main

Microsoft to make Longhorn vulnerability-aware

malebolgia   on 26 February 2004 - 15:33 · 30 comments & 2227 views

Advertisement (Why?)
Microsoft Corp. is working on security technologies for the upcoming Longhorn release of Windows that will protect users against security threats by monitoring system and network behavior as well as the security patches that Microsoft has issued. The new technologies will allow Windows to detect irregular system behavior -- in terms of network traffic, memory usage and system calls, for example -- and respond to them automatically, Microsoft Chairman and Chief Software Architect Bill Gates said in a presentation at the RSA Conference in San Francisco Tuesday.

The result of the development effort, which Microsoft refers to as "active protection technologies," should protect systems from worms and viruses by preventing and containing attacks, according to Microsoft. A component of the protection system, dubbed "dynamic system protection," will track which security patches users have installed. The component will make changes to the Windows firewall to fend off any attacks that appear to take advantage of a security flaw that users have not yet patched themselves against. For example, if Microsoft has provided a patch for a flaw involving ActiveX controls, dynamic system protection will block ActiveX controls from running on a Windows system until that patch is installed, Microsoft said.

News source: InfoWorld


Changelog:

  • Almost all components starting from some 0.7 beta SDK still work, though recompilation with new SDK is recommended to take advantage of new features
  • "Open" dialog now lists supported file types
  • File modification time tracking, goodbye "reload file info"
  • File size tracking
  • New menu item config, massively improved menu system
  • Improved matroska component (fully extendable through third-party components, improved speed, etc)
  • Fixed UI glitch in masstagger
  • Masstagger scripts can be now exported to files
  • New diskwriter
  • New albumlist
  • Replaygain shows total progress
  • Toolbar menu now completely fakes regular menu behaviors
  • Found a way to get rid of dreaded beep when pressing alt+key
  • Various minor UI tweaks, improved playlist tabs
  • Fixed multimedia keys displayed in shortcuts page
  • AIFF input fixes
  • FLAC input fixes
  • SDK side change: all uppercase/lowercase character conversion had to be moved to utf8api, some string8 methods are missing (replaced with utf8api functions)
  • New icons, thanks to picmixer
  • Improved drag&drop support, thanks to foosion
  • Improved commandline handling (wildcards, relative paths, etc)
  • Integrated commandline tagger in foo_masstag.dll, run foobar2000 /tag:help for info

  • Post a comment · Send to friend Comments · There are 30 additional comments
    #1 StaticFish on 26 Feb 2004 - 15:37
    Hopefully this will be the last straw for virus writers

    They keep promicing all of this new stuff, spam virus, world peace etc.... but it will be just the sasme in 2-3 years time, mark my words

    ** Disclaimer: things may not actually be the same, and you should in no way take notice of this post
    #2 mrk on 26 Feb 2004 - 15:39
    looks like MS are taking note of everything everyone is saying and implementing measure to better help

    smooth!
    (3 replies) #3 spunk on 26 Feb 2004 - 15:40
    Its a good idea, but hopefully you can turn that feature off. Would be annoying at times per that example.
    #3.1 iguanas on 26 Feb 2004 - 15:51
    surely, but i hope it gets some advanced known of the OS to do this, cause, every "pro user" wannabe will be turning it of, like windows update, and then , the same as the blaster virus, the patch available 2 weeks before the worm is out, and still millions and millions of computers infected.
    #3.2 mram on 26 Feb 2004 - 16:10
    For every one person wanting a feature turned off that actually helps you, there are 100 novices that are bringing down the network around you through simple bad practices on a client workstation.

    Yes, I'm sure there will be GPOs to prevent activity like this, and/or registry keys. But I'd personally want it that difficult. It's about time that MS gets known for a more "hard line" stance on security, rather than allowing simple check boxes to prevent really good practices.
    #3.3 Jugalator on 26 Feb 2004 - 19:20
    QUOTE (#3.0)
    Its a good idea, but hopefully you can turn that feature off.

