Cyber Security Strategy

Thursday 7 April 2011

Microsoft Security Updates - April 2011

Operation b107 - Rustock Botnet Takedown - Using the knowledge gained during its takedown of the botnet Waledac just over a year ago, the Microsoft Digital Crimes Unit (DCU) has successfully taken down a larger, more notorious and complex botnet known as Rustock, which had an estimated infection count above one million computers and was capable of sending billions of spam messages per day. Learn more more on The Official Microsoft Blog

Earthquake in Japan- How to Help While Avoiding Donation Fraud - When we hear about a disaster like the earthquake in Japan, many of us try to think of ways we can help. Read this Security Tips & Talk blog post for valuable tips you can pass on to your end users to help them avoid online donation scams.

Microsoft Security Bulletin Summary for March, 2011
http://www.microsoft.com/technet/security/bulletin/ms11-mar.mspx
Security Bulletin Overview for March 2011
Microsoft Security Response Center (MSRC) Blog Post http://go.microsoft.com/?linkid=9683067

Forefront Security TechCenter - http://technet.microsoft.com/en-gb/forefront/default.aspx
Please note that if you have feedback on documentation or wish to request new documents - email isadocs@microsoft.com

Forefront Threat Management Gateway 2010 homepage
http://technet.microsoft.com/en-gb/forefront/ee807302.aspx

The ISA Server Product Team Blog (http://blogs.technet.com/isablog/) is updated on a regular basis. Latest entries include:
New WIKI Article by Yuri Diogenes–”Forefront TMG 2010 Survival Guide”
http://blogs.technet.com/b/isablog/archive/2011/02/27/new-wiki-article-by-yuri-diogenes-forefront-tmg-2010-survival-guide.aspx

Forefront Unified Access Gateway 2010 Technical Resources
http://technet.microsoft.com/en-gb/forefront/edgesecurity/ee907407.aspx
For comments, feedback, and requests, contact the Forefront UAG User Assistance team at uagdocs@microsoft.com.
Forefront Unified Access Gateway Product Team Blog
The UAG Product Team Blog (http://blogs.technet.com/edgeaccessblog) is updated on a regular basis. Latest entries include:
No place like HOD
http://blogs.technet.com/b/edgeaccessblog/archive/2011/03/15/no-place-like-hod.aspx

Security Tip of the Month- Improving Security Using Attack Surface Analyzer - Learn how to use Attack Surface Analyzer, a free tool from Microsoft, to better understand the aggregate attack surface change that may result from the introduction of line-of-business (LOB) applications to the Windows platform.

Microsoft Security Compliance Manager - The Microsoft Security Compliance Manager (SCM) will help you plan, deploy, operate, and manage your security baselines for the most widely used Microsoft technologies. Learn more about this free tool—which includes security baselines for Windows Server 2008 R2, Microsoft Office 2010, Windows 7, and Internet Explorer8—then check out tips for getting started and answers to answers to frequently asked questions.

Infrastructure Planning and Design Guide for Malware Response - Looking to limit the risk of malware infection? This new guide can help your organization determine the best and most cost-effective response strategy for malware outbreaks. Learn how your quick decisions can return systems to operation while limiting your exposure then download the guide.

Malicious Software Removal Tool - Need to check your computers for malware infection? Download the Microsoft Windows Malicious Software Removal Tool. Updated monthly and available in x86 and x64 versions, the tool checks Windows Vista, Windows 7, Windows XP, Windows 2000, and Windows Server 2003 computers for, and helps remove, infections by specific, prevalent malicious software-including Blaster, Sasser, and Mydoom. When the detection and removal process is complete, the tool displays a report describing the outcome including which, if any, malicious software was detected and removed.

Getting Started with the SDL Threat Modeling Tool - Find tips to help you get started with the Microsoft Security Development Lifecycle (SDL) threat modeling approach and learn how to use the tool to develop great threat models as a backbone of your security process. Available as a free download, the SDL SDL Threat Modeling Tool helps engineers analyze the security of their systems to find and address design issues early in the software lifecycle.

Microsoft Baseline Security Analyzer- Frequently Asked Questions - Get answers to frequently asked questions about Microsoft Baseline Security Analyzer (MBSA) 2.2 including system requirements, configuration, scanning, and reporting. MBSA 2.2 provides a streamlined method for IT pros to identify missing security updates and common security misconfigurations.

Detecting Security Bulletins with the Extended Security Update Inventory Tool - The Extended Security Update Inventory Tool is designed to help IT pros identify Microsoft Systems Management Server (SMS) client computers that may need security updates that are not detectable using the existing SMS Security Update Inventory Tool built on MBSA.

