5/25/07

Windows Vista VHD - Free Download

Thanks to odeeee for this download links. Windows Vista is now available for IT professionals and developers with MSDN and TechNet subscriptions. In the coming weeks, Microsoft will start the Windows Vista Customer Preview Program (CPP) for developers and IT professionals who are not members of the subscription services.

Windows Vista comes with a breakthrough user experience and is designed to help you feel confident in your ability to view, find, and organize information and to control your computing experience.

The visual sophistication of Windows Vista helps streamline your computing experience by refining common window elements so you can better focus on the content on the screen rather than on how to access it. The desktop experience is more informative, intuitive, and helpful. And new tools bring better clarity to the information on your computer, so you can see what your files contain without opening them, find applications and files instantly, navigate efficiently among open windows, and use wizards and dialog boxes more confidently.

Windows Vista is engineered to be the most secure version of Windows yet. The new features in Windows Vista help to give you the control and confidence you need to get the most out of your PC.

For organizations with complex desktop infrastructures, whether large or small, Windows Vista Enterprise is the operating system designed specifically to help realize a better return on IT investments. In this VHD, you'll have the opportunity to road-test new and improved features including management (e.g. MUI, BDD, etc…) usability (e.g. Search, Navigation, etc…) and security (UAC, Windows Defender, etc…), enhancements to the Windows Vista platform.

Download: Vista.part1.exe, Vista.part2.rar, Vista.part3.rar


News source: Softpedia

New Vista OEM Activation Hack - Vista Boot by gkend

Thanks to Steve Jobs for this article on his blog and to our forum members to clecha, Nighthief and fitterphil120 for most of the findings. One again the “Chinese” come up with a new method to trick out the Vista Activation. We have seen Softmode and VistaLoader, however “ Vista Boot by gkend” does promise even more.

We do not know much about it; however we know it will emulate a brand SLIC which will make an OEM Activation possible.

What is new and where this method does vary from the others is that it does integrate the SLIC table directly into BootMgr. Unlike other Paradox, this method can have no conflicts wit different chipsets, motherboards, or drivers. Unlike VistaLoader, this method has no conflicts with multiboot systems, does not require alteration of the Master Boot Record, and does not result in any text being displayed prior to Windows being booted. This method will also work equally well with Vista 32-bit or 64-bit and is independent of the version of Windows (Home Basic, Home Premium, Business, Ultimate) used. The bad news are, this method is vulnerable to the same types of detection which can be used on the other cracks - so can be disabled.

Some notes on using this hack:

1. Any SLIC table can be used with this program, simply by selecting it. No special encoding is present (like in the Paradox crack). All of the SLIC tables we have collected are viable candidates for integration.

2. This crack only applies the SLIC table. It does not apply (or even have) the matching OEM certificates - nor does it install a serial number for Vista. Both of these steps must still be done manually using the command prompt and SLMGR.VBS.

3. It is completely possible to take advantage of this cracks facility of specifying the partition of the BootMgr file to create a collection of pre modified BootMgr files.

Download: http://share.gulli.com/files/999820566/vistaboot522.rar.html


News source: stevejobs.blogs.keznews.com

5/20/07

Vista Hacked Again, This Time Even More Effectively


This is not the first time we've mentioned a Windows Vista crack, and it won't be the last, but now a hacker group known as NoPE somehow managed to create a cracked Windows Vista DVD that works immediately, out of the box, with no serial number or activation keys required. Just like some of those corporate versions of Windows XP that worked for years, the hacked Vista product appears to be already activated and it even automatically updates itself with the latest patches.



