RSSNew Microsoft 'Morro' anti-malware will share competitors' security events
By Scott M. Fulton, III | Published June 23, 2009, 5:26 PM
It's an argument we've seen before from Microsoft's competitors and opponents, as well as from many sensible observers: It may be unfair for the manufacturer of the operating system to leverage its customer visibility to advance a free software platform that cuts out commercial competitors. But there's another argument from opponents as well, many of them the same people: Microsoft should be responsible for the health and well-being of its customers' systems when the operating system is threatened, either through malicious use or from system defects.
So what should it be? Today, for better or worse, the company staked a broader claim on the anti-malware market with the initial public beta release of Microsoft Security Essentials, formerly code-named "Morro." It's not the company's first free anti-virus product -- it first cut its teeth (and maybe cut some other parts along with them) with Windows Defender for Vista. And in the subscription service field, OneCare became notorious first for being substandard, and then for a public relations patch-up campaign that blamed the world at large for having been substandard.
Historically, Microsoft hasn't been able to get the ball rolling in this department. In fact, for well over six years now, Microsoft's anti-malware efforts have continually begun and begun again, dating back to the original incarnation of Security Essentials planned in 2003 for Windows XP.
What it's calling Security Essentials today is a piece of this and a piece of that: the core scanning engine from OneCare, along with the capability to share malware signatures in real-time with the Dynamic Signature Service originally intended for its Forefront commercial package, wrapped together with a front end that effectively substitutes for Windows Defender, and that looks slightly more like an XP product than a Vista product. But at the heart of the system is the first public test of an idea that was supposed to premiere with Forefront last April and didn't: a live database of security events compiled with the aid of perhaps as many as 20 partners.
The database is called the Dynamic Signature Service (DSS), and it's compiled using what's called Security Assessment Sharing -- part of a revised platform Microsoft put forth in 2007 code-named "Stirling." With SAS, anti-malware events logged by these partners' commercial software may be utilized in real-time by Security Essentials. Though the complete list of participating vendors has not been released, those who thus far have been willing to acknowledge their own participation include: Brocade, Guardium, Imperva, Juniper Networks, Kaspersky Labs, Q1 Labs, RSA, Sourcefire, StillSecure, and TippingPoint. (Some of these SAS partners are credited on Forefront's Stirling page.) Some you've likely heard of, others maybe not, though by sharing information with one another and with Microsoft, these firms could be giving each other a leg up against competition from "the usual gang," including McAfee and Symantec.
The sharing of events with the DSS requires the Security Assessment Sharing Agent, which for now is a part of other Microsoft server software such as Exchange Server -- it's not part of Security Essentials.
Still, the argument against the use the DSS goes like this: When Microsoft uses a high-powered feature to elevate the profile of an anti-virus service that it has already described as providing only basic features, but doing so for free, it could be provoking Windows users to accept substandard security rather than invest in commercial alternatives.
The initial message Security Essentials gives its customer is, "Trust Microsoft." As the installer program describes for itself, it may reset settings for Automatic Updates so that they are downloaded and installed automatically -- in other words, "full green" in the icon. Its message reads: "By using this program, you agree to let Microsoft make changes to your system, such as enabling features that keep your system up to date and make it safer for you to browse the Internet." It's the company's way of saying to customers, if you choose to go down this road, you're making the decision to trust Microsoft with the security of your operating system and files.
DSS is one of those ways, and now Microsoft will be opening up its database to select partners in exchange for them opening their databases in turn. Combining the resources of several companies, including independent engineers -- all in the spirit of "interoperability" -- could poke a lot of holes in that counter-argument.
I wouldn't touch a Microsoft products that dealt with viruses or malware- I've already seen their track record with Windows Defender and OneCare.. One Care rated so low the testing chart didn't cover it; complete failure. It was like a colander trying to hold water.
http://www.lehsys.com/20...se-theres-always-morrow/
Count me out.
Thanks for reading!
Score: -2
|You mean "Viru$es".
Score: -2
|OneCare actually jumped by leaps and bounds ever since that failed test (2 years ago) when they started a hiring spree from the other security firms. Before they killed OneCare, it actually landed up as one of the top in the pro-active test from the same place that failed it the first time. http://www.av-comparatives.org
Score: 0
|Ah, stingray...
Always nice to hear from the trolls who have *zero* clue what they are talking about.
Though the initial release was horrible, they have apparently learned from it. Forefront has been winning awards and topping the comparatives since shortly after it launched, and is the same engine used in OneCare before it went on hiatus to become WSE.
Score: 0
|BTW: Totally off topic:
Pricing for Win7 released!
http://arstechnica.com/m...-cheaper-than-vista.ars
Pre-Order:
Home Premium: $49.
