What Microsoft didn’t say about the new 0day Windows flaw

Casting blame on Windows, when Internet Explorer is at fault.

See my latest InfoWorld Tech Watch blog.

Yet another Internet Explorer 0day

Microsoft has released Security Advisory 2501696, describing yet another 0day flaw in Internet Explorer.

This time the problem lies in the way IE handles MHTML code. Apparently there’s a way for a sufficiently ornery Web page to run amok on your PC, if you’re browsing with Internet Explorer. No action on your part necessary; it’s a drive-by security hole.

You have two choices.

You can either run Microsoft’s Fixit, which sits in Knowledge Base article 2510696.

Or you can do what I’ve been begging you to do for almost a decade now. Use Firefox. Or Chrome. Or Safari. Or anything except Internet Explorer.

The real story behind Microsoft’s $20 billion quarter

My latest InfoWorld Tech Watch post.

Seven simple steps for setting up Windows 7

Windows Secrets Newsletter is out. My Top Story talks about seven easy ways to make sure your new copy of Windows 7 works right.

Microsoft loses three more cloud-savvy heavy hitters

See my InfoWorld Tech Watch blog.

Microsoft takes a swing at the iPad and misses by a mile

See my latest InfoWorld Tech Watch post.

And now for a different kind of 0day

Any list of the ten smartest people in the computer biz today would have to include Mark Russinovitch.

With technical street cred stretching from building Windows uber-utility Sysinternals, to discovery of the Sony Rootkit, to defining the Microsoft Technical Fellow position by example, Mark knows tech like you know your coffee cup.

Add one more achievement to the list. He’s a hell of a good novelist. At least, I couldn’t stop myself scrolling through the posted excerpt from his first novel, Zero Day. (Warning: it reads like an explicit action-adventure novel.)

Mark says he started working on the novel eight years ago, and it’s taken this long to get through the book-writing maze.

From the cover:

An airliner’s controls abruptly fail mid-flight over the Atlantic. An oil tanker runs aground in Japan when its navigational system suddenly stops dead. Hospitals everywhere have to abandon their computer databases when patients die after being administered incorrect dosages of their medicine. In the Midwest, a nuclear power plant nearly becomes the next Chernobyl when its cooling systems malfunction.

At first, these random computer failures seem like unrelated events. But Jeff Aiken, a former government analyst who quit in disgust after witnessing the gross errors that led up to 9/11, thinks otherwise. Jeff fears a more serious attack targeting the United States computer infrastructure is already under way. And as other menacing computer malfunctions pop up around the world, some with deadly results, he realizes that there isn’t much time if he hopes to prevent an international catastrophe.

Arabs in league with Al-Qaeda play the villains. They want to “wreak havoc” on the West “in a very cost-efficient way that’s low risk.” Cyber terrorism fits the description, eh?

Okay, so it’s long on cliches and penny-pinching Al-Qaedites, but the excerpt moves right along. The lead blurb comes from a certain Mr. Gates. You may have heard of him, too.

Look for Zero Day on store shelves in March. Or you can pre-order a copy through Amazon, Barnes & Noble, or a handful of other bookstores.

A quick check on the Amazon ordering page reveals that customers who bought Zero Day also bought a copy of the Windows 7 Professional Upgrade. Simple coincidence? I think not.

Mandatory Windows Live Messenger update starting today

If you use an older version of Windows Live Messenger, you’re going to get an update.

From the Windows Live Blog:

If you are using Windows Live Essentials on Windows XP, or are still using a pre-2011 version of Windows Live Essentials (including Messenger), starting this week, you’ll see a required update that is rolling out in all 48 languages. This minor update to Windows Live Messenger and the other Windows Live Essentials programs includes a set of important security updates, performance improvements, targeted bug fixes, and some other, minor changes.

Microsoft pulls another botched auto update patch, KB 2454826

Microsoft just yanked yet another automatic update-distributed patch. A patch for Windows 7, no less.

This one isn’t a security patch. But if you had auto updates turned on – or if you told Windows to download but don’t install updates – you got it on January 11.

KB 2454826 is supposed to improve graphics performance on Windows 7 machines. Instead, it locks up some machines with an error 0x7F, a Blue Screen Stop: 0x0000007F, or Windows Live Mail won’t launch. Details in KB 2498368.

The solution? Turn off Automatic Updates, fer heaven’t sake.

Oh. Sorry. The solution is to uninstall the patch, but to do so, you have to go into Safe Mode. Details in the KB 2498368 article.

Microsoft’s Attack Surface Analyzer sheds light

There’s a new free tool from Microsoft called Attack Surface Analyzer, just out in beta. Basically it lets you take a snapshot of your system before and after you install a new program, and then tells you what security holes the program may have opened up.

I had a bit of fun with Bing Toolbar. Take a look at the InfoWorld Tech Watch column.

The mysterious KB 976902 and Win7 SP1

This interesting note just in from EP:

Hey Woody.

About that mysterious KB976902 update for Windows 7 you mentioned a few months ago.

It’s back.  MS released KB97902 on Jan. 11, 2011 as noted here:

http://support.microsoft.com/kb/976902

Much of the files in KB976902 are version 6.1.7601.17514 dated 11/20/2010.

Hmmm, isn’t the RTM or final release of Windows 7 SP1 supposed to have a build number of 7601.17514.101119-1850?

I think that build of SP1 has already been leaked on the web.  A bunch of Win7 users in this Windows Sevenforums.com thread have already obtained the “leaked” version of Win7 SP1:

http://www.sevenforums.com/news/137662-microsoft-confirms-windows-7-sp1-rtm-released-oems-today.html

Kinect: Coming soon to the corporate world?

I think the Kinect – yes, the gaming gizmo – is going to roll over the corporate world this year. See my InfoWorld Tech Watch article.

Further evidence: Mary Jo Foley reports that a “core contributor” to the Kinect effort at MS has just jumped ship to work for Google.