Friday, March 30, 2007

The Original Human Space Invaders

What’s your going rate? IT work orders by state

What’s your going rate? IT work orders by state by ZDNet's Larry Dignan -- OnForce, an information technology labor marketplace, has rolled out a new feature called MarketView that answers a simple question: What are you worth? MarketView puts IT labor into a stock market presentation and classifies workers by region and category. For instance, the 90-day average work order for an IT support worker in Alabama [...]

Thursday, March 29, 2007

Bush and Clinton cameo at wireless show

Speaking to a packed house of roughly 5,000 people at the CTIA Wireless trade show, the former presidents took to the stage separately and then sat down together to answer a few questions. The two have worked closely over the past couple of years raising money for victims of Hurricane Katrina and the 2004 Asian tsunami.

During his speech, Clinton pointed out the benefits of the technology and communications boom of the 1990s, highlighting his own role in signing into law the 1996 Telecommunications Act, which paved the way for cable companies and others to enter the telecommunications market.

But while millions benefited from the boom, Clinton said, many people in the world have remain out of reach of such prosperity. He noted that half the world's population still lives on just $2 a day. Communications technology, in particular mobile phones, could help improve the lives of the world's poorest by enabling people to reach new markets and make connections in ways that didn't formerly exist, he said.

On the flip side, he also talked about how the same technology used to foster economic development in poor regions of the world, can be used by terrorists to organize and plot attacks.

He urged people in wireless communications businesses to widen their circle of influence to not only grow their industry for their own personal gain, but to help poor people throughout the world get access to communications technology, and to also use this technology to help educate people and break down destructive identity barriers that split the world apart and foster terrorism.

"You don't want historians to look back and say they had this wonderful technology which enabled people to communicate, but all it did was reinforce divisions of the 20th century," he said.

The communications industry would rather the story be that its technology helped benefit everyone--rather than serving to divide people into different groups or identities, being used instead to unite people throughout the world, he said.

Bush also highlighted how technology could be used to influence the world. Specifically, he talked about how technology can help spread democracy.

He relayed a story he had heard from former Canada Prime Minister Brian Mulroney, who said that in the early 1980s, then-West Germany Chancellor Helmut Kohl had predicted the fall of East Germany. Bush explained that Kohl was convinced that Germany would soon be reunified because people living in the east were seeing through television how prosperous and free the west was.

"Thanks to the technology, the genie was already coming out of the bottle," Bush said.

Bush added that more modern technology, such as the Internet, is also influencing China in similar ways. Bush, who has visited China 14 times since leaving the presidency in 1992, said he has seen drastic changes there over the years as technology creeps deeper into society connecting the Chinese people to the rest of the world.

There are more human rights and examples of capitalism "than anyone would have dreamed possible," he said. "And your industry will have a large part to play in more freedoms that lie ahead in China."

Microsoft confirms Windows zero-day, drive-by exploits

Microsoft confirms Windows zero-day, drive-by exploits by ZDNet's Ryan Naraine -- [UPDATE: March 29, 2007 @ 1:15 PM Eastern] Microsoft has confirmed that this is indeed a zero-day flaw that will require a security update. Although Internet Explorer is the primary attack vector, this is a vulnerability in the way Windows handles animated cursor (.ani) files. From Redmond's security advisory: The threat is caused by insufficient [...]

Wednesday, March 28, 2007

Rackable's portable data center goes on sale

Rackable Systems has begun selling a data center packed into a modular storage container, getting to market ahead of a rival system from Sun Microsystems.

Called Concentro, the system squeezes as many as 1,200 servers along with power and cooling equipment into a 40-foot shipping container. It can be mounted on a truck for portability. The company argues that it's the bee's knees when it comes to energy efficiency, dense packing of computing power and rapid setup of ordinarily complicated computing gear.

The idea is similar to Sun's Blackbox, but Rackable's shorter servers can face toward the central aisle; Sun's full-length models fit sideways on racks that slide into the aisle. Concentro is available for order now, and the Milpitas, Calif.-based company said it has "several new orders pending."

Sun's rival product isn't far from reality, though. "We're finalizing the first deals. We'll have Blackbox on customer properties in the next six to eight weeks," said Dave Douglas, Sun's vice president of eco-responsibility, at a media event on Friday.

Rackable's Concentro uses Intel's quad-core Xeon 5300 "Clovertown" processors, two of which can fit into each of the 1,200 servers. Concentro also can be used to house storage--as much as 30 terabytes of capacity.

Sun and Rackable both are racing to promote products that simplify data center design. But neither was actually first--at least when it comes to portable data center prototypes. American Power Conversion started rolling around its demonstration system in 2005, a data center on a truck.

Concentro uses direct-current (DC) power, an element in Rackable's energy efficiency.

Support for XBAP in Mozilla Firefox is coming

Support for XBAP in Mozilla Firefox is coming by ZDNet's Ryan Stewart -- At an event today on Microsoft's campus, Ian Ellison-Tayler, the WPF Product Unit Manager mentioned that XBAP support is coming to Mozilla Firefox as part of the .NET Framework 3.5 update that will ship with Visual Studio "Orcas". This means that RIA developers can deploy browser based WPF applications to both IE and Firefox. WPF just got a big boost as a browser technology.

Metasploit 3.0 ships with 177 exploits, 104 payloads

Metasploit 3.0 ships with 177 exploits, 104 payloads by ZDNet's Ryan Naraine -- HD Moore's open-source Metasploit Framework has been rewritten from scratch and released with 177 exploits, 104 payloads and new modules to exploit Wi-Fi driver vulnerabilities in the Windows kernel. Version 3.0 of the point-and-click hacking tool, which is used for pen testing and to verify patch installations, is now available as a free download. Photo [...]

Want a job? Clean up your Web act

Employers are increasingly checking out online personal information about candidates when making recruitment decisions.

Net reputations built up through online activities--such as blogging, posting videos to YouTube, or using social networks such as Facebook and have a significant effect when applying for a job, according to a report from business social network Viadeo.

According to the research, released Wednesday, one in five employers finds information about candidates on the Internet, and 59 percent of those said it influences recruitment decisions.

A fourth of human resources decision makers said they had rejected candidates based on personal information found online. Most people, however, remain unaware of the effect their Net reputation can have on their job prospects.

Examples of online information that has been shown to create negative information include MySpace pages that reveal excessive drinking or disrespect for work.

One survey respondent said his company rejected a candidate based on activities found online that "did not fit ethically" into the organization.

But information found online can also work positively when applying for a job, with 13 percent of HR decision makers having decided to recruit people in light of what they found.

Positive information could include achievements not already known, Internet skills demonstrated through a Web site and extra skills not revealed by a corporate application form.

Peter Cunningham, a U.K.-based Viadeo manager, said the results should be a wake-up call to anyone who has ever posted personal information online.

"The rise of search engines such as Google means that potential employers are never more than a few clicks away from information about you," he added in a statement.

The research surveyed more than 2,000 consumers and more than 600 employers via an online interview.

GPL getting tougher on patent deals

The third draft of General Public License version 3 includes provisions to toughen the license's stance on patent deals between software providers.

The Free Software Foundation posted draft 3 of GPL 3 on its Web site, as expected, Wednesday.

Modifications were made since the second draft, which came out in July 2006, to address a patent deal between Microsoft and Linux seller Novell, under which Microsoft agreed not to sue Suse Linux customers for patent infringement.

"The recent patent agreement between Microsoft and Novell aims to undermine (software users') freedoms. In (the third) draft, we have worked hard to prevent such deals from making a mockery of free software," Richard Stallman, president of the FSF and principal author of the GPL, said in a statement Wednesday.

Novell and Microsoft on Wednesday said that the added patent provisions of the third GPL 3 draft will not derail their partnership.

"It is unfortunate...that the FSF is attempting to use the GPL 3 to prevent future collaboration among industry leaders to benefit customers," Horacio Gutierrez, Microsoft's vice president of intellectual property and licensing, said in a statement.

Novell said it will continue to participate in open-source software projects and remains committed to its partnership with Microsoft.

"If the final version of the GPL 3 does potentially impact the agreement we have with Microsoft, we'll address that with Microsoft," Novell spokesman Bruce Lowry said.

In supporting documents to the new draft, the FSF said it has not yet decided whether the patent addition will apply to all such commercial arrangements or only to those signed in the future. The latter option would let the existing Novell-Microsoft agreement stand.

The basic idea of the GPL is unchanged: Anyone may use, modify and redistribute GPL software, but a party that redistributes GPL software must publish any changes that are made.

One change in GPL 3 governs patents. An earlier draft required an organization that distributed GPL software to grant rights to its patents related to the software. But the new draft is narrower, requiring only that it grant rights to patents relating to any contributions it makes to that software.

Another change is a narrower scope for a section that had concerned digital rights management (DRM), technology that can be used to restrict users' access to software or content. The new version avoids reference to the DRM concept and requires that installation instructions be provided to permit users to install modified software. However, a company doesn't have to supply support, warranty and updates if the user modifies the software, and the instructions don't need to be supplied

Also new in the third draft are simplified terms to make GPL 3 more compatible with GPL 2, which is used for thousands of open-source software products, including the Linux kernel, Java and MySQL.

Previous drafts of GPL 3 have drawn mixed reviews, including major reservations from Linux founder Linus Torvalds and a majority of the Linux kernel developers.

