Posts tagged as:

Microsoft

Microsoft Security Bulletin MS08-067 Critical Update

by certifiedbug on October 24, 2008

in Microsoft

Vulnerability in Server Service Could Allow Remote Code Execution (958644)

Executive Summary

This security update resolves a privately reported vulnerability in the Server service. The vulnerability could allow remote code execution if an affected system received a specially crafted RPC request. On Microsoft Windows 2000, Windows XP, and Windows Server 2003 systems, an attacker could exploit this vulnerability without authentication to run arbitrary code. It is possible that this vulnerability could be used in the crafting of a wormable exploit. Firewall best practices and standard default firewall configurations can help protect network resources from attacks that originate outside the enterprise perimeter.

This security update is rated Critical for all supported editions of Microsoft Windows 2000, Windows XP, Windows Server 2003, and rated Important for all supported editions of Windows Vista and Windows Server 2008. For more information, see the subsection, Affected and Non-Affected Software, in this section.

Out-of-band update, extremely urgent to patch ASAP.
http://www.microsoft.com/technet/security/bulletin/ms08-067.mspx

Edit
Get Protected, Now!
http://blogs.technet.com/mmpc/archive/2008/10/23/get-protected-now.aspx

MS08-067 and the SDL
http://blogs.msdn.com/sdl/archive/2008/10/22/ms08-067.aspx

Note:
Threat Expert’s Blog called Gimmiv.A a worm.  A worm may follow but at this stage the attack is a trojan as shown in their own reports.

Sunbelt Blog. The trojan itself isn’t a worm but a dll dropped by Gimmiv is.

{ 0 comments }

Microsoft releases an updated version of the Windows Malicious Software Removal Tool on the second Tuesday of each month, and as needed in response to security threats.

The free tool searches for specific infections and is available through Microsoft Update, Windows Update and the Microsoft Download Center. Operating systems covered are Windows Vista, Windows XP, Windows 2000, and Windows Server 2003.

KB890830 64 bit version for Vista x64, Windows XP x64 and Windows 2003 x64 computers.

“Deployment of the Microsoft Windows Malicious Software Removal Tool in an enterprise environment”.
http://support.microsoft.com/kb/891716

MSRT is not a replacement for an anti-virus program, make sure you have one installed.

Microsoft® Malware Protection Center article by Oleg Petrovsky, Uprooting Win32/Rustock

Edit:
How to troubleshoot an error when you run the Microsoft Windows Malicious Software Removal Tool
http://support.microsoft.com/kb/891717

Rustock is a challenge to remove, if you experience difficulties try running MSRT in ‘Safe Mode’.

How to Start Vista in Safe Mode
Windowshelp-Microsoft

A description of the Safe Mode Boot options in Windows XP
http://support.microsoft.com/kb/315222

{ 0 comments }

CSS expressions support ends with IE8 Beta 2

by certifiedbug on October 17, 2008

in Microsoft

IE Blog.

Design criteria such as standard compliance, performance, reliability and security framed the design of IE8 as whole, for new as well as existing features. As a result, CSS expressions are no longer supported in IE8 standards mode. This change was announced previously on the IE blog, however, this post will provide a few more details about that decision. The following FAQ will give a quick overview of the feature, the rationale behind our design decision and what it may mean for your own site.

http://blogs.msdn.com/ie/archive/2008/10/16/ending-expressions.aspx

{ 0 comments }

Email spoofing basically is when someone forges the header information making the email appear to have originated from somewhere other than the real source.

One such spoof is doing the rounds falsely claiming to be from Steve Lipner at Microsoft urging recipients to install an attached update.

The email is not from Microsoft, the malicious attachment contains Backdoor:Win32/Haxdoor, and of course you should not open it.

