DOCSLIB.ORG

Contents in This Issue

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text

Load more

NOVEMBER 2005 The International Publication on Computer Virus Prevention, Recognition and Removal CONTENTS IN THIS ISSUE 2 COMMENT Virus Bulletin WHEN IRISH EYES ARE thanks the sponsors Is the boot on the other foot? SMILING of VB2005: A busy conference schedule, 3 NEWS combined with the famous warmth Microsoft assists Nigeria in fight against and hospitality of the Irish and a high-tech crime drop or two of the local ‘water’ were Errata – Windows 2003 Server a recipe for success for VB2005 in comparative review Dublin last month. page 14 3 VIRUS PREVALENCE TABLE LANGUAGE LOGGING 4 VIRUS ANALYSIS Using components of Windows multilingual Criss-cross support, it is possible to create a file that will capture keystrokes on a target system while using FEATURES the OS to protect that file from removal or deletion. Masaki Suenaga explains how an IME could be 6 IME as a possible keylogger used as a keylogger. 11 The false positive disaster: anti-virus vs. page 6 WinRar & co. THE TROUBLE WITH WINRAR 13 LETTERS Andreas Marx reports on his extensive false positive testing of anti-virus software. 14 CONFERENCE REPORT page 11 In Dublin’s fair city 16 PRODUCT REVIEW NOD32 for Windows NT/2000/XP/2003/x64 with centralized management This month: anti-spam news and events and 20 END NOTES & NEWS John Graham-Cumming looks at measuring and marketing spam filter accuracy. ISSN 0956-9979 COMMENT ‘It adds insult to the voices of those of us on the systems administrators’ side, which was equal in its representation on the panel.) injury when the So, putting aside the reporting of the subject, I’d like to major media outlets touch again on why accurate reporting is an issue for misrepresent the those of us on the administration side. facts.’ In the context of the informational problems that face anti-malware administrators, media misreporting is not Gabrielle Dowling the greatest challenge we face. And when incidents Independent author, USA occur, we certainly don’t rely on such reports as primary sources of information. But, in the fog of war, when we are deluged with information – very little of it good, IS THE BOOT ON THE OTHER some of it outright wrong, usually with the most critical FOOT? details missing – and we are trying to process it all as fast as possible, it adds insult to injury when the major Talk about irony. When I finally managed to log into my media outlets misrepresent the facts. Worse, it adds to email at the conclusion of VB2005, I found folks on the administrative load when we’re distracted by queries AVIEWS were hotly discussing some of the media from end users and the boardroom based on reports coming out of the conference. In particular, I was misinformation: it’s the last thing we need in the midst struck by a report written for Silicon.com, entitled of an event (and an ‘event’ does not necessarily mean ‘Security firms put the boot into the media’. It read: ‘At that we have an actual or potential problem on our this week’s Virus Bulletin 2005 conference in Dublin, a network, but rather that there is an outbreak of panel session featuring representatives from IBM, McAfee something significant against which we need to check and Symantec turned nasty for the assembled press with the adequacy of our defences and incursion responses). vendors airing grievances about what they consider to be “a layer of incompetence” in media companies.’ I think there’s another reason this subject stings those in the trenches. As the security field seems increasingly This seemed to allude to the panel I had chaired on the known for folks filled with bravado who like to drop informational problems facing anti-virus administrators. allusions to ‘the coming superworm’ and dilettantes Apparently, I’d hit a sore spot when I threw the following with little experience writing books that simplistically question to the panel (verbatim): ‘Do news reports of liken worms to warheads, I am constantly struck by the virus outbreaks typically misrepresent the facts? If so, lack of such swagger in the anti-virus community. They what are the repercussions of that misinformation?’ are smart people who have been in the trenches and It was not an accusatory question, but a pragmatic one, know better. and I was surprised by how it came to take over the panel Some of the banter that arose at VB was finger-pointing and audience discourse. It was more surprising still to by the media, saying they were merely responding to see how it came to be reported, since I don’t think things press releases issued by the vendors. That seems wrong, ever approached the tenor of ‘ugly’, and in fact the on two fronts. First, fact-checking is part of Reporting vendors on the panel were generally supportive of media 101, and reporters should be aware that press releases are efforts, accurate or not. (Notably, the reporter omitted a marketing tool. Second, and more importantly, most if not all vendors have dropped that habit – some actually advise administrators that they are issuing a particular alert simply because of media attention, not because it is Editor: Helen Martin being seen broadly in the wild. I love that trend! Technical Consultant: Matt Ham Reporters certainly face the same informational Technical Editor: Morton Swimmer challenges as those of us fighting malware, and that’s Consulting Editors: one of the problems that AVIEN/AVIEWS help to Nick FitzGerald, Independent consultant, NZ address by providing a platform for an experience-rich, Ian Whalley, IBM Research, USA marketing-poor exchange of information. But I would Richard Ford, Florida Institute of Technology, USA Edward Wilding, Data Genetics, UK say this, and it applies broadly: if your fundamental information is incomplete or not well understood, refrain from extrapolating from it or you’ll wind up wildly off the mark. 2 NOVEMBER 2005 VIRUS BULLETIN www.virusbtn.com NEWS MICROSOFT ASSISTS NIGERIA IN FIGHT AGAINST HIGH-TECH CRIME Prevalence Table – September 2005 The Nigerian government has signed an agreement with Microsoft under which the two organizations will Virus Type Incidents Reports collaborate in fighting high-tech crime originating in the Win32/Netsky File 12,228 51.36% country. Win32/Bagle File 4,522 18.99% Under the agreement, Microsoft will provide information, assistance and training to the Nigerian government’s Win32/Zafi File 3,048 12.80% Economic and Financial Crimes Commission (EFCC), Win32/Mytob File 1,023 4.30% which was set up in 2002 to address the problem of Win32/Mydoom File 418 1.76% cybercrime in the country. One of the areas Microsoft Win32/Lovgate File 242 1.02% expects to focus on is botnets – for example teaching officials how to extract useful information from Win32/Klez File 211 0.89% compromised PCs, how to monitor computer networks to Win32/Funlove File 185 0.78% detect such attacks and how to identify the perpetrators. Win32/Bagz File 177 0.74% Mallam Nuhu Ribadu, executive chairman of the EFCC Win32/Dumaru File 150 0.63% said: ‘Our economy has lost hundreds of millions of dollars Win32/Bugbear File 140 0.59% in foreign investment because our credibility and the trust of the international community have been affected.’ He Win32/Pate File 121 0.51% added: ‘This agreement will be of great benefit to us. It will Win32/Mabutu File 101 0.42% put us in the proper direction in fighting cybercrime. It will Win32/Valla File 98 0.41% help us to improve our understanding of the technologies Win32/Fizzer File 94 0.39% involved as well as give us new investigative skills to go after the criminals.’ Win32/Mimail File 87 0.37% Win32/Reatle File 86 0.36% Win32/Swen File 83 0.35% ERRATA – WINDOWS 2003 SERVER COMPARATIVE REVIEW Win32/Mylife File 77 0.32% Win32/Bobax File 73 0.31% Regrettably, there were three errors in the latest Win32/Mota File 67 0.28% Windows 2003 Advanced Server comparative review (see VB, October 2005, p.12). In Redlof Script 58 0.24% alphabetical order these were: Win32/Yaha File 44 0.18% CAT Quick Heal: Initially this was flagged as having missed Win32/Agobot File 43 0.18% a sample of W32/Nimda.A in the .EML format. Subsequent Win32/Zotob File 31 0.13% tests revealed that the infected contents of the .EML file Win32/Randex File 26 0.11% were removed, though the file itself remained. This must therefore be considered a detection and a VB 100% award is Win32/MyWife File 25 0.10% due to Quick Heal. Win95/Spaces File 23 0.10% MWI VirusChaser: Due to an administrative error the tests Win32/Gael File 22 0.09% for this product were omitted from the initial review. The Win32/Maslan File 21 0.09% product gained a VB 100% award when tested, with full Win32/Nimda File 18 0.08% detection in the wild and no false positives. Win32/Sobig File 18 0.08% Sophos Anti-Virus: The product submitted by Sophos was Others[1] 250 1.05% that which was available to the public on the company’s website at the time of the review submission. Due to Total 23,810 100% miscommunication, however, the versions downloaded for testing, were an incompatible combination of base scanning [1]The Prevalence Table includes a total of 250 reports across engine and virus database updates. Re-testing with the 56 further viruses. Readers are reminded that a complete listing is posted at http://www.virusbtn.com/Prevalence/. correct combination resulted in full In the Wild detection and a VB 100% award for the product.
Recommended publications
  • A the Hacker