    Just keep in mind that, to the operating system, a virus can just as well be "you". So if "you" can turn such a feature off, a virus should be able to as well, especially if the user is fooled to launching it. Which is the way most viruses spread today.
    (5 replies) #4 Cryptic_Night on 26 Feb 2004 - 15:49
    Sounds like: "Microsoft will now be able to see if your Windows is a legal copy or not."
    #4.1 iguanas on 26 Feb 2004 - 15:52
    what are you saying, you dont own an original copy of it?
    if yes... why bother?
    #4.2 garymchughuk on 26 Feb 2004 - 16:11
    less piracy may mean reduced price for the OS. But then again... Microsoft wouldnt do this.
    #4.3 ANova on 26 Feb 2004 - 19:15
    Exactly. I hate the fact that MS makes life more difficult for those who actually buy their os then those that pirate it. Things like activation and the os's refusal to boot when the hard drive is transfered from one computer to the next doesn't do anything but aggrivate things. Warez users always easily find a way around it as well.
    #4.4 rogerroger on 26 Feb 2004 - 20:56
    That's right. Warez is all about making things simple. After all, driving to the store and waiting in the checkout lines and then having to get out your wallet is really way to much work. I'd much rather sit on my fat as$ and click-click!
    LOL
    #4.5 tntomek on 26 Feb 2004 - 22:59
    QUOTE (#4.2)
    ess piracy may mean reduced price for the OS

    ROTFL

    I seriously doubt that. Maybe music would be cheaper if people didn't pirate that as well. Those ****ers would just get pocket more.
    #5 MoRiA on 26 Feb 2004 - 16:32
    Good idea, if it works. I for one am fed up with incompetant users getting virii (or viruses, i prefer virii..) and those infected machines annoying the hell out of the rest of us. A few months ago I received hundreds of "returned: recipient unknown" emails caused by whatever virus it was. Anyone care to guess how many times I was infected by that virus? Nill. I wonder why that would be... Ooh look at that? It's a firewall and AV app!

    One friend of mine refuses to run a firewall because last time he tried he set it up to block all traffic regardless (don't ask me how he managed this) so he thinks that all firewalls block all traffic and nothing i can say will convince him otherwise. Another friend (i wonder why i have so many incompetant friends at times..) had Blaster sitting on his computer for weeks because he thought "it would just go away". He knew what it was and he'd applied the patch but the fact that his AV software alerted him every boot didn't seem to make him want to do anything about it.

    My brother *ignores* virus warnings. He'll call me into his room to look at something and by the time i've got there he's closed the alert window and says "It was somethign about a trojan.. Probably a virus..".
    #6 nw_raptor on 26 Feb 2004 - 16:47
    they better make what they say
    #7 divertom15 on 26 Feb 2004 - 17:20
    sounds good
    #8 Starman on 26 Feb 2004 - 17:33
    Imagine all the bandwidth all over the world from CodeRed remnants. The receive light on my cable modem blinks constantly and my log shows tons of CodeRed and other attacks on my system. Anything to prevent users from getting viruses is a good thing!
    (5 replies) #9 ANova on 26 Feb 2004 - 19:12
    I don't much like the fact that we can't use a service until it is patched. Frustration builds up inside of me to the breaking point whenever I feel someone is trying to control an aspect of my life, no matter how small.
    #9.1 mram on 26 Feb 2004 - 20:17
    There are guardrails to prevent you from walking off of high bridges, lookouts, etc.
    There are bumpers to prevent your car from driving off the road.

    There are a million tiny little preventative measures to keep you not only from hurting yourself, but others incidentally.

    This is no different... you take all these things for granted because they are explained to you as part of culture that it is for your protection.

