Monthly Archives: February 2009

Microsoft Office Labs vision 2019 (montage + video)

[flv:officelabsmontage.flv 600 400]

When Microsoft decides to imagine the future, it never fails to impress. Not only do you have some of the smartest people envisioning what’s possible, but they also invest so much into communicating these ideas through sights and sounds which the production value can be compared to most blockbuster sci-fi films.

Today at the Wharton Business Technology Conference, Microsoft’s Business Division president Stephen Elop unveiled the latest production from Microsoft Office Labs called “2019”, starring stock photo men, women and children playing with the next-generation of communication, collaboration and production technologies. (via Steve Clayton)

Those with a keen eye and a good memory might recognize a few familiar concepts in this video already shown in earlier videos of the “envisioning” series, for example the future of personal health, having said that, I believe there’s still a couple of new never-before-seen concepts sliced between. Please correct me if I’m wrong. And I’m not wrong. Update below.

Update: I’ve been able to get my hands on the new “2019” video in its full glory. This 5-minute long spectacle is available separately below. Some of the new technologies demoed including a “transparent wall” between two classrooms around the world, animated drawings, realtime conversation translations, surface displays, electronic boarding cards, transparent displays, mini projectors among many others. The electronic newspaper is definitely my favorite.

[flv:msofficelabs2019.flv 600 360]

And for those who like to analyze every pixel as much as I do, here’s a couple screenshots I extracted from Stephen’s PowerPoint deck. An interesting future indeed.

Get your Windows 7 Beta DVD here

windows7dvds

In my recent travels to Microsoft Australia in Sydney, I’ve recently inherited a small fortune of Windows 7 Beta (32-bit) DVDs. After many failed attempts of building a “house of cards” out of fifteen of these DVDs, I’ve come to realize that this is simply too many Windows 7 Beta DVDs for one person.

Now that the public Windows 7 Beta download from Microsoft now officially closed, these DVDs are a great way to try out Windows 7 Beta if you haven’t already without resorting to filesharing websites or a friend of a friend’s uncle who works at Microsoft. On the other hand if you already have Windows 7, these also serve as great coffee mug coasters and ninja throwing projectiles.

If you would like the chance to win one of these DVDs mailed to you (international readers welcome), please send an email to win7betadvd@gmail.com. The email can be blank, contain a quote from Einstein or a picture of your cat – it doesn’t matter. Fifteen (15) winners will be picked at random on Friday 27th February 2009 (Australian time). Product keys are available separately from the Microsoft website.

PS: I have been and am currently still on holiday. Regular programming will resume Saturday 28th of February 2009. If you would like to see where I’ve been, have a look at my Flickr stream.

Update: The contest is now closed. The winners will be picked and contacted shortly.

Users prevail: Microsoft changes Windows 7 UAC control panel behavior to address security flaw

windows7uac

It seemed only hours ago Microsoft stood by their decision not to change the UAC control panel behavior in Windows insisting it was “by design”. Oh wait, it was only hours ago. Nevertheless, three hours and numerous comments later, Microsoft reversed their decision for the better of all Windows 7 users. The Engineering 7 blog writes,

…we are going to deliver two changes to the Release Candidate that we’ll all see. First, the UAC control panel will run in a high integrity process, which requires elevation. That was already in the works before this discussion and doing this prevents all the mechanics around SendKeys and the like from working. Second, changing the level of the UAC will also prompt for confirmation.

The result is actually even slightly better than what I had hoped for. I originally proposed a secure confirmation to be displayed when the UAC level is changed, but Microsoft one-upped that proposal to also run the UAC control panel in high-integrity which means malicious applications cannot manipulate the user-interface of that window without first elevating itself.

All I want to say is thank you to everyone who took the time out to thoroughly understand the issue at hand and continued to spread the message in a constructive and meaningful manner. At the same time I also want to acknowledge everyone who may have disagreed with our opinions for also being constructive.

The day I posted my original article I had lost my ADSL internet connection, and still to this day it is down. So Microsoft, if you disconnected my internet, I’d like to have it back now please. 😛

Update: I’d also like to reiterate, until the RC build of Windows 7 is available, everyone using the Windows 7 Beta should change their UAC setting to “max” to ensure they are safe from either UAC vulnerabilities.

Win a free Windows 7 shirt (Australian residents only)

windows7shirtIf the Zune guy has taught us anything it’s that you should never mutilate your skin to show your love for a product, which is why a shirt is exponentially better. Thanks to Microsoft Australia, I was recently offered forty (40) of these limited-edition Windows 7 shirts, but since one can only wear so many at a time, I’m passing the freebies onto (some of) you, the wider Australian enthusiast community.

Sorry, Australian residents only. Usually I don’t limit my giveaways to geographical barriers but because Microsoft Australia is helping me with the logistics (and I thank them for it), this is a necessary limitation.

To enter, first sign up for a Twitter account if you don’t already have one. Then tweet what you like most about Windows 7 with the hash tag #win7shirtau. For example, “Problem steps recorder in Windows 7 rocks #win7shirtau”. Finally befriend me, “longzheng“, on Twitter so I can direct message you if you win. I promise I won’t spam you Viagra (unless the economy gets really tough).

