Still Loving Blog: News

Showing posts with label News. Show all posts

Mar 16, 2011

Internet Explorer 9 resmi di Rilis

Microsoft secara resmi merilis browser terbarunya Internet Explorer 9, Senin (14/3/2011) waktu AS atau Selasa kemarin WIB memanfaatkan momentum ajang konferensi SXSW Interactive (SXSWi) di Austin, Texas. Software terbaru untuk menjelajahi situs web ini diklaim lebih aman, lebih kencang, mendukung standar web lebih baik, dan paling menarik untuk komputer berbasis Windows.

"Hari ini, Web dapat menampilkan kekuatan dan kinerja dari hardware PC terbaik melalui Windows dan Internet Explorer 9," kata Dean Hachamovitch, corporate vice president Microsoft dalam siaran persnya. Internet Explorer 9 dapat diunduh dalam 40 bahasa melalui situs www.beautyoftheweb.com.

Dengan iE9, situs web dapat melakukan penyesuaian agar secara khusus dapat ditampilkan di menu Windows 7 seperti sebagai sebuah aplikasi tersendiri dengan ikon di layar memanfaatkan fitur Pinned Sites. Saat ini telah lebih dari 250 situs terkemuka di seluruh dunia memanfaatkan fitur khusus tersebut untuk menghadirkan pengalaman berbeda bagi para pengunjungnya.

Pinned Sites dan JumpList memungkinkan para pengguna menempatkan situs web secara langsung pada Windows 7 Taskbar, seperti halnya pada aplikasi-aplikasi, dan menjalankan berbagai perintah dengan mudah dan cepat terdahap situs-situs, seperti memeriksa inbox mereka, mengganti stasiun radio, menerima undangan seorang teman atau melihat berita penting. Selain 250 situs terkemuka, lebih dari 1.000 situs dan disain lainnya juga memanfaatkan fitur-fitur baru dengan Internet Explorer 9 dan Windows 7.

"Apa yang menjadi perhatian pengguna tentang Web adalah situs mereka, bukan browser mereka. Karenanya Internet Explorer 9 membuat situs mereka menjadi menarik. Browser ibarat gedung theater dan situs yang dikunjungi merupakan pertunjukannya, demikianlah Internet Explorer 9 membuatnya lebih menarik – pada situs favorit Anda," kata Ryan Gavin, senior director, Windows Internet Explorer, Microsoft.

Versi terbaru dari Internet Explorer memanfaatkan kekuatan hardware Windows PC masa kini untuk meningkatkan seluruh kinerja browsing Web. Browser ini memiliki akselerasi penuh HTML5, Internet Explorer 9 menggabungkan kekuatan Graphics Processing Unit (GPU), menggunakan 90 persen dari kekuatan PC yang sebelumnya tidak digunakan oleh web browser.

Para developer kini dapat mengembangkan situs web yang lebih cepat, lebih menarik seperti halnya pada aplikasi-aplikasi yang menggunakan interoperabilitas HTML5 atau menggunakan Adobe Flash Player dan Microsoft Silverlight, keduanya memanfaatkan akselerasi hardware dalam Internet Explorer 9 sesuai dengan versi yang berikutnya.

Internet Explorer 9 juga dirancang untuk menjadi browser yang memiliki sejumlah teknologi keamanan, privasi, dan dapat dipercaya untuk membuat konsumen lebih aman mengakses online. Microsoft telah memperkenalkan Tracking Protection di Internet Explorer 9, yang membantu pengguna mengelola data yang mereka kirim ketika mengakses web. Selain itu ada fitur PrivacyChoice, TRUSTe, Abine dan Adblock Plus. IE9 juga menyediakan download manager yang pertama terintegrasi dengan perlindungan malware SmartScreen. Beberapa studi yang dikutip Microsoft menyatakan bahwa Internet Explorer 9 menahan 99 persen dari serangan malware buatan masyarakat, lima kali lebih banyak dari Firefox dan 33 kali lebih banyak dari Chrome.

Kombinasi Windows 7 dan Internet Explorer 9, menciptakan pengalaman terbaru yang menjadikan web seperti aplikasi-aplikasi PC yang ada. Hasilnya adalah pengalaman web yang lebih baik.
source : kompas

IE 8 coming

Admin Microsoft, News 3 comments

After taking 6 years to move from version 6 to version 7, the IE team has offered the first IE8 beta barely 18 months after IE7's release.

The most important stuff includes:

- Fixes to long-standing rendering bugs, including most notably the double margin bug and skittish CSS floats
- Support for generated content
- Support for more pseudo class (i.e. :after, :before and :focus) and support for the outline property
- Much improved development tools, including a built-in, souped-up version of the IE Developer Toolbar that rivals Firebug's feature set
- A much more standardized Document Object Model (DOM), which means you won't need to write IE-specific JavaScript to make IE8 sing and dance
- The introduction of CSS table-layout support allowing you to take some of the more robust layout qualities of tables (i.e. self-equalizing columns) and apply them directly to clean, sensible markup.

