Microsoft is Making Windows 8 Compatible For Mobile Devices

The software industry's attention is riveted on Microsoft. Software developers from around the world have convened at a conference, called Build, in Anaheim, Calif., where Microsoft will unveil details about Windows 8, the next version of its cash-cow PC operating system. Windows 8 is on course to replace Windows 7 roughly a year from now.
This won't be just another upgrade. Windows 8 is nothing less than the linchpin to Microsoft's strategy for keeping Windows relevant — if not resurgent — as the shift to the post-PC computing era unfolds.
"The stakes are huge," says Charles King, principal analyst at research firm Pund-IT. "The company must play outside its comfort zone, but if Microsoft succeeds, the potential opportunities could be significant."
Microsoft declined to comment, preferring to reveal technical details at Build, says Frank X. Shaw, corporate communications vice president.
Traditional PCs remain by far the most widely used computing tools out there. The installed base of Windows desktop and laptop computers in use in homes and businesses globally exceeds 807 million and is projected to top 920 million next year, according to market researcher Gartner. Even so, Microsoft has fallen behind as consumers and workers begin to spend more time using touch tablets and smartphones to work, play and socialize. Sales of smartphones will soar 56%, to 467.6 million, this year, while sales of touch tablets will grow nearly four times, to 69.8 million this year, Gartner says.
Internet-connected mobile devices that respond to fingertip touches, instead of a mouse and keyboard or a keypad, are all the rage. The soaring popularity of Apple's iPhone and iPad touch tablet and Google Android smartphones have, in turn, spawned a burgeoning universe of graphical, touch-enabled software apps.
Microsoft, meanwhile, has scrambled to keep up in smartphones and has been left in the dust on touch tablets.
Yet, Windows and the ubiquitous Office clerical suite remain pivotal to the software giant's future, generating combined revenue of $41.23 billion and operating income of $26.4 billion in Microsoft's 2011 fiscal year, ending June 30. However, Windows revenue dipped 1% to $4.7 billion in the fourth quarter. For the fiscal year, Windows revenue fell 2% to $19 billion, while Windows operating profit dropped 6% to $12.3 billion.
Those slippages underscore the notion that "the post-PC world is about smartphones and tablets and their blazingly fast rates of innovation," says Scott Ellison, mobile industry analyst at IDC. "Microsoft needs to prove it can be more than a slow follower."

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Microsoft is Making Windows 8 Compatible For Mobile Devices"https://www.voiceofgreyhat.com/2011/09/microsoft-is-making-windows-8.html</a>

Microsoft Patches Serious 34 Vulnerabilities

In today's Patch Tuesday, Microsoft released 16 bulletins addressing 34 vulnerabilities in Microsoft Windows, Microsoft Office, Internet Explorer, .NET, SQL, Visual Studio, Silverlight, VML and ISA. Nine of the bulletins are rated Critical, with seven rated as Important. Wolfgang Kandek, Qualys CTO, comments: "The only bulletin with a known expoit in the wild is MS11-046, a local privilege escalation flaw in the "afd.sys" driver. IT admins can check with their end-point security providers for coverage, but should include this bulletin high on their to-do lists in any case, as it is only a matter of time until we see more attackers use malware taking advantage of this exploit to gain control of your workstations."

Here are the bulletins:-

Vulnerability in OLE Automation 
This security update resolves a privately reported vulnerability in Microsoft Windows Object Linking and Embedding (OLE) Automation. The vulnerability could allow remote code execution if a user visits a Web site containing a specially crafted Windows Metafile (WMF) image. In all cases, however, an attacker would have no way to force users to visit such a Web site. Instead, an attacker would have to convince users to visit a malicious Web site, typically by getting them to click a link in an e-mail message or Instant Messenger request.

Vulnerability in .NET Framework and Microsoft Silverlight
This security update resolves a privately reported vulnerability in Microsoft .NET Framework and Microsoft Silverlight. The vulnerability could allow remote code execution on a client system if a user views a specially crafted Web page using a Web browser that can run XAML Browser Applications (XBAPs) or Silverlight applications. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. The vulnerability could also allow remote code execution on a server system running IIS, if that server allows processing ASP.NET pages and an attacker succeeds in uploading a specially crafted ASP.NET page to that server and then executes the page, as could be the case in a Web hosting scenario. This vulnerability could also be used by Windows .NET applications to bypass Code Access Security (CAS) restrictions.

