By Andy McCue, 29 June 2004 14:45
NEWS
Microsoft has hailed Windows XP Service Pack 2 (SP2) as a "victory for the security guys" and its new features have been welcomed by users at the software giant's annual Tech Ed conference in Amsterdam this week.
A test release of SP2 was issued two weeks ago and the final version is expected to be ready sometime in July, although Microsoft is yet to set a firm date for the delayed update.
At a whopping 300MB, the Windows XP update is being touted by Microsoft as another step towards its goal of 'trustworthy computing'. The security enhancements were demonstrated to developers at Tech Ed this week.
Steve Riley, product manager in Microsoft's security business unit at Redmond, acknowledged that SP2 has taken longer than expected to pull together.
"It takes time to finally get this stuff right," he said.
He nicknamed SP2 "Shorthorn" in reference to some of the features that have been added in from the development of Microsoft's next major version of its operating system, codenamed Longhorn.
Riles said: "This is stuff we discovered in the development of Longhorn that we thought we have got to get into the OS now."
Among the changes in SP2: the newly renamed Windows Firewall comes switched on as default and uses only an inbound logging system. Riley said traditional ZoneAlarm and Norton firewall products that ask users to authorise outbound traffic cause too much confusion.
Spyware and pop-up ads are also tackled in SP2 and the title and status bar will now always be visible on the screen to limit the impact of ads that spoof Windows dialogue boxes or take over the whole screen.
Riley said there has been a noticeable increase in "zone elevation" attacks in which secure windows can be navigated to a lower security zone that would leave the information in the hands of attackers.
SP2 is a key part of Microsoft's Trustworthy Computing initiative, which Riley said will take 10 years.
"It's about making the hackers work harder," he said.
silicon.com spoke to a developer at the conference from the University of Southampton who welcomed the security enhancements in SP2.
"It's a huge step forward for preventing Trojans and the firewall is a huge step in the right direction," he said.
On a separate note, this year's Amsterdam Tech Ed has featured much drum-banging - literally. All delegates received a tom-tom drum on the opening day and are encouraged to make a noise when they approve of speakers.
Comments
There are 8 comments. Join the discussion
1. sylviepipi
that's fast (i just seen the presentation and the posting already here)
2. anonymous
Wow; years late and tons of code short and it's called a victory. We'd still be driving Morris Minors if they were run by Microsoft.
3. Mike Parker
The comment about other firewall products getting you to verify outgoing traffic? It is not confusing, if you do not recognise the application trying to use the Internet, it is most probably a Trojan of some description. I would say confirming outbound traffic should be an option at least, as it stops a lot of DoS attacks etc. from viruses without even needing to remove the virus.
4. anonymous
Only 10 years to wait for a secure OS.
Wait a minute, why don't I just use one that's already available?
5. anonymous
Asking users about outbound connections is good, it allows users to make an informed choice or alerts to user to possible infections/ spyware/adware on their PCs. For example the latest ie exploit that sends your banking details to the internet, hmmm, does the microsoft security officer think this is not a risk?
6. David Quickfal
I find it utterly incredulous that SP2 will have no outbound checking on the firewall.
IMHO such a facility is a must have.
If nothing else it alerts the user to diallers and any other program that would seek to send data without the users knowledge.
A pain to set up but after that invaluable !
7. Adrian Midgley
MS programs phone home?
If you supply programs that phone home from your customers, then you probably would want to persuade them to remove their outgoing surveillance, wouldn't you.
Doesn't mean there is anything good about that of course.
8. anonymous
Isn't it a bit early to anounce victory?
They haven't released this service pack yet!
Not to say that the size of 300mb (compressed!) is nearly the half of the installation CD.
--------
Linux is not ready for the Desktop
Windows is not ready for Internet