The Microsoft Security Response Center (MSRC)

First and foremost, we never, ever, ever send attachments with our security notification e-mails. And, as a matter of company policy, Microsoft will never send you an executable attachment. If you get an e-mail that claims to be a security notification with an attachment, delete it. It is always a spoof. You can think of our security notification e-mails as a notification for you to go the security bulletin to get the updates from the link in the bulletin to the Microsoft Download Center http://www.microsoft.com/downloads. You should always get our security updates from the links in the bulletins or through our deployment tools such as Microsoft Update or Windows Update, Windows Software Update Services (WSUS) or Systems Center Configuration Manager.

Article: Microsoft Security E-mail Spoofs with Malware

{ 0 comments }

Scheduled October bulletin release day, Tuesday, Oct. 14, 2008.

The Microsoft Security Response Center (MSRC)

Preliminary information, subject to change.

As part of our regularly scheduled bulletin release, we’re currently planning to release:

  • Four Microsoft Security Bulletins rated as Critical, six rated Important, and one rated Moderate. These updates may require a restart and will be detectable using the Microsoft Baseline Security Analyzer.

As we do each month, the Microsoft Windows Malicious Software Removal Tool will be updated.

We are also planning to release high-priority, non-security updates on Windows Update and Windows Server Update Services (WSUS) as well as high-priority, non-security updates on Microsoft Update and Windows Server Update Services (WSUS). For additional information, please see the Other Information section of the Advanced Notification.

We also want to announce the availability of the Exploitability Index in upcoming security bulletin summaries and the official release of Microsoft Active Protections Program, which were both announced at Black Hat in August. The Exploitability Index provides additional information to help customers prioritize deployment of monthly security bulletins while the Microsoft Active Protections Program provides vulnerability information to security software providers in advance of Microsoft’s monthly security bulletin releases. Both the Exploitability Index and Microsoft Active Protection Program provide additional support to customers and partners to defend against emerging online threats.

As always, we’ll be holding the October edition of the monthly security bulletin webcast on Wednesday, Oct. 15, 2008 at 11 a.m., Pacific Standard Time. We will review this month’s release and take your questions live on-air with answers from our panel of experts. As a friendly reminder, if you can’t make the live webcast, you can listen to it on-demand as well at the same URL. In addition, we’ll also be posting the text of the questions and answers from each month’s webcast. You can see a full listing of the posted questions and answers on this page.

You can register for the webcast here: http://msevents.microsoft.com/CUI/EventDetail.aspx?EventID=1032374639&Culture=en-US

Update 1: Microsoft Security Advisory 951306

{ 0 comments }

Trend Micro, October 2, 2008. Rogue AV Tactics Continue to Threaten

October has just begun and Trend Micro threat researchers keep seeing more and more — slightly different, but yet increasingly more annoying — variations to the set of rogue AV infection signals we have been documenting on this blog.

Fake BSOD (actually a screensaver) now sports a specific mention of the problem — an unregistered version of a certain AV product.

Now even the fake reboot screen (also a screensaver) has text

The bogus reboot screen poses as Microsoft’s Security Center and recommends you activate your anti virus protection software, (which happens to be AntiVirus 2009).

Certifiedbug, September 29, 2008.
Microsoft and Washington State’s lawsuits reveal ’scareware’ defendants

Microsoft also filed five “John Does” lawsuits. Nameless defendents until discovery reveals the identities of the individuals responsible for marketing the scareware, aka ‘rogues’.
The actual products are well known in the security community and forums that help victims of malware infections.

Antivirus 2009

Microsoft® Malware Protection Center, October 2, 2008.
Rogue Antivirus - A Closer Look at Win32/Antivirusxp
Subratam Biswas and Scott Wu.

Fake security applications have always been good at confusing end-users. Win32/Antivirusxp is no difference in that aspect, and with names such as Antivirus2008, XPAntivirus, Windows Antivirus, Antivirus 2008 XP, confusion is hard to avoid.

