|
We guarantee your privacy: 1. We will never sell, rent, or give away your address to any outside party, ever. 2. We will never send you any unrequested e-mail, besides newsletter updates. 3. All unsubscribe requests are honored immediately, period. Privacy policy 
|
|
INTRODUCTION — news about your newsletter Next issue Sept. 15, no issue Aug. 25 We're taking a break! Since a lot of people go on vacation in the last half of August, we skip an issue then to give our contributors some time off. (The same is true at the end of December, too.) Our next issue will be published on Sept. 15. That's two days after Microsoft's next Patch Tuesday, the date when fixes and advisories usually come out. We publish twice a month, so our second issue in September will appear on the 29th. We're a little crazy for trying to get an entire newsletter to you only 48 hours after Redmond's flurry of announcements become available for us to analyze. But that's what we do. Although I'll be traveling the rest of this month, I won't be in a cave. I'll be reading the rumor mill and chatting up my sources, just as I always do. If some important Windows tricks arise, I'll send you a short news update. Thanks again for your support of Windows Secrets. —Brian Livingston, Editor ^ TOP STORY — info you need to make Windows work SPECIAL REPORT: Protect your media player from podcasts By Brian Livingston It should be fun and harmless to play podcasts — short radio and television programs that download automatically from the Internet. But dumb programming mistakes in popular media players can allow spyware to silently infect your PC while an apparently innocent multimedia file is playing. In the first part of my special report on podcasts, published last issue, I explained that applications designed for media downloading — called "podcatchers" — can cheerfully save hacked media files or even troublesome executable files to your hard disk. In the second part of my report, I'll explain today the steps you can take to protect yourself. Infected executable files, in this case, aren't actually your most serious problem. Let's say a podcast you download happens to really be, for example, a dot-exe file. If your podcatching software downloaded the file earlier and you absent-mindedly try to play it, your media player will probably do nothing. It'll just sit there, waiting for you to load a file type it understands. The real danger occurs if your media player allows a "poisoned" audio or video file to silently run commands or install other files. You'd think media players would support nothing but audio, video, and still images. But, amazingly, these players have a history of letting multimedia files get away with murder. The good news is that playing podcasts on a specialized MP3 player — such as an Apple iPod or a Creative Zen Micro — probably won't infect these little devices. They run simple operating systems and aren't full computers, so they're not attractive targets. The bad news is that, if you watch video podcasts or listen to audio podcasts using Windows or a Pocket PC, any weaknesses in your Microsoft or third-party media player can expose you to infection. If you have a broadband connection, in particular, your PC is a valuable resource for hackers who'd love to install their spyware. They can then show you pay-per-click pop-up ads, use your bandwidth to quietly send millions of pieces of spam, or launch denial-of-service attacks against Web sites. The solution is to keep your media player updated with the latest vendor patches. This can be a simple and trouble-free task. Once your player is updated, you can relax and enjoy podcasts safely. In the following sections, I'll tell you how to fix whichever media player you may use — Windows Media Player, iTunes, QuickTime, RealPlayer, or Winamp. |
