Tag Archives: security

I’m just back from AVG’s press event in New York, where new CEO Gary Kovacs (ex Mozilla) presented the latest product suite from the company.

Security is a huge topic but I confess to being something of a sceptic when it comes to PC security products. Problems include performance impact, unnecessary tinkering with the operating system (replacing the perfectly good Windows Firewall, for example), feature creep into non-security areas (AVG now does a performance tune-up product), and the fact that security software is imperfect. Put bluntly, it doesn’t always work; and ironically there was an example at a small business I work with while I was out there.

This business has AVG on its server and Microsoft Security Essentials on the clients, and somehow one of the clients got infected with a variant of a worm known as My little pronny which infects network shares. It may not be the exact one described in the link as these things mutate. Not too difficult to fix in this instance but a nuisance, and not picked up by the security software.

IT pros know that security software is imperfect, but uses do not; the security vendors are happy to give the impression that their products offer complete protection.

Still, there is no doubt that anti-malware software prevents some infections and helps with fixing others, so I do not mean to suggest that it is no use.

AVG is also a likeable company, not least because it offers free versions of its products that are more than just trialware. The freemium model has worked for AVG, with users impressed by the free stuff and upgrading to a paid-for version, or ordering the commercial version for work after a good experience with the free one.

Another key topic though is how security companies like AVG will survive the declining PC market. Diversification into mobile is part of their answer; but as I put it to several executives this week, Windows is particularly vulnerable thanks to its history and design, whereas operating systems like Android, iOS and Windows RT are designed for the internet and locked down so that software is only installed from curated app stores. Do we still need security software on such devices?

My further observation is that I know lots of people who have experienced Windows malware, but none so far who have complained about a virus on their Android or iOS device.

What then did I learn? Here is a quick summary.

AVG is taking a broad view of security, and Kovacs talked to me more about privacy issues than about malware. Mozilla is a non-profit that fights for the open web, and the continuity for Kovacs now with AVG is that he is working to achieve greater transparency and control for users over how their data is collected and shared.

The most striking product we saw is a free browser add-in called PrivacyFix. This has an array of features, including analysis of social media settings, analysis and blocking of ad trackers, and reports on issues with sites you visit ranging from privacy policy analysis to relevant information such as whether the site has suffered a data breach. It even attempts to rate your value to the site with the current settings; information which is not directly useful to you but which does reinforce the point that vendors and advertisers collect our data for a reason.

I can imagine PrivacyFix being unpopular in the ad tracking industry, and upsetting sites like Facebook and Google which gather large amounts of personal data. Facebook gets 4 out of 6 for privacy, and the tool reports issues such as the June 2013 Facebook data breach when you visit the site and activate the tool. Its data is limited though. When I tried it on my own site, it reported “This site has not yet been rated”.

AVG’s other announcements include a secure file shredder and an encrypted virtual drive called Data Safe which looks similar to the open source TrueCrypt but a little more user-friendly, as you would expect from a commercial utility.

AVG PC TuneUp includes features to clean the Windows registry, full uninstall, duplicate file finder, and “Flight mode” to extend battery life by switching off unneeded services as well as wireless networking. While I am in favour of making Windows leaner and more efficient, I am wary of a tool that interferes so much with the operating system. However AVG make bold claims for the efficacy of Flight Mode in extending battery life and perhaps I am unduly hesitant.

On the small business side, I was impressed with CloudCare, which provides remote management tools for AVG resellers to support their customers, apparently at no extra cost.

All of the above is Windows-centric, a market which AVG says is still strong for them. The company points out that even if users are keeping PCs longer, preferring to buy new tablets and smartphones than to upgrade their laptop, those older PCs sill need tools such as AVG’s suite.

