Microsoft
SBS beta and WHS Vail release candidate released
- Monday, 16 August 2010 17:20
Microsoft has released new previews of three of its server products: the first betas of the new cloud-based Small Business Server Aurora and its bigger brother Small Business Server 7, and an updated beta of the second version of Windows Home Server, codenamed "Vail."
The first beta of Vail was released in April. The new version of Windows Home Server provides more robust storage management and better backup options, including the ability to back up Mac OS X computers. Peculiarly, the initial announcement from Microsoft described this new build as Release Candidate 0, but this language has since been removed; this is just another beta after all.
This is just as well; this build contains several known data-loss bugs, so clearly has some way to go before being release quality. As always with a beta, Microsoft advises against using this in any production capacity, and with such flaws in this build, that's probably good advice.
Small Business Server 7 is the next version of Small Business Server, updated to include among other things Windows Server 2008 R2, and Exchange Server 2010. Aurora is a new product that simplifies the configuration and installation, using cloud services for Exchange e-mail and SharePoint collaboration.
Both betas can be had from their respective Connect sites, Aurora here and Vail here.
Read the comments on this post
New Windows kernel mode flaw points to future attack vectors
- Monday, 09 August 2010 17:57
A new Windows flaw that allows all current, supported versions of Windows to be crashed was published on Friday by Israeli researcher Gil Dabah. The bug allows a local user to cause a system to suffer a blue-screen of death crash. In principle, this may also allow attackers to run code of their choosing with kernel privileges, though in practice, the looks as if it would be difficult due to the nature of the flaw.
The bug is in a kernel-mode component called win32k.sys, which handles many key Windows features like window management and 2D graphics. This specific flaw is in the component's handling of the system clipboard; by placing specially malformed data onto the clipboard, the system can be made to corrupt the screen or crash outright. In the early days of Windows, the component in question did not run in kernel mode; it was moved there for Windows NT 4, as doing so made 2D desktop graphics substantially faster.
win32k.sys has remained in kernel mode ever since, and as a result, this flaw affects Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2, for both x86 and x64, both with or without Service Packs.
Microsoft is aware of the flaw but has not announced when a patch might be made available. Due to the nature of the problem, it has been assigned a "Less Critical" rating by security group Secunia. This rating is a result of the lack of remote exploitability and the difficulties in using the flaw to execute an attacker's code.
So far this year, Microsoft has patched a number of similar flaws in the Windows kernel, including bugs in the win32k.sys component. The company tends to give them an "Important" rating, again due to the requirement that the attacker be logged in to perform the attack. Researcher Tavis Ormandy went so far as to suggest that so far this year, Windows has not gone more than a few days at a time without a known, published kernel flaw of this kind.
If the flaw could be exploited in such a way as to allow arbitrary code execution, an attacker with a regular user account would be able to increase his privileges. This does not directly increase the risk of the flaw—the ability to log on is still required—but it does make the flaw more useful, as it allows attackers to break out of system sandboxes such as those used in Web browsers like Chrome and Internet Explorer. This in turn magnifies the risk of those browser flaws.
It is precisely this dual technique—a browser flaw to allow malicious code to run, coupled with a kernel privilege escalation flaw—that is being widely used to jailbreak iPhones and other Apple devices. The privilege escalation is needed because the iPhone runs software in a sandbox; merely being able to attack Safari is not enough to make the system changes required to jailbreak.
Though Internet Explorer 7 and 8 and Chrome both incorporate this kind of sandboxing on Windows Vista and Windows 7, typical attacks on Windows systems don't bother attempting to use kernel flaws to escalate their privileges. The widespread use of Windows XP and users running with full Administrator rights makes it not worth the effort. As Windows XP finally starts dying off and sandboxing becomes more common, we could start to see greater attention paid to, and exploitation of, this kind of flaw, just as we already do on locked-down phone platforms.
Read the comments on this post
Microsoft keeps Mac vs. PC battle going on Windows 7 website
- Monday, 09 August 2010 09:05
Microsoft has added a PC versus Mac section to its Windows 7 website. The webpage is under the Compare tab, where users can match up the three main Windows 7 editions, read a Top 10 list of reasons to buy Windows 7, and read Microsoft's thoughts on why it believes Windows 7 has the advantage over Mac OS X. According to the new page, Microsoft says it has Apple beat in six categories: Having Fun (Macs might spoil your fun), Simplicity (Macs can take time to learn), Working Hard (Macs don't work as well at work or at school), Sharing (Macs don't like to share), Compatibility (Macs might not like your PC stuff), and Choice (Macs don't let you choose).
Each area makes a couple valid points, though Redmond makes sure to avoid naming any potential strengths Cupertino may have: this is strictly a pro-PC show. Each page ends off with a note to visit the Windows PC Scout to help the user find the right PC for them.
