Microgeist » featured

Google's-run-in-with-China-shows-that-internet-is-now-a-real-battleground

admin — Mon, 15 Feb 2010 00:00:00 +0000

Provided Courtesy Of: ONE USEFUL spin-off from the developing story of Google's difficulties with the Chinese communist regime is that it may finally spur the west to discard the rose-tinted spectacles through which it has chosen to view China in the past decade and not before time.

The west's response to China's rapid industrialisation was determined by a recipe blending three parts greed with one part naivety. The greed was understandable: the stupendous rate of Chinese economic growth triggered a desperate desire for a slice of the action. Everywhere, whether in companies or universities, one found a palpable determination to “get into China”. In the political world, we saw western governments scramble to out-do one another in fawning upon visiting Chinese potentates.

Still, greed is part of human nature; we have to make a living, and often behave reprehensibly while doing so. What was less forgivable about the west's approach was the implicit naivety. It was a product of wishful thinking brought about by market triumphalism, the belief that, in the end, it is impossible to have a capitalist economy without also having liberal political institutions.

Google's engagement with China was driven by both greed and naivety. The latter was graphically illustrated by the deal on filtering search results the company accepted. The Google folk persuaded themselves it was better to let internet users know their searches had been filtered, on the grounds that this might alert Chinese citizens to the imperfections in their political arrangements. It was unpalatable, but better than nothing. And it might lead to change.

It was all hooey, of course. The regime is irredeemably authoritarian and never had any intention of ceding freedom of information to its people. Neither has it ever bought into the idea of market triumphalism. The whole Chinese economic “miracle” is a refutation of the link between capitalism and liberalism: Hu Jintao & Co believe it is perfectly possible to build a dynamic, prosperous economy without bothering with all that democracy nonsense.

Recent developments confirm the indifference of the regime to western sensibilities. Though nobody has yet conclusively proved the hacking attack that triggered Google's decision to quit China was officially sanctioned, I can't find anyone in the security world who doubts it. And already some specialists have uncovered interesting similarities between it and the “Ghostnet” operation of 2008/9 mounted against Tibetan activists which was traced back to a Chinese intelligence network.

James Fallows, the distinguished US journalist who has recently returned from a long posting in China, thinks it is entering its own “Bush-Cheney era” a period of aggressive dismissal of the world. “A difficult and unpleasant stage of China-US and China-world relations lies ahead,” he writes. “This is so on the economic front [and] may prove so on the environmental front It is increasingly so on the political-liberties front, as witness Vaclav Havel's denunciation of the recent 11-year prison sentence for the man who is in many ways his Chinese counterpart, Liu Xiaobo.”

Which provides the context for the most remarkable development of the week Hillary Clinton's speech on internet freedom at the Newseum in Washington last Thursday. Internet users, she declared, must be “assured certain basic freedoms” freedom of expression and of worship, freedom from want and from fear and, most intriguingly, “freedom to connect”.

She then turned to l'affaire Google. “We look to Chinese authorities to conduct a thorough investigation of the cyber intrusions that led Google to make this announcement. We also look for that investigation and its results to be transparent. The internet has already been a source of tremendous progress in China, and it's great that so many people there are now online. But countries that restrict free access to information or violate the basic rights of internet users risk walling themselves off from the progress of the next century.”

Ten Innovative Ways To Use Twitter For Business

SAP Report – Six Mistakes Companies Are Making Today and How You Can Avoid Them

The regime was so enraged it issued an unprecedentedly speedy critique. Which shows how quickly the Google drama is evolving into a high-level crisis. Cyberspace was the next frontier; it's becoming the next battleground.

This is comment. GNM does not necessarily support the views expressed.

This eBook is your industry-specific roadmap out of the economic slump. Selling through a Slump: An Industry-by-Industry Playbook brings together sales strategies and best practices from 11 top sales experts from 11 distinct vertical market sectors, ranging from retail to health care to telecom – because one size doesn't always fit all. The practical tips and experience-based wisdom here aren't just limited to any single industry, though. Regardless of your market sector, you're bound to find value in this arsenal of great sales ideas. Get access to exclusive tips on how to sell in a challenging market, from renowned sales experts like Jill Konrath, Charles Green, and Dave Stein. You've got questions – this eBook was created to give you answers.
#

Google-teams-up-with-National-Security-Agency-to-tackle-cyber-attacks Internet groups fear alliance means US government could access personal...
Cloud-computing-how-information-giants-are-setting-the-pace-for-the-internet's-next-decade From Google's library project to Apple's iTunes store, 'cloud capitalism'...
Gmail-ups-security-after-Chinese-attack Gmail, Google's free email service, moves to encrypt by default...

