Microsoft Security Newsletter - Volume 7, Issue 3

Sign up for other newsletters | Unsubscribe | Update your profile

This is a monthly newsletter for IT professionals and developers—bringing security news, guidance, updates, and community resources directly to your inbox. To view an online version of this newsletter, click here or subscribe to the Featured Security and Privacy Content RSS feed to receive more frequent updates on news and featured resources. If you would like to receive less technical security news, guidance, and updates, please subscribe to the Microsoft Security for Home Computer Users Newsletter. Note from the Editor I'm back from RSA Conference 2010, held in San Francisco last week. Microsoft was a Global Diamond Sponsor of the event where Scott Charney, the Corporate Vice President of Trustworthy Computing at Microsoft, delivered a keynote. Scott's keynote focused on the vision Microsoft has for a safer, more trusted Internet called "End to End Trust." You can watch Scott's RSA keynote by visiting the End to End Trust Web site. An important element of the End to End Trust vision is the concept of privacy. Privacy encompasses many different issues and can mean different things to each of us. Keeping yourself and your family safe online from scams that could lead to identity theft is a form of privacy. IT professionals may think of privacy in terms of keeping their organization's customer data confidential and safe from data breaches. Governments may think about privacy as it relates to the cloud and providing services to their citizens. However you think about privacy, Microsoft has resources for you. To learn more about privacy and access some of the content Microsoft has to offer, please visit www.microsoft.com/privacy and consult the tools and resources outlined below. Best regards, Tim Rains, Group Product Manager, Microsoft Trustworthy Computing Top Stories Check Out the Redesigned Security TechCenter The Security TechCenter on TechNet features easier access to the top security tasks, tools, events, and videos, in addition to the latest security bulletin and advisory information, news, and highlights. Download Microsoft Forefront Identity Manager 2010 Try this integrated identity management solution with powerful self-service capabilities for Office end-users, rich administrative tools and enhanced automation for IT professionals and .NET- and WS-* based extensibility for developers. Evaluate Forefront Server Security Management Console Today With Forefront Server Security Management Console, administrators can easily manage Forefront Security for Exchange Server, Forefront Security for SharePoint, and Microsoft Antigen. Use the Web-based console to centralize configuration and operation, automate the download and distribution of signature and scan engine updates, and generate comprehensive reports. The Microsoft SDL and the 2007 Microsoft Office System The 2007 Office system was the first Microsoft Office release to integrate the Microsoft Security Development Lifecycle (SDL) process throughout product development. Learn how the SDL affected the development process and improved the security of the 2007 Office system. Security Guidance Security Tip of the Month: User-Controlled Attributes in Forefront Identity Manager 2010 Learn how the Forefront Identity Manager (FIM) 2010 self-service user profile management can be configured for a privacy scenario, enabling end users to selectively control who can view their home phone number. Privacy Guidelines for Developing Software Products and Services Follow these guidelines to ensure that customer privacy and data protection is incorporated into the development process. Regulatory Compliance TechCenter Find guidance and tools to manage compliance infrastructure and institute sound principles of IT service governance. Microsoft Privacy & Safety Blog Hear directly from Microsoft privacy professionals on the latest discussions, issues, and announcements related to protecting online privacy and safety. SDL Quick Security Reference: Cross-Site Scripting and SQL Injection Attacks Learn how to address common vulnerabilities from the perspective of multiple business roles: business decision maker, architect, developer, and tester/QA. These papers are intended to help you address a critical business problem now while moving you toward Microsoft SDL adoption in the future. Infrastructure Planning and Design Guide: Microsoft Forefront Unified Access Gateway (UAG) Walk through a three-step planning and design process of selecting the Forefront UAG features required, determining the number of instances, and designing the infrastructure. This key guidance will help you successfully implement a Forefront UAG. This Month's Security Bulletins Important: • MS10-016: Vulnerability in Windows Movie Maker Could Allow