Vulnerability in Threat Management Gateway Firewall Client 
This security update resolves a privately reported vulnerability in the Microsoft Forefront Threat Management Gateway (TMG) 2010 Client, formerly named the Microsoft Forefront Threat Management Gateway Firewall Client. The vulnerability could allow remote code execution if an attacker leveraged a client computer to make specific requests on a system where the TMG firewall client is used.

Vulnerability in Windows Kernel-Mode Drivers
This security update resolves a privately reported vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if a user visits a network share (or visits a web site that points to a network share) containing a specially crafted OpenType font (OTF). In all cases, however, an attacker would have no way to force a user to visit such a web site or network share. Instead, an attacker would have to convince a user to visit the web site or network share, typically by getting them to click a link in an e-mail message or Instant Messenger message.

Vulnerabilities in Distributed File System
This security update resolves two privately reported vulnerabilities in the Microsoft Distributed File System (DFS). The more severe of these vulnerabilities could allow remote code execution when an attacker sends a specially crafted DFS response to a client-initiated DFS request. An attacker who successfully exploited this vulnerability could execute arbitrary code and take complete control of an affected system. Firewall best practices and standard default firewall configurations can help protect networks from attacks that originate outside the enterprise perimeter. Best practices recommend that systems that are connected to the Internet have a minimal number of ports exposed.

Vulnerability in SMB Client
This security update resolves a privately reported vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if an attacker sent a specially crafted SMB response to a client-initiated SMB request. To exploit the vulnerability, an attacker must convince the user to initiate an SMB connection to a specially crafted SMB server.

Vulnerability in .NET Framework
This security update resolves a publicly disclosed vulnerability in Microsoft .NET Framework. The vulnerability could allow remote code execution on a client system if a user views a specially crafted Web page using a Web browser that can run XAML Browser Applications (XBAPs). Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. The vulnerability could also allow remote code execution on a server system running IIS, if that server allows processing ASP.NET pages and an attacker succeeds in uploading a specially crafted ASP.NET page to that server and then executes the page, as could be the case in a Web hosting scenario. This vulnerability could also be used by Windows .NET applications to bypass Code Access Security (CAS) restrictions.

Cumulative Security Update for Internet Explorer
This security update resolves eleven privately reported vulnerabilities in Internet Explorer. The most severe vulnerabilities could allow remote code execution if a user views a specially crafted Web page using Internet Explorer. An attacker who successfully exploited any of these vulnerabilities could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Vulnerability in Vector Markup Language
This security update resolves a privately reported vulnerability in the Microsoft implementation of Vector Markup Language (VML). This security update is rated Critical for Internet Explorer 6, Internet Explorer 7, and Internet Explorer 8 on Windows clients; and Moderate for Internet Explorer 6, Internet Explorer 7, and Internet Explorer 8 on Windows servers. Internet Explorer 9 is not affected by the vulnerability.

The vulnerability could allow remote code execution if a user viewed a specially crafted Web page using Internet Explorer. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Vulnerability in MHTML
This security update resolves a publicly disclosed vulnerability in the MHTML protocol handler in Microsoft Windows. The vulnerability could allow information disclosure if a user opens a specially crafted URL from an attacker's Web site. An attacker would have to convince the user to visit the Web site, typically by getting them to follow a link in an e-mail message or Instant Messenger message.

Vulnerabilities in Microsoft Excel
This security update resolves eight privately reported vulnerabilities in Microsoft Office. The vulnerabilities could allow remote code execution if a user opens a specially crafted Excel file. An attacker who successfully exploited any of these vulnerabilities could gain the same user rights as the logged-on user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. Installing and configuring Office File Validation (OFV) to prevent the opening of suspicious files blocks the attack vectors for exploiting the vulnerabilities described in CVE-2011-1272, CVE-2011-1273, and CVE-2011-1279. Microsoft Excel 2010 is only affected by CVE-2011-1273 described in this bulletin. The automated Microsoft Fix it solution, "Disable Edit in Protected View for Excel 2010," available in Microsoft Knowledge Base Article 2501584, blocks the attack vectors for exploiting CVE-2011-1273.

