Windows 7 Beta Available in January 2009

Microsoft executive Bill Veghte answered a few questions on Wednesday about Microsoft's business strategies for the Windows product line at the Credit Suisse Annual Technology Conference.

Veghte, who is Microsoft's senior vice president for Windows business, notably described when Windows 7, Microsoft's latest operating system under development, will be released.

"Our public comments have been to have general to release-to-manufacturing of Windows 7 product by next January, and we're on track for that," Veghte said at the Scottsdale, Ariz.-based event.

Windows 7 will be available first as a beta, followed by the release candidate version and then release to manufacturing. Veghte didn't exactly specify when the beta would be released, but a Web page advertising Microsoft's MSDN Developer Conference gave an indication. It explains that attendees at the January 2009 MSDN event will be handed the "Windows 7 Beta 1 DVD."

Developers reacted to the pre-beta of Windows 7, which was publicly released at the Professional Developers Conference in October, saying it was "the highest quality" Windows release they've seen, Veghte said. The APIs were complete with that release, he noted.

Microsoft expects that the Windows 7 beta will be compatible with existing systems running Vista. Microsoft made fundamental changes in security and graphics when it first released Windows Vista, which tripped up some of the vendors writing drivers for the OS. However, with the release of Windows 7, "we don't have to change graphics drivers," Veghte explained.

Microsoft has spent "more than 250 structured hours of conversation" with its OEM partners on Windows 7, Veghte said. It has gathered feedback from both hardware and software providers for the beta release.

Phil Winslow, Credit Suisse analyst, asked Veghte about Microsoft's up-selling strategy and how it will structure its premium offerings with Windows 7. Veghte didn't provide the details except to say that Microsoft would base pricing on its past Windows release experiences.

In that context, the elephant in the room that went unmentioned during the talk was the "Vista Capable" lawsuit in which plaintiffs have accused Microsoft of false advertising. Microsoft offered a Vista Basic edition of the operating system that couldn't run prominent features, such as its Aero graphics experience. It apparently caused customer confusion at the low-end of the price scale when customers expected Aero to be part of the Vista Basic experience.

Winslow asked about the market prospects of netbooks, which are low-cost, low-tech laptops that typically can run Windows XP, but not Vista. Veghte said that the netbooks market is meaningful in terms of the number of units that can be sold, although he said it was "too early to tell" what the market share might be. "It's significant enough that we are going to participate," he said.

Veghte said that netbooks would "cannibalize" Microsoft's existing OS market share to some degree. Microsoft is also concerned that customers will choose Windows for netbooks rather than a Linux OS alternative. Veghte said that "more than 70 percent" of netbook vendors are onboard with offering Windows-based machines.

Veghte was asked about how virtualization would affect Microsoft's hold over its component products. He didn't really give an answer except to say that virtualization on the server side will help consolidate unused capacity for customers, while on the client side, Microsoft has an opportunity to help drive down deployment costs for organizations.

Winslow asked about how Microsoft expects to continue pushing out margins in a recessionary environment. Veghte didn't really answer, but he pointed to Microsoft's R&D accomplishments in rolling out the forthcoming Windows 7 and Internet Explorer 8 products. Microsoft is also extending the Windows experience to the Web via its Live offerings, he added.

Veghte talked a lot about Microsoft's marketing campaigns as a way of having a conversation with the customer. Windows has "almost 80 percent positive reception…and yet we need to have a conversation about what Windows uniquely offers," he said. People remember the ads from Microsoft's latest ad launches, he said.

An audience participant asked if Windows 7 will be harmed or helped by the contention that it is just the "Service Pack 2 release of Vista." Veghte didn't really answer, except to emphasize Windows 7's compatibility with Vista.

Veghte did point to two notable features in Windows 7. One feature, called "direct access," is a more convenient way to connect with the office than current VPN (virtual private network)-type connections. Another is the ability to differentiate device use between work and home by specifying groups in Windows 7.

An audio recording of Veghte's talk can be accessed at the Microsoft Investor Relations Web page here.



‘Twilight’ Tuesday: Stars Answer More Of Fans’ Burning Questions … Like What It’s Like To Kiss Robert Pattinson
Vista SP2 Goes Out in Limited Beta
‘Windows 7′ No Longer a Code Name

Unpatched Systems at Risk From Worm, Microsoft Says

Microsoft is seeing an increase in the number of malware attacks exploiting a security hole supposedly addressed by a recent patch, the company announced on Wednesday.

The problem stems from a worm dubbed "Win32/Conficker.A." The worm will "propagate on random computers" in an affected Windows-based network, according to Microsoft.

"Recently we've received a string of reports from customers that have yet to apply the update and are infected by malware," said Microsoft Security Response Center spokesman Bill Sisk in an e-mail. "These most recent reports have a common malware family and we urge people who haven't patched their systems to patch them immediately or as soon as possible."