The cat and mouse game continues, where Microsoft will counter this, and then the hackers will respond, and so on, and so on. Of course, activation schemes, digital rights management and security measures only affect the honest people, inconveniencing them and sometimes even stopping them in their tracks, while the h4ck3rz rise to the challenge every time with their formidable sk1llz. Sigh. – – Charlie White


5/19/07

Microsoft to launch new Vista-subscription trials in early 2008

Microsoft is readying a new Windows-Vista based version of its FlexGo hardware-software-services bundle aimed at emerging markets.
As part of FlexGo ‘Next,’ Microsoft plans to shift its emphasis from pay-as-you-go to subscription-based pilots, company officials said at the Windows Hardware Engineering (WinHEC) conference in Los Angeles this week.

Microsoft rolled out the first version of its FlexGo program in May 2006. With a group of hardware, telecommunications, retail and financial services partners, Microsoft began testing pay-as-you-go and subscription-based rentals of PCs and software in Brazil, India, Mexico and Russia.

A year into the trials, Microsoft has decided to shift its focus to subsciption pilots with 20 or so telcos in Brazil, India and Mexico, officials said this week.

Microsoft also is beginning to phase in Windows Vista into the FlexGo trials, officials said. Starting in the first quarter of 2008, Microsoft will begin offering all of the different 32-bit Vista SKUs via the FlexGo pilot program.

“In the past, you had to have a separate SKU for a FlexGo-enabled system. Now every version of 32-bit Vista will be offered,” said Mike Wickstrand, a Director of Product Management with Microsoft’s Market Expansion Group.

In explaining the pilot program’s change in focus, Wickstrand acknowledged that pay-as-you-go had “high consumer appeal, but not enough usage for the financial institutions” providing credit to the user base. Given the explosion in availability of consumer credit, subscriptions are emerging as a more popular option.

Under the FlexGo program, users make initial down payments on mid-range PCs and make monthly payments for software and broadband services from their local telcos, much the way customers pay cable providers for TV and Internet access. Microsoft and its partners will allow users to sign up and pay for their subscriptions in a variety of ways, ranging from ATMs and point-of-sale terminals, to the Web.


News source: blogs.zdnet.com

Vista Sales Near 40 Million, Gates Says At WinHEC

Microsoft chairman Bill Gates also revealed that the official name of the next version of the company's server operating system--heretofore code-named Longhorn--will be Windows Server 2008.
Microsoft Corp.(MSFT) has sold nearly 40 million Windows Vista licenses in the first 100 days that the latest version of the operating system has been available, Chairman Bill Gates said Tuesday.

Gates said an accelerating consumer shift to digital lifestyles had helped make the operating system the fastest-selling in history, and that premium editions have accounted for 78 percent of Vista sales.

Windows operating systems run on more than 95 percent of the world's computers and represent the Redmond, Washington-based company's biggest profit driver.

Vista, which Microsoft introduced on Jan. 30, also marks the first major operating system upgrade in more than five years from the world's biggest software maker.

During a speech in Los Angeles, Gates said the company named its next-generation Windows Server software -- formerly known as "Longhorn" -- Windows Server 2008.

Windows Server is the server operating system equivalent to the Vista PC operating system, with an emphasis on many of the same features, such as better security.

Microsoft, which controlled an estimated two-thirds of the global server software maker in 2006, has said the product is on track for a debut in the second half of 2007.

The company also said three new hardware manufacturers -- Gateway Inc. , Lacie and Medion - plan to build products for Windows Home Server. That software is aimed at helping families with multiple PCs easily centralize, share and protect digital content, such as pictures, music, documents and videos.

Microsoft shares were up 15 cents to $31.02 in early afternoon Nasdaq trade.


News source: informationweek.com

5/10/07

Microsoft Launches Windows Live Hotmail Worldwide

Built from the ground up, the new Windows Live Hotmail is now safer, more powerful and available virtually anywhere.