Week in Microsoft: Windows 7 and IE hit market milestones
- Saturday, 07 August 2010 10:00
Let's look back at this week's top Microsoft news, which was dominated by these stories.
IE gains market share at the expense of Firefox, Chrome: Firefox and Chrome both lost share in July. Meanwhile, Internet Explorer has managed to gain market share for the second month in a row.
Windows 7 overtakes Windows Vista in market share: Windows 7 has already managed to pass Windows Vista in market share, while Mac OS is at five percent and Linux is at one percent. Charts inside.
Patch Tuesday: Microsoft's most security bulletins ever!
- Thursday, 05 August 2010 13:35
According to the Microsoft Security Response Center, Microsoft will issue 14 Security Bulletins addressing 34 vulnerabilities on Tuesday. It will also host a webcast to address customer questions the following day.
Eight of the vulnerabilities are rated "Critical" and six are marked "Important." All of the Critical vulnerabilities earned their rating through a Remote Code Execution impact, meaning a hacker could potentially gain control of an infected machine. At least seven of the 14 patches will require (yeah!) a restart.
The list of affected operating systems includes all supported versions of Windows; almost all supported Microsoft Office suites are also vulnerable, including Office 2004 for Mac and Office 2008 for Mac. Those who have upgraded to Microsoft Office 2010 may breathe easy. Silverlight 2 and Silverlight 3 are also on the list, but the latest version, Silverlight 4, is not.
Compared to last month's minor Patch Tuesday, this one is massive. In fact, this is the most bulletins Microsoft has ever released in one month.
This month's Patch Tuesday does not include a fix for the Windows Shortcut flaw because Microsoft released an out-of-band patch for that one earlier this week.
Along with these patches, Microsoft is also planning to release the following on Patch Tuesday:
- One or more nonsecurity, high-priority updates on Windows Update (WU) and Windows Server Update Services (WSUS)
- One or more nonsecurity, high-priority updates on Microsoft Update (MU) and WSUS
- An updated version of the Microsoft Windows Malicious Software Removal Tool on Windows Update, Microsoft Update, Windows Server Update Services, and the Microsoft Download Center
This information is subject to change; Microsoft has been known to rush patches or to pull them as it deems necessary.
Read the comments on this post
UK government: Upgrading away from IE6 costs too much
- Wednesday, 04 August 2010 21:30
The UK government is not yet interested in ditching Internet Explorer 6, saying the costs required to do so outweigh the benefits. Six months ago, an online petition started in hopes that the UK would abolish all use of the world's most-loathed browser.
The petition debuted soon after the German and French governments began to advise their citizens to use a different browser than IE in the wake of the Chinese-Google hack attack. It closed on June 6 after gathering 6,223 signatures; on July 30, the government gave an official response. Here's the crux of it:
Complex software will always have vulnerabilities and motivated adversaries will always work to discover and take advantage of them. There is no evidence that upgrading away from the latest fully patched versions of Internet Explorer to other browsers will make users more secure. Regular software patching and updating will help defend against the latest threats. The Government continues to work with Microsoft and other internet browser suppliers to understand the security of the products used by HMG, including Internet Explorer and we welcome the work that Microsoft are continuing do on delivering security solutions which are deployed as quickly as possible to all Internet Explorer users.
The UK government is correct in saying that Microsoft will continue to keep IE6 updated and secure. In fact, the software giant has promised to do so until April 2014, which is when Extended Support for Windows XP (which includes IE6) ends.
That said, Microsoft trash talks IE6 every chance it gets, promoting the increased security of IE8 at the same time. Furthermore, as IE flaws are discovered, IE6 and IE7 are affected more often than not, while IE8 usually remains unaffected.
The true reason the UK government doesn't want to upgrade becomes clear in the last paragraph of its explanation. It doesn't want to spend the money:
It is not straightforward for HMG departments to upgrade IE versions on their systems. Upgrading these systems to IE8 can be a very large operation, taking weeks to test and roll out to all users. To test all the web applications currently used by HMG departments can take months at significant potential cost to the taxpayer. It is therefore more cost effective in many cases to continue to use IE6 and rely on other measures, such as firewalls and malware scanning software, to further protect public sector internet users.
On some level, this makes sense; not every benefit is worth the costs. But such testing will have to be done eventually, and not even Her Majesty's Government can stick with IE6 indefinitely.
Read the comments on this post
Microsoft and Salesforce.com settle patent lawsuit
- Wednesday, 04 August 2010 18:43
Microsoft and Salesforce.com have settled the patent infringement cases they each brought before the US District Court. "We are pleased to reach this agreement with Salesforce.com to put an end to the litigation between our two companies," said Horacio Gutierrez, corporate vice president and deputy general counsel of Intellectual Property and Licensing at Microsoft.