    So is this. The online computing culture needs to change. You may not like it, and I sympathize, but I'm sure it'll be no less inconvenient than any other tool in life.
    #9.2 ANova on 26 Feb 2004 - 22:27
    That's a rather extreme comparison. I believe there are better ways to handle the situation.
    #9.3 mram on 26 Feb 2004 - 22:49
    It isn't any more complicated than any other basic task. I think you are the one taking it to the extreme; who would claim that doing the work to avoid the cutoff based upon an exposed vulnerability is actually more work than performing the fix? What would you recommend as an alternative...? If you think there are better ways, contribute...
    #9.4 compange on 27 Feb 2004 - 04:32
    Remember... There's always Linux if you're looking for true freedom to control every aspect of your system.
    #9.5 mram on 27 Feb 2004 - 06:45
    The true freedom to control everything comes at a price that really is deceptive.

    For example, you can fix your car on your own, too. And cars have been around longer than Linux. So why aren't you a natural born mechanic? Technically, that's easier to learn, too.

    People want simplicity over the ability to do everything. The masses do, anyway. Noone really cares that they don't know how a TV works. They hit a channel, it goes there, that's fine. Nowadays there are more people on the internet than have cable. Do you really truly honestly believe that people will just want Linux because they want control?

    Besides, that actually is more of a cheap shot. It's not like you lose control here, it's that the system auto-updates or auto-secures based upon known vulnerabilities. Would you really want Linux to not do that?
    (2 replies) #10 rogerroger on 26 Feb 2004 - 20:59
    Good response mram. To simplify, if users are too stupid to install AV or a firewall, they really have no business using a computer. This is a step in the right direction for MS. Way to go!
    #10.1 ANova on 26 Feb 2004 - 22:39
    The issue here has nothing to do with whether or not the user has an AV and Firewall, it has to do with services being disabled until they are deemed secure by MS. What if a vulnerability is found for a certain app within windows but MS takes it's sweet time creating a patch? Are we just supposed to stop everything we're doing and wait for them? The world doesn't work like that. Again, I only see this as detrimental more then anything else. Sure it's on the right track and some would say necessary for people who don't know anything about computers but for those of us who do know what we are doing it's just a pain in the ass. As well I predict these computer illiterate customers will start complaining about their programs not working rather then patch their systems.
    #10.2 mram on 26 Feb 2004 - 22:52
    QUOTE
    services being disabled until they are deemed secure by MS

    You're taking this highly out of context.

    I read this as: If windows update shows a critical update in RPC services, then the client's RPC service exposure will be hardened until the update is loaded.

    It isn't like big brother is watching over you. It's a way to allow intelligent protection based upon known holes that Microsoft has already published fixes for.
    #11 toadeater on 26 Feb 2004 - 21:05
    I've only gotten a virus once in my life, and that was from a coworker who gave me an infected disk that I didn't think of checking first back then. Now I check everything that comes near my computer. Viruses are made possible mostly because of user stupidity, they are easy to deal with.
    #12 Trix on 26 Feb 2004 - 22:27
    there making that whatever-net from terminator!! longhorns going to take over the world!!
    #13 Ely on 26 Feb 2004 - 22:32
    Two thumbs up for this new features on LongHorn, This should be something XP already had, but well at least we will have it within a few years.
    #14 Ivand on 26 Feb 2004 - 22:38
    Trix, Skynet

    I think its a good feature, unless they use a good idea at the MS way, as they always do I must add, and turn it into something annoying ( like the office assistant )
    #15 an0maly on 26 Feb 2004 - 22:42
    lol there must be a way to get fools off the net.
    i mean i know at least 20 people who call themselves computer experts [LOL] who dont know what a firewall does or they dont know that downloading a file named [for example] picname.jpg.exe is a virus.
    i think these people should be kept off pc's maybe a test is needed when u get a pc? lol.

    Commenting has either been disabled on this article or you are not logged in. Click here to login or register, its free!

    Note: Anonymous commenting is disabled in order to keep the quality of responses to a high standard.

    Advertisement (Why?)