Microsoft Responds to SP2 Security Center Issue

Advertisement (Why?)

Microsoft has responded to Neowin with regard to the XP SP 2 problem story we ran yesterday, as reported by PC Magazine & e-Week. The open letter is an unedited version of what we received early this morning.

Dear Neowin,

We wanted to alert you to some misguided press reports that may cause Microsoft customers undue concern. Some articles have posted that claim there is a highly critical vulnerability that would allow a malicious user to spoof the Windows Security Center in Windows XP SP2 however this claim is not accurate. we don’t know how closely you have been following this issue, but we wanted to make sure you had the facts from Microsoft.

As you know Windows Security Center, found in the Windows XP Control panel, provides customers the ability to easily check the status of essential security functionalities such as firewalls, automatic updates and antivirus. Windows Security Center will inform users whether key security capabilities are turned on and up to date and will notify users if it appears that updates need to be made or if additional action steps may need to be taken to help them get more secure.

To clarify, there is not a vulnerability in the Windows Security Center. In order for an attacker to spoof the Windows Security Center, he or she would have to have local administrator rights on the computer (ed. XP Homes default user is 'Admin', and many XP Pro users set their account to admin status for a hassle free life). If an attacker were granted access to a user’s system, either by being granted them or attaining them by enticing a user to open a malicious attachment, the criminal actions the attacker could pursue include many that are far more serious than just spoofing the Windows Security Center. In Windows XP SP2, we have added functionality to reduce the likelihood of unknown applications from running on the user’s system including turning Windows Firewall on by default, Data Execution Prevention and Attachment Manager in Outlook Express, to name a few.

All the best,
Windows Community Team

View: Neowin: Win XP Sp2 Problem?

Build 9 24 August 2004

* Version number incremented to 1.1
* Redesigned user interface
* Added right click context menu to profile list on main window
* Added new services to service help (including new XP SP2 services)
* Added colors and minor modications to text window logging to fsasctl
* Added additional support for terminating the desktop (explorer.exe)
* Added running programs filter to programs window
* Added Tools menu option to allow user to set Program Options and launch the Service Manager
* Added Tool Tip help througout the program (can be disabled via Program Options)
* Added abilty to shutdown or restart the computer after fsasctl has finished execution (not available for Windows 9x/ME)
* Fixed bug where Comments embedded in program executables were not being displayed properly in the programs window

(15 replies) #1 moeburn on 27 Aug 2004 - 19:41

I just visited a website with IE6.0 and SP2, and it installed 72 adware programs on my harddrive (prescan with ad-aware, then postscan with ad-aware, 72 was the difference.). Don't bullsiht us, microsoft.

#1.1 warwagon on 27 Aug 2004 - 19:46

thats your own fault, use firefox

#1.2 primortal on 27 Aug 2004 - 19:49

can you post the website so all of us with SP2 also get 72 adware programs installed and see if it true....

#1.3 Hurmoth on 27 Aug 2004 - 19:52

72 adware programs just like that ... Do you have WinXP SP2? Because I haven't seen this at all ... maybe you are the one bull****ting us!

#1.4 Fluffy2k on 27 Aug 2004 - 19:56

If you click yes to install on those ActiveX boxes on certain websites then yes it will install whatever the heck it wants, but it's not going to install them without YOU saying YES.

#1.5 Ely on 27 Aug 2004 - 19:58

You are FULL of it, That's the fact, stop thinking you are talking to idiots. Where's that site?

#1.6 brhinescot on 27 Aug 2004 - 19:59

Total lie. If anything ad-aware may of been showing you tracking cookies. I don't know, I don't use it. I do know Active-X controls or exe's arent going to run unless you say its ok. Where is your proof? Where is the site? I'd love to test this myself.

#1.7 digitalslacker on 27 Aug 2004 - 20:04

"Do you want to install content from provider GAIN"
YES
*lots of popups*
I HATE MICROSOFT!

things like that don't just happen, either your security settings are too low or you let the active x component run.

#1.8 NetRyder on 27 Aug 2004 - 20:15

Looking for pr0n/warez? Moron...

#1.9 IntelliMoo on 27 Aug 2004 - 20:35

Oh my gosh! I enter an address and clicked the Go button, and IE went to the address without asking me! It should have asked me if I really wanted to go there! I can't believe it, SP2 stinks!

