February 2007

Brian Krebs of The Washington Post was surprised to see a security gaffe at the RSA Security Conference in San Francisco, by people using kiosks supplied with Microsoft Windows XP machines to check their email or log on to their PCs remotely.

Apprantly the PC’s were running under the “administrator” account instead of limited user accounts.

Krebs writes:

Had I spent a bit more than 10 seconds at the terminals, I could have downloaded software that would let me steal user names and passwords from some of the more important companies in the information security community.

Food for thought.

Microsoft TechNet
Updated: February 8, 2007

On 13 February 2007 Microsoft is planning to release:

Security Updates

• Five Microsoft Security Bulletins affecting Microsoft Windows. The highest Maximum Severity rating for these is Critical. These updates will be detectable using the Microsoft Baseline Security Analyzer. Some of these updates will require a restart.

• Two Microsoft Security Bulletins affecting Microsoft Office. The highest Maximum Severity rating for these is Critical. These updates will be detectable using the Microsoft Baseline Security Analyzer. These updates may require a restart.

• One Microsoft Security Bulletin affecting Microsoft Windows and Microsoft Visual Studio. The highest Maximum Severity rating for this is Important. These updates will be detectable using the Microsoft Baseline Security Analyzer and the Enterprise Scan Tool. These updates will require a restart.

• One Microsoft Security Bulletin affecting Microsoft Windows and Microsoft Office. The highest Maximum Severity rating for this is Important. These updates will be detectable using the Microsoft Baseline Security Analyzer. These updates may require a restart.

• One Microsoft Security Bulletin affecting Step-by-Step Interactive Training. The highest Maximum Severity rating for this is Important. These updates will be detectable using the Microsoft Baseline Security Analyzer and the Enterprise Scan Tool. These updates may require a restart.

• One Microsoft Security Bulletin affecting Microsoft Data Access Components. The highest Maximum Severity rating for this is Critical. These updates will be detectable using the Microsoft Baseline Security Analyzer and the Enterprise Scan Tool. These updates may require a restart.

• One Microsoft Security Bulletin affecting Windows Live OneCare, Microsoft Antigen, Microsoft Windows Defender, Microsoft Forefront Security for Exchange Server and Microsoft Forefront Security for SharePoint. The highest Maximum Severity rating for these is Critical. These products provide built-in mechanisms for automatic detection and deployment of updates. Some of these updates may require a restart.

Microsoft Windows Malicious Software Removal Tool

• Microsoft will release an updated version of the Microsoft Windows Malicious Software Removal Tool on Windows Update, Microsoft Update, Windows Server Update Services and the Download Center.

Note that this tool will NOT be distributed using Software Update Services (SUS).

Non-security High Priority updates on MU, WU, WSUS and SUS

• Microsoft will release two NON-SECURITY High-Priority Updates for Windows on Windows Update (WU) and Software Update Services (SUS).

• Microsoft will release eight NON-SECURITY High-Priority Updates on Microsoft Update (MU) and Windows Server Update Services (WSUS).

Although we do not anticipate any changes, the number of bulletins, products affected, restart information and severities are subject to change until released.

© 2007 Microsoft Corporation. All rights reserved

IEBlog

Steve Reynolds
Program Manager

This update addresses an issue experienced by some users where CPU usage is high when they are navigating a page that contains multiple frames or when multiple frames are navigated simultaneously. This occurs when the phishing filter evaluates the page for each navigation, resulting in multiple simultaneous evaluations for the same page.

If you have experienced any such performance issues, you are encouraged to download and install this update.

This update is now available on Windows Update for Windows Vista users and will be made available in February for Windows XP and Windows Server 2003 users. All users can download it now here along with related KB article 928089.

His final entry on the Windows Vista Team Blog; what a typical day might look like after retiring as a fulltime employee at Microsoft.

My favourite entry:

5:00 PM: Dinner with the family. After they finished asking who was this strange man sitting at the dinner table, we had a great conversation about the kids’ day. May have spent too much time asking them “how they would have done things better” and “what do they see as their key areas for growth.”

Wishing you well Mr Allchin, and hope to see you continue blogging on your new ventures in life.