December 19, 2007

Mac versus Windows vulnerability stats for 2007

December 18th, 2007

Posted by George Ou

The year 2007 has been an interesting year that brought us improved security with Windows Vista and Mac OS X Leopard (10.5).   But to get some perspective of how many publicly known holes found in these two operating systems, I’ve compiled all the security flaws in Mac OS X and Windows XP and Vista and placed them side by side.  This is significant because it shows a trend that can give us a good estimate for how many flaws we can expect to find in the coming months.  The more monthly flaws there are in the historical trend, the more likely it is that someone will find a hole to exploit in the future.  For example back in April of this year, hackers took over a fully patched Macbook and won $10,000 plus the Macbook they hacked.

I used vulnerability statistics from an impartial third party vendor Secunia and I broke them down by Windows XP flaws, Vista flaws, and Mac OS X flaws.  Since Secunia doesn’t offer individual numbers for Mac OS X 10.5 and 10.4, I merged the XP and Vista vulnerabilities so that we can compare Vista + XP flaws to Mac OS X.  In case you’re wondering how 19 plus 12 could equal 23, this is because there are many overlapping flaws that is shared between XP and Vista so those don’t get counted twice just as I don’t count something that affects Mac OS X 10.4 and 10.5 twice.

Windows XP, Vista, and Mac OS X vulnerability stats for 2007
  XP Vista XP + Vista Mac OS X
Total extremely critical 3 1 4 0
Total highly critical 19 12 23 234
Total moderately critical 2 1 3 2
Total less critical 3 1 4 7
Total flaws 34 20 44 243
Average flaws per month 2.83 1.67 3.67 20.25

 X Extremely critical
 H Highly critical
 M Moderately critical
 L Less critical

So this shows that Apple had more than 5 times the number of flaws per month than Windows XP and Vista in 2007, and most of these flaws are serious.  Clearly this goes against conventional wisdom because the numbers show just the opposite and it isn’t even close.

Also noteworthy is that while Windows Vista shows fewer flaws than Windows XP and has more mitigating factors against exploitation, the addition of Windows Defender and Sidebar added 4 highly critical flaws to Vista that weren’t present in Windows XP.  Sidebar accounted for three of those additional vulnerabilities and it’s something I am glad I don’t use.  The lone Defender critical vulnerability that was supposed to defend Windows Vista was ironically the first critical vulnerability for Windows Vista.

Windows XP, Vista, and Mac OS X vulnerability details for 2007
Month Windows XP Windows Vista Mac OS X
DEC CVE-2007-0064 H
CVE-2007-3039 L
CVE-2007-3895 H
CVE-2007-3901 H
CVE-2007-5355 L
CVE-2007-0064 H
CVE-2007-5350 L
CVE-2007-3895 H
CVE-2007-3901 H
CVE-2007-5351 M
CVE-2007-5355 L
 