For sample installation and screenshoot you can view here

Archived News:

Five things you'll love (or hate) about IE8 (blogs.computerworld.com)
Hands-on With Microsoft's IE8 Beta (washingtonpost.com)
Microsoft Releases Internet Explorer 8 Beta (pcmag.com)
IE8 will default to standard-compliant mode (arstechnica.com)
The Internet Explorer 8 beta toolbar (istartedsomething.com)

Backup your Blog

Admin News, software, Utility 5 comments

blogger backup restoration

Unlike WordPress, there’s no export feature in Blogger that can help you download or backup your blog entries and comments left by readers.

There are however some third-party options and the best among them all is Blogger Backup. This Windows utility that saves your entire Blogger posts to the disk and can easily restore them in case you accidentally delete your blog or some of the posts.

You login with your Blogger / Google account and select one of the blogs that you want to archive locally. You can either save all your blog posts to one file or let the software create new file per blog entry. It can also backup reader comments.If you ever want to recover blog posts that are in the local backup folder but deleted from the actual blog, just hit the "Restore Posts" button, select the entries and they’ll be back online in almost no time.

Blogger Backup follows the incremental backup style so if you run the software again after a week, only blog posts and comments published during this seven day period will be downloaded locally, not the entire blog.

Get Blogger Backup at CodePlex.com.

Though we covered Blogger Backup some time back , that version did not play very well with the new Blogger but this new release fixes all the previous problems and is extremely fast. Highly recommended.

Resource: Labnol.org

Mozilla Launching Firefox 3.0 Beta 1

Admin News, patch, software No comments

Mozilla Corp. Monday nov,19 has released the first beta of Firefox 3.0, but continued to warn most users to stick with production Version 2.0.

"We do not recommend that anyone other than developers and testers download the Firefox 3 Beta 1 milestone release, It is intended for testing purposes only." Mike Beltzner, Mozilla's interface designer, said in a note posted to the company's development center.

But while the official word was for users to stand clear, Beltzner's personal recommendation was a lot less intimidating. "It's a preview release, so use with caution and don't expect your add-ons to work without some magic; but between you and me, I've been running on this 'developer preview' for at least three months, and have never looked back," he said in a post to his own blog.

Beltzner also touted several of the improvements in Firefox 3.0, including new security features and tools, a redesign of the bookmarking and browser history and numerous back-end platform enhancements, but he said they all require more testing and user feedback. The company has posted a more complete list of new features in the release notes it added to its Web site Monday.

On the security side, Firefox 3.0 adds malware check, a phishing filter-like feature that warns users attempting to reach a URL blacklisted for suspected malicious code hosting; one-click site information that displays site ownership; fixes for vulnerabilities in plug-in updating; and integration with antivirus software and Windows Vista's parental control settings.

Mozilla also claimed that it has fixed more than 300 individual memory leaks and added a new cycle collector to eliminate other memory issues. Firefox has a reputation for leaking memory -- consuming large quantities the longer it's left running, and ultimate slowing down its host computer -- although some of its developers have contested the claims, and even pegged the problem as one of perception.

Most current Firefox plug-ins -- Mozilla calls them extensions -- will not work with Firefox 3.0, a stumbling block for some who might otherwise want to test the preview. "Users of the latest released version of Firefox should not expect their add-ons to work properly with this beta," the beta's release notes read.

Firefox 3.0 Beta 1 can be downloaded for Windows, Mac OS X and Linux in 21 language versions from Mozilla's site.

DOWNLOAD FIREFOX 3.0 BETA 1

Novell BorderManager Client Trust Buffer Overflow Vulnerability

Admin News, patch, security, vulnerabilities No comments

Secunia.com 2007-11-01 , release at their website a vulnerability has been reported in Novell BorderManager, which can be exploited by malicious people to compromise a vulnerable system.
The vulnerability is caused due to the Client Trust application incorrectly processing validation requests sent to the UDP port on which clntrust.exe is listening (by default 3024). This can be exploited to cause a heap-based buffer overflow by sending a specially crafted validation request containing a Novell tree name without backslash or zero wide characters.

Successful exploitation allows execution of arbitrary code.

The vulnerability is reported in Novell BorderManager 3.8. Prior versions may also be affected.

Solution : Download patch from Vendor
(http://download.novell.com/Download?buildid=AuOWp2Xsvmc~)

6 Related Secunia Security Advisories

1. Novell BorderManager Unicode Encoding Detection Bypass
2. Novell BorderManager ISAKMP Predictable Cookie Security Issue
3. Novell BorderManager VPN Denial of Service Vulnerability
4. Novell BorderManager Proxy Potential Denial of Service
5. Novell Bordermanager VPN Service Unspecified Denial of Service
6. Novell BorderManager 3.7 SP2 fixes multiple issues

Other Release at 2007-11-01 from Secunia.com

New tools help hack into iPhone

Admin Apple, Hack, News 4 comments

By Robert McMillan

New tools help hack into iPhone

HD Moore, one of the developers of the Metasploit hacking software, is supporting the iPhone within the Metasploit framework and providing tools to run 'shellcode' prompts

iPhone hackers have some new tools now, thanks to HD Moore, one of the developers of the Metasploit hacking software.