Downloads

Keeping Enterprise Data Safe with Office 2010
Keeping Enterprise Data Safe with Office 2010 - Office 2010 Security Whitepaper
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=4a9e2382-f375-43bf-b5d6-dcf9df5c3e37

Business Intelligence Competency Center (BICC) Core System Documentation: Encoding and Unicode Considerations
Describes what you need to know when dealing with Encoding and Unicode in applications built on top of Microsoft solutions.
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=4b8c3058-0821-492a-ad3d-5e8ad9a5e9d1

Microsoft Forefront Online Protection for Exchange Service Level Agreement (SLA)
This document has been moved. Please update your links and bookmarks with the new location, listed below.
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=f5714ed7-f14d-499e-b7d9-3365c9008113

NTFS Chkdsk Best Practices and Performance
This document provides best practices for using NTFS Chkdsk.
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=35a658cb-5dc7-4c46-b54c-8f3089ac097a

QFE Rollup Package 2 for System Center Data Protection Manager 2010
This download fixes issues in Microsoft System Center Data Protection Manager (DPM) 2010
Please read KB article 2465832 for complete information.
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=d3fabb18-1adb-4c87-a95d-d3c3826d5bfb

Microsoft Exchange Hosted Archive Service Level Agreement (SLA)
This document has been moved. Please update your links and bookmarks with the new location, listed below.
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=01c1168f-8f59-4746-9b42-f1166bb7142d

AD CS Step-By-Step Guide
This document describes the steps needed to set up a basic public key infrastructure.
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=44315bff-b744-4637-a66b-e69b4955ee45

Update for Windows Mail Junk E-mail Filter [March 2011] (KB905866)
Install this update for Windows Mail to revise the definition files that are used to detect e-mail messages that should be considered junk e-mail or that may contain phishing content.
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=aa029fde-f341-44fc-8b85-0c6f3d3c2d69

Microsoft® Windows® Malicious Software Removal Tool (KB890830)
This tool checks your computer for infection by specific, prevalent malicious software (including Blaster, Sasser, and Mydoom) and helps to remove the infection if it is found. Microsoft will release an updated version of this tool on the second Tuesday of each month.
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=ad724ae0-e72d-4f54-9ab3-75b8eb148356

Microsoft® Windows® Malicious Software Removal Tool (KB890830) x64
This tool checks your computer for infection by specific, prevalent malicious software (including Blaster, Sasser, and Mydoom) and helps to remove the infection if it is found. Microsoft will release an updated version of this tool on the second Tuesday of each month.
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=585d2bde-367f-495e-94e7-6349f4effc74

March 2011 Security Release ISO Image
This DVD5 ISO image file contains the security updates for Windows released on Windows Update on March 11th, 2011.
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=ab55654c-c685-4316-93fc-e3a80cccac71

Suite B PKI in Windows Server 2008
This document provides guidance for the planning and implementation of a Microsoft Windows Server 2008 and Windows Server 2008 R2 public key infrastructure (PKI) using Suite B compliant cryptographic algorithms
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=6f319ffa-739e-4fe8-bac3-92547baef7a9

Cross-forest Certificate Enrollment with Windows Server 2008 R2.doc
This paper explains how cross-forest certificate enrollment works. It also provides deployment guidance for cross-forest certificate enrollment in new and existing Active Directory Certificate Services (AD CS) deployments.
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=d408be72-7c74-4b19-a2de-fa11858c30b2

Configuring and Troubleshooting Certification Authority Clustering in Windows Server 2008 and Windows Server 2008 R2
This guide describes how to install, configure, and troubleshoot failover clustering with Active Directory Certificate Services in Windows Server 2008 and Windows Server 2008 R2.
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=15c75333-be26-4955-a32c-03077daf1631

Certificate Enrollment Web Services in Windows Server 2008 R2
This paper explains how certificate enrollment Web services work in Windows Server 2008 R2. It also provides deployment guidance for certificate enrollment Web services in new and existing Active Directory Certificate Services (AD CS) deployments.
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=28b910f8-6374-48dd-a897-11fff62ab795

Active Directory Certificate Services (AD CS)
This download center location contains information related to administering Active Directory Certificate Services (AD CS)
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=d9cbaab9-552b-45f0-a8ac-b3cb4009f068

Microsoft SCEP Implementation Whitepaper.
This whitepaper provides an overview of Microsoft implementation for SCEP in the Windows Server 2008 R2
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=e11780de-819f-40d7-8b8e-10845bc8d446

Active Directory Certificate Services Upgrade and Migration Guidance
This document discusses the planning and implementation of a Windows Server 2008 Active Directory Certificate Services (AD CS) upgrade and migration from an existing Windows public key infrastructure (PKI), including scenarios and step-by-step instruction.
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=c70bd7cd-9f03-484b-8c4b-279bc29a3413

Webapps_Webcast_series_Jan_2011_videos
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=a33b795b-f529-4a20-9335-ae2281e756cf

Microsoft IT CISO Perspective on Cloud Security
In this session, you will hear directly from Microsoft’s CISO as he shares his perspective on cloud security.
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=d48897ce-e0f5-4bde-a480-c1d6378578b8