Remote Code Execution (975561) • MS10-017: Vulnerabilities in Microsoft Office Excel Could Allow Remote Code Execution (980150) Security Bulletin Overview for March 2010 • Microsoft Security Response Center (MSRC) Blog Post • Windows Media Video (WMV) • Windows Media Audio (WMA) • iPod Video (MP4) • MP3 Audio • High Quality WMV (2.5 Mbps) • Zune Video (WMV) Community/MVP Update Security MVP of the Month: Matthieu Suiche Matthieu Suiche is a security researcher who focuses on reverse-code engineering and volatile-memory analysis. His research and utilities to date have included Windows hibernation files and Windows physical memory acquisition (Win32dd/Win64dd). Matthieu has been a speaker during various security conferences such as PacSec, BlackHat USA, and the EUROPOL High Tech Crime Meeting. He currently works for a computer security and kernel code consulting and software company. MVP Article of the Month: Privacy Considerations for C Language Applications Walk through some of the core aspects of privacy you should consider when developing applications, services, and Web sites using C development languages. Microsoft Product Lifecycle Information Find information about your particular products on the Microsoft Product Lifecycle Web site. See a List of Supported Service Packs: Microsoft provides free software updates for security and nonsecurity issues for all supported service packs. Security Events and Training Tech•Ed 2010 -- Security Identity, Access, and More Check out the Security, Identity, and Access track at Tech•Ed North America 2010 for the latest guidance on and demonstrations of Microsoft Forefront products, identity-based access technologies, Windows security technologies, and more. Upcoming Security Webcasts Interactive Security Webcast Calendar Upcoming security webcasts in a dynamic, interactive format. For IT Professionals • TechNet Webcast: Security Talk: Harmonizing Security Compliance and the SDL (Level 100) Thursday, March 11, 1:00 PM Pacific Time • TechNet Webcast: Data Governance for Privacy, Confidentiality and Compliance: People and Process (Part 2 of 4) (Level 100) Thursday, March 11, 9:00 AM Pacific Time • TechNet Webcast: Security Talk: Delivering and Implementing a Secure Cloud Infrastructure (Level 200) Tuesday, March 23, 1:00 PM Pacific Time • TechNet Webcast: Forefront Identity Manager 2010: Monitoring and Troubleshooting FIM in Production (Level 300) Thursday, March 18, 10:00 AM Pacific Time • TechNet Webcast: Security Talk: Regulatory and Standards Management in Compliance Mapper (Level 200) Monday, March 29, 11:00 AM Pacific Time • TechNet Webcast: Data Governance for Privacy, Confidentiality, and Compliance: Managing Technological Risk (Part 3 of 4) (Level 100) Tuesday, March 30, 9:00 AM Pacific Time • TechNet Webcast: Forefront Identity Manager 2010: Deploying FIM (Level 300) Tuesday, March 30, 10:00 AM Pacific Time • TechNet Webcast: Forefront Identity Manager 2010: Extending FIM (Level 300) Monday, April 5, 10:00 AM Pacific Time • TechNet Webcast: Information About Microsoft April Security Bulletins (Level 200) Wednesday, April 14, 11:00 AM Pacific Time For Developers • MSDN Webcast: Security Talk: Lessons from Implementing the Security Development Lifecycle (SDL) (Level 200) Thursday, March 11, 1:00 PM Pacific Time • MSDN Webcast: Security Talk: Protecting Your Data from the Application to the Database (Level 300) Thursday, March 18, 1:00 PM Pacific Time • MSDN Webcast: geekSpeak: Inside SQL Server Integration Services with Andy Leonard (Level 200) Wednesday, March 24, noon PM Pacific Time • MSDN Webcast: Security Talk: Agile Security -- Develop Code Rapidly and Securely with SDL-Agile (Level 200) Thursday, March 25, 1:00 PM Pacific Time • MSDN Webcast: Security Talk: Azure Federated Identity Security Using ADFS 2.0 (Level 300) Thursday, April 1, 1:00 PM Pacific Time Now On Demand • TechNet Webcast: The Case for Data Governance to Maintain Privacy, Confidentiality and Compliance (Part 1 of 4) (Level 100) Gain an understanding of key data security, privacy, and compliance concerns, and what data governance is, what it encompasses, and how it compliments IT governance and compliance. Volume 7, No. 3 March 2010 In This Issue: Top Stories Security Guidance This Month's Security Bulletins Community/MVP Update Microsoft Product Lifecycle Information Security Events and Training Upcoming Security Webcasts Security Program Guide • Microsoft SDL – Developer Starter Kit • Security Awareness Materials • Learn Security on the Job • Learning Paths for Security – Microsoft Training References and Resources Upcoming Chats • View a listing of upcoming technical chats Security Blogs • Trustworthy Computing Security/Privacy Blogs • Michael Howard • Eric Lippert • Eric Fitzgerald • MSRC Blog • ACE Team • Windows Security • Solution Accelerators - Security & Compliance • Security Vulnerability Research & Defense • Security Development Lifecycle (SDL) Security Newsgroups • General Security issues/questions Open with newsreader • Virus issues/questions Open with newsreader • ISA Server Open with newsreader • Window Vista: Security Open with newsreader • SQL Server: Security Open with newsreader • Windows Server: Security Open with newsreader Community Web Sites • IT Pro Security Community Additional Security Resources • Security Help and Support for IT Professionals • TechNet Troubleshooting and Support Page • Microsoft Security Glossary • TechNet Security Center • MSDN Security Developer Center • Sign-Up for the Microsoft Security Notification Service • Security Bulletin Search Page • Home Users: Protect Your PC • MCSE/MCSA: Security Certifications • Subscribe to TechNet • Register for TechNet Flash IT Newsletter © 2010 Microsoft Corporation. All rights reserved. Microsoft, Azure, MSDN, Forefront, SharePoint, SQL Server, Windows, Windows Server, Windows Vista, and Zune are trademarks of the Microsoft group of companies. To cancel your subscription to this newsletter, reply to this message with the word UNSUBSCRIBE in the Subject line. You can also unsubscribe at http://www.microsoft.com/info/unsubscribe.htm. You can manage all your Microsoft.com communication preferences at this site. Legal Information. This newsletter was sent by the Microsoft Corporation One Microsoft Way Redmond, Washington, USA 98052 Sign up for other newsletters | Unsubscribe | Update your profile © 2010 Microsoft Corporation Terms of Use | Trademarks | Privacy Statement

Microsoft Hardware Newsletter for March 10, 2010

Sign up for other newsletters | Unsubscribe | Update your profile

From the Editor In the previous issue of this newsletter, we ran an article about the Debugging Tools for Windows that was inaccurate. In that article, the version number given for the Debugging Tools was a Microsoft internal build number and not the correct external release number. Also, a decision on where and how to release the Debugging Tools has not yet been made. For now, the current release of the Debugging Tools is available in the Windows Driver Kit (WDK) 7.1.0 release. We apologize for the misinformation, but we value the feedback we saw within the community as a result. For more information on this release of the Debugging Tools, see the Top Story in this issue. Also in this issue we feature information about the new release of the WDK, the usual listing of new papers and recent blogs from the Windows team, and news highlights from the Windows Logo Program for Hardware. As always, we hope you find this information useful. - The WHDC Web Team TOP STORY: Current Debugging Tools for Windows Available in WDK The current version of the Debugging Tools for Windows (6.12.2.633) is available as part of the WDK 7.1.0 release. We also plan to make this version of the Debugging Tools available in the next release of the Windows Software Development Kit (SDK) later this year. To download the WDK and manually install the Debugging Tools for Windows: 1. Download the WDK (http://www.microsoft.com/whdc/DevTools/WDK/WDKpkg.mspx) and burn the ISO to a DVD or other installation media. (The WDK ISO file is approximately 620 MB to download.) 2. Open the ISO from the installation media and open the Debuggers directory. 3. In the Debuggers directory, run the appropriate MSI or setup EXE and follow the instructions in the Setup Wizard. (Note: This method installs the debugger to the default installation location of the debugger, which is under Program Files. To install to a directory other than the default, select Custom in the Setup Wizard and specify a different installation location.) 4. After installation is complete, you can find the debugger shortcuts by clicking Start, pointing to All Programs, and then pointing to Debugging Tools for Windows. For information on what's new in this release of the Debugging Tools, see the "What's New for Debugging Tools for Windows" Web page on the Windows Hardware Developer Central (WHDC) Web site: http://www.microsoft.com/whdc/devtools/debugging/whatsnew.mspx. Note: As of WDK release 7.0.0, the WDK build environments no longer support the development of drivers for Windows 2000. However, the Debugging Tools for Windows continue to support Windows 2000. By installing the Debugging Tools manually, as described above, you will be able to use the Debugging Tools on a system running Windows 2000. Note also: Windows Symbols Packages are not available in the WDK and are still available on WHDC (http://www.microsoft.com/whdc/devtools/debugging/symbolpkg.mspx). News for Windows Hardware and Driver Developers Windows Driver Kit (WDK) 7.1.0 Now Available Download the WDK 7.1.0 release and get the most recent headers, libraries, build tools, build