To keep the competition fair, winners will be still chosen at random and multiple submissions by one user is counted only once, but creativity is encouraged. Competition closes on Friday, 13th of February 2009 and winners will be notified on Twitter via direct messages (also email notifications by default). Anyone found using multiple Twitter accounts or not in Australia will automatically be disqualified.

Besides the obvious fact it is “new and shiny”, Windows 7 comes with a lot of cool new features and improvements so I’m sure you’d have no problems thinking of one, if you have tried it that is. If you haven’t, it’s not too late either. You have until February 10 to register for the free public beta and February 12 to download it. Head over to the TechNet Australia’s Windows 7 Beta site for more information.

I have noticed these shirts have four holes on them, but I’ve been assured by the manufacturer it is by design. 😛

Update: The winners have been selected and notified. If you didn’t win one, consider printing your own.

Second Windows 7 beta UAC security flaw: malware can silently self-elevate with default UAC policy

UAC broken in Windows 7

Soon after writing my last blog post on the potential security vulnerability to autonomously disable Windows 7 beta’s UAC system, I had realized that flaw was just one piece in a string of dominoes that fell much earlier when the new tiered-UAC system was introduced in Windows 7.

In summary, a second UAC security flaw in the Windows 7 beta’s default security configuration allows a malicious application to autonomously elevate themselves to full administrative privileges without UAC prompts or turning UAC off. A result I’m sure cannot be classified as “by design”.

This public disclosure comes after a private disclosure to Microsoft and Windows 7 beta testers earlier this week. Whilst Microsoft has not officially responded, I’ve heard rumors it may already fixed in current internal builds. If and until a patch is available, I feel obliged to outline the elevated risk (pun) to the millions of Windows 7 beta user running Windows 7 beta in its default UAC policy of “notify me of changes by program, not of Windows changes” which does not adequately enforce the privilege system, arguably an essential factor to a safe operating system.

Windows 7 UAC flowchartWithout going into too much detail, as you already may know from the previous postings, Windows 7 has the ability automatically elevates Microsoft-signed applications and code which specifies “auto elevation” to mitigate the number of UAC prompts. Rafael Rivera has more details how this works.

The fundamental risk with the above behavior is the fact that Windows is a platform that welcomes third-party code with open arms. A handful of these Microsoft-signed applications can also execute third-party code for various legitimate purposes. Since there is an inherent trust on everything Microsoft-signed, by design, the chain of trust inadvertently flows onto other third-party code as well. A phenomenon I’ve started calling “piggybacking”.

To demonstrate, one of the many Microsoft-signed applications that can be taken advantage of is “RUNDLL32.exe”. With a simple “proxy” executable that does nothing more than launch an elevated instance of “RUNDLL32” pointing to a malicious payload DLL, the code inside that DLL now inherits the administrative privileges from its parent process “RUNDLL32” without ever prompting for UAC or turning it off.

For more technical details about this and a downloadable proof of concept, head over to Rafael’s site where he has prepared a non-malicious informational executable and DLL rolled into one neat package to try for yourself at home.

Unfortunately this flaw is not just a single point of failure. The breadth of Windows executables is just too many and too diverse, and many are exploitable. The only solution I can think of is also one I don’t think Microsoft will even consider, that is to revert to a single UAC policy and prompt for every elevation including Windows’ own applications. I’m curious how this will play out.

Important: The advice to every Windows 7 beta user is to set your UAC setting to “high”. This will make sure granting privileges are only in the control of your own mouse clicks and should prevent a malicious application from exploiting this and the previous flaw. Again, the balance between usability and security comes under the spotlight.

In Microsoft’s defense, some people have also argued UAC is not a “security boundary”, a vague term in my books. I argue because UAC is designed to enforce privileges (processes cannot jump to any privilege they want) and control privileges (prompts for privilege changes) it is a security feature. If a security feature can be maliciously and silently bypassed or turned off, I would consider that a security flaw.

Finally, to clarify my perspective on the whole issue, Windows 7 is a great operating system and these UAC issues are just two particular cases in a very small list of notable issues. I disagree with how Microsoft had handled the original issue but I’m sure with the wider public feedback it received we will end up with a more secure operating system as a result. In no part am I trying to “derail” Windows 7’s success run, but ensuring the default security policy is adequately safe for current and future users.

Update: As it turns out, Microsoft had known of this Windows 7 UAC auto-elevation flaw all the back in November of 2008. “For Beta, Windows components that can execute arbitrary code and or apps (eg CMD, CSCRIPT, WSCRIPT, PowerShell, etc) are prevented from auto-elevating.” I guess they overlooked things then.

Update 2: Microsoft’s Jon DeVaan has posted a response on the official Windows 7 blog with an extensive look at the UAC system in Windows 7 and their decision on the default security policy. In conclusion, they continue to stand by their decision and does not indicate they will change the default UAC policy.