Microsoft Corp. today announced that Windows Live™ Hotmail®, the successor to MSN® Hotmail, is launching globally in 36 languages. The most significant upgrade for Hotmail since it pioneered the webmail industry in 1996, the new service has been built to be a vast improvement over the previous Hotmail offering, having incorporated input from more than 20 million beta testers. Windows Live Hotmail will deliver a safer, more powerful and productive e-mail experience than previous versions with flexible access via the Web, on a mobile phone or with an e-mail client. Microsoft also announced that later this month Windows Live Hotmail customers will be able to access their Windows Live Hotmail e-mail and contacts for free* using Microsoft® Office Outlook® 2003 or Office Outlook 2007 via the new Microsoft Office Outlook Connector beta.

As Windows Live Hotmail begins rolling out on May 7 and continues over the coming days, consumers will be able to visit http://www.hotmail.com to sign up for a new Windows Live Hotmail account. Current MSN Hotmail customers can also update their existing account to Windows Live Hotmail by logging into their account and clicking on the green Join Windows Live Hotmail button.

“We’re thrilled to deliver Windows Live Hotmail to the more than 280 million active MSN Hotmail accounts around the world,” said Steve Berkowitz, senior vice president of the Online Services Group at Microsoft. “Windows Live Hotmail represents an extremely compelling end-to-end e-mail experience that makes it easy for customers to get best-of-breed e-mail access across PCs, mobile devices and the Web. Windows Live Hotmail is a cornerstone online service for Microsoft and a critical part of our online advertising business because e-mail is a key point of influence for consumer purchases. We’re pleased to announce the launch of the service to advertisers in addition to consumers on the eve of the Microsoft Strategic Account Summit.”

Millions of pieces of customer feedback played an instrumental role in the development of the look and feel of the new Windows Live Hotmail. Key customer benefits include the following:

Access: Hotmail, Where You Want It
Today’s Windows Live Hotmail customers don’t necessarily sit behind a computer screen all day; they want flexibility for their busy lives. As a result, Microsoft has developed new technologies to meet their needs:

• Outlook Connector. Available later this month in 11 languages worldwide, the new Microsoft Office Outlook Connector beta will enable people to view and manage their Windows Live Hotmail account from Outlook for free, with full contact, e-mail and e-mail folder synchronization.

• Mobile. Using Windows Live Hotmail for mobile (http://mobile.live.com), customers can access their e-mail when they are on the go on a Web-enabled mobile phone or PDA. In the future, Windows Mobile® customers will receive a richer online and offline Windows Live Hotmail experience with Windows Live for Windows Mobile, which will ship with Windows Mobile v6.

• More to come. In the coming weeks, Microsoft will introduce an additional e-mail client option for Windows Live Hotmail with the release of Windows Live Mail beta, a free consumer e-mail client available via download that will be a successor to Outlook Express and Windows Mail on Windows Vista™.


News source: microsoft.com/Presspass

Longhorn becomes Windows Server 2007

Microsoft has decided that its experimental server software, which has been working under the codename Longhorn, will be shipped under the name "Windows Server 2007".

A document titled "Hosting and Consuming WCF Services"on Vole's website, which was spotted by Steven Bink, uses the name Windows Server 2007 several times for the next generation server.

According to Arnnet.com, while the name "Windows Server" was never really in dispute, the 2007 tag always was. Some punters had thought that the software would ship so late it would be called Windows Server 2008.

Vole has said that it will not release the official name until it gets around to releasing the beta 3 version of the software. We are currently on Beta two.

Update: Although Longhorn Beta 3 has in fact been released, the new name has still not been officially announced.


News source: theinquirer.net

Hack to Run DreamScene in Vista Home Premium, Basic, Starter, Business and Enterprise

Own a non-Ultimate edition of Windows Vista, but very like the DreamScene application featured in Ultimate Extras package? With most OEM brand computers factory installed Windows Vista Home Premium or Home Basic, and corporates go for Windows Vista Enterprise edition, Microsoft will be earning a lot if everybody upgrade to Ultimate version with Windows Anytime Upgrade just for DreamScene. There’re alternative programs in VideoLAN’s VLC Player and BS.Player that can be used to set video as desktop background wallpaper, however, this is a hack to allow users in any editions of Vista to run native and original Windows DreamScene from Microsoft.