Earlier this year, Torvalds panned GPL 3, saying the new version seeks to promote the Free Software Foundation's philosophy rather than produce a pragmatic legal foundation.

"The GPL was designed to ensure that all users of a program receive the four essential freedoms which define free software," Stallman said of the philosophy behind the open-source license. "These freedoms allow you to run the program as you see fit, study and adapt it for your own purposes, redistribute copies to help your neighbor and release your improvements to the public."

Version 3 has been more than a year in the making, with its first public presentation in January 2006.

The next step to completing GPL 3 is a 60-day comment period, followed by a "last call" draft. The final GPL 3 will arrive 30 days after that, according to the FSF.

The timing pushes back by about three months the original deadline of March for a new version of the license.

With desktop camera, your face can be your password

A Canadian company on Wednesday announced a new camera that functions as both a Webcam and a security system that scans a face in three dimensions.

Toronto-based Bioscrypt claims an industry first with its 3D DeskCam. The 3-inch tall, half-inch wide camera uses infrared along with a lens to scan a face in three dimensions and authenticate users accessing computers, the company said.

The camera uses about 40,000 identification points, looking primarily at a person's forehead, eye sockets and nose bridge, said Ryan Zlockie, director of product management at Bioscrypt. The facial-recognition system has passed tests with identical twins and professional face molds, Zlockie said. A person registered with facial hair who subsequently shaves doesn't have to be reregistered, but somebody who undergoes plastic surgery does, he said.

The 3D DeskCam can remove the need for passwords, tokens or smart cards to log on to a computer or online services, according to Bioscrypt.

For consumers, the 3D feature can also help create avatars that look like an individual for use in gaming and instant-message applications, Zlockie said.

Bioscrypt pitches facial scanning as a user-friendly alternative to other biometric security systems that scan a finger or an iris.

"3D face recognition is much quicker and you don't have to be as close as with iris scanning," Zlockie said. Also, people don't have to touch anything or worry about greasy fingers, he said.

The camera, priced at $350, is slated to be available in the second half of this year. Initially, Bioscrypt is targeting business users, but the device could be available to consumers by the end of the year or early next year, Zlockie said. When produced in higher volume, the price should come down to around $200, he said.

Tuesday, March 27, 2007

Wireless LAN security myths that won’t die

Wireless LAN security myths that won’t die by ZDNet's George Ou -- It's been two years since I wrote "The six dumbest ways to secure a wireless LAN," and it's probably been one of my more successful blog entries ever, with two flashes on Digg. Since that time, I've written a free electronic book on enterprise wireless LAN security for anyone to use and download from TechRepublic. [...]

Video: Microsoft releases, demos beta of Office Communications suite

Video: Microsoft releases, demos beta of Office Communications suite by ZDNet's David Berlind -- Today, Microsoft is releasing the beta version of its latest unified communications suite. The pair of solutions is known as Office Communicator 2007 (the client side) and Office Communicator Server 2007 (the server side). In favor of Office Communicator Server (OCS), Microsoft is dropping the old product name Live Communications Server (2005) or LCS. To [...]

Ubuntu Beryl Matrix 3D Desktop

Thought this was worth looking at.

Monday, March 26, 2007

AMD’s no angel, but Intel’s public usage of benchmark data is feloniously misleading

AMD’s no angel, but Intel’s public usage of benchmark data is feloniously misleading by ZDNet's David Berlind -- In recent weeks here at ZDNet, I have been matter, and my colleague George Ou has been anti-matter. Or maybe the other way around. Publicly on ZDNet's blogs, George has taken both me and the New York Times' David Pogue to task over our position on digital cameras and their megapixel myth. Behind the scenes, [...]

Windows weakness can lead to network traffic hijacks

WASHINGTON--A problem in the way Windows PCs obtain network settings could let attackers hijack traffic, security researchers said Saturday.

The problem occurs because of a design bug in the system used by Windows PCs to obtain proxy settings, researchers with security firm IOActive said at the ShmooCon hacker conference here. As a result, an attacker with access to a network at a corporation, for example, could insert a malicious proxy and see all the traffic, the researchers said.

"The upshot of it is that I can become your proxy server without you knowing about it," Chris Paget, director of research and development at IOActive, said in an interview after his presentation on the problem. "I can put up the equivalent of a detour sign on your network and redirect all the traffic."

An attacker can set up that "detour sign" because Internet Explorer on Windows PCs by default searches for a proxy server using the Web Proxy Autodiscovery Protocol, or WPAD, Paget said. It turns out that an attacker can easily register a proxy server on a network using the Windows Internet Naming Service, or WINS, and other network services including the Domain Name System, or DNS, he said.

"When IE starts up, it will ask the network where its proxy server is," Paget said. "It is really easy to put up your hand and say: 'Here I am.'"

Microsoft acknowledged the problem in a support article published Saturday on its TechNet Web site. "If an entity can surreptitiously register a WPAD entry in DNS or in WINS�?clients may be able to route their Internet traffic through a malicious proxy server," Microsoft said in its support article.

If an attack is successful, all traffic on a network will flow through the attacker's proxy. This means the attacker can access all the data, redirect and manipulate it and carry out all kinds of other nefarious acts, Paget said.

Still, the proxy problem isn't a critical security issue, Paget and fellow IOActive security expert Dan Kaminsky said. An attack is possible only with access to the target network, not from the Internet, they noted. "The biggest risk inside a corporation would come from a malicious insider," Paget said. "This is not worthy of mass panic or critical advisories."

That doesn't remove the need to fix the problem. Insider threats are real. Also, the proxy problem may be appealing to attackers who find it increasingly hard to exploit other vulnerabilities, Kaminsky said.

"Buffer overflows and other bugs have gotten a lot harder to do, so design issues like this have gotten a lot more interesting for attackers," he said.

Problems with WPAD aren't new. Seven years ago Microsoft patched IE 5 because the browser would search for a proxy server on the Internet if it failed to find one on its local network. That let a malicious hacker give settings to the browser that would facilitate a broader attack.

Such a problem was exploited by somebody who registered the domain name "" and served a "wpad.dat" file with proxy information to Windows PCs looking for it. As a result the people using those PCs ended up on an online auction Web site regardless of the address they typed into their browser.

In its support article, Microsoft lists steps for network administrators to address the WPAD problem. The steps reserve static WPAD DNS host names and to reserve WPAD WINS name records. As a result, an attacker's malicious WPAD name will no longer work, which will foil the malicious proxy trick, Paget said.

Vista’s Windows Mail vulnerable to file-execution attack

Vista’s Windows Mail vulnerable to file-execution attack by ZDNet's Ryan Naraine -- A design error in Microsoft's Windows Mail, the e-mail application bundled into Windows Vista, could expose users to remote file-execution attacks, according to a warning from security researchers. A hacker known as "Kingcope" published proof-of-concept code to show that remote code execution is possible if a user is tricked into clicking a malicious link. The error is [...]

Mozilla: Hackers control bug disclosure

WASHINGTON--Software makers are at the mercy of bug hunters when it comes to flaw disclosure, Mozilla's security chief said Saturday.

The software industry for years has pushed guidelines for vulnerability disclosure. Those "responsible disclosure" efforts have had some effect, but security researchers maintain control over the process, Mozilla Security Chief Window Snyder said in a panel discussion at the ShmooCon hacker event here.

"The researcher has all the power," Snyder said. "They control when they disclose it, and they control the idea whether or not the vendor responds in time."

Releasing vulnerability details has been hot topic for years. The software industry advocates private disclosure of a bug and time to fix it before a researcher goes public, a practice the industry calls responsible disclosure. After all, early release could help criminals to launch cyberattacks and damage a vendor's reputation.

Security researchers who follow the industry's guidelines are often frustrated by a lack of response from software makers. Another frequent point of criticism is the time it takes for a fix to be released and for the researcher to get credit in a security alert.

"Vendors have a real responsibility to respond to what's reported to them," said Snyder, who previously worked at Microsoft.

But not everyone buys into responsible disclosure. It is a trap set by software makers, said panel member Dave Aitel, of security software firm Immunity. "Responsible disclosure is a marketing term," he said. "Responsible disclosure plays into the hands of Microsoft and other big vendors...they are trying to control the process."

Instead of disclosing a flaw to the vendor, Aitel wants bug hunters to sell vulnerability information to him. Immunity pays bug hunters for details on security vulnerabilities and uses those in his company's products, which include penetration-testing tools that can be used to break into computers and networks.

Chris Wysopal, CTO and founder of security review company Veracode, disagreed that bug hunters are always in charge. "We see a lot of threats," he said. "Being on the receiving end of legal threats isn't an easy thing."

If a company unleashes its legal wrath onto a security researcher, then that's an example of a company that doesn't know what it is doing, said Rohit Dhamankar, manager of security research at TippingPoint, a seller of intrusion prevention products.

"There are sophisticated vendors like Mozilla and Microsoft, and there are vendors who have no clue about good process," Dhamankar said. TippingPoint, which also pays security researchers for bugs, was threatened with a lawsuit recently by a Web portal software maker, he said.

To gain a competitive advantage over rivals, companies such as Immunity and TippingPoint pay bug hunters for flaws. By purchasing bug information, their products can detect problems before any other product can and before an official patch is available.

