Jerry Bryant's Security Blog

Security Program Manager - Microsoft PSS Security Team

November 2004 - Posts

How to help protect against a WINS security issue

An investigation is underway regarding reports of a security issue with the WINS service (Windows Internet Name Service). We have released the following KB article describing ways to mitigate:

http://support.microsoft.com/default.aspx?scid=kb;en-us;890710

WINS is a server service so can be installed on Windows NT 4.0 Server, Windows 2000 Server and Windows Server 2003 but is not installed by default and should NOT be an internet facing service.

Basically the advice for mitigating potential risk is to block TCP port 42 and UDP port 42 at your firewall or to uninstall the WINS service if you do not need it.

See the KB article for more details.

Posted: Nov 29 2004, 01:55 PM by jbmsft | with 1 comment(s)
Filed under: ,
Windows 2000 Update Rollup

To make it as easy as possible for customers to maintain the security and stability of their Windows 2000 systems, Microsoft will produce an Update Rollup for Windows 2000 Service Pack 4 (SP4), with a planned release in mid-2005.

Here's the announcement:
http://www.microsoft.com/windows2000/server/evaluation/news/bulletins/rollup.asp

And an FAQ:
http://www.microsoft.com/windows2000/server/evaluation/news/bulletins/rollupfaq.asp

Posted: Nov 29 2004, 01:46 PM by jbmsft | with no comments
Filed under: ,
Security Resource Guide - November 2004
Microsoft continues to be committed to building software and services that will help better protect our customers and the industry.  Because there is no one solution, our approach to security includes technology innovations to improve the ability to isolate malicious code, improvements in tools and processes for security updates, ongoing work on engineering excellence, and enhancements and improvements for managing user authentication and authorization.  This includes improving our tools and training and providing better prescriptive guidance.   BillG executive email of March 31: http://www.microsoft.com/mscorp/execmail/2004/03-31security.asp
 
Tools
 
Microsoft Baseline Security Analyzer (MBSA)
Use this tool to identify common security misconfigurations and missing security updates. MBSA runs on the Windows Server™ 2003, Windows® 2000, and Windows XP operating systems and will scan for vulnerabilities in multiple products and technologies, including Microsoft Internet Information Services (IIS) and SQL Server™.
 
Software Update Services (SUS) / Windows Update Services (WUS)
Quickly and reliably deploy the latest security updates, and service packs with Software Update Services. This new site now has the latest info on WUS.
 
Windows Update
Scans your computer and provides a selection of updates tailored for your operating system, software, and hardware.
 
Microsoft Office Product Updates
Scans and updates Microsoft Office products.
 
IIS Web Server Lockdown Wizard
Reduces the attack surface of Internet Information Services (IIS) and includes URLScan to provide multiple layers of protection against attackers.
 
UrlScan Security Tool
Helps prevent potentially harmful HTTP requests from reaching IIS Web servers.
 
Removal Tools:
Mydoom, Zindos and Doomjuice worms: http://support.microsoft.com/?kbid=836528
 
Blaster Removal Tool for Windows XP and 2000:
 
Sasser (A-F) Worm Removal Tool: http://support.microsoft.com/?kbid=841720
 
MS04-028 Enterprise Scanning Tool: http://support.microsoft.com/?kbid=886988
 
Other Tools:
 
Security Risk Self-Assessment for Midsize Organizations http://www.securityguidance.com
 
Updating
 
Understanding Update Management: Microsoft’s Software Update Strategy
Updated white paper talks about the need for strong update management process.
 
Other Update Management info in the TechNet Topics Page
 
Isolation and Resiliency 
 
Listing of resources for the IT Pro to evaluate and deploy XP SP2
 
Network Access Protection
 
Internet Security and Acceleration (ISA) Server 2004 whitepapers updated
Read about secure remote Outlook access in the Unique Protection for Microsoft Exchange Server whitepaper, a very viable business scenario with ISA Server
 
Engineering Excellence 
 
Trustworthy Computing: Security
 
Whitepapers on Security Enhancements:
Describes the Trustworthy Computing initiative as applied to the Windows Server, Office 2003 and Exchange Server 2003 development processes respectively.
Windows Server 2003:
Office 2003:
Exchange Server 2003:
 
Get the Facts:
 
Guidance and Training
 
 
Security Guidance Centers on Microsoft.com
Prescriptive guidance to help provide defence-in-depth security.
 
E-Learning Security Training
E-Learning self-paced clinics - 4 Developer and 8 ITPro modules
Now available in French, German, Spanish and Japanese
 
Security Guidance Kit CD (now shipping in US and Canada)
CD-ROM with tools, templates, and how-to guides
 
Microsoft IT Security Showcase
An insider view into Microsoft's process of deploying, and managing its own enterprise solutions.
 
Security Newsletter
Register for our free monthly e-mail newsletter that's packed with security news, guidance, updates, and community resources to help you protect your network.
 
Security Program Guide: Events and Training Information
Events, webcasts and training ivailable for both IT Professionals and Developers.
 