 Windows Secrets Newsletter Issue 59 — 2005.08.11 INTRODUCTION • Next issue Sept. 15, no issue Aug. 25 TOP STORY • Protect your media player from podcasts • Update WMP to avoid surprises • iTunes isn't safe just because it's Apple • QuickTime can play more than videos • Music and movies can hack RealPlayer • Winamp falls victim to sneak MP3s WINDOWS GIZMOS • New battery technologies lengthen life • Recharge phones, PDAs, cameras, etc. • Double-strength batteries appear in U.S. • Get USB, FireWire, video, speaker ports INDEX OF REVIEWS • External hard drives catch reviewers' eyes • Seagate receives Ultimate Choice award • PC World awards drives as Best Buys • Sony impresses editors at PC Mag • HP projector gets Ultimate Mobility nod • PC Mag rates top inkjets for 2005 • New laser gets Editors' Choice • PC World rates less-expensive SLRs • Pen Computing names choice PDAs • Garmin praised by Smart Computing • Epson scanner excels in PC Pro tests • PCE makes power-supply picks SECURITY BASELINE • ZoneAlarm 6.0 install problems HOT TIPS • Have a problem? I'll print something • Support 16 VPNs with a single router • Should Microsoft problems be publicied? • Word of Cisco weaknesses travels fast OVER THE HORIZON • Windows holes from several sources • Microsoft ActiveSync has security problems • USB drivers could attack computers • IE JPEG problems fixed by patch • Severe hole in Windows 2000, 2003, XP • Exploit code targets Veritas Backup Exec WINDOWS PATCH WATCH • Microsoft forgets to sign a few patches • Microsoft update is acting up, too • One new IE patch is medium priority • Two patches are essential to stop worms • Both antiworm patches require W2K SP4 • RDP vulnerability is like afterthought • Two fixes for telephony and Kerberos • Three re-releases for Viewer, 2003, and OE • Genuine Advantage fixed... for now • While at Microsoft Update, what to patch? • Service pack issues and APC gotcha UPDATE MANAGEMENT • UR1 — not an update, not a service pack • UR1 is not a service pack • Certain disadvantages come with UR1 • How to handle rollup deployment WACKY WEB WEEK • "Jeb's Jobs" is tech support on steroids USEFUL LINKS • State e-mail taxes begin to bite • How Utah, Michigan legislators got fooled • Internet Explorer 7 Beta 1 Review NEWSLETTER CONTROL PANEL • Windows Secrets home page • How to subscribe • Change your delivery address • Change your preferences • Access past free issues • Access past paid issues • Upgrade to paid version • Search for info (WinFind) • Submit a Windows tip • Get subscription help • How to unsubscribe CIRCULATION: over 147,000 |
|
Update Windows Media Player to avoid surprises Late in 2004, computer experts noticed that a popular Windows Media Player video file was actually a silent delivery mechanism infecting millions of PC users with spyware. On Jan. 3, 2005, security researcher Ben Edelman revealed what was happening to people who played this video file in WMP. After clicking the OK button on a single, legitimate-looking "browser update" dialog box, "My computer quickly became contaminated with the most spyware programs I had ever received in a single sitting," he said. Edelman counted an amazing total of 31 programs that had silently been installed, without even displaying a license agreement. These included adware from 180solutions, CoolWebSearch, Ezula, ISTbar, and many other adware companies, he said. (By the way, I reported on July 14 that Microsoft's AntiSpyware beta program, to the dismay of spyware experts, has stopped recommending the removal of programs by 180solutions, Ezula, and some other adware companies.) How the trick works: Media files that are played using recent versions of Windows Media Player, such as 9.0 and 10.0, can invoke Microsoft's Digital Rights Management system. This DRM scheme allows multimedia files, among other things, to open a Web page and display information to the user. Allowing audio and video files to open new windows is not such a good idea in the first place. Even worse, however, is how DRM was implemented by Microsoft. 
Left: Playing a video file in Windows Media Player can launch a dialog box that
looks official but installs spyware.
