SleepyEgg

Tech News, Deals, & Games

  • Increase font size
  • Default font size
  • Decrease font size
Home News Microsoft

Microsoft

0-day exploits for IE flaw another reason to switch to IE 8

E-mail Print PDF

Microsoft confirmed on Tuesday a new flaw affecting version 6 and 7 of its Internet Explorer web browser that could allow remote code execution. The security advisory noted that targeted attacks using the flaw were already in the wild.

This information was confirmed by McAfee, reporting that exploitation of the flaw was originating from the domain topix21century dot com over both HTTP and HTTPS. The drive-by attacks install a backdoor which connects to a command-and-control server.

Analysis by Symantec reveals that the exploit works effectively on IE 6. IE 7 tended to crash instead, and IE 8 is, as stated in the Microsoft advisory, immune. The attack loads some malicious code, and then makes repeated changes to the HTML document eventually provoking execution of the malicious code.

The best solution is to upgrade to IE 8, as one of the many improvements found in this browser also seals off the security hole. Failing that, enabling Data Execution Prevention in IE 7 should provide some level of mitigation, as the current exploits do not circumvent DEP (though they could probably be combined with DEP bypass techniques). Removing access to the file iepeers.dll using either of the mechanisms described in Microsoft's advisory prevents Internet Explorer from loading the flawed code, but may also break print and web folder functionality. Finally, disabling of scripting and ActiveX in the Internet and Local Intranet security zones should also provide protection against exploitation.

Microsoft has still made no indication whether this flaw will receive an out-of-band update, but with exploits in the wild and documented analysis of the exploit, clearly this flaw is something that needs fixing, and soon.

Read the comments on this post


Full Article
 

CodePlex refresh, FOSS projects more compatible with Windows

E-mail Print PDF

The CodePlex Foundation has announced the arrival of several new board members, including Jim Jagielski, the Chief Open Source Officer of SpringSource. Jagielski, who was one of the original cofounders of the Apache Software Foundation (ASF), brings a lot of credibility and leadership experience to the CodePlex Foundation.

When the CodePlex Foundation was established by Microsoft last year, an interim board of directors was assembled to help get the organization off the ground while permanent board members were being chosen. A number of the interim board members, including Novell's Mono project leader Miguel de Icaza, will be turning their seats over to new representatives. Former Microsoft open source evangelist Sam Ramji, currently VP of strategy at Sonoa, will be remaining on the board, along with Microsoft .NET Framework program manager Davies Boesch.


Full Article
 

Microsoft browser ballot gives Opera, Firefox a boost

E-mail Print PDF

The Microsoft browser ballot released this month to Windows users in the EU is already doing Microsoft's rivals a favor. Two of the major competitors to Internet Explorer have seen an increase in downloads, while the other two are not willing to share data. We contacted the makers of Firefox, Chrome, Safari, and Opera; here's what they had to say.

Opera, the Norwegian browser maker that first filed a complaint with the European Union in December 2007, accusing Microsoft of violating EU antitrust law by bundling IE with Windows, is pleased with the progress its browser is making. "Since the browser choice screen rollout, Opera downloads have more than tripled in major European countries, such as Belgium, France, Spain, Poland, and the UK," an Opera spokesperson told Ars. The company said it currently did not have more detailed numbers but plans on sharing more as they become available.

Mozilla, which has a particularly solid foothold in Europe, was slightly more specific in the progress it was seeing with its browser downloads. "Early data suggests 50,000 to 100,000 new users chose Firefox as a direct result of seeing the Ballot Choice screen," a Mozilla spokesperson told Ars. "We expect these numbers will increase as the Ballot Choice rolls out in additional countries and will share updated metrics as they become available."

Apple did not respond at all, and while Google was happy to respond, the company wouldn't get specific: "We generally don't share download stats on that granular of a level," a Google spokesperson told Ars. The company did not respond to a follow-up question if Chrome saw an increase in number of downloads period. While Apple and Google haven't said much, we think it's likely that both have also seen a bump in the number of downloads of their browsers. Hundreds of thousands of users who may not have known of a world outside of Internet Explorer are being confronted with the alternatives.