Hack to install Windows DreamScene in non-Ultimate Vista


  1. Download the patched DreamScene dll files package NonUltimateDreamScene.zip (alternative link).
  2. Unpack the archive content to a folder.
  3. Right click on InstallDreamScene.bat and select “Run as Administrator” to install Windows DreamScene on your non-Ultimate version of Vista. Answer “Y” to continue.You can also open elevated command prompt with administrator rights and type InstallDreamScene.bat to execute the batch script.
  4. Restart your computer.
Voila, your system now will run DreamScene without paying hefty Ultimate price. If you prefer to manually to install the patched DreamScene DLL files, here’s the step-by-step guide:


  1. Download the patched DreamScene files as above and unpack to a folder.
  2. Copy DreamScene.dll to %WinDir%\System32\ folder.
  3. Copy DreamScene.dll.mui to %WinDir%\System32\en-US\ folder.
  4. In Windows Explorer, navigate to %WinDir%\System32\ folder.
  5. Right click on themecpl.dll file, and click on Properties on right click menu.
  6. Select the Security tab, then click Advanced.
  7. Subsequenly select the Owner tab, click Edit button. Press Continue (or log in if you’re not Administrator) on any User Access Control prompt.
  8. Select your Vista logon user name, then click OK button. Then click OK in any dialog window that pops up, and press OK again at Advanced Security Settings window.
  9. On Security tab, click the Edit button. Press Continue (or log in if you’re not already an Administrator) on User Access Control prompt.
  10. Click Add button, and click on Advanced button. Next press Find Now button, and then select your logged on user name. Press OK when done.
  11. Click OK again on Select Users or Groups dialog.
  12. On Permissions for themecpl.dll window, highlight your user name, and check the box next to “Full Control” under “Allow” column. Hit OK when done, and confirm any message. Click OK twice to exit from ownership taking process.
  13. Rename the file themecpl.dll in %WinDir%\System32 to themecpl.dll.original.
  14. Copy the patched version of themecpl.dll to %WinDir%\System32\ folder.
  15. Repeat step 4 - 12 on themecpl.dll.mui file located in %WinDir%\System32\en-US\ folder.
  16. After taking ownership, rename the file %WinDir%\System32\en-US\themecpl.dll.mui to themecpl.dll.mui.original.
  17. Copy the patched version of themecpl.dll.mui to %WinDir%\System32\en-US\ folder.
  18. Create a new folder in %windir%\Web named “Windows DreamScene” (without quotes).This is the location to place all your videos want to set as DreamScene wallpaper, and can be easily configured via Control Panel Personalization applet.
  19. Lastly, import and merge DreamScene.reg to registry.
  20. Reboot computer.

Using DreamScene

After patching, right click on any blank space on Desktop, select “Personalize”, then click on “Desktop Background”. Under location, select “Windows DreamScene Content”, and then select a animated video you want.


News source: UnfocusedOne

'Final' iPod fix for Vista delivered

Microsoft Corporation has released what it has called the "final" fix that corrects the issue of some iPods corrupting when ejecting them using Windows Explorer or the 'Safely Remove Hardware' function in the System Tray. Within days of Vista's general availability, Apple Incorporated warned Windows iTunes users to delay upgrading to Vista. Now, however, "Apple and Windows have partnered together to ensure a great experience in using Windows Vista with iTunes and the iPod, and both companies recommend you download this update," said Nick White, a Vista program manager. The Vista iPod patch will be made available to users on May 22 via Windows Update although itis already available from Microsoft's site.

Download: Update for Windows Vista (KB936824)


News source: ComputerWorld

5/7/07

Microsoft: Why the Silence about IE 8.0?