On Tuesday, Moore announced that he was supporting the iPhone within his Metasploit framework and released software that would allow hackers to run "shellcode" command prompts on Apple's mobile device.

By integrating the iPhone into Metasploit, it will now be a little easier for hackers to gain access to someone else's iPhone, but they will also need a few other tools to succeed. First, they will need to create working exploit code, which takes advantage of bugs in Apple's software, to trick the device into running the shellcode. They will also need to create more sophisticated "payload" applications that can do things like remotely connect with the hacker. "It's a first step," Moore said of his hack.

With iPhone prices dropping and noticeable improvements in the quality of iPhone hacking tools, Apple's phone has become a more interesting target of late, Moore said.

And the iPhone has obviously hit a nerve in the security community. Moore said that about a quarter of the attendees at the recent Black Hat conference in Las Vegas had the devices. "It's trendy," he said. "It kind of creeped me out when I saw how many people had iPhones when I went to Vegas."

In fact, hackers have already developed a number of exploits that they claim could be used on the iPhone's Safari browser.

And security researchers have even demonstrated how the iPhone can be compromised. In July, a Baltimore, Maryland, company called Independent Security Evaluators showed how it could run unauthorized software on an iPhone by taking advantage of a Safari bug.

Moore believes that the iPhone's browser and mail client will be the best sources of bugs and he said that because of the components and information stored on the phone, it may end up being a more attractive target than the PC.

For example, the phone could be used to track someone's location based on information from cell phone towers. Throw in the iPhone's microphone, camera, and an Internet connection, and you suddenly have a device that could be used to secretly keep tabs on people, Moore said. "If you look at what you get by exploiting someone's iPhone, you actually get a lot more than you do from someone's PC a lot of the time," he said.

Sabotaging Google

Admin google, News, security No comments

John C. Dvorak - PC Magazine

A reader, Courtney Cox (no relation to the actress), recently pointed out to me that the top results of recent complex Google searches turned out to be inane Chinese sites that were not even parking sites, just an assortment of keywords that somehow got indexed and brought to the top of the results list. After seeing a few of these sites, I have to wonder what's going on. Is it sabotage?

Let's start by showing you a typical site: http://vmk.wtoxd.cn/xmijotb.html (there's some annoying Active X here. So visit at your own risk). This site was the top result listed when the search term "reset mp3 player m240d" was entered. And here are the full search results , in which nine of the top ten results are these weird Chinese sites.

Courtney sent me numerous examples of this phenomenon, and it's obvious that the more specific and detailed the search request, the more likely Google is to list these Chinese sites. The issue has apparently been reported to Google, but if the basic algorithms allow this sort of result, even banning the specific sites will not stop this sort of abuse.

Right now the motives behind this phenomenon are obscure, unless it's being done just for testing purposes. You know, like underground nuclear testing.

I'm reminded of some news reports I read in The New York Times as I was doing some Civil War–era research in old copies of the paper circa 1860 to 1870. At that time, the telegraph was the hot technology, and it was being built out all over the country using telegraph poles and wires strung everywhere. During this era it was not uncommon for one of the telegraph companies to chop down the poles and cut the wires of another telegraph company. There were constant news stories about it, and this sort of thing still exists. It's no different than a phone company "accidentally" unhooking a competitor's DSL rig in the central office during the burst of open-access activity in the 1990s.

I remember my first visit to China 20 years ago, listening to the long lectures about how China intends to become a capitalist nation. The Chinese liked to say they were going to emulate American capitalism. Ever since then I wondered what that meant. Would it mean chopping down telegraph poles? The American way? —next: Gaming the System

When I see this sort of site at the very top of a list of Google results, I wonder how hard it would be to scuttle Google by gaming the system. I don't think Yahoo! or even Microsoft has thought of this. But if not, why not? Perhaps one of the two companies is indeed behind the Chinese sites. Who would know?

We do already know that Google is susceptible to Google-bombing and click fraud. Now we have this. We also know that Google's search results include far too many parking sites. So many, in fact, that there are brokers who will turn all your domains into parking sites for a revenue split. You've all seen these parking sites. Many are done as typo sites: Mistype a URL and you wind up at some site that is nothing more than links to various shopping and search sites that generally have nothing to do with anything. In some instances, these sites appear on the first page of Google search results. As far as I'm concerned, they should not appear at all. And while they're an eye-rolling nuisance to readers of PC Magazine, you can be certain that multitudes of rubes using the Internet think that they're real sites.

As Google gets bigger and more dominant, you can be certain that the competition will come up with some way to ruin Google and make it simply unusable. I have to assume that these Chinese sites, which serve no purpose other than to scramble Google, are a step in that direction.

