Microsoft
Out-of-band patch pushed for ASP.NET encryption flaw
Written by Akuma Tuesday, 28 September 2010 15:51
Microsoft has today published a set of patches for a security flaw in all versions of ASP.NET. The flaw, given an "important" rating by the company, allows information disclosure from any ASP.NET site that used cryptography in certain ways. In practice, almost all ASP.NET sites are impacted by the problem, as a range of built-in features use the affected code.
Initially, the fixes must be manually downloaded and installed. It will be published to Windows Update and Windows Server Update Services within a few days. Though not being pushed out on the normal Patch Tuesday schedule, the fix is fully tested and production-quality. With the fix deployed, the workarounds described in the advisory are no longer required.
ASP.NET is not the only software susceptible to the flaw. Apache MyFaces, for example, has the same issue, as do certain CAPTCHA systems. Frameworks such as Ruby On Rails also include functions vulnerable to the same design flaw, though typically are not themselves flawed. The reason that the flaw isn't restricted to ASP.NET is that it's a design fault concerning how the programs use encryption, and both MyFaces and ASP.NET make the same mistake.
The impact of the issue will vary depending on how software uses the encryption-dependent features. ASP.NET is unusually vulnerable, as it makes particularly extensive use of encrypted data. The attack can be used to retrieve any file from a server running ASP.NET, including files containing essential configuration data. The information disclosed can in turn be used for privilege escalation, as shown in this attack against DotNetNuke. Other systems may be vulnerable to a similar attack but with less catastrophic consequences.
In essence, the flaw allows attackers to figure out how to decrypt information that they shouldn't be able to decrypt, by examining error messages sent by the server. Encryption algorithms generally require their inputs to be multiples of eight or 16 bytes long; to reach the right length, messages are padded with extra data. The attackers send specially manipulated encrypted data to the server, and the server's error messages allow the attackers to distinguish between data that was properly padded and data that was not, which in turn leaks information about the real (non-padding) data. Ultimately, attackers can decrypt data used by the application and, subject to certain constraints, encrypt data of their own choosing.
In cryptographic terms, any system that can tell an attacker some fact about a piece of encrypted data is named an "oracle." Since this oracle tells attackers about the validity of data used to pad encrypted messages, the attack has been dubbed a "padding oracle attack" by the researchers who devised it.
What is surprising about this attack is that isn't especially new. The attack method itself was largely described in 2002, as was a mechanism to subvert the attack and silence the oracle. Application of the attack to common online systems was demonstrated in April of this year at Black Hat Europe, and again in August at USENIX WOOT.
However, it wasn't until the ekoparty security conference two weeks ago that anyone appeared to take real notice of the attack's impact, especially against ASP.NET applications. Vulnerabilities were duly recorded and Microsoft began work on producing the patch that was published today.
Read the comments on this post
Microsoft may be turning a new page in dropping Live Spaces
Written by Akuma Tuesday, 28 September 2010 06:35
Since 2004, Microsoft has had a free blogging-cum-social networking platform it called Windows Live Spaces (née MSN Spaces). Though it attracted a few users, it never gained a huge amount of traction in the market, and lacked the range of features found in more mainstream blogging platforms. So it's perhaps unsurprising that Microsoft is killing off Live Spaces.
What is surprising is what Microsoft is replacing it with. Try to create a Live Space blog now, and you'll be directed to WordPress.com, the hosted blogging service powered by the WordPress blog software. For its part, WordPress now includes some additional features to make it a suitable slot-in replacement for Live Spaces; old Spaces can now be imported into WordPress.com blogs, and WordPress.com blog updates can be published via Messenger Connect.
Feature: The eternal antitrust case: Microsoft versus the world
Written by Akuma Sunday, 26 September 2010 18:00
"The worst thing that could come of this is I could fall down the steps of the FTC building, hit my head and kill myself," quipped Microsoft Chairman William H. Gates in 1992, as the Federal Trade Commission launched an investigation of his company. But nobody joked on the third day of April, 2000, as Judge Thomas Penfield Jackson delivered his decision on what had morphed into the biggest software antitrust case in history: The United States of America vs. Microsoft.
