bit-tech.net

Microsoft kills Sidebar, Gadgets over security concerns

Microsoft kills Sidebar, Gadgets over security concerns

The Windows Sidebar might be pretty, but it's also dangerous - and Microsoft is willing to kill it to prevent the infection spreading.

Microsoft has officially killed the Windows Gadgets feature of Windows 7 and Windows Vista, following the discovery of a major security flaw in the Windows Sidebar.

Introduced in Windows Vista, the Sidebar and its associated Gadgets functionality was supposed to make users' lives easier. The sidebar could contain active content, providing weather information, a clock, network status, system status, unread email counts, or almost any other piece of information the user desired. Although it made the move intact to Windows 7, its use has never been particularly popular - leaving Microsoft deciding to deactivate the functionality rather than try to fix a recently-discovered vulnerability.

Discovered by security researchers Mickey Shkatov and Toby Kohlenberg, who are due to present a talk entitled We Have You By The Gadgets at the Black Hat Briefings event later this month, the flaw allows attackers to take over the system by exploiting badly-written or maliciously-coded Gadgets installed in the Sidebar.

Microsoft's solution: turn the whole damn thing off. A Fix It Solution, which Microsoft describes as 'not intended to be a replacement for any security update,' disables the Sidebar functionality entirely in order to protect users from attack. For those who still want the Sidebar, there is little in the way of attack mitigation at present - aside from running Microsoft's Sidebar-killer and installing a third-party application designed to perform the same task.

Security-conscious users running any Windows 7 Service Pack 1, Windows 7, Windows Vista Service Pack 2 or Windows Vista Service Pack 1 build are advised to download and apply the patch, which can be found on Microsoft's support site.

36 Comments

Discuss in the forums Reply
Elton 13th July 2012, 12:59 Quote
Given that I've never actually used it (I'm a minimalist in terms of aesthetics) I don't see it being a problem. But the CPU monitor was a nice addition.
murraynt 13th July 2012, 13:00 Quote
No loss. Rainmeter and other programs are better.
Petrol head 13th July 2012, 13:00 Quote
Great, hadn't long downloaded a gadget that recorded my CPU and GPU usage while gaming. Oh well

First message though!
Guinevere 13th July 2012, 13:02 Quote
LOL, must be one hell of an engineering job to fix this if the best quick solution they can come up with is to disable the entire feature.
Speed 13th July 2012, 13:04 Quote
Surely this should be an optional or even forced update through Windows Update? How many people are actually going to read about this and then visit the Microsoft site to fix it? Not that many. :|

I really hope they get this fixed through Windows Update and quick, this sort of thing only brings publicity to a security hole which unless its been properly patched for the bulk of the userbase isn't a smart move.
3lusive 13th July 2012, 13:05 Quote
Did anyone actually use it?
faugusztin 13th July 2012, 13:09 Quote
Quote:
Originally Posted by Guinevere
LOL, must be one hell of an engineering job to fix this if the best quick solution they can come up with is to disable the entire feature.

It is more like "we don't have any spare programmer to fix that". MS already stopped some time ago their own page with gadgets, and when this vulnerability came up, they decided to kill it, especially considering they are soon releasing Windows 8 with live tiles, which is a turbo version of these gadgets.
Aracos 13th July 2012, 13:15 Quote
I've never used this.....
John_T 13th July 2012, 14:49 Quote
I like and use this, I like having the analogue clock on the top right of my screen. I also use the weather, news-feeds, share-price tracker and currency tracker, and the little screen of rotating images is a nice touch. Maybe it's not popular with users here, but I'm suspicious of Microsoft saying it's unpopular as literally everyone I know uses it in some form or other.

Frankly I'm irritated that they couldn't be arsed to fix it. Seems just plain lazy to be honest.

Also, like Speed says, if this is such an important issue then it should be in their update program. How many home users are also avid PC enthusiasts who regularly read tech press? One percent? Two percent? Not many more I suspect.