Microsoft Forefront Endpoint Protection 2012 Privacy Statement
Microsoft Forefront Endpoint Protection 2012 Privacy Statement
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=e72065f9-c08d-4c50-b785-b98416b530e3

SharePoint Server 2010 site and content security worksheet
Use this worksheet to record inherited and unique permissions, and record which groups need what level of access.
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=478a6cdf-8b3c-4b2e-993f-be07715466a6

SharePoint Foundation 2010 site and content security worksheet
Use this worksheet to record inherited and unique permissions, and record which groups need what level of access.
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=3ce0858d-0d59-4f70-8a55-1e493ea7c742

Events/WebCasts

Security Webcast Calendar http://go.microsoft.com/fwlink/?LinkId=37910
Find security webcasts listed in an easy-to-use calendar format.

Upcoming Security Webcasts
http://www.microsoft.com/events/security/upcoming.mspx

MSDN Webcast: Security Talk: Using the Attack Surface Analyzer (Level 200)
Thursday, April 07, 2011 1:00 P.M.-2:00 P.M. Pacific Time
TechNet Webcast: Information About Microsoft April Security Bulletins (Level 200)
Wednesday, April 13, 2011 11:00 A.M.-12:00 P.M. Pacific Time

On-Demand Security Webcasts
http://www.microsoft.com/events/security/ondemand.mspx

News

Windows Internet Explorer 9 Released to Web
You can now download Internet Explorer 9. Check out the latest features for IT professionals, and get guidance to help you pilot and deploy this enterprise-ready browser in your organization with the Springboard Series for Internet Explorer 9.
http://windows.microsoft.com/en-US/internet-explorer/products/ie/home
http://technet.microsoft.com/en-us/ie/default

Visual Studio 2010 Service Pack 1 now available
Visual Studio 2010 Service Pack 1 includes a host of improvements and fixes based on your feedback, including a local Help Viewer, Silverlight performance tuning, .NET 3.5 unit testing, IntelliTrace for 64-bit and SharePoint, and much, much more.
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=75568aa6-8107-475d-948a-ef22627e57a5&displaylang=en

Microsoft App-V 4.6 Service Pack 1 and MED-V 2.0 Released
Microsoft Desktop Optimization Pack (MDOP) 2011, featuring Microsoft App-V 4.6 Service Pack 1 (SP1) and MED-V 2.0, is now available. App-V 4.6 SP1 makes App-V packaging easy, fast, and predictable, and MED-V 2.0 is easier to use than ever, with no dedicated infrastructure required
http://blogs.technet.com/b/mdop/archive/2011/03/09/app-v-4-6-sp1-and-med-v-2-0-are-available-as-part-of-mdop-2011.aspx

Downloads

Group Policy Settings Reference Windows Internet Explorer 9
This spreadsheet lists the policy settings for computer and user configurations included in the administrative template files (admx/adml) delivered with Windows Internet Explorer 9.
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=21e84c24-b967-4d6d-850a-5eb554d18447

VMM 2012 Beta Eval (VHD)
System Center Virtual Machine Manager 2012 delivers industry leading fabric managment, virtual machine management and services deployment in private cloud environments.
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=76002803-4fe8-4573-a76d-6b2b11adfe58

System Center Virtual Machine Manager (VMM) 2012 Beta Documentation
This download provides technical documentation for the Beta release of VMM 2012.
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=f7c174f2-1d39-4fed-9778-3f41b84f744b

Server App-V Beta Documentation
The beta documentation for Microsoft Server Application Virtualization (Server App-V) is available in this download.
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=d24bbf9b-9d9c-4966-90e5-575852c9258b

Microsoft Windows Server 2008 Hyper-V Common Criteria Guide
This is the supplemental administrator guidance documentation that was used in the Common Criteria evaluation of Microsoft Windows Server 2008 Hyper-V.
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=cb19538d-9e13-4ab6-af38-8f48abfdad08

System Center Virtual Machine Manager 2008 R2 Service Pack 1 – Evaluation
System Center Virtual Machine Manager 2008 R2 SP1 (VMM) is a comprehensive management solution for the virtualized data center. It enables increased physical server utilization, centralized management of virtual machine infrastructure, and rapid provisioning of new virtual machines by the administrator, delegated administrator, and authorized end users.
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=9189bbce-d970-4c6c-9dd3-9e65798ecd70

BranchCache Learning Roadmap
This learning roadmap provides you with links to prerequisite information you need to understand and deploy BranchCache, and also provides links to BranchCache information from level 100 to level 300. In addition there are links to optional information that will enhance your ability to expand and manage your BranchCache deployment.
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=cda652cf-c954-4b78-9e1b-7a660dc3b867

Microsoft Desktop Virtualization Data Sheets
Learn how Microsoft Desktop Virtualization Solutions can empower organizations to provide employees with the flexibility to work everywhere on a range of devices, while simplifying compliance and business continuity through a centralized and unified management infrastructure.
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=81d1d1b8-e0e2-43c1-be91-6a5382f8ac39