environments, code samples, documentation, and other tools used to create drivers and kernel-mode software. This latest version includes: . Support for Windows XP x64 as an installation platform . Debugger updates . Redistributable change: Update to Offreg.dll . Build Environment updates and additions . Sample improvements . Update to Sensor Adapter Test Suite Find out more about the changes in this release of the WDK here: http://www.microsoft.com/whdc/devtools/wdk/RelNotesW7.mspx. For information on how to download the current release of the WDK, visit http://www.microsoft.com/whdc/DevTools/WDK/WDKpkg.mspx. Processor Power Management in Windows 7 and Windows Server 2008 R2 Windows 7 and Windows Server 2008 R2 include updated support for ACPI processor power management (PPM) features, including support for processor performance states and processor idle sleep states on multiprocessor systems. This paper provides details of the support in Windows 7 and Windows Server 2008 R2, describes how PPM functions with the Windows 7 and Windows Server 2008 R2 power policy store, and provides guidelines for firmware developers and system designers. (http://www.microsoft.com/whdc/system/pnppwr/powermgmt/ProcPowerMgmtWin7.mspx) Power Policy Configuration and Deployment in Windows Windows Vista and later versions of Windows feature a new power policy storage mechanism and infrastructure called the power policy store that enables third-party extensibility and configuration using Windows Group Policy. Third-party device and application vendors can install additional power settings by customizing an existing Windows power plan. These custom power settings can be configured using the same tools and user interface elements as Windows-installed power settings. All power policy settings in Windows can be enforced to specific values using Group Policy, which enables enterprises to easily enforce display and sleep idle timeout power settings that can help reduce PC energy consumption and associated expenses. Users do not need administrative privileges to change most power policy preferences. However, system administrators can apply a consistent power management policy in the enterprise by restricting access to power settings on a per-user or per-group basis. This paper describes the Windows power policy store, demonstrates common power policy configuration tasks, and provides reference information about native power settings in Windows. In this update, the processor power management settings have been revised. (http://www.microsoft.com/whdc/system/pnppwr/powermgmt/PMpolicy_Windows.mspx) What's New in Blogs for Hardware and Driver Developers "What is IRQL?" by Jake Oshins in Doron Holan's "A Hole in My Head" Blog Jake Oshins wanted to write about IRQLs and I am gladly letting him use my blog as a platform. Here it is. I've found myself explaining IRQL a lot lately, sometimes to people who want to know because they're trying to write Windows drivers and sometimes to people who are accustomed to Linux or some other variant of Unix and they want to know why something like IRQL is required within Windows when those systems so clearly get by without it. Penny Orwick covered this topic before, in the following two papers, with a lot of help from me and some others: http://www.microsoft.com/whdc/driver/kernel/irql.mspx and http://www.microsoft.com/whdc/driver/kernel/locks.mspx. I'll try to do it a little more briefly here. Read more: http://blogs.msdn.com/doronh/archive/2010/02/02/what-is-irql.aspx "The Sensor and Location Drill Down - Part 3: The Location API" in the "Sensor and Location Platform Team Blog" Over the last several weeks we have been providing an introduction to the Sensor and Location Platform by examining each component in the platform in greater detail. We started first with an overview of the Sensor and Location Platform (http://blogs.msdn.com/sensorslocation/archive/2009/12/15/sensor-location-platform-the-50-000-foot-view.aspx). This was followed up with a drill down in the Sensor DDI or Device Driver Interface (http://blogs.msdn.com/sensorslocation/archive/2010/01/12/the-sensor-and-location-platform-drill-down-part-1-the-sensor-ddi.aspx). Next we examined the Sensor API (http://blogs.msdn.com/sensorslocation/archive/2010/01/27/the-sensor-and-location-drill-down-part-2-the-sensor-api.aspx) and how it fits into the Sensor and Location Platform. As the final post in this series we will be examining the Location API. Read more: http://blogs.msdn.com/sensorslocation/archive/2010/02/10/the-sensor-and-location-drill-down-part-3-the-location-api.aspx "How to Generate and View WinUSB and 1394 Debug Trace Logs" in the "Windows USB Core Team Blog" The following are two recent posts from Don Miller, software developer on the Windows USB Core Team: How to generate and view a WinUSB debug