On that note, I should add that entering "reset mp3 player m240d" on Yahoo! yielded worse returns, with all the results being weird Chinese sites—including one that tried to load a Trojan (caution!!) that AVG killed immediately. When the same search terms were used on MSN, there were no results at all.

Vista Infected By Virus Stoned.Angelina

Admin Microsoft, News, security, virus, vista, vulnerabilities 4 comments

New Info

A batch of laptops pre-installed with Windows Vista Home Premium was found to have been infected with a 13-year-old boot sector virus.

Those of you with a long memory will vividly recall the year 1994: Nirvana's lead singer Kurt Cobain died, South Africa held its first multi-racial elections, and Tony Blair became leader of the Labour party. Oh, and Microsoft's operating system was the quaint, pre-NT Windows for Workgroups.

Click here to find out more!

But it was a year that also saw the arrival of a boot sector computer virus known as Stoned.Angelina which moved the original master boot record to cylinder 0, head 0, sector 9.

It would appear that this teenage virus has not yet been consigned to the history books.

According to Virus Bulletin , the consignment of infected Medion laptops – which could number anything up to 100,000 shipments – had been sold in Danish and German branches of retail giant Aldi.

The computers had been loaded with Microsoft's latest operating system Vista and Bullguard's anti-virus software, which failed to detect and remove the malware.

Although the infection itself is harmless, Stoned.Angelina will undoubtedly have left Microsoft and Bullguard execs blushing with embarrassment about the apparent flaws in their software which allowed an ancient virus to slip through the back door.

On its website Bullguard offered some reassurance to Medion customers hit by the virus:

"Stoned.Angelina is a low-risk boot virus that infects the MBR (Master Boot Record) of hard disks. This is a very old virus. Apart from its ability to spread from computer to computer, it carries no payload (damage) to the systems it infects."

It added that the virus commonly spreads by being booted from an infected floppy disk, and causes no damage to the operating system.

Virus Bulletin technical consultant John Hawes said: "This is a reminder that old viruses never really die.

"Malware that's been off the radar for years often pops up when least expected, after someone digs out an old floppy or boots up an ancient system, and security firms have a duty to maintain protection against older threats for just this kind of eventuality."

Original source

Novell Client For Windows Vista

Admin Microsoft, News, software, vista 1 comment

Novell Netware now support Windows Vista , you can download Vista Client here or Click on image

System requirements

The Novell Client for Windows Vista is supported on the following platforms:

* Windows Vista Business (x86 or x64)
* Windows Vista Enterprise (x86 or x64)
* Windows Vista Ultimate (x86 or x64)

The Novell Client for Windows Vista might run but is not supported on Windows Vista Starter, Windows Vista Home Basic, and Windows Vista Home Premium editions. This Client will not run on Windows XP, 2000, or 2003.

Key features

* Support for Novell Open Enterprise Server (OES) 1, OES 2, NetWare 5.1/6.0/6.5
* File system integration with NSS and non-NSS volumes via NCP
* Login script processing
* Notification area (Red N) options
* Integrated login with Windows Vista (single username and password)
* NMAS™ client integration
* Forgotten password recovery options
* LDAP contextless login support
* DFS junctions
* Support for 802.1x wireless authentication
* DHCP options
* OpenSLP support
* Shell extensions for Windows Vista�s file browser
* File caching/shared open mode support
* Auto-reconnect
* Cluster failover support
* Property pages, NCIMAN, and updating Client settings

Apple iTunes Music File Buffer Overflow Vulnerability

Admin Apple, News, security, vulnerabilities 1 comment

According to Secunia.com , a vulnerability has been reported in Apple iTunes, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to an unspecified boundary error when processing album cover art. This can be exploited to cause a buffer overflow via a specially crafted music file.

Successful exploitation may allow execution of arbitrary code.

The vulnerability is reported in versions prior to 7.4.

Solution : Update your iTunes Software to version 7.4.

iTunes 7.4 for Mac:
http://www.apple.com/support/downloads/itunes74formac.html

iTunes 7.4 for Windows:
http://www.apple.com/support/downloads/itunes74forwindows.html

1. Apple iTunes Music File Buffer Overflow Vulnerability
2. Apple QuickTime Multiple Vulnerabilities
3. Apple QuickTime Java Extension Two Vulnerabilities
4. Apple QuickTime Java Extension "toQTPointer()" Code Execution
5. Apple QuickTime Multiple Vulnerabilities
6. Apple Quicktime RTSP URL Handling Buffer Overflow Vulnerability
7. Apple QuickTime Plug-In Local Resource Linking Weakness
8. Apple QuickTime Multiple Vulnerabilities
9. Apple iTunes AAC File Parsing Integer Overflow Vulnerability
10. QuickTime Multiple Code Execution Vulnerabilities

Hacks let the iPhone roam

Admin Apple, Hack, News, vulnerabilities 1 comment

George Hotz, a 17-year-old resident of Glen Rock, NJ, announced on his blog on Thursday that he had found a way -- with the judicious use of a soldering iron and tools to erase and rewrite the firmware -- to unlock the iPhone. Hotz outlined the steps on his blog and is selling the phone on eBay.