#1.10 Hurmoth on 27 Aug 2004 - 20:53

DAMN IE!

#1.11 Jugalator on 28 Aug 2004 - 12:50

QUOTE

Go here: http://www.mikx.de/scrollbar/
... with Windows XP SP2 and IE.

Now drag the scrollbar and check what went in your autostart folder.

#1.12 STV on 28 Aug 2004 - 17:04

nothing happened. oh yeah, almost forgot, you can set up IE to where it wont allow things like that to download. this is more a case of user error and is not IE's problem.

STV

#1.13 dkldkldkl on 29 Aug 2004 - 10:35

Who drags the scrollbar these days, when all mice are have the scrolling wheel?

Unlike STV, I was able to reproduce it.

#1.14 STV on 29 Aug 2004 - 20:15

just for kicks, set your security level in IE to high. then go to that page. and youll see what i mean.

STV

#1.15 noyb on 29 Aug 2004 - 23:13

Problem is your the minority, most people don't know or don't think to change any security settings on their computers. MS need to fix their security so even at default levels users are safe.

(9 replies) #2 Kracal on 27 Aug 2004 - 19:48

I think he is bull****ting anyway

Moeburn that is...

#2.1 thenay on 27 Aug 2004 - 19:55

I never had any spyware after installin SP2

#2.2 ramik on 27 Aug 2004 - 20:39

i never had spyware at any time....

i am not among those users classified as stupid, i don't accept strange emails, never say Yes to any activeX...

#2.3 MoRiA on 27 Aug 2004 - 20:44

Yup. Same here. Since installing SP2 and customising my IE Privacy settings to block all 3rd party cookies ad-aware has been unable to find any spyware/adware or even tracking cookies. So either suddenly ad-aware is detecting nothing or SP2 is a godsend

Almost forgot. Spy bot search & destroy fanboys, this is NOT an invite for you to flame ad-aware. Kthx

#2.4 chacho on 27 Aug 2004 - 21:42

use the damn reply button.

#2.5 Kracal on 27 Aug 2004 - 22:01

you mean quote?

Either way, I clicked the wrong one..

#2.6 D-j-M on 28 Aug 2004 - 00:34

No, he means reply. Just like I'm doing now.

#2.7 T-Metal on 28 Aug 2004 - 01:31

Sometimes the forums here behave differently than expected. Sometimes it automatically makes a new comment, ignoring the reply button. VERY annoying bug.

#2.8 DOGglee on 28 Aug 2004 - 16:08

#2.9 T-Metal on 29 Aug 2004 - 11:44

#3 DJ Prem on 27 Aug 2004 - 19:57

stop bulling around

#4 905punk on 27 Aug 2004 - 19:58

that must be one hell of a warez/porn site for more then 72 seperate pieces of data miners and attempted browser hijacks and cookies.

(1 reply) #5 wa22guy on 27 Aug 2004 - 20:02

Microsoft is completely right in this situation... people are stupid!

#5.1 mleonc on 27 Aug 2004 - 21:37

So we are all stupid - Microsoft thinking.

(2 replies) #6 Steffan on 27 Aug 2004 - 20:04

I think MS finally realize the problem and they are trying to cover their rear-end.

#6.1 SquareSoft0 on 27 Aug 2004 - 20:24

Soooo.... proving for a fact that the falsely reported security center problem does NOT in fact have the easily completed spoof which has been hovering around the lower end news websites is covering their rear-end? Get it through your heads that the vast majority of 'hacks' and other such inconveniences are 'user input errors.' Most ignorant comments like that have come from people that haven't read the article's actual link, this time the ENTIRE bit of info is on Neowin's page and you STILL failed to read it. To have this 'spoof' take place, the 'hacker' must either trick an ignorant user such as yourself to run a 'hack' to allow them admin rights, or physically ALLOW them on the computer with an admin password. Microsoft will fix all urgent security flaws, but they will NOT send out patches to stop you from ****ing up your own machine.

#6.2 Phasma on 28 Aug 2004 - 00:09

Nicely put SquareSoft! I totally agree.

#7 tronmaster on 27 Aug 2004 - 20:06

Great repky from MS! :thumbs up:

(6 replies) #8 Puma on 27 Aug 2004 - 20:20

Good job Neowin!

