Vista Cleans Mac OSX's Clock

In absolute numbers, figures from Net Applications are not particularly impressive.


New Survey: Vista Cleans Mac OSX's Clock

Apple fans have made much of the fact that the newest figures from Net Applications show that Apple's share of the operating system market has jumped almost 32% in the past year. But they're ignoring a simple fact: Vista's market share during that same time leaped more than 355%. When you add in other Windows versions, Microsoft owns more than 90% of the market.

Net Applications reports that the Mac had 7.94% market share in June, up from 6.03% a year ago. Going from a little more than 6% to just under 8% may be a big gain when measured as a percentage of growth. But when seen in absolute numbers, it's not particularly impressive.

Vista, by way of contrast, showed far more explosive growth. In June, 2007, it had 4.54% market share. In June, 2008, it had reached 16.14% --- more than a 355% gain. Those numbers are substantial not just in percentage terms, but in raw terms as well. Apple would sell the first-born children of most of its employees if it could ever get to a 16% market share.

Net Applications says that in June, all versions of Windows were on 90.89% of computers, down from 93.34% a year ago. Both Windows XP and Windows 2000 market share shrunk, while Vista's skyrocked.

It's true that in the last year, Mac OSX has made some small inroads into the operating system market. But Windows is still on more than 90% of computers. Shaving a point or two here and there won't change Microsoft's domination.

For a chart of overall operating system trends, according to Net Applications, click here. For a chart that includes version numbers, click here.

Microsoft Patches its XP Patch

A free tool repairs PCs impaired by the XP SP3 update and a conflict with Symantec's software.


Microsoft Patches its XP Patch

Nearly three weeks after security vendor Symantec Corp. released a free tool to clean up PCs crippled by the Windows XP Service Pack 3 (SP3) update, Microsoft Corp. issued a fix that should reestablish lost Internet and wireless connections.

Last week, Microsoft posted a hotfix for a problem users first reported in mid-May. Users of Symantec's consumer security software said that after updating their PCs to XP SP3, a bug emptied Windows' Device Driver and deleted network connections.

Although Symantec initially blamed Microsoft for the snafu, it later accepted some responsibility. In late May, Symantec acknowledged that Microsoft's updating process and a security feature in its own Norton-branded software combined to swamp the Windows registry with hundreds, sometimes thousands, of bogus and corrupted keys. That security feature, dubbed "SymProtect" by Symantec, was designed to protect the company's security software from attack by guarding against unauthorized changes to the registry.

Although Microsoft had previously declined to comment on the episode, the support document that accompanied the hotfix fingered Symantec's software. "This problem occurs when the Fixccs.exe process is called during the Windows XP SP3 installation," said Microsoft. "This process creates some intermediate registry subkeys, and it later deletes these subkeys. In some cases, some anti-virus applications may not let the Fixccs.exe process delete these intermediate registry subkeys."

The hotfix replaces the Fixccs.exe file with an updated version, but it can only be applied if the user has booted into Windows' Safe Mode, according to the support document.

Symantec has contended that other security software with registry-change monitoring defenses also caused similar problems for users updating to Windows XP SP3, but there have been few reports logged to Microsoft's support forums. Microsoft, however, intimated that Symantec might not be alone when it used the generic, and plural, "some antivirus applications" in its explanatory document.

Users can download the hotfix from the Microsoft site.

Microsoft has not yet begun serving up Windows XP SP3 via Windows Update's Automatic Updates feature, and conceivably could prevent machines that have specific security programs installed from receiving the update. It's already done exactly that by blocking other systems, notably those running AMD processors, from getting XP SP3 to sidestep an endless reboot bug.

Bluetooth, IE to Get Critical Microsoft Patches

Microsoft plans to issue seven sets of security patches next week for Windows.


Bluetooth, IE to Get Critical Microsoft Patches

Microsoft plans to issue seven sets of security patches next week, including critical fixes for DirectX, Internet Explorer and Bluetooth wireless software for Windows.

The updates are due Tuesday, the day Microsoft had previously scheduled to release its security patches. Fixes are also slated for Active Directory, the Windows Internet Name Service (WINS) and the Pragmatic General Multicast (PGM) protocol, used by Windows to stream media to many recipients. These updates are all rated "important."

A seventh update, rated "moderate," is listed as a "Kill Bit" update for Windows. This type of patch will disable code that is known to have a security bug.

"The Kill Bit will more than likely be for a third-party application," said Andrew Storms, director of security operations with security vendor nCircle.

Lately, Microsoft's security group has had to pay more attention to software that runs on top of Windows, as attackers have increasingly looked to products like QuickTime, Adobe's Flash and other media players when devising their attacks.

