Advance Notice Microsoft Security Bulletin

On Tuesday, October 10, Microsoft will release the Security Updates listed below. In addition, it will be the last update for XP SP1 and SP1a. The details are here.

The following suggestions on what you can do before “Patch Tuesday” are from Calendar of Updates:

• Undo any 3rd party work-around or any work-around that you did on affected system or components in Windows that is going to be patched
• Create a backup of your good system (see also: System Back-up) and/or ensure that System Restore service is enabled, actually running, working and not corrupted or in the good state. Note: System Restore is available in Windows Millennium (Me) and the Windows XP (Home and Professional) Operating Systems.

To check whether System Restore is enabled and actually running:

• Type services.msc
• Click OK button
• Locate System Restore Service in the list of services and verify that the status is “Started”.

Note: You may also access the Services Console by going to Control Panel>Performance and Maintenance>Administrative Tools>Services.

Microsoft Technet has complete details of today's Microsoft Security Bulletin Advance Notification.
that Microsoft is planning to release on 10 October 2006.

=================================================
Security Updates
=================================================

• Six Microsoft Security Bulletins affecting Microsoft Windows. The highest Maximum Severity rating for these is Critical. These updates will be detectable using the Microsoft Baseline Security Analyzer and the Enterprise Scan Tool (EST). Some of these updates will require a restart.

• Four Microsoft Security Bulletins affecting Microsoft Office. The highest Maximum Severity rating for these is Critical. These updates will be detectable using the Microsoft Baseline Security Analyzer. These updates may require a restart.

• One Microsoft Security Bulletin affecting Microsoft .NET Framework. The highest Maximum Severity rating for this is Moderate. These updates will be detectable using the Microsoft Baseline Security Analyzer and the Enterprise Scan Tool. These updates may require a restart.

Microsoft MVP Awardee Stuns the Security Community

Yesterday evening, I saw this at the SunbeltBLOG:

“Patchou” (aka Cyril Paciullo) has just been given Microsoft MVP status. Worthy of congratulation, except… Patchou got his fame through a program called Messenger Plus!, which has the option of installing LOP (a not-so-pleasant piece of adware).

That led me to Paperghost's Vital Security post. Paperghost has never been hesitant to tell it the way he sees it and isn't shy in his presentation.
Today the news has "hit the wires". So before you run off to read what everyone is saying, let's take a look at a description of LOP from Sunbelt Research:

C2.Lop:

Type	Adware
Type Description	Adware, also known as advertising software, displays third-party advertising on the computer. The ads can take several forms, including pop-ups, pop-unders, banners, or links embedded within web pages or parts of the Windows interface. Some adware advertising might consists of text ads shown within the application itself or within side bars, search bars, and search results. Adware is often contextually or behaviorally based and tracks browsing habits in order to display ads that are meant to be relevant to the user.
Category	Hijacker

Background information is available at Sandi's Site and you can find additional information on what happens when the sponsor link is accepted when installing Messenger Plus! at Spyware-Free.

As posted by Ed Bott in "Microsoft gives adware pusher an MVP award",

"Around this time every year, Microsoft publishes its new list of Most Valuable Professionals (MVPs). MVPs are unpaid volunteers, not Microsoft employees, and the official criteria for being named an MVP are based on their willingness to participate in technical and product communities."

Consider Mr. Bott's comment in conjunction with this from Security Ticker:

"Microsoft's MVP program supposedly rewards "outstanding members of Microsoft's peer-to-peer communities, and is based on the past year's contributions those members make in those communities online and offline." So why have they given the creator of Messenger Plus an MVP Award, when he bundles the notorious LOP Adware in with his creation?" {emphasis added}

Mozilla Releases Firefox 2 Release Candidate 2

While the temperature in my area reached the low 30's last night, the folks at Mozilla were uploading uploading Release Candidate 2 (RC2) to the servers. Should you decide to give it a test run, please keep in mind that RC is not final and bugs and incompatabilities may exist with installed extensions.
For enhancements and changes to Firefox 2 RC2., see the Release Notes. Please read the Installation Instructions. I also recommend backing up your profile, bookmarks and cookies before installing a new version as well creating a restore point if using Microsoft XP.
Also released for testing is Firefox Portable 2.0 Release Candidate 2. Firefox Portable can be run from a USB flash drive, iPod, portable hard drive, CD, etc and used on any computer. It can also be run from a local hard drive or your desktop. This would be a handy way to test Firefox 2 RC2 without affecting the version installed on your computer.