#8.1 Z3r0 on 27 Aug 2004 - 20:29

Bad Job Neowin, once again posting hyped up stories.
Good job Microsoft making a quality product.

#8.2 mleonc on 27 Aug 2004 - 21:40

Quality my A-S-S

#8.3 insurektion on 27 Aug 2004 - 23:41

no one is forcing your ass to use windows. dont like it move along. linux is waiting with open arms.

#8.4 mleonc on 28 Aug 2004 - 02:13

I use Slackware

#8.5 feverish- on 28 Aug 2004 - 03:56

Want a cookie? I use both XP and slackware, am I special too?

#8.6 icebrain on 29 Aug 2004 - 10:16

<sarcasm>slackware?! i use gentoo, i compile my own kernel and all the **** that i use ... so what am i? linux-god?</sarcasm>

j/k

(9 replies) #9 Magallanes on 27 Aug 2004 - 20:29

Anyone use XP in non-admin mode?

#9.1 Jason on 27 Aug 2004 - 20:32

All corporate users not including IT staff should be part of the Users group or similar but not the admin one.

#9.2 Lurchybaby on 27 Aug 2004 - 20:34

Yes, my users do. They're dumb enough and manage to screw things up w/o admin rights...i'd hate to see what they'd be capable of WITH admin rights. =)

#9.3 noyb on 27 Aug 2004 - 20:46

XP should not be running with admin privileges as a default user account. So many problems would be solved if XP ran on a least privileges access system, it may be acceptable for someone who knows what they are doing with their machine, but not at all needed, typing an admin password is hardly an inconvinience. The point is, and is the main thing that is overlooked by most people on neowin is that 99% of people don't know or don't care how to set up their system to be secure, and they should not have to thats the job of the manufacturer of the product.
So next time someone wants to be clever and call others dumb and be down right insulting in doing so, just try and remember that the majority of people don't see computing as a hobby or their chosen career choice and where people should be at least responsible for installing AV and firewall software, pissing around with setting after setting is not something the average user should have to do.

#9.4 Fowen on 27 Aug 2004 - 22:30

noyb: Your thinking is backward. Just like anything else, if the user does not secure their system it is not the manufacturers fault. For instance, If I leave my door unlocked, and wide open, would I blame the lock company or the company that made the door? No. It would be nobody elses fault then the users.

With SP2 Microsoft is basically "locking the door" for the user. No it is not gonna be full proof, nothing will be short of not turning on a computer for "stupid users".

#9.5 noyb on 27 Aug 2004 - 22:57

The least privileges system is an example of where MS has failed to implement a basic form of security common sense, having at as the default on the Home version of XP is just bizzare as its the system that will most likely have inexperienced users on it. Furthermore the amount of services that MS loads for no good reason is just another example of a security failing.

At the end of the day typical users (see how i call them typical and not stupid like the majority of people here) are never going to secure their own systems EVER. MS should have realised this by now and should be looking at taking this burden upon themselves, that would obviously mean taking on more testers and programmers but we are talking about largest and richest software company in the world its not unreasonable.

#9.6 frazell on 28 Aug 2004 - 01:05

noyb...

Home runs in admin by default for two reasons. 1 it dosent have different levels of permission 2 as you said in your earlier post non-computer professionals dont want to learn computers, why put them in a "Guest" account? so they can come screaming "I cant install my copy of BF 1942, says i dont have permission!".

The fact remains the same. MS CANNOT make your machine (or anyone elses) 100% secure, because they are NOT you. To revive the example from an earlier reply, if you left your door unlocked and got robbed you cant blame the lock or door manufacturer. They cant guarentee that you wont lock the door every time you leave. Same with MS they cant determine what a "Malicious" program is, let alone block it. We all hate Ad-Ware, but there are people who use it, knowingly. The moment MS stepped in as a "Police" force in IT they would be hauled back into court. They already went to court for similar actions and lost...