Vulnerability in Ancillary Function Driver
This security update resolves a publicly disclosed vulnerability in the Microsoft Windows Ancillary Function Driver (AFD). The vulnerability could allow elevation of privilege if an attacker logs on to a user's system and runs a specially crafted application. An attacker must have valid logon credentials and be able to log on locally to exploit the vulnerability.

Vulnerability in Hyper-V Could
This security update resolves a privately reported vulnerability in Windows Server 2008 Hyper-V and Windows Server 2008 R2 Hyper-V. The vulnerability could allow denial of service if a specially crafted packet is sent to the VMBus by an authenticated user in one of the guest virtual machines hosted by the Hyper-V server. An attacker must have valid logon credentials and be able to send specially crafted content from a guest virtual machine to exploit this vulnerability. The vulnerability could not be exploited remotely or by anonymous users.

Vulnerability in SMB Server
This security update resolves a privately reported vulnerability in Microsoft Windows. The vulnerability could allow denial of service if an attacker created a specially crafted SMB packet and sent the packet to an affected system. Firewall best practices and standard default firewall configurations can help protect networks from attacks originating outside the enterprise perimeter that would attempt to exploit this vulnerability.

Vulnerability in the Microsoft XML Editor
This security update resolves a privately reported vulnerability in Microsoft XML Editor. The vulnerability could allow information disclosure if a user opened a specially crafted Web Service Discovery (.disco) file with one of the affected software listed in this bulletin. Note that this vulnerability would not allow an attacker to execute code or to elevate their user rights directly, but it could be used to produce information that could be used to try to further compromise the affected system.

Vulnerability in Active Directory Certificate Services Web Enrollment
This security update resolves a privately reported vulnerability in Active Directory Certificate Services Web Enrollment. The vulnerability is a cross-site scripting (XSS) vulnerability that could allow elevation of privilege, enabling an attacker to execute arbitrary commands on the site in the context of the target user. An attacker who successfully exploited this vulnerability would need to send a specially crafted link and convince a user to click the link. In all cases, however, an attacker would have no way to force a user to visit the Web site. Instead, an attacker would have to persuade a user to visit the Web site, typically by getting them to click a link in an e-mail message or Instant Messenger message that takes the user to the vulnerable Web site.

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Microsoft Patches Serious 34 Vulnerabilities"https://www.voiceofgreyhat.com/2011/06/microsoft-patches-serious-34.html</a>

Ophcrack 3.4.0 Released (Windows Password Cracker Based on Rainbow Tables)

Ophcrack 3.4.0 Released (Windows Password Cracker Based on Rainbow Tables)

After almost three years without news, here comes the version 3.4.0 of ophcrack. This will probably be the final release in the 3.x branch. It adds the support of the soon to be released XP flash and Vista eight XL tables. On Windows it also adds the support of dumping the hashes through samdump2 live using NTFS low-level access to the locked files.

Brief About Ophcrack:-

Ophcrack is a free Windows password cracker based on rainbow tables. It is a very efficient implementation of rainbow tables done by the inventors of the method. It comes with a Graphical User Interface and runs on multiple platforms. 

Features :-

•  Runs on Windows, Linux/Unix, Mac OS X, ...
• Cracks LM and NTLM hashes.
• Free tables available for Windows XP and Vista/7.
• Brute-force module for simple passwords.
• Audit mode and CSV export.
• Real-time graphs to analyze the passwords.
• LiveCD available to simplify the cracking.
• Dumps and loads hashes from encrypted SAM recovered from a Windows partition.
• Free and open source software (GPL).

To Download Ophcrack 3.4.0 Installer for both Windows & Linux click Here. If you want to get the tables to crack LM Password hashes for (Windows XP, Vista & 7) click Here.  