"I'm sorry about how hard they are to follow, but someone will get them to work, and simplify them, and simplify them more," he said of the ten steps his method requires to unlock the phone. "Hopefully a software unlock will be found in the near future."

Unknown to Hotz, that's exactly what has happened. A group calling itself IPhoneSimFree has claimed to have unlocked the iPhone just via software -- a claim that has been verified by mobile-device news site Engadget. By unlocking the phone, the group claims that any provider can be used in any country.

Video - Strom Site

Admin Hack, News, security, spyware No comments

F-secure was make nice video about Strom Site.

The Zhelatin/Storm Gang has been very busy lately. Their spamming tactics have changed from sending an attachment to sending a link that directs recipients to an IP Address. The HTML used by their sites is variable, and also differs depending on the browser.

The video is available via F-secure YouTube Channel.

Apple says iTunes sales top 3 billion songs !

Admin Apple, article, News No comments

Apple company, which makes the market-leading iPod digital media player, said iTunes has sold more than 3 billion songs since its launching four years ago, media reported Wednesday.

The milestone came just six months after iTunes, Apple Inc.'s online music download service, surpassed the 2 billion tracks-sold mark. The service was launched in April 2003 and, until February 2006, sold its first 1 billion songs.

ITunes has surpassed Amazon.com Inc. and Target Corp. to become the third-largest music retailer in the United States, according to media reports.

The iTunes catalog contains over 5 million songs, 550 television shows and 500 movies.

Apple's line of iPod portable music players has been key to iTunes' popularity.

In April, Apple company said it had sold more than 100 million iPods. It reached that milestone in the five and a half years since the first iPod was sold.

Perhaps most importantly, Apple offered not just the downloading service but also the hardware for managing music collections.

"They've made it brain-dead simple to buy, download and move content around onto iPods, computers and now iPhones," said Gartner analyst Mike McGuire.

Analysts refers to this as the digital music "ecosystem," which comprises the hardware, software and downloading service. Each plays a role in giving Apple a leading share of the digital music world.

Source:Xinhua/people.com

Microsoft Windows URI Handling Command Execution Vulnerability

Admin Microsoft, News, patch, vulnerabilities 1 comment

A vulnerability has been discovered in Microsoft Windows, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to an input validation error within the handling of system default URIs with registered URI handlers (e.g. "mailto", "news", "nntp", "snews", "telnet"). This can be exploited to execute arbitrary commands when a user e.g. using Firefox visits a malicious website with a specially crafted "mailto" URI containing a "%" character and ends in a certain extension (e.g. ".bat", ".cmd")

Examples:

mailto:test%../../../../windows/system32/calc.exe".cmd
nntp:../../../../../Windows/system32/telnet.exe" "secunia.com 80%.bat

Successful exploitation requires that Internet Explorer 7 is installed on the system.

The vulnerability is confirmed on a fully patched Windows XP SP2 and Windows Server 2003 SP2 system using Firefox version 2.0.0.5 and Netscape Navigator version 9.0b2. Other versions and browsers may also be affected.

Solution:
Do not browse untrusted websites or follow untrusted links.

Read more here

BETA test the new Secunia Personal Software Inspector!

Admin News, security, software 1 comment

The Secunia PSI detects installed software on your computer and categorises it as either Insecure, End-of-Life, or Up-To-Date. Effectively enabling you to focus your attention on software installations where more secure versions are available from the vendors.

Highlights of The Secunia PSI:

* The Secunia PSI will be available free of charge
* Calculates your unique Secunia System Score
* Automatically scans your computer
* Enables you to update Insecure/End-of-Life software
* Provides Direct Download Links to security updates & patches
* Detects and advises on more than 4,200 applications
* Direct correlation between thousands of Secunia Advisories and your specific system and software
* Secure SSL encrypted connection to Secunia

How does the Secunia PSI work

The Secunia PSI works by examining files on your computer (primarily .exe, .dll, and .ocx files). These files contain non-specific meta information provided by the software vendor only. This data is the same for all users, and originates from the installed programs on your computer - never from their configuration. Please read the privacy statement available at the bottom of this page and through the Secunia PSI application for more details about how information from your computer is used by Secunia.

After examining all the files on your local hard drive(s), the collected data is sent to Secunia's servers, which match the data against the Secunia File Signatures engine (https://psi.secunia.com/) to determine the exact applications installed on your system.

This information can then be used to provide you with a detailed report of the missing security related updates for your system.

System Requirements:

The current list of requirements that must be met for the Secunia PSI to function correctly are the following:

Supported Operating Systems:
* Microsoft Windows XP - Service Pack 2
* Microsoft Windows 2003
* Microsoft Windows 2000 - Service Pack 4
* US and European languages only
* Learn more
Download the free PSI BETA from the Secunia website:

iPhone, Apple PCs vulnerable to hackers: consultant

Admin Apple, News, security 3 comments

The iPhone and Apple Inc.'s desktop computers may be vulnerable to hackers due to a flaw in their Web browser, according to a security firm, which said it found a way to hack into the iPhone.

