Stephen Toulouse Quotations

We've taken a look at this situation and incorporated some lessons learned. We will work very hard to help ensure something like this doesn't happen in the future,

We had been looking into detailing the history anyway and some customer questions drove the idea to write it up. We just wanted to make sure people had the history.

Security researchers provide a valuable service to our customers in helping us to secure our products. We want to get face to face with them to talk about their views on security, our views on security, and see how best we can meet to protect customers.

Should MS05-018 have been a more complete update to address the underlying vulnerable function? Yes, Cesar is right. But I want to reiterate that MS05-018 did protect against the issue that was brought to us,

Certainly, right now, we and our anti-virus partners are not seeing a widespread impact of this attack.

It had a huge benefit to our developers.

It is on the table. Every time any kind of exploitation is going on, it is on the table.

We're working on an update to Internet Explorer and that update is currently in our testing process and could come out as early as April. However there's no firm date.

We're working day and night on development of a cumulative security update for Internet Explorer that addresses the vulnerability.

We can't leave anybody behind. And unfortunately you might be introducing new problems. So whenever we look at even a quick hack ... it's got to be of quality. That's what customers have told us time and again.

We have not tested this mitigation tool. We can't recommend it because we have not tested it...Customers should weigh the risk of applying something like this to their systems.

We're literally in a meeting going over our plans, keeping track of things, when we got word on Tuesday that CNN was reporting they had been hit. At the time, we knew a high-profile target was reporting they had been hit and they didn't know what it was. Their computers were shutting down and restarting,

We saw the exploit code and our Security Windows Reaction Team tested it against the patch, and we were convinced we would see an attack. It was only a matter of time,

This situation is now resolved and customers should be able to get the update. I want to reiterate that the problem had nothing to do with the update itself, you applied it manually from the download center or got it through SUS 1.0 it should install correctly and protect against the vulnerability. But it's available now for everyone.

Currently this exploit is not publicly available, but we continue to urge customers on older versions of our operating systems to deploy MS05-051 to help protect from attempted exploitation,

Currently that update is in the testing phase and could be released as early as April. But of course, that isn't final.

Our test and engineering plan for that update that we began two weeks ago is on track to have that update ready for Tuesday.

The MSRC is constantly monitoring the threat environment for any malicious activity. We are keeping an especially close eye on the newsgroups and vulnerability lists for exploits related to this month's activities and will mobilize immediately to help protect customers against threats as necessary.

Although infection rates are low, it doesn't mean it's not a bad situation, ... We want to make sure, not only are we providing information to make sure customers aren't impacted, but to make sure they know how to get back to an operational state.

This is why it takes so long, but that's not to say that if there's an exploit, we won't accelerate testing and get it out there as fast as we can. But if we find problems in the testing phase, it could trigger a restart and cause even more delays.

There's been some speculation that you can only trigger this by using an incorrect size in your metafile record and that this trigger was somehow intentional. That speculation is wrong on both counts. The vulnerability can be triggered with correct or incorrect size values.

There's been some speculation that ... this trigger was somehow intentional. That speculation is wrong.

It only affected Windows 2000. So far it has shown a very limited impact -- we're not seeing any widespread impact to the Internet, but we remain vigilant.

The key thing is really that we want to make people understand the risk with these flaws and that they enable automatic updates.

In general, many of these bulletins have a lower impact in terms of severity and are much more difficult to exploit on newer operating systems such as Windows XP SP2 and Windows Server 2003 SP1.

If you aren't using Macromedia Flash Player, or know that you don't need it, you can disable the ActiveX control in Internet Explorer through the

The huge responsibility we have is that we have to answer to our customers, and our customers represent potentially hundreds of millions of different configurations.

Among the critical updates, customers who run older versions of the operating system such as Windows 2000 should prioritize MS05-051 for deployment on those systems.

The maximum total severity rating for this month is Critical, so please update systems as soon as possible when the bulletin is available this coming Tuesday.

I have approximately 70 messages on Xbox Live right now and half of them are, 'I'm going to kill you' and 'I'm going to find you and destroy you' and I haven't worked (at Microsoft) in two years. Even to this day people who don't know I left Microsoft still come after me.

Here's the reality, for the next couple of years the Mac OS will experience increasing security threats and mark my words, the company will have to seek outside expertise in the form of a head of security communications in the next 12 months.