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Ophcrack 3.4.0 Released (Windows Password Cracker Based on Rainbow Tables)"https://www.voiceofgreyhat.com/2012/04/ophcrack-340-released-windows-password.html</a>

Microsoft offers keyboard with 128-bit encryption

Microsoft has unveiled the new Wireless Desktop 2000, a keyboard and mouse combo for $40. You can buy it now from Microsoft.com, though you should note that it requires either Windows XP (excluding Windows XP 64-bit), Windows Vista, or Windows 7. The Wireless Desktop 2000 includes Microsoft's first keyboard that features Advanced Encryption Standard (AES) 128-bit encryption – the same technology trusted by the US government to secure their wireless connections and which industry leaders consider to be one of the most secure encryption standards. AES is a unique pre-programmed 128-bit encryption key designed to help prevent your keystrokes, which are transmitted over-the-air, from being intercepted and deciphered. The keyboard also includes a pillow-textured palm rest for added comfort and caters to multitaskers with Taskbar Favorites for Windows 7.  The included Wireless Mouse 2000 features enhanced side grips, an ambidextrous design (meaning it can fit either hand), and also includes a Tilt Wheel for easy side-to-side scrolling. It uses Microsoft's BlueTrack technology, which means it can works on virtually any surface (except glass and mirrored surfaces). All of Microsoft's keyboards and mice come with a worldwide three-year limited hardware warranty.
This appears to be a decent keyboard and mice combo for the price, but the addition of encryption is puzzling. Is Microsoft trying to tap into the paranoid market?

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Microsoft offers keyboard with 128-bit encryption"https://www.voiceofgreyhat.com/2011/06/microsoft-offers-keyboard-with-128-bit.html</a>

Why did Microsoft spend $8.5bn on Skype? (Detailed Report)

In a bold move, Microsoft acquires Nokia and catapults itself to the top of the smartphone world. The full integration of Windows Phone 7 software into Nokia hardware will result in a better user experience for customers, a zero-fragmentation platform for developers, easier deployment of a smaller number of SKUs for retailers, and more reliable update management for carriers.

It's worked before. Microsoft's hardware/software integrated devices, Xbox and Kinect, are enjoying strong revenue growth and great margins: $1.9bn revenue last quarter, 50% more than last year, with 10% operating profit.

In a prepared statement, Microsoft CEO Steve Ballmer says:

I welcome Stephen Elop back into my executive staff. His brief leave of absence has allowed us to more fully explore the possibilities of combining the best smartphone hardware, Nokia's, with the best OS, Windows Phone 7. Google's anticompetitive Android free and open licensing practices unfairly tilted the playing field against our better product; they made it impossible for us to sell Windows Phone 7 software. Instead, we're now ready to do battle with Apple from a superior position: a stronger product carrying the Windows Everywhere flag, wider carrier distribution around the world, and more retail partners in US, Europe, and BRIC nations. With our acquisition of Nokia, we're now a $100bn company, back where we belong: at the top of the high-tech industry.

When I woke up, I heard a different story: Microsoft bought Skype for $8.5bn.

We all know Skype: free voice and video calls from computer to computer, plus paid services if you need to dial a phone. As Skype prepared for its long-awaited IPO, we got financial data from their S-1filing with the SEC. S-1s are always instructive: This is usually the first time a private company opens the kimono – and the SEC watches closely as you prepare to sell shares to widows and orphans.

The Profit & Loss statement in Skype's S-1 looks like this:

With revenue of $860m in 2010, Skype's operating profit is a modest $20m, with a net loss of $69m due to interest expenses stemming from $686m in long-term debt. Except for in 2008, when they saw a $42m profit, Skype has racked up huge losses, including $1.4bn in 2007 and $370m in 2009.

(Technically, these figures straddle two different corporate structures because of Skype's complicated history. Started in 2003 as an independent European company, Skype was acquired by eBay in 2005 for a price pegged between $2.6bn and $3.1bn. After the acquisition, eBay discovered its ownership of Skype was "encumbered": A crucial piece of Skype's technology was owned by another company, Joltid, which was essentially in the hands of Niklas Zennström, one of Skype's founders. eBay settled with Joltid for about 14% of Skype. This caused wags to say the crafty Skype founders sold the company twice – and it certainly didn't make the ex-management consultants running eBay look so sharp. In 2009, eBay sold 70% of Skype to private equity and venture investors in a transaction that valued the company at $2.75bn.)

