researchers agreed that one of the Windows updates should be tops on everyone's to-do list. "There are a few that will stick out for a lot of people," said Andrew Storms, director of security operations at nCircle Network Security Inc. "The GDI is one."

MS08-071, which contains two separate vulnerabilities, both critical, updates the Graphics Device Interface (GDI), the core graphics rendering component of Windows. GDI has been repeatedly patched by Microsoft, most recently in September.

"This looks very similar to MS08-021," said Storms, referring to an April update that patched two other GDI bugs. Like that earlier fix, as well as the one in September, hackers could exploit the vulnerabilities by duping users into opening or viewing malicious Windows Metafile (WMF) images.

"[MS08-071] is something similar to what we saw with WMF files once before this year, and once last year, too," said Amol Sarwate, manager of Qualys Inc.'s vulnerability lab. "It's in the core kernel, it's always there, it's in all versions of Windows and the attack vector is pretty high." Like Storms, Sarwate put the update at the top of his list.

The long-running patch job on GDI will, said Storms, inevitably prompt some to ask whether Microsoft's vaunted Security Development Lifecycle (SDL) process, under which it scrutinizes code as its written for bugs, really works. "Is SDL functioning? I don't know," Storms admitted. "Without seeing the code analysis, it's difficult to presume it's not."

"Yes, I think that's a fair question," said Wolfgang Kandek, chief technology officer at Qualys. "But is it realistic to expect Microsoft to find everything? No, it's not."

Storms said the IE update, MS08-073, would be his next highest update priority, simply because of the number of vulnerabilities it fixes -- four, all critical -- and because of the dominance of Microsoft's browser. After that, it gets murkier. "GDI and IE are certainly top of the list, but beyond that it's a toss-up," he said. "It's going to be difficult for people in the trenches to understand what to go after the first and second."

Qualys' Sarwarte and Kandek, meanwhile, staked out MS08-070 as the second-most-interesting update among today's eight. "This is a far-reaching vulnerability," said Kandek, who noted that while end users won't be installing this update for Visual Basic, it can potentially affect anyone who browses the Internet with IE.

"Microsoft's telling developers that they need to update their development system and the Visual Basic runtimes, then notify users of the ActiveX controls that they've created," said Kandek, talking about the technology that provides IE with add-on functionality. "And again, all [hackers] have to do is just come up with a malicious Web site with vulnerable ActiveX controls."

The Visual Basic update patches a total of six bugs, all ranked critical.

Other bulletins include updates that patch Microsoft Word's file format (MS08-072, with a total of eight vulnerabilities), Microsoft Excel's file format (MS08-074, three vulnerabilities), Windows Media (MS08-076, two vulnerabilities), SharePoint (MS08-077, one bug) and Windows Search (MS08-075, which deals with two vulnerabilities).

Some caught the eye of researchers. "The reason why I'm expecting questions about whether SDL is working is because of MS08-076," said Storms, referring to the two-patch update for Windows Media. "Both those bugs are very similar to what we've seen before in other Microsoft products."

Eric Schultze, the chief technology officer at Shavlik Technologies LLC, agreed. "This is closely related to a security patch from last month -- MS08-068," said Schultze in an e-mail today. That bug, which Microsoft fixed in November, was in how the Server Message Block (SMB) protocol handled credentials when a user connected to an attacker's SMB server. At the time, Schultze and others claimed that the bug went back at least seven years.

"It's similar to the MS08-068 attack, but uses different communication mechanisms to log on to the computers," Schultze added. "Microsoft says that Windows Media Player doesn't play by the same rules as the operating system, and that's why this issue wasn't fixed in November. I'd get this one patched right away.

Storms, however, pointed to MS08-075, which patches Windows Search, the integrated desktop search function, in Windows Vista and Windows Server 2008. He found the update interesting, not so much because it only affects Microsoft's newest operating system, but because one of its two patches fixed a flaw in yet another protocol, this time "search-ms."

"There have been issues prior with protocol handlers in Windows," said Storms. "Why would Microsoft make it possible for a protocol handler to call my local file system? What's the validity of that?"

As Storms said, Microsoft has had to patch several protocol handler vulnerabilities in the last 13 months, starting with one in November 2007 in Windows XP and Server 2003 that the company argued for months was not its responsibility to fix.

This month's eight security updates can be downloaded and installed via the Microsoft Update and Windows Update services, as well as through Windows Server Update Services.

This must be one of busiest month before the X-mas break.
I've notice my Vista computer wanting me to install around 8 updates last night.

Does Microsoft's free AV will put cloud over the current AV Industry?