Ultimately, flaws don't get fixed without public disclosure, Wysopal said. "The responsible thing is to send it to the vendor, but then you get stuck with the vendor not doing anything about it if there isn't the threat that it will be publicly disclosed," he said. "Public disclosure is the only way to actually get things fixed."

Mozilla's Snyder said 30 days is a good timeframe to give a software maker to come up with a fix and called on bug hunters to follow responsible disclosure guidelines.

"I appreciate the work that's going on and I appreciate a little heads up before the whole world finds out (about a security vulnerability)...I would appreciate 30 days, but I will take what I can get."

Trojan horse targets Skype users

Miscreants have again adapted the Warezov Trojan horse to target Skype users, Websense Security Labs warned on Thursday.

The attack is similar to threats that target instant-messaging applications. A targeted Skype user will receive a chat message with the text "Check up this" and a link to a malicious executable called "file_01.exe" on a Web site, Websense said in an alert. If the user runs the file, several other files are downloaded and run, it said.

Once infected, a computer will be at the beck and call of the attacker and the Trojan horse will start sending messages to the victim's Skype contacts to propagate, Websense said. The attack is similar to one reported in February, but it has been adapted with files hosted at different locations and a new version of the malicious code, the security company said.

Skype has acknowledged in the past that its instant-messaging feature could be used for nefarious purposes just like any other IM service. The company has said that it is looking at partnerships with security firms to offer a capability for the Skype client that filters out malicious links.

"Harmful viruses and Trojan horses may damage a user's computer and collect private data, regardless of whether a person is using Skype, e-mail or IM clients," Kurt Sauer, Skype chief security officer, said Friday. Skype warned users against opening the malicious file and said they should take caution in general when opening attachments. The company also recommends using antivirus software to check incoming files, Sauer said.

Warezov, also known as Stration, has been around since at least September. Several variants of the malicious code have appeared. Miscreants have spread it via spam e-mail, as well as Skype.

Tuesday, March 20, 2007

Microsoft probes possible IE 7 phishing hole

Microsoft is investigating a possible vulnerability in Internet Explorer 7 that could help cybercrooks launch phishing scams, the company said Wednesday.

An attacker can use an error message displayed by the latest Microsoft browser to send Web surfers to malicious Web sites that will display with the address of a trusted site, such as a bank, Aviv Raff, a developer in Israel, wrote on his Web site. Raff included an example where the error message directs the Web surfer to a site of his choice.

Microsoft is looking into the issue, a representative said. "Microsoft is not aware of any attacks attempting to use the reported vulnerability," the representative said in an e-mailed statement. "Microsoft will continue to investigate... to help provide additional guidance for customers as necessary."

The vulnerability relates to the message IE displays when Web page loading is aborted, Raff wrote. An attacker can rig the message by creating a malicious link. The message will offer a link to retry loading the page; hitting it brings up the attacker's page, but showing an arbitrary Web address, he wrote.

To launch a phishing attack, an attacker can create a Web link that purports to go to a trusted site, such as a bank. When clicked, the link results in a rigged error page. Following the reload link on that page will display the attacker's Web site with the address of the trusted site in the IE 7 address bar, Raff wrote.

Phishing attacks are a prevalent Internet threat that typically use fraudulent Web sites and spam e-mail to trick people into giving up personal information such as Social Security numbers and credit card details.

IE 7 on Windows Vista and Windows XP are affected, Raff wrote.

Blogging's roots reach to the '70s

Back before the Internet even existed, Les Earnest created what would become the first proto-blogging tool.

Earnest, who is retired from Stanford University's computer science department with the title senior research scientist emeritus, invented the "finger" utility in the early 1970s. It let network users read a specific text file from another user's account, which frequently would be customized to include musings about politics, personal life, and professional activities.

The text file was called a ".plan," and it led to an early kind of blogging. In a 1990 retrospective, Earnest wrote: "The program was an instant hit. Some people asked for the Plan file feature so that they could explain their absence or how they could be reached at odd times, so I added it. I found it interesting that this feature evolved into a forum for social commentary and amusing observations."

As part of an article about who created the first blog--the 10-year anniversary of the term, at least, is this year--CNET spoke with Earnest. Following are excerpts from the conversation.

On the concept of blog-like .plan files: "The concept, of course, goes back to bulletin boards; that's where it all started. That is, in my lab at Stanford for example, people would occasionally post something and then others would write in the margin a response to it, and then sometimes add another piece of paper so that they could say even more. They used to have battles on the bulletin board in this way.

"Shortly after we put up (a computer system), another such interchange was launched using an ordinary computer file that was accessible to everyone so that anyone could both read and write on it, and there was a big debate...The first one was about whether we should send men to space. That would've been around 1967 or 1968."

On how .plan files were used: "It was used in much the same way as blogs are now, that is, the .plan file was intended to be just a way to tell people where you were going to be. If you were going off on vacation or a trip or something, or were just going to sleep for a while, you could post that in your .plan file. But then people noticed that it could be used as a statement of personal views on things and they started doing that, and then still later it was used by quite a few people to post their public key for secure communications, so it got used in several ways. (For) expressing your personal views on things, it was very much like a blog, a personal blog. It of course did not allow others to post things on it."

On whether blogging-like uses were expected: "No, the intent was just to let people say when they were going to be back if they were going away, that sort of thing. These other uses people thought up on their own, it was not the plan."

On creating the finger program: "I put it in at the request of some of the people in my lab. The finger program was developed initially just as a way of keeping track of people in my lab.

"People work all hours, day and night, around the clock, so you wanted to be able to find out what phase a given person was in, so the finger program would first of all tell you real names instead of teletype numbers, and it would also tell you when they last logged out or if they're still logged in, how long their terminal has been idle...

"The .plan file was a different piece of information that was added subsequently. After it came into use (at my lab), other people kept using it, and then the idea came up to make it an Internet utility so you could ask about people at other sites.

"We actually have all of the files that describe finger and also all the plan files that were ever generated in our lab over 20 years. The public part is available now, the private part, we're in the process of making accessible to alumni under password control...That's going to take some time."

On people claiming to have invented blogs: "Everybody who comes into the field thinks that when they begin, it all begins. I believe the old bulletin board wars were really the origin of this idea."

Sun CEO praises Google Maps on Blackberry Pearl as a near “religious experience”

Sun CEO praises Google Maps on Blackberry Pearl as a near “religious experience” by ZDNet's David Berlind -- How often do you see this? The CEO of one company (Sun's Jonathan Schwartz in this case), writing a review (albeit a short one) of how other companies products and services work (together). Wrote Schwartz of how Google Maps runs on his Blackberry Pearl: Given the diversity (and temperament) of the customers we serve, I [...]

Video spam. Who would have guessed?

Video spam. Who would have guessed? by ZDNet's Richard Stiennon -- You can just scroll down this page to see my predictions for 2007. Pay particular attention to number 8. 8. YouTube abuse threatens site. Like network news, email, and IM before it, the new popular service, video sharing, will succumb to spammers who post ads, ad backed videos, and stealth marketing exploits, ruining the experience for [...]

Microsoft researchers follow Web spam money trail

Microsoft researchers follow Web spam money trail by ZDNet's Ryan Naraine -- Using a homegrown tool called Fiddler, researchers at Microsoft have come up with a system to track the money that flows from big-name advertisers to search engine spammers. The methodology, created by Microsoft Research in partnership with the University of California, Davis, has already uncovered a complex scheme where a small group using false doorway pages [...]

How Apple orchestrated web attack on researchers

How Apple orchestrated web attack on researchers by ZDNet's George Ou -- The Mac press had a field day nearly destroying the reputations of two security researchers but where they alone in their actions? See proof of how Apple and its PR department were pulling the strings all along.

Report: Notebooks to take lead over desktops by 2011

As worldwide desktop shipments continue to slow, notebooks are expected to represent more than half of all client PCs by 2011, according to an IDC report released Tuesday.

PC shipments worldwide rose only 7.3 percent in the fourth quarter, compared with a 15 percent growth rate for the same period last year. IDC attributes the declining growth to corporate buyers purchasing fewer desktops, especially in the more mature markets.

Desktop shipments grew an anemic 2 percent to 138.3 million in 2006, while portables--a category that doesn't include handhelds--jumped 26.3 percent to 82.4 million, according to the report.

Meanwhile, in the U.S. retail sales of notebooks surpassed desktops in 2005.

"In the United States, portable PC shipments will maintain double-digit growth through 2010, but this shift to mobility will not be enough to offset reduced demand for desktops," Doug Bell, IDC personal computing program analyst, said in a statement.

IDC, however, notes that the release of Microsoft's Windows Vista will likely lead to a temporary boost in desktop shipments later this year and into early next year, but the declining growth rate is expected to reemerge shortly afterward.

"While more replacements and Vista adoption may provide a brief respite for desktops in 2008, essentially all desktop growth will occur in emerging regions," Loren Loverde, director of IDC's Worldwide Quarterly PC Tracker, said in a statement.

Using steam to cool computers

You can hold Celsia's new cooling component for about three seconds. Then your fingers start to feel as if they're getting burned.

It's part of a new line of components from the San Jose, Calif.-based company that it says will cool off torrid hotspots inside computers and light fixtures running light emitting diodes (LEDs) better than conventional heat pipes or fans.

Feeling is believing. In the corporate demonstration, a person stirs a cup of hot water with a stick of copper. It takes about five seconds or so to feel a gradual warming sensation. The human guinea pig then stirs with one of the company's heat spreaders: the rapid rise in temperature is noticeable before two seconds elapse. Holding the NanoSpreader for five seconds is nearly impossible.

