Windows 7 Security: What's the Real Story?

Published by Sunbelt Software	FORUMS | RSS | MY PROFILE | PRIVACY

Vol. 2, # 13 - Apr 1, 2010 - Issue # 29   Windows 7 Security: What's the Real Story? Editor's Corner Windows 7 Security: What's the Real Story? Follow-up: Storage technology Quotes of the Week Cool Tools News, Hints, Tips and Tricks Windows 7 taskbar tips Forrester study says Windows 7 users are very satisfied with the OS Top Ten Riskiest Cities for Cybercrime HTC HD2 runs Windows Phone 7 How to: Using the New Windows 7 Features How to change the duration of Windows 7 notifications Windows 7 and Vista Security Microsoft issues emergency out-of-band update Question Corner How can I see my XP computers in the network map? Windows 7 Configuration and Troubleshooting Windows 7 won't sleep Windows 7 mobile PC doesn't wake up Fav Links This Week's Links We Like. Tips, Hints And Fun Stuff Product of the Week CyberScrub Privacy Suite: Completely Erase Evidence of All Internet/Computer Activity & Encrypt Data NEW! VIPRE® Antivirus Premium 4.0 VIPRE is the only antivirus software that does not slow down your PC, and now it comes with integrated firewall! VIPRE Antivirus Premium 4.0 Does not slow down your PC New antivirus + antispyware engine with firewall Advanced anti-rootkit technology Cutting-edge Proactive Protection Full email protection: Outlook and Windows Mail Ideal for Netbooks that need malware protection No automatic credit card charge each year! Try VIPRE Antivirus Premium now for 30-days FREE! http://www.win7news.net/O52HI2/100401-VIPRE-Premium Editor's Corner Windows 7 Security: What's the Real Story? The tech press, like the mainstream news media, loves a story that makes somebody or something (in this case, Windows 7) look bad. Thus it's not surprising that after last week's Pwn2Own hacking contest, which was part of the CanSecWest security conference in Vancouver, Canada last week, headlines like this one popped up: "Hackers Exploit Windows 7 in 2 Minutes." http://www.win7news.net/O52HI2/100401-Windows-7-Exploit They did this by disabling DEP and ASLR via the web browser. Data Execution Prevention is designed to prevent applications from executing code from a non-executable region of memory and thwart buffer overflow exploits. Address Space Layout Randomization makes it harder for attackers to predict target memory addresses. These security mechanisms are enabled by default in Windows 7 IE8. So does this mean Windows 7 and IE 8 are putting you in danger and you should switch to a different operating system and/or browser? Microsoft's competitors would love for you to believe that, but the Firefox and Safari browsers were exploited in the contest, too. Chrome proved to be the "last man standing." As for the Windows 7 OS, a new study by BeyondTrust security researchers found that most Windows 7 security problems are caused not by insecurity of the operating system but by inexperienced or sloppy systems administrators who don't configure administrative rights properly. In fact, according their report 90% of Windows 7 vulnerabilities could not have been exploited if users were not given administrative rights. They say this would have protected against 100% of IE 8 vulnerabilities. You can read the report in PDF format here: http://www.win7news.net/O52HI2/100401-Vulnerability-Analysis Microsoft representatives felt it necessary, in the wake of all the publicity, to clarify that the defensive measures built into Windows 7 aren't meant to "prevent every attack forever." Anyone who expects that they would is, in my opinion, being a big unrealistic about the nature of security, as I wrote in this blog post: http://www.win7news.net/O52HI2/100401-Not-Fool-Proof While the Windows 7 attack made headlines on many sites, less attention was given by many writers to the hack of a fully patched OS X Macbook by security researcher Charlie Miller at the same conference. http://www.win7news.net/O52HI2/100401-Hacker-Disappointed-w-Apple In the past, Microsoft has been criticized for the number of patches they issued, with detractors claiming that lots of patches equal lots of security flaws that shouldn't have been there in the first place. Interestingly, Apple recently released a security update for Leopard and Snow Leopard that contained 92 patches, with a third of the vulnerabilities addressed rated as critical. http://www.win7news.net/O52HI2/100401-Monster-Security-Update Perhaps the most significant fact to come out of the Pwn2Own story is that web browsers are the weak spot in the security of most systems. The Windows 7 hack used IE 8 and the OS X hack exploited a vulnerability in Safari. The details of that vulnerability are a closely guarded secret until Apple releases a fix. The iPhone 3G was also successfully hacked in the contest, and once again, Safari was the mechanism used to do it. The German government takes browser security so seriously that their CERT office issued a warning to their citizens in March, advising them to stop using Firefox because of a critical vulnerability. http://www.win7news.net/O52HI2/100401-Firefox-Warning