Nevertheless, AVG seems to be hedging its bets with a strong focus on mobile, especially Android. We were assured that Android is just as vulnerable to Windows when it comes to malware, and that even Apple’s iOS needs its security supplementing. Even if you do not accept that the malware risk is as great as AVG makes out, if you extend what you mean by security to include privacy then there is no doubting the significance of the issue on mobile.

microsoft, security

Hands on with Microsoft’s Azure Cloud Rights Management: not ready yet

September 2, 2013 onlyconnect 1 Comment

If you could describe the perfect document security system, it might go something like this. “I’d like to share this document with X, Y, and Z, but I’d like control over whether they can modify it, I’d like to forbid them to share it with anyone else, and I’d like to be able to destroy their copy at a time I specify”.

This is pretty much what Microsoft’s new Azure Rights Management system promises, kind-of:

ITPros have the flexibility in their choice of storage locale for their data and Security Officers have the flexibility of maintaining policies across these various storage classes. It can be kept on premise, placed in an business cloud data store such as SharePoint, or it can placed pretty much anywhere and remain safe (e.g. thumb drive, personal consumer-grade cloud drives).

says the blog post.

There is a crucial distinction to be made though. Does Rights Management truly enforce document security, so that it cannot be bypassed without deep hacking; or is it more of an aide-memoire, helping users to do the right thing but not really enforcing it?

I tried the preview of Azure Rights Management, available here. Currently it seems more the latter, rather than any sort of deep protection, but see what you think. It is in preview, and a number of features are missing, so expect improvements.

I signed up and installed the software into my Windows 8 PC.

The way this works is that “enlightened” applications (currently Microsoft Office and Foxit PDF, though even they are not fully enlightened as far as I can tell) get enhancements to their user interface so you can protect documents. You can also protect *any* document by right-click in Explorer:

I typed a document in Word and hit Share Protected in the ribbon. Unfortunately I immediately got an error, that the network location cannot be reached:

I contacted the team about this, who asked for the log file and then gave me a quick response. The reason for the error was that Rights Management was looking for a server on my network that I sent to the skip long ago.

Many years ago I must have tried Microsoft IRM (Information Rights Management) though I barely remember. The new software was finding the old information in my Active Directory, and not trying to contact Azure at all.

This is unlikely to be a common problem, but illustrates that Microsoft is extending its existing rights management system, not creating a new one.

With that fixed, I was able to protect and share a document. This is the dialog:

It is not a Word dialog, but rather part of the Rights Management application that you install. You get the same dialog if you right-click any file in Explorer and choose Share Protected.

I entered a Gmail email address and sent the protected document, which was now wrapped in a file with a .pfile (Protected File) extension.

Next, I got my Gmail on another machine.

First, I tried to open the file on Android. Unfortunately only x86 Windows is supported at the moment:

There is an SDK for Android, but that is all.

I tried again on a Windows machine. Here is the email:

There is also note in the email:

[Note: This Preview build has some limitations at this time. For example, sharing protected files with users external to your organization will result in access control without additional usage restrictions. Learn More about the Preview]

I was about to discover some more of these limitations. I attempted to sign up using the Gmail address. Registration involves solving a vile CAPTCHA

but got this message:

In other words, you cannot yet use the service with Gmail addresses. I tried it with a Hotmail address; but Microsoft is being even-handed; that did not work either.

Next, I tried another email address at a different, private email domain (yes, I have lots of email addresses). No go:

The message said that the address I used was from an organisation that has Office 365 (this is correct). It then remarked, bewilderingly:

If you have an account you can view protected files. If you don’t have an Office 365 account yet, we’ll soon add support…

This email address does have an Office 365 account. I am not sure what the message means; whether it means the Office 365 account needs to sign up for rights management at £2 per user per month, or what, but it was clearly not suitable for my test.

I tried yet another email address that is not in any way linked to Office 365 and I was up and running. Of course I had to resend the protected file, otherwise this message appears:

Incidentally, I think the UI for this dialog is wrong. It is not an error, it is working as designed, so it should not be titled “error”. I see little mistakes like this frequently and they do contribute to user frustration.

Finally, I received a document to an enabled email address and was able to open it:

For some reason, the packaging results in a document called “Azure IRM docx.docx” which is odd, but never mind.