The sudden rush of heat occurs because steam is being created inside the NanoSpreader, said George Meyer, director of development at the company, which was re-launched in 2006. The exterior of the device is a copper sleeve that absorbs heat from a processor or a hard drive.

The interior consists of a series of vacuum-sealed chambers and channels containing small amounts of water. The water turns to steam, which then conducts the heat from the source to another component, such as an aluminum heat sink, that can dissipate the heat into the ambient atmosphere.

"Steam conducts heat better than almost any substance out there," he said.

Testers often don't believe that. "There's got to be some sort of chemical in there," one observer said, though Meyer affirmed that the active ingredients are copper and water.

Heat is one of the primary obstacles for industrial designers and consumer electronics manufacturers these days. Consumers want small, quiet devices. Unfortunately, components like processors and hard drives generate a lot of heat and often require fans or heat pipes, tubes of metal that conduct heat away, to keep them cool.

"The digital video recorder is one of the most strenuous applications for a hard drive there is," said Meyer. Blade server manufacturers and makers of telecommunications equipment are also shopping for new components to remove heat.

The company is also targeting LED lights. Although LEDs can produce a significant amount of light per watt of power, LEDs also generate a significant amount of heat. Thus, LED arrays often need cooling components.

IBM and other companies have created water or oil-filled components for cooling internal computer components for years. But many of these devices contained relatively large amounts of water and are therefore physically large.

Shrinking the size of these components so they won't add bulk in smaller computers has been a bit of a challenge. Cooligy has developed a liquid cooling system, but it requires a mechanical pump. Other companies working on products in this market include Nanocoolers and Cool Chips. None of these companies has experienced broad adoption yet.

For its part, Celsia asserts that it has an advantage in that its components are fairly small, measuring only a few millimeters thick, and are made out of fairly basic materials. It has also teamed up with Taiwan's Yeh-Chiang Technology, one of the largest manufacturers of heat pipes.

Getting this far hasn't been easy. The company emerged from South Korea as iCurie in 2001. In 2005, a new management team was installed and an additional $20 million in funding was raised from various sources.

Celsia's components cost more than ordinary heat pipes or cooling technologies, but fewer cooling components are needed. In the end, the company says using its components versus ordinary ones should be cost-neutral.

The smaller number of components also frees up designers.

"If you are looking at an ultralight portable, you could build it without a fan," he said.

John W. Backus, 82, Fortran Developer, Dies

John W. Backus, who assembled and led the I.B.M. team that created Fortran, the first widely used programming language, which helped open the door to modern computing, died on Saturday at his home in Ashland, Ore. He was 82.

His daughter Karen Backus announced the death, saying the family did not know the cause, other than age.

Fortran, released in 1957, was “the turning point” in computer software, much as the microprocessor was a giant step forward in hardware, according to J. A. N. Lee, a leading computer historian.

Fortran changed the terms of communication between humans and computers, moving up a level to a language that was more comprehensible by humans. So Fortran, in computing vernacular, is considered the first successful higher-level language.

Mr. Backus and his youthful team, then all in their 20s and 30s, devised a programming language that resembled a combination of English shorthand and algebra. Fortran, short for Formula Translator, was very similar to the algebraic formulas that scientists and engineers used in their daily work. With some training, they were no longer dependent on a programming priesthood to translate their science and engineering problems into a language a computer would understand.

In an interview several years ago, Ken Thompson, who developed the Unix operating system at Bell Labs in 1969, observed that “95 percent of the people who programmed in the early years would never have done it without Fortran.”

He added: “It was a massive step.”

Fortran was also extremely efficient, running as fast as programs painstakingly hand-coded by the programming elite, who worked in arcane machine languages. This was a feat considered impossible before Fortran. It was achieved by the masterful design of the Fortran compiler, a program that captures the human intent of a program and recasts it in a way that a computer can process.

In the Fortran project, Mr. Backus tackled two fundamental problems in computing — how to make programming easier for humans, and how to structure the underlying code to make that possible. Mr. Backus continued to work on those challenges for much of his career, and he encouraged others as well.

“His contribution was immense, and it influenced the work of many, including me,” Frances Allen, a retired research fellow at I.B.M., said yesterday.

Mr. Backus was a bit of a maverick even as a teenager. He grew up in an affluent family in Wilmington, Del., the son of a stockbroker. He had a complicated, difficult relationship with his family, and he was a wayward student.

In a series of interviews in 2000 and 2001 in San Francisco, where he lived at the time, Mr. Backus recalled that his family had sent him to an exclusive private high school, the Hill School in Pennsylvania.

“The delight of that place was all the rules you could break,” he recalled.

After flunking out of the University of Virginia, Mr. Backus was drafted in 1943. But his scores on Army aptitude tests were so high that he was dispatched on government-financed programs to three universities, with his studies ranging from engineering to medicine.

After the war, Mr. Backus found his footing as a student at Columbia University and pursued an interest in mathematics, receiving his master’s degree in 1950. Shortly before he graduated, Mr. Backus wandered by the I.B.M. headquarters on Madison Avenue in New York, where one of its room-size electronic calculators was on display.

When a tour guide inquired, Mr. Backus mentioned that he was a graduate student in math; he was whisked upstairs and asked a series of questions Mr. Backus described as math “brain teasers.” It was an informal oral exam, with no recorded score.

He was hired on the spot. As what? “As a programmer,” Mr. Backus replied, shrugging. “That was the way it was done in those days.”

Back then, there was no field of computer science, no courses or schools. The first written reference to “software” as a computer term, as something distinct from hardware, did not come until 1958.

In 1953, frustrated by his experience of “hand-to-hand combat with the machine,” Mr. Backus was eager to somehow simplify programming. He wrote a brief note to his superior, asking to be allowed to head a research project with that goal. “I figured there had to be a better way,” he said.

Mr. Backus got approval and began hiring, one by one, until the team reached 10. It was an eclectic bunch that included a crystallographer, a cryptographer, a chess wizard, an employee on loan from United Aircraft, a researcher from the Massachusetts Institute of Technology and a young woman who joined the project straight out of Vassar College.

“They took anyone who seemed to have an aptitude for problem-solving skills — bridge players, chess players, even women,” Lois Haibt, the Vassar graduate, recalled in an interview in 2000.

Mr. Backus, colleagues said, managed the research team with a light hand. The hours were long but informal. Snowball fights relieved lengthy days of work in winter. I.B.M. had a system of rigid yearly performance reviews, which Mr. Backus deemed ill-suited for his programmers, so he ignored it. “We were the hackers of those days,” Richard Goldberg, a member of the Fortran team, recalled in an interview in 2000.

After Fortran, Mr. Backus developed, with Peter Naur, a Danish computer scientist, a notation for describing the structure of programming languages, much like grammar for natural languages. It became known as Backus-Naur form.

Later, Mr. Backus worked for years with a group at I.B.M. in an area called functional programming. The notion, Mr. Backus said, was to develop a system of programming that would focus more on describing the problem a person wanted the computer to solve and less on giving the computer step-by-step instructions.

“That field owes a lot to John Backus and his early efforts to promote it,” said Alex Aiken, a former researcher at I.B.M. who is now a professor at Stanford University.

In addition to his daughter Karen, of New York, Mr. Backus is survived by another daughter, Paula Backus, of Ashland, Ore.; and a brother, Cecil Backus, of Easton, Md.

His second wife, Barbara Stannard, died in 2004. His first marriage, to Marjorie Jamison, ended in divorce.

It was Mr. Backus who set the tone for the Fortran team. Yet if the style was informal, the work was intense, a four-year venture with no guarantee of success and many small setbacks along the way.

Innovation, Mr. Backus said, was a constant process of trial and error.

“You need the willingness to fail all the time,” he said. “You have to generate many ideas and then you have to work very hard only to discover that they don’t work. And you keep doing that over and over until you find one that does work.”

Monday, March 19, 2007

Hooters heading for Holy Land

U.S. restaurant chain Hooters, known for waitresses in low-cut blouses and short skirts, will open its first branch in Israel this summer, in the Mediterranean seaside city of Tel Aviv.

"I strongly believe that the Hooters concept is something that Israelis are looking for," Ofer Ahiraz, who bought the Hooters franchise for Israel, told Reuters Monday. "Hooters can suit the Israeli entertainment culture."

At Hooters, waitresses the company calls Hooters Girls serve spicy chicken wings, sandwiches, seafood and drinks.

Ahiraz said a specific location in Tel Aviv, Israel's most cosmopolitan city, had yet to be chosen, but he said it would not open restaurants near large religious populations, and they would not be kosher.

He said his plan was to open as many as five Hooters restaurants in the next few years, including one in the southern resort city of Eilat.

The Tel Aviv version of Hooters is expected to mimic most of the chain's other 430 restaurants in the United States and in 23 countries including China, Switzerland, Australia and Brazil.

Ahiraz said, however, he expected some minor modifications to meet Israeli tastes since U.S. chains have had a mixed response in Israel.

Food chains such as Starbucks, Dunkin' Donuts and Hard Rock Cafe failed, Kentucky Fried Chicken closed many locations, while others such as Burger King and McDonalds have thrived by altering their offerings to suit the Israeli market.

