Microsoft Faced Big Issues in Fixing SMB Hole

Microsoft has come clean and confirmed that it took seven years to deliver its Server Message Block (SMB) fix. The SMB fix is part of Microsoft's November security patch, released on Tuesday.

Redmond had a problem back then, according Security Response Center spokesperson Christopher Budd in a blog post. Basically, when the issue of an exploit affecting the application-level network protocol first came up in 2001, the software giant couldn't "make changes to address the issue without negatively impacting [other] network-based applications."

Providing a hotfix might have resulted in glitches that would have rendered "many, or nearly all, customers' network-based applications inoperable," Budd wrote.

The SMB vulnerability is related to a previously disclosed SMBRelay attack. Intruders equipped with a copy of the published exploit can get onto a workstation almost unnoticed and read and write files. They can also modify the Windows registry, delete objects and access e-mails, among other actions.

As a stop-gap over the past seven years, Microsoft recommended SMB signing, which is a security mechanism in the SMB protocol that can be used for authentication purposes. The signing function had been available before 2001 in Microsoft Windows NT 4.0 Service Pack 3 and Microsoft Windows 98.

With the SMB vulnerability fix in November's patch release, security experts who followed the issue are breathing a sigh of relief. Not only has a fix come out, but there now is a fuller explanation of the problem.

No one was more relieved than former Microsoft security staffer and current Chief Technology Officer at Shavlik Technologies, Eric Schultze. Having brought the problem to the attention of the software giant, Schultze had come to view the SMB exploit as a pebble in his shoe over the years.

"It's been a ride, as I had been pushing for a fix since 2001," he said. "We even ended up having a meeting with the OS and Internet Explorer teams. At first, we thought it was mitigated in IE, but that only worked for non-OS calls to SMB. Well, it looks like [Microsoft] has finally seen the light."

These days, vulnerabilities to Microsoft product and services rarely become public before Microsoft delivers a patch. And over the years, chances of widespread exploitation have become slimmer due to quicker response times from Microsoft.

Budd believes the Microsoft team got it right with the November patch.

"[The patch] addresses the SMBRelay issue but does so in a way that doesn't have the negative impact on applications that we originally believed addressing this issue would have," he wrote.


‘Max Payne’: Rain Man, By Kurt Loder
‘Twilight’ Event Turns Ugly When Thousands More Fans Show Up Than Expected
Off-Cycle Microsoft Patch Targets Worm-Like Windows Bug

Office Web Apps Will Work on iPhones

Microsoft's Office Web applications, announced late last month at Microsoft's Professional Developers Conference, will work on "multiple platforms" including Apple's iPhone, according to a Microsoft Channel 10 blog.

Lightweight versions of Excel, OneNote, PowerPoint and Word will be accessible by supported Web browsers, including Internet Explorer, Firefox and Safari, according to the blog. The iPhone uses MobileSafari, a version of Apple's Web browser.

Safari support apparently is a new development. A FAQ on the Microsoft Office Live Workspace Web site just lists Internet Explorer and Firefox as the only compatible browsers. The browser won't have to use Microsoft's Silverlight to run the Office Web applications, the blog explains.

Users won't be restricted to Windows or Mac OS X operating systems. They can use Linux, as long as the browser is supported, according to the blog.

A Live ID will be needed to use Office Web applications. In order to collaborate and exchange document files over the Internet, users will need an Office Live Workspace account. The Workspace is just a storage place on the Internet -- it doesn't let you edit documents unless you have the associated Microsoft Office application located on your PC, Mac or device.

A second option for sharing documents in real time over the Internet is Microsoft SharedView, which is integrated with Office Live Workspace, according to the blog.

Microsoft is still figuring out how to price Office Web applications. Business customers can use them via subscription or "existing volume licensing agreements," the blog states. Consumers may get them via subscription or an ad-funded model through Office Live. Universities will get access to Office Web applications for free using the Live@edu service.

A "limited technical preview" of Office Web applications will be conducted this fall, according to Chris Bryant, group product manager for Microsoft Office. Bryant announced Office Web applications on Day 2 at the PDC, as shown in this video snippet.