My question though: to what extent is this document protected? I took the screen grab using the Snipping Tool and pasted it into my blog for all to read, for example. The clipboard also works:

That said, the plan is for tighter protection to be offered in due course, at lease in “enlightened” applications. The problem with the preview is that if you share to someone in a different email domain, you are forced to give full access. Note the warning in the dialog:

Inherently though, the client application has to have decrypted access to the file in order to open it. All the rights management service does, really, is to decrypt the file for users logged into the Azure system and identified by their email address. What happens after that is a matter of implementation.

The consequences of documents getting into the wrong hands are a hot topic today, after Wikileaks et al. Is Microsoft’s IRM a solution?

Making this Azure-based and open to any recipient (once the limitation on “public” email addresses is lifted”) makes sense to me. However I note the following:

As currently implemented, this provides limited security. It does encrypt the document, so an intercepted email cannot easily be read, but once opened by the recipient, anything could happen.
The usability of the preview is horrid. Do you really want your trusted recipient to struggle with a CAPTCHA?
Support beyond Windows is essential, and I am surprised that this even went into preview without it.

I should add that I am sceptical whether this can ever work. Would it not be easier, and just as effective (or ineffective), simply to have data on a web site with secure log-in? The idea of securely emailing documents to external recipients is great, but it seems to add immense complexity for little added value. I may be missing something here and would welcome comments.

had to sign in twice since I didn’t check “Remember password!"

If you try recursion, it will package the already packaged file.

security

Ubuntu forum hack sets same-password users at risk

July 24, 2013 onlyconnect

Canonical has announced a comprehensive security breach of its forums.

Unfortunately the attackers have gotten every user’s local username, password, and email address from the Ubuntu Forums database.

The passwords are not stored in plain text, they are stored as salted hashes. However, if you were using the same password as your Ubuntu Forums one on another service (such as email), you are strongly encouraged to change the password on the other service ASAP.

Ubuntu One, Launchpad and other Ubuntu/Canonical services are NOT affected by the breach.

If someone impersonates you on the Ubuntu forums it might be embarrassing but probably not a calamity. The real risk is escalation. In other words, presuming the attacker is able to work out the passwords (they have all the time in the world to run password cracking algorithms and dictionary attacks against the stolen data), it could be used to compromise more valuable accounts that use the same password.

Password recovery mechanisms can work against you. Businesses hate dealing with password reset requests so they automate them as much as they can. This is why Ubuntu’s warning about email accounts is critical: many web sites will simply email your password on request, so if your email is compromised many other accounts may be compromised too.

A better approach in a world of a million passwords is to use a random password generator alongside a password management database for your PC and smartphone. It is still a bit “all eggs in one basket” in that if someone cracks the password for your management database, and gets access, then they have everything.

It is a dreadful mess. Two-factor authentication, which involves a secondary mechanism such as a security token, card reader, or an SMS confirmation code, is more secure; but best reserved for a few critical accounts otherwise it becomes impractical. Two-factor authentication plus single sign-on is an even better approach.

internet, mobile

What is mobile security? And do we need it?

March 21, 2013 onlyconnect

I attended Mobile World Congress in Barcelona, where (among many other things) numerous security vendors were presenting their latest mobile products. I took the opportunity to quiz them. Why do smartphone users need to worry about security software, which many users were glad to leave behind with their PC? I observed that whereas I have often heard of friends or contacts suffering from PC malware, I have yet to hear anyone complain about a virus on their mobile or tablet.

I got diverse answers. NQ Mobile, for example, told me that while mobile malware is relatively uncommon in the USA and Europe, it is different in China where the company has a strong base. In China and some other territories, there are many Android-based mobiles for which the main source of apps is not the official Google Play store, but downloads from elsewhere, and malware is common.

Do you have an Android phone? Have you checked that option to “allow installation of non-Market apps”? One mobile gaming controller I received for review recently came with a free game. Guess what – to install the game you have to check that option, as noted in the documentation.

