Windows 7 RC's bi-hourly shutdowns begin on Monday

J
ust a quick heads up for those who signed up to run the Release Candidate (build 7100) version of Windows 7 and never upgraded to the final code: get going with that or prepared to be annoyed. Starting this Monday, March 1st, besides showing an expiration notification on the taskbar, your system will start to shut down every two hours and any unsaved work will be lost in the process.

Those brave souls who ignore the "reminders" and work their way around the shutdowns will face one more phase in the expiration process. On June 1, if you are still on the Windows 7 RC, your license will expire and the non-genuine experience will be triggered. This means Windows will boot to a black desktop and users will still have to deal with the constant notifications and bi-hourly shutdowns.

As annoying as all this may sound, especially for those who have been running the test release as their main installation, we can't say Microsoft wasn't clear about the whole expiration process from the get go.

That said, if you need some more time to back up your stuff there is a little-known (and perfectly legal) way to extend your RC license as many as 90 more days -- just open a command prompt window with administrator privileges, enter "slmgr -rearm" (minus the quotes) and reboot. The 'trick' can be used up to three times and each will give you 30 days to go grab a legal copy of Windows 7 and upgrade.

Read more...

High school uses notebook webcams to spy on students

T
he parents of a Lower Merion high school student have filed suit against the district for using school-issued laptops to spy on kids. The school rigged notebooks with software that lets officials remotely view and capture images with the built-in camera -- a mechanism that was supposedly greatly misused. The plaintiff's child claims to have been disciplined in school for "improper behavior" at home, and the Vice Principal used a photo taken by the webcam as evidence.

In a statement yesterday, Superintendant Dr. Christopher McGinley confirmed that the laptops indeed have a "security feature" to track missing systems. The "feature" can take a "still image of the operator and the operator's screen," but McGinley said it has been deactivated, and will not be reactivated without express written notification. He also insisted that the feature has only been used to locate lost, stolen or missing laptops.

Students involved in the suit have contacted Gizmodo with details about the situation. It's said that the green lights next to the kids' laptops often turns on, suggesting it's in use, but the district claims it's just a glitch. One student questioned a school IT guy about the light, who said it was occurring because "people logged out when an application using the camera was on." The employee also admitted that the school could in fact look through the webcam, but it would violate law.

Read more...

U.S. authorities close in on Chinese Google hackers

U
.S. authorities have reportedly tracked down the hacker who wrote the code behind the attacks on Google and a number of other local companies last month. Serious questions had already been raised about the likelihood of the attacks being in some way sanctioned by the Chinese government, and today's development seems to further back that notion.

Turns out the alleged hacker is a Chinese "freelance security consultant in his 30s" who had published extracts of his IE6 exploit code as a work in progress. Although this man did not launch any attacks himself, according to The Financial Times, Chinese officials have "special access" to his work and are believed to have picked up the code.


The spyware's launch was recently traced to computers at Shanghai Jiaotong University and Lanxiang Vocational School, the first of which counts former government cyber security experts among its staff. Both institutions have denied involvement in the attacks, of course. The latest findings don't give a definite answer as to who was behind the attacks, but it might put some extra pressure on China to cooperate with the ongoing investigations.

Read more...

Fake antivirus software posing large security threat to users

W
ith the Internet evolving, the security risks users face on a day-to-day basis have become increasingly complicated. Security vendors are the most aware of this, challenged with protecting people's PCs from ever-expanding threats without turning a computer into an inert hunk of plastic. Their most difficult challenge yet may be one that has began to emerge relatively recently, in the form of fake anti-virus suites that try to convince people they are real -- usually to bleed money from them.

Just how big of a problem are fake anti-virus programs, though? Comparing 2008 to 2009, there has been a reported five-fold increase in the number of fake A/V detections. The primary reason for this right now is cited as a constant-changing checksum on a tainted piece of software, leading to hundreds of thousands of variants -- making it more difficult to detect amongst a wide array of machines. One particular security group, APWG, believes that as this evolution of fake software continues, the demand placed on real anti-virus scanners may become overwhelming.