PDC: Microsoft Office To Be Available as a Service
‘Iron Man’ Recasting Makes Us Wonder: Does Swapping Actors Ever Work?

AMD Releases Next-Gen Opterons

Advanced Micro Devices will release the next generation of quad-core Opteron processors, a line formerly code-named "Shanghai," by the end of the year, according to Steve Demski, an AMD product and marketing manager.

The will be the first line of AMD server and workstation processors created with the smaller 45-nanometer lithography process, which should provide improved performance and lower power requirements. The previous Opteron generation were created by a 65 nanometer process.

The five new Opteron models AMD will release by the end of the year will range in speed from 2.3 Ghz to 2.7 Ghz. All will run at 75 watts. Additional special editions for 55-watt low-power usage (the HE models) and 105-watt high-performance usage (SE) will be available in the first part of 2009.

Demski touted the smaller lithography process as being key for the energy savings. The lithography process involves etching out circuits on the dye using laser beams, in this case beams 45 nanometers wide, rather than 65. Printing circuit patterns on the chip wafer with a finer process means the circuitry itself will use less power, as it is smaller and more tightly laid out.

"With a smaller dye shrink, you actually have a lower capacitance on the dye itself, and that leads to lower idle power," Demski said. "We measure about 25 percent lower idle power at the CPU level, and at the system level that equates to about 8 percent lower power."

The chips also feature a new technology, called Smart Fetch, which reduces power consumption further, namely by turning off individual cores when they are not needed. The company predicts that this approach can cut power usage by up to 21 percent.
The new lithography process has also allowed AMD to up the clock speed on the Opterons, while not creating any additional heat. While the former generation, code-named "Barcelona," topped out at 2.3 Ghz, this generation ranges from 2.3 to 2.7 Ghz -- all running at the same 75-watt power envelope as Barcelona chips.

In addition, the chips will also come with a number of tweaks that should improve performance. The L3 cache has been increased from 2MB to 6MB. The chips will support the faster, next-generation DDR II 800 random access memory. A more efficient way of checking coherency among the various cores has been added.

AMD has also doubled the frequency of the HyperTransport bus, from 8GB per second, to 16GB per second. This should provide "significantly more bandwidth between CPUs," Demski said.

All these improvements should add up to better benchmark scores for the chips. And Demski provided a few. He boasted that a 2.7 Ghz Opteron 2384 could performed 32 percent faster than an Intel E5450 3 Ghz Xeon in executing integer-throughput tasks, as well as 14 percent faster in executing Java programs. The company has submitted these benchmarks to the Standard Performance Evaluation Corporation for posting.

Cray, Dell, Fujitsu, Hewlett-Packard, IBM and Sun Microsystems have all prepared server or workstation platforms that will incorporate this generation of processors, Demski said.

The 75 watt models, will range from $377 wholesale, for the 2.3 Ghz 2376, to $989 for the 2.7 Ghz 2384.


‘Madagascar: Escape 2 Africa’ Knocks ‘High School Musical 3′ Off Box-Office Peak
Powerful Grid Set To Handle Collider Data

SMB Exploit Took 7 Years To Fix, Security Pros Say

It has taken years and a few concept findings by hackers for Microsoft to finally patch its Server Message Block (SMB) vulnerability, but the point is that it's finally done, security experts say.

Eric Schultze, an IT security gadfly, said jokingly that he has been holding his breath for seven years -- waiting for the patch that Microsoft finally delivered on Tuesday.

And Schultze, who is chief technology officer at IT security shop Shavlik Technologies, believes it's about time.

"I used to demonstrate this attack in classroom training events around the country," he said. "It was very eye opening for people to see a very easy-to-use exploit that could result in accessing anyone's computer on their network."

Schultze added that the problem was acknowledged by Microsoft in 2001 but it was never fixed, which "was an equally eye-opening bit of news for the classroom participants years ago."

There were other warnings as well. Hacker-turned-security-researcher Josh Buchbinder (a.k.a. "Sir Dystic") published remote code exploits that revealed the same vulnerabilities that Redmond cited on Tuesday with the SMB fix.