When you allow non-Market apps, you are disabling a key Android security feature, that apps can only be installed from the official store which, you hope, has some level of quality checking from Google, and the likelihood that malware that does slip through will be quickly removed. But what will users do, install the game, or refuse to disable the feature? I am reminded of those installation manuals for PC devices which include instructions to ignore the warnings about unsigned drivers. Most of us shrug and go ahead.

Nevertheless, for those of us not in China mobile malware is either uncommon, or so stealthy that few of us notice it (an alarming thought). Most of the responses I received from the security vendors were more along the lines that PC-style malware is only one of many mobile security concerns. Privacy is another one high on the list. When you install an app, you see a list of the permissions it is demanding, and sometimes the extent of them is puzzling. How do we know whether an app is grabbing more data than it should, for unknown purposes (but probably to do with ad targeting)?

Some of the mobile security products attempt to address this problem. Bitdefender Mobile Security includes an application audit which keeps track of what apps are doing. Norton Mobile Security scans for apps with “unusual permissions”.

Web site checking is another common feature. Software will attempt to detect phishing sites or those compromised with malware.

Perhaps the biggest issue though is what happens to your lost or stolen device. Most of the mobile security products include device tracking, remote lock and remote wipe (of course, some smartphones come with some of this built-in, like iOS and Find My iPhone).

If you do lose your phone, an immediate worry is the security of the data on it, or even worse, on an SD card that can be removed and inspected. Your contacts? Compromising photos? Company data? Remote wipe is a great feature, but could a smart thief disable it before you are able to use it?

Some products offer additional protection. NQ mobile offers a Mobile Vault for data security. It has a nice feature: it takes a photo of anyone who enters a wrong passcode. Again though, note that some smartphones have device encryption built-in, and it is just a matter of enabling it.

Windows Phone 8 is an interesting case. It includes strong Bitlocker encryption, but end users cannot easily enable it. It is enabled via Exchange ActiveSync policies, set through the Exchange Management Console or via PowerShell:

Why not let users set encryption themselves, if required, as you can on some Android phones? On Apple iOS, data encryption is automatic and can be further protected by a passcode, with an option to wipe all data after 10 failed attempts.

Encryption will not save you of course if a rogue app is accessing your data and sending it off somewhere.

Mobile security can feels like a phoney war (ha!). We know the risks are real, that smartphones are just small computers and equally vulnerable to malware as large ones, and that their portability makes them more likely to go astray, but most of us do not experience malware and mainly worry about loss or theft.

Businesses are the opposite and may care more about protecting data than about losing a device, hence the popularity of mobile device management solutions. The fact is though: some of that data is on the device and being taken everywhere, and it is hard to eliminate the risk.

Is mobile security a real problem? I hardly need to say this: yes, it is huge. Do you need anti-virus software on your phone? That is harder to answer, but unless you are particularly experimental with the apps you install, I am not yet convinced.

The frustrating part is that modern smartphones come with integrated security features many of which are ignored by most users, who find even a simple passcode lock too inconvenient to bother with (or perhaps nobody told them how to set it). It is hard to understand why more smartphones and tablets are not secure by default, at least for the easy things like passcodes and encryption.

App and privacy issues are harder to address, though maintaining properly curated app stores and only installing apps from there or from other trusted sources is a good start.

security

Another reason to use tablets: desktop anti-virus does not work

February 1, 2013 onlyconnect 4 Comments

The New York Times has described in detail how it was hacked by a group looking for data on Chinese dissidents and Tibetan activists. The attack was investigated by security company Mandiant.

Note the following:

Over the course of three months, attackers installed 45 pieces of custom malware. The Times — which uses antivirus products made by Symantec — found only one instance in which Symantec identified an attacker’s software as malicious and quarantined it, according to Mandiant.

Apparently the initial attack method was simple: emails with malicious links or attachments.

Symantec made an unconvincing defence of its products in a statement quoted by The Register:

Advanced attacks like the ones the New York Times described … underscore how important it is for companies, countries and consumers to make sure they are using the full capability of security solutions. The advanced capabilities in our endpoint offerings, including our unique reputation-based technology and behaviour-based blocking, specifically target sophisticated attacks. Turning on only the signature-based anti-virus components of endpoint solutions alone are not enough in a world that is changing daily from attacks and threats. We encourage customers to be very aggressive in deploying solutions that offer a combined approach to security. Anti-virus software alone is not enough.