"It shows that if you are flexible and listen to your customers you can be a success story," Ahiraz said.

The opening of Hooters in Israel is part of the chain's global expansion. Privately held Hooters said it planned to open 17 restaurants in Colombia, Dubai, Guam, New Zealand and India in the next two years.

"International expansion is a major focus for our company, and we are very excited to add Israel to our family," John Weber, executive vice president of franchise operations for Hooters of America, said in a statement.

A new day for business security

It might not seem as if a building security guard and a network administrator have much in common. But they do--and the distinction between the two is blurring more every day.

It's true that the people who control building access from security desks and those securing computer networks both watch traffic and walk perimeters to safeguard an organization's assets. But now, technology, tighter security controls, federal regulations and potential cost benefits are bringing the two traditionally separate worlds together--and the convergence is driving industry alliances that may have seemed unusual in the past.

Oracle, for example, has partnered with Honeywell and Lenel to make its identity and access-manager software work with the physical access systems sold by those companies. A similar announcement from Novell and Honeywell is expected in coming weeks.

"It used to be the guns, gates and guards versus the bit chasers and the hacker trackers," said Howard Schmidt, president of the Information Systems Security Association, an international group of IT security professionals. "Technology has fundamentally changed the way all those groups do business. We're much more united today than in the past."

Unifying technologies include network-connected surveillance cameras and mechanisms to control building access that tie into the same systems used to grant network access, said Schmidt, a security consultant who has served as cybersecurity adviser to the White House and ksecurity executive at Microsoft and eBay.

"We're seeing the technologies that used to be restricted to physical space--the cameras, the alarm systems, the card readers--all of which were unique to a hard-wired analog environment, moving into an IP-based digital system," Schmidt said. The Internet Protocol, or IP, is used to connect computers on modern networks.

Software can catch what the human eye might not, such as somebody sneaking into a building behind another person who just swiped a security badge. Also, a single system for credentials can replace multiple access systems and passwords. One badge, or smart card, could be used to enter buildings, log on to networks and buy lunch in the campus cafeteria.

Removing security silos
"It is all about removing the silos around security," said Wynn White, vice president of security and management products at Oracle. Many software applications already let users sign on with a single password--the integration of physical and logical security takes that several steps further, he said.

Through integration, organizations will get a better view of their overall security, said Geoffrey Turner, an analyst at Forrester Research. "You now are able to follow through in securing both tangible and intangible assets," he said. Ultimately, this should provide more security for employees, as well.

One benefit: instead of discovering that an employee who left a company months ago still has an e-mail address or building access, access to all resources can be severed with a single action, White said.

Aside from technology and demand for tighter controls, the convergence is being driven by regulation. Homeland Security Presidential Directive 12, issued in 2004, includes a requirement for automated and secure user credentialing at federal agencies. As a result, the government is leading the move, but the private sector is close behind, according to Turner.

"This is a real trend; there is a sense of inevitability about it, but it is slower than everyone thinks," Turner said. "The private sector has some breathing space. But they need to watch the government."

The next two years will be important in bringing together the security disciplines, Turner said. Companies such as networking giant Cisco Systems, along with software makers Microsoft, Novell, Sun and Oracle will play a key role, he said. They will partner with the likes of HID Global and Honeywell, makers of physical access systems, he said.

"I can hear the elephants dancing, and I know there are a lot of discussions going on," Turner said. "But we were anticipating more partnership announcements between companies this first quarter than we've actually seen."

Katie Moussouris, a hacker for hire at Symantec, often tests the security of businesses, and that doesn't just include IT security. "We're requested by customers to do physical penetration tests," she said. In other words, she's hired to try to enter a building and get past the guards. "Those requests don't come from the physical security folks, they come from the IT department," she said.

With IT folks now involved in physical security, Moussouris expects her job to become tougher. "They will see a lot more places to harden than just the people who are in charge of physical security," she said. For example, weak spots, such as phone closets that have been turned into network hubs, will also be secured, she said.

Ultimately, the executive in charge of information security at an organization could also become responsible for the security guards, who today typically are part of a facilities group that may report to a different executive. That's because IT departments and chief information security officers are used to managing projects, Turner said.

"IT security has already made a progression from the data center glass house to desktops and mobile computing, where things have to be managed in a ubiquitous geographic context," he said. "They are better prepared to reach out and manage additional responsibility."

While technology is an enabler, it is also an obstacle to integration. Traditional security systems--the locks and cameras--are just now going digital.

"Not all physical access products are digitalized in a way that allows them to be integrated and managed through a network," Turner said. "They have to make a transition from an analog technology base to a digital base." Part of that is building secure systems, so they won't be a weak link in a security chain, he said.

Even if physical security systems have moved into the digital realm, they often aren't compatible with tools used to manage users on networks, such as those sold by Oracle.

"Interoperability is a key challenge," White said. Oracle has built connectors that allow its identity and access manager products to work with some physical security systems, but it had to custom-build those, he said. "The standards are ill-defined," he said, adding that nobody in the industry has yet stepped forward to establish any standards.

Also, controlling all aspects of security from a single system could provide a single point of failure. If the one system goes down or is breached, that could create a serious problem or compromise. The easy answer to that concern is strong security and using redundant systems, said Eric Maiwald, a Burton Group analyst.

"That concern may be more of a red herring than anything else," he said. "You're not going to leave that system somewhere it can be broken into." Also, there should be tight controls on who can grant access and clearances to people, he said. "You're not just talking about outsiders; you're also talking about insiders."

Convergence is very much a work in progress, experts agree. But while that work is being done, some organizations, mostly in government, are already moving to a single system and some, such as Delaware State University, already have.

Said Turner: "We're designing the shoes while we're running along wearing them."

Report: U.S. most prolific source of online attacks

U.S. networks pumped out the highest percentage of attacks during the second half of last year, with China running a distant second, according to a report released Monday by security firm Symantec.

The U.S. accounted for 31 percent of malicious activity originating from computer networks, while 10 percent came from China and 7 percent from Germany, Symantec said in its Internet Security Threat Report.

The company also found that 51 percent of all known servers used by attackers to buy or sell stolen personal information, such as credit card or bank account numbers, are located in the U.S.

U.S.-based credit cards, with accompanying verification numbers, were found to be selling for $1 to $6 each on these servers. But a more thorough roundup of personal-identification data--including a person's birthdate and banking, credit card and government-issued identification numbers--fetched $14 to $18, the report noted.

Internet thieves increasingly are turning to Trojan-horse software, which can load keylogging software onto unsuspecting victims' computers. The software is able to harvest people's log-in names and passwords to various accounts and can glean other sensitive information people type into their computers.

Trojans accounted for 45 percent of the top 50 malicious code samples collected by Symantec during the second half of last year, up from 23 percent in the previous six months. Symantec noted that that significant jump further reflects a movement away from mass-mailing worms--programs that spread software viruses and clog networks.

Phishing, an attempt by attackers to trick people into revealing personal or financial information, largely occurs during the weekday, the report noted. Many phishing attacks begin with an e-mail that appears to be from a legitimate source but in fact contains a malicious attachment or includes a link to a malicious Web site. During the second half of the year, a daily average of 961 phishing e-mails were sent to people on weekdays; 27 percent fewer phishing messages were sent out on weekends.

Cop's Internet breasts prompt investigation

[I never get to see any of the good pictures, but I decided to post about this anyway. After all, breasts are breasts.]

SYDNEY (Reuters) - A photograph of a young Australian policewoman's breasts, sent to her boyfriend as a get well message on her mobile phone, has sparked an investigation after it was circulated on internal police e-mail.

The Victoria state police constable was in her police uniform with her name badge visible, her shirt undone and her breasts exposed when she was photographed, Australian Associated Press (AAP) reported Monday.

The image was circulated widely through the force's internal e-mail, landing in the inboxes of top-ranking officers and ethical standards department detectives.

"She has sent an image to her boyfriend and obviously he has done the wrong thing and forwarded it on," a Victoria Police spokeswoman told AAP.

"The ethical standards department has been notified. They are aware of the incident, which involved the circulation of a photograph, and they are examining it to see if an offence has been committed.

Friday, March 16, 2007

Vista vulnerable to ‘Sticky Keys’ backdoor

Vista vulnerable to ‘Sticky Keys’ backdoor by ZDNet's Ryan Naraine -- From the "neat-find-department" comes word from McAfee that Windows Vista is vulnerable to a Sticky Keys backdoor that could be exploited — under perfect circumstances — to launch malicious executables. McAfee researcher Vinoo Thomas said the security risk, which is already well-known on Windows XP, exists because Windows Vista does not check the integrity of the [...]

Planets align for Linux surge

Every year is supposed to be the year that GNU/Linux "really takes off" and that "Windows is doomed", etc.. But this year… well this year could actually be the tipping point for Linux and open source. Look at the signs:

1. Despite assertions to the contrary, Microsoft Vista has unquestionably stumbled. It has compatibility problems with older applications, it requires hardware upgrades to get full functionality, it's more expensive than what it replaces, and it's being banned by many organizations and government agencies.
2. Dell. The company that practically invented the turn-key commodity PC market for ordinary people is making plans to sell entry level computers with Linux pre-installed and ready to go. There are a lot of people out there who just want an inexpensive PC for web surfing, email, and word processing. For them, it doesn't matter whether the computer is running Linux or Windows or AmigaDos as long as the apps are there and they can use them right out of the box.
3. Linux and open source in general has far more "gravitas" in corporate circles than ever before. Oracle is trying to break into the market, Red Hat is flexing its muscles, and even Microsoft is selling Linux vouchers.
4. Linux desktops are looking better than ever. Gnome and KDE, with Xgl and Compiz and Beryl give the eye candy. Ubuntu pioneers ease of use. Linspire makes it familiar to people who are used to pre-Vista Windows.
5. Open source applications have achieved a critical mass. Mozilla Firefox is an excellent browser, and Open Office can handle all but the most diehard VBA hacker's productivity needs. Eclipse and NetBeans provide excellent free development environments for multiple languages. And many applications are moving to the web anyway, requiring no local software install besides a modern web browser.