{ 0 comments }

Fright Fight: Washington Attorney General leading battle against scareware with Microsoft
SEATTLE – Attorney General Rob McKenna stood at the frontlines with Microsoft Corp. in the war against spyware in 2006. Now armed with tougher legislation, the state’s top law enforcement officer, with the world’s largest software company, is charging forward with new lawsuits targeting scareware purveyors.

“The Attorney General’s Office along with Microsoft has yanked the fear factor dial out of the hands of businesses that use scareware as a marketing tool and have spun it toward them,” McKenna said.

“We won’t tolerate the use of alarmist warnings or deceptive ‘free scans’ to trick consumers into buying software to fix a problem that doesn’t even exist,” McKenna continued. “We’ve repeatedly proven that Internet companies that prey on consumers’ anxieties are within our reach.”

The Attorney General’s Office along with Microsoft announced the filing of new cases under Washington’s recently improved Computer Spyware Act during a joint press conference today in Seattle.

“Microsoft is honored to assist Washington Attorney General McKenna in helping to protect consumers from online threats,” said Richard Boscovich, Senior Attorney for Microsoft’s Internet Safety Enforcement Team. “Cybercrime continues to evolve, but with public/private collaboration such as this, we can work to champion tougher laws, greater public awareness and, ultimately, stronger protections for online consumers.”

In 2005, Washington became one of the first states to adopt a law explicitly prohibiting spyware activities and imposing serious penalties on violators. The statute doesn’t stop at outlawing programs that collect personal information, but uses a broader definition of “spyware” and punishes those who mislead users into believing software is necessary for security. The law was updated last session to create additional liability for third-parties that permit the transmission of spyware and to address new types of deceptive behaviors, such as misrepresenting the need for computer repairs.

As of today, the Attorney General’s Office has filed seven suits under the statute.

The Attorney General’s Office filed its latest case today in King County Superior Court against the marketers of a program called Registry Cleaner XP. The civil suit brings five causes of action against James Reed McCreary IV, of The Woodlands, Texas, and two businesses: Branch Software, of The Woodlands, Texas, doing business as Registry Cleaner XP, and Alpha Red, Inc., of Houston, Texas. McCreary is the sole director of Branch Software and CEO of Alpha Red.

McKenna said Microsoft referred the case to the Attorney General’s Consumer Protection High-Tech Unit and has been helpful in assisting the office with enforcement issues.

According to the state’s complaint, the defendants sent incessant pop-ups resembling system warnings to consumers’ personal computers. The messages read “CRITICAL ERROR MESSAGE! – REGISTRY DAMAGED AND CORRUPTED,” and instructed users to visit a Web site to download Registry Cleaner XP.

Computers capable of receiving Windows Messenger Service pop-ups, also known as Net Send messages, were vulnerable to the attacks. Windows Messenger Service, not to be confused with the instant-messaging program Windows Live Messenger, is primarily designed for use on a network and allows administrators to send notices to users.

“Consumers who visited the Web site were offered a free scan to check their computer – but the program found ‘critical’ errors every time,” said Senior Counsel Paula Selis, who leads the Attorney General’s Consumer Protection High-Tech Unit. “Users were then told to pay $39.95 to repair these dubious problems.”

The filings today bring the number of civil spyware actions brought by Microsoft since the Computer Spyware Act was first enacted in 2005 to 17. In 2006, Microsoft and the Attorney General each brought lawsuits against the same group of defendants under the Washington Computer Spyware Act, obtaining permanent injunctions and settlements. Additionally, Microsoft has routinely worked with the FTC and other state and federal law enforcement agencies in the battle against spyware.

Spyware has arguably become the biggest online threat to consumers and businesses since the advent of the Internet. Microsoft has said that 50 percent of its customer-support calls related to computer crashes can be blamed on spyware.

Complaint

Registry Cleaner XP demo

- 30 –

Media Contacts:
Janelle Guthrie, APR, Communications Director, Office of the Attorney General, 360-586-0725 or janelleg@atg.wa.gov
Dan Sytman, Media Relations, Office of the Attorney General, 360-586-7842 or dans@atg.wa.gov

Editor’s Note: The Attorney General’s Office has also brought enforcement actions against companies that market products named Registry Cleaner, Registry Cleaner Pro, Registry Cleaner 32 and related names. Those cases are unrelated and involve different defendants.