Could the New York Times hack have been prevented by switching on more Symantec features? Count me as sceptical; in fact, it would not surprise me if these additional features were on anyway.

Anti-malware solutions based on detecting suspicious behaviour do not work. The task is too difficult, balancing inconvenience, performance, and limited knowledge of what really is or is not suspicious. Further, dialogs presented to non-technical users are mystifying and whether or not the right response is made is a matter of chance.

This does not mean that secure computing, or at least more secure computing, is impossible. A Windows desktop can be locked-down using whitelisting technology and limited user permissions, at the expense of inconvenience if you need to run something not on the whitelist. In addition, users can avoid most attacks without the need of any anti-virus software, by careful avoidance of malicious links and attachments, and untrustworthy websites.

Aside: it is utterly stupid that Windows 8 ships with a new mail client which does not allow you to delete emails without previewing them or to see the real destination of an URL in the body of an email.

This kind of locked-down client is available in another guise though. Tablets such as those running iOS, Android or Windows RT (mail client aside) are designed to be resistant to attack, since apps are sandboxed and normally can only be installed via a trusted app store. Although users can bypass this restriction, for example by enabling developer permissions, this is not such a problem in a corporate deployment. The users most at risk are probably those least likely to make the effort to bypass corporate policies.

Note that in this context a Windows 8 Professional tablet such as Surface Pro is just another desktop and no more secure.

Another approach is to stop believing that the endpoint – the user’s device – can ever be secured. Lock down the server side instead, and take steps to protect just that little piece of functionality the client needs to access the critical data and server applications.

The key message though is this. Anti-virus software is ineffective. It is not completely useless, but can be counter-productive if users believe that because they have security software installed, they are safe from malware. This has never been true, and despite the maturity of the security software industry, remains untrue.

New types of client devices hold more promise as a route to safer personal computing.

development, professional, ruby, software development

Got a Ruby on Rails application running? Patch it NOW

January 10, 2013 onlyconnect

A security issue has been discovered in Ruby on Rails, a popular web application framework. It is a serious one:

There are multiple weaknesses in the parameter parsing code for Ruby on Rails which allows attackers to bypass authentication systems, inject arbitrary SQL, inject and execute arbitrary code, or perform a DoS attack on a Rails application. This vulnerability has been assigned the CVE identifier CVE-2013-0156.
Versions Affected: ALL versions
Not affected: NONE
Fixed Versions: 3.2.11, 3.1.10, 3.0.19, 2.3.15

and also worth noting:

An attacker can execute any ruby code he wants including system("unix command"). This effects any rails version for the last 6 years. I’ve written POCs for Rails 3.x and Rails 2.x on Ruby 1.9.3, Ruby 1.9.2 and Ruby 1.8.7 and there is no reason to believe this wouldn’t work on any Ruby/Rails combination since when the bug has been introduced. The exploit does not depend on code the user has written and will work with a new rails application without any controllers.

You can grab patched versions here.

How quickly can an organisation patch its applications? As Sourcefire security architect Adam J. O Donnell observes, this is where strong DevOps pays dividends:

Modern web development practices have made major leaps when it comes to shortening the time from concept to deployment. After a programmer makes a change, they run a bunch of automated tests, push the change to a code repository, where it is picked up by another framework that assures the changes play nice with every other part of the system, and is finally pushed out to the customer-facing servers. The entire discipline of building out all of this infrastructure to support the automated testing and deployment of software is known as DevOps.

In a perfect world, everyone practices devops, and everyone’s devops workflow is working at all times. We don’t live in a perfect world.

For many organizations changing a library or a programming framework is no small task from a testing and deployment perspective. It needs to go through several steps between development and testing and finally deployment. During this window the only thing that will stop an attacker is either some form of network-layer technology that understands how the vulnerability is exploited or, well, luck.