Two years ago, Microsoft used the Bill Gates keynote at its MIX conference as the launch pad for Internet Explorer (IE) 7.0, which shipped last year. However, this year at MIX07, news of the next IE version, which Microsoft has confirmed is in development, was not to be had.
Instead, the software giant used the show to focus on its new cross-platform browser plug-in Silverlight, which will be rapidly enhanced over the coming months with interesting new developer features. But what's going on with IE 8.0?

During a session at the show, IE platform architect Chris Wilson implied that Microsoft was delaying the next IE version somewhat. Microsoft had previously spoken of a 12- to 18-month release cycle for IE 8.0, a dramatic improvement over the five-year wait between IE 6.0 and IE 7.0. But at MIX07, Wilson said IE 8.0 would likely ship closer to two years after IE 7.0, which launched in October 2006.

Microsoft is also being vague about what features it will incorporate into IE 8.0. The company was conspicuously silent about the product at MIX out of a desire to not upstage Silverlight, according to my sources. Previously, the company had noted that it would be working on better compatibility with Cascading Style Sheet (CSS) standards and other Web technologies in IE 8.0.

The problem is that the Web development community is still a bit touchy after IE's five years of stagnation between IE 6.0 and IE 7.0, a time during which rival browsers from Mozilla and Apple added gobs of new features and seized market share. IE 7.0, in many ways, was simply a chance for Microsoft to catch up from a functional perspective. And while IE still controls the market, Web developers often have to ensure that their sites and applications work with Mozilla Firefox as well. Now, they're asking Microsoft for a little guidance about what to expect in the next IE version so they can prepare for the future.

It's a valid question, and one that Microsoft should address as soon as possible. In fact, it seems like the type of thing that the company could have addressed at its annual Web conference.


News source: windowsitpro

5/6/07

Microsoft Wants Yahoo!

Stung by the loss of Internet advertising firm DoubleClick to Google last month, Microsoft has intensified its pursuit of a deal with Yahoo!, asking the company to re-enter formal negotiations, The Post has learned.

While Microsoft and Yahoo! have held informal deal talks over the years, sources say the latest approach signals an urgency on Microsoft's part that has up until now been lacking.

The new approach follows an offer Microsoft made to acquire Yahoo! a few months ago, sources said. But Yahoo! spurned the advances of the Redmond, Wash.-based software giant. Wall Street sources put a roughly $50 billion price tag on Yahoo!.

"They're getting tired of being left at the altar," said one banking source who has recently had talks with Microsoft.

"They now seem more willing to extend themselves via a transaction to get into the game."

Part of the reason for that is because Google keeps trumping Microsoft on the deal front, beating out the company on not just DoubleClick, but also for a renewed search advertising pact with AOL in 2005 that Microsoft lusted after.

Moreover, with Google developing Internet-based software that directly competes with Microsoft Office, sources said Microsoft has no choice but to go on the offensive.

"The minute you hear Microsoft start arguing against something on antitrust grounds, you know they are desperate and need to do something big," said one source.

Sources said Microsoft is working with Goldman Sachs.

News of Microsoft's latest approach comes as Yahoo!'s new search advertising platform Project Panama is just getting off the ground.

The long-awaited platform posted disappointing first-quarter results, but sources said that was more a function of difficult comparisons to the year-earlier period and less a sign that the system wasn't working.

That said, another quarter or two of similar results and investors might begin renewing calls for a sale or for CEO Terry Semel to step down.

As it stands now, a deal between Microsoft and Yahoo! would up the combined companies' share of the all-important search advertising market to 27 percent against Google's 65 percent. It would also narrow the gap in overall online ads with Google to just 13 percent.

More importantly, a deal would create what one source described as "the dominant force on the Internet" in terms of eyeballs. That's an important consideration as more and more content flows online - as the equations goes, eyeballs equal advertising.

Microsoft and Yahoo! also feature complimentary offerings on the content side, with MSN drawing an older audience with its news focus. By contrast, Yahoo! attracts a younger demographic with its entertainment coverage.


