Topic: Metro Interface Improves Windows 8 While Increasing Some Risks

[Pez]

Metro Interface Improves Windows 8 While Increasing Some Risks

 
This is our second look at security-related changes to Windows 8 and the new Metro interface. Our first post introduced the topic and examined some of what’s new and potentially risky in Internet Explorer 10. Today, we’ll discuss improvements and possible problem points in the Windows Store, background tasks, the Windows 8 interface, and more.

Let’s Go Shopping
The Windows Store is similar to applications stores or markets for other platforms. To install apps, a customer needs to have a Microsoft Account (or a current Windows Live account).


Larger picture

The Windows Store

The Windows Store currently does not prompt users to review the capabilities being requested by a new application. This information is visible in the details page for the application:


Larger picture

Application capabilities

If an application attempts to access something that it hasn’t requested at installation, then the application will be denied access to that resource. It is important that users review the capabilities requested by their applications and not install those that request permissions that make the users uncomfortable. Odd requests can be a warning flag, for example, if a photo-editing app requests access to text messaging (SMS) yet has not explained why this capability is required. Purpose-built security software always adds value and provides more layers of protection from such rogue applications.

Background Tasks
With Metro, all applications that are not in the foreground are suspended—so they don’t chew up resources that the foreground application could use. But Metro applications can also be active while in the background. Here are some triggers that will cause activity:

Trigger event                             When task is triggered
ControlChannelTrigger                  On incoming messages on the control channel
InternetAvailable                         The Internet becomes available
InternetNotAvailable                    The Internet becomes unavailable
LockScreenApplicationAdded         An app tile is added to the lock screen
LockScreenApplicationRemoved     An app tile is removed from the lock screen
MaintenanceTrigger                      Time for maintenance background tasks
NetworkNotificationChannelReset   A network channel is reset
NetworkStateChange                    A network change such as a change in cost or connectivity occurs
OnlineIdConnectedStateChange     Online ID associated with the account changes
PushNotificationTrigger                 A raw notification arrives on the Windows Push Notification Service channel
ServicingComplete                        The system has finished updating an application
SessionConnected                         The session is connected
SessionDisconnected                     The session is disconnected
SessionStart                                 The user session starts
SmsReceived                                A new SMS message is received by an installed mobile broadband device
TimeTrigger                                  A time event occurs
TimeZoneChange                          The time zone changes on the device (for example, when the system adjusts the clock for daylight saving time)
UserAway                                     The user leaves
UserPresent                                  The user returns


Although background triggers are not security risks per se, Metro will allow applications to run in the background. The trigger will launch a terminated application or unfreeze a suspended application and the run the task without bringing the application to the foreground. The user will not know the program is running.

Windows 8 vs. Windows 7 Interfaces
With Windows 8 (apart from the Metro interface) Microsoft has made significant improvements over the previous version. Fixes and upgrades include address space layout randomization, heap randomization, kernel fixes, and improvements to use-after-free issues in IE 10.

Let’s look at some noteworthy changes that will be visible to users. We’ll cover more improvements in future posts.

Windows SmartScreen
The SmartScreen feature, introduced in earlier versions of IE, has become Windows SmartScreen. This helps protect users from downloading or running suspicious or malicious applications. As you might expect, however, it allows you to run the executable anyway.


Larger picture

Windows SmartScreen

SmartScreen warns users who try to download a suspicious executable, but users may override the warning. This freedom poses a risk if such downloads are not secured by policy or antimalware solutions


Larger picture

Users can choose to bypass warnings

Windows Defender
Windows Defender has been around for a while, but in Windows 8 it will come packaged with Windows and provide a first line of defense for users without an independent security suite installed. Windows Defender will detect viruses and other malware; that’s an improvement on previous versions, although in third-party tests Microsoft security solutions have performed at no better than an average level, according to the “Virus Bulletin” RAP averages quadrant. Windows Defender is a good first step toward effective security, but “defense in depth” is better. Consumers should install a desktop security suite to provide better protection than Windows can offer. In a corporate environment this defense becomes even more important, and security policies can be better enforced with an endpoint security suite.