And early in the month, security researchers were "sounding the alarm" over an unpatched remote code execution vulnerability in Opera. http://www.win7news.net/O52HI2/100401-Opera-Flaw Even Google Chrome, the browser that "won" the contest, had been patched for eleven vulnerabilities a few days before Pwn2Own, with an update rated by Secunia as "highly critical." http://www.win7news.net/O52HI2/100401-Chrome-Patches If we could remove all web browsers, our operating systems would be significantly more secure. Unfortunately, they would also be significantly less functional, since we would be unable to get information from web sites, pay bills or shop online, or even send email if we have web-based accounts. The web browser is not only the application that's most often used to connect to the Internet; it's also one of the most frequently used applications of all on most systems. In the early days of the Internet, web browsers displayed text and picture files and that's about it. Web pages were written in simple HTML. Today's web sites use much more sophisticated technologies to provide us with video and interactive elements. ActiveX, VBScript, JavaScript, Java and various plug-ins such as Flash and Silverlight enable a much richer web experience, but they also come with security issues. You can disable some or all of these features to make your browser more secure (but you may be unable to access some web sites or view some content on some sites). One thing is certain: newer versions of web browsers are generally more secure than older versions, and it's important to keep your browser (and your operating system) updated with the latest security patches. If you want to increase the security of your Windows 7 machines, especially in a business environment, you may have looked for the Windows 7 Security Guide and concluded that there's not one. When you search the web or search Microsoft.com, you'll find the XP Security Guide and the Vista Security Guide, but it's a little more difficult to ferret out the Windows 7 Security Guide. That's because it's part of the Windows 7 Security Compliance Management Toolkit. That's a 16.6 MB download that you can find here: http://www.win7news.net/O52HI2/100401-Security-Toolkit The download includes toolkits for each of the following operating systems: Windows XP, Vista, Windows 7, Server 2003, Server 2008. It also includes toolkits for IE 8 and Office 2007. When you finally drill down to the Security Guide itself, you'll find it's a .docx document that contains 83 pages and covers most aspects of Windows 7 security, including how to implement a security baseline and relevant policy settings, protecting against malware, protecting sensitive data with BitLocker, EFS and RMS, controlling device installation and usage, and application compatibility. Bottom line: Windows 7 is a secure OS when configured and used properly - but no operating system provides perfect security. It's up to you to use best security practices, have anti-virus and anti-malware software installed and running, have a firewall turned on and properly configured and otherwise practice defensive computing. In many cases, it's not the operating system but the applications installed on it that can be exploited. Web browsers are the number one culprits, so it's vital that you keep your browser updated and stay away from questionable web sites. If you do need to visit risky sites, such as for research purposes, it's a good idea to use "sandboxing" of some kind to isolate the web browser you use to visit those sites from your primary operating system. You can do that by running a browser in a virtual machine (for example, if you have Windows 7 Pro or above, you can download and install Windows Virtual PC and XP Mode, install IE 8 or another browser of your choice in the XP VM, and use that for risky browsing. You can also use VMware for the same purpose, or a program such as Sandboxie. Or you can use the Chrome browser, which has built in sandbox technology. Tell us what you think about Windows 7 security. Do you feel more secure using Windows 7 than you did with XP or Vista? Do you buy into the Apple ads that claim Mac is more secure than Windows 7? Do you think Linux is better for security? What web browser do you consider the safest? Do you use it exclusively, or do you have criteria other than security by which you choose your browser? Do you disable some or all of the scripting and other potentially dangerous features in your web browser, or do you take the risk in order to get a better web experience? We invite you to discuss these questions in our forum at http://www.win7news.net/O52HI2/100401-Forum-Discussion Follow-up: Storage technology In last week's editorial, I talked about trends in storage technology and how this particular computer component has evolved since the olden days when we stored data on for our personal computers on cassette tape. Several readers weighed in on the subject. Jaze asked about the WEI disk subscore for a Windows 7 computer with an SSD drive. As a matter of fact, my Sony VAIO X has an SSD drive