    A the Hacker

    A The Hacker Madame Curie once said “En science, nous devons nous int´eresser aux choses, non aux personnes [In science, we should be interested in things, not in people].” Things, however, have since changed, and today we have to be interested not just in the facts of computer security and crime, but in the people who perpetrate these acts. Hence this discussion of hackers. Over the centuries, the term “hacker” has referred to various activities. We are familiar with usages such as “a carpenter hacking wood with an ax” and “a butcher hacking meat with a cleaver,” but it seems that the modern, computer-related form of this term originated in the many pranks and practi- cal jokes perpetrated by students at MIT in the 1960s. As an example of the many meanings assigned to this term, see [Schneier 04] which, among much other information, explains why Galileo was a hacker but Aristotle wasn’t. A hack is a person lacking talent or ability, as in a “hack writer.” Hack as a verb is used in contexts such as “hack the media,” “hack your brain,” and “hack your reputation.” Recently, it has also come to mean either a kludge, or the opposite of a kludge, as in a clever or elegant solution to a difficult problem. A hack also means a simple but often inelegant solution or technique. The following tentative definitions are quoted from the jargon file ([jargon 04], edited by Eric S. Raymond): 1. A person who enjoys exploring the details of programmable systems and how to stretch their capabilities, as opposed to most users, who prefer to learn only the minimum necessary.
  • Flow-Level Traffic Analysis of the Blaster and Sobig Worm Outbreaks in an Internet Backbone

    Flow-Level Traffic Analysis of the Blaster and Sobig Worm Outbreaks in an Internet Backbone

    Flow-Level Traffic Analysis of the Blaster and Sobig Worm Outbreaks in an Internet Backbone Thomas Dübendorfer, Arno Wagner, Theus Hossmann, Bernhard Plattner ETH Zurich, Switzerland [email protected] DIMVA 2005, Wien, Austria Agenda 1) Introduction 2) Flow-Level Backbone Traffic 3) Network Worm Blaster.A 4) E-Mail Worm Sobig.F 5) Conclusions and Outlook © T. Dübendorfer (2005), TIK/CSG, ETH Zurich -2- 1) Introduction Authors Prof. Dr. Bernhard Plattner Professor, ETH Zurich (since 1988) Head of the Communication Systems Group at the Computer Engineering and Networks Laboratory TIK Prorector of education at ETH Zurich (since 2005) Thomas Dübendorfer Dipl. Informatik-Ing., ETH Zurich, Switzerland (2001) ISC2 CISSP (Certified Information System Security Professional) (2003) PhD student at TIK, ETH Zurich (since 2001) Network security research in the context of the DDoSVax project at ETH Further authors: Arno Wagner, Theus Hossmann © T. Dübendorfer (2005), TIK/CSG, ETH Zurich -3- 1) Introduction Worm Analysis Why analyse Internet worms? • basis for research and development of: • worm detection methods • effective countermeasures • understand network impact of worms Wasn‘t this already done by anti-virus software vendors? • Anti-virus software works with host-centric signatures Research method used 1. Execute worm code in an Internet-like testbed and observe infections 2. Measure packet-level traffic and determine network-centric worm signatures on flow-level 3. Extensive analysis of flow-level traffic of the actual worm outbreaks captured in a Swiss backbone © T. Dübendorfer (2005), TIK/CSG, ETH Zurich -4- 1) Introduction Related Work Internet backbone worm analyses: • Many theoretical worm spreading models and simulations exist (e.g.
  • Computer Viruses, in Order to Detect Them

    Computer Viruses, in Order to Detect Them

    Behaviour-based Virus Analysis and Detection PhD Thesis Sulaiman Amro Al amro This thesis is submitted in partial fulfilment of the requirements for the degree of Doctor of Philosophy Software Technology Research Laboratory Faculty of Technology De Montfort University May 2013 DEDICATION To my beloved parents This thesis is dedicated to my Father who has been my supportive, motivated, inspired guide throughout my life, and who has spent every minute of his life teaching and guiding me and my brothers and sisters how to live and be successful. To my Mother for her support and endless love, daily prayers, and for her encouragement and everything she has sacrificed for us. To my Sisters and Brothers for their support, prayers and encouragements throughout my entire life. To my beloved Family, My Wife for her support and patience throughout my PhD, and my little boy Amro who has changed my life and relieves my tiredness and stress every single day. I | P a g e ABSTRACT Every day, the growing number of viruses causes major damage to computer systems, which many antivirus products have been developed to protect. Regrettably, existing antivirus products do not provide a full solution to the problems associated with viruses. One of the main reasons for this is that these products typically use signature-based detection, so that the rapid growth in the number of viruses means that many signatures have to be added to their signature databases each day. These signatures then have to be stored in the computer system, where they consume increasing memory space. Moreover, the large database will also affect the speed of searching for signatures, and, hence, affect the performance of the system.
  • Chapter 3: Viruses, Worms, and Blended Threats

