Happy New Year!

There has been a lot of local (and International) coverage on the WMF zero day exploit that came to light during the Christmas holidays (Dec 27th).

 The vulnerability affects the graphics rendering engine in Windows and could potentially allow malicious code embedded in a Windows Meta File image to be executed resulting in complete compromise of a system. The vulnerability is not known to be wormable and to be infected, the user would have to visit the attacker's website to view the image. There is an immediate workaround for Winodws XP and Windows server 2003 users that can be achieved by unregistering the Windows Picture and Fax Viewer (details on how to do this are contained in the document linked below.

The security centre in the US are currently testing the required update  and are now reasonably confident that the update will be released on Tuesday - Jan 10th. The delay is really down to the engineers testing and localising the update to make sure the update can be deployed effectively across all platforms with a minimum of downtime. Despite the press activity, we are seeing very low infection rates and this is why the update is being held for a full test cycle. There is a workaround immediately available at http://www.microsoft.com/technet/security/advisory/912840.mspx. There was a thrid party patch issued earlier in the week that has been endorsed by SANs however, our recommendation is to wait until the tested update is released next week

Today was makeITsecure day 2005. There was a lot of activity including a 600k booklet drop through the national press, a ministerial briefing with the CEOs of the organisations involved and decent amout of PR activity and news pickup. We also had around 70 Microsoft and Dell security ambassadors out on the streets passing out guidance booklets and advice to anyone who needed any. I was pretty happy with the way the campaign has been received.

Bizarrely, somebody sent me a copy of a discussion thread examining why we don't have any references to the firefox browser on the site and why we appear to be dissing p2p music share sites. The general consensus being that because some of the sponsors are big corporates, we're trying to push people towards our own products. The reality is that we talk about web browsers in general and the only instance where we mention Internet Explorer is in explaining how to change the security settings. A lot of P2P file share sites are rife with spyware and that's a simple fact of life. The idea behind the campaign is to provide awareness and advice to non-technical people about what the threats are and how to mitigate them. Over the past months, we've had 48,000 page views to the site by 18,000 unique users....somebody finds this stuff useful! Of course we could have just done nothing at all....... 

The past week has been a busy week in security for us in Ireland. Last Friday, we had Rafal Lukawiecki present at one of our events to coincide with the visit of Microsoft's CEO, Steve Balmer to Ireland as part of our 20th anniversary celebrations. This is the second time Rafal has presented to audiences in Ireland. Both times, the satisfaction scores for the events have been amazing. He obviously has a deep understanding of what he's presenting since he can it make so understandable - even for non-technical audience members. I have been to security presentations where the speakers have lost me in jargon within a few minutes. I always suspected that they resorted  to obsfucation (no pun intended) because they didn't really understand what they were talking about ( but maybe that's just me). If you haven't seen Rafal present, you can pick him up on recording at http://www.microsoft.com/uk/technet/itsshowtime/sessionh.aspx?videoid=18 .

The second big announcement of the week was that we are finally showing what we are doing with some of the technology that we have acquired over the past couple of years. We have now passed Antigen for Exchange, based on the Sybari technology we recently acquired, through the Security Development Lifecycle review process. This means that the product that will provide anti-spam and anti-virus protection for messaging and collaboration servers will be available in beta in the coming months. The second product announcement was Microsoft Client Protection that is designed to provide a one-stop shop for anti-spyware and anti-virus in a single package. The product won't be available until next year although their may be a beta in the next few months.

Finally, last Tuesday was Patch Tuesday. Three critical patches on Windows...four important and three moderate. If you haven't deployed the patches, you can get them from www.microsoft.com/security and folow the links.

On Friday, I handed over the prize of a Toshiba Tablet PC to the Ireland Gatekeeper Competition winner - Jason Guy.  The Gatekeeper was a security competition that tested the contestants knowledge of security issues. It was run in 19 countries throughout Europe during June. Each day during the competition, a muliple choice question  was posted on the Gatekeeper site. The contestant then had a limited time to answer the question and bonus points were awarded fow how quickly they answered it. The final and twentieth question was open ended and the answer judged by a panel of security experts. Jason, who works for IBM, scored the highest out of the 120 Irish contestants and was 330 (out of his total of ~ 3600) points ahead of his nearest rival. Jason's entry was then put up against the other winning contestants throughout Europe. The final winner though was a guy from Poland who was only 90 points ahead of Jason. The top 50 from Ireland will all recieve free magazine subscriptions to Win IT Pro Magazine - if they registered their details.

So is Jason Ireland's top security expert? He doesn't claim to be so perhaps the others were too shy to enter.

Mike