Very bad form Microsoft!
Taniniver 13th July 2012, 15:08 Quote
I use a couple of gadgets - a CPU and memory usage meter and temperature monitor, a similar one for the GPU, and a little control thing for Daemon Tools.

The issue seems to be around the fact that they run with the same privileges as the user account. Well, so do all my other programs don't they? I wouldn't go grab a gadget from some random untrusted page on the net in the same way I wouldn't just run some random executable.

I'd be ignoring the hotfix and keeping my gadgets thanks, unless they force it out (in which case I'll be annoyed) or they introduce something to replicate the functionality I already use.
Sylvester20007 13th July 2012, 15:12 Quote
Well, I am a bit upset by it and if im honest, I would not liket to see it as a forced update as I like it and use it a lot.

My desktop system, my workl laptop and a Windows Server 2008 R2 (use the Vista sidebar installer for the server) I like to use CPU, Network, disk and battery monitoring gadgets, on a server this is very useful when working with iSCSI as you can see in realtime the bandwith and data through put going over the iSCSI network NICs. I like to see how much RAM I have and CPU I am using. I think this idea of kill it is a very short sighted move from M$. I believe that because the are chaning there game face with Win8, this is a move to push Devs to start learing how to make these live tiles instead.

I would like to see it fixed rather than dispanded but also agree for those who will loose sleep over it there should be an optional update to remove it.

If tey make it a move to remove it as a forced update I just hope they offer an option to reload it for those who want it. I am glad I kept my vista sidebar installer exe :P
fdbh96 13th July 2012, 16:03 Quote
Quote:
Originally Posted by Sylvester20007
Well, I am a bit upset by it and if im honest, I would not liket to see it as a forced update as I like it and use it a lot.

My desktop system, my workl laptop and a Windows Server 2008 R2 (use the Vista sidebar installer for the server) I like to use CPU, Network, disk and battery monitoring gadgets, on a server this is very useful when working with iSCSI as you can see in realtime the bandwith and data through put going over the iSCSI network NICs. I like to see how much RAM I have and CPU I am using. I think this idea of kill it is a very short sighted move from M$. I believe that because the are chaning there game face with Win8, this is a move to push Devs to start learing how to make these live tiles instead.

I would like to see it fixed rather than dispanded but also agree for those who will loose sleep over it there should be an optional update to remove it.

If tey make it a move to remove it as a forced update I just hope they offer an option to reload it for those who want it. I am glad I kept my vista sidebar installer exe :P

You may as well use rainmeter as previously mentioned in this thread as it does all of what you want and looks a lot better than windows gadgets.
thehippoz 13th July 2012, 16:26 Quote
I wrote a lot of the gadgets I use.. use the sidebar from vista in 7- it's much better in a lot of ways.. launch apps- get realtime weather and views of the sun and moon are updated in realtime

realtime monitoring of my dvd and virtual mounts.. clipboard keeper- holds a history of things you copy.. that's used a lot

the thing is it uses flash/javascript and explorer.. you write mainly in js- can see security concerns over that- but why not keep it in as an option..
Quote:
Originally Posted by fdbh96
You may as well use rainmeter as previously mentioned in this thread as it does all of what you want and looks a lot better than windows gadgets.

eh I'll keep my desktop luffagus free
Er-El 13th July 2012, 18:07 Quote
There are better widget programs out there. Oh well...
GravitySmacked 13th July 2012, 18:33 Quote
I use it. I have a cpu & gpu monitor, top 5 processor tasks, a weather app, volume widget and a notes widget - all useful additions to my second monitor.
2bdetermine 13th July 2012, 18:55 Quote
It's just an excused or their way of saying. If you want your gadgets back, get W8.
longweight 13th July 2012, 19:22 Quote
People used that crap?
evanjdooner 13th July 2012, 22:18 Quote
I like that, on the KB article, you have to click "Enable" to disable the Sidebar, and "Disable" to enable it again.
Elton 14th July 2012, 00:02 Quote
Quote:
Originally Posted by 2bdetermine
It's just an excused or their way of saying. If you want your gadgets back, get W8.