and although its overall WEI score is low - thanks to the gaming graphics score, which I would never use on this laptop - the subscore for the disk is a pretty good 6.9, which is certainly better than the disk score on my otherwise powerful Nehalem desktop. My son built a Nehalem-based machine for analyzing chess games and planning chess strategy. Since it runs Windows Server 2008 R2, there is no WEI score, but he says performance is substantially better with the Intel SSD than with a traditional hard disk. I wrote about his system here: http://www.win7news.net/O52HI2/100401-Chess-Strategy In the forums, Schiang pointed out that you can offset the expense of the SSDs somewhat by buying slower processors, because SSDs make more difference in perceived performance for most users than upgrading from dual to quad core, even at 50% faster CPU speed. David W. disagrees; he thinks the best option is a set of conventional SATA II or III in RAID 0 configuration. As Tim G. notes, though, that's more hardware and configuring than some people want to bother with. Different strokes for different folks. Tim D. noted that he upgraded from 32 bit to 64 bit Windows 7 on a Core i7 system with 6 GB of RAM, but saw no discernable difference. I would expect to see increased performance from the ability to utilize the full 6 GB of RAM. Tim also mentioned that he was unable to get a WEI rating due to an error message that says the system doesn't have the necessary multi-media support to run the requested assessment. This problem has been reported to have been caused by the video card drivers, or by various anti-virus programs. Finally, WEI - for some strange reason - is dependent on components in Windows Media Player (WMP) so if you have removed WMP (or if you have the "N" European version of Windows 7 that comes without WMP, you won't be able to run WEI. As always, thanks to everyone who participated in the discussion. 'Til next week, Deb Shinder, Editor feedback@win7news.net PS: Did you know this newsletter has a sister publication for XP users called WXPnews? You can subscribe here, and tell your friends: http://www.win7news.net/O52HI2/100401-WXPNews And for IT pros, there's our "big sister," WServer News, at http://www.win7news.net/O52HI2/100401-WserverNews Look for the Win7News fan page on Facebook! Quotes of the Week "Only those who attempt the absurd will achieve the impossible. I think it's in my basement ... let me go upstairs and check." - M.C. Escher "Action is the fundamental key to all success." - Pablo Picasso "Have no fear of perfection - you'll never reach it." - Salvador Dali "Great things are done by a series of small things brought together." - Vincent Van Gogh NEW! VIPRE® Antivirus Premium 4.0 VIPRE is the only antivirus software that does not slow down your PC, and now it comes with integrated firewall! VIPRE Antivirus Premium 4.0 Does not slow down your PC New antivirus + antispyware engine with firewall Advanced anti-rootkit technology Cutting-edge Proactive Protection Full email protection: Outlook and Windows Mail Ideal for Netbooks that need malware protection No automatic credit card charge each year! Try VIPRE Antivirus Premium now for 30-days FREE! http://www.win7news.net/O52HI2/100401-VIPRE-Premium Cool Tools ADVERTISEMENT Why back up when you can sync? Simply replicate every piece of data to another drive in real-time. Set it and forget it. http://www.win7news.net/O52HI2/100401-GoodSync Do you have programs you just can't seem to get rid of? Uninstaller! 2010 "ALL New" Version Just Released: http://www.win7news.net/O52HI2/100401-Your-Uninstaller Moving to Windows 7 is Easy! PCMover moves programs, files, and settings from your old PC to your new PC. http://www.win7news.net/O52HI2/100401-PCmover Search for a driver and you get a ton of Driver Software offers instead. But how do you know which one is good? Try Driver Genius 9.0. Free scan. http://www.win7news.net/O52HI2/100401-Driver-Genius Billing address autofill, Secure password storage, all automatic and safe. Not a little toolbar utility. Huge time saver! http://www.win7news.net/O52HI2/100401-RoboForm Get your speed back! Advanced Vista Optimizer will tweak Vista for Max performance. Easy to use: http://www.win7news.net/O52HI2/100401-System-Optimizer Spellchecker is NOT ENOUGH! Improve your English writing skills with WhiteSmoke a smarter solution for high quality writing. Try it: http://www.win7news.net/O52HI2/100401-WhiteSmoke Ultra Edit New Version 15.2 - Replacing Notepad or Looking for The Most Powerful Text Editor? http://www.win7news.net/O52HI2/100401-UltraEdit News, Hints, Tips and Tricks Windows 7 taskbar tips The Windows 7 taskbar is good - but there are ways to make it better. We've told you before how to add back the Quick Launch bar, but that's not the only "hack" you might be interested in. For instance, you can add information about volume, battery life and memory use, put the recycle bin on the taskbar, or more easily control the behavior, with the tips in this article: http://www.win7news.net/O52HI2/100401-Taskbar-Hacks Forrester study says Windows 7 users