For all of you IE 7 fans ...

jimpeel · Dec 27, 2006

Per this article http://www.nytimes.com/2006/12/25/t...&partner=rssuserland&emc=rss&pagewanted=print in the New York Times (12-25-06).

Merry Christmas from Microsoft.

December 25, 2006

Flaws Are Detected in Microsoft’s Vista

By JOHN MARKOFF
SAN FRANCISCO, Dec. 24 — Microsoft is facing an early crisis of confidence in the quality of its Windows Vista operating system as computer security researchers and hackers have begun to find potentially serious flaws in the system that was released to corporate customers late last month.

On Dec. 15, a Russian programmer posted a description of a flaw that makes it possible to increase a user’s privileges on all of the company’s recent operating systems, including Vista. And over the weekend a Silicon Valley computer security firm said it had notified Microsoft that it had also found that flaw, as well as five other vulnerabilities, including one serious error in the software code underlying the company’s new Internet Explorer 7 browser.

The browser flaw is particularly troubling because it potentially means that Web users could become infected with malicious software simply by visiting a booby-trapped site. That would make it possible for an attacker to inject rogue software into the Vista-based computer, according to executives at Determina, a company based in Redwood City, Calif., that sells software intended to protect against operating system and other vulnerabilities.

Determina is part of a small industry of companies that routinely pore over the technical details of software applications and operating systems looking for flaws. When flaws in Microsoft products are found they are reported to the software maker, which then produces fixes called patches. Microsoft has built technology into its recent operating systems that makes it possible for the company to fix its software automatically via the Internet.

Despite Microsoft assertions about the improved reliability of Vista, many in the industry are taking a wait-and-see approach. Microsoft’s previous operating system, Windows XP, required two “service packs” issued over a number of years to substantially improve security, and new flaws are still routinely discovered by outside researchers.

On Friday, a Microsoft executive posted a comment on a company security information Web site stating the company was “closely monitoring” the vulnerability described by the Russian Web site. It permits the privileges of a standard user account in Vista and other versions of Windows to be increased, permitting control of all of the operations of the computer. In Unix and modern Windows systems, users are restricted in the functions they can perform, and complete power is restricted to certain administrative accounts.

“Currently we have not observed any public exploitation or attack activity regarding this issue,” wrote Mike Reavey, operations manager of the Microsoft Security Response Center. “While I know this is a vulnerability that impacts Windows Vista, I still have every confidence that Windows Vista is our most secure platform to date.”

On Saturday, Nicole Miller, a Microsoft spokeswoman, said the company was also investigating the reported browser flaw and that it was not aware of any attacks attempting to use the vulnerability.

Microsoft has spent millions branding the Vista operating system as the most secure product it has produced, and it is counting on Vista to help turn the tide against a wave of software attacks now plaguing Windows-based computers.

Vista is critical to Microsoft’s reputation. Despite an almost four-and-half-year campaign on the part of the company, and the best efforts of the computer security industry, the threat from harmful computer software continues to grow. Criminal attacks now range from programs that steal information from home and corporate PCs to growing armies of slave computers that are wreaking havoc on the commercial Internet.

Although Vista, which will be available on consumer PCs early next year, has been extensively tested, it is only now being exposed to the challenges of the open Internet.
“I don’t think people should become complacent,” said Nand Mulchandani, a vice president at Determina. “When vendors say a program has been completely rewritten, it doesn’t mean that it’s more secure from the get-go. My expectation is we will see a whole rash of Vista bugs show up in six months or a year.”

The Determina executives said that by itself, the browser flaw that was reported to Microsoft could permit damage like the theft of password information and the attack of other computers.

However, one of the principal security advances of Internet Explorer 7 is a software “sandbox” that is intended to limit damage even if a malicious program is able to subvert the operation of the browser. That should limit the ability of any attacker to reach other parts of the Vista operating system, or to overwrite files.

However, when coupled with the ability of the first flaw that permits the change in account privileges, it might then be possible to circumvent the sandbox controls, said Alexander Sotirov, a Determina security researcher. In that case it would make it possible to alter files and potentially permanently infect a target computer. This kind of attack has yet to be proved, he acknowledged.