Last Friday, Microsoft warned that a widely publicized flaw in Apple's Safari browser could be combined with another Microsoft bug to let attackers run unauthorized software on a victim's PC.

It's not clear whether Microsoft plans to patch that bug. The IE update could include a fix, although it's unlikely that Microsoft has had enough time to run this software through its testing process, Storms said.

It is unusual for Microsoft to patch Bluetooth, a protocol used to connect devices like headsets to Windows, but added that "the more interesting question is will this patch and/or the bug extend into Windows mobile where it will more than likely have a greater impact?"

Microsoft announced the planned patches in a note posted to its Web site on Thursday.

Microsoft Clarifies XP SP 3 Flash Issue

Amid concerns that users of its Window XP SP 3 may be vulnerable to online attacks, Microsoft has finally explained XP users need to upgrade Adobe Flash Player


Microsoft Clarifies XP SP 3 Flash Issue

Amid concerns that users of its Window XP Service Pack 3 operating system may be vulnerable to online attacks, Microsoft has finally broken its silence and explained which XP users need to upgrade their Adobe Flash Player software.

The confusion started Monday, when handlers at the Internet Storm Center pointed out that Microsoft had quietly noted that the recent XP SP 3 was vulnerable to five Flash bugs patched in November 2006. Some took this to mean that if an XP system was updated to Service Pack 3, it would somehow wind up with an older, buggy, version of the Flash Player.

Microsoft originally declined to comment on the matter, but on Tuesday it reconsidered and said that this is not the case.

"Microsoft does not ship any version of Flash in the Windows XP Service Pack 3 update that customers use to update existing SP2 machines," the company said in a statement.

However some people who build new XP systems using SP3 will need to update their software. "A new system built using a copy of Windows XP with SP3 integrated will install the original Flash 6 that shipped with Windows XP Gold and will need MS06-069 installed from Windows Update," Microsoft said.

They should, however, be running the latest version of the player, 9.0.124.0, which includes bug fixes that protect against an attack currently being used by criminals.

Just last week Symantec mistakenly reported that attackers had discovered an unpatched zero-day flaw in the Flash Player. The bug turned out to be something patched in April, but nevertheless, it is being exploited in a fairly widespread attack, so having a vulnerable version of Flash is a dangerous proposition.

But that incident, combined with Microsoft's initial silence on the XP SP 3 issue, has made things tough for Windows users, said Susan Bradley, a Windows blogger who is chief technology officer with Tamiyasu, Smith, Horn and Braun, Accountancy Corp. "It is very confusing," she said. "First we were really freaking out because we thought we had a zero-day," she said, "Now we've got this bulletin that says if you apply this, you're [in trouble]."

Users can find out if their PCs are running the latest version of the player by checking with this Adobe Web site.

Microsoft Extends XP Deadline for Low-Cost PCs (Part 1)

Microsoft has extended the life of Windows XP so that computer makers can include the operating system on low-cost PCs


Microsoft Extends XP Deadline for Low-Cost PCs
Part 1

Microsoft has further extended the life of Windows XP so that computer makers can include the operating system on low-cost desktop PCs, the company announced at the Computex trade show on Tuesday.

Microsoft has been under pressure from computer makers to provide a version of its OS for an emerging class of very low-cost laptops and desktops. Its new Windows Vista OS is widely seen as too resource-hungry for those machines.

In April Microsoft extended its deadline for selling Windows XP licenses for low-cost laptops like the Asus Eee PC. It had originally planned to stop selling most XP licenses on June 30.

At Computex on Tuesday it said it has now also extended the deadline for low-cost desktops. PC makers can now include Windows XP in those systems until 2010, the same as the deadline for low-cost laptops, said Rob Young, a senior director with Microsoft's OEM group.

In a statement, Microsoft said the extension applies to "nettops," a term coined by Intel to refer to low-cost desktops that have limited system configurations and are intended for simple tasks like surfing the Internet and sending e-mail. Examples include the upcoming Asus Eee Box, which is on show here at Computex.

It was unclear what limitations Microsoft may put on PC makers to prevent them from installing Windows XP on more capable machines. Young said Microsoft and PC vendors are in general agreement over what constitutes a nettop and suggested that Microsoft won't specify the hardware configurations that vendors can use with XP.

Microsoft said it was responding to the growing popularity of nettops and netbooks, and to demands from PC makers to provide a suitable OS for those machines.

"We've had a lot of feedback from customers and partners, and they're very interested in seeing these devices with Windows on them," said Steve Guggenheimer, the head of Microsoft's OEM business, during a speech at Computex.

continued

Microsoft Extends XP Deadline for Low-Cost PCs (Part 2)

Microsoft has extended the life of Windows XP so that computer makers can include the operating system on low-cost PCs


Microsoft Extends XP Deadline for Low-Cost PCs
Part 2

continued

It was unclear what limitations Microsoft may put on PC makers to prevent them from installing Windows XP on more capable machines. Young said Microsoft and PC vendors are in general agreement over what constitutes a nettop and suggested that Microsoft won't specify the hardware configurations that vendors can use with XP.