Meanwhile, Symantec Research Manager Ben Greenbaum suggests that the flaw may have its roots eight summers ago at the security conference Defcon 2000. At that event, Veracode Chief Scientist Christien Rioux (a.k.a. "Dildog") released the code.

Greenbaum said in a prepared statement that he didn't know why Microsoft had waited so long to fix the issue.

SMB is an application-borne network protocol enabling shared access to files and serial ports, as well as remote printers. While the flaw affecting SMB was just deemed "important" by Microsoft in its November patch bulletin, Schultze said that the remote code execution implications and the lag time on the patch were "pretty scary."

"The [SMB exploit] should keep IT managers up at night until it's fully patched," Schultze cautioned. "It's like, 'How do I know I haven't already been hacked with this exploit?' [and] 'Who's been accessing my computer without my password?' And the answer is, you really don't know."

Years ago, hackers could use a copy of the SMBRelay program to access a workstation on a typically configured corporate network without scrutiny. Microsoft conceded that previously available "public tools," including a Metasploit module, "have been and are available to perform this attack," according to a blog post. Metasploit is the open source toolkit used by hackers to build attack code. It's also used by security professionals to publish proof-of-concept exploits.

Redmond has yet to respond publicly and specifically about the perceived lag time on Tuesday's patch.

Right after Tuesday's roll out, Schultze had a hunch about the familiar exploit pattern but still wasn't convinced.

"So I tested and confirmed that the patch does indeed address the SMBRelay attack revealed by Dystic in March 2001," he said. "This pretty much means that Microsoft has known of this problem since 2001 and was not able to, or chose not to, fix it until now."

Schultze added that this also means that working exploit code has been available for all operating systems, including Windows NT 4, Windows 2000, Windows XP, Windows Server 2003, Windows Vista and Windows Server 2008. However, as Microsoft correctly states, exploitation is mitigated on Vista and Windows Server 2008. That said, Schultze considers the item to be "critical."

There is little insight outside of Redmond as to how Microsoft's patch selection process works. For security researchers who spoke out about the SMB patch, prioritization will continue to be a challenge as far as both the patch release cycle and the installation cycle on the enterprise side.

"Our opinion is that last month's big release, plus the recent out-of-band, high-profile release, used up most of the normal production resources of MSFT's security team and they were only able to QA a limited number of new patches," said Wolfgang Kandek, CTO of Qualys Inc. "However, we do not think that is there is a slowdown in terms of vulnerabilities like this that constitute classes of vulnerabilities that are well known by now, but -- as we've seen -- not necessarily well defended against."


Off-Cycle Microsoft Patch Targets Worm-Like Windows Bug
‘Twilight’ Tuesday: Anna Kendrick Says It Was ‘Easy To Get Googly Eyed’ At Robert Pattinson
Paramore’s ‘Twilight’ Song ‘Decode’ Premieres On Stephenie Meyer’s Web Site

November's Patch Addresses Two Windows App Exploits

Redmond rolled out two fixes in its Tuesday patch -- one deemed "critical" and one "important."

And, as expected, the November release comes with both fixes designed to stave off remote code execution (RCE) vulnerabilities in Windows programs.

The critical item affects Windows and Microsoft Office and deals specifically with Windows XML Core Services versions 3.0, 4.0 and 6.0. Windows XML Core Services helps developers create XML-based applications, such as Web apps that share structured data.

Knowledge about this vulnerability first emerged in January of 2007.

"Proof-of-concept code for this issue that causes the browser to crash was publicly released some time ago," said Alfred Huger, vice president of Symantec Security Response. "To exploit [the vulnerability] an attacker would have to get a user to view a compromised Web page or click on a malicious link."

According to Huger as well as Microsoft, when a user clicks on a corrupted link, XML coding in the page is processed and remote code execution will occur. However, it's somewhat complex to set up the XML code, from a hacker's perspective.

This critical fix is relevant for certain Internet Explorer and Microsoft SharePoint Server users, experts say. Affected operating systems include Windows 2000 Service Pack 4, Windows XP, Vista and Windows Server 2003 and 2008.

The second fix in this patch is deemed important. It resolves a previously disclosed vulnerability in Microsoft Server Message Block (SMB) Protocol, according to the software giant. It's similar to a fix released 11 months ago covering Server Message Block Version 2.