One of the real problems, they noted, is that most software today relies on signature-based detections. Software which changes itself on a per-download basis is easily able sneak past this. It's further complicated because many of these fake programs often try to use a bit of social engineering to accomplish their goals -- convincing people they are real, which would get past virtually any software protection. APWG also indicated that the number of machines being infected year by year is actually going up, as opposed to going down. Are malicious software writers getting that much better, or are security vendors slipping? It has always been an interesting battle to watch -- unfortunately, end users are caught in the middle.

Read more...

AVG touts faster scans and new features with AVG 9.0

H
ot on the heels of Microsoft's Security Essentials launch last week, AVG Technologies is unveiling a major update to its free and paid internet security products which the company claims brings much faster scan times as well as a number of under-the-hood improvements.

Responding to customer feedback the security firm has reportedly put special focus on improving the user experience and ease of use. As a result, version 9.0 is said to be "up to 50 percent" faster than its predecessor, thanks to more sophisticated caching techniques and memory use. Boot times have also been reduced by around 10 to 15 percent and overall the installation process on the full-fledged suite has been shortened from 22 screens to 11.

In addition to the anti-phishing protection offered through LinkScanner, AVG 9.0 now also includes additional protection against identity theft in the physical world (for US customers only) with the AVG Identity Theft Recovery Unit (ITRU). Meanwhile, firewall enhancements include a complete redesign and a new cloud-based white listing database to reduce the amount of user input required to secure a PC.

Both AVG Internet Security 9 and AVG Anti-Virus are available now for a one-year license of $49.99 and $34.99, respectively. The main difference between the two is that AVG Anti-Virus lacks the firewall, identity protection, anti-spam, and system tools that come in AVG Internet Security. As always, a cut-down free version will also be available but starting from mid-October.

Read more...

Zero-day Windows Vista, 7 vulnerability discovered

M
icrosoft is looking into a zero-day vulnerability today, which reportedly affects systems running Windows Vista and 7. Researcher Laurent Gaffie said that a hacker could exploit the flaw on Windows 7 to cause a critical system error. The flaw lies in a Server Message Block 2 (SMB2) driver.

Gaffie said in a blog post yesterday, "SRV2.SYS fails to handle malformed SMB headers for the NEGOTIATE PROTOCOL REQUEST functionality." People who have commented on his blog post are reporting that the exploit can not only lead to denial of service, but also remote code execution.


Gaffie has contacted Microsoft, and it has since responded by saying that it is investigating the issue but that it is "unaware of any attacks trying to use the claimed vulnerability or of customer impact." The H has successfully tested the proof-of-concept code, which caused a reboot on Vista -- but did not work on Windows 7.

Read more...

Worm attacks WordPress blog software

S
erving as a stern reminder of why it's important to keep desktop as well as server software up to date, a new worm can reportedly infect certain versions of the WordPress blog software. WordPress announced the discovery today, saying that a security bug which has already been fixed is now being exploited in the wild.

The worm is able to attack versions of WordPress prior to 2.8.4 and its immediate predecessor. Version 2.8.4 was released in early August to specifically address this flaw, which results in a password reset of WordPress accounts and allows someone to take control of the admin account. Doing so would give the person access to further information, as well as the ability to wreak havoc on the blog itself.

Though the vulnerability was initially published several weeks ago, this is the first report of malware specifically identifying and trying to exploit it. The WordPress developer is concerned that many servers are still running old versions, which puts them at risk. If you're maintaining a WordPress server that's behind on updates, consider this a heads up.

Read more...

Microsoft Office Build 4417 leaked

 A
s usual, when Microsoft has a new operating system or productivity suite on the assembly line, the public domain has a front seat show. Microsoft Office 2010 Build 4417 has reportedly hit the Web with some minor tweaks and improved stability.

According to Neowin, the most noteworthy change to Build 4417 is that Redmond has fine-tuned and polished the Back-Stage view feature. The latest leak packs a new upload center to store and share documents online, a new activation system, and updated icons. Users are reporting that the uninstall issues of a previously leaked Mondo build have been corrected, and the current version can be uninstalled.

Microsoft Office 2010 first leaked to torrent sites back in May, and Microsoft pushed out a technical preview on July 13. I have no doubt there will be many more unofficial builds to come. If you're going to partake in that scene, be careful of shady sources -- it's not uncommon for these leaks to be laced with malware.