The fact remains the same people are the ones responsible for their machines. In all honesty the "average" user is referred to as dumb with good reason. I dont like to call people dumb, but the "average" user breaks all common sense when they get on a computer. They get an active-x pop-up asking them to install XYZ and they hit "Yes" not because they know what it is, because they want the dialog gone. If they took a few minutes to read it and determine the source then they would be alott safer. Active-X has its problems (no sand-bo

, but one thing it has (and thankfully so) is Digital Signatures. Unlike Email if you see an Active-X pop-up you can be sure its from who it says its from. If you dont know the company why would you accept it? Thats the problem with the "average" user. No matter what we or MS does they will still be the biggest threat to security.

#9.7 tagmonkey200 on 29 Aug 2004 - 14:21

well said noyb... when you buy the lock i'd imagine that in the back or somewhere in the documentation it would recomend that you leave the door locked whilst not in use, also when you buy a lock it is to secure the door. buying xp is like buying a door but without a lock. xp 2 provides a little trap for intruders, how ever users should get a lock and close the door open to security issues. (sorry for making almost **** all sense)

#9.8 Fowen on 30 Aug 2004 - 04:50

I would give you 20$ if you could show me in a lock manual where it actually tells you to lock it when not in use.

#9.9 noyb on 30 Aug 2004 - 05:14

I think your taking the analogy to far. The issue we were reffering to does not mean locking the system down when not in use, it was about keeping the root of the system protected until it needs to be accessed by manual intervention. Windows XP Home edition does not have this facility and Proffessional does not use it by default. by fully implementing using this facility it would go some way in the prevention of spyware, virus attacks and other threats to the user.

However MS do not have the balls to implement such a method of security as they are to worried about developers getting upset about a common place practice, or is it the whole inconvienice of users having to type in a password i can't remember.

(4 replies) #10 bucko on 27 Aug 2004 - 20:33

That's good to here, after writing a review of SP2 on my site then hering Security Center has an exploit I was a bit like oh crap. But good to here m$ says all is ok if you have all the security (hence firewall ENABLED by default etc).

That warez kidie at the top must be browsing porn and clicks yes on everything, good luck in your computing life my friend!

#10.1 MoRiA on 27 Aug 2004 - 20:46

You can't even click 'yes' on everything with SP2.. You don't even get that box any more

You have to manually tell that box to appear with the banner at the top. <3 SP2

#10.2 todd` on 27 Aug 2004 - 22:21

interesting.. i agree with you bucko, but how do you know its warez?

#10.3 frazell on 28 Aug 2004 - 01:06

he was obviously browsing a site not useful for anything...

#10.4 bucko on 29 Aug 2004 - 14:53

It was just a wild guess but most warez sites have 75+ spyware **** he wouldn't get any spyware if he went to neowin.net would he :p

#11 Ely on 27 Aug 2004 - 20:34

I have to agree that Neowin sometimes posts hyped up news, They have a massive user base and should be a little bit more careful when posting such misleading news, because in my opinion the whole SP2 problem article is misleading.

(2 replies) #12 pogz on 27 Aug 2004 - 20:38

Funny how it was the threat of the century and now it's really no big deal. Those news sites really need to hire some better journalists.

#12.1 MadDog on 27 Aug 2004 - 20:45

Neowin.net - Where unprofessional journalism looks better.

#12.2 pogz on 28 Aug 2004 - 01:22

I was talking about the previous article linked, not neowin...

It was at PC Mag and eweek. I think big companies like that could do better.

(4 replies) #13 pctuk on 27 Aug 2004 - 20:40

The point is this: if a virus installed itself, it could register as a firewall/antivirus and reassure the user that he/she was protected, when in fact a virus was causing havoc.

Noob1: I got some e-mail viruses from you the other day
Noob2: No, it can't have been mine - Windows says I'm protected. It must be a forged address or something.

It surely wouldn't be hard to use some kind of signature only allowed to approved programs.

#13.1 Ryster092 on 28 Aug 2004 - 00:34

What Microsoft are trying to say is, that if a virus or a hacker got onto your system and had admin rights, they could do a lot worse than simply fool you into thinking your anti-virus was up to date and turned on when it wasnt!!!

#13.2 frazell on 28 Aug 2004 - 01:10

agreed with the poster before me.

If MS had an "approved" list it would cost companies money to get on that list (as it would cost MS money to evaluate these companies and their software product). That would render any free Anti-Virus tools immediatly incompatible as well as any company who dosent invest. It would have people up in arms against MS on that move. The security center isnt a catch-all solution. Its designed to get the average user more pro-active in their systems security. Just like the seat belt light in a car. Its designed to get you more active in the role of putting your seat belt on, but if you dont then you dont...