Managing Microsoft Desktop Virtualization
Learn about managing desktop virtualization solutions with Microsoft technologies..
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=59e220ee-e7a1-4f8e-a86a-538b854c5e18

Microsoft RemoteFX for Remote Desktop Virtualization Host Capacity Planning Guide for Windows Server 2008 R2 Service Pack 1
This white paper is intended as a guide for capacity planning of Microsoft RemoteFX in Windows Server 2008 R2 Service Pack 1.
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=679193cb-9b74-4590-a2be-00bde429c990

Remote Desktop Session Host Capacity Planning in Windows Server 2008 R2 and Microsoft RemoteFX in Windows Server 2008 R2 with Service Pack 1
This white paper is intended as a guide for capacity planning of RD Session Host in Windows Server 2008 R2 and RemoteFX in Windows Server 2008 R2 with Service Pack 1 (SP1).
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=ca837962-4128-4680-b1c0-ad0985939063

Events/Webcasts
Full list can be found at: http://www.microsoft.com/events/default.mspx

Interactive Webcast Calendar
The interactive calendar will help you quickly find live webcasts that fit your schedule as well as on-demand webcasts to view at your convenience. You can choose your time zone and filter this list by audience, webcast series, product or topic, and presenter.
http://www.microsoft.com/events/webcasts/calendar/monthview.aspx

Monthly Archived Webcasts:
http://www.microsoft.com/events/webcasts/library/default.mspx

April WebCast Calendar
http://www.microsoft.com/events/webcasts/calendar/MonthView.aspx?stdate=4/1/2011&audience=0&series=0&product=0&presenter=0&tz=0

New KB's
Problems with Windows 7 parsing MCCS information - http://support.microsoft.com/kb/2515532
“Access Denied” error trying to rename a file on share available offline -
http://support.microsoft.com/kb/2457622
Event ID 7000 or 7026 may be logged in the System log on a computer that is running Windows 7, Windows Vista, Windows Server 2008 R2, or Windows Server 2008 - http://support.microsoft.com/kb/933757
Error message when installing RSAT: 'This update is not applicable to your computer' - http://support.microsoft.com/kb/2517239
Display Changes Resolution on Windows 7 While Pressing Win+P Hot Key and Select Duplicate When Only One Monitor is Connected -
http://support.microsoft.com/kb/2518084
The GetGlyphOutline() function incorrectly returns glyphs from the GulimChe font in Windows 7 - http://support.microsoft.com/kb/2447659
A DNS Update is recorded as failed: Event ID 5774, 1196, or 1578 - http://support.microsoft.com/kb/977158
Windows 7 stops responding when you print to a Bluetooth printer - http://support.microsoft.com/kb/2461648
[SDP 3][506d1864-dc2a-493c-be61-defc84fbcd60] Volume License Activation - Windows 7 and Windows Server 2008 R2 - http://support.microsoft.com/kb/2518799
[SDP 3][10678477-8f52-4968-8848-01305cbcc3c1] Performance - Windows 7 and Server 2008 R2 - http://support.microsoft.com/kb/2516512
Microsoft inbox DSM may not perform well on system with many processors - http://support.microsoft.com/kb/2517251
Using Hyper-V with large sector drives on Windows Server 2008 and Windows Server 2008 R2 - http://support.microsoft.com/kb/2515143
Remote Desktop or RemoteApp session does not terminate due to spawned splwow64.exe process - http://support.microsoft.com/kb/2513330
Physical Memory Limits in Crash Dump files for Windows 7 and Windows 2008 R2 - http://support.microsoft.com/kb/2510168
Group Policy Editor incorrectly displays value for drop-down box data in Group Policy settings if opened maximized - http://support.microsoft.com/kb/2494205
The DNS Zone Transfer setting is not retained in Windows Server 2008 - http://support.microsoft.com/kb/2514953
You cannot manage a remote DNS server by using RSAT or the DNS MMC on Window Server-based computers - http://support.microsoft.com/kb/2514936
A static record is not updated to a dynamic record as expected in the Windows Server MMC - http://support.microsoft.com/kb/2514994
Directory Services - Windows 7 and Server 2008 R2 - http://support.microsoft.com/kb/2515358
A hotfix is available to update the Daylight Saving Time for Chile for Windows Operating Systems - http://support.microsoft.com/kb/2519231
MS11-015: Description of the security update for Windows XP Media Center Edition 2005: March 8, 2011 - http://support.microsoft.com/kb/2502898
MS11-017: Description of the security update for Remote Desktop client 5.2: March 8, 2011 - http://support.microsoft.com/kb/2483618
Offline File Synchronization – In Windows 7 the "Work Offline/Work Online" option button disappears from Windows Explorer after an offline / online transition and the Client Side Cache remains offline until the next restart of the computer - http://support.microsoft.com/kb/2512089
A device may be displayed as the default icon on the network map when the network has more than 10 hosts - http://support.microsoft.com/kb/2506718
Keys in the CNG user interface are always described as having no description in Windows 7 or in Windows Server 2008 R2 - http://support.microsoft.com/kb/2507840
A black screen is displayed when a Windows 7 SP1-based or Windows Server 2008 R2 SP1-based computer tries to enter hibernation - http://support.microsoft.com/kb/2496744
MS11-017: Vulnerability in Remote Desktop client could allow remote code execution: March 8, 2011 - http://support.microsoft.com/kb/2508062
MS11-017: Description of the security update for Remote Desktop client 7.0: March 8, 2011 - http://support.microsoft.com/kb/2483614