Related posts brought to you by Yet Another Related Posts Plugin.

CES-iPhone-controlled-drone-unveiled-at-tech-show-curtain-raiser

admin — Mon, 15 Feb 2010 00:00:00 +0000

Provided Courtesy Of: Unmanned drones have become synonymous with controversial military action in some of the most dangerous warzones. But now a child's toy has been created using the same technology.

The AR.Drone, an iPhone-controlled helicopter powered by four separate blades, has been unveiled at the agenda-setting Consumer Electronics Show in Las Vegas.

Boasting built-in military grade systems such as wind compensation and autopilot functions, the drone is able to hover for hours over a single spot or fly under the command of a pilot using a wireless controller such as an iPhone.

The toy also boasts a number of other hi-tech embellishments, including a pair of on-board cameras and a computerised internal guidance system that allow it to track objects and react to the environment automatically.

“With video cameras and a powerful computer, we have developed a very stable drone that is easy to control and flies like a dragonfly,” said Henri Seydoux, the founder and chief executive of the Paris-based company behind the toy, Parrot.

A spokesman for the company, which is better known for making Bluetooth headsets and in-car systems, would not say how much the AR Drone will cost but confirmed that it would be available to buy later this year.

“Our first project was a Bluetooth race car. We've developed it, but I was not satisfied,” said Seydoux. “So I started with the idea of a quadricopter.”

The company was demonstrating the device at the annual Consumer Electronics Show in Las Vegas, one of the world's biggest technology industry showcases.

Thousands of computer buffs and hi-tech entrepreneurs are expected in the city this week as the world's most powerful electronics brands fight it out for top billing. Among the 2,500 companies in attendance are Microsoft, Sony, Samsung and Nokia who are all launching major new products at the event.

Ten Innovative Ways To Use Twitter For Business

SAP Report – Six Mistakes Companies Are Making Today and How You Can Avoid Them

The show's organisers expect more than 100,000 enthusiasts to turn up over the next four days to get their hands on new products such as touchscreen tablet computers, record-breaking television screens and electronic books.

Despite the focus on expensive gadgets and gizmos, however, toys are an increasingly significant part of the show with a manufacturers showing off robots and hi-tech contraptions aimed at youngsters.

The high levels of interest and excitement come despite a difficult period for the event, which is entering its 42nd year. In 2009 many exhibitors were left reeling by the global economic crisis, and many have scaled down their plans for this year's show.

Organisers say that visitor numbers could be even lower this week than they were this time last year, although more new companies have signed up to exhibit than ever – a signal that the excitement that was absent last year has returned.

“There's a great deal of enthusiasm leading into 2010 that just wasn't there in the 2009 show,” said Jason Oxman, a senior vice-president of the Consumer Electronics Association, which organises the event.

Gmail-ups-security-after-Chinese-attack Gmail, Google's free email service, moves to encrypt by default...
Is-IOBit-Security-360-worth-the-risk? Martin Day is using anti-virus software from iobit.com, and wonders...
Mac-or-PC-which-is-safer-or-more-secure? An article at CNet offers a compilation of comments from...

Related posts brought to you by Yet Another Related Posts Plugin.

Cloud-computing-how-information-giants-are-setting-the-pace-for-the-internet's-next-decade

admin — Mon, 15 Feb 2010 00:00:00 +0000

Provided Courtesy Of: It is a vast orphanage, yet its inhabitants are not children, but millions of books that have been unceremoniously dumped by their owners, locked away unseen and unread. Many of the books' authors are still alive. That is not the problem. The trouble is that the copyright owners the publishers no longer think they will profit from making these books commercially available. Yet the owners decline to free the books and make them publicly available, in case someone else makes money from them. Many books will only be in commercial print for a couple of years before they are packed off to the orphanage to spend decades in the dark.