Microsoft Apparently Rescinds MVP Award

It certainly has been an interesting week. It began with the sharing of the excitement and thrill of the newly awarded and re-awarded Microsoft MVPs. Shortly thereafter, everything seemed to go on a downward spiral over the awarding of MVP to the developer of Messenger Plus!.
Messenger Plus! in and of itself is a well-designed add-on to Messenger. The problem the members of the security community (myself included) have is with the "optional" sponsor program. Unfortunately, that sponsorship leads to some not-so-pretty additions. It has been well documented what the results are when accepting the sponsor install with Messenger Plus! so I won't go into that here.
The understandable argument is that the sponsorship itself does not need to be accepted in order to install the software. Although this is true, unfortunately, Messenger Plus! is extremely popular with teen and preteens. With adults known to not read (and freely admit not understand) EULAs (end user license agreements), how would 11-17 year-olds be expected to do so? In addition, those under 18's are anxious to install the software that their friends have on their computers. Taking it a step further, accepting sponsorship (read advertisements) is certainly not the same as the actual end result.

Would those involved in the MVP selection process even realize the severity of the effects of the documented sponsorship? Not likely as they are adults who are familiar with EULAs and would not have been checking the sponshorship box. Remember, Microsoft is a huge corporation with multiplie disciplines.

Did this and perhaps other information that we have no way of knowing about result in a mistake being made by Microsoft? It appears so, at least based on the the apparent necessity for Sandi and Paperghost to post, respectively, "The saga of Patchou and his short lived MVP award" and "Caught in a Crossfire Hurricane" with links to a msghelp.net forum thread entitled "Patchou Lost MVP Status :(". (Note: Registration is required to access the referenced link at msghelp.) Sadly, those supporting Patchou have resulted to mud-slinging and bad-mouthing others.

Edit Note: The thread at msghelp.net has apparently been deleted (or relocated to a private location since portions of it have been quoted elsewhere.) A better action would have been moderating the foul language and locking the thread.

A new week has begun. I hope that the turmoil of the past week can be put behind us.

9SEP06 Update Note: The following was reported at Microsoft Informer:

"Cyril Paciullo was awarded with MVP status this year on the basis of his technical expertise and strong community contribution. However, his active MVP Award status was revoked as soon as the extent of the connection between his application and spyware was made apparent to the MVP Program," the company said in a statement.

It was published at Mess.be (which I understand is the official site for Messenger Plus!) :

dwergs says:

When Patchou last week proudly announced his freshly acquired Most Valuable Professional (MVP) status, the news spurred so much criticism from fellow MVPs and security experts that Microsoft decided to take back the award on Friday. The whos, whats and whys can be found eg. here and here.

It needs to be clearly understood that the Microsoft MVP Program is wholly managed by Microsoft, not the MVPs. There are approximately 2600 MVPs worldwide. Out of those 2600 MVPs only about 145 are WIndows Security MVPs. I hardly think that small a minority could have such an effect.

Suzi Turner posted an excellent summary and reflection of my opinion in "MVP awards, Messenger Plus! and adware -- a good combination?" at ZDNet.

WinPatrol Update

Bill Pytlovany issued a maintenance release version of WinPatarol 10. Unless you have had the problems addressed, updating to 10.0.5 is not required.

• WinPatrol registry functions enhanced to handle over-zealous registry cleaners.

Improper use of Registry Cleaners can cause Scotty to repeatedly ask permission for system changes.

• Build Tools updated to Microsoft Visual Studios 2005.

In theory, this shouldn't break anything. Adds a few KB to the program size but so far benchmarks indicate faster performance.

• PLUS Tab Search available on Free versions to support future promotions.

When you click on the PLUS tab there's a input box that allows you to search on any program name. This is now displayed on Free versions so it will be available in the future.