If the RCE exploits were to compromise this SMB hole, an attacker could install programs and change privileges. For instance, a hacker could change, edit and delete privileges within the OS layer and configure user rights.

Although Microsoft stamped this second fix as important, don't ignore this patch, said Tyler Reguly, security research engineer at nCircle.

"SMB redirection has more play inside the enterprise, so both of these updates should be given equal consideration in the patching process," he said. "We continue to see an increased risk from insider threats and SMB redirection is the ultimate insider attack in today's enterprise environment where IE is often the corporate standard and can be made to pass credentials when a user simply visits a Web page."

Affected operating systems covered by this important fix include Windows 2000 Service Pack 4, Windows XP, Vista and Windows Server 2003 and 2008. The fix replaces two separate bulletins released in 2006 and 2005, respectively, for Windows 2000 SP4 and XP SP2.

Both updates will require restarts.

Meanwhile for items pertaining to general Windows updates and other nonsecurity content, this knowledgebase has a description of such hook-ups on Microsoft Update, Windows Update and Windows Server Update Services.


‘Twilight’ Event Turns Ugly When Thousands More Fans Show Up Than Expected
Elizabeth Banks Stays Behind The Camera For Sci-Fi Flick ‘The Surrogates’
Only 2 Fixes Expected on Patch Tuesday

Microsoft Rolls Out Windows Live Services, Silk Road Project

Microsoft went "Live"-crazy on Thursday, announcing plans to roll out updates to its Windows Live services and Windows Live Essentials offerings, which are aimed at consumer users. On the developer side, Microsoft exec Satya Nadella told PubCon attendees in Las Vegas today about the latest in Live Search developer tools for Web site search optimization.

Microsoft Live Services are the online solutions part of the company's overall "software plus services" strategy. Under this strategy, Microsoft plans to offer both installed solutions and hosted services, and sync the data between both.

Microsoft's CEO, Steve Ballmer, painted a picture for this software plus services vision at the User Conference for Microsoft Services in Tokyo, Japan last week. He suggested that Web 2.0-type collaboration technologies would eventually find a role in Microsoft's enterprise applications.

"Live services, as I said, is sort of the new element, the element that brings in Web 2.0 capabilities…, Ballmer said, according to a transcript. "These are concepts that in the corporate environment we will add back into Active Directory and other technologies so that you have the potential to also bring new Web 2.0 capabilities to applications that run inside your own corporate environment. So Live Services will pioneer in Windows Azure, in the cloud, but will also bring back to Windows Server over time through Active Directory and SharePoint and the like."

Windows Azure is Microsoft's "operating system in the cloud" that was unveiled late last month at Microsoft's Professional Developers Conference in Los Angeles. Windows Azure supports Live Services plus a few more, such as .NET Services, SQL Services, SharePoint Services and Microsoft Dynamics CRM Services.

Consumer users will see an updated Windows Live "over the coming weeks" in the U.S. market, according to Microsoft's announcement today. The updated Windows Live services suite also will be available in 54 countries by early 2009.

Microsoft has partnered with more than 50 Web companies for the Windows Live launch. It has integrated Windows Live services with those from Flickr, LinkedIn, Pandora and others. It also teamed with HP to integrate Windows Live Photo Gallery with HP printers. China Telecom will cobrand Windows Live Messenger as part of its Internet service.

Nadella, Microsoft's senior vice president of the Search, Portal and Advertising Platform Group, announced the latest release of the Live Search APIs for developers. The APIs, at beta version 2.0, are part of Microsoft's code-named "Silk Road" project, which is designed to help Web publishers build traffic on their sites.

Developers, using Silk Road, can select content to enhance the user's search experience on the publisher's Web site. Search results can be delivered using JSON, RSS, SOAP or XML Web service protocols.

Developers need to use application ID (AppID) to enable Silk Road customization. For Web sites not affiliated with Microsoft, developers can create Windows Live ID authentication using a software development kit. The kit, called Windows Live ID Web Authentication SDK 1.2, contains sample applications using "ASP.NET (C# and VB), Java, Perl, PHP, Python, and Ruby" programming languages, according to a Microsoft blog.