Enlarge
image in contextDRM-protected multimedia files, when played in WMP, can make a dialog box appear, such as the one shown above that Edelman diagnosed. (This image is reproduced with Edelman's permission.) In this case, the dialog box tells the user to click the Install button to get what was supposedly a Required Media Player Version 10 Browser Update. Most Windows users, of course, see dialog boxes like this all the time. For example, legitimate audio and video files commonly require the download of a particular compressor-decompressor, or codec. That perfectly ordinary situation displays a very similar codec-update dialog. (I discuss, below, a safe way to update codecs.) In the case shown above, the message does say Security Warning, but so do many other alert boxes. It's very natural for Windows users to click OK on boxes such as this one, and huge numbers of people have done so. After all, the dialog box says the download is required! (For details, see Edelman's original report.) Microsoft's response to the outcry over this unacceptable behavior was pathetic. For at least a week, the company initially said the misleading dialog boxes were using a "by-design feature" of WMP, which wouldn't be changed. The company then reversed course, telling eWeek in January that a patch would be available by mid-February. Patches that allowed WMP 10 users to switch off the deceptive behavior were in fact released by then. But no patches were made available for WMP 9, which is used by more people, according to an April 14 eWeek article. Microsoft finally released security advisory 892313 and the related Knowledge Base article 892313 on May 10. These articles described the problem and linked to an update for WMP 9 that had been posted a few days earlier. Unfortunately, the WMP 9 patch is available only for users of Windows 2000 and 2003, not users of Windows 98 or Me. Worse, neither the advisory nor the KB article tells WMP 9 and 10 users that they must change a setting to turn the protection on after installing the upgrades. Finally, as far as I can determine, neither Windows Update nor the newer Microsoft Update bothers to inform users of the need for these upgrades. What to do: Users of Windows XP with Service Pack 2 (SP2) who also have Windows Media Player 10 installed are not vulnerable to the problem. For everyone else, I've put together the following steps to make you immune. WMP is "integrated" into Windows and you can't easily remove it. For this reason, I urge you to upgrade WMP's components to the latest version available for your OS, even if you never use it. Then apply patches as described in the steps below. WMP 10 will run only on Windows XP. WMP 9 will run on Windows 98 SE, Me, 2000, and 2003 as well as XP. Users of Windows XP: First, if you don't have SP2 installed, I recommend that you install it now, using the XP SP2 page or the new Microsoft Update (requires Internet Explorer). While you're at it, use Microsoft Update to get the latest security patches for XP. Then, if you don't have WMP 10, get it from Microsoft's download center. Once WMP 10 is installed, read security advisory 892313 and install the update for WMP 10 using the link in KB article 892313. Finally, read section 9.4 of Microsoft's WMP FAQ. Follow the instructions in bullet point 4 to turn off auto-acquisition. To do this in WMP, right-click the title bar, then click Tools, Options, Privacy, then turn off Acquire licenses automatically for protected content. Users of Windows 2000 or 2003: First, use the new Microsoft Update (requires IE) to get the latest security patches for your OS. Then, upgrade to the latest version of WMP 9 using Microsoft's download center. Once the updated WMP 9 is installed, read security advisory 892313 and install the update for WMP 9 using the link in KB article 892313. Finally, read section 9.4 of Microsoft's WMP FAQ. Follow the instructions in bullet point 4 to turn off auto-acquisition. To do this in WMP, right-click the title bar, then click Tools, Options, Privacy, then turn off Acquire licenses automatically for protected content. Users of Windows 98 SE and Me: WMP 9 will run on these OS versions, but 98 SE and Me are so old that Microsoft no longer supports them and I don't recommend them. There's no patch for WMP 9 on these operating systems. If you have a PC that's running 98 SE or Me, check whether it meets the hardware requirements for XP using Microsoft's upgrade center. If so, I urge you to upgrade to XP SP2 and WMP 10, even if you have to pay money for a retail copy of XP. All users: Upgrading to the latest Windows security patches, which I recommend above as step one, eliminates other security holes that affect WMP. For example, being current with all patches stops WMP 9 from being infected by poisoned PNG images, as described in MS05-009. Also, Windows Update may already have installed patch 828026, which dates back to September 2003. Administrators should use the three Registry values described in the related KB article 828026 to stop WMP 9 from responding to URL script commands. Note that even taking the steps above may allow some media files to display dialog boxes, which you must take care to answer correctly. As far as I'm concerned, no video is important enought to answer Yes to any dialog box a strange file opens, if WMP is the media player. (If you need an updated codec, download it separately from a legitimate source, such as the ones recommended by Microsoft in "How do I find a codec?") If you're running XP SP1 or higher or 