Microsoft SIR Report - Volume 10
Direct download (PDF) or Microsoft webpage:
https://www.microsoft.com/security/sir/

What is SIR: The Security Intelligence Report (SIR) is an investigation of the current threat landscape. It analyzes exploits, vulnerabilities, and malware based on data from over 600 million systems worldwide, as well as internet services, and three Microsoft Security Centers.

Regards
Urs

Certainly interesting approach and in my opinion something that is kind of overdue since a long time as good old SMTP was never designed for the today’s world and Internet. Also the idea to charge for emails is not new, but together with a new service type, providing emails on the same level as paper mail sounds interesting and it makes - at least for me - more sense to charge for such a service. I had many discussions with customers that wanted exactly such features like proof of identity, proof of delivery, etc. But the main question remaining is, if it makes sense to solve that in isolated solutions (services) or if we don't need a new global standard for such needs. SMTPv2? :-) As long as I need to attach also to the SMTP-World, I will still have a SPAM problem.

Also interesting the second aspect of the article, describing a new German law, that allows ISPs to charge for sent messages (if they wish). However, I'm surprised that it needs a new law to do so.
Would you pay for emails and if so, how much?

Perhaps this would help to solve another issue: Bots on end users PCs. Sometimes, I get the impression that some people don't care about their PCs security and would even "accept" (or ignore) a (hidden) bot on their PC. They have a flat Internet rate and don't care about sent emails, other traffic and as long as the bot does not disturb their work. But if they have to pay?

-Urs

These articles cover the fundamental information how to secure Windows 7 and some of the lesser known security functionality it provides.

- Urs

- Urs

The high-profile Stuxnet incident included validly signed malware with misappropriated Authenticode certificates from two Taiwanese companies. More recently, it appears a U.S. credit union lost its private key to malware authors who used it to sign some variants of Trojan:Win32/Tapaoux.A as well.

https://blogs.technet.com/b/mmpc/archive/2010/09/16/hold-on-to-your-keys.aspx

Microsoft has also published a guide: Code-Signing Best Practices:
https://www.microsoft.com/whdc/driver/install/drvsign/best-practices.mspx

-Urs

"Keeping a keylogger off your machine is about a trillion times more important than the strength of any one of your passwords,” says Cormac Herley, a principal researcher at Microsoft Research who specializes in security-related topics.

https://www.nytimes.com/2010/09/05/business/05digi.html?_r=1&bl

- Urs

Short for Enhanced Mitigation Experience Toolkit, EMET version 2.0 brings several new protections to operating systems and applications such as Windows XP or Internet Explorer 6, which remain widely used even though they are not as secure as more recent releases.

https://www.microsoft.com/downloads/details.aspx?FamilyID=c6f0a6ee-05ac-4eb6-acd0-362559fd2f04&displayLang=en

Software vulnerabilities and exploits have become an everyday part of life. Virtually every product has to deal with them and consequently, users are faced with a stream of security updates. For users who get attacked before the latest updates have been applied or who get attacked before an update is even available, the results can be devastating: malware, loss of PII, etc.

Security mitigation technologies are designed to make it more difficult for an attacker to exploit vulnerabilities in a given piece of software. EMET allows users to manage these technologies on their system and provides several unique benefits:

1. No source code needed: Until now, several of the available mitigations (such as Data Execution Prevention) have required for an application to be manually opted in and recompiled. EMET changes this by allowing a user to opt in applications without recompilation. This is especially handy for deploying mitigations on software that was written before the mitigations were available and when source code is not available.

2. Highly configurable: EMET provides a higher degree of granularity by allowing mitigations to be individually applied on a per process basis. There is no need to enable an entire product or suite of applications. This is helpful in situations where a process is not compatible with a particular mitigation technology. When that happens, a user can simply turn that mitigation off for that process.

3. Helps harden legacy applications: It’s not uncommon to have a hard dependency on old legacy software that cannot easily be rewritten and needs to be phased out slowly. Unfortunately, this can easily pose a security risk as legacy software is notorious for having security vulnerabilities. While the real solution to this is migrating away from the legacy software, EMET can help manage the risk while this is occurring by making it harder to hackers to exploit vulnerabilities in the legacy software.

4. Ease of use: The policy for system wide mitigations can be seen and configured with EMET's graphical user interface. There is no need to locate up and decipher registry keys or run platform dependent utilities. With EMET you can adjust setting with a single consistent interface regardless of the underlying platform.

5. Ongoing improvement: EMET is a living tool designed to be updated as new mitigation technologies become available. This provides a chance for users to try out and benefit from cutting edge mitigations. The release cycle for EMET is also not tied to any product. EMET updates can be made dynamically as soon as new mitigations are ready

The toolkit includes several pseudo mitigation technologies aimed at disrupting current exploit techniques. These pseudo mitigations are not robust enough to stop future exploit techniques, but can help prevent users from being compromised by many of the exploits currently in use. The mitigations are also designed so that they can be easily updated as attackers start using new exploit techniques.

-Urs

https://www.cnet.com/8301-17918_1-20015314-85.html?tag=mncol;1n

-Urs

https://blogs.pcmag.com/securitywatch/2010/08/microsoft_releases_sdl_docs_wi.php

On that front there was big news today:

• Microsoft SDL (Security Development Lifecycle) :
  https://blogs.msdn.com/b/sdl/archive/2010/08/26/microsoft-sdl-and-the-creative-commons.aspx
• Creative Commons License
  https://creativecommons.org/licenses/by-nc-sa/3.0/

- Urs

https://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=a0920a32-b63d-4e13-8e42-7ad7ad9b3168

The Dynamic IP Restrictions Extension for IIS provides IT Professionals and Hosters a configurable module that helps mitigate or block Denial of Service Attacks or cracking of passwords through brute-force by temporarily blocking Internet Protocol (IP) addresses of HTTP clients who follow a pattern that could be conducive to one of such attacks. This module can be configured such that the analysis and blocking could be done at the Web Server or the Web Site level. The module includes the following features:

• Seamless integration into IIS 7.0 Manager.
• Dynamically blocking of requests from IP address based on either of the following criteria:
  • The number of concurrent requests.
  • The number of requests over a period of time.
• Blocking of requests can be configured at either site or server level.
• Configurable deny actions allows IT Administrators to specify what response would be returned to the client. The module support return status codes 403, 404 or blocking the requests entirely.
• Support for IPv6 addresses.
• Support for web servers behind a proxy or firewall.

- Urs