A tragically high proportion of our culture lies trapped in this cultural coma, including perhaps 95% of commercially published books and tens of thousands of films. That is why Google's project to digitise more than seven million orphaned books, as part of a digital library that could exceed the Library of Congress, should be welcomed. A treasure trove of culture and ideas will be opened up for more people than ever to access. No one else was going to do it, so Google is footing the bill. That should be good for all of us.

Yet Google's plans have also induced a sense of foreboding, chiefly among publishers and writers. By liberating the orphans, Google will acquire huge power over the future of publishing. It will be able to head off potential competition from other databases of digital books. As we trawl through Google's library, the company will acquire yet more information about our habits and interests, which it will aggregate in its vast servers, and analyse with its clever algorithms, to sell advertising to us in yet more ingenious ways. A profit-driven corporation, run by self-confessed software nerds, is an unlikely custodian of the world's literary heritage.

The debates over Google's plans are just the first of many to come about who will control our culture when so much of it is stored in vast clouds of data swirling above us. Google is the first and most successful exponent of a new kind of economic power: cloud capitalism.

Another is Apple, which, like Google, can appear both very open, public spirited even, and cleverly commercial. Apple's beautiful devices, the iPod and the iPhone, are made much more compelling because of the carefully managed clouds of music and applications that they allow access to. The iTunes cloud has provided a model for how to make money from culture online, but it also includes masses of free educational content. The iPhone cloud has created an entirely new market for people to sell content and applications through mobile phones, and so turned the mobile phone industry on its head.

These early exponents of cloud capitalism are setting the template for others to follow in the next decade. As they do, the internet, which even in its short life as the information superhighway and cyberspace, will change once more in ways that will engender both excitement and foreboding.

Not long ago we had stand-alone computers, in my case an Amstrad with a green blinking screen, on which I kept my paltry data and simple software. The internet linked these separate computers, so that files could be sent, for example, as attachments to emails, peer-to-peer. The web landed on top of the internet to link separate documents. Browsers let us surf these links. The ethics underpinning all this came from a mixture of hippies, geeks and 1960s academics who believed in collaboration to share information and ideas.

The internet that the cloud capitalists want to give us is quite different. In cloud computing, our data emails, documents, pictures, songs and software will be stored remotely in a digital cloud hanging above us, always there to access from any device: computer, television, games console, hand-held and mobile. We should be able to draw down as much or as little of the shared cloud as we need.

When the New York Times wanted to make available on the web 11 million articles dating from 1851 to 1989, the paper scanned in the stories, converted them to TIFF files, and uploaded them to Amazon's cloud service S3, taking up four terabytes of space on Amazon's remote servers. Apparently someone in the IT department signed up for the service on the web using a credit card. Then using Amazon's EC2 computing platform, the TIFF files were turned into PDF files. The paper created an archive of 11 million articles entirely by using resources borrowed from the cloud.

Ten Innovative Ways To Use Twitter For Business

SAP Report – Six Mistakes Companies Are Making Today and How You Can Avoid Them

The promise is that we might get as many different kinds of computer-generated clouds as there are in the sky, from solid stratus to high-altitude cirrus. The World Digital Library, which is being created by a set of the world's leading museums, will be a permanent, global public cloud. Wikipedia is a cloud of self-managed, user-generated information. Some clouds will emerge in a crisis and have a fleeting life. Ushahidi emerged after Kenya's disputed elections in 2007-08 for people to report where violent attacks were taking place by using a mashed-up version of Google Maps.

The machines making these clouds are vast, energy-efficient data centres and server farms 7,000 in the US to date. Google has two million servers operating around the world. Microsoft is reportedly adding up to 35,000 servers a month in places such as its data centre outside Chicago, which covers 500,000 sq feet (46,000 sq metres), costs $500m and will hold 400,000 servers.

The rise of cloud capitalism has led to a vicious civil war with the media old guard: last year, Rupert Murdoch accused Google of stealing his content and unveiled plans to charge his online readers. Yet the truth is that old media industries will increasingly rely on the cloud to get to their customers, whether it is books on ereaders, online newspapers on an iPhone or films on an iPad.