Saturday 18 December 2010

Microsoft Security updates for December

Our top 10 security stories of 2010

What computer security topics do our readers care about most? Take a look at our most popular articles and blog posts from the past year.

Security updates for December 14, 2010
The bulletin for December includes 17 security updates, including updates for the Windows operating system, Microsoft Office, and the Windows Internet Explorer browser.

Microsoft security news

Watch out for fake "Security Essentials 2011"

Fake security software that claims to protect your PC from malicious software, but instead infects your PC with it, is on the rise. Watch out for fake "Microsoft Security Essentials 2011."

Preview the new Internet Explorer 9 privacy feature

With "Tracking Protection" in the next version of Internet Explorer, you can prevent companies from tracking your behavior online. Learn more about the new feature in this interview with two Microsoft security executives.

See the results of a recent Microsoft survey on cyberbullying

New research by Microsoft shows that parents and educators are concerned about cyberbullying, but it's still not a top priority for schools. Read the complete findings.

Check out the Microsoft Safer Online team on Facebook

If you're on Facebook and want to keep up with the latest security news, check out our Safer Online page. It's full of great tips to help you and your family be safer online.

Protect your computer

Using the family PC to shop for a gift?

Cover your tracks with InPrivate Browsing in Internet Explorer 8, which removes all evidence of your browsing and search history.

Windows XP users: Avoid "Free Public Wifi" rogue software

If you use Windows XP and have tried to connect to a public wireless network, you might have seen a "Free Public Wifi" network available. Don't connect - this is malicious software that will infect Windows XP-based computers without the latest security updates.

How to create strong passwords

Get the secrets to creating passwords that cybercriminals can't crack - and you can remember. Plus, learn common password pitfalls to avoid.

Protect yourself and your family

6 rules for safer financial transactions online

Finishing up your holiday shopping online? Remember to follow these six basic rules to minimize the risks and help protect your credit card information.

Keep an eye on your kids' Internet use

Your kids are online and you're busy. Windows Live Family Safety can help. This free download lets you monitor your kids' online activities, choose which websites they can visit, and even set time periods when they can use the computer.

Xbox 360 and Kinect: Your questions answered

Is your child using the new Kinect sensor to control the Xbox 360 entertainment system? Are you wondering about your child's privacy and online safety when using the technology? This list of frequently asked questions and answers can address your concerns.

Security resources

About this Microsoft newsletter
Microsoft Security for Home Computer Users is a monthly newsletter bringing security news, guidance, updates, and community resources directly to your inbox. If you would like to receive more technical security information, see the Microsoft Security Newsletter.

Saturday 13 November 2010

The fight against botnets: Are we winning?

Are you using an older operating system? If you are, your computer is more susceptible to infections from bot-related malicious software. That's according to the just-released Microsoft Security Intelligence Report covering the first half of 2010.

Read about this and other key findings in the report, which focuses on the battle against botnets. The report outlines the progress that Microsoft and others have made, but indicates there is still much work to do.

Security updates for November 9, 2010
The bulletin for November includes three security updates: two for Microsoft Office and one for Microsoft Forefront Unified Access Gateway.

Microsoft security news

Online safety conference going on now
Microsoft is the top sponsor of the annual Family Online Safety Institute conference - the preeminent online safety conference of its kind - which is going on now in Washington, D.C. Peter Cullen, Chief Privacy Strategist at Microsoft, is delivering the keynote address today.

Free virus protection for your small business
Security Essentials, the no-cost antivirus and antispyware software from Microsoft, is now available for small businesses. Learn more and download today.

Bullying Prevention Conference to be held in Seattle
The seventh annual International Bullying Prevention Association conference will take place in Seattle November 15-17. Jacqueline Beauchere, Director of Privacy and Online Safety Communications in the Microsoft Trustworthy Computing group, will deliver the keynote address.

Microsoft Digital Crimes Unit versus the cybercriminal
Can cybercriminals be caught and prosecuted? That was a question posed by one of our readers. Get the answer, and learn more about the Microsoft Digital Crimes Unit.

Protect your computer

Firewalls in versions of Windows
Depending on which operating system is on your PC, you might already have a firewall and it might already be turned on for you. Learn how to check your firewall settings.