OEMs like Dell can benefit from customizing the GNU/Linux desktop and OS far beyond what Microsoft will allow on Windows. Dell could provide a completely branded experience, from startup screens to wallpaper, from icons to online help, browser home pages, and bundled applications.

Linux has a unique window of opportunity right now while Microsoft gets its act together with Vista. And Dell is in a unique position to take their users by the hand and jump through that window to bring Linux to the masses.

Thursday, March 15, 2007

Battery start-up speeds toward trucks, data centers

A123Systems, one of many start-ups looking to improve energy storage, wants to find a home for its batteries in corporate data centers and in hybrid trucks and buses.

The company, spun off from the Massachusetts Institute of Technology in 2001, has developed nanoscale materials to improve lithium-ion batteries. Its technology results in safe and more powerful batteries that can charge faster than traditional batteries, according to the company.

Industrial tools manufacturer DeWalt has incorporated cylinder-shaped batteries into its professional power tools. General Motors earlier this year said it will evaluate A123Systems' batteries for a planned hybrid plug-in SUV, the Saturn Vue.

A123Systems founder and MIT professor Yet-Ming Chiang, speaking at the MIT Energy 2.0 Conference here Saturday, said the company intends to expand its use of the technology in transportation and other industries.

It is creating a battery for lightweight jets that save half the weight compared with existing products. A123Systems also plans to create uninterrupted power supplies for servers.

In the transportation industry, the company is developing batteries for hybrid trucks and buses, including plug-in hybrids, Chiang said.

At the conference, the company showed off a plug-in Toyota Prius that can go 30 miles to 35 miles before recharging. The company's batteries, which are about 33 inches wide, are stored under the hatchback trunk.

Although more development is needed, Chiang said, A123Systems' batteries can make a mark in plug-in hybrids, much the way they have in the power tools industry.

"This really is new battery technology," he said. "We have capabilities that five years ago power tool people didn't believe was possible."

OpenBSD hit by 'critical' IPv6 flaw

A vulnerability in the way OpenBSD handles IPv6 data packets exposes systems running the traditionally secure open-source operating system to serious attack.

A memory corruption vulnerability error exists in the OpenBSD code that handles IPv6 packets, Core Security Technologies said in an alert published Tuesday. Exploiting the flaw could let an attacker commandeer a vulnerable system, according to Core, which said it discovered the issue and crafted sample exploit code.

"This vulnerability allows attackers to gain complete control of the target system, bypassing all the operating system's security mechanisms," Core said in a statement Wednesday. Core deems the issue "critical." Security-monitoring company Secunia rates it "highly critical."

OpenBSD is one of several operating systems based on the Berkeley Software Distribution, or BSD. The most popular BSD descendents are FreeBSD, PCBSD and NetBSD, with OpenBSD coming in fourth, according to the BSDstats project.

OpenBSD is mostly known for its security enhancements and is used for firewalls, intrusion detection systems and other applications. Google is among OpenBSD users and backers. The OpenBSD team likes to tout that only a few remotely exploitable vulnerabilities have been found in the code in a decade.

A security update was issued last week to deal with the OpenBSD issue, which affects multiple releases of the operating system.

Default installations of OpenBSD are vulnerable as IPv6 is enabled and the system does not filter inbound packets, Core said. IPv6 is the next version of the Internet Protocol designed to support a broader range of IP addresses as the IP version 4 addresses currently in use become more scarce.

To exploit the vulnerability, an attacker must have the ability to send malicious IPv6 packets to the target system or be on the same network, Symantec said in an alert. The Cupertino, Calif., security company raised its ThreatCon to level 2 because of the issue, which means attacks are expected.

As a work-around for users who can not apply the OpenBSD patch or who do not need to process or route IPv6 traffic on their systems, all inbound IPv6 packets can be blocked by using Openness' firewall.

Red Hat hopes to solidify lead with new Linux

Red Hat faces a lengthening list of rivals, but the company hopes to cement its lead in the Linux market Wednesday with its latest version of the open-source operating system.

The Raleigh, N.C.-based company plans to launch Red Hat Enterprise Linux 5 at a San Francisco event Wednesday. It's the first major update to the company's flagship Linux product in more than two years.

Though Red Hat still dominates Linux, a lot has changed in that time. Novell's Suse Linux Enterprise Server beat Red Hat to the punch with a major new feature, the Xen virtualization software.

Oracle has entered the market with a clone of Red Hat's operating system. Ubuntu is making inroads with strong ties to open-source community volunteers. And Sun Microsystems--for years Red Hat's prime target--is fighting back by bringing its Solaris operating system to widely used x86 servers and making it open-source software as well.

"There is disruption from below from the community (Linux versions) and much stronger competition from its peer group," said 451 Group analyst Raven Zachary. "This will take years to play out, but I see Red Hat having less differentiation from other offerings over time."

Red Hat is still on the offensive, though. In its most recent publicly reported quarter, its revenue increased 45 percent to $105 million, 84 percent of that coming through recurring support subscription contracts. Though profit dropped 37 percent to $15.5 million, much of that was from higher expenses stemming from the acquisition of JBoss, a supplier of open-source Java server software that has provided Red Hat with its biggest opportunity for market expansion.

"Red Hat continues to be the vendor capturing the lion's share of revenue and unit shipments for worldwide Linux operating system shipments," said IDC analyst Al Gillen. Though Novell has remained relevant, the overall balance between the two Linux powers "hasn't shifted dramatically," he said.

RHEL 5's biggest new feature, hands down, is Xen virtualization. The promise of virtualization software, which lets a single machine run multiple operating systems in separate partitions called virtual machines, is that a single computer can replace several inefficiently used ones. In the longer term, virtualization also permits software to be moved--sometimes while running--from one computer to another, which opens the door for higher reliability and a fluidly responding computer room.

Accompanying the virtualization promise, though, are difficulties. Administrators need new management tools, software licensing becomes more complicated, and the underlying technology must be certified to work with a multitude of software and hardware options.

Red Hat will permit up to four virtual machines to run atop RHEL 5 Server, but it's adding a new product called RHEL Advanced Platform that supports unlimited virtual machines and includes the company's Global File System software.

Virtualization is moving to mainstream servers using x86 processors such as Intel's Xeon and Advanced Micro Devices' Opteron, but Red Hat isn't the only one making the push. It's not even the only one pushing Xen, which also is commercialized by XenSource and included in Novell's rival product.

"This is the beginning of (Red Hat's) serious endeavor. There's a lot at stake," Gartner analyst George Weiss said. "There's Novell and Virtual iron, Microsoft is coming along, then there's VMware," which already dominates the x86 server virtualization market.

Apple bumper patch vindicates MOAB, MOKB hackers

Apple bumper patch vindicates MOAB, MOKB hackers by ZDNet's Ryan Naraine -- When the controversial Month of Apple Bugs (MOAB) project ended earlier this year, a derisive “that was it?” reaction could be heard coming from the Mac faithful. Outside of a QuickTime code execution exploit (which required user interaction), the majority of the MOAB vulnerabilities released dealt with denial-of-service crashes and privilege escalation bugs, prompting the dismissal [...]

Monday, March 12, 2007

Updates from the Microsoft Daylight Saving patch trenches

Updates from the Microsoft Daylight Saving patch trenches by ZDNet's Mary Jo Foley -- It's going to be a busy weekend for IT administrators still struggling to get their systems patched to handle the change to Daylight Saving Time (DST) on March 11. Here are some suggestions from readers about how to deal with the DST patch maze.

New shield foiled Internet backbone attack

An attack in early February on key parts of the backbone of the Internet had little effect, thanks to new protection technology, according to a report released this week.

The distributed denial-of-service attack on the Domain Name System proved the effectiveness of the Anycast load-balancing system, the Internet Corporation for Assigned Names and Numbers said in a document published Thursday. ICANN regulates Internet domain name and address registration and operates one of the main so-called root DNS servers.

"The Internet sustained a significant distributed denial-of-service attack, originating from the Asia-Pacific region, but stood up to it," according to the ICANN document, which attributed the Internet's fortitude to Anycast's routing of traffic to the nearest server.

DNS serves as the address book for the Internet, mapping text-based domain names to the actual numeric IP addresses of servers connected to the Internet, and vice versa. A distributed denial-of-service attack seeks to bring targeted servers down by sending an onslaught of traffic from multiple sources, typically compromised PCs.

During the attack, which lasted almost eight hours, six of the 13 root servers that form the foundation of the Internet's DNS were targeted, ICANN said. However, only two were noticeably affected. These two did not have Anycast installed because the technology was still being tested, ICANN said.