The browser ballot will be presented on Windows computers across the EU for at least the next five years. Microsoft's rivals are, however, already pushing to have it appear outside of Europe as well.

Read the comments on this post


Full Article
 

Microsoft begins rolling out redesigned MSN homepage

E-mail Print PDF

Microsoft today began rolling out its new MSN homepage, but not everyone will be getting it at once: the update will trickle out over the next few weeks to the site's 100 million US customers. The software giant is touting the new version as "its most significant homepage redesign in over a decade." It comes with a new MSN butterfly logo (which complements the Bing logo), a larger Bing search box and tighter integration with the search engine, local information from a new feature dubbed MSN Local Edition, as well as the addition of three social network streams: the Windows Live "What's New" feed of course, Facebook, and Twitter.

The above was previewed in November, but Microsoft says the redesign includes more than 30 updates that are based on 70,000 pieces of customer feedback. These new features include TrendWatch, which highlights the day's top trends and movers on Twitter, Hyper-local Tweets, which uses Bing to highlight tweets from your location (available on the new Local Edition), and My Cities, which allows you save up to three cities to keep up with your friends or family across the entire country in your MSN Local Edition.

Microsoft says it has seen double-digit increases in Bing search queries coming from the new homepage thanks to changes that make the decision engine more prominent. As for the MSN Local module on the homepage, the software giant says it is driving over 50 percent more traffic to the MSN Local Edition and that the main module on the new homepage also received over 50 percent more clicks than the original homepage. Microsoft made improvements to these sections based on the data it was seeing. For example, the company says the social networking additions were welcomed with open arms, so it has made sure the default social network tab is the one that the user frequents the most.

The real test, not only for the servers but for the designers, will come in the next few weeks as the majority of users start to see the new version. As we've said before, we think the new look is much cleaner than the old version, but—as Facebook knows all too well—users aren't always happy with huge revamps of major websites.

Read the comments on this post


Full Article
 

Microsoft kills off mid-market Essential Business Server

E-mail Print PDF

Microsoft's mid-market server bundle, Essential Business Server, is being discontinued, with no further development after June 30. EBS shipped in November 2008, aimed at organizations with up to 250-300 desktops. The bundle includes a range of Microsoft server products, including Windows Server 2008, Exchange Server 2007, Forefront Security, and ISA Server. The discontinuation was announced on the EBS blog.

Redmond's Small Business Server product, aimed at companies with fewer than 75 desktops, has been a significant and popular part of its server software line-up for many years. The company hoped to replicate this small business success with EBS, but after just 16 months has chosen to terminate the package, citing changes in the demands made by the mid-size companies and a desire to streamline its product lineup. The growth of virtualization in this market means that corporate needs are better met by other products in the lineup.

An EBS R2 release, updated to include Windows Server 2008 R2 and other technology, was originally expected in the second half of this year. With this announcement, that's no longer going to happen. Instead, existing customers will be able to replace EBS with the equivalent standalone software for a six-month period from July 1 through to the end of the year. EBS itself will continue to be supported for a further five years.

This decision will not have any impact on SBS; an update to that package is expected later this year.

Read the comments on this post


Full Article
 

Week in Microsoft: browser ballot arrives, to go global?

E-mail Print PDF

Let's look back at the week that was in Microsoft news. Here were the top stories:

Coding error leads to uneven EU browser ballot distribution: The distribution of browser choices on the EU browser ballot released this month to Windows users is uneven. Internet Explorer shows up in the right-most position 50 percent of the time for current IE users, an outcome that's due to Microsoft attempting to shuffle the browsers using JavaScript's sort function.

Microsoft rivals push to send browser ballot on world tour: The lobbying group European Committee for Interoperable Systems (ECIS), which is composed of many Microsoft rivals including Opera, is urging the rest of the world to push Microsoft into offering the browser ballot screen.