I doubt it, there probably was a security risk on this one as it wouldn't be difficult to make a plugin for the sidebar and have it inject a virus given that it had pretty much all the permissions. Couple it with auto-update and you could easily be poofed.

That said, I'd use it for my 2nd monitor, but I turn it off when I'm gaming. Purely because of electricty.
Horizon 14th July 2012, 00:15 Quote
I DL'd the patches and nothing happened, evertyhing works the same as before gadgets still enabled, even tho I'll I have active the printer status widget and bing desktop which snuck onto my computer via windows update.
Speed 14th July 2012, 00:41 Quote
I assume you just used the one and the correct one?
Teelzebub 14th July 2012, 01:58 Quote
Never have or will use it, I think it's a waste of space tbh
Star*Dagger 14th July 2012, 03:03 Quote
Now if they could just remove the rest of the OS that makes it slow, stupid and weak!
JacSmith 14th July 2012, 10:00 Quote
Quote:
That said, I'd use it for my 2nd monitor, but I turn it off when I'm gaming. Purely because of electricty.

Saving electricity. :)
Tattysnuc 14th July 2012, 11:25 Quote
Oh well. I'm sure you'll be able to download the security patched app version of this from the MS shop for Windows 8...
Guinevere 14th July 2012, 12:18 Quote
Quote:
Originally Posted by faugusztin
It is more like "we don't have any spare programmer to fix that".

You're saying with a workforce of 93k people with quite a significant proportion of those being engineers they couldn't find a 'spare' developer if they wanted to?

Fat chance.

They knew it would be a big job of auditing, reengineering and running through QA a huge behemoth of an antiquated set of C++ libraries.

More a case of "We'll get a project management team on it pronto, they'll fine half a dozen experienced C++ coders from a dusty back room in redmond. We'll give them two weeks to digest the documentation, and another six to issue a fix"
faugusztin 14th July 2012, 12:23 Quote
Quote:
Originally Posted by Guinevere
You're saying with a workforce of 93k people with quite a significant proportion of those being engineers they couldn't find a 'spare' developer if they wanted to?

You misunderstood me. What i said was along the line "we don't want to waste time of any of our developers with that old junk, especially with Windows 8 close to release, and no one is going to pay MS for fixing that stuff. Let's throw it out."
dogknees 14th July 2012, 15:22 Quote
Not happy at all!!

I have a live local rain radar, phase of the moon, satellite cloud cover as well as the cpu meter, network meter and a calendar. Rainmeter only does a fraction of these tasks.

One of the best things about them is that you can set them almost completely transparent so they don't get in the way, and just have to roll the mouse over them to check something.

No set of tiles that cover the applications you have open will replace this functionality.

And don't get me started on the limitations on watching the output of a TV tuner in full-screen only! The whole, point of big monitors is that there's space to have all these things visible on the screen at once, and to have enough space to type this on bit-tech at the same times.
rollo 14th July 2012, 15:26 Quote
Can't say I've used it first thing I disable on new builds.
longweight 14th July 2012, 15:49 Quote
Quote:
Originally Posted by dogknees
Not happy at all!!

I have a live local rain radar, phase of the moon, satellite cloud cover as well as the cpu meter, network meter and a calendar. Rainmeter only does a fraction of these tasks.

One of the best things about them is that you can set them almost completely transparent so they don't get in the way, and just have to roll the mouse over them to check something.

No set of tiles that cover the applications you have open will replace this functionality.

And don't get me started on the limitations on watching the output of a TV tuner in full-screen only! The whole, point of big monitors is that there's space to have all these things visible on the screen at once, and to have enough space to type this on bit-tech at the same times.