are very satisfied with the OS A new report out from Forrester Research finds that the majority of early adopters of Windows 7 described themselves as "very satisfied." It also contained the somewhat surprisingly news that more than 40% of the consumers who have moved to Windows 7 did so by upgrading an existing computer, rather than getting it pre-installed on a new PC. Either way, it's good news for Microsoft, especially after the beating Vista's reputation took among users. Read more here: http://www.win7news.net/O52HI2/100401-Win7-Early-Adopters Top Ten Riskiest Cities for Cybercrime Security experts at Norton have compiled a list of the cities that have the most reported cybercrime and Seattle is right at the top. Other cities on the list (San Francisco, Denver, Boston, Austin) tend to be places where the tech industry thrives, as well. That's really not surprising - the more people you have online in a given area, the more likely online criminals will target them. The rankings also take into account the tendency of people in a particular area to engage in risky online behavior, such as using wi-fi and conducting financial transactions over the Internet. Find out whether your city made the top ten list: http://www.win7news.net/O52HI2/100401-Riskiest-Online-Cities HTC HD2 runs Windows Phone 7 It's been widely reported that existing Windows Mobile 6.5 phones won't be able to run the new Windows Phone 7 Series operating system that's expected to come out before the end of the year - but a hacker has ported the new OS to the HTC HD2, which is one of the most attractive WinMo smart phones on the market now. Here's a video showing this phone running the next generation Windows phone software: http://www.win7news.net/O52HI2/100401-HTC-HD2 How to: Using the New Windows 7 Features How to change the duration of Windows 7 notifications By default, notification dialog boxes in Windows 7 stay open for 5 seconds. Maybe that's not long enough for you to deal with them. You can change the time duration easily, without having to edit the registry. Here's how: Click Start | Control Panel. Click Ease of Access Center. Click "Make it easier to focus on tasks" Scroll down to the "Adjust time limits and flashing visuals" section and under "How long should Windows notification dialog boxes stay open," click the down arrow at the right side of the drop-down box. Select a duration from 5 seconds to 5 minutes. Click OK. Windows 7 and Vista Security Microsoft issues emergency out-of-band update It was Tuesday, but it wasn't Patch Tuesday. Nonetheless, Microsoft released a security update this week for ten vulnerabilities in Internet Explorer. This emergency "out of band" release was the result of a zero day vulnerability that was made public earlier in the month and the growing number of attacks that attempt to exploit it. This is the iepeers.dll vulnerability. The good news is that this vulnerability doesn't apply to IE 8 in Windows 7. However, three of the other vulnerabilities that are addressed in this patch do. Read more here: http://www.win7news.net/O52HI2/100401-Web-Browser-Vulnerabilities Question Corner How can I see my XP computers in the network map? QUESTION: I have one new Windows 7 computer, one Vista computer and an old XP laptop on my home network. I like the network map in Network and Sharing Center but the XP computer doesn't show up there, just the Windows 7 and Vista. Is there any way to make the XP system show up on the map? Thanks! - Mark L. ANSWER: Windows 7 and Vista use the Link Layer Topology Discovery (LLTD) protocol to detect the systems on the network and create the network map. The problem is that XP doesn't support LLTD by default, so your XP systems will show up at the bottom of the page and not on the map. You can add LLTD support to XP if you have Service Pack 3 installed. You'll need to install a hotfix, which you can download from the link on this page (where you will also find more information about this issue): http://www.win7news.net/O52HI2/100401-Network-Map Windows 7 Configuration and Troubleshooting Windows 7 won't sleep Every parent can relate to this: those nights when your child just won't go to sleep. But what if it's your Windows 7 computer that has insomnia? If you try to put the computer to sleep and it wakes back up immediately or doesn't go to sleep at all, there are several things you can try to fix the problem (depending on what's causing it). To get the details, check out KB article 976877 at http://www.win7news.net/O52HI2/100401-Win7-Wont-Sleep Windows 7 mobile PC doesn't wake up Okay, here's a problem that's just the opposite of the one above. In this case, your mobile Windows 7 computer won't wake up to run a scheduled task, even though you configured it with the "wake the computer to run this task" option. You probably won't have the same problem with your desktop system. That's because, by default, the ability to wake from sleep for a timed event is disabled on mobile computers (to save battery power). However, you can change the power settings to fix this. Find out how in KB article 973454 at