Redmond's concerns had prompted the company to issue an out of band patch to address the problem in late October.

The security hole, and Microsoft's related hotfix, centers on remote procedure call (RPC) technology, which allows subroutine code to execute on other computers in a shared network. What's unique about this RPC vulnerability is that subroutines can be executed without programmer interference. It allows an almost automatic remote interaction between CPUs in a shared processing environment.

One security expert maintained that there is little to be concerned about, that is, unless your system is unpatched.

Randy Abrams, director of technical education at security firm ESET, said that although the vulnerability is bad "there are several mitigations, including disabling file and print sharing, which is generally a baseline sane practice."

Abrams also suggest that the proper use of firewalls wouldn't hurt either.

"The real threat is not worms," he said. "Worms are only automation and they tend to make a lot of noise. Any vulnerability that a worm can exploit can also be exploited by a Trojan, or manually by a skilled hacker. The hacker is far more likely to go undetected and capable of causing far greater harm."

This type of client-side bug is a textbook example why defense-in-depth security practices should be followed by IT pros and individual users alike.

Microsoft offers further details on the specific threats and workarounds in this link.



Microsoft Ups Exploit Code Warning
‘Twilight’ Event Turns Ugly When Thousands More Fans Show Up Than Expected
Off-Cycle Microsoft Patch Targets Worm-Like Windows Bug

IT Security: Expect More Misery in 2009

This year, the IT industry reached an inflection point, where more new malicious programs were created than useful ones. So says security solution provider Symantec in its latest report highlighting some of the top security trends in 2008.

The report also spells out what to look for in 2009.

"With today's threats growing in volume and severity, we see that there are several things to look for," said Zulfikar Ramzan, a technical director at Symantec. "The rapid explosion of new malware variants and the move towards targeted malware are certainly worrisome."

Symantec officials expect that the current recession and credit crisis, along with the rise of social networking and the use of mobile devices, will shape the types of security threats that we'll see in the near future. For instance, bank mergers and bankruptcies may provide occasions for compromising online security through phishing attacks (fake official-looking notices sent by e-mail).

2008 Trends
This year's trends, according to the report, included malware variants, fake applications, Web-based threats, plug-in vulnerabilities and data breaches.

Under the malware variant category, you find Trojan viruses, phishing and not so tasty worms and spam. In addition, the last quarter of 2008 saw the resurgence of the botnet bug. A botnet is a robot doing the bidding of hacker. It is malicious software that autonomously replicates itself on a network. Most botnet attacks occur on systems using Windows. They can be installed via worms, Trojan horses and other malware.

In the fake application category, you find nasties such as the fake security update, which may target users of Microsoft products. The fake security update routes users to a server not affiliated with Redmond to "patch" their Windows systems. According to Microsoft, in November alone, the Microsoft Windows Malicious Software Removal Tool eliminated fake security applications on almost one million PCs.

Web-based threats aren't so simple anymore.Trusted Web sites can contain embedded coding that reroutes users to an unfriendly server.

Plug-in vulnerabilities affect users of Windows Media Player, Apple's QuickTime and Adobe Flash, among others. The bugs can crash a user's system.

Data breaches of enterprises large and small remained on the radar in 2008, as they did last year. These types of attacks are varied in nature, use different attack vectors and grab headlines, as well as the attention of concerned IT pros. Victims include the grocery chain Hannaford Bros. and the Walter Reed military hospital, among others.

2009 Trends To Come
In 2009, computer users can expect to see more spam, possible security issues with virtual machines and social networking-borne vulnerabilities added on top of 2008's list.

Microsoft's Bill Gates said that the spam problem would be "solved two years from now," but that was back in 2004, and it's still a problem. Symantec takes the view that spam will be as unavoidable as those weight-loss prevention ads and double-coupon notices that come unsolicited via snail-mail from your local post office.

A good spam filter can help, Ramzan said, "but it is also important to ensure that endpoints are protected with a comprehensive internet security suite that includes anti-virus, anti-spyware, and intrusion prevention capabilities among others," he added.

The jury is still out on whether virtual machines also require virtualized security on top of traditional security measures. Recent surveys have suggested that many IT admins don't trust the security of virtualized systems.

Expect to see more social networking sites as attack vectors in 2009. It's not uncommon these days to find malware on sites such as Facebook, Myspace or LinkedIn. Using a compromised account, hackers can send messages to everyone the user added to their social network. These "friends" will likely trust such messages, and this is how a Trojan horse or botnet can be released.

The Underground Economy
According to Symantec's research, a keystroke logger can be bought for $23. A hacker typically might pay $10 to have someone else host a phishing scam to avoid detection. A botnet of one's very own can be had for as little as $225. Industry-specific toolkits, such as those exploiting Internet banking site vulnerabilities, average $740 a pop.