2000 SP3 or higher, you can restrict access to WMP, although you can't easily remove it. You do this using Windows' Set Program and Access Defaults feature. Follow the instructions in section 2.4 of the WMP FAQ. By the way, don't bother using KB 190990, entitled "How to determine the version of Windows Media Player," to determine your version of WMP. Despite being revised as recently as Mar. 24, 2005, the article shows the wrong current version numbers for WMP 9 and 10. After you've upgraded and patched WMP, you may also wish to install one of the third-party media players mentioned later in this article. Let the new player associate multimedia file extensions with itself so WMP never runs. That's the best you can do to keep audio and video files from automatically launching WMP. When security holes are discovered in the future, my guess is that other vendors will fix their problems quicker than Microsoft will. iTunes isn't safe just because it's Apple Apple software doesn't suffer from security flaws as often as Microsoft's does, but problems aren't unheard of. You need to stay abreast of Apple updates, especially for its popular iTunes media program, just as you do with Windows apps. A flaw in iTunes was announced by Apple as recently as May 9, 2005. The problem allows a hacked MPEG4 file (.mp4) to silently install a Trojan horse on a computer. This wouldn't affect an iPod or other specialized MP3 player. Nor would it likely affect Apple's OS X operating system, which protects users from installing software unknowingly. But it would be a big problem in Windows, which by default runs with administrator privileges all the time, allowing viruses to quietly install themselves. Fortunately, Apple released an upgrade, iTunes version 4.8, on May 9 to correct the problem on Windows 2000 and XP and OS X 10.2.8 or higher. Even better, Apple released iTunes version 4.9 on June 28, which is the first version that supports podcasting. You should upgrade iTunes to 4.9 immediately. What to do: First, read the description of the MPEG4 problem provided by SANS and Apple. Then, upgrade to iTunes 4.9 using Apple's download page. QuickTime can play more than videos QuickTime is another Apple program, this one primarily used to display short videos. The application runs on both Windows and Mac and often comes preinstalled on PCs. It's also widely downloaded by people who want to view movie trailers provided by Hollywood studios and other content. QuickTime was found in September 2004 to be hackable if it was used to display, of all things, a still-image bitmap file (.bmp). If you happened to load a poisoned bitmap, it could silently take over your PC while the image was being displayed as though nothing was wrong. Apple released QuickTime 6.5.2 on Oct. 27, 2004, to correct the problem. Since that date, it's released QuickTime 7.0. But that version was found to allow media files to send data from your computer back to a hacker's Web server. The company released QuickTime 7.0.1 on May 31, 2005, to patch this. What to do: Read Apple's descriptions of the problems corrected by QuickTime 6.5.2 and 7.0.1. Then upgrade to QuickTime 7.0.1 using Apple's download page. Music and movies can hack RealPlayer RealPlayer is one of the most popular media players on the market, with hundreds of millions of downloads of its free player and more than 2 million paying subscribers, according to a company statement. But RealPlayer and other products made by RealNetworks have had a troubled history with security holes and privacy issues. The company lists on its security page more than a dozen patches that have been required for its media products, including RealPlayer and RealOne Player, in the past 2-1/2 years. In addition, RealNetworks' software raises security issues for both companies and individuals. RealPlayer and RealOne Player are configured by default with Internet-access features that allow RealNetworks and its partners, such as NASCAR and CNN, to install additional software, according to WatchGuard Technologies. Most recently, RealNetworks released patches for its software — including RealPlayer, realOne Player, RealPlayer Enterprise, and Rhapsody — on June 23, 2005. These programs, if unpatched, can let hackers access a PC if the user plays a hacked MP3 audio file or AVI video file, or even visits a Web site that plays multimedia content. What to do: Read the descriptions of the latest security hole provided by eEye Digital Security and RealNetworks. Then review any patches that may apply to you on RealNetworks' security page. Finally, upgrade any RealNetworks software you may have to the latest version that's safe. For example, RealNetworks' June 23 bulletin says these versions are not at risk: RealPlayer 10.5 (build 6.0.12.1212) and Rhapsody 3 (build 0.1141). Winamp falls victim to sneaky MP3s Winamp is such a widely used media player that it's listed as the 32nd most popular file at CNET's Download.com. Unfortunately, like the other player apps, Winamp, too, has had its share of programming blunders that exposed users to danger. In the latest case, merely playing an MP3 file in Winamp can cause hacker code to silently run. This can potentially plant a Trojan horse on a computer, according to a July 14 analysis by a security research group in Croatia named LSS (Laboratorij za Sustave i Signale). Winamp released a new version on July 19 that fixes the flaw. What to do: Read the analysis by LSS, then upgrade to Winamp 5.094 using Winamp's download page. C'mon, get it together, developers