"The court concludes that Microsoft maintained its monopoly power by anticompetitive means and attempted to monopolize the Web browser market," Jackson declared.
Ten years ago, on September 26, 2000, that trial took a crucial turn towards the settlement that would allow Microsoft to retain its vast control over the personal computer operating system market. Let's revisit the essentials of that case, and follow the aftermath—a legacy of endless negotiation and struggle with the entity that, to this day, is the OS on 91.32 percent of the world's PCs.
Week in Microsoft: HomeGroup's domestic bliss, no free ride on Android
Written by Akuma Saturday, 25 September 2010 09:00
Here's the week that was in the world of Microsoft.
HomeGroup: A practical guide to domestic bliss with Windows 7: Microsoft has been trying to give Windows home users a convenient, peer-to-peer networking solution since at least 2002. With Windows 7 HomeGroup, they finally got it right. Ars walks you through HomeGroup's functionality, architecture, and history.
Microsoft says patent-infringing Android isn't really free : Microsoft has verbally attacked Google again, this time saying that Android should not be called free given all the legal issues it is attracting.
Is that Bill Gates staring back at you from Outlook 2010?
Written by Akuma Friday, 24 September 2010 16:05
One of the new things in Outlook 2010 is the "People Pane." At the bottom of e-mail windows (both the inbox view and individual messages), the People Pane is a panel that can show recent e-mail from a contact, any appointments that you have with them, and a few other bits and pieces of information.
It's a neat little feature, especially when used in tandem with the Outlook Social Connector (part of Outlook 2010, and available as a download for Outlook 2003 and Outlook 2007). Making the Outlook Social Connector work is not quite as convenient as it should be; actual connections to social networking sites use providers that have to be installed separately—on its own, the OSC doesn't really do anything. But once you have the providers installed, the People Pane can show even more information—LinkedIn status updates, new photos posted to Facebook, that kind of thing.
The People Pane in actionOne of the things the People Pane does is to show a little picture of your contacts. Outlook contacts can have pictures added to them, though I suspect most people don't bother. One place they do bother adding contacts to is their social networking profiles, and the People Pane will, with the OSC, retrieve profile pictures from Facebook and the other social networking sites it connects to.
But of course, not every person will have a picture available. So the People Pane has a fallback picture. A default, for when it can't find a better picture to display. The default is just a silhouette:
That isn't just anyone's silhouette, however. Our eagle-eyed editor-in-chief, Ken Fisher, noticed that the silhouette has a striking resemblance to one William H. Gates III. Quite how he noticed this is anybody's guess—we suspect he has a framed picture of the Microsoft founder and philanthropist mounted on his wall.
And it's not just any old picture of Bill Gates that some cheeky Outlook developer has used. Oh no. It's a picture from one of the man's finest moments. It's the picture taken in Albuquerque, New Mexico, way back in 1977, when he was arrested for a driving offense, the exact nature of which is lost to the sands of time. It's the man's mug-shot.
There you have it: irrefutable scientific proof.
Microsoft reverses course: IE9 won't require Windows 7 SP1
Written by Akuma Friday, 24 September 2010 11:33
Yesterday we reported that Internet Explorer 9 on Windows 7 would have Service Pack 1, due in the first half of next year, as a prerequisite—a surprising move, given that companies are often cautious about rolling out new service packs. Microsoft has now changed its public position: Service Pack 1 won't be required to run the new browser.
When Microsoft releases Internet Explorer 9, will it require Windows 7 Service Pack 1?
No. Internet Explorer 9 will install on systems that have either Windows 7 RTM or Windows 7 with Service Pack 1 (SP1) installed.
Today's new answer
Internet Explorer 9 will require a number of patches before it can run; Microsoft has made many fixes to the Direct2D and Media Foundation APIs that the new browser heavily depends on. These fixes will be incorporated into Service Pack 1. However, standalone updates are also available, and the browser will install these if necessary.
This process should be familiar to anyone who has used the Platform Previews or the beta; those install the hotfixes if necessary.
When Microsoft releases Internet Explorer 9, will it require Windows 7 Service Pack 1?