Larger picture

Browsing Metro Style
A browser must provide everything from text, forms, and images to complex resource-intensive activities such as script execution and video. Browsers that have adopted the HTML5 standard are much more feature rich, and they are also a gateway to some rich applications that require system resources not available within Metro. But these user and application demands are difficult to meet in Windows 8 due to the significant restrictions placed on the Metro environment.

To provide developers and users with a choice to change the default browser in Windows 8, Microsoft has introduced a new class of applications: the “Metro style enabled desktop browser.” These applications can be registered as the default browser and can execute within the immersive Metro interface. This is an interesting twist because this non-Metro, non-Windows-Store application can influence Metro. It shouldn’t take long before we see custom tricks to get nonbrowser applications posing as browsers.

To Microsoft’s credit the Metro browser installation is not entirely unattended. To select a default browser, the user sees the following screen:


Larger picture

The default browser selection screen

Any changes that modify the system state generally by default put the user in control of the change rather than the application. This control is great, but it puts great responsibility on users to see, understand, and make the right decisions. These decisions can be improved significantly by relying on advice from antimalware vendors, which have greater visibility and can offer proactive measures to boost security for Windows 8.

Need for Education
Windows has great influence and market share, but that also places great responsibility on Microsoft. Windows 8 will provide users with a number of new interface paradigms. New and skilled users alike will need to learn to survive in this new environment. They must:

•Learn what resources their systems have
•Learn how these resources can affect the system—a tangible cost if misappropriated by rogue apps
•Learn how to spot rogue applications
•Learn to identify fake or phishing websites in the new immersive web-browsing interface
•For administrators and security personnel: Learn the new tricks and other structures to protect users
“Old” Windows (with its desktop applications) still lies under the hood of Metro and is still vulnerable to conventional threats to IE or Office as well as to new Metro applications. Microsoft’s new security features will apparently require attackers to use a higher degree of sophistication to exploit systems. Yet past improvements have not deterred malware authors, and there is no reason to believe that new ones will either. Good user education remains of paramount importance.

Users must ensure that any operating system is patched, and that their machines have an antimalware solution that is kept up to date.

Future posts will include more analysis of Windows 8 and the state of its security. We will also further explore implications for users and discuss best security practices for the operating systems and applications.



Reletad previus article: Windows 8 Metro Brings New Security Risks

Orginal article: Tuesday, July 10, 2012 at 9:08am by Prashant Gupta

[Samker]

...

Windows Defender

Windows Defender has been around for a while, but in Windows 8 it will come packaged with Windows and provide a first line of defense for users without an independent security suite installed. Windows Defender will detect viruses and other malware; that’s an improvement on previous versions, although in third-party tests Microsoft security solutions have performed at no better than an average level, according to the “Virus Bulletin” RAP averages quadrant. Windows Defender is a good first step toward effective security, but “defense in depth” is better. Consumers should install a desktop security suite to provide better protection than Windows can offer. In a corporate environment this defense becomes even more important, and security policies can be better enforced with an endpoint security suite.

...

Did you notice that almost every 3rd party AV uninstall WD during installation process ??

 

[Pez]

...

Windows Defender

Windows Defender has been around for a while, but in Windows 8 it will come packaged with Windows and provide a first line of defense for users without an independent security suite installed. Windows Defender will detect viruses and other malware; that’s an improvement on previous versions, although in third-party tests Microsoft security solutions have performed at no better than an average level, according to the “Virus Bulletin” RAP averages quadrant. Windows Defender is a good first step toward effective security, but “defense in depth” is better. Consumers should install a desktop security suite to provide better protection than Windows can offer. In a corporate environment this defense becomes even more important, and security policies can be better enforced with an endpoint security suite.

...

Did you notice that almost every 3rd party AV uninstall WD during installation process ??

  

Yes I know but is it not common sense to not have duplicate antivirus install on a computer. It just take performance.
In this way a user at lest without any acction have some virus protection when they install the system. Then after that you can chose a other if you want.