The Determina researchers said they had notified Microsoft of four other flaws they had discovered, including a bug that would make it possible for an attacker to repeatedly disable a Microsoft Exchange mail server simply by sending the program an infected e-mail message.

Last week, the chief technology officer of Trend Micro, a computer security firm in Tokyo, told several computer news Web sites that he had discovered an offer on an underground computer discussion forum to sell information about a security flaw in Windows Vista for $50,000. Over the weekend a spokesman for Trend Micro said that the company had not obtained the information, and as a result could not confirm the authenticity of the offer.

Many computer security companies say that there is a lively underground market for information that would permit attackers to break in to systems via the Internet.

(All enhancements to the above text are those of the poster)

Copyright 2006 The New York Times Company
Click to expand...

star17 · Dec 27, 2006

How come the New York Times didn't afford equal reporting to the recent serious flaws found in Firefox? Could it be when I did a search, the first two search result items are paid ads for........Firefox?

jimpeel · Dec 27, 2006

Not being an editor for the NYT I have no idea why they didn't cover that. Perhaps it is the money angle.

If one takes that as the sole factor, then it may be also stated that the story is patently false based on their prejudices. Is the story false? That is for deeper investigation by those who wish to know.

That said, where can the rest of us access the information you have expressed so that we might be equally edified?

star17 · Dec 27, 2006

http://query.nytimes.com/search/que...=12&day2=27&year2=2006&submit.x=23&submit.y=6

jimpeel · Dec 27, 2006

I checked where you linked and found two technology stories. The first was December 23, 2006 - By DAN MITCHELL (NYT) - Technology - News http://www.nytimes.com/2006/12/23/technology/23online.html wherein there was no paid advertisement for Firefox. The article mentioned several other software packages and webpages but Firefox wasn't even mentioned until the next-to-last paragraph and then only as a comparison of market share. In that paragraph, there was also a hotlink to Microsoft but none to Firefox.

The other article was December 21, 2006 - By J. D. BIERSDORFER (NYT) - Technology - News http://www.nytimes.com/2006/12/21/technology/21askk.html opens with an ad to Adobe Acrobat which may be skipped by selecting "skip this ad". The word "Firefox" appears only twice in the article and includes no link to Mozilla. The article does, however, hotlink to a tutorial page for IE7. Internet Explorer is mentioned five times -- three of which specifically mention IE7.

The third and fourth articles are from the NYT archive all of which are "for fee" articles. Only articles from the last seven days are free and then they fall into the archive and everyone must pay to read them at $4.95 per article. This includes ALL articles back to 1981. One may also choose to pay other subscription fees which reduce the costs of articles to as low as .04 per article.

I have found nothing to indicate that there is any prejudice on the part of the NYT toward Mozilla or Microsoft.

star17 · Dec 27, 2006

I check the Times each day when I get home; the Firefox flaws were a couple weeks ago and no mention, at least not as prominent as the IE mention, was made on their site. I saw the IE article you posted on their website main page Christmas evening.

I'm not impying there's any prejudice of any sort, but every time IE or Windows or anything Microsoft has a problem, it sure gets some serious air time. Firefox has had some sewrious flaws lately, and I've not seen equal time given. I actually found out about the FF flaws from a Secunia alert, not a news webpage.

jimpeel · Dec 27, 2006

Perhaps it is because Microsoft not only affects the casual user but major businesses and corporations worldwide that they give such immediate and thorough attention to flaws and weaknesses. Firefox is geared to the casual user rather than the corporate level user.

star17 · Dec 27, 2006

Not sure about that, FF is making a big push to get corporate; you can't go forever doing everything for free. Free doesn't pay the bills.

Who knows; you can't believe everything you read, hear or see in the media anyway.

DavidGP · Dec 27, 2006

Taken from the above

Alexander Sotirov, a Determina security researcher. In that case it would make it possible to alter files and potentially permanently infect a target computer. This kind of attack has yet to be proved, he acknowledged.
Click to expand...