Baltimore-based Independent Security Evaluators, which tests its clients' computer security by hacking it, said on Monday that three employees found a way to take control of iPhones through a Wi-Fi link or by tricking users into going to a Web site.

Charles Miller, principal security analyst at the firm, said a security weakness allows someone to take control of Apple's Safari Web browser and see other applications on the device at the same time, which could potentially make users of Macintosh desktop computers vulnerable to attacks.

"The same problem actually exists on Apple's desktops," said Miller. But he added that while his firm had identified the risk for both desktops and phones, it had written only the code necessary to hack into the iPhone.

The security consultants, who took about a week and a half to work out the move, said they were able to take control of an iPhone and make calls or send text messages, as well as access e-mails, voice-mail, address books and call and Web browsing history.

Miller said his company gave details about the hack and a potential security patch to Apple, but did not publicly release the details.

"We're looking into the report submitted by (Integrated Security Evaluators) and we always welcome feedback on how to improve our security," Apple spokeswoman Lynn Fox said.

Miller said Apple could have avoided the risk by eliminating links between the browser and other applications.

"It turns out that on the iPhone there are probably some basic things they could have done that would have made it better," said Miller.

The claim comes more than three weeks after Apple and AT&T Inc. (T.N: Quote, Profile, Research) started selling Apple's first cell phone, which includes a music and video player as well as a Web browser.

As many as 700,000 iPhones were sold on the first weekend after the June 29 launch, according to analyst estimates.

Days after launch, a well-known hacker Jon Johansen, claimed to have overcome restrictions on the iPhone, allowing highly technical users to bypass AT&T's network to use the phone's Internet and music features.

While cell phones have not historically been as vulnerable to attack as desktop computers, some experts worry that phones take on greater risks as they add more computer-like features.

Miller said he had not looked into security on other mobile phones to see how they compare to the iPhone, but said the more complex a system is, the greater the likelihood is that it will have problems.

source: reuters.com

New Sophos Security Threat Report Reveals Record Number of Web-Borne Attacks During 2007

Admin article, News, security No comments

Sophos Reveals Sharp Rise in Web Threats, and Uncovers Latest Trends in Viruses, Spyware and Spam

Sophos, a world leader in IT security and control, has published new research on the first six months of cybercrime in 2007. The Sophos Security Threat Report examines existing and emerging security trends and has identified a sharp increase in the number of web threats, as well as the countries and server types hosting the most infected sites.

The first half of 2007 has seen a significant increase in threats spread via the web, which has surpassed email as the preferred method of attack for financially motivated cybercriminals. In June alone, Sophos’s global network of monitoring stations uncovered a record number of infected web pages - approximately 29,700 - each day. In contrast, earlier in 2007, only as few as 5,000 malicious pages per day were detected.

Sophos blocks access to millions of web pages to protect customers from malware and inappropriate content. Taking a snapshot of just one million of those web pages, experts found that 28.8 percent were hosting malware. An additional 28 percent were blocked due to the adult nature of their content, most commonly because they were pornography or gambling sites. Pages created by spammers accounted for 19.4 percent and 4.3 percent were classed as illegal sites, including phishing sites or those peddling pirated software. Of the websites containing malicious code, just one in five had been designed specifically for malicious activity, with the remaining 80 percent made up of legitimate sites that have fallen victim to hackers.

APACHE IS THE MOST COMPROMISED SERVER

By compromising a single file on a web server, cybercriminals can easily and quickly cross-contaminate a huge number of websites, as the infected file may form part of a plethora of unrelated pages, all of which are published from the same server.

The breakdown of the world’s top server types affected by web threats in the first six months of 2007 reads as follows:
1. Apache 51.0%
2. Microsoft IIS 6 34.0%
3. Microsoft IIS 5 9.0%
5. nginx 3.0%

Other 3.0%

The fact that more than half of all infected web pages were hosted on Apache servers demonstrates that infection is not simply a Windows problem. Earlier this year, during a global ObfJS attack, in which legitimate sites were compromised so that they could serve up a malicious code, 98 percent of affected servers were running Apache - many of which were hosted on UNIX rather than Windows platforms.

“Website infections have increased significantly in the past six months. The number of infected sites has grown more than five times since January,” said Ron O’Brien, Boston-based Sophos senior security analyst. “As 80 percent of those sites are legitimate, it makes you wonder why more action is not taken to help prevent such attacks. Simple measures such as keeping up to date with security patches are one of the most effective ways to prevent infections on servers.”