CVE-2006-0024 H
CVE-2007-1218 H
CVE-2007-1659 H
CVE-2007-1660 H
CVE-2007-1661 H
CVE-2007-1662 H
CVE-2007-3798 H
CVE-2007-3876 H
CVE-2007-4131 H
CVE-2007-4351 H
CVE-2007-4572 H
CVE-2007-4708 H
CVE-2007-4709 H
CVE-2007-4710 H
CVE-2007-4766 H
CVE-2007-4767 H
CVE-2007-4768 H
CVE-2007-4965 H
CVE-2007-5379 H
CVE-2007-5380 H
CVE-2007-5398 H
CVE-2007-5476 H
CVE-2007-5770 H
CVE-2007-5847 H
CVE-2007-5848 H
CVE-2007-5849 H
CVE-2007-5858 H
CVE-2007-5850 H
CVE-2007-5851 H
CVE-2007-5853 H
CVE-2007-5854 H
CVE-2007-5855 H
CVE-2007-5856 H
CVE-2007-5857 H
CVE-2007-5859 H
CVE-2007-5860 H
CVE-2007-5861 H
CVE-2007-5863 H
CVE-2007-6077 H
CVE-2007-6165 H
CVE-2006-4339 H
CVE-2006-6731 H
CVE-2006-6736 H
CVE-2006-6745 H
CVE-2007-0243 H
CVE-2007-2435 H
CVE-2007-2788 H
CVE-2007-2789 H
CVE-2007-3004 H
CVE-2007-3005 H
CVE-2007-3503 H
CVE-2007-3504 H
CVE-2007-3655 H
CVE-2007-3698 H
CVE-2007-3922 H
CVE-2007-4381 H
CVE-2007-5232 H
CVE-2007-5862 H
CVE-2007-6276 M
NOV     CVE-2007-6165 H
CVE-2007-4702 L
CVE-2007-4703 L
CVE-2007-4704 L
CVE-2005-0953 H
CVE-2005-1260 H
CVE-2007-0464 H
CVE-2007-0646 H
CVE-2007-2926 H
CVE-2007-3456 H
CVE-2007-3749 H
CVE-2007-3756 H
CVE-2007-3758 H
CVE-2007-3760 H
CVE-2007-3999 H
CVE-2007-4267 H
CVE-2007-4268 H
CVE-2007-4269 H
CVE-2007-4671 H
CVE-2007-4678 H
CVE-2007-4679 H
CVE-2007-4680 H
CVE-2007-4681 H
CVE-2007-4682 H
CVE-2007-4683 H
CVE-2007-4684 H
CVE-2007-4685 H
CVE-2007-4686 H
CVE-2007-4687 H
CVE-2007-4688 H
CVE-2007-4689 H
CVE-2007-4690 H
CVE-2007-4691 H
CVE-2007-4692 H
CVE-2007-4693 H
CVE-2007-4694 H
CVE-2007-4695 H
CVE-2007-4696 H
CVE-2007-4697 H
CVE-2007-4698 H
CVE-2007-4699 H
CVE-2007-4700 H
CVE-2007-4701 H
CVE-2007-4743 H
OCT CVE-2007-5587 L
CVE-2007-2217 H
CVE-2007-2228 L
CVE-2007-3897 H
CVE-2007-2228 L
CVE-2007-3897 H
 
SEPT CVE-2007-4916 M CVE-2007-3036 L  
AUG CVE-2007-1749 H
CVE-2007-3034 H
CVE-2007-2224 H
CVE-2007-3033 H
CVE-2007-3032 H
CVE-2007-3891 H
CVE-2007-1749 H
CVE-2004-0996 H
CVE-2004-2541 H
CVE-2005-0758 H
CVE-2005-3128 H
CVE-2006-2842 H
CVE-2006-3174 H
CVE-2006-4019 H
CVE-2006-6142 H
CVE-2007-0450 H
CVE-2007-0478 H
CVE-2007-1001 H
CVE-2007-1262 H
CVE-2007-1358 H
CVE-2007-1460 H
CVE-2007-1461 H
CVE-2007-1484 H
CVE-2007-1521 cialis soft H
CVE-2007-1583 H
CVE-2007-1711 H
CVE-2007-1717 H
CVE-2007-1860 H
CVE-2007-2403 H
CVE-2007-2404 H
CVE-2007-2405 H
CVE-2007-2406 H
CVE-2007-2407 H
CVE-2007-2408 H
CVE-2007-2409 H
CVE-2007-2410 H
CVE-2007-2442 H
CVE-2007-2443 H
CVE-2007-2446 H
CVE-2007-2447 H
CVE-2007-2589 H
CVE-2007-2798 H
CVE-2007-3742 H
CVE-2007-3744 H
CVE-2007-3745 H
CVE-2007-3746 H
CVE-2007-3747 H
CVE-2007-3748 H
CVE-2007-3944 H
 