Of all of the Windows applications we use, media players that simply play audio or video clips should be risk-free. It isn't asking too much for developers of these programs to subject them to thorough security audits and neutralize any possible threats. Enjoying podcasts should be a simple matter that doesn't expose users to serious risks. We're not there yet, so — until that day comes — you need to give your media player periodic patches in order to use podcasts safely. You might think that a podcaster would never risk losing audience share by including a virus in a regularly scheduled show. But a podcaster's PC might inadvertently get infected, adding a hidden virus to a file without anyone noticing until it had gone out to thousands of people. In addition, viruses these days don't seek to erase a PC's hard drive. Instead, they aim to quietly take over the PC's bandwidth, and big dollars are at stake. Podcasters have already received financial offers to distribute adware within podcatching software, according to a public warning by Nick Bradbury, the developer of FeedDemon. We all have to keep our guard up against this threat. To send us more information about podcasting, or to send us a tip on any other subject, visit WindowsSecrets.com/contact. You'll receive a gift certificate for a book, CD, or DVD of your choice if you send us a comment that we print. Brian Livingston is editor of the Windows Secrets Newsletter and the coauthor of Windows 2000 Secrets, Windows Me Secrets, and eight other books. ^ |
|
FORWARDING INSTRUCTIONS — news gains value when it's shared Please share this information with your friends You're encouraged to refer your friends and colleagues to this free newsletter. Because most e-mail programs don't correctly display a formatted message that's been forwarded, simply call people's attention to the permanent Web address of this issue: WindowsSecrets.com/comp/050811. ^ |
|
WINDOWS GIZMOS — our product reviews of new stuff New battery technologies lengthen life
|
|
INDEX OF REVIEWS — our directory of product shootouts External hard drives catch reviewers' eyes
|
|
THE SECURITY BASELINE — the minimum you need for safe computing ZoneAlarm 6.0 apps encounter install problems By Brian Livingston The latest version of ZoneAlarm products is beset with reports of incompatibilities and other problems. I reported on July 28 that version 6.0 of the ZoneAlarm Security Suite was released. This version, for the first time, integrated antispyware functions with the product's existing firewall, antivirus, and antispam features. I also reported that the suite had already received a PC Magazine Editors' Choice award. Zone Labs, the product line's publisher, subsequently released its new standalone firewall product, ZoneAlarm 6.0, on Aug. 5. Zone Labs' user forum has been humming with complaints from users that version 6 of the company's software has disabled other applications, interferes with POP3 e-mail downloads, and has other issues. At the top of its user forum page, Zone Labs acknowledges that there are problems. "The cause appears to be related to the upgrade process, not the application itself," the company says. "Therefore, we recommend users experiencing difficulties uninstall any prior version of ZoneAlarm (v.2.x - v.5.x) residing on their computer system and do a clean installation of their new ZoneAlarm 6.0 product." Uninstalling ZoneAlarm 6 can be tricky, so if you're having the above problems, please read Zone Labs' uninstall instructions page. I'm grateful to the many readers who've passed their comments about ZoneAlarm 6 problems along to me. Particularly provocative were these remarks (edited for length) by Lorin Ricker:
Prior to the release of Zone Labs' 6.0 version of its products, testers had overwhelmingly rated ZoneAlarm 5.5 as the best standalone software firewall. Since that version is still available and supported, people who are uncomfortable with the new "point-oh" release should stick with 5.5 (or revert back to 5.5). You can download free or trial versions of version 5.5.094 at the following locations: ZoneAlarm Free, ZoneAlarm Pro, ZoneAlarm Security Suite, ZoneAlarm Antivirus. However, I think it's too soon to give up on ZoneAlarm Security Suite 6.0. Zone Labs will surely find and correct the incompatibilities soon. Not everyone who installs a 6.0 version of Zone Labs products is having problems. Those who do have problems seem to have installed 6.0 over a previous install. That should work fine, but in this case it apparently does not. While many computer users are savvy enough to put together their own security suite from unrelated products, many other users are not. Most PC novices would benefit from having a single package that met all their needs for antivirus, antispam, antispyware, and firewall protection. I invite my readers (who have test machines) to uninstall previous ZoneAlarm products and clean-install the new 6.0. As readers report their results — and as professional testing labs turn out new ratings — Zone Labs may continue to rise to the top of all security suites, or there may be a new winner. I'll let you know in future issues. The Security Baseline as it stands Based on the latest published tests, the four products a PC needs for comprehensive protection against hackers are (1) a Linksys hardware firewall, (2) ZoneAlarm Security Suite 6.0 (new info: but uninstall previous versions first, see above), (3) CounterSpy antispyware, and (4) an update-management tool of your choice. See details below.