However the potential power of these cloud providers raises all sorts of fears, not least for privacy, security and reliability: outages of Google servers have left millions of gmail users without a service. There will be disputes over who owns the particles in the cloud: witness the furore over whether Facebook owns pictures posted by its members.

More worryingly, commercial providers of cloud services will have strong incentives to manage their users to maximise revenues and to discourage them from roaming from one service to another. Providers of cloud services are bound to have preferred suppliers of software and other services they will promote. The cloud capitalists will want to harvest all they can from their clouds, which means turning you and me, our preferences and interactions into pieces of information to be analysed by algorithms. They will not see us as readers, customers or members, but as bits of linked information.

We could soon find cloud services trying to shape our lives. An algorithm at Facebook recently recommended that I reconnect with my wife (we live together very happily, thanks), while Amazon recommended I buy a copy of my own book. Clumsy nudges such as this are not the worry; we should worry when the algorithms become so sophisticated that we don't realise it is happening.

Perhaps most worrying of all will be the relationship between these corporate clouds, holding vast amounts of data about us, and governments keen to bring the web under control, whether in the name of security, decency or maintaining social order. Governments have not known what to make of the freewheeling internet; they will be much more comfortable dealing with a few corporations that will turn the free-for-all into something more manageable.

Governments are busy trying to get the internet under control, while traditional media companies fight a series of doomed rearguard actions against the web. The real power is passing to the cloud capitalists who are organising a digital landscape that is only just coming into view. What will get lost in all of this are the interests of citizens and consumers. Whose cloud is it anyway?

This essay is based on Cloud Culture: How the web is shaping global cultural relations, published tomorrow by Counterpoint, the think tank of the British Council.

Google's-run-in-with-China-shows-that-internet-is-now-a-real-battleground It was naive to imagine the regime would not control...
Cloud Computing Myths and Realities Download this fantastic overview here This is a fantastic and...
Google-teams-up-with-National-Security-Agency-to-tackle-cyber-attacks Internet groups fear alliance means US government could access personal...

Related posts brought to you by Yet Another Related Posts Plugin.

Google-teams-up-with-National-Security-Agency-to-tackle-cyber-attacks

admin — Mon, 15 Feb 2010 00:00:00 +0000

Provided Courtesy Of: Google's decision to enlist the help of the National Security Agency in tackling cyber attacks has caused alarm among internet groups and bloggers, who fear that users' personal information could be accessed by the US government.

The Washington Post reported yesterday that the internet giant had turned to the NSA, which conducts surveillance and codebreaking for the federal government, in the wake of a cyber attack it believes came from China.

The agency is responsible for securing the US administration's computer networks against similar breaches, and is said to be helping Google to understand and analyse the attacks.

Sources say that the agreement will not allow the NSA to view users' searches or access email accounts, but the deal has angered some members of the online community.

The Electronic Privacy Information Centre, a public research centre based in Washington, has filed a freedom of information request seeking details of the agency's relationship with Google.

“Google and NSA are entering into a secret agreement that could impact the privacy of millions of users of Google's products and services around the world,” the centre's executive director Marc Rotenberg told the New York Times.

Sam Diaz, blogger and senior editor at ZDNet, a technology website, said he felt “squeamish” about the possibility of information sharing between Google and the government, and was sceptical about the NSA's ability to help protect the company's infrastructure.

“I mean no disrespect to my country or my government but I have to ask: Is Washington really the best choice if you're looking for help with something as serious as cyber security?” he wrote.

“After all, I wouldn't exactly place any Washington agency at the cutting edge when it comes to fighting what was referred to as one of the most sophisticated cyber attacks experts had ever seen.”

Ten Innovative Ways To Use Twitter For Business

SAP Report – Six Mistakes Companies Are Making Today and How You Can Avoid Them

Andrew Beal, writing in Marketing Pilgrim, said: “Big brother just partnered with big brother.

“While it's unlikely that Google's going to hand over any user information, I still don't like how close and how quickly Google is snuggling up with perhaps the scariest of all government agencies,” he blogged.

