Security for all

Quote:

---

Both legitimate and unlicensed users of Microsoft's XP operating system software will be able to download the Service Pack 2 security patch for free

Microsoft's increasing concern over information security has translated into its decision to bite the bullet and make its upcoming SP2 (Service Pack 2) security patch available to all users - including those using pirated copies of its Windows XP software.

"We haven't explicitly done anything to SP2 to exclude it from pirated copies," said Microsoft group product manager Barry Goffe. The United States-based executive was interviewed via telephone.

This is unlike SP1 (Service Pack 1), which had features to prevent users with pirated copies from downloading it. In SP2's case, the mammoth 80MB to 250MB patch can be downloaded and installed on computers running both legitimate and pirated copies.

Users can also request a free CD copy of SP2, although shipping charges could apply, something which the company has yet to finalise, said Mr Goffe.

"It was a tough choice, but we finally decided that even if someone has pirated copy of Windows, it is more important to keep him safe than it is to be concerned about the revenue issue," he added.

He admitted, however, that it is more than altruism that helped Microsoft come to this decision.

"Having these unsecured users means bigger worm and virus outbreaks - which also impacts the Internet and consequently, our legitimate users as well."

The most visible changes SP2 will introduce to XP is the new Windows Firewall, a renamed, upgraded version of the ICF (Internet Connection Firewall) firewall system that shipped with the original Windows XP, and the new aggressive attitude towards security updates and controls.

Unlike ICF, Windows Firewall is turned on by default, and automatically locks up ports like DCOM (Distributed Component Object Model) popular among worm-writers.

New technology allows it to dynamically open and close ports on demand. For example, when an approved online gaming application is given permission to send or receive data over the Net, the port is opened for it, and when the application shuts down, the port is closed.

"We wanted a firewall good enough for most consumers' needs, and we believe Windows Firewall is it," said Mr Goffe.

SP2 will also make XP more aggressive towards sloppy users. For example, features like the automatic patch updating feature or Windows Firewall will no longer go away quietly if ignored, and will continue to pester users to download new patches periodically. To balance this, the company is working on coming up with more user-friendly warnings and reports of any suspicious activities that occur.

Besides these two changes, there are many other under-the-hood security features aimed at "stopping malicious code like worms, phishing attacks like websites that hijack web browsers to trick users into giving out personal information, and improving security against the buffer overrun attacks favoured by virus-writers," said Mr Goffe.

Other than security-related upgrades, SP2 also introduces a much-awaited anti-pop-up ad feature, and is integrated with the Internet Explorer Web browser to allow users to stop pop-ups that the user did not explicitly request.

The service pack is scheduled for a "first half of 2004" launch date, and the company is currently testing its first release candidate or RC1. There is expected to be at least another release candidate tested before the actual patch release.

Meanwhile, Mr Goffe noted that pirate users should not assume that the change of heart in SP2 means that Microsoft is going soft on piracy.

"We have and are developing new technologies to combat piracy for our software, but for SP2 we'll make one exception."

---

Source : http://computertimes.asia1.com.sg/ne...4,2292,00.html

So I guess the first question we will have to answer when SP2 comes out is how good of a firewall is it going to have? I mean will it be good enough to replace firewall programs like zone alarm or the such or will it just be the next target for skiddies and virus writers to attack? Microsoft has done a lot of talking up with this firewall and their next SP so heres hopin that it will work out well. But dont count on me disabling any of the firewall rules I have set in place now.

On a side note: do you think it wil be an editable firewall where you will be able to open your own ports?

Spyrus: Putting it into perspective any firewall is better then none. ICF functions, albeit in a limited fashion. In some ways a firewall that you have no control over is better for Joe and Jane Public. It doesn't bother them with "OMG, something is trying to get to the internet" which does nothing for them other than raising their level of paranoia.... :rolleyes: If the next version can be unobtrisive yet effective while still allowing Joe to play his games while Jane racks up his credit cards then I'm for it...... and they'll both be happy and more secure...