The use of such tools for identity theft and credit card scams creates an industry worth a quarter of a billion dollars, according to Symantec.

Steps To Take
Symantec and other IT security pros suggest adopting security measures based on individual needs and assessed risk.

The main challenge for security administrators and CIOs will be enabling one enterprise-wide security policy that integrates a wide range of applications and hardware at various stages of obsolescence. A security policy involves employee education, data loss-prevention strategies and the use of encryption tools.

"There is no one silver bullet that can fully address an overarching security problem or group of problems," Ramzan said. "We believe in forming a defense-in-depth strategy."



‘Zack And Miri Make A Porno’: Boffo, By Kurt Loder
Microsoft Ups Exploit Code Warning
‘Twilight’ Event Turns Ugly When Thousands More Fans Show Up Than Expected
Malware Disguised as Social Networking Tops Emerging Security Threats

UPDATED: Microsoft Offering $20 Billion for Yahoo Search?

Just days after Microsoft CEO Steve Ballmer's declaration that Redmond was "done with all of these [acquisition] discussions with Yahoo," one newspaper is reporting that a deal is in the works.

According to a report published Saturday by the Times of London, Microsoft and Yahoo have agreed to "the broad terms" of a deal that would give Microsoft Yahoo's search business for $20 billion. Reporter John Waples described the deal as "complex": Microsoft would have a "10-year operating agreement" for Yahoo search, would participate in the company's management structure and acquire 30 percent of Yahoo overall.

Neither company has commented publicly on the report as of press time. However, All Things D's Kara Swisher reported on Sunday that her sources from both companies "scoffed" at the article, saying that the companies haven't even been talking.

If the Times report is true, the timing may make sense: Yahoo's CEO, Jerry Yang, recently announced he would leave the company. Shareholders who sued Yahoo after the negotiations earlier this year failed blamed Yang in court documents for not accepting Microsoft's original offer of $31 a share made in February. Yang stated at the time that he wanted an amount in the high $30s. Microsoft's follow-up attempt to acquire just the search portion of Yahoo failed over the summer -- and was the first of many times Ballmer said he would no longer seek to acquire any part of the company.

Yahoo's value has dropped precipitously during the last year: It was in the mid-$20s per share right before the original Microsoft offer; it closed Friday at $11.51 a share.



‘Star Trek’ Director J.J. Abrams Clears Up Confusion With William Shatner
Microsoft Hires Yahoo Search Team Engineer
Yang To Step Down as Yahoo CEO
‘Flash of Genius’: War Story, By Kurt Loder

Microsoft Adds Gen 4 Datacenters for Cloud Computing

Microsoft is initiating the fourth in a series of datacenter upgrades to enable its cloud computing services, according to a Microsoft blog post on Tuesday. And, like everything else in the software world, being highly modular is a good thing.

The Generation 4 Modular Data Center is described as "a highly modular, scalable, efficient, just-in-time data center capacity program that can be delivered anywhere in the world very quickly and cheaply."

The new datacenter configuration is seen as "the foundation of cloud data center infrastructure in the next five years," according to the blog, co-written by Michael Manos, Microsoft Data Center chief, Daniel Costello, director of Data Center research and engineering, and Christian Belady, principal power and cooling architect for Microsoft Data Center.

Manos said that the new plan is the most revolutionary change in datacenter configuration in the past 30 years. He even compares it to Henry Ford's introduction of production-line manufacturing in the first Model-T car factories.

Gen 4 centers will not be individually designed. Instead, they use a "commoditized manufacturing approach" that will utilize components built in various locations. The components can then be assembled on site.

A video on the blog's Web site depicts truckloads of modular units pulling into a prefabricated courtyard, which is roofless. The trucks leave behind their payloads of modular units stored in shipping containers. The modular units consist of servers, mechanical, electrical and security components.

The "building blocks" of Gen 4, including cement walls and modular components, are simply assembled on site according to capacity needs. This approach saves time and construction costs, and provides a level of scalability that traditional datacenters do not have, according to the blog.

Gen 4 can be configured to accommodate noncritical applications. It enables a "stripped down, low-cost infrastructure with little or no redundancy and/or temperature control." This, according to Manos, may save 20 percent to 40 percent of capital expenditures in building a new datacenter.

Power loads can be moved from critical to noncritical uses as requirements dictate. Moreover, the new Gen 4 datacenters will use less concrete, less copper and less water than traditional datacenters, according to the blog.

Microsoft has been adding about 10,000 servers per month to its datacenters, according to Debra Chrapaty, Microsoft’s corporate vice president of Global Foundation Services. The buildouts will help serve up Microsoft's growing catalog of online offerings, according to Manos.

"At Microsoft, we are not a one trick pony and have many Online products and services (240+) that require different levels of operational support," Manos said in the blog. "We understand that and ensured that we addressed it in our design…."



