Monday, July 10, 2006

Inside Scoop

Vista stands for:

Viruses, Infections, Spyware, Trojans and Adware

Now you can't complaint they didn't tell you!

Monday, July 03, 2006

Microsoft says Vista beta testers better hurry

By Ina Fried
Staff Writer, CNET News.com

update For those who want to try out the current test version of Microsoft's Windows Vista, it may be now or never.

The company is nearing its self-imposed cutoff point and plans to stop allowing new downloads after Friday, according to Microsoft blogger Ian Moulster.

"In case you weren't aware, we are only providing a limited number of copies of Windows Vista Beta 2--either download or physical copies--and we're fast approaching the cutoff point, " Moulster wrote. "What this means is--if you want to get a copy, get it now (and I mean now)."

Microsoft released Beta 2 of Windows Vista in May but didn't make it available to the general public until earlier this month. Microsoft cautioned at the time that it might limit the number of testers.

According to the latest schedule, the oft-delayed operating system is due to be finished and available to large corporate customers late this year, with a mainstream launch in January.

As for the current beta, Moulster said people who start their download before the cutoff will be able to finish getting the software, even if it takes them slightly past the deadline. He cautioned that people should make sure that they get a product key for the software and also recommended that people activate their beta software. "We may be able to provide people who have activated copies with future...stuff," he said. "I'm being vague because I need to be. Just trust me and make sure you activate."

A Microsoft representative confirmed the company has nearly reached the amount of testers it plans to allow to try Vista Beta 2. "The Windows Vista Beta 2 code is available in limited quantities, and we've almost reached that limit and expect to close the program shortly," the representative said in an e-mail.

Friday, June 30, 2006

Download now ... if you dare

A New Windows means new security problems

From E-Week:

Blue Pill' Prototype Creates 100% Undetectable Malware

By Ryan Naraine
June 28, 2006


A security researcher with expertise in rootkits has built a working prototype of new technology that is capable of creating malware that remains "100 percent undetectable," even on Windows Vista x64 systems.
Joanna Rutkowska, a stealth malware researcher at Singapore-based IT security firm COSEINC, says the new Blue Pill concept uses AMD's SVM/Pacifica virtualization technology to create an ultra-thin hypervisor that takes complete control of the underlying operating system.
ADVERTISEMENT

Rutkowska plans to discuss the idea and demonstrate a working prototype for Windows Vista x64 at the SyScan Conference in Singapore on July 21 and at the Black Hat Briefings in Las Vegas on Aug. 3.

The Black Hat presentation will occur on the same day Microsoft is scheduled to show off some of the key security features and functionality being fitted into Vista.

Rutkowska said the presentation will deal with a "generic method" of inserting arbitrary code into the Vista Beta 2 kernel (x64 edition) without relying on any implementation bug.

PointerVM Rootkits: The Next Big Threat? Click here to read more.

The technique effectively bypasses a crucial anti-rootkit policy change coming in Windows Vista that requires kernel-mode software to have a digital signature to load on x64-based systems.

The idea of a virtual machine rootkit isn't entirely new. Researchers at Microsoft Research and the University of Michigan have created a VM-based rootkit called "SubVirt" that is nearly impossible to detect because its state cannot be accessed by security software running in the target system.

Now, Rutkowska is pushing the envelope even more, arguing that the only way Blue Pill can be detected is if AMD's Pacifica technology is flawed.

"The strength of the Blue Pill is based on the SVM technology," Rutkowska explained on her Invisible Things blog. She contends that if generic detection could be written for the virtual machine technology, then Blue Pill can be detected, but it also means that Pacifica is "buggy."

PointerRead more here about Microsoft's moves to hardens Vista against kernel-mode malware.

"On the other hand—if you would not be able to come up with a general detection technique for SVM based virtual machine, then you should assume, that you would also not be able to detect Blue Pill," she added.

"The idea behind Blue Pill is simple: your operating system swallows the Blue Pill and it awakes inside the Matrix controlled by the ultra thin Blue Pill hypervisor. This all happens on-the-fly (i.e. without restarting the system) and there is no performance penalty and all the devices," she explained.

eWEEK.com Special Report: The Rise of Rootkits

Rutkowska stressed that the Blue Pill technology does not rely on any bug of the underlying operating system. "I have implemented a working prototype for Vista x64, but I see no reasons why it should not be possible to port it to other operating systems, like Linux or BSD which can be run on x64 platform," she added.

Blue Pill is being developed exclusively for COSEINC Research and will not be available for download. However, Rutkowska said the company is planning to organize trainings about Blue Pill and other technologies where the source code would be made available.

Rutkowska has previously done work on Red Pill, which can be used to detect whether code is being executed under a VMM (virtual machine monitor) or under a real environment.