Microsoft sloppy on Duqu workaround

The latest Windows malware, Duqu is getting a lot of attention.
Duqu exploits a previously unknown TrueType font parsing bug in the Windows kernel. The bug exists in all the supported versions of Windows: XP, Vista, 7, Server 2003 and Server 2008. It's a big-time bug too, as it lets bad guys do pretty much anything they want to do on the victims' computer.
While it works on a fix, Microsoft has offered a workaround that prevents access to the buggy component, file t2embed.dll. But Microsoft seems to have been particularly sloppy in explaining their workaround.

Michael Horowitz on Duqu

• Microsoft sloppy on Duqu workaround
• Why Duqu is more dangerous than most people think
• A simple test insures the Duqu workaround is working

I am referring to Microsoft Security Advisory (2639658) Vulnerability in TrueType Font Parsing Could Allow Elevation of Privilege.

Why Duqu is more dangerous than most people think

I don't care who wrote the Duqu virus/trojan.
I don't care if it's related to Stuxnet or not.
I don't care who or what the target of Duqu was.
As a Windows user, what I care most about, is that Duqu exploited a previously unknown bug in Windows regarding TrueType font parsing.
Microsoft says the threat from Duqu is limited. To me, that's too narrow a scope. To me, the issue is not Duqu itself but the TrueType font parsing bug in Windows that it exploited.
The people behind Duqu could exploit this as-yet-unpatched bug again with different software. And the people who wrote Duqu may not be the only humans on the planet who found this new bug in Windows.
Although the bug is not yet fixed, there is a workaround from Microsoft that prevents access to the buggy
code. Although I griped about the workaround last time, it's very important that Windows users install it.

A simple test ensures the Duqu workaround is working

As I've written about in my previous two postings, the Duqu malware/trojan exploits a bug in Windows TrueType font rendering to install itself. A very serious bug too, one that gives malicious software free rein to do anything it wants.
Microsoft is working on a fix, and in the meantime has offered a workaround that blocks access to the buggy software (the T2embed.dll file). All Windows users should install the workaround either by issuing commands from a DOS prompt or by downloading and running a Fix It program from Microsoft.
But how do you know that the workaround is doing its job?
I recently griped about some sloppiness in the Microsoft Security advisory (2639658). Since then, the advisory has been updated twice, the most change being yesterday, November 11th. 

Debugging a broken Internet connection

I was sitting in my living room, minding my own business, when all of a sudden I couldn't access a website. Then another and another. What to do?
Many years have taught me that the hardest part of debugging a computer problem is understanding it. With that in mind, the first thing to do is to narrow down the problem, to find the specific link in the chain that broke. The following steps should help you do just that.
1. Try a different web browser
Any computer that has only one web browser is, in my opinion, mis-configured,  if for no other reason than all things break and having a second (or third) browser available is like a spare tire in the trunk.

Why Windows 7 SP1 may go missing

Back in March, I wrote that there was no rush to install Windows 7 Service Pack 1 (SP1). But that was eight months ago, and it's certainly advisable now. And even back then, I felt that installing it on a new computer was the right approach.
So, imagine my surprise when a new Windows 7 computer refused to acknowledge that Service Pack 1 existed. There were over 70 available Windows patches (the computer was a bit dated), but none were SP1.
Back when Service Pack 1 was released, I recall reading that there were some patches that were highly advisable to install before installing SP1*. Rather than re-research this, I installed about 20 patches and hoped SP1 would show up. Then another 20, then another. Eventually, I installed everything Windows Update offered, except for Internet Explorer 9. Still no Service Pack.