#13.3 pctuk on 28 Aug 2004 - 07:51

Of course an anti-virus could cause great damage. However, it would also be fooling the user into thinking everything is OK. That would be worse than if it was just a virus, without reassuring the user.

#13.4 dkldkldkl on 29 Aug 2004 - 10:41

I agree with pctuk, but don't forget that before SP2 there was no security center, so it had never told you that your antivirus is disabled; if you have an active antivirus program with updated definitions, the virus will probably not run since the AV program will stop it, and if you don't it will show you the red shield; the security center doesn't have a green shield in your taskbar when everything seems to be okay, it's just that there is no red shield, so if you don't see a red shield it doesn't tell you not to check anyway if there is a red X sign over your antivirus icon.

(3 replies) #14 Ironman273 on 27 Aug 2004 - 20:43

The hilarious thing is that most of the people that will bash Microsoft over this are the same that, let's say, if Microsoft took away functionality to not allow this to happen, like not allowing you to be administrator on your computer, would be the same people saying that they want to do whatever they feel like because it's their computer.

/longest run-on sentence ever

#14.1 bcronin on 27 Aug 2004 - 21:27

I don't know how MS can sluff this off as only being a problem if someone has admin rights when they ship the OS with admin being the default. Perhaps if they did not do that, everyone wouldn't write applications that required admin in order to run (which is a further disincentive to lowering the account's privilege level). I personally run all my user accounts as Power Users, which I have found to be a decent compromise, but there are still far too many programs that require admin for no good reason in my opinion.

#14.2 Ryster092 on 28 Aug 2004 - 00:35

They are not "sluffing" anything. They are merely saying that if some had admin access to your PC, the security center showing inaccurate information would be the least of your worries.

#14.3 frazell on 28 Aug 2004 - 01:14

bcronin...

They ship it with admin as default because thats what most people are used to. They would be screaming all down MS's throat if MS did anything other, because they would be required to relearn PC's to some degreee.

And I' m a windows developer who has attended tons of MS developer conferences. MS constantly preaches to developers to code for the least capable account and not to use Admin level requirements unless ABSOLUTLY nessasry. You cant fault MS for the mistakes or hamperings of other developers. You should instead contact those developers and complain as in this case they are the ones in the wrong.

(1 reply) #15 nic on 27 Aug 2004 - 20:55

Good letter from Microsoft. And it points out the crucial flaw of the original story, that is: it is harder and would be loss security for an attacker to actually get to the point where they could spoof the security center interface. If an attacker has already made it that far, why would they bother? They've already got control of your computer, they don't need you to click any further.

#15.1 bcronin on 27 Aug 2004 - 21:29

Yes, right, good answer MS, if someone already has admin rights, spoofing security center is the least of your worries. But the OS ships with admin as the default, and so anything that manages to find a way to run on your box without you knowing it can trash your system anyway. Oh yes, that makes me feel so much more comfortable. <sigh>

(11 replies) #16 Breach on 27 Aug 2004 - 21:33

Oh come on! From pure, empyrical experience I do not know one single soul who runs XP on a day-to-day basis with a restricted account. Heh, even the first user one gets to create after doing a fresh XP install (SP2-inclusive) becomes automatically member of the Local Admins group! Pretty much all games require admin access to run, etc. etc...

#16.1 bcronin on 27 Aug 2004 - 21:43

Absolutely right. Even though I know (a bit) better and run as a non-admin PowerUser, I'll bet most Mom and Pop users haven't a clue in this regard and simply take the default. MS's answer is pretty much an admission that SP2's security is a sham. The real problem is that there are so many unwitting admin users out there who can be trashed in far worse ways, despite security center. Fix the problem at the source. Stop making admin the defaultt. Beat up all the software vendors whowrite apps that require admin for no good reason, etc.