‘Twilight’ Soundtrack To Be Previewed At Hot Topic Listening Parties
Security Concerns May Slow Cloud Computing Adoption
Paramore’s ‘Twilight’ Song ‘Decode’ Premieres On Stephenie Meyer’s Web Site
Amazon To Host Microsoft Solutions in the Cloud

Web PI Gains XP, Windows 2003 Support

Facing criticism that the beta of its Web Platform Installer didn't support Windows XP and Windows Server 2003, Microsoft addressed that complaint with the release candidate made available yesterday.

Web PI is a free tool designed to bring together the latest iteration of Internet Information Server, ASP.NET, Visual Web Developer Express, SQL Server and the .NET Framework that Microsoft announced two months ago.

"Web PI offers a simple experience for downloading and installing the entire stack through a single installer to help you obtain the software you need to build and run a complete Web solution on the Microsoft Web platform," wrote Bill Staples General Manager of Microsoft's Web Platform and Tools engineering teams in a blog posting announcing the release.

Among those who criticized the lack of Windows XP support was Scott Hanselman, senior program manager in Microsoft's developer division. In a blog posting yesterday, Hanselman applauded the added platform support.

"How ya like me now, son?," he wrote. "Also works for Server 2003, so that's cool." Hanselman also pointed out Web PI's inclusion of the ASP.NET MVC beta, URL Scan 3.1 (designed to provide protection against SQL injection attacks) and IIS 7.0 Manager, which allows organizations to manage IIS 7 from Windows XP-based machines.

Complimenting the release of Web PI, Microsoft also launched Web App Installer, a free tool that provides a single way for Web developers to gather ASP.NET and PHP-based open source Web apps. Still in beta, Web AI consists of a suite of Web applications that include Drupal, DotNetNuke, Graffiti, Gallery, OS Commerce, Wordpress and PHPBB. Though Microsoft hadn't determined plans for Web AI at the time, the company is now planning a release candidate by mid-2009, according to Lauren Cooney, Microsoft's group product manager, Web Platform and Standards.

The Web PI release candidate can be downloaded here.



Vista SP2 Goes Out in Limited Beta
Microsoft Unleashes Tool For Web Developers
Fact-Checking Oliver Stone’s ‘W.’ — Is The Film True To Life?
Paramore’s ‘Twilight’ Song ‘Decode’ Premieres On Stephenie Meyer’s Web Site

Researchers Find Vista Kernel Memory Security Bug

Windows Vista may have a potential buffer-overflow security problem, according to researchers at Innsbruck, Austria-based enterprise security firm Phion. On Friday, the researchers described an exploit involving the iphlpapi.dll application programming interface.

The researchers passed illegal PrefixLength values to routing tables using the CreateIpForwardEntry2 method. It corrupted Vista's kernel space memory, they explained.

"When adding a route entry to the IPv4 routing table using the method CreateIpForwardEntry2 and passing an illegal value greater than 32 [2] for the destination PrefixLength member in the DestinationPrefix structure contained in the MIB_IPFORWARD_ROW2 structure [3], kernel space memory is being corrupted resulting in random blue screen crashes," wrote Thomas Unterleitner, a member of Phion's research team.

The team had used a program to corrupt Vista's memory. However, they also tried passing illegal values using the "route add" command and got the same results.

The problem affects security at the client level and could enable code injection, according to Unterleitner. However, the exploit requires administrative privileges to carry it out. A spokesperson for the Microsoft Security Response Center said in an e-mailed response that they were unaware of any affects on customers.

"To exploit the vulnerability, the attacker would have to already be a privileged user on the system; either an Administrator or part of the network administrator's group, which limits the impact of this attack to users that already have a high-level of trust on the system," the spokesperson wrote.

Phion first informed Microsoft of the problem on Oct. 22. The company is providing a workaround solution for users of its netfence entegra client security solution. However, Microsoft's spokesperson wrote that the company can't vouch for "third party security updates or mitigations."

The Microsoft spokesperson did not say when the company planned to issue a fix, but Unterleitner told ZDNet UK that "Microsoft will ship a fix for this exploit with the next Vista service pack."

Windows Vista Service Pack 2 Beta was released to private testers in late October, but the final release awaits meeting certain quality improvements, according to Mike Nash, Microsoft's corporate vice president for Windows product management, in an announcement. No date for Vista SP 2 is specified as yet.

The exploit affected Vista Enterprise and Vista Ultimate editions, but it likely affects other Vista versions, Unterleitner wrote. Windows XP is not subject to this buffer-overflow security problem.


Microsoft Ups Exploit Code Warning
Microsoft Faced Big Issues in Fixing SMB Hole
‘Twilight’ Event Turns Ugly When Thousands More Fans Show Up Than Expected