Referring to the NSA's monitoring of the email and telephone calls of thousands of Americans after the 2001 terror attacks, Beal wrote: “This is the same agency that tapped your phones and emails without a warrant after 9/11. We're supposed to feel confident it won't take a poke around Google's sensitive data?”

Noah Shachtman, writer of Wired magazine's national security blog Danger Room, described the NSA as a “particularly untrustworthy partner”.

“We all know that Google automatically reads our Gmail and scans our Google calendars and dives into our Google searches, all in an attempt to put the most relevant ads in front of us,” he wrote.

“But we've tolerated the automated intrusions, because Google's products are so good, and we believed that the company was sincere in its 'don't be evil' mantra.”

Shachtman said Google's pledge that its agreement with the NSA would not compromise user data was “hard to believe, given the NSA's track record of getting private enterprises to co-operate, and Google's willingness to take this first step.”

The company said it was subject to a “highly sophisticated and targeted attack” in December 2009, which it said originated from China. In January, Google said that it was no longer willing to censor search results on its Chinese service.

Gmail-ups-security-after-Chinese-attack Gmail, Google's free email service, moves to encrypt by default...
David-Cameron-plans-new-centre-to-fight-cyber-attacks Tory leader also hits out at Alastair Campbell with assurance...
Google's-run-in-with-China-shows-that-internet-is-now-a-real-battleground It was naive to imagine the regime would not control...

Related posts brought to you by Yet Another Related Posts Plugin.

Gmail-ups-security-after-Chinese-attack

admin — Mon, 15 Feb 2010 00:00:00 +0000

Provided Courtesy Of: Gmail, Google's free webmail offering, is now encrypted by default as a guard against hackers, the company has announced on its Gmail blog. As the company explains, “Using https helps protect data from being snooped by third parties, such as in public Wi-Fi hotspots. We initially left the choice of using it up to you because there's a downside: https can make your mail slower since encrypted data doesn't travel across the web as quickly as unencrypted data. Over the last few months, we've been researching the security/latency tradeoff and decided that turning https on for everyone was the right thing to do.”

Of course, it also has the effect of making it very much harder for people who want to break into Gmail accounts say, government-sponsored hackers of a very large country to do so. (A properly configured https system should be proof against man-in-the-middle attacks although, as a security researcher showed last February, the problem is to get users to realise when they're being targeted.

Gmail accounts belonging to human-rights activists were targeted by Chinese hackers almost certainly with the approval of the Chinese government though Google said that only certain details about the accounts, such as the subject lines of emails and the date when the accounts were created, were compromised. Other attacks in which Gmail accounts were broken into occurred when the users' computers had “malware” secretly installed on them to steal passwords and other login details.

Google-teams-up-with-National-Security-Agency-to-tackle-cyber-attacks Internet groups fear alliance means US government could access personal...
Computer-security-fraud-fears-as-scientists-crack-'anonymous'-datasets Computer experts in the US can now identify people from...
Is-IOBit-Security-360-worth-the-risk? Martin Day is using anti-virus software from iobit.com, and wonders...

Related posts brought to you by Yet Another Related Posts Plugin.

Is-IOBit-Security-360-worth-the-risk?

admin — Mon, 15 Feb 2010 00:00:00 +0000

Provided Courtesy Of: Do you have an opinion on iobit.com? I use their anti-virus software, but I'm worried now by comments from Malwarebytes: IOBit's Denial of Theft Unconvincing. I used the software as it was on a Computer Shopper DVD, and I was using their maintenance tool, Advanced SysCare. Its “System Optimisation” really does work (my anecdotal experience on several PCs).Martin Day

In its user forum, IOBit responded with a denial of Malwarebytes' accusations and then said it had cleaned up its database “to remove all disputed data”. It is currently hosting 58 pages of debate.

But I think you should stop using IOBit Security 360 because it doesn't seem to be very good — according to this PC Magazine review — and because it's not on the VB100 list. (Virus Bulletin provides independent testing of anti-virus software.)

It's not worth taking a risk on an unknown product when there are so many good free alternatives such as Avast, AVG Free, Avira AntiVir, Microsoft Security Essentials and many more.

There's a Virus Bulletin chart that will help you choose a replacement.