http://www.win7news.net/O52HI2/100401-Win7-Mobile-PC Fav Links This Week's Links We Like. Tips, Hints And Fun Stuff Disclaimer: VistaNews does not assume and cannot be responsible for any liability related to you clicking any of these linked Web sites. Happy Easter http://www.win7news.net/O52HI2/100401-Easter-Bunnies Top Ten animal power moves http://www.win7news.net/O52HI2/100401-Power-Moves Smart or Stoopid? Take the test. http://www.win7news.net/O52HI2/100401-Test I love these ancient public service films: http://www.win7news.net/O52HI2/100401-Public-Service-Announcement 500 worst passwords http://www.win7news.net/O52HI2/100401-Passwords Trololo cat http://www.win7news.net/O52HI2/100401-Trololo-Cat A palindrome reads the same backwards as forward. This video however, reads the exact opposite backwards as forward. Not only does it read the opposite, the meaning is the exact opposite. It got spontaneous applause wherever shown: http://www.win7news.net/O52HI2/100401-Lost-Generation Imagine traveling 40 miles without using a single drop of gasoline. The Chevy Volt offers innovative green engineering. Fuel Economy: 230 mpg, Price: 30-40k http://www.win7news.net/O52HI2/100401-Volt Unbelievable: A dog and a deer having fun playing soccer: http://www.win7news.net/O52HI2/100401-Soccer Product of the Week CyberScrub Privacy Suite: Completely Erase Evidence of All Internet/Computer Activity & Encrypt Data Now fully Windows 7 compatible with improved features for Win7. CyberScrub Privacy Suite removes all evidence of your online activity, erases data beyond recovery, secures your files with strong encryption and enhances overall system performance. This award winning software utility sports over 50 new features and enhancements. Did you realize every picture or video viewed is written to your hard drive? Simply opening an email can put you in a compromising situation. Privacy Suite eliminates all web tracks (pictures, video, history, websites visited, cache and temp files, IM, chat, email, etc.), automatically removes newsgroup pictures and binaries, eliminates traces from popular Peer2Peer applications, Real and Windows Media Player, Photoshop and more. You can even create your own customized areas to clean. Remember- "Delete" does not mean "Erase". Deleted files can be retrieved using simple recovery tools. 100% Windows 7 compatible Privacy Suite software supports Internet Explorer 8 and Firefox 3.5 and supports a huge list of the most popular more Click below for other exciting New Features and to Download the free trial. Use your exclusive 20% discount for Win7News subscribers to purchase. http://www.win7news.net/O52HI2/100401-CyberScrub  About Win7News What Our Lawyers Make Us Say These documents are provided for informational purposes only. The information contained in this document represents the current view of Sunbelt Software on the issues discussed as of the date of publication. Because Sunbelt must respond to changes in market conditions, it should not be interpreted to be a commitment on the part of Sunbelt and Sunbelt cannot guarantee the accuracy of any information presented after the date of publication. INFORMATION PROVIDED IN THIS DOCUMENT IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND FREEDOM FROM INFRINGEMENT. This newsletter and website and may contain links to other websites with whom we have a business relationship. Sunbelt Software does not review or screen these sites, and we are not responsible or liable for their privacy or data security practices, or the content of these sites. Additionally, if you register with any of these sites, any information that you provide in the process of registration, such as your email address, credit card number or other personally identifiable information, will be transferred to these sites. For these reasons, you should be careful to review any privacy and data security policies posted on any of these sites before providing information to them. The user assumes the entire risk as to the accuracy and the use of this document. This document may be copied and distributed subject to the following conditions: 1) All text must be copied without modification and all pages must be included; 2) All copies must contain Sunbelt's copyright notice and any other notices provided therein; and 3) This document may not be distributed for profit. All trademarks acknowledged. Copyright Sunbelt Software, Inc. 1996-2010. Win7News Archives Looking for a past issue? Missing an issue? Accidently deleted an issue? Trying to find that article that pointed you to that cool site? All our newsletters are archived and are searchable: http://www.win7news.net/archives About Your Subscription to Win7News This is a posting from Win7News. You are subscribed as cpedley.killcomputer@blogger.com Your personal W7N Number is: O52HI2 To manage your profile, please visit our site by clicking on the following link: http://www.win7news.net/profile?w7n=O52HI2 If you have feedback or wish to write to the editor, write to us at feedback@win7news.net Sunbelt Software 33 North Garden Avenue Clearwater, Florida USA 33755