AVG Sees Uphill Battle for Microsoft in Its Launch of Free Anti-Virus Software

AVG Replies to Announcement of Competitor's Replication of Its Anti-Virus Software Offering

Last update: 9:22 a.m. EST Nov. 21, 2008
AMSTERDAM, Netherlands, Nov 21, 2008 /PRNewswire via COMTEX/ -- AVG, a global anti-virus and Internet security software provider with over 85 million users in 167 countries, today responded to Microsoft's announcement of a free anti-virus software product slated to appear in mid-2009.
AVG, which for eight years has offered free anti-virus software to users worldwide, noted the multiple challenges Microsoft faces in supporting a free anti-virus software product -- chief among them the enormous overhead costs it will incur for customer service and support issues, as well as for ongoing product management and upgrades.
Microsoft will also likely contend with a severe backlash from dissatisfied channel partners, whose margins and unit sales will be negatively impacted as a result of the free product offering, AVG believes.
"For over eight years, AVG has recognized and responded to the growing global threat of malware by offering a free and comprehensive tool to combat computer viruses, spyware, malware and online threats," said J.R. Smith, the company's CEO. "Microsoft is clearly following our lead, which will certainly help combat basic and less sophisticated threats. But the real threat in this scenario is to Microsoft's own profitability and channel partner relations."
AVG also highlighted the challenges facing Microsoft to keep pace with the growing proliferation of new and increasingly onerous online threats. Microsoft often relies on its monthly "patch Tuesday" updates to refresh its current anti-virus product, leaving computer users vulnerable to botnets and other malicious attacks. Importantly, the free Microsoft anti-virus software will have even less protective features than its current OneCare offering - further heightening computer users' vulnerability to fast-spreading viruses and other threats.
Statistics highlight the escalating problem. Computer infections from malware are increasing exponentially. AVG's in-house research team notes that 50,000 variants are being issued every day - further pointing up the need for real-time protection.
AVG's LinkScanner feature provides up-to-the-minute protection against the very latest threats. What's more, AVG's award-winning anti-virus products have long been recognized for providing maximum computer security and online protection with minimal resource strain.
From a global protection perspective, AVG has a strong presence in established and emerging markets. The company's strategic growth plan includes the introduction of several new native-language versions of its anti-virus programs in the coming weeks. Moreover, the company's worldwide user-support community -- with people and small businesses from 167 countries -- continues to grow as the industry's only truly "self-help" network.
"The exceptional ease of use and simplicity of AVG's products have long been a strong sell for the channel, providing more security strength and functionality at a much lower cost than Microsoft's anti-virus offerings," added Mr. Smith. "Given these tough economic times, our resellers appreciate the robust product margins we offer and the vitality of our end-user community to help drive future sales."

About AVG Technologies
AVG is a global security solutions leader protecting more than 85 million consumers and small business computer users in 167 countries from the ever-growing incidence of web threats, viruses, spam, cyber-scams and hackers on the Internet. Headquartered in Amsterdam, AVG has nearly two decades of experience in combating cyber crime and one of the most advanced laboratories for detecting, pre-empting and combating Web-borne threats from around the world. Its free online, downloadable software model allows entry-level users to gain basic anti-virus protection and then to easily and inexpensively upgrade to greater levels of safety and defense in both single and multi-user environments. Nearly 6,000 resellers, partners and distributors team with AVG globally including Amazon.com, CNET, Cisco, Ingram Micro, Play.com, Wal-Mart, and Yahoo!. More information is available at http://www.avg.com.
SOURCE AVG Technologies

http://www.avg.com

Just recently Microsoft announced that they will offer free AV for Windows users, and so does this mean everyone will use Microsoft's free Antivirus instead of paid Antivirus software?
The real question is why Microsoft is offering FREE AV? If Microsoft's AV was great Antivirus software would Microsoft give it away for FREE? Their Microsoft's Office is NOT FREE, because they know they can make profit. The bottom line is Microsoft's AV is simply not the worthy competitor in AV Industry.

Microsoft was trying to persuade Windows users to use their Antivirus program for years and failed miserably; very few customers out there will use Microsoft's OneCare as its rated one of worse performing AV.

Even AVG's free AV don't detect much as some of the paid Antivirus like Norton, McAfee, Trend Micro, Kaspersky etc.. These free AV users out there are NOT using AVG free AV or free Microsoft's AV because they want to use it but rather they have to, they wants FREE AV and don't want to pay for it. Average computer users know that AVG or Microsoft's AV is not good as others that they can buy from computer shops or Internet.

Freebie users often don't pay for other software that they are using, therefore having freebie users as main market is No good for the software company.

I remember the free Antispyware companies like Adaware and Search & Destroy; both companies are now selling their software; and they are not doing well on their sale because their initial offerings were FREE base software. Once a free, then it will have to be remain as FREE otherwise average computer users will not use them again. Why would you pay for second graded software where you can get the best available software on the market for same price?

These freebie users will use other free softwares when free versions ceased, simply means freebie users will always wants freebies. Going from freebie to pay versions is not a good marketing strategy.

If you don't make any profit then you are out of the business is fundamental law of the business

Microsoft dumps OneCare

Article: Microsoft scraps OneCare security suite

By Daniel Robinson
20 November 2008 06:10AM

Microsoft is to replace Windows Live OneCare with a free security service from the second half of 2009.
The company said that the replacement, codenamed Morro, will provide comprehensive protection from malware including viruses, spyware, rootkits and Trojans.

It will also be less demanding on system resources, making it suitable for low bandwidth connections or less powerful PCs.

Morro will be available as a download for users running XP, Vista and Windows 7. OneCare will continue to be available through retail for XP and Vista until 30 June 2009, and will be gradually phased out when Morro becomes available.