Professional: $99
Available from the 26th through the 11th (While "supplies" last...whatever that means...)
Looks like I'm spending $150 this weekend. ;)
Score: 0
|Only $50.00 here.
Score: 0
|Is the above download build # wrong? It says 1.0.1487.0, yet what I have is 1.0.1407.0. Using Update Essentials under Help says I have the latest.
Score: 0
|Same here:
Microsoft Security Essentials Version: 1.0.1407.0
Score: 0
|"Who takes a benefit of it?" is the first question of the police investigators to catch a criminal.
But nobody investigates where viruses and malware come from to punish this criminal behavior.
In the meantime viruses and malware mean big business for many people in many ways.
Hmmm....
Score: -1
|Like advertising and scamming idiots out of their money?
Simplest answer is usually the best. Wrapping it into some insane conspiracy theory would be one of the least likely....any idea how much something like that would damage a company? We've all seen their boneheaded moves...do you truly think they could keep something like that under wraps???
Score: 0
|It would never happen in America or in Europe. But remember that almost 85% of our hardware comes from different asian countries where there is almost no legal effective control.
Score: 0
|Same applies. If ASUS started adding chips to their boards or distributing viruses with their drivers, people would notice.
The only time that might be an issue is when buying from a non-mainstream vendor, in which case...buyer beware still applies.
The main point is still valid. This isn't some major conspiracy and no-one with enough of a market to have any affect would get away with it for long (making it very unlikely that they'd even attempt such corporate suicide).
Score: 0
|IMHO introducing viruses and malware should be considered a criminal behavior by law and consequently be investigated and punished. I don't believe in conspiracies, but what I see is that no legal measures at all are taken against it, and that viruses and malware are a a gold mine for many important corporations.
Score: 0
|Not that I don't agree with the ideal, but at who's expense?
Most of these "virus writers" do not reside in our borders, use advanced method's of mothballing their whereabouts, and are generally groups instead of individuals, making them even more difficult to track.
I can't even begin to fathom how much that would begin to cost. ..not to mention the PR damage. Should we invade Africa? Where do we even start?
It'd be great to round all these folks up and publicly execute them in slow, horrifically painful ways...but it's just not feasible.
Score: 0
|IMHO not doing anything at all means increasing it. It is important for everyone of us all over the world and criminals should be localized, identified and punished as long as possible, even using the international organizations. This is like Al Quaeda, but in computing.
Score: 0
|*shrug*
Well, like I said, I agree with the ideal, but just don't see how it would be at all possible to accomplish.
If you have any ideas, please...do tell. ;)
Score: 0
|OMG! I am only a humble member of this forum. But it is said: "It is easier for a mouse to see the king that for the king to see the mouse". Even when commercial interests are great, they should be left aside and fight, being the ones who have to fight just the ones that indirectly have found a gold mine thanks to these criminals.
BTW: "Morro" is a spanish word, as you may see in this link connected to the "Diccionario de la Lengua Española", which collects all common terms used by european spaniards and also by 300 millions spanish speaking american people:
http://buscon.rae.es/dra...PO_BUS=3&LEMA=morro
As you may see the colloquial meaning of it is:
"8. m. coloq. Descaro, desfachatez. Tener, echarle morro"
which means, according to Yahoo, Babelfish:
"8. masculin. colloquial. Impudence, brazenness. To have, to throw nose to him"
Wow!
Score: 0
|It's not the company's first free anti-virus product -- it first cut its teeth (and maybe cut some other parts along with them) with Windows Defender for Vista.
I could swear that Windows Defender came out for XP before Vista was ever released. That, and I'm pretty sure MS cut it's teeth long before Windows Defender with a little product called "MS Anti virus" that was included in some versions of DOS in the late 80's and early 90's, last version to include it I believe was DOS 6.22. Though I can't say whether it was actually Microsoft's own work or if it was just a branded program that someone else made. In fact, I wonder if anyone actually ever used that back then. I don't remember anyone ever mentioning it back then, no articles about it, no news about it, as if it just never existed.
Score: 0
|I believe the AV with DOS was Checkpoint's product. Not sure if MS bought them or just bundled it.
Score: 0
|MS Antivirus - It was based on Central Point's Anti-virus. Just looked at it in a Virtual PC (yeah, i have DOS laying around...)
Central Point was eventually bought by Symantec.
More:
http://en.wikipedia.org/.../Central_Point_Software
Score: 0
|Heh..
Love it. Someone's always got the DOS disks lying around. I still have my old ZEOS DOS/WIn 3.11 install CD lying around somewhere. I thought that was *so* cool at the time. Boot it, format /s the drive and copy over the DOS folder. Set up your CD-ROM drive in autoexec and config, reboot and install windows from the CD...done.