This site runs WordPress, and if I look at the logs I see constant attack attempts. In fact, I see the same attacks on sites which do not run WordPress. The bots that do this are not very smart; they try some exploit against every site they can crawl and do not care how many 404s (error showing page not found) they get. One in a while, they hit. Sometimes it is the little-used applications, the tests and prototypes, that are more of a concern than the busy sites, since they are less likely to be patched, and might provide a gateway to other sites or data that matter more, depending on how the web server is configured.

.net, development, microsoft, nokia, software development, windows

Trial apps and in-app purchases easy to hack on Windows 8 says Nokia engineer

December 11, 2012 onlyconnect 5 Comments

A principal engineer at Nokia, Justin Angel, has written a piece showing how to hack apps on Windows 8, undermining their potential revenue for the app vendors. “This is an educational article written in the hope both developers and Microsoft can benefit from an open exchange of knowledge,” he says, adding that the article was written in his own time and has nothing to do with his employer.

The hacks he describes cover:

Compromising in-app purchases by modifying data held locally, such as app currency.
Converting trial apps to full versions without paying
Removing ads from games
Reducing the cost of items offered for in-app purchase
Injecting Javascript into the Internet Explorer 10 process in order to bypass trial restrictions

There is an inherent security weakness in any app that has to work offline, since the decryption keys also have to be stored locally; this inherent weakness is not unique to Windows 8. However, Angel argues that Microsoft could do more to address this, such as checking for tampered app files and preventing Javascript injection. Code obfuscation could also mitigate the vulnerabilities.

Although Angel is writing in his own time, the issues are relevant to Nokia, which makes Windows Phone devices and may make Windows 8 tablets in future.

Should Angel have revealed the cracks so openly and in such detail? This is an old debate; but it is sure to increase pressure on Microsoft to improve the security of the platform.

reviews

Review: Kingston DataTraveler Locker+G2 secure USB Flash drive

August 28, 2012 Tim Anderson

Ever lost a USB Flash drive? Do you even know? There are so many around now that it would be easy to drop one and not to notice.

Most of the time that does not matter; but what if there is confidential data on there? This can be hard to avoid. Perhaps you want the drive for backup of your most important stuff, or to exchange data with a business partner.

The obvious solution is to encrypt the data. There are a variety of approaches, but the advantage of the Kingston DataTraveler Locker+ G2 is that you (or your staff) have no choice: if you do not set a password, you cannot use the drive.

The actual drive is a smart metal affair which is surprisingly weighty for its size. You can attach it to a key ring with a supplied loop. Stick it into a Mac or PC (no Linux support sadly) and two drives are detected, one a tiny 10MB drive and the other apparently empty. In order to setup the drive or access the data, you have to run Kingston’s DTLocker utility.

The password requirements are a minimum of 6 characters with at least three of upper case, lower case, numeric and special characters.

While 6 characters seems weak it is not too bad considering that after 10 wrong attempts the device will block access and require a password reset. When the password is reset the device is automatically reformatted. In other words, if a bad guy gets your Flash drive, he will be able to reset the password and use the device, but will not see your data.

If a good guy finds your device, he can read your contact details and get in touch to return it to you.

The general approach seems reasonable, and is a great improvement over sticking confidential data on a Flash drive and hoping for the best. However I did encounter an issue where the utility refused to run. Another drive which also appears as two drives was already connected, and somehow this tripped up the DTLocker utility. When I disconnecte the other drive, all was well. It is something to do with available drive letters, even though I still had plenty free.

Once set up, the DTLocker stays resident and offers a context menu in the Windows notification area.

The device formats as FAT32 but I successfully reformatted it as NTFS, just to see if it would work. It did. I also had success using the DataTraveler on a Mac.

With five year warranty and an inexpensive price, the DataTraveler Locker+ is easy to recommend. There are a couple of caveats. Kingston’s firmware could do with a bit of work to overcome occasional drive letter problems. Second, I would like to see more information about the type of drive encryption used. What if a determined data thief stripped down the drive and read the data? The absence of more information suggests that Kingston is aiming this at those who want casual data protection, not the highest level of security. In normal circumstances though, it is more than enough.