Why did Microsoft pay $8.5bn – 10 times the company's revenue – for a business that has changed hands so many times, never made money, and comes with substantial debt? (Admittedly, the $686m debt number is manageable – for Microsoft).

One eloquent answer comes from Brad Horowitz, a partner at the Andreessen Horowitz venture firm started by Netscape's founder. Horowitz invokes the network effect: A large number of users attracts more users and so on, in a kind of gravitation well:

500,000 new registered users per day – 170 million connected users – 30 million users communicating on the Skype platform concurrently – 209 billion voice and video minutes in 2010

And he concludes:

Today, I tip my hat to an old rival, Microsoft. By acquiring Skype, Microsoft becomes a much stronger player in mobile and the clear market leader in internet voice and video communications. More importantly, Microsoft gets a team, ably led by the exceptional Tony Bates, that can compete with anyone.

Well, this is a nice encomium to the guys who transformed the venture firm's $50m investment in Skype a few months ago into a $150m payday. My own venture investor hat is tipped to MM. Andreessen and Horowitz.

But not so much to Steve Ballmer.

Looking at Microsoft's recent quarterly numbers, we see the continuation of a now old and getting older tradition: losses in the Online Services Division. Only a few weeks ago, TechCrunch wondered: When Will Microsoft's Internet Bloodbath End? Business Insider provided a vivid illustration for the problem:

In just the past 12 months, Microsoft has lost $2.5bn in its online business. They spend $2 to make $1 in revenue. Buying and "integrating" Skype will make the picture even redder.

So, again, why spend $8.5bn on Skype?

The official explanation is that Skype will be targeted at professional users. For these, Microsoft already has a product called Lync, although not many have heard of it. And they have Messenger for consumers. (Actually, it's Windows Live Messenger for Windows and Microsoft Messenger for the Mac.) I don't think it's unfair to ask how, how well, and when Microsoft's Grand Unified Messaging platform will effectively exist, and how it will be monetised.

Given Microsoft's track record, there isn't much evidence of its ability to perform such integration, nor of its ability to move a big platform forward at a competitive pace, certainly not faster than what Google seems able to do with Google Voice, Talk and Google Video for Business.

The theory must be that every Windows PC will come with "Skype inside". But that isn't much progress: There are already 170 million connected Skype users, and 500,000 new registrations everyday. And imagine how carriers will react when they see a Skype client bundled with every Windows Phone 7 device, further pushing them towards their preordained destination: dumb pipes.

Today, Skype is joyfully used in both consumer and business environments. It's not perfect, but the price is right and Skype is now a verb. The next thing we know, Microsoft will take a good if imperfect service and "improve" it by integrating it with Office or SharePoint (a good product on its own). And, at some point, Microsoft will try to make us pay for it. In more ways than one.

But, again, the history isn't there. Microsoft's ability to successfully charge for a formerly free product is lacking.

Reactions to the Skype deal have been negative, if not downright derisive. Many see the Skype acquisition as more evidence that Microsoft can't innovate, or even effectively copy and out-implement any more. One local exec asked, rhetorically, how much it'd take to re-implement Skype. $100m? $1bn? It's not a question of money. Microsoft spends tons in R&D: 15% of sales, about $9bn per year. (Apple spends 2% of revenue, less than $2bn.) Think of iTunes: it's been out there for close to 10 years and there's no iTunes clone coming out of Redmond. Microsoft has to buy what it no longer has the people or the culture to create – or copy.

David Pogue, the NY Times' tech guru, thinks this acquisition will go where so many went before: to failure by mediocrity and to poisoning by matrix management.

Ben Brooks, a Microsoft shareholder – and not the disgruntled kind – comments on the Skype deal and concludes: The Ballmer Days Are Over. Perhaps, but who can tackle the job of turning Microsoft around?

In last year's 30 May Monday Note, I wrote Ballmer had opened the "Second Envelope". He was running out of explanations: first blame your predecessor, then fire a few subordinates. Next, you're out of excuses and out the door.

Since then, a few more subordinates have decided to "spend more time with their families": CTO Ray Ozzie, who wrote a long, long farewell memo (don't do that, it doesn't make you look good); tablet executive Bill Mitchell; Bob Muglia, president of the server and tools division. We'll exclude Stephen Elop, the president of the business division who went on to rescue Nokia, as he might have left of his own volition – or of his seeing Ballmer looking for the next excuse.

