Microsoft tool shows whether apps pose danger to Windows

Attack Surface Analyzer can identify multiple classes of weaknesses introduced by newly installed programs

IDG News Service - Microsoft has released Attack Surface Analyzer 1.0, a free tool that can help system administrators, IT security professionals or software developers understand how newly installed applications can affect the security of a Windows OS.

The tool scans for classes of known security weaknesses that can be introduced by the files, registry keys, services, Microsoft ActiveX controls and other parameters created or changed by new applications.

It can identify executable files, directories, registry keys, or processes with weak access control lists (ACLs). It can also flag processes that don't mark memory regions as non-executable (NX), which could result in the bypassing of the Data Execution Prevention (DEP) Windows security feature. The tool also identifies services with fast restart times that could be attacked to bypass address space layout randomization (ASLR), as well as changes to the Windows Firewall rules or Internet Explorer security policies.

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

These and many other weaknesses that the tool identifies can facilitate various types of attacks, including some that could allow attackers to gain control of the system, execute malicious code or gain access to sensitive data.

The tool is already being used by internal product groups at Microsoft and a public beta version has been available to download since January 2011. The 1.0 stable version released on Thursday contains significant performance enhancements and bug fixes.

"Through improvements in the code, we were able to reduce the number of false positives and improve Graphic User Interface performance," the Microsoft Security Development Lifecycle (SDL) team said in a blog post. "This release also includes in-depth documentation and guidance to improve ease of use."

The tool has 32-bit and 62-bit versions and supports Windows Vista and newer versions of Microsoft's OS, including Windows 8 and Windows Server 2012 that hit the RTM (release to manufacturing) milestone on Tuesday.

Attack Surface Analyzer 1.0 is not compatible with the beta version of the tool, so existing users need to perform new "clean" system and post-application-installation scans -- known as the baseline and product scans respectively.

Attack Surface Analyzer requires .NET Framework 4 or higher present on the system in order to compare and analyze scan results. However, performing the actual scans can be done from the command line interface without .NET Framework.

Microsoft kissing Hotmail goodbye

The company aims to draw users away from Gmail and Yahoo Mail

Microsoft on Tuesday began publicly previewing a new webmail service for consumers called Outlook.com that will eventually replace Hotmail.

Microsoft also expects that Outlook.com will draw people away from competing consumer webmail services like Google's Gmail and Yahoo Mail.

MORE FROM MICROSOFT: 12 new network features in Windows 8

With Outlook.com, Microsoft set out to "reimagine personal e-mail -- from the datacenter all the way to the user experience," wrote Microsoft official Chris Jones in a blog post.

Outlook.com features what Microsoft describes as "clean" and "intuitive" user interface that gives more prominence to messages and less to other elements, like headers and search boxes. It doesn't include display ads.

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

With Exchange ActiveSync, Outlook.com accounts can be synchronized across a variety of devices, and it features native integration with Facebook, Twitter, LinkedIn, Google and, in the near future, Microsoft's own Skype.

This means that users can access content and notifications from those social media accounts within the Outlook.com interface.

Outlook.com also sorts messages of different types into separate buckets, so that e-mail from contacts, newsletter subscriptions, e-commerce notifications and social media content is arranged into different groups.

The new webmail service also includes Office Web Apps, the online versions of Word, Excel, PowerPoint and OneNote along with the SkyDrive cloud storage service.

Once Outlook.com exits its test phase, it will replace Hotmail's user interface, although users will be able to retain their @hotmail.com, @live.com and @msn.com addresses as well as their contacts, messages, password and rules.

"While today's preview is just the start, Outlook.com is ready now to become your primary email service. We're expecting millions of people to try it out. Starting today, you can get an @Outlook.com email address, and we've also made it easy to get started with your current email address if you want to," Jones wrote.

Outlook.com is not to be confused with the Outlook email and calendaring PC application, nor with Outlook Web App, which gives Exchange users access to their accounts via a browser.

Microsoft customers see benefits of cloud OS; Windows 8, not so much

TechEd conference finds Microsoft pitching hard on Windows 8, cloud OS

ORLANDO, Fla. -- Microsoft wants its customers to know two things: that Windows 8 is ready for the enterprise and that it has products and services for creating flexible hybrid cloud environments -- a cloud OS.

Those are the two big messages the company pushed at its TechEd North America 2012 conference here, where some parts of those ideas resonated with customers, but others were met with skepticism.

"Move development to the cloud? That's a pretty good idea," said Andre Beaupre, president of Groupe ABI, a data center consultancy in Montreal. He was embracing Microsoft's spin that Windows Server 2012 plus its upgraded cloud offering, Azure, equals a cloud operating system that can boost capacity on the fly as needed for developers.