Microsoft said it was responding to the growing popularity of nettops and netbooks, and to demands from PC makers to provide a suitable OS for those machines.

"We've had a lot of feedback from customers and partners, and they're very interested in seeing these devices with Windows on them," said Steve Guggenheimer, the head of Microsoft's OEM business, during a speech at Computex.

Microsoft's statement was ambiguous, saying only that it would extend the deadline for "the Windows offering" to include nettops. Young confirmed that the extension applies to Windows XP.

"We have seen much demand for Windows on the Eee PC," Jerry Shen, CEO of Asustek Computer, said in the statement. "It is great that Microsoft is addressing this customer demand and providing a Windows solution on these devices, which will provide a familiar computing experience."

Intel has said nettops and netbooks are intended as a second PC for the home or for people in developing countries who can't afford a full-featured PC. However, Guggenheimer acknowledged Tuesday that no one knows yet where the devices will prove popular.

"We've had standalone Internet devices come out before, not too many of them have been successful, but now we are getting towards the right price points," he said. "How they'll land and who will buy them we don't really know yet, but we'll wait and see."

Netbooks and nettops are intended to be powerful enough to consume content, such as streaming video, but not powerful enough for content creation tasks like video editing. Many will use Intel's new Atom chips or Via's low-power C7 processor.

The Eee Box is due to go on sale in July for about $300 and will be offered with Windows XP or Linux. It will come with a maximum hard drive capacity of 250GB and use 802.11n Wi-Fi for Internet access.

Safari Flaw Worse Than First Thought

Microsoft is warning that a previously disclosed flaw in Apple's Safari browser could have dire consequences for Windows users.


Safari Flaw Worse Than First Thought, Microsoft Warns

The Safari bug, originally disclosed on May 15 by security researcher Nitesh Dhanjani, allows attackers to litter a victim's desktop with executable files, an attack known as "carpet bombing."

It turns out that if this flaw is exploited in combination with a second unpatched bug in Internet Explorer, attackers can run unauthorized software on a victim's computer, according to Aviv Raff, a security researcher. Raff says he originally reported the IE flaw to Microsoft more than a year ago, and then told them about how it could be combined with the carpet bombing bug just over a week ago.

IDG News Service tested Raff's demonstration attack code, which runs Windows Calculator on a victim's system. For the attack to work, a victim must first visit a maliciously crafted Web page with the Safari browser, which in turn will trigger the carpet bombing attack and exploit the IE flaw.

Both the Safari and IE bugs "are moderate vulnerabilities that, combined, produce a critical flaw, which allows remote code execution," Raff said in an instant message interview.

Microsoft is taking the issue seriously. It released a security advisory on the problem late Friday, a sign that it may be working on a patch for the IE flaw. The advisory says that the vulnerability has to do with the way Windows handles desktop executables and recommends that Windows users "restrict use of Safari as a web browser until an appropriate update is available from Microsoft and/or Apple."

The attack reportedly affects all versions of Windows XP and Vista, Microsoft said.

Apple may not be rushing out to patch this bug, however. Dhanjani says that Apple has told him that it is not treating the Safari bug as a security issue, a response that has generated criticism from the security community. Last week, for example, the consumer advocacy group Stopbadaware.org urged Apple to reconsider this stance.

According to Raff, unless Apple patches the bug, more attacks like the one he found in IE are likely to pop up. "This is not the only issue that can be combined with the Safari vulnerability," he said. "If Microsoft fixes this, Safari users will still be vulnerable."

XP SP3 Good to Go

Windows XP Service Pack 3 is now available for download from Microsoft's Download Center, and is also being released via Windows Update.


Windows XP SP3 Available for Download

Microsoft released the third service pack for Windows XP on Tuesday to the Web after last week delaying its scheduled release because of an incompatibility with one of its other software applications. It also resumed automatic distribution of Windows Vista, Service Pack 1 (SP1), which had been halted because of a similar problem.

Windows XP SP3 is now available through Windows Update and also on the Microsoft Download Center. Microsoft had expected to release the software on April 29; however, it discovered it conflicted with an application called Microsoft Dynamics RMS. The problem also affected Windows Vista SP1. Dynamics RMS is a retail-chain-management software for small and midsized businesses.

In announcing the release of SP3 for XP, Microsoft said it had addressed this problem by deploying a Windows Update filter that would keep the service packs from being offered to customers who use Microsoft Dynamics RMS, and advised these users to contact Microsoft's support services for more information.