Full Article
 

Horizontal scrollbar prompts EU gripe from 6 browser makers

E-mail Print PDF

With Microsoft's EU-appeasing browser ballot rolling out across Europe over the next three months, dissatisfaction is growing with its implementation. Last week, flaws in its randomization emerged—a result of ineptitude rather than malice. Today, six Web browsers have petitioned the EU to complain about the overall design of the browser ballot. They argue that the ballot fails to do what it is supposed to: provide European consumers with "information on the 12 most widely-used web browsers."

The complaint stems from the way the ballot is designed. The ballot lists the 12 browsers with the highest market share. The top five browsers—Microsoft's Internet Explorer, Google's Chrome, Apple's Safari, Mozilla's Firefox, and Opera—are immediately visible in the ballot. The next seven—AvantBrowser, Flock, K-Meleon, GreenBrowser, Maxthon, Sleipnir, and SlimBrowser—are only visible on scrolling to the right with a horizontal scroll bar. It is this design that is deemed inadequate. The complaint, signed by six of the seven secondary browsers (the exception, K-Meleon, was excluded due to an inability by the other six to find anyone to contact to represent that browser) argues that this horizontal scrollbar is inadequate—an overwhelming majority of people won't notice it or use it.


Full Article
 

Microsoft Patch Tuesday for March 2010: two bulletins

E-mail Print PDF

According to the Microsoft Security Response Center, Microsoft will issue two Security Bulletins addressing eight vulnerabilities on Tuesday, and it will host a webcast to address customer questions about the bulletins the following day (March 10 at 11:00 am PST, if you're interested). Both of the vulnerabilities are rated "Important" and both may require a restart.

The list of affected operating systems includes Windows XP (x86 and x64), Windows Vista (x86 and x64), and Windows 7 (x86 and x64). In terms of the Microsoft Office suites, all supported versions are affected on both Windows and Mac OS X.

Compared to last month's whopper of a Patch Tuesday, this one is quite a small one, especially given that there are no "Critical" patches coming. The exact breakdown of the bulletins is as follows:

  • Bulletin 1: Important (Remote Code Execution), Windows
  • Bulletin 2: Important (Remote Code Execution), Office

If you're wondering, the IE/Windows Help vulnerability we reported on earlier this week is not yet ready to be patched. There are no known attacks, but Microsoft is still encouraging customers to review the advisory and apply the suggested workarounds where possible. Customers that are running Windows Vista, Windows Server 2008, Windows 7, or Windows Server 2008 R2 are not affected.

Along with these patches, Microsoft is also planning to release the following on Patch Tuesday:

  • One or more nonsecurity, high-priority updates on Windows Update (WU) and Windows Server Update Services (WSUS)
  • One or more nonsecurity, high-priority updates on Microsoft Update (MU) and WSUS
  • An updated version of the Microsoft Windows Malicious Software Removal Tool on Windows Update, Microsoft Update, Windows Server Update Services, and the Microsoft Download Center

This information is subject to change by Patch Tuesday; Microsoft has been known to rush patches as well as pull them if it deems it necessary.

Read the comments on this post


Full Article
 

Microsoft open-sources clever U-Prove identity framework

E-mail Print PDF

More and more personal, private information is being used and stored online than ever before, and at the same time, attacks on that information are increasing in frequency and sophistication. Phishing is a growth industry—it's very profitable to trick people into handing over names, passwords, credit card numbers, and so on, so that their finances can be pillaged. Important activities like banking and filing tax returns are being performed, and these need strong proof of identity. On the other hand, there's no reason why a storefront like, say, iTunes, needs to know your identity; it only needs to know that the money being handed over is yours to hand over. 

Ultimately, we want to be able to securely make transactions without giving third parties the ability to masquerade as us; we want to be able to visit websites and make purchases without those sites being able to track us or combine different pieces of information to draw a more complete picture of us; we want to be able to be able to disclose some information about ourselves, but not everything. The U-Prove framework, released as a CTP today by Microsoft, aims to solve these problems.


Full Article
 
  • «
  •  Start 
  •  Prev 
  •  1 
  •  2 
  •  3 
  •  4 
  •  5 
  •  6 
  •  7 
  •  8 
  •  9 
  •  10 
  •  Next 
  •  End 
  • »


Page 1 of 30

Polls

Which is your favorite Game Console?
 

Login

               No account yet?