My how things have changed...
Score: 0
|Over the last 10 years, I've yet to encounter a problem with a computer that the advice "uninstall Norton" didn't fix. You name it, removing Norton fixes it. That crap causes far more problems then it's ever actually solved.
If this does better in the "doesn't wreck your computer" department, that alone would make it better then the major commercial alternatives.
Score: 0
|I'm not sure if MSE is related to Forefront. OneCare was based on heavily modified RAV engine.
However Microsoft also owns former Fortinet which fits better under the Forefront name.
But i won't say for sure since i haven't researched this in depth (yet).
Score: 0
|Ars Technica Quote:
"MSE's engine is actually identical to the one that ships with Forefront Client Security; in fact, Microsoft uses the same engine for all of its security products."
WindowsLive Quote:
"Based on Microsoft's own Forefront 2.2 enterprise security technologies, the aim of Security Essentials is to provide an economically friendly way to encourage protecting your Windows PC."
The version numbers also match (engine/definition).
Pretty solid bet it's Forefront.
Score: 0
|So, now that the economic arguements are out of the way, do I install it or not? I have files that I never wish scanned (bad signatures, false positives, etc). Can I easily exclude an entire tree?
Score: 0
|Dunno about the tree, but there are places to exclude files. Didn't even have to hunt for it.
Score: 1
|Thanks.
Having installed it, the answer is, no you can't.
You have to open the exclusion dialog, open the tree, open the folder, open subfolders, click one, click OK. Repeat as needed.
I wish someone would make it easy to do this.
Score: 0
|Is it perhaps possible to "drag" the excluded items from the folder into the "exclusions" window?
I do not have it here at work, so I cannot test that. Give it a go and let me know. That would be incredibly useful.
Score: 0
|Works well. Quick and easy. Takes up *few* resources and scans faster than anything I've used.
It is based on the Microsoft Forefront engine and definition files used on their server products that Microsoft has been winning security awards with since it's release so I would expect it's detection rate to be just as good. (Can't believe you missed that one, Scott...)
The final will be a free download. Microsoft is contacting OEMs (to offer bundling with new PCs) but is not expecting a huge rush as this is free and many of them are getting paid to install McAfee and Norton.
It will disable (thanks soozy) Defender (if installed) and will warn users to remove existing AV solutions (it's never recommended to run more than one "resident" AV for performance reasons alone). It does verify genuine OS, but if you're not genuine, well... Avast with ye! :*grin*
Oh...and lest we forget:
The EU cannot touch this. The other "security" companies have no footing on which to whine about this (though they'll no doubt try)... This is probably one of the most non-controversial things they've done *well* in ages.
EDIT: Heh...Still beta. The balloon pop-up calls it "Microsoft AntiMalware".
Score: 2
|If it's good enough for you PC_Tool, it's good enough for me. I'll even add a thumbs up to your excellent piece, how about that then ?
PS Alas I failed to download and install as promised, appears I needed a special Microsoft account. This I failed to obtain, having attempted and failed to come anywhere near what was required of me. Unable to figure out the gobbledygook I needed to defeat any spam that was lurking. So it's goodbye Microsoft and hello again to all that keeps PC Tools top of my charts, they don't need no special ID to install their stuff, thankfully.
Score: 0
|once again, between the article and the posts I come away with something useful. Thank You. On a side note, PC? if the balloon tips annoy you I found that a rusty old XP program that does work on Vista, XPAntispy will get rid of those annoying tips. I wouldn't suggest using it for anything else. But if you don't like the tips, this program still works and doesn't gum up the works.
Score: 0
|Nah...the tooltips don't annoy me, I just found it amusing that they missed a spot in their product branding. :p
Sturgess: I don't even remember when I originally signed up for that "Connect" account. Ages ago, though... Should be the same account info you'd use to download the Win7 Beta/RCs though if that helps at all.
Score: 0
|It did not uninstall Windows Defender on my Vista PC, maybe because I have Defender disabled?
Score: 0
|Sorry, you are right. Will replace "remove" with "disable". It does not currently remove the files used by defender. I am assuming this is either because it utilizes some of them or simply for compatibility reasons (that will hopefully be ironed out prior to the final).
Good catch!
Score: 0
|I have nothing to say about Security Essentials, but I love the "Actual Beta News" logo. It's like Minute Maid Limeade putting "Made with Real Limes" on the package, as if we should be impressed by limeade made with limes, or by a site named Betanews actually having beta news.
Score: 0
|They've been getting crap about not having enough "Beta" news from many of us for years. I love it. I think it's a poke at us and an opportunity for them to start letting us all know more about the kind of software that drew us here originally in the first place.