Microsoft has also resumed automatic distribution of Vista SP1, which was suspended following discovery of the RMS incompatibility.

Microsoft still is not offering either service pack to Microsoft Dynamics RMS customers, having put in place a filter on Windows Update to prevent distribution to those customers. The company is still working on a fix it expects to have available later this month, it said.

Microsoft still recommends that Dynamics RMS customers running Windows XP SP3 or Windows Vista SP1 contact their Microsoft Customer Support Services for more information.

Microsoft Learns From Itself

Microsoft has delayed the release of the Windows XP Service Pack 3 indefinitely and Microsoft deserves a little credit for doing so.

Microsoft Learns From Itself By Delaying XP SP3

The third service pack was expected to be available to the consumers earlier this week, but that release has been suspended indefinitely due to flaws with Windows Dynamics Retail Management System.

Microsoft deserves some recognition, sarcastic or not, because this delay has proven that Microsoft is learning from its prior mistakes. Microsoft pushed Vista out the doors far too soon and has paid the price with a plethora of bad public relations, and now the software giant is making the right decisions ensuring that kind of a catastrophe doesn't happen again.

When SP3 is finally made available to the masses, it will hopefully come without a problem in the world, which will be a nicety for Microsoft, who has been known for not being able to handle software releases in the recent years.

Windows XP SP3 Delayed

Microsoft has delayed the release of a third service pack for Windows XP, blaming a "compatibility issue" between the software and a retail-chain-management application.


Microsoft Delays Release of Windows XP SP3

Microsoft had said last week that it completed development on Windows XP, Service Pack 3 (SP3), and that it would be available via its software-update services on Tuesday. However, incompatibilities discovered in the past several days between an application called Microsoft Dynamics RMS and both Windows XP SP3 and Windows Vista Service Pack 1 will force the company to hold off on releasing the software. Dynamics RMS is a retail-chain-management software for small and mid-sized businesses.

Microsoft said it is putting filtering in place to prevent its Windows Update service from offering both service packs to systems running Microsoft Dynamics RMS. Once that filtering is in place, Microsoft will release Windows XP SP3 to Windows Update and Download Center for users not running the application causing the problem. The company on Tuesday did not say how long putting in filters would take.

Microsoft is recommending that Microsoft Dynamics RMS customers not install Windows XP SP3 or Windows Vista SP1. For more information, those customers should contact Microsoft Customer Support Services, the company said.


A fix to the Dynamics RMS problem is being tested and "will be available as soon as that process is complete," Microsoft said. The company did not provide a time frame for completion of the testing and recommends customers visit its TechNet Forums for more information regarding Windows XP SP3.

Windows Hacked by Firewire

Security researcher describes how an intruder on site can break into a Windows system using a Firewire port.


Windows Hacked in Seconds via Firewire

A New Zealand security researcher has published a software tool allowing attackers to quickly gain access to Windows systems via a Firewire port.

The tool, which can only be used by attackers with physical access to a system, comes shortly after the publication of research on gaining access to encrypted hard drives via physical access to memory.

Researcher Adam Boileau, a consultant with Immunity, originally demonstrated the access tool at a security conference in 2006, but decided not to release the code any further at the time. Two years later, however, nothing has been done toward fixing the problem, so he decided to go public.

"Yes, this means you can completely own any box whose Firewire port you can plug into in seconds," said Boileau in a recent blog entry.

An attacker must connect to the machine with a Linux system and a Firewire cable to run the tool.

The tool, called Winlockpwn, allows users to bypass Windows authorization, was originally demonstrated at Ruxcon in 2006 at a talk called "Hit By A Bus: Physical Access Attacks With Firewire".

At the time, Boileau also demonstrated some of the malicious uses of the tool, but said he wouldn't be releasing the code for those attacks.

The attack takes advantage of the fact that Firewire can directly read and write to a system's memory, adding extra speed to data transfer. According to Boileau, because this capability is built into Firewire, Microsoft doesn't consider the problem a standard bug.

On the other hand, Boileau said he feels PC users need to be more aware of the fact that their systems can be unlocked via Firewire.

"Yes, it's a feature, not a bug," Boileau stated. "Microsoft knows this. The OHCI-1394 spec knows this. People with Firewire ports generally don't."

Microsoft was not immediately available for comment. In the past the company has downplayed security problems that require physical access.

Firewire has become common on Windows systems in the past few years, and is especially prevalent on laptops.

Researcher Maximillian Dornseif demonstrated a similar exploit on Linux and Mac OS X systems at the CanSec conference in 2005, connecting to those systems via a malicious iPod and Firewire.