How to uninstall Security Essentials
If you want to uninstall Microsoft Security Essentials antivirus software, here's how to do it.

Misplaced your Windows Phone? Easily find and secure it
Do you have a new Windows Phone? See how to use the new Find My Phone feature to track down your phone if it's missing and help protect your data until you can retrieve the phone.

Protect yourself and your family

Do your holiday shopping safely online
Avoiding the crowds and shopping online this holiday season? Use these tips to make sure you're shopping at secure and trustworthy websites.

How to report possible fraud
Have you received an email message that you suspect is a scam or visited a website that seems fake? Find out how to report these and other potential phishing scams.

"I've been mugged! Send money!"
If your friends are getting scam email messages that are supposedly from you, your email address has likely been hijacked. Here's what to do.

Security resources

About this newsletter
Microsoft Security for Home Computer Users is a monthly newsletter bringing security news, guidance, updates, and community resources directly to your inbox. If you would like to receive more technical security information, see the Microsoft Security Newsletter.

Tuesday 12 October 2010

Security Articles from MS this month

Security

Microsoft Malware Protection Center  Website | RSS Feed
Prehistoric Virtual Machines  - 08-Oct-2010

Microsoft Security Response Center MSRC  Website | RSS Feed
Advance Notification Service for October 2010 Security Bulletin  - 07-Oct-2010

Security Bulletins Comprehensive  Website | RSS Feed
Microsoft Security Bulletin Advance Notification for October 2010  - 07-Oct-2010

Security Products Forefront

Forefront Product Suite  Website | RSS Feed
Microsoft acquires AVIcode Inc. to extend application management to the cloud  - 07-Oct-2010

Forefront Server Security  Website | RSS Feed
Hotfix rollup 3 for Forefront Security for Exchange Server SP2 and hotfix rollup 3 for Forefront Security for SharePoint SP3 are now available   - 08-Oct-2010

Forefront Threat Management Gateway ISA Server  Website | RSS Feed
TMG Reports stop working after installing TMG 2010 SP1  - 05-Oct-2010

Tuesday 28 September 2010

Out-of-band Security Update for ASP.NET Security Vulnerability

ASP.NET Security Update Shipping Tuesday, Sept 28th

An hour ago Microsoft released an advance notification security bulletin announcing that we are releasing an out-of-band security update to address the ASP.NET Security Vulnerability that Scott has blogged about this past week. The security update is fully tested, and is scheduled for release tomorrow - Tuesday September 28th – at approximately 10:00 AM PDT. The advance notice bulletin is intended to ensure administrators know it is coming, and are better prepared to apply it once the update is available.

We’ll release the update tomorrow via the Microsoft Download Center (He will blog links to the individual downloads for each version of .NET). We will then release the update via Windows Update and the Windows Server Update Service in a few days as we complete final distribution testing via these channels.

Applying the update addresses the ASP.NET Security vulnerability, and once the update is applied to your system the workarounds we have previously blogged about will no longer be required. Until you have installed the update, though, please do make sure to continue using the workarounds.

You can learn more about tomorrow’s security update release from this Microsoft Security Response Center Blog Post as well as the official Advance Notification Bulletin. We will also hold a special webcast for the bulletin release on Tuesday, September 28, 2010 at 1:00 PM PDT, where we will present information on the bulletin and take customer questions. If you are interested in attending the webcast, click here to sign up.

http://blogs.technet.com/b/msrc/archive/2010/09/27/out-of-band-release-to-address-microsoft-security-advisory-2416728.aspx

http://weblogs.asp.net/scottgu/archive/2010/09/27/asp-net-security-update-shipping-tuesday-sept-28th.aspx

Once again great job MS. We have faith in you… :)

Sunday 26 September 2010

How to manually check if the ASP.Net application is vulnerable to ASP.Net Padding Exploitation

Before I begin, I would like to say that, the actual reason behind the hue and cry about this vulnerability is the fact that the Microsoft Security Advisory 2416728 quoted that this vulnerability can be "further exploited to view data, such as the View State, which was encrypted by the target server, or even read data from files on the target server, such as the web.config file".

Though, there is no available exploit code in the internet that allows us to check the legitimacy of the above statement but it is true that a vulnerability and exploit code that has been disclosed in such a professional manner would definitely not be released to the public. Although, there are tools and scripts such as POET, PadBuster, AspNetPaddingOracleDetector etc. but they fail to justify what Microsoft has quoted in their Security Advisory and it is acceptable that a public release of the actual exploit code will trigger a sudden burst of malicious activities. Seeing the issue from this perspective lets see, how even without the exploit code in place, we can still try to identify if our ASP.Net applications are vulnerable or not.

Before I move on to the steps, let me quickly give a brief idea about one of the most important factors that aid this exploitation mechanism as this will be the key to our manual judgemental skills.