Quote:

---

"It was a tough choice, but we finally decided that even if someone has pirated copy of Windows, it is more important to keep him safe than it is to be concerned about the revenue issue," he added.

---

This part kind of stands out to me. While it generally seems like they are trying to do the right thing. It also seems as if they are planning something. Smoke and mirrors. Maybe it is just me, I am very untrusting when it comes to big corperations.


Two cents.

Quote:

---

"It was a tough choice, but we finally decided that even if someone has pirated copy of Windows, it is more important to keep him safe than it is to be concerned about the revenue issue," he added.

---

Microsoft just wants to look good after the whole "We Are Going To Destroy The Hell Out Of Linux and it Sucks" thing. That and probobly their involvement with SCO. Politics Politics and more ways to make money (and look good to the open source community).

My Three cents

-Lansing_Banda

Perhaps that is another way to look at it. Thanks for your point of view

Just like dopeydadwarf I'm TOO SUSPICIOUS when it comes to big corporations. While it seems that M$ is trying to do the right thing (which I do NOT believe that that's what they're doing) I get a little worried about that "We have and are developing new technologies to combat piracy for our software, but for SP2 we'll make one exception."

This and that "smoke and mirrors" thing dopeydadwarf said makes me wonder what's really behind the scenes....

Actually, it really rather simple..... Microsoft _are_ trying to do the right thing, for the very reasons you people are so suspicious......

With their historic stance on security all they have managed to acheive is criticism and mirth. Those two are not a good combination when you are trying to sell a product. The phrase "any publicity is good publicity" is all fine and dandy when you are talking about some idiot actor but when you are trying to sell a product bad publicity weighs into making the purchase decision.

Now let's say they make a change, like they have, and over the next few years the proloiferation of worms and viruses begins to decrease..... What then? Well, with the decrease in attacks on WinX because it is harder to get into will come an increase in attacks on other OS's.... Interesting. M$ highlights the failure in other's products by reducing the failures in their own. At a minimum they should end up holding market share...... Which, I would suggest, is their absolute minimum goal....

But we win in the end too...... ;)

I know some people who have downloaded the beta version of SP2 for XP Pro. and they have had lots of problems with it screwing up their hard drives.

You have to keep in mind that the people downloaded a BETA version of the Service Pack, thus they probably knew this kind of thing could happen (or at least, they were supposed to know).

TigerShark said something interesting, though. Although I don't think the other OS's will stop creating patches for them, so, theoretically, the attacks should keep being the same for all of the OS's.

And I do believe that there are more people trying to mess up with Win boxes than with any other OS's there is. =)

Quote:

---

Now let's say they make a change, like they have, and over the next few years the proloiferation of worms and viruses begins to decrease..... What then? Well, with the decrease in attacks on WinX because it is harder to get into will come an increase in attacks on other OS's.... Interesting. M$ highlights the failure in other's products by reducing the failures in their own. At a minimum they should end up holding market share...... Which, I would suggest, is their absolute minimum goal....

---

Tiger Shark, I'll give you the benefit of the doubt here. This would only make sense in the long run because it comes down to the money. If they do this for whatever reason, it will remove alot of my doubt. I actually hope they succed in their mission if you want the truth. However
until then I will remain pesimistic when the name MS is in the same sentence with improvement.

Well,

Quote:

---

I will remain pesimistic when the name MS is in the same sentence with improvement.

---

I believe that Microsoft can be totally relied upon to try to improve their market dominance, improve their revenues and improve their profits. :)

Given that a lot of recent malware has been multivector, the presence of even one unpatched, unprotected, vulnerable machine can be a serious problem....

"A chain is a strong as its weakest link"

The Microsoft customer base just look at the damage they incur, rather than the real cause, and blame Microsoft. This is not entirely reasonable:

I used to have my firewalls set to warn of intrusion attempts, I turned that off some time ago, as the pop-ups were making the machines unusable. Nowadays I just look at the logs. All this is because of infected machines on the net, the actual number of "personal" attacks does not seem to have increased significantly. I don't blame Microsoft for this, just as I would not blame General Motors if the automobile was stolen.............I would blame the thief, and the owners (for being careless). However, a lot of people don't see things that way?