    Chapter 3: Viruses, Worms, and Blended Threats

    Chapter 3 Chapter 3: Viruses, Worms, and Blended Threats.........................................................................46 Evolution of Viruses and Countermeasures...................................................................................46 The Early Days of Viruses.................................................................................................47 Beyond Annoyance: The Proliferation of Destructive Viruses .........................................48 Wiping Out Hard Drives—CIH Virus ...................................................................48 Virus Programming for the Masses 1: Macro Viruses...........................................48 Virus Programming for the Masses 2: Virus Generators.......................................50 Evolving Threats, Evolving Countermeasures ..................................................................51 Detecting Viruses...................................................................................................51 Radical Evolution—Polymorphic and Metamorphic Viruses ...............................53 Detecting Complex Viruses ...................................................................................55 State of Virus Detection.........................................................................................55 Trends in Virus Evolution..................................................................................................56 Worms and Vulnerabilities ............................................................................................................57
  • Combating Spyware in the Enterprise.Pdf

    Combating Spyware in the Enterprise.Pdf

    www.dbebooks.com - Free Books & magazines Visit us at www.syngress.com Syngress is committed to publishing high-quality books for IT Professionals and delivering those books in media and formats that fit the demands of our cus- tomers. We are also committed to extending the utility of the book you purchase via additional materials available from our Web site. SOLUTIONS WEB SITE To register your book, visit www.syngress.com/solutions. Once registered, you can access our [email protected] Web pages. There you will find an assortment of value-added features such as free e-booklets related to the topic of this book, URLs of related Web site, FAQs from the book, corrections, and any updates from the author(s). ULTIMATE CDs Our Ultimate CD product line offers our readers budget-conscious compilations of some of our best-selling backlist titles in Adobe PDF form. These CDs are the perfect way to extend your reference library on key topics pertaining to your area of exper- tise, including Cisco Engineering, Microsoft Windows System Administration, CyberCrime Investigation, Open Source Security, and Firewall Configuration, to name a few. DOWNLOADABLE EBOOKS For readers who can’t wait for hard copy, we offer most of our titles in download- able Adobe PDF form. These eBooks are often available weeks before hard copies, and are priced affordably. SYNGRESS OUTLET Our outlet store at syngress.com features overstocked, out-of-print, or slightly hurt books at significant savings. SITE LICENSING Syngress has a well-established program for site licensing our ebooks onto servers in corporations, educational institutions, and large organizations.
  • Symantec Internet Security Threat Report

    Symantec Internet Security Threat Report

    Symantec Internet EXECUTIVE SUMMARY Symantec Internet Security Threat Report September 2003 EXECUTIVE EDITOR Executive Summary Linda McCarthy Symantec Office of the CTO The Symantec Internet Security Threat Report provides a six-month update about Internet threat MANAGER, DEVELOPMENT activity1. It includes analysis of network-based attacks, a review of known vulnerabilities, and David Ahmad Symantec Security Response highlights of malicious code. This summary of that report can alert executives to impending threats and current trends. SENIOR THREAT ANALYST Cori Lynn Arnold Symantec Managed Security With over 20,000 sensors monitoring network activity in over 180 countries, Symantec has Services established one of the most comprehensive sources of Internet threat data in the world, giving SENIOR MANAGER, ANALYSIS Symantec's analysts a superior source of attack data from which to spot important trends. OPERATIONS These trends educate executives about potential threats and exposures, and using the data Brian Dunphy Symantec Managed Security can help them identify weaknesses in their own security architecture or policies. Services In August 2003, the Win32.Blaster blended threat rapidly spread worldwide, and several other SENIOR MANAGER, DEVELOPMENT Oliver Friedrichs highly severe worms followed. In only eight days the pace and frequency of these threats created Symantec Security Response havoc for systems administrators as well as for PC home users, with an estimated cost of damages 2 RESEARCH FELLOW running up to $2 billion . This report
  • Email Worm Modeling and Defense