Read more...

Microsoft: Xbox 360 failures "well behind us"

M
icrosoft has responded to the recent survey being passed around the Web. Consisting of 5,000 Consumerist readers, the controversial poll suggested that around 54% of the participants experienced at least one Xbox 360 failure - 41.2% said they had at least two go kaput.


According to Xbox Live and Xbox 360 director of product management Aaron Greenberg, while issues inundated the early 360 production lines, things have since improved. "I can tell you the consoles we're making today have lower-heat chips and better cooling, and we're seeing fantastic quality in those consoles today," Greenberg said.

He said that the early problems were acknowledged, and Microsoft responded by introducing an extended three-year warranty for anyone who is faced with the infamous Red Ring of Death or E74 error. Greenberg continued by adding that with the strides taken by Microsoft, he feels like most of the problems are well behind them.

What have your experiences been with the newer Xbox 360 models?

Read more...

YouTube to pony up for popular content

Y

ouTube has modified the policy of its partnership program in a way that they hope will make money for both them and content submitters. The site is planning to increase the number of ads that accompany its viral videos. Just yesterday, we reported that the popular video sharing service was looking to turn a profit by baiting new advertisers.

The updated model looks simple on paper. YouTube will contact owners of videos that explode in popularity and ask if they'd like to show ads on the content. YouTube will then split the revenue with the content owner. The exact ratio for the split hasn't been disclosed, but according to YouTube spokesman Aaron Zamost, "very popular videos can make thousands of dollars a month."

Prior to this plan, only the most prolific users were invited to participate in the YouTube Partnership Program. Under that program, select users are raking it in. Back Stage mentions a 16-year-old boy known as "Fred," who earns six figures a year. The change makes it possible for one-hit wonders to profit considerably.

Read more...

New attack cracks WPA Wi-Fi encryption in just a minute

E

ncryption systems used by wireless routers have had a long history of security problems. The Wired Equivalent Privacy (WEP) system was cracked and rendered effectively pointless within a few years of its introduction in 1997. Now, it looks like its WPA successor may soon suffer the same fate, with a pair of Japanese researchers developing a way to break it in just one minute.

The attack builds on the so-called "Becks-Tews method" unveiled last year by researchers Martin Beck and Erik Tews. However, that method worked on a smaller range of WPA devices and took between 12 and 15 minutes to carry out. Both attacks work on WPA systems that use the Temporal Key Integrity Protocol (TKIP) algorithm. They aren't key-recovery attacks -- but give hackers a way to read encrypted traffic sent between computers and certain types of routers that use the outdated encryption system.

The Wi-Fi Alliance has required since 2006 that Wi-Fi-certified products support WPA 2, a much more powerful encryption system that is not vulnerable to these attacks, but users have been slow to upgrade.

The two researchers, Toshihiro Ohigashi of Hiroshima University and Masakatu Morii of Kobe University, are to discuss their findings at a conference in Hiroshima this September 25 but you can read some details now in their paper, "A Practical Message Falsification Attack on WPA" (PDF).

Read more...

Microsoft increases Office anti-piracy measures

Y

ear after year, Office turns out to be Microsoft's biggest software cash producer. Beyond Windows and any other single suite, Office is what makes Microsoft scads of dough. Given the relative high cost of the suite, it's no surprise that Office is also one of the most pirated pieces of software in the world. Hoping to curb losses incurred from rampant piracy, Microsoft is introducing some new countermeasures to the newest versions of Office.

The new anti-piracy measures aren't aimed at single users, however. Microsoft isn't losing sleep over the people torrenting Office or pilfering a burned copy from a friend - instead, it is the counterfeiting involved. The software giant is concerned about knockoff copies in cloned packaging. As pirates get more professional, black market copies of Office look more like the real thing - preventing people from determining whether or not a piece of software is genuine.

To accomplish this, Microsoft is expanding "Office Genuine Advantage," a branch of the same anti-piracy arm that most Windows users are familiar with. Primarily, they are increasing how far OGA is available worldwide, and will pass it off as a Windows Update. While at first that may seem like a small act, it's actually a pretty large one - since counterfeiting is a worldwide issue, and Microsoft has largely focused on only certain regions of the world.