Score: 0
|And they benefit what exactly by a free app, other than providing their very own Windows customers with a security they deserve. When those very ppl start to complain over that, i start to wonder what the hell they really want. I think they don't even have a clue themself.
As far as the exchanging goes, you ppl are inventing hot water. Antimalware companies are doing that for decades, they just don't hang that on the bell. It's just a matter of how fast you process the stuff you get hands on. And how advanced scan engine you can make to avoid just making loads of rather static signatures.
Because to be honest, MSE has one of the most advanced scan engines you can get on the market. Because when competitors professionals start talking about that, you know it's really true.
Quite few ppl who i work from time to time said this and they are top specialists for malware analysis. So keep that in mind when you're about to bash MSE for some stupid reason or just because it's made by Microsoft. MS guys are no idiots, they know their stuff. And they know it freakin' well. Why OneCare never really took off? It was not because it was crap or something like that. It's just that Microsoft gave up on the whole thing too fast or their expectations were too high.
Should we be complaining over AVG eating up the chunk of market avast! should have? Or AVIRA? or vice versa? If you're good and users trust you, thats all you need.
So calling stupid EU regulations on it is just plain idiotic and anyone that will be doing or trying to do that should be shot on sight. Seriously.
Score: 0
|Welcome to can't win no matter wtf you do..
On the one hand "omg windows is insecure, fix this fix that"
On the other hand "omg they are trying to fix windows insecurities.. but those insecurities are my livelihood, QUICK CALL THE EU THEY WILL STOP THEM!!
People (especially so called "security vendors" for the mass market.. yes I am calling you out Mcaffee, Symantec, Trend Micro, Kaspersky, Sophos, Griisoft, and all the rest.. Need to realize that just because a situation exists with a piece of software today.. doesn't mean that it will exist forever..
JUst because your business model is based around a weakness in windows, does not mean that there is no reason for MS to fix that weakness going forward..
What if hypothetically speaking windows was shipped 100% secure from any and all attack vectors? would the same people turn around and cry that it was anti-competitive? I realise this is 0% likely of happening but you do have to consider the slippery slope of these arguments..
You cannot have 2 completely contradictory goals and expect no compromise between them
Score: 2
|"JUst because your business model is based around a weakness in windows, does not mean that there is no reason for MS to fix that weakness going forward.."
That's not quite what is going on here.... TBH, Microsoft is not "fixing" the holes, but plugging them the same way the 3rd party security vendors have been for decades.
Of course, your point still stands. When Microsoft introduced PatchGuard, an effort that actually began to *address* some of the issues, Symantec went to town complaining that Microsoft was cutting them off.
Score: 2
|Chuckling,,, so true. If I am not mistaken, MS had to change some of the Vista program because of Symantec complaints. Others with a better memory than me ( yes folks as you get old memory is one of the 1st things to go "soft" well..ok..not the 1st thing but I won't go there.:)
Score: 0
|"but I won't go there.:)"
...I think you just did. :p
Score: 0
|Looks to me like another reason for the EU to complain about bundling even though it is an "opt in" app. They are making it easier to eliminate competitors.
Score: 0
|And we all know that is one of the prime tactics of capitalism....
Score: 1
|Ah...our pet socialist.
I think you are confusing the "tactic" with a symptom or side-effect.
The "tactic" of business is to be as successful at what you do as possible (pretty much in line with the human condition...do what you do and be as successful as you can in the doing of it).
One of the symptoms/side-effects is that those who are *really* successful take a large portion of the market, forcing out, by demand, those who aren't as successful.
Unfortunately in today's P.C. world we're telling businesses to fear being as successful as they can in order to artificially preserve some absurd sense of fairness when in reality all we're doing is propping up products that aren't successful. How does *that* foster innovation?
Score: 1
|Same thing applies in regards to people- we build them up to lofty standards only then to tear them down..."pet Socialist"..Laughing...I like that. Do I sense a new market emerging?
Score: 0
|This trumps everything that you'll ever say ever again, tool....
http://sethf.com/essays/major/libstupid.php
We all see what your way of thinking success is has made a big mess of America. Too bad you can't be brought up on charges of treason....
You've only ever shown your hatred of the average American. A terrorist can only kill you once, what you do is worse. You've made America a joke and something to pity. Now that Obama is in office maybe that can change and America can regain its respect in the rest of the world.
Lets hope that it is another 40 years before the republicans get into any real power again like the last time before Lord Raygun.
Score: -1
|Shut me up? Are you kidding? You've got *nothing* but the same stale rhetoric seen on MoveOn.Org and the Huffington Post.
If anything, it amuses me....
I had a whole rant going that gave the royal beat-down to every sentence you just posted, but meh... Why bother. It's not like you're capable of logic and critical thinking when it comes to politics anyway. ;)
Score: 0
|