"With the Anycast technology apparently proven, it is likely that the remaining roots--D, E, G, H and L--will move over soon," ICANN said. The letters refer to the five of the 13 official root DNS servers that do not yet have Anycast installed.

The root DNS servers sit at the top of the DNS hierarchy and get queried only if other DNS servers, like those at an Internet service provider, don't have the right address for a specific Web site. The 13 root servers are spread out across the globe and are represented by physical servers in more than 100 places geographically.

Anycast was developed after a similar denial-of-service attack hit the DNS root in 2002. That attack managed to swamp nine of the 13 root servers. "The Internet continued to run but it was a wake-up call for the root server operators," who set out to develop Anycast, ICANN said.

If the DNS system goes down, Web sites would be unreachable and e-mail undeliverable. But DNS is built to be resilient, and attacks on the system are rare.

ICANN has yet to determine the exact techniques used in the February attack. The incident will be discussed at a meeting of DNS root server operators later this month, the organization said.

Thursday, March 08, 2007

Emotiv’s man-machine melding interface technology

Emotiv’s man-machine melding interface technology by ZDNet's Dan Farber -- The human-computer interface has always been clunky. You grapple with various manual input devices to give commands to a computer. Voice interaction is starting to take hold, at least for unforgiving call center applications or "call home" commands, but mind control–connecting our brains to computers–remains elusive. Startup Emotiv Systems is hoping to crack the code [...]

Screen Gallery/Review: Microsoft’s Virtual PC 2007 in action

Screen Gallery/Review: Microsoft’s Virtual PC 2007 in action by ZDNet's David Berlind -- If you've followed any of what I've written over the past couple of years regarding the benefits of virtualizing Windows desktop PCs, you know that I'm a really big fan of the idea. The basic premise is this: Everyone knows that it's not a question of if they'll be moving to a new PC. It's [...]

Hacker builds tracking system to nab Tor pedophiles

Amidst concerns that pedophiles are using public Tor (the Onion Router) servers to trade in child pornography, ├╝ber-hacker HD Moore is building a tracking system capable of pinpointing specific workstations that searched for and downloaded sexual images and videos of kids.

Moore, the brains behind the Metasploit Project, has come up with a series of countermeasures that include using patched Tor servers and a decloaking engine to detect the exact location of a pedophile within an organization or residence.

HD MooreMoore first discussed his "countermeasures" at a meeting of the Austin Hackers Association (AHA) last summer when it became clear that the EFF-backed anonymity/privacy network was being used for the most nefarious purposes. Further confirmation came last September when German authorities cracked down on Tor node operators because of the proliferation of child porn.

In an e-mail interview, Moore said the plan is to release the source code, which will allow anyone to run a patched Tor server to help pinpoint pedophiles online.

Moore's description of the countermeasures:

1. Run a patched TOR server. The patches embed a Ruby interpreter into the TOR connection engine and allow arbitrary Ruby scripts to process data before sending it back to the client.

2. When child porn-related keywords are seen (either the Web request, or the response), inject a little extra HTML code into the response going back to the Web browser. This HTML code would connect to my decloaking engine.

3. The decloak engine is based on the following techniques:

a) A unique identifier is created to track this user.

b) The browser is asked to resolve a unique host name, containing the identifier, that is part of a special domain hosted on my server. I run a modified DNS server that updates a database with the address from which the DNS request is received. The goal of this step is to determine the ISP of the user.

c) The browser is asked to load a Java applet. This applet uses two different techniques to obtain information about the user.

d) The first method uses the Java API to determine the local IP address of the user. This value is then passed back to the JavaScript code in the Web HTML snippet hosting the applet. The goal of this step is to get the real *internal* IP address of the user.

e) The second method involves the applet sending a raw DNS packet, directly to my server. Since this is UDP, it does not pass through TOR, and since it is sent by the Java code, it does not go through the ISP. This packet contains the unique identifier and if received, gives away the real *external* IP of the user. The goal of this step is to get the address of the user's NAT gateway.

f) At this point, my server is able to determine the internal address of the user, the external address from which they access the internet, and the ISP they use to provide DNS resolution, as well as the IP address they come from through the TOR network. This information, along with the unique tracking ID, allows me to identify a specific workstation within an organization or residence.

As to whether this is enough for law enforcement authorities to make an arrest and build a case, Moore's answer: "No idea."

The downsides of building your own PCs

The downsides of building your own PCs by ZDNet's Adrian Kingsley-Hughes -- There are huge upsides to building your on PC, but it's not smiles all the way ...

Microsoft customers melting down over Daylight Saving patches

Microsoft customers melting down over Daylight Saving patches by ZDNet's Mary Jo Foley -- Thousands of Microsoft customers are running into problems understanding and applying the myriad Microsoft Daylight Saving Time (DST) patches required in order to keep their Windows, Exchange Server and other systems up-to-date when DST takes effect on March 11.

Microsoft takes a 'Patch Tuesday' break

In a note on its Web site Thursday, Microsoft said it won't release any security bulletins, yet it will release several updates that are not related to security. The second Tuesday of the month is Microsoft's scheduled patch release day.

Also on Tuesday, Microsoft will go ahead with an updated release of its Windows Malicious Software Removal Tool. The program detects and removes common malicious code placed on computers and is pushed out monthly.

The patch break could be a welcome respite for IT managers still busy testing the dozen fixes Microsoft released last month. Also, many IT pros may be occupied with the switch to daylight saving time, which at the behest of Congress, is happening three weeks earlier this year. Many computer systems don't have that change programmed in and require patching.

Microsoft occasionally has months when it has not released security updates. The last time Microsoft did not offer security updates as part of its monthly update cycle was September 2005, the company said.

"Microsoft continues to investigate potential and existing vulnerabilities in an effort to help protect our customers," a company representative said on Thursday. "Creating security updates that effectively and comprehensively fix vulnerabilities is an extensive process involving a series of sequential steps."

Still, the lack of security updates also means that cybercrooks have more time to exploit known security vulnerabilities. There are five known zero-day holes in Microsoft products, according to eEye Digital Security. Microsoft has warned that a bug in Word is being exploited in attacks. The company has said it is working on a fix.

Monday, March 05, 2007

Gmail tips to enhance productivity

Gmail tips to enhance productivity by ZDNet's Garett Rogers -- Matt Cutts, Google's best spam fighter and all around smart guy, tells us about a few things he does in Gmail to make sure he wastes as little time as possible. Since email is a necessary evil for many people who find themselves drowning in their inbox, these three tips will surely find their way [...]

Your Wi-Fi can tell people a lot about you

Simply booting up a Wi-Fi-enabled laptop can tell people sniffing wireless network traffic a lot about your computer--and about you.

Soon after a computer powers up, it starts looking for wireless networks and network services. Even if the wireless hardware is then shut-off, a snoop may already have caught interesting data. Much more information can be plucked out of the air if the computer is connected to an access point, in particular an access point without security.

"You're leaking all kinds of information that an attacker can use," David Maynor, chief technology officer at Errata Security, said Thursday in a presentation at the Black Hat DC event here. "If the government was taking this information from you, people would be up in arms. Yet you're leaking this voluntarily using your laptop at the airport."

There are many tools that let anyone listen in on wireless network traffic. These tools can capture information such as usernames and passwords for e-mail accounts and instant message tools as well as data entered into unsecured Web sites. At the annual Defcon hacker gathering, a "wall of sheep" always lists captured log-in credentials.

Errata has developed another network sniffer that looks for traffic using 25 protocols, including those for the popular instant message clients as well as DHCP, SNMP, DNS and HTTP. This means the sniffer will capture requests for network addresses, network management tools, Web sites queries, Web traffic and more.

"You don't realize how much you're making public, so I wrote a tool that tells you," said Robert Graham, Errata's chief executive. The tool will soon be released publicly on the Black Hat Web site. Anyone with a wireless card will be able to run it, Graham said. Errata also plans to release the source code on its Web site.

The Errata sniffer, dubbed Ferret, packs more punch than other network sniffers already available, such as Ethereal and Kismet, because it looks at so many different protocols, Graham said. Some at Black Hat called it a "network sniffer on steroids."

Snoops can use the sniffer tools to see all kinds of data from wireless-equipped computers, regardless of the operating system.

For example, as a Windows computer starts up, it will emit the list of wireless networks the PC has connected to in the past, unless the user manually removed those entries from the preferred networks list in Windows. "The list can be used to determine where the laptop has been used," Graham said.

Apple Mac OS X computers will share information such as the version of the operating system through the Bonjour feature, Graham said. Bonjour is designed to let users create networks of nearby computers and devices.

Additionally, computers shortly after start-up typically broadcast the previous Internet Protocol address and details on networked drives or devices such as printers that it tries to connect to, Graham said.

"These are all bits of otherwise friendly information," Graham said. But in the hands of the wrong person, they could help attack the computer owner or network. Furthermore, the information could be useful for intelligence organizations, he said.

And that's just what the data snoops can sniff out of the air when a laptop is starting up. If the computer is then connected to a wireless network, particularly the unsecured type at hotels, airports and coffee shops, much more can be gleaned. Hackers have also cracked basic Wi-Fi security, so secured networks can't provide a security guarantee.

In general, experts advise against using wireless networks to connect to sensitive Web sites such as online banking. However, it is risky to use any online service that requires a password. The Errata team sniffed one reporter's e-mail username and password at Black Hat and displayed it during a presentation.