    Email Worm Modeling and Defense

    Email Worm Modeling and Defense CliffC.Zou∗,DonTowsley†, Weibo Gong∗ ∗Department of Electrical & Computer Engineering †Department of Computer Science University of Massachusetts, Amherst, MA 01003 {czou, gong}@ecs.umass.edu, [email protected] Abstract— Email worms constitute one of the major Internet little differences in terms of the propagation dynamics of email security problems. In this paper, we present an email worm worms. model that accounts for the behaviors of email users by con- Based on the above email worm model, we study the ef- sidering email checking time and the probability of opening email attachments. Email worms spread over a logical network fectiveness of “selective immunization defense”, i.e., selecting defined by email address relationship, which plays an important some most connected email users’ computers to make them role in determining the spreading dynamics of an email worm. immune to an email worm. The results explain why selective Our observations suggest that the node degrees of an email immunization defense against email worm propagation is quite network are heavy-tailed distributed. We compare email worm effective for a power law topology but not so good for the other propagation on three topologies: power law, small world and random graph topologies; and then study how the topology two topologies. affects immunization defense on email worms. The impact of The rest of the paper is organized as follows. Section II the power law topology on the spread of email worms is mixed: surveys related work. Section III presents the email worm email worms spread more quickly on a power law topology than propagation model.
  • Who Wrote Sobig? Copyright 2003-2004 Authors Page 1 of 48

    Who Wrote Sobig? Copyright 2003-2004 Authors Page 1 of 48

    Who Wrote Sobig? Copyright 2003-2004 Authors Page 1 of 48 Who Wrote Sobig? Version 1.0: 19-August-2003. Version 1.1: 25-August-2003. Version 1.2: 19-November-2003. Version 1.3: 17-July-2004. This sanitized variation for public release. Scheduled for release: 1-November-2004. This document is Copyright 2003-2004 by the authors. The PGP key included within this document identifies the authors. Who Wrote Sobig? Copyright 2003-2004 Authors Page 2 of 48 Table of Contents Table of Contents................................................................................................................................................... 2 1 About This Document..................................................................................................................................... 3 2 Overview........................................................................................................................................................ 5 3 Spam and Virus Release History..................................................................................................................... 6 3.1 Identifying Tools .................................................................................................................................... 6 3.2 Identifying Individuals and Specific Groups ............................................................................................ 6 3.3 Identifying Open Proxies and Usage........................................................................................................ 8 3.4
  • THE CONFICKER MYSTERY Mikko Hypponen Chief Research Officer F-Secure Corporation Network Worms Were Supposed to Be Dead. Turns O

    THE CONFICKER MYSTERY Mikko Hypponen Chief Research Officer F-Secure Corporation Network Worms Were Supposed to Be Dead. Turns O

    THE CONFICKER MYSTERY Mikko Hypponen Chief Research Officer F-Secure Corporation Network worms were supposed to be dead. Turns out they aren't. In 2009 we saw the largest outbreak in years: The Conficker aka Downadup worm, infecting Windows workstations and servers around the world. This worm infected several million computers worldwide - most of them in corporate networks. Overnight, it became as large an infection as the historical outbreaks of worms such as the Loveletter, Melissa, Blaster or Sasser. Conficker is clever. In fact, it uses several new techniques that have never been seen before. One of these techniques is using Windows ACLs to make disinfection hard or impossible. Another is infecting USB drives with a technique that works *even* if you have USB Autorun disabled. Yet another is using Windows domain rights to create a remote jobs to infect machines over corporate networks. Possibly to most clever part is the communication structure Conficker uses. It has an algorithm to create a unique list of 250 random domain names every day. By precalcuting one of these domain names and registering it, the gang behind Conficker could take over any or all of the millions of computers they had infected. Case Conficker The sustained growth of malicious software (malware) during the last few years has been driven by crime. Theft – whether it is of personal information or of computing resources – is obviously more successful when it is silent and therefore the majority of today's computer threats are designed to be stealthy. Network worms are relatively "noisy" in comparison to other threats, and they consume considerable amounts of bandwidth and other networking resources.
  • Contents in This Issue