I have not used IOBit's Advanced SystemCare Free, but I think Windows tuners can do more harm than good. The only one I use myself is CCleaner (formerly Crap Cleaner), which you can download free via http://www.ccleaner.com/download (If you are asked for money for CCleaner, then either you have the wrong program or you have downloaded it from a scammer. You can donate to support CCleaner but it's free.)

Advanced SystemCare Free is quite highly rated as a CNet Download so it probably is not an immediate risk. However, IOBit must know that if users don't trust its anti-virus software, then in the long term, they probably won't trust any of its software. It should aim to re-establish its credentials by getting independent verification and testing of its anti-virus software. Declarations are not enough.

This is not a news report and may contain views expressed by the author which are not supported by GNM.

Gmail-ups-security-after-Chinese-attack Gmail, Google's free email service, moves to encrypt by default...
Computer-security-fraud-fears-as-scientists-crack-'anonymous'-datasets Computer experts in the US can now identify people from...
Microsoft-patches-IE-vulnerability-but-perhaps-three-months-later-than-it-should-have-done Microsoft has released a roll-up patch that fixes the Google...

Related posts brought to you by Yet Another Related Posts Plugin.

Computer-security-fraud-fears-as-scientists-crack-'anonymous'-datasets

admin — Mon, 15 Feb 2010 00:00:00 +0000

Provided Courtesy Of: Computer scientists in the US have discovered ways to “re-identify” the names of people included in supposedly anonymous datasets.

In one example, a movie rental company released an anonymous list of film-ratings taken from its 500,000 subscribers. Using a statistical “de-anonymisation” technique, the academics were able to identify individuals and their film preferences.

The discovery raises concerns about how safe it is to release personal information such as medical records or mobile phone data even if details such as names or national insurance numbers have been removed. There are fears the information could be accessed by criminals.

The discovery has led British researchers to raise the issue in a report they are writing for the European commission. Dr Ian Brown, of the Oxford Internet Institute and a co-author, said the example of the film list was relatively trivial. “But this raises concerns for more sensitive data such as medical records. Epidemiologists say they could do interesting research if they had access to more anonymous data. This shows it is difficult to do that in a way that can't be reversed.”

One concern is that criminals could identify individuals through mobile phone data and use the information to track people's movements and find out when they are away from home. “That is one worry. Other people who you might worry about accessing that information include employers, insurers or the government. There are a whole range of potential users,” Brown said.

Experts say the discovery that lists can be “de-anonymised” needs to be included in the debate about how information is released and where to draw the line. But they also highlight the benefits of letting researchers and others access large datasets.

Last week Sir Tim Berners-Lee, inventor of the world wide web, launched a new website data.gov.uk on which members of the public will be able to access information on crime rates, exam results, house prices and more.

“They are talking about non-personal data,” said Brown. “But another thing they are looking at releasing is crime reports down to street level. You have to think about how people might be able to link that back to individuals.”

William Heath, founder of Ctrl-Shift, which specialises in how personal data are used, said: “If you take it in the light of Friday's news about data.gov.uk, the government has clearly done something really good to make public data available. Now they need a more enlightened approach to personal data, but you can't simply say anonymised data can be safely made public because it is clear how hard it is truly to anonymise data.”

Gmail-ups-security-after-Chinese-attack Gmail, Google's free email service, moves to encrypt by default...
Is-IOBit-Security-360-worth-the-risk? Martin Day is using anti-virus software from iobit.com, and wonders...
Google-teams-up-with-National-Security-Agency-to-tackle-cyber-attacks Internet groups fear alliance means US government could access personal...

Related posts brought to you by Yet Another Related Posts Plugin.

Microsoft-patches-IE-vulnerability-but-perhaps-three-months-later-than-it-should-have-done

admin — Mon, 15 Feb 2010 00:00:00 +0000

Provided Courtesy Of: As expected, Microsoft shipped patch MS10-002 yesterday to fix the Internet Explorer vulnerability that may have affected Google, gave some journalists panic attacks, and almost brought the governments of France and Germany to their knees.

The patch is important because as well as fixing a specific vulnerability that affected people running IE6 on Windows XP (two browsers and two operating systems behind the times), it rolls up several other fixes into a 9.6 megabyte package you can download here. Alternatively, a visit to Windows Update will bring the offer to install Cumulative Security Update for Internet Explorer 8 for Windows XP (KB978207) if it finds you don't have it.