trace log Hello, my name is Don Miller. I am a software developer on the Windows USB team. In this blog post, I'm going to describe how to get debug trace messages from WINUSB.SYS driver. WinUSB is a generic USB driver provided by Microsoft to enable user-mode applications to access simple USB devices through a software library. It uses WPP software tracing to log debug messages. Enabling and viewing the WinUSB debug log can be helpful to Windows device driver developers who are using WinUSB.SYS as the functional driver for their USB device(s). Read more: http://blogs.msdn.com/usbcoreblog/archive/2010/02/05/how-to-generate-and-view-a-winusb-debug-trace-log.aspx How to generate and view a 1394 debug log Hello, my name is Don Miller. I am a software developer on the Windows USB team but also I am the developer responsible for the Windows 1394 driver stack. In this blog post, I'm going to describe how to get debug trace messages from the Windows 7 1394OHCI.SYS driver. The Microsoft 1394OHCI.SYS driver is new for Windows 7 and uses WPP software tracing to log debug messages. For more information on the new Windows 7 1394OHCI.SYS driver please refer to the 1394 Bus Driver in Windows 7 whitepaper (http://www.microsoft.com/whdc/connect/1394_Windows7.mspx). Read more: http://blogs.msdn.com/usbcoreblog/archive/2010/02/10/how-to-generate-and-view-a-1394-debug-log.aspx "Increase VMBus buffer sizes to increase network throughput to guest VMs" in the "Windows Server Performance Team Blog" Traffic jams happen every day, all across the world. Too many vehicles competing for the same stretch of road, gated by flow control devices like stop signs and traffic lights, conspire to ensnare drivers in a vicious web of metal and plastic and cell phones. In the technology world, networking traffic is notoriously plagued by traffic jams, resulting in all sorts of havoc, including delayed web pages, slow email downloads, robotic VOIP and choppy YouTube videos. (Oh, the humanity!) Read more: http://blogs.technet.com/winserverperformance/archive/2010/02/02/increase-vmbus-buffer-sizes-to-increase-network-throughput-to-guest-vms.aspx "Guest Post: Intel Discusses iSCSI and One Million IOPs" in the "Windows Virtualization Team Blog" Hi, I'm Jordan Plawner, storage networking product planner from Intel. Today I'm doing a recap of the Intel Server and Ethernet Adapters and Windows 2008 R2 1m iSCSI IOPs announcement and HyperV performance Webcast. The number of comments and ongoing discussions has been impressive. There were two themes that ran through the blog questions and comments that I want to address. First: What does one million IOPs on a single 10GbE port performance mean? Second: What about features? Read more: http://blogs.technet.com/virtualization/archive/2010/02/25/Guest-post_3A00_-Intel-discusses-iSCSI-and-1-million-IOPs.aspx Windows Logo Program News Windows Vista SP2 Deadline Extension Based on feedback from original equipment manufacturer (OEM) partners, we are extending the deadline for testing with Windows Vista Service Pack 2 (SP2) by two months. All Windows Vista logo program submissions must be tested with Windows Vista SP2 by May 1, 2010. For the latest Windows Logo Program news, subscribe to the Windows Logo Program Newsletter (http://www.microsoft.com/whdc/newsreq.mspx). Edition for March 10, 2010 In This Issue: From the Editor TOP STORY: Current Debugging Tools for Windows Available in WDK News for Windows Hardware and Driver Developers What's New in Blogs for Hardware and Driver Developers Windows Logo Program News Tools and Links for Developers Windows Driver Developer Kits, Tools, and Programs • Windows Driver Kit (WDK) • Windows Logo Kit (WLK) • WDK Documentation (monthly updates) • Windows Symbols (October 2009) • Windows Logo Program Developing Drivers with the Windows Driver Foundation Buy the Book WDF Resources on WHDC Events International CTIA Wireless 2010 March 23-25, 2010 Las Vegas, Nevada, USA Intel Developer Forum (IDF) 2010 April 13-14, 2010 Beijing, China Microsoft Tech Ed North America 2010 June 7-10, 2010 New Orleans, Louisiana, USA The Microsoft Hardware Newsletter provides manufacturers and developers the latest technical details for how to succeed with the Windows platform. Register now, if you're not already receiving the Microsoft Hardware Newsletter. To cancel your subscription to this newsletter, reply to this message with the word UNSUBSCRIBE in the Subject line. You can also unsubscribe at the Microsoft.com Web site. You can manage all your Microsoft.com communication preferences at this site. Legal Information. This newsletter was sent by the Microsoft Corporation 1 Microsoft Way Redmond, Washington, USA 98052 Sign up for other newsletters | Unsubscribe | Update your profile © 2010 Microsoft Corporation Terms of Use | Trademarks | Privacy Statement