Isn't that what smaller windows are for?
thehippoz 14th July 2012, 16:04 Quote
if you write gadgets, you can make them pretty efficient.. they're nice- especially the vista version of the sidebar.. set opacity and run your browser the right size.. can monitor many things at once

combine with everest (or aida nowdays xD) you get a full monitoring of your rig from the taskbar to the sidebar and the osd handled with afterburner.. really only useful to programmers though- because a lot of the gadgets out there are coded pretty crappy

I've taken quite a few and slimmed them down or strait fixed them- or wrote from scratch.. just because the luffagus don't use them doesn't mean anything (they actually ruin everything including gaming).. it's a useful feature

I use my custom gadgets all the time! :p
CrazyJam 14th July 2012, 20:41 Quote
I only use two of the default gadgets that Windows 7 comes with (CPU/RAM & Weather) so would I need to uninstall the sidebar as well or can I keep using it?
dogknees 15th July 2012, 03:42 Quote
Quote:
Originally Posted by longweight
Quote:
Originally Posted by dogknees
Not happy at all!!

I have a live local rain radar, phase of the moon, satellite cloud cover as well as the cpu meter, network meter and a calendar. Rainmeter only does a fraction of these tasks.

One of the best things about them is that you can set them almost completely transparent so they don't get in the way, and just have to roll the mouse over them to check something.

No set of tiles that cover the applications you have open will replace this functionality.

And don't get me started on the limitations on watching the output of a TV tuner in full-screen only! The whole, point of big monitors is that there's space to have all these things visible on the screen at once, and to have enough space to type this on bit-tech at the same times.

Isn't that what smaller windows are for?

Apparently Win8 will only support DTV tuners in a full screen view and only under Media Centre. So, no other windows visible at the same time.
thewelshbrummie 15th July 2012, 12:12 Quote
Quote:
Originally Posted by murraynt
No loss. Rainmeter and other programs are better.
Quote:
Originally Posted by longweight
People used that crap?

Each to their own I guess. Never helped that Microsoft were late to the desktop widget party, with Google and Yahoo having their own versions well before Vista. Lack or awareness didn't help either - once I showed my old man how to use them they've been on his work PC ever since (especially foreign currency exchange and weather). Having currency exchange, CPU/RAM meter and a twitter client auto load on boot without doing anything is a massive advantage - live tiles don't come close to offering that functionality (this coming from a hard core Win Phone 7 user, where the limited screen resolution makes tiles a more sensible route imho).

Rainmeter didn't work for me, especially as my Win7 install has had massive niggly problems that seemed to coincide with installing it (updates fail to run, my Codemasters games fail to run - F1 2010/11, Dirt 2/3 refused to load). I liked that MS gadgets had to fit a certain width which worked perfectly with the Vista Sidebar. 7 isn't quite so good if you have more than the screen height full tahnks to the sidebar removal but they still work in the same way. Transparency options also helped limit their impact where needed - the twitter client I use is usually set at 20% transparency so is nearly invisible unless I hover the mouse over it - perfect for my needs.
Quote:
Originally Posted by from the article
there is little in the way of attack mitigation at present - aside from running Microsoft's Sidebar-killer and installing a third-party application designed to perform the same task.

Rainmeter excepted, there's no longer an obvious alternative. Yahoo bought out the biggest desktop widget platform, Konfabulator, a few years back - it was shut down in April. Google depreciated Google Desktop last year, which included desktop widgets. Now Microsoft have gone the same route. And obviously Apple Dashboard won't work on Windows. As stated above - Rainmeter didn't work for me - I may give it another go on a sacrificial Win install but desktop widgets are very useful and make far more sense on a PC desktop than Live Tiles in Win8 do. Will be pretty disappointed with Microsoft if a bug fix isn't coming forward, though since the gallery was depreciated and the rumours flow about gadgets being removed from Win8 RTM I doubt we'll see it. They will be missed.
[USRF]Obiwan 16th July 2012, 09:36 Quote
Rainmeter FTW!
CrazyJam 18th July 2012, 10:33 Quote
Just a bump to see if I can still use the default weather and cpu/ram monitor or do those pose a risk as well?
Log in

You are not logged in, please login with your forum account below. If you don't already have an account please register to start contributing.



Discuss in the forums