Their will be a slew of these "potential" flaws coming out, many are just a proof of concept, with no actual proof of a vunerability that has been exploited, as MSFT is releasing to retail Vista in Jan, many more will pop out, to in most cases make a name and get said security companies free advertising, all software has bugs and flaws... MSFT do however have some howlers at times, but so do Apple.

Just its more news worthy for ratings to hit MSFT...

But MSFT have set themselfs up for a torrid 2007, in mentioning Vista is their most secure, it may well be but every cracker and security researcher is going to be attacking it to be the first with an actual working proved exploit as their is no sport in hacking Firefox or Linux,

BCGray · Dec 27, 2006

Just to jump into the fray and stir the pot a little, I think that some(maybe most) of the computer communities animosity toward MS stems from its dominance in the market place, as well as MS's policy of "Like it or Lump it". When the latest browser flaw came out pertaining to both IE and FF, FF said right away, yes there was a flaw and they were looking at ways to rectify it, MS said nothing. That this flaw affected both equally shows that one addressed it immediately and the other just shut us out, and there I believe lies a major problem.

That Gates & MS have given us all major advances in the computing world can not be dismissed, but with those advances have come a "do it my way attitude" (that can be readily seen in there programs). Defending that is like defending AT&T's monopoly of the "Old" phone system, and there were many who did, and the Helter Skelter way in which it was dismantled was equally as foolish.

MS will come to realize as AT&T did, that you cannot bully "John Q Public" for long or "S/He" will turn on you, and MS is not alone in this bullying attitude of the computing world. How many times have we heard people who have come here from other sites were the people there treat them like there idiots and dismiss there problems as trivial.

For a "New" and emerging technology it continues to amaze me, that there are so many that have a closed mind to any change or critique of the system, and Yes we here at Major Geeks are not immune from this? Myself included

Anyway thats this "Old Farts" view...........Happy New Year

Calltaker · Dec 27, 2006

OK... on that note, kinda glad I haven't upgraded to any of those... waiting for them to stabilize and all.

~C

jimpeel · Dec 27, 2006

The old saw is to wait to see what the flaws are and then buy. Let the other guy put up with the failures and breakdowns. Nearly every product has problems with few exceptions -- like the 1967 Camaro -- which worked right out of the box and just kept right on working.

Although rare, there are those exceptions and most are willing to put up with the flaws until they are straightened out. This, however, affects security and data loss so people are not going to want to be those "pioneers" who bought the first copy and ended up getting their d--- shot off.

I will take a "wait and see" attitude. IE7 is already causing problems for some yet there are those who believe it works flawlessly. Witness what happened in my thread "Developing a visceral hatred of IE 7" http://forums.majorgeeks.com/showthread.php?t=109126 . It was shut down due to the p---ing contest which ensued.

theefool · Dec 27, 2006

What software or OS (windows/apple/linux) don't have flaws/exploits/bugs?

ALL software are written by humans. Humans make mistakes. Why do we have to hear complaints about software written by humans?

Calltaker · Dec 28, 2006

theefool said:

Why do we have to hear complaints about software written by humans?
Click to expand...

Because the monkeys haven't started writing it yet... LOL

Sorry, couldn't resist

~C

Adrynalyne · Dec 28, 2006

Biggest security flaw Windows has ever had is stupid users.

How come nobody issues a press release on that one?

jimpeel · Dec 28, 2006

How come nobody issues a press release on that one?
Click to expand...

If they are that stupid, they likely can't read either.

Log in or Sign up

For all of you IE 7 fans ...

jimpeel Sergeant

star17 MajorGeek

jimpeel Sergeant

star17 MajorGeek

jimpeel Sergeant

star17 MajorGeek

jimpeel Sergeant

star17 MajorGeek

DavidGP MajorGeeks Forum Administrator - Grand Pooh-Bah Staff Member

BCGray Guest

Calltaker MajorGeek

jimpeel Sergeant

theefool Geekified

Calltaker MajorGeek

Adrynalyne Guest

jimpeel Sergeant