Whether or not nagging users with duped software is effective, Microsoft doesn't say. However, their anti-piracy efforts have increased exponentially with time. How much farther will Microsoft (or any software vendor, for that matter) go to prevent their code from being stolen?

Read more...

Anti-malware feature quietly slipped into Snow Leopard?

D

ue Friday the 28, Apple's next version of OS X, 10.6 Snow Leopard, may contain an antimalware function of sorts. A report from Mac security firm Intego came yesterday that early testers of the new OS have unearthed some form of bundled-in malware prevention tool.

Neither the firm or users are entirely sure how the function works, but a screenshot shows the feature working with a file downloaded via Safari. The antimalware tool detected a version of the RSPlug Trojan horse in a downloaded disk image.

This is an interesting discovery, considering Apple's long-held stance that PCs are insecure and virus-riddled, whereas Macs "just work." This message is endlessly propagated in Cupertino's "Get a Mac" campaign, where they portray Macs as being trouble-free in the malware department.

While that may be largely true, most would argue that OS X is no more secure than any other operating system, it's just less circulated. With Microsoft Windows installed on 90-plus-percent of computers, it's the obvious target of malware authors.

Read more...

Google fixes two critical Chrome flaws

Without much fanfare, Google has pushed out an update for Chrome that will seal up two vulnerabilities which could have posed a serious risk. The flaws, present in the V8 JavaScript engine that Chrome relies upon, could result in data compromise or even worse, total system compromise through code execution.

One flaw pertained to potentially fraudulent HTTPS sessions, and the more dangerous of the two could be triggered simply by visiting a maliciously-crafted page with certain XML content. Google has pushed out version 2.0.172.43 of Chrome already, making it available for download to anyone who uses Chrome. If you haven't updated already, it's a good idea to snag it.


Interestingly, Google is crediting how they discovered the flaws. Mozilla's security team was apparently responsible for alerting Google to one problem, and a security researcher was credited with discovering the other. That may be only a small note, but it is encouraging to see browser developers working together in some fashion.

Read more...

Microsoft fights Word sales injunction

M
icrosoft has filed an “emergency motion” to stay a judge’s ruling that threatens to prevent the company from selling its widely used word processing application. The issue boils down to a custom XML function in Microsoft Word 2003 and 2007 that allegedly infringes on a patent held by Canadian firm i4i. Although Redmond claims it is expending enormous human and financial capital to come up with modified versions, failing to do so within the court’s 60-day deadline could potentially keep Word and even Office off the shelves for months.






In its motion, Microsoft asked an appeals court to halt that injunction and also to speedily hear the company's appeal once it is filed. The software giant argues that the patents in question are invalid and furthermore claims the injunction could cause "irreparable harm" to the software giant's business and to its partners.

The stakes are high and alternative productivity suites such as OpenOffice.org or even Google Docs certainly would love to capitalize on this. There are a few possible outcomes, though, and somehow I doubt Office ceasing to be available is one of them. Microsoft could still buy some time with the appeal to work on non-infringing versions of Word or perhaps reach an out-of-court settlement with i4i.

Read more...

Microsoft: Dropping IE6 support not an option

Despite enthusiastic efforts around the world to move on to something better, IE6 is unlikely to go anywhere for a long time. Numerous alternatives exist, from Microsoft themselves, Mozilla and others, but while the software giant would like to see IE6 gone as much as anyone else it's still up to users to make the final decision to upgrade.






A post on the IEBlog touched on this topic recently and basically concludes that dropping IE6 support is simply not an option, for a variety of reasons. One of these includes the substantial user base that clings to the old browser, which still represents millions of web-connected users. Another and arguably more important reason is the commitment level Microsoft has to maintain.


They are stuck with the fact Windows XP shipped stock with IE6, and they have an obligation to continue supporting it for the lifetime of the product. That's a problem for Microsoft since extended support for Windows XP – and thereby IE6 – continues for another five years.

We're talking just Microsoft here, of course. Any other company around the world can choose to support whomever they wish – YouTube will soon drop support for IE6, most web developers cater exclusively to IE7 or higher and many other sites are urging users to upgrade as well. Ultimately, IE6 will die, but it is clear that Redmond expects that death to be slow and painful.