Last year, I noted Microsoft's stock had been stagnant for almost 10 years. Things haven't improved since then:

In the past 12 months, Microsoft's stock has fallen by 11% while the Nasdaq climbed 25%, Google 7%, and Apple 44%.

Having run out of ideas and envelopes, is Ballmer spending $8.5bn of Microsoft's $50bn cash, its biggest acquisition so far, as a desperate tentative to keep the company, or himself, in the game?

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Why did Microsoft spend $8.5bn on Skype? (Detailed Report)"https://www.voiceofgreyhat.com/2011/05/why-did-microsoft-spend-85bn-on-skype.html</a>

Microsoft Plugs Internet Explorer Security Hole (Which was Exposed in A Contest)

Microsoft last week patched the last vulnerability in Internet Explorer (IE) used by a researcher in March to win $15,000 at the
The company had patched IE twice before to quash bugs exploited by Stephen Fewer of Harmony Security to bring down IE8 on Windows 7 at Pwn2Own. For his efforts, Fewer was awarded a cash prize of $15,000 and a Sony notebook.

Microsoft internet explorer Fewer chained three exploits , each for a different vulnerability, to bypass IE's sandbox, called "Protected Mode," and compromise IE8. Pwn2Own sponsor HP Tipping Point called the feat "impressive" at the time.
Microsoft patched the third IE bug in a multiple-flaw update to its browser, part of a 13-bulletin collection .
Although Microsoft credited Fewer in the MS11-057 bulletin for reporting the third vulnerability, it said the bug wasn't a security flaw. "Yes, this update addresses a Protected Mode bypass issue, publicly referenced as CVE-2011-1347," Microsoft said in response to an FAQ query, "Does this update contain any non-security related changes to functionality?"
At Pwn2Own, Fewer used the bypass bug to escape Protected Mode so he could circumvent the browser's sandbox, which allowed him to add a file to the machine, a task that mimicked a hacker's insertion of malware.

Fewer confirmed that last week's IE update fixed the final flaw he used at Pwn2Own.
"Yes MS11-057 patches the final bug, the protected mode bypass, that I used in my Pwn2Own exploit, the other two being a use-after-free which was patched in MS11-018 and an information leak patched in MS11-050," Fewer said today in an email reply to questions.

Earlier Flaws Addressed

MS11-018 and MS11-050 were the designations of the April and June bulletins, respectively, that patched the two other vulnerabilities he reported to Microsoft via Tipping Point's bug bounty program.
According to Aaron Portnoy, manager of TippingPoint security research team and the company's Pwn2Own organizer, Tuesday's IE update wraps up patching for the 2011 contest.
During Pwn2Own, Microsoft said that IE9, the browser that launched shortly after Fewer's hack, did not contain the bugs he exploited.
Including Tuesday's update, IE9 has been patched twice since its March launch. Of the August bugs Microsoft acknowledged as security issues, one was reported by Fewer.
"Yes, I have been doing some research into IE9 and actually my first IE9 vulnerability was also patched this Tuesday as part of MS11-057," Fewer said, referring to a separate bug he was credited with this week.
That flaw, dubbed "CVE-2011-1964," was reported via TippingPoint to Microsoft in May, and was ranked critical for IE9 when run on Vista or Windows 7.
Fewer wouldn't commit to taking on IE9 at next year's Pwn2Own, but he left the door open to a repeat performance. "I don't have any plans as of yet for next year's competition, but if I have a few new bugs handy closer to the time, who knows?"
August's security updates, including MS11-057 for IE, can be downloaded and installed via the Microsoft Update and Windows Update services, as well as through Windows Server Update Services.

-News Source (PC-World)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Microsoft Plugs Internet Explorer Security Hole (Which was Exposed in A Contest)"https://www.voiceofgreyhat.com/2011/08/microsoft-plugs-internet-explorer.html</a>

Security firm exploits Chrome zero-day to hack browser, escape sandbox

 French security company Vupen said today that it's figured out how to hack Google's Chrome by sidestepping not only the browser's built-in "sandbox" but also by evading Windows 7's integrated anti-exploit technologies.