The cases have been settled through a patent agreement in which Salesforce.com will receive broad coverage under Microsoft's patent portfolio for its products and services as well as its back-end server infrastructure during the term; Microsoft, in turn, will receive coverage under Salesforce.com's patent portfolio for its products and services. The details of the agreement have not been disclosed, but the parties did indicate that Microsoft is being compensated by Salesforce.com based on the strength of Microsoft's leading patent portfolio in the areas of operating systems, cloud services, and customer relationship management (CRM) software.
Incidentally, Microsoft took the time to underline that Microsoft Dynamics CRM garnered recognition as a leader from two leading independent research firms: Gartner and Forrester Research. Is it a coincidence that Microsoft chose today to issue a press release (linked below) on the topic?
Two months ago, Microsoft filed a federal lawsuit against Salesforce.com, claiming that the online CRM software company infringes on nine patents awarded to Microsoft between 1997 and 2007. Redmond claimed that it first notified Salesforce.com of its infringement over a year ago, and Salesforce.com's January SEC filing warned that Microsoft had been approached by a "large technology company" with allegations that it was infringing on patents. The original complaint asked for temporary and permanent injunctions, monetary damages, and asserted that the infringement is willful.
Microsoft often finds itself on the receiving end of patent lawsuits, but when the company believes that others are infringing it traditionally seeks to reach a licensing agreement with the other party rather than get the courts involved. Microsoft says it has reached more than 600 licensing agreements since launching its intellectual-property licensing program in December 2003.
Read the comments on this post
Inside the final Internet Explorer 9 Platform Preview
- Wednesday, 04 August 2010 16:41
The fourth and final Platform Preview for Internet Explorer 9 was released today, along with a raft of new HTML5 demos and tests. Though a full beta of the new browser is expected next month, Microsoft promised to release previews every eight weeks or so. With this new release, Redmond has kept its promise.
The message is still "the same markup": Internet Explorer 9 is a browser built for HTML5, and pages built to target Web standards will work properly—or, at least, degrade nicely.
As has been common throughout the preview period, Microsoft is touting the new browser's substantially improved performance, both relative to its predecessor and, thanks to its hardware acceleration, relative to other HTML5-capable browsers. The new version leapfrogs Safari 5 in the SunSpider benchmark, though still marginally trails behind Chrome 5 and 6, and Opera 10.60. Still, the mere fact that Internet Explorer 9 is competitive is a vast improvement.
Microsoft turns on Visual Studio LightSwitch
- Tuesday, 03 August 2010 14:20
Microsoft today announced Visual Studio LightSwitch (previously codenamed Kitty Hawk), the newest member of the Visual Studio product family. It will be available as part of Visual Studio Professional, Premium, and Ultimate. Microsoft says that LightSwitch is aimed at developers of all skill levels and organizational sizes who want to build business applications that target the desktop, cloud, and Web.
A beta will be available on August 23 to MSDN Subscribers, with general availability to follow, and the software giant is hoping to get feedback as it works on getting a final version released by next year.
Visual Studio LightSwitch includes pre-built templates and tools in a simplified development environment for building scalable custom business applications that connect with existing applications, legacy systems, and Web services. Developers can choose from a wide variety of hosting, deployment, and third-party plug-in options. Deployment is simplified in that applications (which are at their core Silverlight applications) can be deployed to the client, browser, and even Windows Azure (post-beta). LightSwitch can be used with C# or Visual Basic and it supports SQL Server, SQL Azure, SharePoint, and Microsoft Office.
Microsoft says that LightSwitch dramatically decreases the time it takes to build a custom application by automatically handling routine code; it's a rapid application development tool that offers application shells and screen templates to allow the developer to concentrate on the core business logic.
There's also a lot of "drag and drop" functionality, but full access to the .NET Framework is still available; if you need to tinker under the hood, you can do so by opening your LightSwitch application in the "full" version of Visual Studio.
How does LightSwitch compare to Microsoft's recently announced WebMatrix Web development suite? Both are tools for building applications, but the approach and target audience is very different: WebMatrix is HTML UI and LightSwitch is Silverlight UI.
WebMatrix is a tool that includes a Web server (IIS Developer Express), a simple database (SQL Server Compact), and programming framework (ASP.NET). It is targeted at non-professional developers to make it easier to create new websites from scratch, or use Microsoft's Web Application Gallery to customize popular ASP.NET and PHP open source community applications. In contrast, LightSwitch is targeted at professional developers and power users looking to create custom Line of Business (LOB) applications using data from multiple sources.
Read the comments on this post