At the time of writing, Microsoft had not responded to inquiries regarding the reasons for dropping OneCare. Some commentators have speculated that the service has not been doing as well as the company had hoped, while others believe that Microsoft is trying to get a foothold in emerging markets.

"This new, no-cost offering will give us the ability to protect an even greater number of consumers, especially in markets where the growth of new PC purchases is outpaced only by the growth of malware," said Amy Barzdukas, senior director of product management for online services at Microsoft.

Other security vendors appeared unfazed by Microsoft's announcement, at least publicly.

AVG sees the move as a positive step in the anti-malware landscape, according to head of global communications Siobhan McDermott, who said that AVG did not feel threatened by Microsoft's entering the market.

"Our free product competes with most paid-for products from other vendors. We see no need to change our product at this time, based on what Microsoft has announced so far," she said.

Symantec warned that Morro would probably offer less protection than currently provided by OneCare.

"The security business is fundamentally different from any other market Microsoft plays in, and consumers are encouraged to consider how they will protect themselves, their identities and their families online," said Tom Powledge, vice president of Symantec's consumer business.

McAfee was even more scathing, suggesting in a statement that Microsoft was effectively exiting the security market because OneCare had failed.

"Microsoft has given up. They have now defaulted to a dressed-down freeware product that does not meet consumers' security needs. With more malware attacks than ever before, consumers require a trusted advisor and expert in security like McAfee," it said.

Copyright © 2008 vnunet.com

OneCare security suit have been scoring one of lowest detections from various independent virus samples testers. And despite the effort from MS marketing team, OneCare wasn't selling well; may be this made the decision to dump the OneCare.

MicroSoft's own detailed threats listing site!

Checkout MS's threat listing, wow are they going to be full Antivirus company?
http://www.microsoft.com/security/portal/

Microsoft's search excels in spreading malware

It seems Italian Gromozon is over taking MS live search site.
More reading from: http://www.theregister.co.uk/2007/03/20/windows_live_malware/

Some Microsoft & GM joke

At a recent computer expo (COMDEX), Bill Gates reportedly compared the computer industry with the auto industry and stated, "'If GM had kept up with technology like the computer industry has, we would all be driving $25.00 cars that got 1,000 miles to the gallon.'

In response to Bill's comments, General Motors issued a press release stating:

If GM had developed technology like Microsoft, we would all be driving cars with the following
characteristics (and I just love this part):

1. For no reason whatsoever, your car would crash........ Twice a day.

2. Every time they repainted the lines in the road, you would have to buy a new car.

3. Occasionally your car would die on the freeway for no reason. You would have to
pull to the side of the road, close all of the windows, shut off the car, restart it, and
reopen the windows before you could continue. For some reason you would simply
accept this.

4. Occasionally, executing a maneuver such as a left turn would cause your car to shut
down and refuse to restart, in which case you would have to reinstall the engine.

5. Macintosh would make a car that was powered by the sun, was reliable, five times
as fast and twice as easy to drive - but would run on only five percent of the roads.

6. The oil, water temperature, and alternator warning lights would all be replaced by
a single 'This Car Has Performed An Illegal Operation' warning light.

7. The airbag system would ask 'Are you sure?' before deploying.

8. Occasionally, for no reason whatsoever, your car would lock you out and refuse to
let you in until you simultaneously lifted the door handle, turned the key and grabbed
hold of the radio antenna.

9. Every time a new car was introduced car buyers would have to learn how to drive all
over again because none of the controls would operate in the same manner as the old car.

10. You'd have to press the 'Start' button to turn the engine OFF.

Funny Mr. Bill Gate's saying about Steve Job's new marketing campaign

Ha ha, I personally never met Bill & Steve, but I think they are bunch of hypocrites, just want to make $$$ by selling second/third grade products. They never improve their previous product, just keep on selling NEW PRODUCT !

They don't really care about people or this planet earth. They use cheap advertising campaign to fool us.

The fact is over 90% of desktop computers & notebooks come with pre-loaded MS Windows and god know's how many mobile phones will come with standard Windows OS. :(

In other hand, Mac OS probadly only covers less than 2% of world computers, and rest are covered by other non MS or Mac OS such as Linux.

Apple's Mac targets consumer & specialists, MS's Windows targets commercial & dumb pc users and both targets entertainment market, but truth is their products are not so good or nor specialize compare it to other companies anyway. :)

Product Quality & features & prices & marketshare:
----------------------------
Apple's ipod vs iRiver's player (& other 3rd party players)->(3rd party players beats Apple)
MS's Xbox vs Sony's PS2/3 ->(PS3 beats xbox)
Ms's Windows vs Apple's iMac -> (Windows beats iMac)
MS's Zune player VS ipod -> (ipod beats Zune)
Sony's PSP vs Nintendo portable -> (nintendo beats Sony)
Nokia vs Blackberry -> (Nokia beats Blackberry)
Toyota VS Ford -> (Toyota beats Ford)
so on on on .. blah blah blah...

Link: http://blogs.siliconvalley.com/gmsv/2007/02/quoted_1.html