Yes. Internet Explorer 9 will require Windows 7 Service Pack 1 (SP1). Therefore, organizations must plan, pilot, and deploy Internet Explorer 9 as part of or after a Windows 7 SP1 deployment.
Yesterday's answer
There will still be some benefit to having the Service Pack installed, though; it will allow Internet Explorer 9 to install without a system reboot.
Read the comments on this post
Microsoft takes PC vs. Mac trolling to Facebook
Written by Akuma Thursday, 23 September 2010 20:30
Microsoft has launched a PC versus Mac campaign on Facebook, via its Windows Australia account. The page is under its own "PC or MAC" tab, where users can try to pick who the PC user is based on uploaded pictures, and then share their results with their Facebook friends.
There's even an option to upload your own photo and fill out a "PC or Mac personality survey" for others to guess "where your allegiances lie." In addition to the usual questions, the survey asks what you associate with (cocktails or beer, safety or risks, folder or "scruncher," texting or calling, dj or bands, voyeur or performer) as well as five yes or no "have you ever" questions (borrowed someone else's ID, forgotten mother's day, "wagged" school, gone skinny dipping, or snuck into a cinema without paying). Some of the answers are used on the main page when your picture is paired with another's so that users can pick who the PC user is, while the rest live in your profile.
Every week there is a HP Pavilion dv6-3030TX Notebook and a copy of Windows 7 Home Premium you can win for describing in 25 words or less "How you would use a Windows 7 laptop to get off a desert[ed] island."
Microsoft's plan is to break the stereotype that Apple started with its "Get a Mac" campaign that ended a couple of months ago (i.e., PC user = older business type, Mac user = young and cool). Last month, Microsoft added a PC versus Mac section to its Windows 7 website, and is now taking the trolling to Facebook.
Read the comments on this post
LinkedIn integrated with Windows Live, Facebook chat hits Hotmail
Written by Akuma Thursday, 23 September 2010 17:07
Microsoft has started rolling out multiple updates for the web services complementing Windows and Office. Over the last few months, the software giant has been regularly updating these services, but the number of features just announced implies today's releases are not a coincidence.
Internet Explorer 9 to require Windows 7 users to install SP1
Written by Akuma Thursday, 23 September 2010 10:40
Windows XP users are unable to install Internet Explorer 9, and now it looks like Windows 7 RTM users won't be able to either, at least once the final version hits the 'Net. When Microsoft releases Internet Explorer 9, Windows 7 users will need to have Service Pack 1 before they can install it, according to the Internet Explorer 9 Beta FAQ for IT Professionals. Microsoft did confirm, however, that IT pros will be able to add IE9 to existing Windows 7 images in order to streamline the deployment process.
The decision is a curious one if we remember the company's insistence that IE9 is not dependent on any future releases of Windows. Microsoft has previously released new Windows versions with new versions of IE (IE6 came with Windows XP, IE7 came with Windows Vista, and IE8 came with Windows 7). Now it appears IE9 will require Windows 7 SP1.
This new tidbit explains why, earlier this week, Microsoft used the The Windows Blog to tell businesses not to wait for the final version of IE9, saying they should move to Windows 7 Enterprise and IE8 now. Microsoft is quite aware that businesses will find it much more of a hassle to deploy a whole service pack in order to install IE9, let alone move from Windows XP and IE6/IE7 straight to Windows 7 SP1 and IE9. In other words, Microsoft doesn't want to give organizations any excuse to avoid moving to Windows 7 and IE8.
The IE9 public beta, released last week, requires four hotfixes before it can be installed, but the browser's installer takes care of everything for the user. It's not clear whether Microsoft will have the final IE9 installer roll out SP1 to Windows 7 users, but given the company's history, the software will likely spit out an error message and fire up Windows Update for users to get SP1 themselves.
Microsoft has not given a release date for either Windows 7 SP1 or for IE9, though we now know the two will not be far apart. Testers got their first Windows 7 SP1 beta build three months ago, but the final version won't come until the first half of 2011.
Read the comments on this post
More Articles...
Page 25 of 74
«StartPrev21222324252627282930NextEnd»