People who have the option of using a Virtual Private Network when connected to a wireless network should use it to establish a more secure connection, experts suggest. Also, on home routers WPA, or Wi-Fi Protected Access, offers improved security over the cracked WEP, or Wired Equivalent Privacy.

"The best solution is to be aware of the danger," Graham said. "Everyone doesn't need to work from a coffee shop."

WordPress server hacked, downloads rigged with serious flaw

WordPress server hacked, downloads rigged with serious flaw by ZDNet's Ryan Naraine -- An unknown cracker broke into a server hosting downloads of the popular WordPress blogging software and rigged the file with a remotely exploitable code execution vulnerability. News of the hack comes directly from WordPress creator Matt Mullenweg: "If you downloaded WordPress 2.1.1 within the past 3-4 days, your files may include a security exploit that was [...]

Friday, March 02, 2007

Maynor demos MacBook Wi-Fi hijack, admits mistakes

Maynor demos MacBook Wi-Fi hijack, admits mistakes by ZDNet's Ryan Naraine -- Looking to put to rest one of the most bizarre vulnerability disclosure disputes in recent memory, hacker David Maynor offered an apology for mistakes made, provided a live demo of the controversial MacBook Wi-Fi takeover and promised to release e-mail exchanges, crash/panic logs and exploit code to clear his tarnished name. Maynor kicked off a presentation [...]

Vista Hands On #9: Use Vista for four months, free

Vista Hands On #9: Use Vista for four months, free by ZDNet's Ed Bott -- Looking for real Windows Vista secrets? Everyone knows you can install Windows Vista in evaluation mode for 30 days and reset the countdown timer three times, giving you a free evaluation period of 120 days. The trouble is, you have to remember to type the magic command every 30 days or you're deactivated. Unless you know the real secret, which uses another Windows feature to automate the process. I've got the never-before-published details here.

Thursday, March 01, 2007

Homeland Security offers details on Real ID

Hundreds of millions of Americans will have until 2013 to be outfitted with new digital ID cards, the Bush administration said on Thursday in a long-awaited announcement that reveals details of how the new identification plan will work.

The announcement by the U.S. Department of Homeland Security offers a five-year extension to the deadline for states to issue the ID cards, and proposes creating the equivalent of a national database that would include details on all 240 million licensed drivers.

According to the draft regulations (PDF), which were required by Congress in the 2005 Real ID Act and are unlikely to assuage privacy and cost concerns raised by state legislatures:

• The Real ID cards must include all drivers' home addresses and other personal information printed on the front and in a two-dimensional barcode on the back. The barcode will not be encrypted because of "operational complexity," which means that businesses like bars and banks that require ID would be capable of scanning and recording customers' home addresses.

• A radio frequency identification (RFID) tag is under consideration. Homeland Security is asking for input on how the licenses could incorporate "RFID-enabled vicinity chip technology, in addition to" the two-dimensional barcode requirement.

• States must submit a plan of how they'll comply with the Real ID Act by October 7, 2007. If they don't, their residents will not be able to use IDs to board planes or enter federal buildings starting on May 11, 2008.

• Homeland Security is considering standardizing a "unique design or color for Real ID licenses," which would effectively create a uniform national ID card.

Thursday's draft regulations arrive amid a groundswell of opposition to the Real ID Act from privacy groups, libertarians and state officials. On Wednesday, the National Governors Association endorsed a bill by Sen. Susan Collins, a Maine Republican, that would reduce Homeland Security's power to order states to comply with the law.

The draft rules, which are not final and will be subject to a public comment period, also include a more detailed estimate of how much it will cost to comply. The National Conference of State Legislatures and other state groups estimated last year that states will have to spend more than $11 billion. But Homeland Security says the total cost--including the cost to individuals--will be $23.1 billion over a 10-year period.

Another section of the 162-page regulations says that states have until December 31, 2009 to certify that they're on the path toward fully complying with the Real ID Act.

Push for repeal continues

Opponents of the Real ID Act, who have been advising states to publicly oppose the system, said that the draft rules are insufficiently privacy-protective and reiterated their call for a repeal of the entire law.

"We still need dramatic legislative action from Congress," said Tim Sparapani, legislative counsel for the ACLU, which runs the site. "We've got to wipe out the underlying act."

Sparapani and his allies of more than 50 groups, including the National Organization for Women and United Automobile Workers, sent a letter on Monday endorsing a bill to repeal the Real ID Act. The letter says it was a "poorly-conceived law that can never be made to work in any fair or reasonable manner."

The ACLU believes Collins' bill is only a half-hearted step that doesn't go as far as it should. Other proposals include one from Rep. Thomas Allen, a Maine Democrat, that would rewrite the Real ID Act, insert privacy safeguards, and hand $2.4 billion to states over an eight-year period. On Wednesday, Sen. John Sununu, a New Hampshire Republican, and Daniel Akaka, a Hawaii Democrat, reintroduced a broader bill to repeal portions of the existing law.

Some state governments, such as Maine, already have come out against the Real ID Act--a move that effectively dares the federal government to continue even when some states refuse to participate. At least eight states (including Arizona, Georgia, and Vermont) have had anti-Real ID bills approved by one or both chambers of the legislature.

For their part, proponents of the Real ID Act say it's designed to implement proposals suggested by the 9/11 Commission, which noted that some of the hijackers on September 11, 2001 had fraudulently obtained state driver's licenses. But not all did: at least one hijacker simply showed his foreign passport and walked onto the airplane that day.

The Bush administration and many congressional Republicans have defended the Real ID Act as a way to stop future terrorist attacks and deter illegal immigrants. "Raising the security standards on driver's licenses establishes another layer of protection to prevent terrorists from obtaining and using fake documents to plan or carry out an attack," Homeland Security Secretary Michael Chertoff said in a statement. "These standards correct glaring vulnerabilities exploited by some of the 9/11 hijackers who used fraudulently obtained drivers licenses to board the airplanes in their attack against America."

A 23-page report released this week by Janice Kephart, a former lawyer with the 9/11 Commission, defended the Real ID Act by calling it a "significant step in enhancing our national and economic security and our public safety." Kephart is now president of 9/11 Security Solutions.

States bowing out of Real ID requirements is "not the way to secure America," the report says. "Embedding identity security into state-issued (ID card) systems will take significant planning to fulfill the requirements of Real ID and significant financial resources for the 'brick and mortar' start-up costs. Congress must step up to the plate and make securing of identity documents the national priority that our citizens deserve."

The Real ID Act passed Congress as part of an $82 billion military spending bill that also included funds for tsunami relief. No up-or-down vote on solely the Real ID Act took place in the entire Congress, though the House of Representatives did approve the rules by a 261-161 vote.

How to get 520 GigaFlops for $600

How to get 520 GigaFlops for $600 by ZDNet's Ed Burnette -- Certain specialized compute-intensive tasks have long been coded to take advantage of vendor math libraries and special hardware vector acceleration. Now there are new techniques that can be used to utilize the massively parallel graphics processing unit (GPU) found in modern high-end 3D video cards originally designed for gaming.

Lenovo recalls extended-life laptop batteries

Lenovo on Thursday voluntarily recalled select Sanyo Electric lithium ion extended-life batteries used in its ThinkPad notebook computers.

"Consumers should stop using the recalled products immediately unless otherwise instructed," the U.S. Consumer Product Safety Commission (CPSC) said in its recall announcement. Lenovo is offering a free replacement battery.

The recall affects 9-cell batteries with the part number FRU P/N 92P1131. They were sold between November 2005 and February 2007 as an accessory for about $180.

The recalled devices were used in ThinkPad notebook models: R60, R60e, T60, T60p, Z60m, Z61e, Z61m and Z61p. About 100,000 of the recalled Sanyo Electric battery packs were sold in the U.S., with 105,000 more sold worldwide.

The defect is not with the internal battery cell, according to the CPSC statement. A blow to the corner of the laptop while the battery is installed, which might occur if the device is dropped, can result in overheating. Lenovo received four reports of "batteries overheating and damaging the notebook," according to the recall notice.

Consumers can check Lenovo's battery recall announcement for more information or call Lenovo at (800) 426-7378 anytime to determine if they have a defective battery.

In September, Lenovo also recalled a series of Sony batteries used in ThinkPad computers.

Cybercops drowning in data

As digital evidence increases in importance, authorities seize anything that can hold data. This includes computers, CDs, USB keys, MP3 players, cell phones and game consoles, Jim Christy, a director of the U.S. Department of Defense Cyber Crime Center, said in a presentation at the Black Hat DC Briefings & Training event here.

"This is everything that you got and gave for Christmas," Christy said. In one case, investigators found child pornography on a modified Xbox, he said. "The challenge is that with digital proliferation, the data volume is tremendous these days."

A single terabyte of data equals about 8,333 old-fashioned, five-drawer file cabinets filled with papers. "That's an awful lot for an examiner to go through," Christy said.

Digital evidence can answer key questions in a legal case, but efficient tools to sift through massive amounts of data don't exist today, Christy said. "I want to call out to the industry to create tools to help us investigate large volumes of data in a forensic manner," he said.

Cybercrime investigators need more tools because they are stretched thin. There are only about a dozen accredited digital-forensics labs in the United States. While it may appear differently on popular TV police dramas, digital evidence is used in many more cases than DNA analysis, for example, which appears in only 1 percent of U.S. criminal cases, Christy said.