When we send a request to the ASP.Net application, it carries ciphertext (__VIEWSTATE parameter, Cookie parameter etc) with it. For some reason, if the ciphertext is invalid, an exception will be thrown, and the system may act according to one of the following scenarios:
Returns a 500 Internal Server Error
Returns a 404 Not Found Error
Return the ASP.Net Yellow Screen Of Death (YSOD) Exception page with or without Stack Trace depending on customErrors settings in the web.config
Return a page stating only the exception’s message
Return a constant page, stating there was an error, without providing detail. This is actually the Microsoft’s workaround
The default ASP.Net way of taking the user to the login page and swallowing the exception completely without displaying any error

Now, it is these behaviors that will help us to identify if our ASP.Net application is vulnerable or not and if the workaround proposed my Microsoft is helping our application to refrain itself from giving hints of its vulnerability to the attacker. Though, the vulnerability would still remain, but it would take the sting off by at first not letting the attacker know of its vulnerability.

The below image shows the requests made on a sample ASP.Net blog application. I would explain each of these requests and responses.

Request 1 to Request 3 is highlited in red and Request 4 to Request 8 is highlited in green. The requests highlited as red means the application's web.config was not set in the way that Microsoft recommended and the requests highlited as green means the application's web.config was set as per Microsoft's recommendation.

Explanation:

Condition 1: Web.Config doesn’t redirect to a single error page. CustomErrors section reads <customErrors mode="On"/> or <customErrors mode="RemoteOnly"/>

Request 1: When we made a request to the application with a valid ciphertext "GET /Blog/WebResource.axd?d=R7QyY48orpGSFdUDj4AslA2" the application gave the response "200 OK"

Request 2: When we made a request to the application with an invalid ciphertext "GET /Blog/WebResource.axd?d=test" the application gave the the response "500 Internal Server Error" because its an invalid ciphertext.

Request 3: When we made a request to the application with no ciphertext "GET /Blog/WebResource.axd?d=" the application gave the the response "404 Not Found" and also said that " The resource cannot be found" because our request didn’t had a resource request encrypted as a ciphertext.

So we see that the application has behaved in three different ways for three different GET requests.

Condition 2: Web.Config redirect to a single error page. CustomErrors section reads <customErrors mode="On" defaultRedirect="error.aspx"/>

Request 4: Same as Request 1. Since it’s a valid request, the application responds with the response "200 OK"

Request 5: The request is same as Request 2 and since its an invalid ciphertext, it triggers an error "500 Internal Server Error" in the server, but since we have the customErrors module in the Web.Config to handle this, it sees that there is the error.aspx that it should serve, however, for redirection to that resource, it sends the response "302 Found" and also adds the Location header "Location: /blog/error.aspx?aspxerrorpath=/Blog/WebResource.axd" to the response so that the client knows its current location. Thus, what it has done is, it has supressed the "500 Internal Server Error" error.

Request 6: The client makes a request for the new resource that came with the previous response. In our case, it’s the "GET /blog/error.aspx?aspxerrorpath=/Blog/WebResource.axd". This request is processed and the error.aspx page served resulting in a "200 OK" response from the server.

Request 7: Similar way, when we request to the application with no ciphertext, it triggers an error "404 Not Found" in the server, but again we have the customErrors module in the Web.Config to handle this, it sees that there is the error.aspx that it should serve, however, for redirection to that resource, it sends the response "302 Found" and also adds the Location header "Location: /blog/error.aspx?aspxerrorpath=/Blog/WebResource.axd" to the response so that the client knows its current location. Thus, what it has done is, it has supressed the "404 Not Found" error.

Request 8: The client makes a request for the new resource that came with the previous response. In our case, it’s the "GET /blog/error.aspx?aspxerrorpath=/Blog/WebResource.axd". This request is processed and the error.aspx page served resulting in a "200 OK" response from the server.

What we have seen is, in simple words, if the application is throwing different errors for different scenarios then it reveals the vulnerability because, on the basis of the different error code that is returned by the web server the atacker can guess if the ciphertext was decrypted properly. By making many such requests (and watching what errors are returned) the attacker can learn enough to successfully decrypt the rest of the cipher text. Thus, if the application is showing different errors like the above three requests (Request 1 to Request 3) then its revealing its vulnerability.

Furthermore, for added safety, it is recommended that the error.aspx should have a random, small sleep delay. This will obfuscate the time required to serve the error.aspx on even of an error, thus obfuscating the nature of the error further.

The code of the error.aspx with the random sleep delay can be found on the Microsoft Security Advisory 2416728 page.

Saturday 25 September 2010

Exception event that shows signs of the padding oracle exploitation attack

The below post shows the exception event that shows signs of the attack in progress. Also, found some Dynamic IP Restriction module for IIS 7 that can be used to block this attack.

Exception event that this attack would triger:

What would an attack look like on the network or in my logs?

The publicly disclosed exploit would cause the web server to generate thousands (or more likely tens of thousands) of HTTP 500 and 404 error responses to requests from a malicious client.