Project Silk Road is "in broad beta now," according to Microsoft's Live Search blog, and the company is looking for Web publishers that meet Microsoft's criteria for participation. Web publishers can apply to participate in the Silk Road beta here.

Not to be outdone, Google, a competitor to Microsoft in search advertising, today announced a new search optimization application for Web sites called "On-Demand Indexing for Google Site Search." This new application provides a way to quickly index and customize a Web site's search indices.


‘W.’ Star Josh Brolin Says Portraying A Sitting President Made The Project ‘More Attractive’
Elizabeth Banks Stays Behind The Camera For Sci-Fi Flick ‘The Surrogates’
Microsoft Exec Describes Azure Services Vision
PDC: First Look at Live Mesh and Live Framework

Microsoft Exec Describes Azure Services Vision

Microsoft executive David Treadwell today provided a few more details about the company's Azure Services Platform in a Webinar aimed at the investment community.

The Azure Services Platform was announced late last month at Microsoft's Professional Developers Conference. It represents Microsoft's latest push in its overall "software plus services" enterprise strategy.

Treadwell is Microsoft's corporate vice president for Live Platform Services, but he noted during the presentation that the Microsoft Live Meeting connection kept stalling. It was a minor annoyance. Still, it was reminder that some services still have a few issues to resolve.

Microsoft's Azure Services Platform is helping to provide connectivity to multiple "devices," consisting of PCs, mobile phones and the Web itself, Treadwell explained. Behind it all, Windows Azure provides the utility that enables cloud-based storage and management capabilities for such services.

Microsoft's Azure Services Platform

Treadwell demonstrated how it's possible to sync data using Live Mesh. He created a text document, which, when saved in a folder on a desktop PC, subsequently became available in online storage for other users or devices to access. Live Mesh is part of Microsoft's Live Services offerings, which have been available for years. Live Services provide utilities for identity, directory, communication and presence, and search and geospatial applications.

Currently, there are more than 460 million active users of Live Services, Treadwell said. The services are being hosted on "hundreds of thousands of servers worldwide," he added.

For developers, Microsoft provides its Live Framework, an open, interoperable platform. Third-party software developers can utilize this framework to develop for the PC, mobile phone and Web. In addition, the APIs for the Azure Services Platform are based on standard protocols. ISVs are not locked into one software stack when developing for it.

The Azure Services Platform is designed to serve a broad customer base, from building social networking widgets to delivering high-power enterprise applications. Treadwell contrasted it to Google's hosted applications, suggesting that Azure Services offer a more comprehensive choice that combines the power of installed client apps with services in the cloud.

Treadwell said that Amazon "deserves a lot of credit" for leading the way with inexpensive, scalable services. However, he emphasized the flexibility of Microsoft's Azure ecosystem for developers as a key differentiating factor.

Treadwell addressed a question about possible hurdles for Azure. In response to security concerns, he noted that Live Mesh encrypts all of the data flows in the cloud. He also said that Azure gives users control over where their data resides.

He did acknowledge that some policy and legal challenges exist, especially with government sectors on sharing data over the cloud. The resolution of that problem will be an evolutionary process, he added.

Microsoft also is still trying to work out how to make money with its new cloud-computing venture. The company is considering subscription-based, ad-based and service-based business models, Treadwell said.

Currently, the Azure Services Platform is at the "Community Technology Preview" level.

"Next calendar year, we will take the core pieces [of Azure] to a shipping level," Treadwell said.

He concluded the presentation by noting that the next major release of Live Mesh will integrate FolderShare, a file synchronization service that is similar to Live Mesh. Microsoft acquired FolderShare in 2005. Currently, Microsoft's Live Mesh data sync service is publicly available at the beta release stage.

Treadwell's presentation is available at the Microsoft Investor Relations home page, which can be accessed here.


PDC: First Look at Live Mesh and Live Framework
‘What Just Happened’: Reeling, By Kurt Loder
‘Gears Of War’ Screenwriter Aims For ‘Gritty And Real’ Big-Screen Version Of Video Game