News source: nypost.com

5/4/07

Google expands personalization with iGoogle

Google Inc. is stepping up efforts to allow its users to personalize how they search the Web, moving beyond the one-size-fits-all approach to search it already offers.

Officials told reporters at Google's Silicon Valley headquarters on Monday of moves to allow users to share their own writings, photos, lists and other creative efforts, as well as to give consumers personalized views of the Web through use of their geographical location and search history.

The world's top provider of Web search services is bringing together the more idiosyncratic approach to finding information on the Internet under the umbrella term "iGoogle", the new name for its enhanced personalized home page services.

"We want to personalize the traditional notion of search," Sep Kamvar, lead engineer for the personalization push, told reporters. "I am an eclectic person. But everyone is. We can't go about designing products for the average person."


News source: Reuters

5/2/07

Microsoft Prepares to release Windows Live Hotmail

Windows Live Hotmail (previous named Windows Live Mail) testers have received an e-mail from Microsoft with the words "we're getting ready to launch" although there is no notice of a date. Microsoft is also offering two small gifts for beta participation: a "Free Beta Badge" and a "Great Windows Vista Offer". The link following the offers the beta tester three signatures with the embedded words “I was a Beta Tester for Windows Live Hotmail”. The second offer is for a $100 discount on a high-performance Gateway FX530 Series PC with Windows Vista Ultimate with a 2 system limit per customer or four free (with mail-in rebate) “hardware accessories from Epson, Kingston, D-Link and Artec with a custom-built system running Windows Vista Ultimate from a local PC builder”.

Windows Live Hotmail is currently on the tenth milestone, M10 - released on April 2, 2007. M4 was publically released on November 29, 2005.


News source: neowin.net

TweakNT 1.21

TweakNT is a utility that allows you to remove or readd the timebomb and change the edition of any NT OS. Thanks to Hack4Crack for this download.TweakNT is a utility that allows you to remove, add or edit the timebomb, and change the edition of any NT OS.

It should be fairly self-evident how to use it, if it isnt, I would suggest you don't even try, as you'll most likely break something.

I will say this as so many people dont get it even though it should be fairly obvious:TweakNT is 35k, it only makes changes to the registry. This means that converting your os to anything else is purely cosmetic, it wont install any of the extra compoenents etc... so don't expect miracles. Also, be careful if you're converting - windows may not like it.

Timebomb
Timebomb is not the same as WPA, timebomb is usually present in betas, and is normally somewhere between 120 and 360 days. If there is a timebomb, the build will always be shown on the desktop, consequently, removing the timebomb will remove the build from desktop (unless you specify it to always show) TweakNT also allows you to add a timebomb (not sure quite why you might want to do that) of anywhere between 1 and 93,206 days.

Converting can render your OS completely unusable, do not touch this unless you know what you're doing.Obviously, You can't convert Windows 2000 to web server, as it doesnt exist, these are for .net but the basic "ntswitch" will work on all versions of NT.

All changes made by TweakNT are reversible, though in some cases you may not be able to get to a point where you can run TweakNT to reverse the changes, if this happens you will need to restore the backup of the registry created by TweakNT. You will be told the location of this file after the backup is created. The backup can be restored by renaming or deleting "system" and renaming the backup file to "system". These files are in \windows\system32\config. This renaming has to be done from a secondary OS.

TweakNT requires vb6 runtimes, if you are using 2000 or NT, you may need to install these.

Improvements in 1.1:
You can now add a timebomb (don't ask why)Gives install and expiry dateFixed bug that would make a install with timebomb bigger than 364 days bsod on boot (oops)
Improvements in 1.2:
Added convert to MCE and TabletPC for XP
- not sure what might happen with these on anything other than xpsp1

Modifications with this application at you own risk !!!

CONVERTING TO TABLET PC AND MEDIA CENTER EDITION
DO NOT convert to MCE or TabPC unless you are using: XP SP1 Retail, OEM, TabPC or MCE Converting CORP will not work, windows will not let you log on.