According to security researchers, the problem can be remedied by disabling Firewire when not in use.

source: techworld.com

Microsoft's First Roundup of Patches

The first set of patches for 2008 was released by Microsoft this Tuesday, fixing a pair of networking flaws in the Windows kernel.

Microsoft Releases a New Set of Patches


Microsoft has released a patch to fix a security flaw in Windows that could be used by criminals to create as self-copying computer worm attack. The patch fixed a pair of networking flaws in the Windows Kernel. Another patch was also released for a less-serious Windows flaw that would allow attackers to steal passwords or run Windows software with elevated privileges.

The critical bug lies in the way Windows processes networking traffic that uses IGMP (Internet Group Management Protocol) and MLD (Multicast Listener Discovery) protocols, which are used to send data to many systems at the same time. Microsoft says that an attacker could send specially crafted packets to a victim's machine, which could then allow the attacker to run unauthorized code on a system.

No known code exploits this flaw, security experts say, but now that the patch has been posted, hackers can reverse-engineer the fix and create their own attack code. Since IGMP is enabled both in Windows XP and Vista by default, the bug could be used to create a self-copying worm attack, Microsoft has disclosed.

"Theoretically this is wormable and that's why this is rated critical," said Tim Rains, security response communications lead with Microsoft. However, Microsoft does not believe that hackers will have an easy time developing attack code that will work reliably. "We've done a thorough analysis of the vulnerability and we've come to the conclusion that there are several technical mitigating factors that make it unlikely to get reliable remote code execution," Rains said.

Windows uses the IGMP protocol for many popular consumer applications such as streaming video, multiplayer games and universal plug-and-play, but the protocol is usually blocked at the router. A derivative of IGMP, MLD is the multicast protocol used by IPv6 systems and is enabled on Vista by default

"If it became a worm it could take over an internal network pretty quickly, or at least all the machines where multicast is enabled," said Eric Schultze, chief technology officer with Shavlik Technologies. "But this one is going to be mitigated because a lot of people have blocked multicast."

Windows XP's Final Service Pack

Microsoft lets everyone try Windows XP SP3 Release Candidate, available last night. However, it warns off people who are not comfortable using pre-release code.

Windows XP's Final Service Pack
Microsoft has made available the Release Candidate (RC) for Windows XP Service Pack 3. The update, available at the Microsoft Download Center, would be the last Service Pack for the six-year-old operating system.

The service pack is finally available to the public, after giving thousands of users access to the update in an invitation-only basis.

According to a company spokeswoman, the version that was released, was dubbed a 'release candidate' to note the progress from earlier betas. She was unable, however, to say when the service pack would be available to Windows Update so users can download and install it with Windows Automatic Updates.

The final version of Windows XP SP3 remains slated for delivery sometime in the first half of 2008, the spokeswoman said. She also warned off casual users from trying the preview. "As this is a release candidate, we strongly encourage only those who are comfortable installing prerelease code to download Windows XP SP3," she said.

Recently, Microsoft has been downplaying the significance of Windows XP SP3. In a white paper posted to its Web site last week, and also Tuesday, the company praised Windows Vista at XP's expense, reminding users that "Vista provides the most advanced security and management capabilities of any Windows operating system."

"Windows XP SP3 does not bring significant portions of Windows Vista functionality to Windows XP," the spokeswoman said.

According to the white paper, the Download Center version of XP SP3 will weigh in at about 580MB; the version downloaded and installed via Windows Update, however, will be much smaller, typically around 70MB.

Windows XP debuted in October 2001 and was last updated as SP2 in August 2004; SP3 will be the final major upgrade of the operating system.

Microsoft to Release 7 Patches

The last batch of updates this year focuses on security fixes for Windows and Internet Explorer.


A Round of Patches from Microsoft
Microsoft corporation promised to end the year with a bang by scheduling
seven security updates Tuesday to fix flaws in Windows and Internet Explorer.

Even though Microsoft pledged that Windows Vista, the year-old operating system, is the most secure version of Windows ever, it will still be affected by five of the seven updates. "That's no small percentage," noted Andrew Storms, director of security operations at nCircle Inc. "The perpetuates the fact that even though Microsoft said it was secure, it still needs plenty of patches."

Three of the seven updates will be rated "critical" - Microsoft's highest ranking, while the remaining four will be labeled "important", the next lower rating. Microsoft has revealed limited amount of information about the updates in a prepatch notification posted to its website last Sunday.

One of the seven is a sure bet, Storms said, referring to an update for Windows dubbed as important that will affect Windows XP, and Windows Server 2003. "The Macrovision patch is the most likely candidate for what they're calling bulletin 5," said Storms.

