Finally Microsoft is doing something proactive and perhaps even slightly ahead of the game, a real game-change for the security community.

They have released a new AND open-source tool to make debugging easier, it gives developers a lot of help during the release cycle to build more secure software. Mostly because it takes the legwork and labour intensive tasks and semi-automates them leaving the developer to concentrate on more important stuff.

At least something from Microsoft we can applaud!

Microsoft on Friday released an open-source program designed to streamline the labor-intensive process of identifying security vulnerabilities in software while it’s still under development.

As its name suggests, !exploitable Crash Analyzer (pronounced “bang exploitable crash analyzer”) combs through bugs that cause a program to seize up, and assesses the likelihood of them being exploited by attackers. Dan Kaminsky, a well-known security expert who also provides consulting services to Microsoft, hailed the release a “game changer” because it provides a reliable way for developers to sort through thousands of bugs to identify the several dozen that pose the greatest risk.

“Microsoft has taken years of difficulties with security vulnerabilities and really condensed that experience down to a repeatable tool that takes a look at a crash and says ‘You better take a look at this,’” Kaminsky told The Reg. “What makes !exploitable so fascinating is that it takes at least the first level of this knowledge and packages it up into something that can be in the workflow.”

It’s a great idea, as surely there are a lot of conditions that cause an application to hang – but the majority of them will pose no security risk other than a denial of service locally (which is quite pointless). The tool will point out those bugs that are exploitable and therefore can be considered critical issues.

I hope developers harness this app and really start to produce more secure code.

Over the past five years, Microsoft has made a fair amount of progress hardening its operating systems and applications against the most-common security threats. Protections such as Address Space Layout Randomization and cross-site scripting defenses have been added to later versions of Windows and Internet Explorer, respectively. And the company has generally managed to exorcise its programs of dangerous vulnerabilities before they can be exploited by attackers.

Now, Microsoft wants to help secure third-party applications that run on top of Windows. Last year, the company released a threat-modeling tool and other resources designed to help software developers kick-start secure development lifecycle programs in their organizations. The idea was to package the security experience Microsoft has attained so it can serve as a sort of template for other companies.

The release of !exploitable, which was announced at the CanSecWest security conference in Vancouver, British Columbia, is a continuation of that effort. It’s a Windows debugger extension that’s used during fuzz testing, when testers test the stability and security of an application by throwing unexpected data at it.

The tool creates hashes to ensure each crash is unique then rates them according to how exploitable it is – Exploitable, Probably Exploitable, Probably Not Exploitable or Unknown.

There is currently an x86 and an x64 version availalble.

As wisely said, it’s about the signal to noise ratio and this tool can really help you weed out the noise and get to the important issues.

You can download the application here:

!exploitable Crash Analyzer – MSEC Debugger Extensions

Source: The Register

It looks like there is a fairly serious vulnerability in some of the popular media player packages out in the wild packaged as a MP4 file (due to the MP4 codec from 3ivx), it effects Windows Media Player 6.4 and Windows Media Player Classic, which are made by Microsoft, and AOL’s Winamp version 3.5.

All the more reason to use VLC! This follows fairly shortly after a couple of quite serious vulnerabilities in Quicktime.

Security researchers are warning that popular media players offered by Microsoft and AOL are vulnerable to attacks that can completely compromise a user’s PC.

Attack code has already been released for the bug, which has been confirmed in a codec used by older versions of Windows Media Player, made by Microsoft, and in AOL’s Winamp. A Symantec researcher has warned that users of other players may also be at risk because the vulnerability itself resides in a commonly used MP4 codec produced by a company called 3ivx Technologies.

“The exploit works by supplying victims with a maliciously formed MP4 file,” Raymond Ball wrote for Symantec’s DeepSight Threat Management System. “When a victim unknowingly clicks a link that appears safe, the MP4 content is delivered, causing the exploit to run.”