JUL CVE-2007-3896 H
CVE-2007-4041 H
CVE-2007-5020 H
   
JUN CVE-2007-2219 H
CVE-2007-2218 H
CVE-2007-1658 H
CVE-2007-2225 H
CVE-2007-2227 H
CVE-2007-1658 H
CVE-2007-2225 H
CVE-2007-2227 H
CVE-2007-2229 L
CVE-2007-2399 H
CVE-2007-2401 H
CVE-2007-2242 M
MAY     CVE-2005-3011 H
CVE-2006-4095 H
CVE-2006-4096 H
CVE-2006-4573 H
CVE-2006-5467 H
CVE-2006-6303 H
CVE-2007-0493 H
CVE-2007-0494 H
CVE-2007-0740 H
CVE-2007-0750 H
CVE-2007-0751 H
CVE-2007-0752 H
CVE-2007-0753 H
CVE-2007-1536 H
CVE-2007-1558 H
CVE-2007-2386 H
CVE-2007-2390 H
APR CVE-2007-1205 H
CVE-2007-1206 L
CVE-2007-1973 L
CVE-2007-1209 L CVE-2006-0300 H
CVE-2006-5867 H
CVE-2006-6143 H
CVE-2006-6652 H
CVE-2007-0022 H
CVE-2007-0465 H
CVE-2007-0646 H
CVE-2007-0724 H
CVE-2007-0725 H
CVE-2007-0729 H
CVE-2007-0732 H
CVE-2007-0735 H
CVE-2007-0736 H
CVE-2007-0737 H
CVE-2007-0738 H
CVE-2007-0739 H
CVE-2007-0741 H
CVE-2007-0742 H
CVE-2007-0743 H
CVE-2007-0744 H
CVE-2007-0745 H
CVE-2007-0746 H
CVE-2007-0747 H
CVE-2007-0957 H
CVE-2007-1216 H
MAR CVE-2007-0038 X CVE-2007-0038 X CVE-2005-2959 H
CVE-2006-0225 H
CVE-2006-0300 H
CVE-2006-1516 H
CVE-2006-1517 H
CVE-2006-2753 H
CVE-2006-3081 H
CVE-2006-3469 H
CVE-2006-4031 H
CVE-2006-4226 H
CVE-2006-4829 H
CVE-2006-4924 H
CVE-2006-5051 H
CVE-2006-5052 H
CVE-2006-5330 H
CVE-2006-5679 H
CVE-2006-5836 H
CVE-2006-6061 H
CVE-2006-6062 H
CVE-2006-6097 H
CVE-2006-6129 H
CVE-2006-6130 H
CVE-2006-6173 H
CVE-2007-0229 H
CVE-2007-0236 H
CVE-2007-0267 H
CVE-2007-0299 H
CVE-2007-0318 H
CVE-2007-0463 H
CVE-2007-0467 H
CVE-2007-0588 H
CVE-2007-0719 H
CVE-2007-0720 H
CVE-2007-0721 H
CVE-2007-0722 H
CVE-2007-0723 H
CVE-2007-0724 H
CVE-2007-0728 H
CVE-2007-0726 H
CVE-2007-0730 H
CVE-2007-0731 H
CVE-2007-0733 H
CVE-2007-1071 H
FEB CVE-2006-1311 L
CVE-2007-0025 L
CVE-2007-0026 M
CVE-2007-0210 L
CVE-2007-0211 L
CVE-2006-5559 H
CVE-2007-0214 H
CVE-2006-5270 H CVE-2007-0021 H
CVE-2007-0023 H
CVE-2007-0197 H
CVE-2007-0614 H
CVE-2007-0710 H
JAN CVE-2007-0024 X   CVE-2007-0462 L
CVE-2007-0023 L
CVE-2007-0355 L
CVE-2007-0236 L
CVE-2007-0229 H

Permalink • Print • Comment

Find the Hidden Vista Screen

As you may have figured out, the Windows Vista boot screen is a little pointless. And why Microsoft decided to hide a more visually appealing boot screen is beyond me, but luckily, it can easily be enabled with very little trouble. So, if you're not happy with your Vista boot screen, check this one out instead!

Here's what the default boot screen looks like:

cialis sales online src=”http://imgsrv.worldstart.com/ct-images/boot1.jpg” border=”1″ width=”236″ height=”182″ />

And here's the hidden one, called Aurora:

All you have to do to change them up is type "msconfig" into the Start menu search box. Then hit Enter.

Click the Boot tab and then checkmark the No GUI Boot box.

Hit OK and restart your computer. You should then see the new boot screen immediately. How do you like it now?!

