Update: Microsoft readies Windows XP Service Pack 2 beta

Microsoft Corp. is gearing up for the first beta test of a set of updates for Windows XP designed to bolster the operating system's security and add features such as support for version 1.1 of Bluetooth and a new wireless LAN client.

The beta of Windows XP Service Pack 2, or SP2, will be made available via Microsoft's Developer Network to several hundred thousand testers before the end of the year, Matt Pilla, senior product manager for Windows at Microsoft said Thursday. Targeted testers are software developers and IT professionals, he said.

"SP2 is a fundamentally different service pack," Pilla said. "Much of what we are delivering is the typical set of updates and roll ups, but we are doing a lot more to make the operating system more resilient to attacks."

Microsoft has previously talked about many of the security enhancements it intends to deliver in SP2. The plans were first announce by Chief Executive Office Steve Ballmer in October. A final version of SP2 is due out in the first half of 2004.

Among the security improvements are an updated version of the Internet Connection Firewall, which has been renamed Windows Firewall and will be turned on by default, as well as changes to some Windows parts that have proven attack prone.

The RPC (remote procedure calls) service will run with reduced privileges and the distributed component object model (DCOM) gets more access control restrictions, Microsoft said. Vulnerabilities in RPC and DCOM were exploited by the Blaster worm which wreaked havoc earlier this year.

SP2 will also turn off the Windows Messenger Service, a network administration tool that has been exploited by spammers to barrage Windows users with pop-up messages. The service, not the same as the Windows Messenger instant messaging client, also contains a serious security vulnerability for which Microsoft provided a patch in October.

In addition to reducing the attack surface of Windows XP, SP2 also provides updates to Internet Explorer (IE) and Outlook Express that are meant to make browsing the Web and receiving e-mail safer. IE will also get a pop-up and pop-under blocker, bound to make surfing the Web more enjoyable, Microsoft said.

IE will offer explicit download links to protect users from accidentally downloading and installing potentially malicious programs, while Outlook Express will no longer download external content by default and better handle attachments, according to Microsoft.

Furthermore, as part of Microsoft's efforts to make it simpler to download and apply software fixes, SP2 will install Microsoft's Software Update Services (SUS) 2.0 client. This should help solve problems with the Windows Update service, which has proven to be unreliable. SUS also allows users to interrupt downloading software updates and resume later, Microsoft said.

Finally, new features include support for the Bluetooth 1.1 standard and a new wireless LAN client to simplify connecting to hotspots.

The beta version of SP2 includes a subset of the technologies planned for the final version of the update that is due in the first half of next year. It is "very likely" the final version will have more features, Pilla said. However, there might also be things that don't ship in the final version that are part of the beta, he said.