Early last month, Microsoft confirmed that attackers were actively exploiting a bug in third-party anti-piracy software bundled with Windows. The software, which Microsoft licenses from Macrovision Inc., had been updated for Vista, which was why that OS was not at risk. Although Macrovision quickly issued a replacement driver for Windows XP and Server 2003, Microsoft said it needed time to prepare and test the update, which meant it missed the November patch deadline.

"The rest of these are a complete surprise to me," admitted Storms. With one exception, he also hesitated at guessing the contents of the remaining half-dozen updates. His one prediction: "Bulletin 7 might be the fix for the WPAD vulnerability."

On Monday, the Microsoft Security Response Center advised users of a bug in the way Windows looks up other computers on the Internet that has resurfaced. The flaw could allow attackers to steer users to an untrustworthy Web Proxy Auto-Discovery (WPAD) server, where they would receive directions to, say, malicious Web sites rather than the legitimate destinations.
"That would be a very quick fix, and unlikely Microsoft behavior, but if the fix is as simple as some have said, it's possible," said Storms.

Unless it yanks one or more from the list at the last minute, Microsoft will end the year having released 69 security bulletins in 2007, nine fewer than 2006's total but 14 more than in 2005.

Windows Genuine Disadvantage?

Thousands of Windows users went berserk after Windows Genuine Advantage (WGA) system crippled their system, accusing them of conterfeit software. In Windows Vista SP 1, Vista cripples WGA.


WGA - Change or Go Away
Back in August, a glitch in Microsoft's servers for Windows Genuine Advantage (WGA) accused thousands of users of counterfeit copies of Windows. Users, who paid for their software, were inconvinienced by the fact that WGA crippled their Windows machine, especially Vista. Microsoft has announced that Windows Vista SP1, shipping early next year, will end the kill-switch measure that cripples every aspect of Windows Vista except limited Web browsing if it believes you to have a pirated copy of the operating system

Windows Genuine Advantage is Microsoft's way of determining whether you have an original, genuine copy of Windows, or just a counterfeit copy. The system is installed during Automatic Updates or when you try do download a software off the Microsoft website that requires WGA validation. What it does is scan your system, mainly the product key of Windows, to generate a code that it sends over to Microsoft. If the servers in Microsoft determines your copy of Windows is counterfeit, it tells WGA to run Windows in Reduced Functionality Mode.

With Windows XP, nothing much is changed except for occasional message that your copy of Windows did not pass the WGA test, on your system tray or in the log-on screen. In Windows Vista, however, the effect is more severe. Failing the WGA test on Vista will disable key features, such as the Aero interface, ReadyBoost, and a limited time of using the computer (you are automatically logged off after an hour).

Microsoft has reduced the impact of WGA on Windows Vista users, and it does this with SP 1. It no longer disables the Aero interface or any other features. Instead, it will only annoy them with messages accusing them of piracy. It'll also change their wallpaper, and it'll give them a dialog box that makes them wait until they can postpone activation.

Killing the kill switch is a good start, since it'll reduce the chances that Vista will mistakenly prevent deny functionality to paying customers. But it doesn't represent fundamental change to WGA. In fact, Microsoft VP Mike Sievert says that "It's worth re-emphasizing that our fundamental strategy has not changed. All copies of Windows Vista still require activation and the system will continue to validate from time to time to verify that systems are activated properly."

Still, a lot of users have no confidence with Microsoft's WGA. Of course, that includes those innocent Windows users who were accused of counterfeit software when they were in fact, genuine copies. Users say that either Microsoft has to change WGA to be integrated perfectly with Windows, or better yet, make it go away.

For years, the Microsoft monopoly made it very hard for anyone to opt out of using Windows. Thanks to the resurgent Mac OS X and ever-improving Linux--neither of which are burdened with copy protection--that's no longer true. WGA remains a significant argument against choosing Windows, and will be one until it gets far more seamless or simply goes away.

PC + Mac QuickTime Flaw

Symantec warns that both Windows and Mac systems may be vulnerable to exploits of an unpatched Quicktime flaws



Windows and Mac Shares QuickTime Flaw

Last Sunday, Symantec warned in a DeepSight Threat Management System alert that attackers are trying to exploit an unpatched vulnerability in Apple's QuickTime software that could let them run code on a victim's computer.

Attackers appear to be aimed at Windows users, but Mac OS users could be open to the risk as well, as QuickTime vulnerability in question affects both operating systems. The vulnerability, called the Apple QuickTime RTSP Response Header Stack-Based Buffer Overflow Vulnerability, was first revealed on November 23, and still remains unpatched by Apple.

Windows XP and Windows Vista running Internet Explorer, Firefox, Opera, and Safari are affected by this vulnerability, as well as Apple's own MacOS X 10.4 and 10.5.