#16.2 Ryster092 on 28 Aug 2004 - 00:42

If a hacker breaches the firewall and your antivirus and gains control of your system, then its not gonna matter one iota wether your own account has admin rights or not. They can simply create their own account with admin rights, or hack the ADMINISTRATOR account. This whole debate is a moot point really and all you Anti-MS zealots keep repeating the same old rhetoric. 99% of the time, hackers taking over peoples machines is totally human error (firewall turned off or no firewall at all, antivirus turned off or no antivirus at all, clicking yes on allow boxes, etc). If a user is stupid enough to do one or more of these actions, then they deserve to be infected and hacked and let the security center show what the hacker likes!

#16.3 Mr Mialo on 28 Aug 2004 - 01:23

I try to run my system with only a standard user account but as bcronin says,

Fix the problem at the source. Stop making admin the defaultt. Beat up all the software vendors whowrite apps that require admin for no good reason, etc

An example of this is I bought the Pioneer 107D and use the software that came with it. As a standard user I can only create an image file of the stuff I wish to burn. But as an admin I can create an image and then burn it.

Many windows programs are not created with multiuser in mind.

#16.4 frazell on 28 Aug 2004 - 04:47

Thats not MS's fault, thats the fault of the developer who wrote your piece of software.

BTW get nero it can burn CD's in non admin accounts...

MS constantly tells developers not to develop for admin accounts unless nessasary, but as with people being told not to drink and drive, they still do it.

#16.5 noyb on 28 Aug 2004 - 05:38

I would say that it is the fault of MS that so many software companies are not making software with access rights in mind. MS make the guidelines and should be hammering the message through alot harder than they are, other OS's like OS X and the other *nix variants manage to get developers to work on that arangement so why cant MS.

To be fair to MS i seem to remember them talking about going for a least privilege system for Longhorn. However as todays official announcement shows thats a long way off, and its a measure that should of been implemented years ago.

#16.6 Mr Mialo on 28 Aug 2004 - 07:01

I wonder if MS could change the API to force them to program for multiuser.

BTW how can you make these programs behave nicely for multi-user, is there a way for an adminitrator to do this?

#16.7 noyb on 28 Aug 2004 - 19:11

Sadly no, these guidelines need to be firmly laid out in the initial development of the OS, which in my mind should of been at least XP, it would be near impossible to get developers to change their thinking or programming at this late stage.

#16.8 frazell on 29 Aug 2004 - 00:26

I am a developer and i attend MS developer conferences regularly. They press security and least privilage on the development community as best they can (its a major part of every conference for every technology). There is nothing more they can do about it. Mac and *Nix dosent prevent developers from doing the same things that the majority of Windows developers do. Not every Mac or *Nix application is written to be used outside of root as well. MS has been preaching Multi-User support since NT 3.51 was introduced. The lack of support for it is due to programers not wanting to code for it. If you want programs that stick to MS's guidelines only buy programs bearing the "Designed for Windows ****" Logo.

As i said earlier you cant blame MS for the mistakes of other developers, its not their creation.

#16.9 noyb on 29 Aug 2004 - 00:49

Frazell as i have noted MS makes the guidelines, if the developers fail to comply with the guidlines their software will not work correctly, so if they want to sell software that works correctly to be sold to 95% of computer users they must confirm to the guidelines. Mac and the other *nix platforms have mananged to get this message across to developers, and in most cases they are the same developers working on windows based products aswell. Such a change (and its not a major one) would solve so many security issues with windows so next time your at one of your conferences tell MS to get some balls and really get the message across. MS can make as many service packs as they want but unless they go back to basics on security things are only going to get worse.

#16.10 frazell on 29 Aug 2004 - 05:55

MS does no different than *nix or Apple. They set a guidline that developers "should" follow. Tell me the repercussions for a *nix or Mac developer not following a guidline laid by the respective authorities. The sofware wont run? No the software will run and at most it will pop up a message to the user in a lower account asking them to give higher permissions or not run at all. The same exact thing happens on Windows (i believe someone posted a screen of the Windows RUN AS command above).

Developers and End-Users are a big part of the security problem. MS or any other software vendor creating software that interfaces with other software cant change that. The only solution is to make both developers and end users smarter about security. MS is doing the most they can in that area.

Before you mouth back with another "but *nix developers dont write unnessasry root requiring code" point me to where it says the OS will stop a program running in root from running because it needs root "unnessarily". Because no OS stops any user from logging in as admin/root provided they know the password...

Neowin.net

Microsoft Responds to SP2 Security Center Issue

Share this Article

About the Author

Related news