• Our alternate Installshield Setup program is now used as our default setup. This version is slightly larger than our original default setup but is more compatible with newer systems.

Product Info: WinPatrol 10
Direct Download: Download WinPatrol 10.0.5

If you don't have WinPatrol on your computer, check out the great features here. You won't be sorry you have Scotty on Patrol!

New Anti-Phishing Tool by TippingPoint

No, I don't need a spell-checker. Phishing is pronounced the same as "fishing" and could be compared to the common American usage of "fishing for information" but on a much more dangerous level. People deceived by phishing scams provide personal and financial information, including credit card information, Social Security Number, bank account number, PIN numbers, etc.

Both soon-to-be-released popular browsers, IE7 and Firefox 2 have anti-phishing filters included in the new versions. Knowing about and avoiding phishing scams is one thing, but not all computer users will be able to update to IE7. Besides, it is much better to report phishing scams and have the sites taken down. This is precisely what Castle Cops and Sunbelt Software have been doing with the Phishing Incident Reporting and Termination (PIRT) anti-phishing community since it was formed in March. As Paul and Alex explained in the original Press Release:

"The reason this group was formed is to give consumers direct access to a dedicated task force that will take immediate and aggressive action to shutting down phishing sites," said Paul Laudanski, president of CastleCops.

"While there is a very active professional security community performing outstanding research and forensics on phishing sites, it's our experience that many of these phishing sites themselves aren't immediately reported to the ISP, or in the case of compromised sites, to the domain owner. This effort adds one more layer to the fight against phishing, making it increasingly more difficult for the criminals to perpetrate their scams on innocent users," said Alex Eckelberry, president of Sunbelt Software.

Where is all that taking me and how does it relate to the title of this post? We are right back to the necessity to take the phishing sites down. With the creation of Monkeyspaw, TippingPoint, a division of 3Com, has taken anti-phishing a step further than identification. In addition to checking Web sites for legitimacy, Monkeyspaw reports fraudulent sites. As Business Wire reports:

". . . Monkeyspaw checks Web sites for legitimacy and reports fraudulent sites. “TippingPoint is contributing Monkeyspaw to the public to help investigators analyze and report phishing and other malicious Web sites,” said Tod Beardsley, Monkeyspaw creator and lead counter-fraud engineer at TippingPoint. “By enabling security professionals and end users to easily validate Web sites and report fraudulent sites, we hope to make the Web a safer place.”
Monkeyspaw is unique in that it works with other open source tools like Mozilla’s Firefox, an open source Web browser. Monkeyspaw is used to determine the owner of a particular web server, collect web server configuration information, determine the location of the site, and finally, report fraudulent sites to nearly 50 international organizations through CastleCops. CastleCops reports malicious activity directly to groups including the Federal Bureau of Investigation, Anti-Phishing Working Group, Korea Information Security Agency, and the Australian Computer Emergency Response Team. For full list of organizations that are notified regarding phishing sites, please visit: http://www.castlecops.com/pirt."

After all the Microsoft/Linux Hoopla . . .

I must say that after all the recent postings about the Microsoft asserting their patent portfolio, I found the report at Blink.nu and the "Total Cost of Ownership" (TCO) being lower with Microsoft servers than Linux servers.

"Many total cost of ownership (TCO) studies have reaffirmed that TCO of a large enterprise infrastructure based on Microsoft® Windows ServerTM 2003 is lower than one based on Linux. But what about TCO in a Web hosting environment? Few rigorous studies have examined the economics of ownership among service providers. To understand TCO in a shared hosting environment and to understand what service providers could do to lower the TCO of Windows–based hosted services even more, Microsoft offered to perform an in-depth TCO study at Hostbasket, one of the leading hosting service providers in Europe. The results of the analysis showed that the TCO of Windows–based shared services can be as much as 55 percent lower than the TCO of analogous services offered on Fedora Core. Moreover, the study revealed how service providers can lower the TCO of their Windows–based offerings even more."

Take a look at the chart reproduced at Bink.nu and see the difference, particularly with .NET Framework 2.0 SQL Server 2005. Go, MS!