Symantec said that there are two types of attacks underway. One involves redireting the victim's computer from an adult web site, Ourvoyeur.net, to another web site that infects the computer with an application called loader.exe. It can be saved to the victim's computer as metasploit.exe, asasa.exe, or syst.exe. Once installed on a computer, this application downloads another binary file, which Symantec identified as Hacktool.Rootkit, a set of tools that can be used to break into a system. It's possible that Ourvoyer.net was compromised as part of the attack.

The second method of attack also involves redirection, however, Symantec is currently investigating the attack to determine what, if any, malicious code is involved.

To protect systems from attack, Symantec recommended blocking access to affected sites. "Filter outgoing access to 85.255.117.212, 85.255.117.213, 216.255.183.59, 69.50.190.135, 58.65.238.116, and 208.113.154.34. Additionally 2005-search.com, 1800-search.com, search-biz.org, and ourvoyeur.net should be filtered," it said, adding IT managers can also block outgoing TCP access to port 554.

Alternatively, IT managers could take more drastic steps. "As a last measure, QuickTime should be uninstalled until patches are available," the alert said.

Service Pack 3 Speeds XP

Microsoft has released the beta version of Windows XP to a limited number of testers just days after Windows Vista Service Pack 1 was released. Testers say SP3 speeds up Windows XP.



Service Pack 3 Boosts XP's Speed
Looks like the six-year old operating system is improving, as early testers of Windows XP SP3 reveals that it speeds up Windows XP. Microsoft has released the beta version of SP3 to a limited number of tester just days after the release of SP1 for Vista.

Devil Mountain Software tested the SP1 for Vista earlier, and claimed that Vista with SP1 is no faster than the original, unpatched version. They repeated some of the same tests on the release candidate of Windows XP SP3.

"We were pleasantly surprised to discover that Windows XP SP3 delivers a measurable performance boost to this aging desktop OS," said Craig Barth, Devil Mountain's chief technology officer, in a post to a company blog Friday.

Devil Mountain ran its OfficeBench suite of performance benchmarks on a laptop equipped with Office 2007, Microsoft's latest application suite. The notebook - the same unit used in the Vista/Vista SP1 tests earlier - featured a 2.0GHz Intel Core 2 Duo processor and 1GB of memory. The results reported a 10% speed increase under XP SP3 when compared to SP2, the service pack released in 2004.

"Since SP3 was supposed to be mostly a bug-fix/patch consolidation release, the unexpected speed boost comes as a nice bonus," Barth said. "In fact, XP SP3 is shaping up to be a 'must-have' update for the majority of users who are still running Redmond's not-so-latest and greatest desktop OS."

According to the Office performance benchmarks, Windows XP SP3 is also considerably faster than Vista SP1. "None of this bodes well for Vista, which is now more than two times slower than the most current builds of its older sibling," said Barth.

This may be the Service Pack that could snatch away Vista's selling points. Since companies are still reluctant to upgrade to Vista, they may test out this service pack and eventually skip Windows Vista altogether if all goes well. For one thing, upgrading to Windows Vista costs money - to purchase the operating system, to upgrade the computer components to match the requirements of Vista, and to train people on how to use the new operating system. Upgrading Windows XP to Service Pack 3, is free, however. In addition, XPs performance is better than Vista, considering the application incompatibilities, and with this upgrade, it looks like XPs the clear winner.

But we can't tell for sure. Even though Microsoft extended the support for the six-year old operating system, they may come up with some scheme to force Windows XP users to upgrade to Vista.

Windows XP Service Pack 3 is scheduled to be released in the early quarter of 2008, but Microsoft said this lock is not definite, but will respond accordingly to consumer demands.

Windows XP Service Pack 3

Windows Vista's Service Pack 1 has been quite a buzz during the past few months, but Microsoft is quiet about its Service Pack 3 for Windows XP


Microsoft Quietly Readies XP SP3
Just days after Microsoft delivered the release candidate of Windows Vista's Service Pack 1, Microsoft issued a quiet release of the Windows XP SP3 beta, to about 15,000 testers, the company said.

The next major service pack, a critical fix to the six-year old operating system, will be scheduled to be released in the first half of 2008. Microsoft, however, reminded everyone that this is not definite rather an estimate. "We are targeting [the first half of] 2008 for the release of XP SP3 RTM, though our timing will always be based on customer feedback as a first priority," a company spokesperson said. RTM means release to manufacturing, and when a software is given to a publisher to be boxed and shipped to consumers.

Like Windows Vista SP1, Microsoft will at some point offer the beta version to anyone who wants to test it, the spokesman said.