|
|
HERE'S A TIP — you'll get a better newsletter if you choose the paid version You're reading the free version of the Windows Secrets Newsletter Subscribers to the paid version receive additional information in each issue. Some of the extras this week are:
Paid subscribers can access all old and new paid newsletter content Make a contribution to support our research into Windows and you'll immediately be able to read and search through scores of valuable articles. In addition, paid subscribers are entitled to download valuable content that we license for you at least once every calendar quarter. To upgrade, simply make a contribution of any amount you choose If you do this by Sept. 14, 2005, you'll instantly be sent the full, paid version of today's newsletter. To upgrade to the paid version of Windows Secrets, please visit WindowsSecrets.com/upgrade. Thanks in advance. ^ |
|
WACKY WEB WEEK — playing for you the Internet's greatest bits
USEFUL LINKS — more stuff that's good to know State e-mail taxes begin to bite (2 of 4) The two states that have imposed an e-mail tax start to collect the tax this month. These laws will certainly have no effect on spam, but will affect only legitimate senders of e-mail. (By Brian Livingston, Datamation) More info How Utah, Michigan legislators got fooled (3 of 4) Residents of Utah and Michigan are likely to get less legitimate e-mail, but receive more spam, under new state laws. (By Brian Livingston, Datamation) More info Internet Explorer 7 Beta 1 Review Discover all the new features in Internet Explorer 7.0 Beta 1 — both the standalone version and the version that ships in Windows Vista Beta 1 — in my latest review. (By Paul Thurrott, SuperSite for Windows) More info ^ ABOUT YOUR SUBSCRIPTION — we're here to serve you The Windows Secrets Newsletter (formerly Woody's Windows Watch and Brian's Buzz on Windows) is published twice a month, except for breaks in August and December. The newsletter is published on the Thursday after Microsoft Patch Tuesday (the 2nd Tuesday of each month) and two Thursdays after that. A short "newsletter update" is sometimes published between regular newsletters, if breaking news occurs. Publisher: WindowsSecrets.com LLC, 300 Queen Anne Ave. N. #456, Seattle, WA 98109 USA. Vendors, please send no unsolicited packages to this address (readers' letters are fine). Editor: Brian Livingston is the coauthor of Windows 2000 Secrets, Windows Me Secrets, and eight other books. Associate Editor: Paul Thurrott is the author of Windows XP Home Networking and Great Digital Media with Windows XP and the author or coauthor of several other books. Contributing Editors: Susan Bradley, Mark Burnett, Chris Mosby. Research Director: Vickie Stevens. Program Director: Brent Scheffler. Trademarks: Windows is a registered trademark of Microsoft Corporation. The Windows Secrets series of books is published by Wiley Publishing Inc. The Windows Secrets Newsletter, WindowsSecrets.com, WinFind, Windows Gizmos, Index of Reviews, Briefing Session, Windows Patch Watch, Update Management, and Wacky Web Week are trademarks and service marks of WindowsSecrets.com LLC. All other marks are the trademarks or service marks of their respective owners. How to subscribe: Anyone may subscribe to this newsletter by visiting WindowsSecrets.com/info. Our Ironclad Privacy Guarantee: (1) We will never sell, rent, or give away your address to any outside party, ever; (2) We will never send you any unrequested e-mail, besides newsletter updates; and (3) All unsubscribe requests are always honored immediately, period. Privacy policy HOW TO UNSUBSCRIBE: To unsubscribe from the Windows Secrets Newsletter, Copyright © 2005 by WindowsSecrets.com LLC. All rights reserved. ^ |