At least it’s not Microsoft’s fault this time, but they did use a dodgy codec so I guess some of the blame lays with them right?

They could have checked it out properly before bundling it into their software.

A researcher who goes by the name SYS 49152 released exploit code here, here and here that targets Windows Media Player 6.4 and Windows Media Player Classic, which are made by Microsoft, and AOL’s Winamp version 3.5. Each uses the 3ivx MP4 codec, which is vulnerable to a stack overflow.

Secunia describes the Windows Media Player vulnerabilities as “highly critical,” the second-highest rating on Secunia’s five-tier scale. The vulnerability reporting service didn’t have a rating for the Winamp vulnerability.

No patch is available. Ball recommends users remove the codec or disable media players that use the MP4 codec until the hole is plugged. That strikes us as overkill. Taking care not to click on suspicious links in browsers and email programs should suffice.

So watch out, attack vectors are getting more varied – don’t let your guard down during this merry season.

Source: The Register

I’ve heard this ‘rumour’ plenty of times, I always suspected it was true and Adobe have said similar things about their software.

If you are going to pirate, Microsoft wants you to pirate their software as when you go legit you are already locked in to their proprietary system.

All the more grounds for OSS if you ask me.

A senior Microsoft exec has admitted that some software piracy actually ends up benefiting the technology giant because it leads to purchases of other software packages.

In this way, some software pirates who might otherwise never try Microsoft products become paying customers, according to Microsoft business group president Jeff Raikes.

“If they’re going to pirate somebody, we want it to be us rather than somebody else,” Raikes told delegates at last week’s Morgan Stanley Technology conference in San Francisco, Information Week reports.

A pay as you go model for lower income countries? Sounds interesting.

Rather than saying that piracy isn’t a problem per-se, Raikes reckons that between 20 and 25 per cent of US software is pirated, he argues pragmatically that it can have benefits over the long-run. “We understand that in the long run the fundamental asset is the installed base of people who are using our products,” Raikes said. “What you hope to do over time is convert them to licensing the software,” he said.

Although Microsoft has no intentions of scaling down (much less abandoning) its effort to chase software counterfeiters, Raikes argues that it’s against its interests to push illegitimate users so hard that they wind up using alternative products. “You want to push towards getting legal licensing, but you don’t want to push so hard that you lose the asset that’s most fundamental in the business,” Raikes said, adding that Microsoft is developing “pay-as-you-go” software pricing models in a bid to encourage low-income people in emerging countries to use its technology.

So basically go ahead, pirate MS. Not so say we support Piracy as we don’t we support Open Source and the freedom to modify and control your own software infrastructure (especially useful when it comes to security).

Security through obscurity and patches with a 1 month lead time is never good.

Come let’s pirate Ubuntu instead.

Source: The Register

No surprise really? Microsoft and they monopoly strategies, anti-competitive behaviour, nothing new really is it?

Microsoft and its security rivals are feuding over a key piece of Windows Vista real estate.

The fight is over the display of technology that helps Vista owners manage the security tools on their PC. Symantec, McAfee, Check Point Software Technologies and other companies want Microsoft to change Vista so their products can easily replace the operating system’s built-in Windows Security Center on the desktop. But Microsoft is resisting the call.

Microsoft was locking down the kernel too, how are other security companies supposed to survive?!

“By imposing the Windows Security Center on all Windows users, Microsoft is defining a template through which everybody looks at security,” Bruce McCorkendale, a chief engineer at Symantec, said in an interview. “How do we trust that Microsoft knows what all the important things about security are to warn users about?”

Windows Security Center, introduced with Windows XP Service Pack 2, pops up on desktops to alert PC owners if their firewall, virus protection and other security tools need attention. The version in the Vista update, set for broad release in January, will add new categories and management tools.

Microsoft better be careful unless they want another antitrust case to brew…I’ve heard they will open up the Vista Kernel to certain companies though, will report more on that later.

Source: News.com