Microsoft has been quiet about what will be in Windows XP SP3, and in general has been reluctant to even mention the update as it publicizes the progress of Vista SP1 in company blogs and regular communications with the press. Analysts have speculated that Microsoft, which has already made several XP-related concessions, including extending support for the aged OS and pushing the end of retail and OEM sales out five more months, wants to downplay SP3 to make sure it doesn't steal any more thunder from Windows Vista.

According to accounts published last month, XP SP3 will feature more than 1,000 hot fixes and patches that have been issued in the past three years, as well as at least four new features, some of which will be ports of Vista tools.

War in Microsoft

Analysts say that Microsoft Windows Vista's biggest problem is not competition from other companies like Apple. It's more like Family Feud, actually.


Vista's Biggest Problem
Microsoft's biggest worry shouldn't be rival operating systems from Apple Inc. or Red Hat, but competition from it's own Windows XP, analysts said last week.

The big story isn't that 32% of the companies we surveyed said that they would start Vista deployments by the end of next year," said Benjamin Gray, an analyst at Forrester Research Inc. "It's that companies have been hugely successful in standardizing on Windows XP."

About 85% of US and European companies with more than 1,000 employees use Windows XP, up from 65% a year before. Although Windows XP is already six years old, Gray warned not to bet against it. "There are plenty of companies looking forward to XP SP3," he said. That next hot-fix and patch rollup is to ship sometime in the first quarter of 2008, Microsoft has said, and it will reportedly be XP's last service pack.

Vista's biggest competition isn't Apple or Novell or Red Hat; it's Microsoft itself, it's XP," Gray said. A lot of companies use Windows XP that Microsoft may feel obligated to extend the product mainstream support past its April 2009 expiration date. "I wouldn't be surprised," Gray said, "although it might require some additional pressure on the company by its largest customers."

Still, XP will eventually get the boot in favor of Vista. Vista isn't a matter of if, but of when and how," he noted.

Businesses will start upgrading their operating system to Vista by the end of 2008, while some will do this in 2009, and 2010. Still, some companies are skittish about upgrading, according to Forrester's data.

He attributed the lowered expectations to a lack of detailed information about Vista in 2006; too-high prices for PCs with 2GB of memory, which is essentially the minimum needed for Vista, according to company managers; and a larger-than-expected number of incompatible applications.

"Application incompatibility is a big, big headache," Gray said, citing reports from companies preparing for a migration to Vista. Those firms said applications incompatible with Vista made up between 10% and 40% of their software portfolios. "That's causing a lot of XP shops to take a wait-and-see approach to Vista."

But Gray said he was convinced Microsoft will win out in the end, if only because it has virtually no competitor worth the name in the enterprise market. "Linux and Mac have 1% or 2%, and in some cases, such as Europe and the largest corporations, they don't even register," he said. "Microsoft owns this space, and I don't see that changing."

Businesses Might Skip Windows Vista

With Microsoft's plan of releasing the next version of Windows, code-named Windows 7, in late 2009 or early 2010, there's a strong possibility that business might skip Vista altogether


Will Businesses Skip Vista Altogether?

Windows Vista will be available to consumers and business for one year on November 30, and yet many Windows users are still waiting for the Vista service pack before upgrading. But with Microsoft's plan of releasing the next version of Windows, code-named Windows 7, in late 2009 or early 2010, Windows users might skip Vista and in favor of the new version.

On Wednesday, Microsoft reported that more and more third party vendors are writing software and configuring hardware that are Vista compatible, along with drivers that should iron out the incompatibilities that plagued older hardware.

According to Mike Nash, a vice president of product management for Windows client, the experience of running Vista on hardware that is certified for it "is a lot better today than it was a month ago and certainly a lot better than it was [last November]."

Along with Windows Server 2008, Microsoft will release the roll-up updates for Windows Vista in the first quarter next year. The company is hoping that companies will upgrade to both versions.

Even with optimistic reports of Microsoft about Windows Vista, users are still complaining with enough problems that some companies may opt to wait until Windows 7 before upgrading their desktops. However, Microsoft has not disclosed much detail about Windows 7 except that it will be released about three years after Vista.

Users complain that Vista doesn't run well with older hardware -- either on PCs or with connected devices like printers that are a year or two old. Even on PCs that are supposedly meant to be optimized for Vista, there are still odd performance and compatibility issues with certain devices, applications and OS features that make using it a less than optimal experience

For this reason, one East Coast IT consultant who specializes in Microsoft products said that unless Windows Vista SP1 really smooths over the problems people are having with Vista, "there's a good chance many people will hold on to XP until the next version of Windows.

"They're just so many little usability issues," said the consultant, who asked not to be named, but who has nearly 20 years of experience with Microsoft software. "I can just imagine when the next one comes out, Microsoft will actually get it right and everyone will breathe a sigh of relief."