Permalink • Print • Comment

December 13, 2007

Fsutil

fsutil is quite powerful, it should only be used by advanced users who have a thorough knowledge of Windows XP. In addition, you must be logged on as an administrator or a member of the Administrators group in order to use fsutil.

 

The following table lists the fsutil subcommands.

 

Comm and Description

 

behavior

Queries, changes, enables, or disables the settings for generating 8.3 character-length file names, accepting extended characters in 8.3 character-length file names on NTFS volumes, updating the last access timestamp on NTFS volumes, how often quota events are written to the system log, and the amount of disk space reserved of the MFT Zone.

 

dirty

Queries whether volume's dirty bit is set. Sets a volume's dirty bit. When a volume's dirty bit is set, autochk automatically checks the volume for errors the next time the computer is restarted.

 

file

Typically used by support professionals. Finds a file by its security identifier, queries allocated ranges for a file, sets a file's short name, sets a file's valid data length, or sets zero data for a file.

 

fsinfo

Typically used by support professionals. Lists all drives, queries the drive type, queries volume information, queries NTFS-specific volume information, or queries file system statistics.

 

hardlink

Creates a hard link. A hard link is a directory entry for a file. Every file can be considered to have at least one hard link. On NTFS volumes, each file can have multiple hard links, and thus a single file can appear in many directories (or even in the same directory with different names). Because all of the links reference the same file, programs can open any of the links and modify the file. A file is deleted from the file system only after all links to it have been deleted. After you create a hard link, programs can use it like any other file name.

 

objectid

Typically used by support professionals. Manages object identifiers, which are used by Windows XP to track objects such as files and directories.

 

quota

Manages disk quotas on NTFS volumes in order to provide more precise control of network-based storage. Disk quotas are implemented on a per-volume basis and enable both hard- and soft-storage limits to be implemented on a per-user basis.

 

reparsepoint

Typically used by support professionals. Queries or deletes reparse points, which are NTFS file system objects that have a definable attribute containing user-controlled data, and are used to extend functionality in the input/output (I/O) subsystem. Reparse points are used for directory junction points and volume mount points. They are also used by file system filter drivers to mark certain files as special to that driver.

 

sparse

Manages sparse files A sparse file is a file with one or more regions of unallocated data in it. A program will see these unallocated regions as containing bytes with the value zero, but there is actually no disk space used to represent these zeros. In other words, all meaningful or nonzero data is allocated, whereas all non-meaningful data (large strings of data composed of zeros) is not allocated. When a sparse file is read, allocated data is returned as stored and unallocated data is returned, by default, as zeros, in accordance with the C2 security requirement specification. Sparse file support allows data to be deallocated from anywhere in the file.

 

usn

Typically used by support professionals. Manages the update sequence number (USN) change journal, which provides a persistent log of all changes made to files on the volume.

 

volume

Manages a volume. Dismounts a volume or queries to see how much free space is available on a disk.

 

 Note

 

To view help for the available subcommands at the command prompt, type fsutil, type the subcommand, and then type cialis prescription online help (that is, fsutil subcommand help).

 

Fsutil: behavior

Fsutil: dirty

Fsutil: file

Fsutil: fsinfo

Fsutil: hardlink

Fsutil: objectid

Fsutil: quota

Fsutil: reparsepoint

Fsutil: sparse

Fsutil: usn

Fsutil: volume

Command-line reference A-Z

 

 

Pasted from <http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/fsutil.mspx?pf=true>

Permalink • Print • Comment

November 15, 2007

Microsoft releases details on Vista activation

November 14th, 2007

Posted by Ed Bott

For nearly a year, Microsoft has refused to release technical details of the changes it made to its Product Activation technology in Windows Vista. The company was more than willing to speak in broad terms about the program and how it works, but it kept the details confidential, classifying them as trade secrets.

Until last week, that is. A newly released Technical Market Bulletin entitled Product Activation for Windows Vista and Windows Server 2008 unexpectedly appeared on Microsoft’s Download Center last week. Curiously, the document was dated September 2007, but the Date Published field indicates that it was kicking around internally for more than a month before being officially released.