The patch does require you to restart your PC, so pick a time when that's convenient. You don't really need it in a hurry unless you're still running IE6. However, it's important to install the patch even if you use a different browser, because IE components can be used by other programs or may otherwise be accessible to malware.

The patch will not actually protect companies like Google from targeted “spear phishing” attacks because Microsoft doesn't have a monopoly of security holes. You should check for other unpatched vulnerabilities on your PC by running Secunia's Personal Software Inspector, as mentioned previously in Ask Jack.

But while Microsoft has been congratulated on its openness and speed of response in releasing the patch, a blog post at The Microsoft Security Response Center (MSRC) suggests it has not been as open or as speedy as it looks. The post by Jerry Bryant says:

As we noted in our blog post yesterday, this Internet Explorer security update was already planned for release in February. When the attack discussed in Security Advisory 979352 was first brought to our attention on Jan 11, we quickly released an advisory for customers three days later. As part of that investigation, we also determined that the vulnerability was the same as a vulnerability responsibly reported to us and confirmed in early September.

In other words, Microsoft didn't so much knock out a patch at impressive speed as bring forward the fix to a vulnerability it knew about “in early September”.

OK, Microsoft, but what happened to this fix during November, December and January? If the patch had been released three months ago, maybe Google would not have been caught with its PC pants down.

There's a system of “responsible reporting” whereby security researchers tell Microsoft about security holes in advance, so it can fix them before they become widely known. It's not responsible behaviour to delay fixes for these vulnerabilities on the grounds that people don't know about them, because the bad guys could find out sooner rather than later.

Ten Innovative Ways To Use Twitter For Business

SAP Report – Six Mistakes Companies Are Making Today and How You Can Avoid Them

Yes, we know that all browsers have security flaws, and that Firefox has had plenty. However, Mozilla does appear to fix its security flaws much quicker than Microsoft, which means that the “window of vulnerability” is actually shorter. This is a good reason to use Firefox rather than IE.

If Microsoft had fixed this particular hole three months ago, it might have saved itself billions of dollars worth of bad publicity and probably a measurable loss of browser market share.

This is not a news report and may contain views expressed by the author which are not supported by GNM.

Mac-or-PC-which-is-safer-or-more-secure? An article at CNet offers a compilation of comments from...
Is-IOBit-Security-360-worth-the-risk? Martin Day is using anti-virus software from iobit.com, and wonders...
Gmail-ups-security-after-Chinese-attack Gmail, Google's free email service, moves to encrypt by default...

Related posts brought to you by Yet Another Related Posts Plugin.

Mac-or-PC-which-is-safer-or-more-secure?

admin — Mon, 15 Feb 2010 00:00:00 +0000

Provided Courtesy Of: I don't think there's much doubt about whether you're safer using Windows or Mac OS X: the answer is Mac OS X. If you want to know which is more secure, that's a different question. It's also a more complex one, because there several versions of Windows. If you want to pick on Windows XP, we know that's not secure: its failings prompted Microsoft to spend vast sums retraining its programmers in Trustworthy Computing, and to give users a more secure version free: XP SP2.

By contrast, Windows 7 has more advanced security than OS X, but whether it's safer is another matter. The fact is, Windows is much more likely to be attacked. Chris Wysopal, chief technology officer at Veracode, puts it like this: “I think the Mac is less risky, not more secure. The difference is in the threat environment. An analogy would be an unlocked house in an urban vs rural environment. Both are insecure. One, the rural, is less risky.”

Wysopal is one of the 32 security experts quoted in a CNet article, In their words: Experts weigh in on Mac vs PC security. It's a very interesting read, and it would be even better if more contributors had said which version of Windows they were talking about.

One running theme is that Mac OS X isn't attacked as much because of its small market share, but that won't last if it becomes more popular. Mikko Hypponen, chief research officer at F-Secure, says:

“Mac is more secure, simply because it has less attacks targeting it. If Mac would be targeted more, it could have exactly the same problems as PC does today.”There's two main reasons why Mac isn't targeted as much as PC:1) Smaller user base — making it less a lucrative target 2) Lazy attackers — their existing codebase and expertise is on Windows, so they keep creating more Windows attacks. Hey, if they make a nice enough living by writing malware targeting Windows XP, why change to anywhere else?”