Press release

Update
Microsoft also filed five “John Does” lawsuits. Nameless defendents until discovery reveals the identities of the individuals responsible for marketing the scareware, aka ‘rogues’.
The actual products are well known in the security community and forums that help victims of malware infections.

Antivirus 2009
Malwarecore
WinDefender
WinSpywareProtect
XPDefender

The lawsuits were filed under Washington’s Computer Spyware Act.
Microsoft also amended two complaints filed earlier to unmask those running SMP Soft LLC, a Delaware corporation that markets a scareware product called Scan & Repair Utilities.

A few names should ring a bell.

Antivirus 2009
This site is currently under construction!
ICANN Registrar: 1 & 1 INTERNET AG
registrant-firstname: Oneandone
registrant-lastname: Private Registration

Malwarecore
ICANN Registrar: ESTDOMAINS, INC.
Registration Service Provided By: ESTDOMAINS INC
Status: SUSPENDED
Note: This Domain Name is Suspended.
In this status the domain name is InActive and will not function.

XPDefender
ICANN Registrar: DIRECTI INTERNET SOLUTIONS PVT. LTD. D/B/A PUBLICDOMAINREGISTRY.COM
Registration Service Provided By: VIVIDS MEDIA GMBH
Status: SUSPENDED
Note: This Domain Name is Suspended.
In this status the domain name is InActive and will not function.

WinDefender
ICANN Registrar: TUCOWS INC.
Registrant: Whois Anonymizer

WinSpywareProtect

ICANN Registrar: GODADDY.COM, INC.
Registrant: Domains by Proxy, Inc.

XPDefender
ICANN Registrar: DIRECTI INTERNET SOLUTIONS PVT. LTD. D/B/A PUBLICDOMAINREGISTRY.COM
Registration Service Provided By: VIVIDS MEDIA GMBH
Status: SUSPENDED
Note: This Domain Name is Suspended.
In this status the domain name is InActive and will not function.

{ 0 comments }

Microsoft and Washington State to sue scammers

by certifiedbug on September 26, 2008

in Microsoft

September 29, 2008, Washington state’s Attorney General and lawyers from Microsoft’s Internet Safety Enforcement team will announce several lawsuits against aggressive marketeers of scareware who are being charged under Washington’s Computer Spyware Act.

Microsoft and Washington’s AG have worked together before, jointly suing ‘Secure Computer’ for using fake error messages to scare users into buying its Spyware Cleaner software.

Certifiedbug April 20, 2006. Oregon Man Fined $84K for promoting bogus anti-spyware program

{ 0 comments }

Microsoft’s Press releases

by certifiedbug on September 22, 2008

in Microsoft

Joe Wilcox, Microsoft Watch.
Microsoft’s Nine Press Release Monday

News Analysis. Today, Microsoft dropped nine press releases. What do they all mean?
I’ll just quickly take them one by one, offering a little color and perspective. I read them, so that you don’t have to.

Microsoft Press Release

{ 0 comments }

2009 MVP Global Summit

by certifiedbug on September 21, 2008

in Security

Speaking of conferences,

Microsoft will host the 2009 MVP Global Summit March 1-4, 2009 at the Washington State Convention and Trade Center in Seattle, and at Microsoft headquarters in Redmond, Washington.

I will be attending my third Summit as a Microsoft Consumer Security MVP, and am looking forward to seeing friends and colleagues again real time and meeting new ones.

The MVP Global Summit features more than 400 technical sessions in which MVPs can connect with other MVPs, build relationships with Microsoft experts, and provide real-world insights and feedback to Microsoft product teams.

https://mvp.support.microsoft.com/gp/MVPsummit

{ 0 comments }