TOP WEB-BASED THREATS OF 2007 - SO FAR

The top 10 list of web-based malware hosted on these infected sites during the first six months of 2007 reads as follows:
1. Mal/Iframe 49.2%
2. Troj/Fujif 7.9%
3. JS/EncIFra 7.3%
4. Troj/Psyme 8.3%
5. Troj/Decdec 6.9%
6. Troj/Ifradv 4.1%
7. Mal/ObfJS 2.5%
8. Mal/Packer 1.5%
9. VBS/Redlof 1.1%
10. Mal/FunDF 0.9%

Other 10.3%

Mal/Iframe, which works by injecting malicious code onto web pages, dominates this chart, accounting for almost half of the world’s infected URLs. Furthermore, it shows no sign of abating - in a recent potent attack, more than 10,000 web pages were infected, the majority of which were on legitimate web pages hosted by one of Italy’s largest ISPs.

MOST INFECTED WEB PAGES HOSTED IN CHINA

The top 10 list of countries hosting malware-infected web pages during the first half of 2007 reads as follows:
1. China 53.9%
2. United States 27.2%
3. Russia 4.5%
4. Germany 3.5%
5. Ukraine 1.2%
6. France 1.1%
7. Canada 0.8%
8. United Kingdom 0.7%
9= Taiwan 0.6%
9= South Korea 0.6%

Other 5.9%

China, which at the end of 2006 hosted just over a third of all malware, has now overtaken the U.S., and in the first six months of 2007 was responsible for hosting more than half of all web threats reported to Sophos. China’s dramatic rise in the chart is primarily due to widespread Mal/Iframe infections on Chinese hosted web pages. In fact, more than 80 percent of the country’s compromised web pages are infected with this malware.

HACKERS TURN TO PDFS AND REMOVABLE DRIVES TO COMMIT CYBERCRIMES

The first half of 2007 has seen cybercriminals using attachments in spam messages. To avoid detection by less sophisticated gateway filtering products, there is a growing trend for spammers to use PDF files carrying a graphical version of their marketing message, in their attempt to reach potential customers.

Hackers have also taken advantage of users who have “auto-run” enabled on their Windows PC to automatically execute malicious code as soon as an infected removable flash drive is attached to the computer. Notable examples this year were the LiarVB-A worm, which spread information about AIDS and HIV via USB keys, and the Hairy worm, which claimed that teen wizard Harry Potter was dead. However, neither threat became widespread and both could be protected against by using up-to-date anti-virus software at the desktop.

”Using attachments to spread malware has decreased in the last few years, however, because PDF attachments are so trusted, they will remain high on the list for spammers looking for the file type most likely to be opened,” said O’Brien.

EMAIL STILL A CAUSE FOR CONCERN

Email threats continue to cause concern for businesses and, although they have become eclipsed by web-based threats, the actual amount of email-borne malware has remained constant during the past year. The proportion of infected email during the first half of 2007 was 1 in 337, or 0.29 percent of all messages. More than 8,000 new versions of the Mal/HckPk threat were seen during 2007, as it was used to disguise widespread email attacks like Dref and Dorf.

More information about the latest trends in malware, spyware and spam can be found in the complete version of the latest Sophos Security Threat Report, which can be downloaded from: http://www.sophos.com/securityreport

A journalist-specific edition is available from: http://www.sophos.com/securityreportjul2007

McAfee set to launch Rootkit Detective application

Admin News, security, software No comments

Security software maker McAfee has announced that they would soon launch a new software product named Rootkit Detective.

This new product has been designed to detect and remove dangerous rootkit attacks. The company claims that this application would help end-users ward off the threats. It would also be used to provide the company information relevant information to company’s ongoing research operations.

This application would complement their existing offering SiteAdvisor which warns the users about potentially unsafe websites on the web. McAfee said that Rootkit Detective will be offered at no charge from its Web site via download.

Rootkit Detective has been designed to find hidden kernel processes and registry entries. They would be removed when the system is restarted the next time.

It would also be able to test the integrity of a PC’s kernel memory and track any modifications that might also highlight rootkit activity. They have already provided a beta version of the application which is being tested by thousands of users worldwide.

Joe Telafici, vice president of operations at McAfee Avert Labs added in a statement on this new product: “Dealing with rootkits will always be an arms race; the whole process is a game of challenge-and-response between the hackers and security community, and as the authors have advanced the complexity of their attacks, we need to continually update our own technologies to keep up. We started putting rootkit detectors into our products in 2006, and this is the next stage in advancing our detection technologies.”

Checkout: McAfee Rootkit Detective

Secunia Personal Software Inspector now available for BETA Testing

Admin News, security, software 1 comment

How safe is your computer from software vulnerabilities? Do you have the latest patches and upgrades for your programs? Is your browser uptodate? How about your media player? Test the free Secunia Personal Software Inspector (PSI) BETA to find out!

“The free Secunia Personal Software Inspector is the next evolution of the Secunia Software Inspector series”, says Thomas Kristensen, CTO of Secunia. “Like the Software Inspector and the Network Software Inspector, it is designed to inspect what software you have on your computer, whether you have the latest version and security patches, and if not, how you can upgrade to the latest safe version”.