Another theme is that attacks are moving to target the browser and other software rather than the operating system, and this may not turn out quite as well for Apple. Frank Heidt, CEO of Leviathan Security, says:

“The risk landscape for consumers (and enterprises) has changed over the last few years. Operating systems as such are no longer the primary target of consumer-targeted attacks; applications are. In light of that fact, I'd say each operating system has its benefits and liabilities. The real risks lie in the consumer's browser choice, and security habits. From a browser standpoint, I would choose Firefox over IE, and IE over Safari.”

Nitesh Dhanjani, researcher and consultant, says:

“I know Internet Explorer has had a considerable share of vulnerabilities, but the Safari Web browser also has a lousy reputation in the security community — it almost seems a child's play to locate an exploitable condition in Safari. Apple really needs to get its act together with Safari since OS X is enjoying a healthy market share climb at the moment.”

Ten Innovative Ways To Use Twitter For Business

SAP Report – Six Mistakes Companies Are Making Today and How You Can Avoid Them

In the end, however, a big part of the problem is the bit between the chair and the keyboard. As Graham Cluley from Sophos says: “Social engineering is the unifying threat that puts all computer users at risk, regardless of operating system. And that's what most threats exploit.”

Steve Manzuik, senior manager of security research at Juniper Networks, says:

“Regardless of the operating system, the easiest way for an attacker to compromise a system is by going after the application level and causing the user to click, open, or run something they should not. The trend of patches over the last couple of years from Microsoft, Adobe, and even Apple supports this. Unfortunately, you cannot 'secure' user behavior.”

This is, no doubt, true, but the Mac still has the advantage. A careless Windows 7 user will probably run into lots of ways to get attacked by malware, whereas even the most careless Mac user seems unlikely to run into any. Even if Windows 7 is more secure than Mac OS X, the Mac is still safer.

There are many more quotes ar CNet: Experts weigh in on Mac vs PC security.

This is not a news report and may contain views expressed by the author which are not supported by GNM.

Microsoft-patches-IE-vulnerability-but-perhaps-three-months-later-than-it-should-have-done Microsoft has released a roll-up patch that fixes the Google...
Is-IOBit-Security-360-worth-the-risk? Martin Day is using anti-virus software from iobit.com, and wonders...
Gmail-ups-security-after-Chinese-attack Gmail, Google's free email service, moves to encrypt by default...

Related posts brought to you by Yet Another Related Posts Plugin.

Web Application Security — How to Minimize Prevalent Risk of Attacks

admin — Fri, 27 Nov 2009 02:08:17 +0000

Download the Free Qualys Whitepaper Here

– Vulnerabilities in web applications are now the largest vector of enterprise security attacks.
– At year end, 74% of web application vulnerabilities had no available patch for remediation.

Many organizations have discovered that these attacks evade traditional enterprise network defenses unless new precautions are taken. To help you understand how to minimize these risks, This guide was written as a primer to web application security. The guide surveys typical web application vulnerabilities, compares options for detection, and introduces methods to address the issue including an on demand service that automates detection of the most prevalent vulnerabilities in custom web applications.

Stories about exploits that compromise sensitive data frequently mention culprits such as “cross-site scripting,” “SQL injection,” and “buffer overflow.” Vulnerabilities like these fall often outside the traditional expertise of network security managers.

To help you understand how to minimize these risks, Qualys provides this guide as a primer to web application security. The guide covers:

Typical web application vulnerabilities
Comparison of options for web application vulnerability detection
QualysGuard Web Application Scanning solution

Download the Free Qualys Whitepaper Here

Avoiding 7 Common Mistakes Of IT Security Compliance Download This Free Report from Qualys on The 7 Most...
Google-teams-up-with-National-Security-Agency-to-tackle-cyber-attacks Internet groups fear alliance means US government could access personal...
Is-IOBit-Security-360-worth-the-risk? Martin Day is using anti-virus software from iobit.com, and wonders...

Related posts brought to you by Yet Another Related Posts Plugin.