Google said it was unable to confirm Vupen's claims.

"The exploit ... is one of the most sophisticated codes we have seen and created so far, as it bypasses all security features including ASLR/DEP/Sandbox," said Vupen in a blog post Monday. "It is silent (no crash after executing the payload), it relies on undisclosed ('zero-day') vulnerabilities and it works on all Windows systems."

Vupen posted a video demonstration of its exploit on YouTube.

According to Vupen, its exploit can be served from a malicious Web site. If a Chrome user surfed to such a site, the exploit executes "various payloads to ultimately download the Calculator from a remote location and launch it outside the sandbox at Medium integrity level."

Vupen used the Windows Calculator only as an example: In an actual attack, the "calc.exe" file would be replaced by a hacker-made payload.

Historically, Chrome has been the most difficult browser to hack, primarily because of its sandbox technology, which is designed to isolate Chrome from the rest of the machine to make it very difficult for a hacker to execute attack code on the PC.

For example, Chrome has escaped unscathed in the last three Pwn2Own hacking contests, an annual challenge hosted by the CanSecWest conference in Vancouver, British Columbia, and sponsored by HP TippingPoint's bug bounty program.

Last March, a team from Vupen walked away with a $15,000 cash prize afterhacking Safari, the Apple browser that, like Chrome, is built on the open-source WebKit browser engine.

But no one took on Chrome at 2011's Pwn2Own, even though Google had offered a $20,000 prize to the first researcher who hacked the browser and its sandbox.

The Vupen attack code also bypassed Windows 7's ASLR (address space layout randomization) and DEP (data execution prevention), two other security technologies meant to make hackers' jobs tougher.

Vupen said it would not publicly release details of the exploit, or the unpatched bug(s) in Chrome. "This code and the technical details of the underlying vulnerabilities will not be publicly disclosed," said Vupen. "They are shared exclusively with our Government customers as part of our vulnerability research services."

Last year, Vupen changed its vulnerability disclosure policies when it announced it would no longer report bugs to vendors, but instead would reveal its research only to paying customers.

Other security experts reacted today to the news of one or more Chrome zero-days, and to Vupen's practice of providing details only to its clients.

"I suppose that means we have a known Chrome 0-day floating around. That's fun," said Jeremiah Grossman, CTO of WhiteHat Security, in a Twitter message today.

"That also means for that the [government] is outbidding Google for bug bounties," Grossman added in a follow-up tweet.

"For now, the [government] still has more money than Google," chimed in Charlie Miller, the only researcher who has won cash prizes at four straight Pwn2Own contests.

Google, like rival browser maker Mozilla, runs a bounty program that pays independent researchers for reporting flaws in Chrome. Last month, Google paid out a record $16,500 in bounties for bugs it patched in a single update. In the first four months of 2011, Google spent more than $77,000 on bug bounties.

Google cited Vupen's policy of not reporting flaws as the reason it could not verify the French firm's assertions.

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Security firm exploits Chrome zero-day to hack browser, escape sandbox"https://www.voiceofgreyhat.com/2011/05/security-firm-exploits-chrome-zero-day.html</a>

Researcher Figure-out Yet Another Java Hole That Puts 1 Billion Users at Risk

Researcher Figure-out Yet Another Java Hole That Puts 1 Billion Users at Risk

Just as Oracle is ramping up for the September 30 start of JavaOne 2012 in San Francisco yet again another critical Java vulnerability has been spotted in the wild.  The Polish security researcher Adam Gowdiak has found another vulnerability in Java that could allow an attacker to bypass the sandbox. This newly discovered security hole has effected all latest versions of Oracle Java SE software. According to Security Explorations researcher Adam Gowdiak, who sent the email to the Full Disclosure Seclist, this Java exploit affects “one billion users of Oracle Java SE software.” So far the researcher were able to successfully exploit the vulnerability and achieve a complete Java security sandbox bypass 

in the environment of Java SE 5, 6 and 7. Researcher could only claim such an impact with reference to Java 7 environment (the 

Apple QuickTime attack relying on Issues 15 and 22 is the only exception here). 