We can use stateful filters in the firewall, application or network, or intrusion detection systems on the network to detect such patterns and block such clients. The Dynamic IP Restrictions module supported by IIS 7 can also be used to block these types of attacks.

An attack attempt like this should also generate thousands of warnings in the application event log of your server similar to:

Event code: 3005
Event message: An unhandled exception has occurred.
Event time: 11/11/1111 11:11:11 AM
Event time (UTC): 11/11/1111 11:11:11 AM
Event ID: 28e71767f3484d1faa90026f0947e945
Event sequence: 133482
Event occurrence: 44273
Event detail code: 0

Application information:
Application domain: c1db5830-1-129291000036654651
Trust level: Full
Application Virtual Path: /
Application Path: C:\foo\TargetWebApplication\
Machine name: FOO

Process information:
Process ID: 3784
Process name: WebDev.WebServer40.exe
Account name: foo

Exception information:
Exception type: CryptographicException
Exception message: Padding is invalid and cannot be removed.

The highlighted exception detail is the most important piece of information in the event log entry to look for. It is possible to hit this error while developing new ASP.NET website code, and it can happen in certain production environments. However, if it did not appear on your production servers until recently, it is possible that it indicates an attack. Verifying that the time of these exceptions corresponds to the large number of requests described above would increase the confidence that this entry was caused by an attack.

Note that there are non-attack reasons to see this error as well (including cases where you have mismatched keys on a web-farm, or a search engine is following links incorrectly, etc), so its presence does not always necessarily indicate an attack, however, we can take preventive measures.

The exception also does not mean that an attack was successful. Implementing the <customErrors> workaround we have provided can protect your application from the public exploit, and ensure that these exceptions do not disclose information that an attacker can use against the application.

Complete description of why we should follow this workaround:

Well, while the workaround contains a really valuable information, relevant for every system (as for not disclosing the real error), and it will prevent the automated tool released by the researchers to hack your system, it will, by far, NOT protect you from a potential attack!

How so? The workaround assumes that the potential attacker will look for an HTTP error response status (500), or for an error page containing a specific exception message. However, it is enough for attacker to recognize an abnormal, or just different system behavior on certain requests.

Let’s get back to our ASP.NET system that stores an encrypted sensitive information in a cookie. Each request, the system will probably decrypt this information and use it. In case the ciphertext in a cookie is invalid, an exception will be thrown, and the system may act according to one of the following scenarios:

· Return a 500 error response - very user unfriendly!

· Return a default ASP.NET YSOD exception page - extremely bad in production environment!

· Return a page stating only the exception’s message - also very bad!

· Return a constant page, stating there was an error, without providing details– a good practice, this is actually the Microsoft’s workaround

· “Swallow” the exception, and behave like the cookie does not exist. The response may be a redirect to another pager, or just a a slightly changed HTML (instead of user’s name, a “login” link) – This is the way ASP.NET Forms Authentication works.

Note that every one of the possible responses is different from the normal one. Even the last scenario described above, as clean as it is, still returns a distinctively different response. Therefore, an attacker can take advantage of it, and write a simple script that infers this abnormal behavior to an Invalid Oracle’s answer. It is that simple!

Some useful links related to this attack:

Dynamic IP Restriction: http://www.iis.net/download/DynamicIPRestrictions

URLScan - IIS 6.0 and lesser: http://weblogs.asp.net/scottgu/archive/2010/09/24/update-on-asp-net-vulnerability.aspx

RequestFiltering - IIS 7.0 and above: http://www.iis.net/ConfigReference/system.webServer/security/requestFiltering

Sharepoint Workaround: http://blogs.msdn.com/b/sharepoint/archive/2010/09/21/security-advisory-2416728-vulnerability-in-asp-net-and-sharepoint.aspx

Tuesday 21 September 2010

Microsoft Security Articles

Forefront Client Security  Website | RSS Feed
Understanding how Forefront Client Security responds to potentially unwanted software  - 17-Sep-2010
Using a script to automate UNC definition updates  - 16-Sep-2010
Announcing the Forefront Endpoint Protection Community Evaluation Program  - 14-Sep-2010
New notification resource…  - 14-Sep-2010

Forefront Server Security  Website | RSS Feed
Problems downloading updates for the Kaspersky 8 antivirus engine after installing FSSMC Hotfix Rollup 5 and FSE Service Pack 2 Rollup 2  - 15-Sep-2010

Forefront Threat Management Gateway ISA Server  Website | RSS Feed
Unable to download files larger than 4GB through ISA 200x – works fine in TMG  - 16-Sep-2010
Forefront TMG/UAG Help Wanted at Microsoft in Stockholm  - 15-Sep-2010
TMG Quick Tip: Unable to Join a TMG to an Existing Array  - 14-Sep-2010

Forefront Unified Application Gateway UAG  Website | RSS Feed
How to enable Remote Desktop Sharing (RDS/RDP) from corporate machines to DirectAccess connected machines  - 14-Sep-2010