Microsoft also says its cloud OS can front-end applications while keeping data those apps use safe at corporate sites, and that it supports moving entire virtual servers -- including Linux servers -- in and out of Azure.

MORE FROM TECHED: Windows Server 2012 isn't available yet, but it's powering Bing

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

TEST YOURSELF: The Windows 8 Quiz

As for Windows 8 being ready, its radical shift toward touch and Metro-style, graphics-heavy apps had customers at the conference wondering whether the end users they serve will see enough value to climb the learning curve for the new OS. "I don't know how it's going to be accepted," said Steve Williamson, a sys/ops manager at Santa Fe College in Gainsville, Fla., with about 22,500 students, faculty and staff. "I'll probably wait in it until I get some internal push for it."

Microsoft trumpeted its two big pushes at 90-minute keynotes attended by most of the 8,600 customers the company says attended its annual conference, which was celebrating its 20th year.

The cloud OS framework is built around Windows Server 2012 and Azure, both of which have significant new features.

The OS analogy goes like this: Operating systems manage hardware and are the platform on which applications run. A cloud OS, then, manages the hardware at the scale of a data center and provides the varying platforms on which applications run.

Microsoft is saying Windows Server can manage the physical resources, including pulling them together from a pool of whatever resources are available - in traditional data centers, private clouds and public clouds.

Server 2012 is much more powerful, said Microsoft's Satya Nadella, president of Microsoft's server and tools business. The server, due out later this year, sports up to 320 logical processors per server and 4TB of memory, and up to 64 virtual processors and 1TB of memory per virtual machine. These big numbers, plus the fact that the final preliminary version of Server 2012 is powering the production network for the Bing search engine, indicate a significant upgrade to and stability of the platform, he said.

As for Azure, it recently added support for virtual machines -- including some flavors of Linux -- making Azure an infrastructure-as-a-service provider, not just a platform-as-a-service provider. This ability to shift entire virtual machines in and out of the cloud under the control of Windows Server 2012 is one upside of cloud OS, Nadella said.

Top 20 Windows 8 features

As with any technological overhaul, Windows 8 has been met with passionate and mixed response among those who have had a chance to download and test run the Consumer Preview of Microsoft's flagship OS. The company's bold new direction for Windows, with its dual interface and emphasis on tablet functionality, certainly means changes ahead for IT departments when Windows officially ships. But for users there is a lot to like about the forthcoming OS. Here is a look at the 20 features that Windows 8 users will appreciate the most.

1. Metro Start
Metro Start is Windows 8's new location for launching applications. It includes updating live tiles that you can regroup as you desire, increasing the flexibility of your Windows 8 experience.

2. Traditional desktop
For those who prefer the traditional desktop experience, this still exists in Windows 8, which offers a traditional desktop view akin to that of Windows 7. Applications that run in Windows 7 will also run on Windows 8's traditional desktop.

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

3. Metro apps
Part of the new Metro UI, Metro apps are full screen and easy to install, offering an immersive new way to work with Windows.

4. Windows Store
Integrated into Windows 8, the Windows Store offers Metro apps for download and purchase and soon will also offer desktop apps. A tile located on the Metro UI start screen offers one-click access to the Windows Store.

5. Tablet ready
Unlike previous versions of Windows, which were not built for tablets, Windows 8 has been built from the ground up as both a tablet and desktop operating system, providing a hybrid approach to computing on both PCs and mobile devices.

6. Internet Explorer 10 for Metro
Windows 8 ships with two versions of Internet Explorer 10, the classic desktop version and a new full-screen immersive browser that is lightweight and easy to use.

7. Touch interface
Windows 8's touch interface allows you to use a variety of touch commands to navigate the operating system.

8. SkyDrive connectivity
SkyDrive is not a new feature, but its tight integration into Windows 8 is. In Windows 8, the data you store in the cloud is easily accessible on all your Windows 8 devices, and the files you store in the cloud are easily viewable on your tablet, smartphone, or other Windows 8 device. SkyDrive soon will support large file sizes, meaning you will be able to transfer files that are up to 2GB in size.

9. Charms bar
The Charms bar is a replacement for the Start button, offering quick access to search, sharing features, devices, and settings.

10. Search bar
Search is by no means a new feature for Windows, but the search bar in Windows 8 is a powerful improvement on previous generations.

11. Windows 8 snap-to feature
Windows 8's snap-to feature allows you to multitask Metro apps, so you won't be stuck with just one Metro app at a time. With the snap-to feature, you can snap together multiple Metro apps onto the screen, or you can snap Metro apps to your classic desktop applications, giving you the best of both UIs.

12. Recover your PC
A new feature in the control panel, called Recovery, allows you to refresh or reset your PC. These are two new options offered in addition to the existing system restore and other recovery options available in previous versions of Windows.