I think that Tiger has it right, it is in Microsoft's best interests, so they do it.

On a cynical note:

1. The pirate versions of XP are revenue that Microsoft have already lost. The users will continue to use it, becoming "weak links in the chain"
2. They cannot "sell" patches, their development costs are straight off the bottom line.
3. If they try to protect a patch, it will be even more money wasted as there will be a crack for it within a week.
4. Demonstrating "product support" and "responsibility" is a good marketing line?

Just my thoughts

Nihil

Quote:

---

I actually hope they succed in their mission if you want the truth.

---

Come on man, give me the benefit of the doubt here. I don't wish harm upon MS. Nor do dislike their software so to speak. There are just rules of engament. Find the most widely used OS. Find a weak link and exploit it. As long as MS holds the market for EU's they will always be a target, and there will always be people finding holes. All I was really suggesting was, MS needs to make some big changes before they can be succesful. Besides, using Sasser as an example what good are the patches if only folks like us download them. The foundation for this castle is quickly degradating. It is either time to help reinforce it, or we will have no other choice but to watch it crumble.

Thanks for the reply BTW.

Microsoft: SP2 Will Not Install on Pirated Copies of XP

Quote:

---

Contrary to the remarks it made to the ComputerTimes, Microsoft now claims that it will not permit users who have obtained Windows XP illegally to upgrade to its latest service release. Instead, the software giant will continue to enforce compliance with its licensing.

In a nutshell, Microsoft group product manager Barry Goffe told ComputerTimes that Windows XP Service Pack 2 would not exclude pirated copies from upgrading, and that it was more important to keep user safe than to be "concerned about the revenue issue."

To clarify its position, a Microsoft spokesperson told BetaNews, "Press reports indicating Windows XP Service Pack 2 will install on pirated or illegal copies of Windows XP are not entirely true. Prior to installing, SP2 will check the OS' product ID (PID) against a list of known pirated PIDs. If a PID is found to be invalid, SP2 will not install."

BetaNews confirmed the accuracy of the spokesperson's statement with a source within the company.

"Microsoft's position with SP2 is no different than SP1, so no one should really be surprised that the update might not install on pirated Windows XP versions. Enabling the update for known leaked activation keys could foster more piracy, something Microsoft would want to prevent," said senior Jupiter Research senior analyst Joe Wilcox.

Wilcox noted however, that "it is not clear how many of the Windows XP PCs infected with worms or trojan horses -- software used to spread spam, hide spammers or launch denial of service attacks -- run pirated software. Withholding the update, even for good reason, could contribute to ongoing security problems affecting legitimate Microsoft customers."

Service Pack 2 has fortified Windows XP with a new mix of security features including: a new version of Internet Explorer, which for the first time includes a pop-up blocker and download manager; improved memory protection; e-mail safeguards for Outlook Express; the Windows Firewall; and new security settings for Windows Media Player 9.

Windows networking will see reduced privileges assigned to system services such as Remote Procedure Call (RPC), and Microsoft has redesigned its Distributed Component Object Model (DCOM) by adding granular COM permissions.

Control over these new security features will be governed by the new Windows Security Center. Security Center checks for the third-party antivirus protection, manages automatic system updates and exerts control over the Windows Firewall.

A second release candidate of the service pack is slated for late May or early June, with RC3 also a possibility. The final release of Windows XP Service Pack 2 is expected to be completed by the end of the summer.

---

Source : http://www.betanews.com/article.php3?sid=1084264398

Who should we trust? I trust this one more! :)

Why can't they just make up their mind? I personally think it would make more sense to give it to everyone due to the fact that (as others have mentioned) it will keep them from being zombies and attacking/infecting the machines that are completely legal...