If you are stupid enough to ignore that and try it on corp anyway, you can log on in safe mode and convert back to pro.

This conversion is cosmetic. It will not install all the extra components.

Download:
Download TweakNT 1.21 (link 1)
Download TweakNT 1.21 (link 2)
Download TweakNT 1.21 (link 3)


View: KezNews Discussion - TweakNT 1.21 download

Contest winner: Vista more secure than MacOS

Dino Dai Zovi, the New York-based security researcher who took home $10,000 in a highly-publicized MacBook Pro hijack on April 20, has been at the center of a week’s worth of controversy about the security of Apple’s operating system.

In an e-mail interview with Computerworld, Dai Zovi talked about how finding vulnerabilities is like fishing, the chances that someone else will stumble on the still-unpatched bug, and what operating system — Windows Vista or Mac OS X — is the sturdiest when it comes to security.

Friday, the vulnerability was first identified as within Safari, but by Monday, QuickTime was tagged. Why the confusion?

I knew exactly where the vulnerability was when I wrote the exploit; that is part of the basic vulnerability research usually required to write a reliable exploit. I intentionally did not reveal where exactly the vulnerability was in order to prevent others from reverse engineering the vulnerability from those details. Initially, I was only revealing that the vulnerability affected Safari on Mac OS X, the target of the contest. However, now ZDI [3com TippingPoint’s Zero Day Initiative] has been willing to publicly reveal that it affects many more system configurations, including all Java-enabled browsers on Mac OS X and Windows if QuickTime is installed.

As you were working with the vulnerability and exploit, did you know that it would impact non-Mac OS X systems?

I had suspected that it might affect other platforms running QuickTime, but I did not have time to look into it.

You found the vulnerability and crafted an exploit within 9 or 10 hours. And you’ve said ‘there was blood in the water.’ Does that mean you had a head start — in other words, prior research — or was it all built from scratch? Is it really that easy to dig up a vulnerability?

I had found other vulnerabilities in Mac OS X and even QuickTime in the past, so I had some familiarity with the code, but I only discovered this vulnerability that night. My quote that there was “blood in the water” referred to the fact that there were reports of other vulnerabilities in QuickTime, and even Java-related vulnerabilities in QuickTime over the last few years. In my experience, if a certain software package has had vulnerabilities in the past, it is more likely to contain other undiscovered vulnerabilities.

Halvar Flake and Dave Aitel, two prominent security researchers, use the fishing metaphor to explain vulnerability finding. Some days you go out and catch nothing, some days you catch something great. Sometimes you hear about some great fishing happening in a stream somewhere and there are lots of fish to catch until everyone else starts fishing there and the stream becomes overfished. In this case, I suspected that there would be good fishing in QuickTime and I got lucky and found something good in a short amount of time. This is far from the first time that I’ve gone fishing for vulnerabilities, however.

After the positive ID of the vulnerability, there were some unconfirmed claims that your exploit had been snatched at CanSecWest. Although those reports have been discounted, what can you tell us about how you protect your findings? And what are the chances that someone will independently dig out the vulnerability based on the limited information made public?

I do everything that I consider reasonable to protect my security research. I keep exploits in encrypted disk images that are only mounted when necessary on hardened systems that are not always powered on. I am very conservative in what details I share and with whom in order to tightly control knowledge of the vulnerabilities. I often give my exploits non-obvious code names so that I can refer to them over non-encrypted channels without revealing anything about them. [But] with the details that have been released so far, I believe that is a very real possibility that someone may be able to independently dig out the vulnerability, but it won’t exactly be trivial and I hope that whoever does acts responsibly with it.

With the ongoing ‘Mac OS X is safe’ vs. ‘You’re in denial’ debate, what would you recommend to a Mac user as reasonable security precautions? I recommend that Mac users make their primary user a non-admin account, use a separate keychain for important passwords, and store sensitive documents in a separate encrypted disk image. I think these are fairly straightforward steps that many users can take to better protect their sensitive information on their computer.