13. Simplified settings
The Control Panel still exists in Windows 8, but now it is accompanied by a new PC settings section available through the Metro UI. The PC settings section offers access to the several of the same commands but in a simplified format so you don't have to dig deep into Control Panel to find popular options.

15. File History
File History offers a new, easier way to back up and restore files.

16. Ribbon and quick access toolbar
The unified menu system in Windows 8 now includes the ribbon and the quick access toolbar that were introduced in Office 2007. These are now standard features of the Windows operating system.

17. Windows Reader
Windows Reader is a native PDF reader included in Windows 8, freeing you from requiring an additional application to read or mark up PDF files.

18. Metro Video app
Microsoft has enhanced its video capabilities in Windows 8 with Video, a simple-to-use Metro video app. Both Windows Media Player and Media Center are still part of Windows 8, but Windows 8's Metro Video gives a lightweight alternative for video viewing.

19. Integrated social networking
Microsoft has made considerable effort to integrate social networking throughout Windows 8. Applications like Socialite and Tweet@rama allow you to post directly to Facebook or Twitter, and you'll find these among the tiles in the Metro UI.

20. Reduced hardware requirements
Perhaps one of the most important features for many users is actually having the ability to run the operating system. Machines that run Windows 7 and Windows Vista already meet the hardware requirements for Windows 8, and many systems running Windows XP will also be eligible to run the latest OS.

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

Microsoft cloud survey: Security, cost both a deterrent and an attraction

More transparency would help boost the confidence of small businesses in cloud services

Small and midsize businesses that actually use cloud services see them as a way to boost security and save money, according to a survey sponsored by Microsoft.

The same survey finds similar-size businesses not using cloud services worry they might not be secure enough and that the costs of transitioning to them might be a hurdle.

Best Microsoft MCTS Certification, Microsoft MCITP Training
at certkingdom.com

The goal of the survey was to find out the expectations small and midsize businesses had for cloud services and how that compared to the reality experienced by companies that are already using cloud services, says Tim Rains, director of Microsoft's Trustworthy Computing.

WINDOWS 8: Firefox, Chrome cry foul over Windows 8 on ARM

The upside for security is that cloud services on average cuts 18 hours per week from security management time, the survey says, because much of it is handled by the provider, Rains says. "It doesn't eliminate the need for patch management on-premise, but there's less of it to manage," he says.

That saves money, but also increases security because providers are likely to patch and upgrade in a timely manner as a competitive edge.

The survey says that over the past three years, businesses using cloud services enjoyed decreases in security spending that are more than five times the savings reaped by businesses that didn't use cloud services. Of those using cloud services, 20% say they reduced their security management costs, but the number was just 4% for those that didn't use cloud services.

Still, 40% of those respondents not using cloud services say security is the reason they don't, but 67% of them say they would be more confident about using cloud services if there were industry security standards. Visibility into how cloud providers operate their networks so customers can map that to standards and best practices would make 38% of respondents more confident about buying cloud services.

A third of those not using cloud services say they see the cost of transitioning to cloud services as a barrier.

The survey questioned 94 small and midsize businesses using cloud services and 93 that did not. Microsoft says cloud users were defined as companies that used a cloud service via a subscription model, and did not differentiate among SaaS, IaaS and PaaS offerings, or what types of data or functions were entrusted to those services.

The survey was conducted by research firm comScore, which did not reveal to respondents that the survey was sponsored by Microsoft. Respondents were not qualified based on which cloud vendor they used.

A small to midsize business was defined as one with between 100 and 250 PCs in its network

Best Microsoft MCTS Certification, Microsoft MCITP Training
at certkingdom.com

How Run Android apps on Windows

We’ve run Android apps on Virtualbox, Netbooks and told you about Bluestacks bringing Android apps to Windows PC. Bluestacks is now a reality, available to general public.

Unlimited life Microsoft MCTS Training, Microsoft MCITP Training at certkingdom.com

The alpha version allows most Android games & apps to be installed on a PC, but prohibits some games, such as Angry Birds and Fruit Ninja, that all would be available in paid version.

Not every app will work perfectly, but most of the apps should. Users can to push programs from their phone or tablet to the PC from a program that will be available from the Android market.

“Their first computing device is a phone,” Sharma said in a telephone interview. Indeed, BlueStacks had its idea for virtualization technology long before it had the idea to do Android on Windows. That specific implementation, Sharma said, came when one of his colleagues got back from a trip to Switzerland. On that trip, the colleague’s young daughter had played a lot of Android games. Back home, she wanted those same programs to run on the PC. With that, BlueStacks had its business model.

BlueStacks raised $7.6 million in Series A funding earlier this year from backers including Ignition Ventures, Radar Partners, Helion Ventures, Redpoint Ventures and Andreessen Horowitz. The company has slightly more than two dozen workers at its headquarters in Campbell, Calif., and at offices in India, Taiwan and Japan.