Read more...

Symantec Fail on Virus Buletin Test....???

Virus Bulletin has released its August 2009 test results for Windows Vista SP2 Business. The company examined 35 anti-malware products and put them through their paces. In order to pass the basic requirements of the test, applications must detect all malware known to be "In the Wild" while not presenting any false positives. The products are tested in their default settings and must succeed in both on-demand and on-access detections.






Virus Bulletin threw the programs in a ring with around 3,000 unique samples of malware spread across four categories: Polymorphic viruses, Trojans, WildList viruses and Worms/bots. Of the 35 tested, only 23 passed, meaning about a third of the products fell to the tests. Among the more known solutions is Symantec's Endpoint Protection, which missed two infections on the Wildlist.

Symantec was quick to defend itself in response to Ars Technicia's original coverage of the Virus Bulletin tests. A company spokesperson said that "In the past ten years, Symantec has earned 44 consecutive VB100 awards, something no other vendor has come close to matching." They went on to add that the missed malware is an "extremely rare replicant of a highly polymorphic file infecting virus" and that they have since fixed the issue in their signatures.

You can check out the test in full on Virus Bulletin's website, although I believe you need a subscription. Ars Technica has created a condensed list of the results which you can view after the jump.

Read more...

Microsoft readies five critical fixes for Patch Tuesday

M
icrosoft is lining up nine updates for next Tuesday as part of its monthly patch cycle – five of them are deemed critical and the remaining four marked as important. Affected software includes various Windows and Microsoft Office versions as well as the .NET Framework, Visual Studio, Microsoft ISA Server, Microsoft BizTalk Server, and Windows Client for Mac.


This particular security update will likely raise a few eyebrows among IT professionals, since Microsoft recently issued fixes for Visual Studio and ISA Server – the first as part of an out-of-bound patch last week and the latter in last month’s update. The advance notification is light on details, as usual, but warns that the flaws could lead to remote code execution, elevation-of-privilege and denial-of-service attacks.

Read more...

Facebook/Twitter/LiveJournal Service Attack Targeted at Georgian Blogger

A
ll day Thursday three social media sites, Facebook, Twitter, and LiveJournal, were victims of distributed denial of service attacks (DDoS). It first started with Twitter and then moved to the others. Facebook initially didn’t say it was hit by a DDoS in its first press release but then later said: “Earlier this morning, Facebook encountered network issues related to an apparent distributed denial of service attack, that resulted in degraded service for some users [...] No user data was at risk and we have restored full access to the site for most users. We’re continuing to monitor the situation to ensure that users have the fast and reliable experience they’ve come to expect from Facebook.” Users on Facebook earlier in the morning, including myself, noticed pop-up error messages while doing simple tasks like viewing photos and commenting.







Twitter also released a statement saying, “As we recover, users will experience some longer load times and slowness.” As of this morning, Twitter seems to be back up and running as usual with only slight hiccups.

It may not be a coincidence that all three social media sites were attacked at almost the same time, but hopefully we’ll find out more soon.

Read more...

Comcast adopts DNS hijacking, cashes in on bad URLs

In a bid to squeeze out more cash through their existing service, one of the largest ISPs around has added themselves to the ranks of companies participating in controversial DNS-redirecting programs. Comcast has officially begun redirecting invalid DNS requests to their own “search portals,” which are advertising pages intended to capture anyone who makes a typo or visits an invalid address into a web browser.




The technique is slowly being adopted by other ISPs around the world, and has been rife with controversy since the beginning. Essentially, anytime a user tries to visit an invalid web page, they are redirected to an advertising splash page rather than being told that the page is unavailable. As most other ISPs are doing, Comcast is offering an opt-out system – though there have been complaints that the process is not particularly friendly. Other ISPs around the world that have begun implementing this include Bell Canada, Verizon, and EarthLink.

Several years ago, Verisign, a major domain registrar, attempted to implement this. Their attempt received massive public outcry, and ultimately even ICANN stepped in and asked them to stop. Comcast has even gone a step beyond their cohorts, pushing for a new IETF standard that would make such DNS hijacking more legitimate.

Read more...