Windows XP SP2 more secure? Not so fast

It's late. It's large. But Microsoft's much heralded Windows XP Service Pack 2 has finally arrived. Right now, manufacturers and large-systems operators are getting their first look at the final version of SP2. By the end of August, automatic desktop downloads will be available via Windows Update, then on free CDs.

At first glance, the release suggests that Microsoft has finally become serious about upgrading Windows' security. But before you get too excited, let me take a moment to slice through some of the hype coming out of Redmond, Washington. When it comes to eliminating Internet threats, there's still a lot of work yet to be done -- both by Microsoft and by you and me.

Windows XP -- the second edition
Windows XP SP2's biggest news is the new Windows Security Center -- and it's about time. Now, from one location within Windows, complete with system-tray alert notifications, you can monitor whether your antivirus and firewall protection are enabled and whether Windows is up-to-date with the latest patches. Windows XP SP2 also improves its built-in firewall (now called Windows Firewall) and turns it on by default, blocks pop-ups and malicious code within Internet Explorer, and turns off HTML images (such as spam pornography) within Outlook Express.

Some XP SP2 changes are harder to see. Microsoft used this release to harden its operating system; in other words, Microsoft recompiled all its Windows system binaries to include a new flag, GS, which will mitigate buffer overflows, a common method used by criminal hackers (crackers) to overwrite legitimate code with malicious code on your PC. A buffer overflow is the method the Sasser worm used to infect PCs. Windows XP SP2 also makes important changes to core Windows components, such as DCOM and RPC (flaws within the DCOM RPC led to the damaging MSBlast attack last year). And SP2 will also bring every Windows XP system up-to-date, whether or not you've ever performed a Windows update post-install. Once you've installed SP2, you'll have SP1's updates plus all the security patches released up through MS04-025.

No more buffer overruns? Read the fine print
Are we all clear now, then? No need to worry about malicious attacks that take advantage of Windows weaknesses? Not so fast. To fully block the aforementioned buffer overflow and the Internet worms that feed on them you'll need to follow fine print: turns out the necessary No Execute (NX) setting isn't present in the current hardware architecture of most 64-bit and 32-bit processors on the market today. This Data Execution Prevention, or DEP, is currently available only on newer AMD and a handful of Intel's Itanium server chips. In other words, the new Windows DEP changes won't help you unless you're running XP SP2 on a machine with AMD or Intel Itanium processors. My colleague, David Berlind, has suggested that large companies looking to upgrade their hardware fleet should wait until after the first of the year, after Intel has released its chips.

For you and me, it's going to take even longer before this final layer of Microsoft data protection trickles down. Not everyone will upgrade their PCs based on the fact that these new chips won't execute malicious code, and unless you're particularly anxious about buffer overrun, the new security probably isn't a compelling enough reason to hold off purchasing a new desktop PC. In fact, you and I are likely to see good prices on the old chipsets as soon as the new DEP/NX chips hit the market early next year.

And, of course, pre-XP Windows operating systems still have a sizable share of the PC market and have numerous vulnerabilities that SP2 won't fix -- all targets for virus writers and script kiddies. It's going to take years for all the new hardware and software changes introduced to Windows XP to trickle down to the masses worldwide. In the meantime, I expect to see about the same level of virus-writing activity, if not more, as virus writers attempt to snag XP customers before they upgrade.

No more Internet worms? Read the fine print
And remember what I said above about the XP firewall? That it's new and improved? Well, I need to qualify that statement. Despite the firewall's improvements, it's not invincible. A month ago, I asked Fred Felmen, vice president of marketing for Zone Labs, what impact Windows XP SP2 might have on third-party firewalls such as Zone Labs' ZoneAlarm. He said the Microsoft firewall protects only against inbound threats, not outbound threats, such as keystroke-logging Trojans that report your passwords and credit card info to others. Also, the lack of outbound protection means your infected PC could still participate in distributed denial-of-service attacks. In short, I recommend keeping your third-party firewall enabled alongside Microsoft's. Two firewalls are better than one.

Finally, since we're talking about Microsoft software here, it's entirely possible that virus writers will soon write code that turns off the Windows Security Center, or at least leads it to falsify its status reports (saying, for instance, that a security measure is enabled when it's really not). So don't just rely on the Security Center's status messages. Periodically check your antivirus and firewall programs independently.

Some known issues with SP2
I'm not just paranoid. Numerous sources are now reporting that the Windows Security Center is misrepresenting Norton AntiVirus's status -- even after the antivirus program is enabled and freshly updated. Symantec is aware of the problem and says it will release a LiveUpdate shortly that should enable the program to better communicate with the Windows Security Center. Other than that, the SANS Institute has set up this forum to report real-world problems with Windows XP SP2. Luckily, so far, the issues involve slower boot times and sluggish Internet Explorer performance.

Microsoft has made significant progress towards remedying its past problems, but the company still falls far short of putting itself on the leading edge in PC security. Install Windows XP SP2 when you get the opportunity, but don't expect this one update to solve all your Internet security issues. To be safe, keep and maintain third-party antivirus and firewall programs.