US Security Summit Keynote and Training Content
 
Security Notifications via e-mail
Sign up today to get e-mail alerts when an important security bulletin or virus alert has been released.
 
Security Update RSS Feed
 
Security Bulletin Search Page
Search on product, technology or KB article
 
Security Bulletin Webcast
Join Microsoft experts on the day after bulletin announcements to get the latest information and have the opportunity to ask questions.
 
How to Tell If a Microsoft Security-Related Message Is Genuine
 
Writing Secure Code, 2nd edition
Best practices for writing secure code and stopping malicious hackers.
 
Building and Configuring More Secure Web Sites
Best Practices used at OpenHack.
 
Recent Security Guidance Center additions:
Windows XP Guide, includes SP2
New Security Risk Management Guide
Windows NT 4.0 and Windows 98 Threat Mitigation Guide
Microsoft Identity and Access Management Series
Antivirus Defense-in-Depth
Securing Wireless LANs with PEAP and Passwords
 
Small Business Guidance:
Guidance specifically for the smaller business
 
Configuring Windows XP 802.11 Wireless Networks for the Home / Small Business
 
Consumer Information:
 
Newsletter for home users
 
Security bulletin notifications for home users
  
 
 
 
 
 
 
Posted: Nov 24 2004, 08:05 PM by jbmsft | with 10 comment(s)
Filed under: ,
Security At Home

At Microsoft, we are making new efforts to educate end users on computer security. Moreover, our web site has been reorganized in a way to make it easier for this audience to find information that should make more sense to them. All the information has been organized under “Microsoft At Home”. For Security related information, see:

http://www.microsoft.com/athome/security/default.mspx

A series of videos are also being produced to better demonstrate the information like this one on phishing:

http://www.microsoft.com/athome/security/spam/phishing/video1.mspx

We would love to get as much feedback on this infromation as possible. There are several places on the site to give that feedback.

Posted: Nov 22 2004, 05:12 PM by jbmsft
Filed under: ,
Network Access Protection Platform Architecture

Overview
Network Access Protection (NAP) is a set of operating system components that provide a platform for protected access to private networks. The NAP platform provides an integrated way of detecting the state of a network client that is attempting to connect to a network and restricting the access of the network client until the policy requirements for connecting to the network have been met.
To protect access to a network, a network infrastructure needs to provide the following areas of functionality:
• Policy validation, which determines whether the computers are compliant with security policy. Compliant computers are deemed “healthy.”
• Network restriction, which restricts access based on health state.
• Remediation, which provides necessary updates to allow the computer to get healthy
• Ongoing compliance, which permits access to the network as long as the users’ computer meets policy requirements.
The NAP platform provides enforcement for Dynamic Host Configuration Protocol (DHCP) address configuration, virtual private network (VPN)-based network connections, and Internet Protocol security (IPsec)-based communications and an architecture through which policy validation, network restriction, remediation, and ongoing compliance can occur via additional components supplied by third-party software vendors or Microsoft.
The NAP platform requires servers running Windows Server "Longhorn" and clients running Windows® XP with Service Pack 2.

http://www.microsoft.com/downloads/details.aspx?familyid=2f37651e-1749-45c3-996e-53de05d44ef7&displaylang=en

Posted: Nov 18 2004, 09:29 PM by jbmsft | with 1 comment(s)
Filed under:
Microsoft Security Bulletin(s) for November 9, 2004

November 9, 2004
Today Microsoft released the following Security Bulletin(s).

Note: www.microsoft.com/technet/security and www.microsoft.com/security are authoritative in all matters concerning Microsoft Security Bulletins! ANY e-mail, web board or newsgroup posting (including this one) should be verified by visiting these sites for official information. Microsoft never sends security or other updates as attachments. These updates must be downloaded from the microsoft.com download center or Windows Update. See the individual bulletins for details.

Because some malicious messages attempt to masquerade as official Microsoft security notices, it is recommended that you physically type the URLs into your web browser and not click on the hyperlinks provided.

Bulletin Summaries:

October Summary
http://www.microsoft.com/technet/security/Bulletin/ms04-nov.mspx

Important Bulletins:
 
MS04-039 – Vulnerability in ISA Server 2000 and Proxy Server 2.0 Could Allow Internet Content Spoofing (888258)
http://www.microsoft.com/technet/security/Bulletin/ms04-039.mspx

This represents our regularly scheduled monthly bulletin release (second Tuesday of each month). Please note that Microsoft may release bulletins out side of this schedule if we determine the need to do so.

If you have any questions regarding the patch or its implementation after reading the above listed bulletin you should contact Product Support Services in the United States at 1-866-PCSafety (1-866-727-2338). International customers should contact their local subsidiary.

Posted: Nov 09 2004, 10:02 AM by jbmsft | with 2 comment(s)
Filed under:
Security bulletin advanced notification

We will now be giving customers advanced notice of upcoming security bulletins three business days before the expected release. Details:

http://www.microsoft.com/technet/security/news/bulletinadvance.mspx

Posted: Nov 04 2004, 05:41 PM by jbmsft | with no comments
Filed under: ,