    Contents in This Issue

    FEBRUARY 2004 The International Publication on Computer Virus Prevention, Recognition and Removal CONTENTS IN THIS ISSUE 2 COMMENT A NEW TREND IN Are your networks secure? VIRUS WRITING? Following in the footsteps 3 NEWS of W32/Bugbear.A, VB2004 call for papers W32/Mimail.I and .J took Divine intervention the concern of identity theft Waiting, reflecting and removing to another level, producing a plausible-looking popup and web page and asking questions that are favoured security checks of many 3 VIRUS PREVALENCE TABLE banks. Stuart Taylor asks: is there a criminal element entering virus writing? 4 FEATURE page 11 Outbreak response times: putting AV to the test TESTING TIMES It’s not just a product’s ability to detect malware 7 TUTORIAL that is of vital importance to the user, but the speed Mission impossible: the Messenger with which the developer produces an update in and others outbreak situations. Andreas Marx puts AV response times to the test. 11 OPINION page 4 Misguided or malevolent? New trends in virus writing COMPARATIVE REVIEW Matt Ham lines up the AV products for 12 COMPARATIVE REVIEW Windows NT. page 12 Windows NT 4.0 20 END NOTES & NEWS This month: Anti-spam news and events, Habeas delivering the goods, ASRG summary. ISSN 0956-9979 COMMENT ‘Until now, most who are not located in the same office, who may be travelling on business or may be working from home. business use of Managers from any location can respond to instant instant messaging messages with quick decisions. Presence-awareness allows each user to see the online status and availability has been of the of other colleagues on the system.
  • Media Diffusion of Computer Security Threats

    Media Diffusion of Computer Security Threats

    Iowa State University Capstones, Theses and Retrospective Theses and Dissertations Dissertations 1-1-2006 It came from the Internet : media diffusion of computer security threats Adam Paul Patridge Iowa State University Follow this and additional works at: https://lib.dr.iastate.edu/rtd Recommended Citation Patridge, Adam Paul, "It came from the Internet : media diffusion of computer security threats" (2006). Retrospective Theses and Dissertations. 19035. https://lib.dr.iastate.edu/rtd/19035 This Thesis is brought to you for free and open access by the Iowa State University Capstones, Theses and Dissertations at Iowa State University Digital Repository. It has been accepted for inclusion in Retrospective Theses and Dissertations by an authorized administrator of Iowa State University Digital Repository. For more information, please contact [email protected]. It came from the Internet: Media diffusion of computer security threats by Adam Paul Patridge A thesis submitted to the graduate faculty in partial fulfillment of the requirements for the degree of MASTER OF SCIENCE Major: Human Computer Interaction Program of Study Committee: Chad Harms, Major Professor Kim Smith Anthony Townsend Iowa State University Ames, Iowa 2006 Copyright ©Adam Paul Patridge, 2006. All rights reserved. 11 Graduate College Iowa State University This is to certify that the master's thesis of Adam Paul Patridge has met the thesis requirements of Iowa State University Signatures have been redacted for privacy 111 TABLE OF CONTENTS CHAPTER 1. INTRODUCTION 1 CHAPTER 2. LITERATURE REVIEW 4 COMPUTER SECURITY 4 Computer Security Threats 4 Lifespan of a Threat 6 DIFFUSION OF INNOVATION 7 History of Diffusion Research 8 Innovation Adoption Process 10 Diffusion of Innovation Components 12 Diffusion Criticisms 18 RESEARCH QUESTIONS 19 CHAPTER 3.
  • Progress Made, Trends Observed a White Paper from the Microsoft Antimalware Team Msrwindows Malicious Software Removalt Tool

    Progress Made, Trends Observed a White Paper from the Microsoft Antimalware Team Msrwindows Malicious Software Removalt Tool

    Progress Made, Trends Observed A White Paper from the Microsoft Antimalware Team MSRWindows Malicious Software RemovalT Tool Matthew Braverman Program Manager Microsoft Antimalware Team Acknowledgements I would like to thank the following individuals for their contribution to this paper: Mike Chan, Brendan Foley, Jason Garms, Robert Hensing, Ziv Mador, Mady Marinescu, Michael Mitchell, Adam Overton, Matt Thomlinson, and Jeff Williams The information contained in this document represents the current view of Microsoft Corporation on the issues discussed as of the date of publication. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information presented after the date of publication. This White Paper is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS DOCUMENT. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photo- copying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation. Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property. Copyright © 2006 Microsoft Corporation. All rights reserved.