The document is similar in many respects to the Technical Market Bulletin: Microsoft Product Activation for Windows XP (Word .doc format), released in August 2001, before the launch of Windows XP, and updated in 2002 after Microsoft made some activation changes in XP Service Pack 1.

Historically, the underlying principle of Product Activation has been simple: You can reinstall Windows on the original hardware as many times as you like and activate it automatically over the Internet. You need to reactivate over the phone if the hardware is substantially changed. That’s been the hard-and-fast rule for more than six years.

With that history in mind, I was surprised (to put it mildly) when I read this sentence on the next-to-last page of the Vista activation bulletin:

Reinstallation of Windows Vista or Windows Server 2008 on the same or similar hardware and a subsequent reactivation can be accomplished five times.

If that’s true, it’s a major change in policy for Microsoft. I went back through all my notes and records looking for any indication that this policy has been announced previously and found nothing. So I contacted Microsoft to get an explanation and got an impressively rapid response from Alex Kochis, Senior Product Manager in the Windows Genuine Advantage (WGA) group. His blunt response: “There has been no meaningful policy change. We need to correct that paper.”

The new activation document, it turns out, is missing some crucial details. A more complete description of the actual activation policy is found at the bottom of Microsoft’s Windows Vista Activation FAQ:

How many times can I activate Windows Vista?

Windows can be activated any number of times, but your re-activation experience will vary based on the way you acquired Windows.

If you acquired Windows Vista via retail purchase (boxed product), you may activate via the Internet the first five times. Subsequent activations are allowed but must be completed via telephone.

If you acquire Windows Vista pre-installed on a computer, re-installation would not require additional activation steps unless significant hardware changes were made.

And even that description, Kochis explains, is potentially misleading. The policy allowing five automatic activations over the Internet has been in place for the past year, but it’s subject to change at any time. The real goal, it turns out, is to block hackers who try to spoof parts of the hardware ID so that multiple systems can appear identical when they check in with Microsoft’s activation servers. In that scenario, the server logs for a single product ID might show hundreds or even thousands of activation requests, leading to a requirement that the system be activated over the phone. In that scenario, a customer service representative can confirm that the activation request is legitimate.

For systems sold from large manufacturers (Dell, HP, Sony, and the like), activation is accomplished using a separate check called OEM Activation cialis natural 2.0. If you reinstall Windows using the original media, activation should never be required unless the motherboard is replaced with one from a different manufacturer. The limit of five reactivations should only apply to retail copies, and then it will likely affect only hard core enthusiasts who repeatedly reinstall and attempt to reactivate retail copies.

If you fall into the latter category, here are three pieces of advice to avoid being bitten by activation hassles:

1. Take advantage of the initial 30-day grace period before activating. Delay activation until you’re satisfied that all hardware and software are working as you intended.

2. Use an image backup program like Vista’s Complete PC Backup (found in the Business and Ultimate editions) or a third-party alternative like Acronis True Image. After installing Windows and all current updates (including drivers), complete activation and then use the backup program to create a snapshot of the drive. If you ever need to reinstall, you can do so easily with that image, which won’t require reactivation if it’s restored to the original hardware.

3. If you’re such a fanatic that you install Windows more than five times a year, get a TechNet Plus subscription. For $299, you get a one-year subscription that includes perpetual licenses for every version of Windows Vista (including Ultimate), Windows XP Professional, Microsoft Office, and a slew of server software and tools. The licenses aren’t valid for business use, but you can install and use each product on up to 10 separate machines for evaluation purposes, and the licenses don’t expire even if you choose not to renew your subscription after the first year.

I’ll have more details from this new technical bulletin, including a rundown on the activation changes between XP and Vista.

Permalink • Print • Comment

October 24, 2007

Windows automatically updating itself: Case closed?

October 22nd, 2007

Posted by Mary Jo Foley @ 12:52 pm

It’s time for the latest — and possibly final — installment of the seemingly never-ending saga of “Why is my copy of Windows automatically updating and rebooting itself?Windows automatically updating itself: Case closed?

In the last episode, the Windows Update Product team stated on its blog on October 12 that neither Automatic Update (AU) nor the bunch of patches that Microsoft rolled out on October 9, Patch Tuesday, were responsible for reports from Windows users earlier this month that their machines were automatically updating without their approval.