News source: macworld.com

Microsoft Confirms Windows Vista OEM BIOS Cracked

Windows Vista LogoMicrosoft confirmed the fact that hackers have developed a valid Windows Vista crack designed to exploit the operating system's OEM BIOS activation.

Alex Kochis, a senior licensing manager with the WGA team revealed that the OEM Activation was a measure introduced concomitantly with Windows XP and designed to streamline the deployment and activation process of the operating system.

“Microsoft worked with OEMs to develop an implementation that would work best for them and their customers while keeping the goals of product activation clearly in focus. As we looked to develop a solution, it was important to ensure that product activation technology could still deliver an acceptable degree of protection, while at the same time, reduce the need for an extra step by the end user,” Kochis revealed.

The Redmond Company introduced a marker in the BIOS of the OEM's motherboard that identifies OEM systems. Via this action, Microsoft managed to intimately connect Windows with a value in the BIOS of the motherboard, and with an OEM machine and an OEM licensed operating system.

“Over the years we've seen examples of BIOS editors that, with some work, allowed people to make an edited BIOS appear to be an OEM BIOS. Because Windows Vista can't be pirated as easily as Windows XP, it's possible that the increased pressure will result in more interest in efforts to hack the OEM Activation 2.0 implementation,” Kochis opined.

As of now, Microsoft revealed that it is aware of two cracks that exploit the Windows Vista OEM 2.0 activation. One method is essentially the same as the OEM cracks implemented in Windows XP and it involves editing the BIOS of a motherboard in order to masquerade the motherboard as an OEM product. Kochis classified the process as labor-intensive and risky due to the fact that users can render the motherboard completely useless. “So while this method works today, it's potentially hazardous and really doesn't scale well to large numbers of systems, which makes it less of a threat,” Kochis added.

As far as the second OEM workaround is concerned, Kochis promised that Microsoft will have little trouble in tackling it as it simply involves a software crack designed to make Windows Vista believe that it is running on OEM hardware.

“We focus on hacks that pose threats to our customers, partners and products. It's worth noting we also prioritize our responses, because not every attempt deserves the same level of response. Our goal isn't to stop every "mad scientist" that's on a mission to hack Windows. Our first goal is to disrupt the business model of organized counterfeiters and protect users from becoming unknowing victims. This means focusing on responding to hacks that are scalable and can easily be commercialized, thereby making victims out of well-intentioned customers,” Kochis concluded.


News source: softpedia
View: KezNews Discussion - Microsoft Confirms Windows Vista OEM BIOS Crack

Microsoft attempts to lock down Office

Microsoft is touting a new set of security features designed to lock down Word and Excel. The software giant said it hopes the move will end Office's run as a favourite target of malware authors and remote attackers.
Josh Edwards, technical product manager for Microsoft Office, explained in an interview with vnunet.com that Microsoft completely restructured the way it approaches security in the latest release of Office.

Edwards said that the new approach began three years ago when the company realised that it had to make security a central priority.

"The idea was how we could integrate security in such a way that it is not a feature, but more of a philosophy," he said.

In order to shift security to centre stage, Microsoft took several steps to ensure that security research was integrated into the development process for Office.

Edwards said that the company brought in outside researchers to find weaknesses, and required its project managers to become proficient in security.

The renewed focus on security for Office is well timed. Increasingly sophisticated attackers have shifted much of their focus from vulnerabilities within Windows to applications such as Excel and Office.

"Every file type, every application that is broadly used, is facing the same situation right now," said Edwards.

"Office, being a commonly used application, has received a lot of that attention, and has driven a lot of the things we're doing with security."

One these measures is the move to the OpenXML document format. The new format stores different parts of the document separately, keeping formatting and document information away from the actual data itself.


News source: vnunet.com