“We really felt that there was a need to make the average user aware of the dangers of leaving your applications unpatched”, says Kristensen. Most Windows users are aware of Microsoft Patch Tuesday, he adds, because it is heavily marketed and it notifies you in a userfriendly way that you need to take action.

However, Patch Tuesday only covers Microsoft products and not the very large number of equally dangerous vulnerabilities discovered in other software. Most people aren’t aware of these issues, or don’t want to spent hours every month hunting for the relevant information about security updates.

“Our idea to solve this is to make all this information available through a userfriendly interface to make it as easy as possible for people to check the security patch status of their software”, Kristensen adds.

Secunia is offering the PSI as a free tool for private individuals as part of our effort to make browsing the Internet a safer activity.

Users are invited to take part in BETA testing the Secunia Personal Software Inspector. The BETA version can be downloaded from: https://psi.secunia.com/

Both the BETA and final versions of the PSI are free. The final version will also be available from the Secunia website.

“We really want to highlight the emerging issues of private consumers not being aware of the possibility that their sensitive data can be exposed through their personal computer when applications are left unpatched”, says Kristensen. Patching applications, Kristensen adds, ensures that you are protected against currentlyknown software vulnerabilities and attack vectors from online criminals.

However, with the dozens of programs you have on your computer, trying to keep up with each upgrade is practically impossible. To do so would require you to spend a lot of time checking vendor websites and surfing the Internet for news on software vulnerabilities, and this just isn’t very feasible.

The PSI does all that for you, and more. With a click of the mouse, the PSI identifies the installed software on your computer, and determines which ones are secure, and which ones aren’t. It then tells you where you can download updates to turn your nonsecure software to secure software, making the transition from vulnerable computer to secured system as easy as 123. And did we mention it’s free?

To ensure that your computer is thoroughly inspected for vulnerable software, you just need to follow these three simple steps: Step 1 is to download the PSI from https://psi.secunia.com and run it on your personal computer. Step 2 is to check the inspection results for applications marked as “Insecure” and “Endoflife” (meaning they are no longer supported by the vendor). Step 3 is to check the vulnerability information to see where you can download the secure software version.

The PSI detects more than 4,200 different applications and versions, ensuring that whatever software you have installed in your system is monitored by Secunia for software flaws, security patches, and updated versions.

The final version of the PSI will also be though the Secunia websites, thirdparty download sites, and globally present partners. Our partners, who also share our concern regarding the rising level of unpatched applications, will be capable of distributing an easytouse tool compared to their current alternative of advising their users/customers to manually keep all applications patched.

Securityoriented organisations that cater to consumer needs, such as ISPs and banks, can also take advantage of the PSI to better inform their subscribers and account holders about the necessity of online security.

To detect what software you have on your network, Secunia uses its File Signature technology, which is composed of carefully programmed rules used to identify installed applications, and their exact versions on Windowsbased systems.

To detect if your software version is the latest nonvulnerable version available from the vendor, the Software Inspector uses Secunia Advisory Intelligence technology, which Secunia has been providing to the global IT community for over four years.

Secunia’s commercial services include vulnerability advisories and analysis, exploit code, binary analysis, and file signatures. The complete Secunia File Signature database contains more than 110,000 rules for detecting more than 4,200 unique applications and their exact versions.

To know more about the services that Secunia can provide for you and your company, please go to http://corporate.secunia.com.

Press Contact Information:

Thomas Kristensen, CTO

pr@secunia.com

Phone: +45 7020 5144

Fax: +45 7020 5145

New launching software - µTorrent mUI

Admin News, software No comments

µTorrent is one of the several free BitTorrent client available on the Windows platform. It became popular because of its small size and smaller memory foot print.

The software has been designed to be light on the system and has become one of the most popular torrent client on the Windows platform.

The developers of this excellent software sometime back unveiled the first public beta of µTorrent’s WebUI.

This application enables the user to control the µTorrent application running on a machine through the web interface from anywhere in the world as long as they have access to the internet.

The latest news is that a mobile based version of this web interface to control the µTorrent application is scheduled to release today.

This new project has been named µTorrent mUI and it would be released in a beta version. They developers claim that the interface would work with any mobile with an internet web browser.

Checkout: µTorrent mUI

Mar 16, 2011

Mar 21, 2008

Archived News:

Feb 23, 2008

Nov 21, 2007

Nov 2, 2007

6 Related Secunia Security Advisories

Other Release at 2007-11-01 from Secunia.com

Sep 28, 2007

By Robert McMillan

New tools help hack into iPhone

John C. Dvorak - PC Magazine

Sep 21, 2007

New Info

Sep 8, 2007

System requirements

Key features

Sep 7, 2007

Related Article :

Aug 25, 2007

Aug 4, 2007

Aug 3, 2007

Jul 27, 2007

Jul 26, 2007

Blog Archive

Popular Posts

Exchange Link

My Traffic

About Me

Followers