Want a free Data Traveler Locker? Look out for our competition coming soon.

microsoft, professional, software development, windows

Microsoft toughens logo requirements for Windows 8, forbids startup apps

August 11, 2012 onlyconnect 1 Comment

Today I came across the certification requirements for Windows 8 desktop apps. This is the successor to the Windows 7 Logo program, and represents a set of best practices required for software to display the official Windows logo.

In practice, I am not sure how many buyers check that software is certified before buying, though it might make sense for businesses to do this as a matter of policy if they want keep Windows desktops running smoothly and safely.

The requirements are also interesting as a guide to what Microsoft considers to be well-behaved applications.

The new requirements are tougher than before. Some guidelines that were in the “Beyond Windows 7” section in the previous logo program have now moved to become full requirements. Others seem to be completely new.

Here are some highlights:

Your app must not depend on any Windows compatibility feature, nor the VB6 runtime.
Apps may not start automatically on startup. You may not set the “run” registry keys nor install a shortcut into a startup folder.
Apps must use “strong and appropriate ACLs” to secure executables, directories and registry keys.
Apps must be compiled with /SafeSEH (safe exception handling), /NXCOMPAT (no data execution) and /DYNAMICBASE (random address space layout).
All executables must be signed with an Authenticode certificate – this was the same in Windows 7 but worth repeating.

The automatic startup prohibition is particularly intriguing. It could not be clearer:

10.2 Your app must avoid starting automatically on startup

I hate unnecessary startup applications too; but I do not object to all of them. My password manager runs on startup and sits in the notification area. Some of Microsoft’s own applications do this, for example Lync, Skype and SkyDrive. I would have thought auto-startup is acceptable if it is under the user’s control.

One factor may be that Windows 8 desktop apps do not auto-start on log-in even if you set them to do so. Instead, they start when the user clicks or taps into the Desktop. Therefore, in a sense none of the normal auto-start techniques are reliable.

There is a way round this, which is to install an autorun service.

In general, tough certification requirements are a good idea, though if they are too demanding the risk is that vendors will simply ignore them.

security, windows

Windows 8 defeats booking.com virus

August 1, 2012 onlyconnect 2 Comments

Someone trying out Windows 8 release preview brought her machine to me to look at. She was having trouble with an email attachment. The email was in fact carrying a virus, one that purported to be from booking.com though it had nothing to do with that company. The supposed booking is in an attached zip file which the victim is invited to open. My contact had opened the zip and attempted to run the contents, a windows executable. She could not remember exactly what happened but said that a dialog had appeared and she clicked OK.

Clicking OK is normally the wrong thing to do with a virus but not in this case. I had a look at the virus and uploaded it to Comodo’s online virus analyser.

This detected API calls that copy a file to the All Users folder and sets it to autorun. Comodo pronounced the executable “Suspicious+”.

But did it run? I tried it on an isolated virtual instance of Windows 8 Release Preview. Running the executable throws up this dialog:

If you click OK nothing happens. If you click More Info, it says that SmartScreen does not recognise the file and offers a Run Anyway option. However the user in this case did not click More info, but instinctively clicked OK, therefore not running the virus.

As a final experiment, I tried running the virus on the isolated machine. It deleted itself but did not seem to succeed in infecting the machine. It is hard to be sure though, so the virtual machine has now been deleted.

Observations:

Windows 8 did not detect the file as a virus. SmartScreen merely did not recognise the file. It would do the same for any unrecognised file, and I have seen this dialog appear for files that I do want to run.

Even when I ran the file, Windows Defender did not (as far as I can tell) detect the virus. The test machine was offline (for isolation) but fully up to date.

What interests me most is how SmartScreen interacts with the social engineering behind the malware. The user actually wanted to run the file, being convinced that it was genuine, but clicking OK simply did nothing. This behaviour is annoying if the application is not in fact malware, but clearly it can on occasion save the day.

Tim Anderson's IT Writing