The Product Update team continued to investigate. At some point (I’m not sure exactly when, as the time stamp does not reflect the post update time/date) the team updated its blog again, suggesting a few possible causes for the reports by certain Windows users of their machines updating automatically. On the team’s list of possible reasons that AU settings can be (re)set or changed:

  • “During the installation of Windows Vista, the user chooses one of the first two recommended options in the “Out of Box Experience” and elects to get updates automatically from Windows
  • “The user goes to the Windows Update Control Panel and changes the AU setting manually
  • “The user goes to Security Center in Windows Vista and changes the AU setting
  • “The user chooses to opt in to Microsoft Update from the Microsoft Update web site
  • “The user chooses to opt in to Microsoft Update during the installation or the first run experience of another Microsoft application such as Office 2007.”

In short, Microsoft’s explanation was that users were knowingly or unknowingly changing their own Automatic Update settings and complaining about the results.

I went back and asked some of the many readers who complained in the comments on my blog post, as well as the additional ones who sent me e-mail, about both Vista and XP automatically updating even after they had indicated they did not want automatic updates to take effect automatically. I showed them Microsoft’s explanation. To put it politely, many did not feel Microsoft’s explanation was adequate. Here’s one reader response from a user who said that his XP machine rebooted itself this month, despite his AU settings being set to off:

“I’m not buying their explanation. I — for several years — have always shut off Windows update. I don’t want anything installed on my computer unless I know about it. If something is done on my computer, installations or whatever, I want to control it. I don’t allow any software vendor to update my software unless I’m aware of it. This includes Sun, Firefox, Thunderbird and others. I’m a computer tech and am keenly aware of how software changes can have adverse effects on a computer. I especially don’t trust Microsoft. Why and how Microsoft made changes to my computer very much concerns me and makes me more wary of MS than ever.”

Another reader astutely replied that he cialis daily generic thought that the users might be experiencing the problem noted my ZDNet blogging colleague David Berlind back in August. Berlind documented how Vista could force unwanted and immediate reboots on users. Microsoft’s explanation, at that time, was that users running in non-admin mode might be subject (knowingly or unknowingly) to the whims of their administrators. Microsoft’s explanation to Berlind:

“Because an administrative user had configured the machine to automatically stay up to date, the reboot is not postpone-able by a non-admin. Allowing a non-admin to override an admin’s wish is not the right default for security sake. This behavior is also controllable by policy to allow a non-admin user to interact with Windows Update. So yes, what [you] experienced is by design and justifiable as it does not allow a non-admin to go against the wishes of the administrative user. And again if running as a non-admin is his normal mode of operation, then there are policies which can be set to tweak behaviors more to his liking.”

I went back to the spokesperson for the Update team and asked whether it might be possible that this same policy decision was what was causing so many users to report that Vista and XP were automatically updating their machines against their wishes right after Patch Tuesday this month. The spokeswoman forwarded me the same response sent to Berlind, noting that it applied to Vista and XP.

The spokesperson said users who felt these settings were inappropriate should get their admins to change the policy setting in Windows Update so that a restart does not happen automatically after a scheduled install. (As Berlind noted back in August, changing this setting is not something many average users will be able to do easily.)

Microsoft is pointing users to this TechNet article explaining how to stop their machines from patching themselves without their approval, as well as this piece, which is specific to managing Windows Software Update Services settings.

There are still a number of unanswered questions, in my mind, regarding this matter. Why are reports of machines updating themselves automatically surfacing now, over the past several months, and not before now — especially in the case of five-year-old Windows XP? Are we going to start seeing these kinds of complaints flood in every month right around the time of Patch Tuesday? And are there other reasons beyond those Microsoft has suggested as the causes of Windows machines automatically patching and updating themselves which might be at fault here (as the reader I quoted is suggesting)?

Microsoft considers this Windows Update case closed. But is it? And should it be?

Permalink • Print • Comment
« Previous PageNext Page »
Made with WordPress and a search engine optimized WordPress theme • Sky Gold skin by Denis de Bernardy