The following Java SE versions were verified to be vulnerable:

• Java SE 5 Update 22 (build 1.5.0_22-b03)
• Java SE 6 Update 35 (build 1.6.0_35-b10)
• Java SE 7 Update 7  (build 1.7.0_07-b10)

All tests were successfully conducted in the environment of a fully patched Windows 7 32-bit system and with the following web browser applications:

• Firefox 15.0.1
• Google Chrome 21.0.1180.89
• Internet Explorer 9.0.8112.16421 (update 9.0.10)
• Opera 12.02 (build 1578)
• Safari 5.1.7 (7534.57.2)

So far there are no reports that the vulnerability is being exploited for attacks. Oracle has not said whether or when it will close the vulnerability. Here we want to remind the very recent history, when several zero day vulnerability was found in all the version of java, which was added on BlackHole Exploit kit. Later Oracle released a patch to close the security hole. 

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Researcher Figure-out Yet Another Java Hole That Puts 1 Billion Users at Risk"https://www.voiceofgreyhat.com/2012/09/Researcher-Figureout-Yet-Another-Java-Hole.html</a>

Microsoft Ending Support for Windows Mobile 6.x

Earlier this week, Microsoft announced Windows 7.1 Mango, their latest and greatest software. Well, amidst all the fanfare, the company also quietly revealed the end of support for the older Windows Mobile 6.x software, a move which will be taking place on July 15th.

This means that several things will be going down on the 15th, here are the specifics:

• “App Submission and Management. On July 15, 2011, we will no longer be accepting new Windows Mobile 6.x applications or application updates. In addition, it will no longer be possible to modify prices, metadata, or other information. However, you will still be able to remove your apps by contacting support.
• App Distribution. Even though app submission will stop on July 15, users will still be able to purchase and download your Windows Mobile 6.x applications through the Windows Marketplace for Mobile.
• App Reporting. Sales and download reports will continue to be available for your Windows Mobile 6.x applications through the App Hub after July 15.
• Developer Payouts. Developer payouts will continue to be processed in accordance with the provisions of the Windows Phone Marketplace Application Provider Agreement.”

In short, the marketplace will still be available post-July 15th but Microsoft will no longer be accepting applications for the dated software. So, if you’ve been toting a Windows Mobile 6.x device around, it might be time to start thinking about making the upgrade to Windows Phone 7, especially now that developers are being forced to abandon ship.

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Microsoft Ending Support for Windows Mobile 6.x"https://www.voiceofgreyhat.com/2011/05/microsoft-ending-support-for-windows.html</a>

Microsoft Said, Our Security is Stronger than Sony & RSA, also We are not Vulnerable to DDoS

Microsoft's John Howie claims Microsoft security is stronger than Sony and RSA which were hacked due to "rookie mistakes." The software giant also released Volume 10 of its Security Intelligence Report.

Uh-oh. There's nothing quite like throwing down the gauntlet and virtually taunting hackers to prove a proud boast is false. In what some attackers might consider a dare,  John Howie, Microsoft's senior director in the Online Services Security & Compliance (OSSC) team, basically claimed that Microsoft sites are unhackable and can't be DDoSed.

According to Microsoft, "rookie mistakes" by Sony and security firm RSA caused the corporations to be brought down by hackers. Howie told Computing News that Sony was coded badly and failed to patch its servers. "These are rookie mistakes," Howie said.  In regards to the breach at RSA, Howie stated, "RSA got hacked because someone got socially engineered and opened a dodgy email attachment. A rookie mistake."

Howie added, "At Microsoft we have robust mechanisms to ensure we don't have unpatched servers. We have training for staff so they know how to be secure and be wise to social engineering. We have massively overbuilt our internet capacity, this protects us against DoS attacks. We won't notice until the data column gets to 2GB/s, and even then we won't sweat until it reaches 5GB/s. Even then we have edge protection to shun addresses that we suspect of being malicious."

In other Microsoft security news, after analyzing 600 million computers worldwide, Microsoft released Volume 10 of its Security Intelligence Report. It  focuses on malware, software vulnerability disclosures, vulnerability exploits, and related trends. The majority of all vulnerabilities in 2010 were vulnerabilities in applications versus operating systems or web browsers. Exploiting Java vulnerabilities topped the list of exploitation categories over generic HTML/scripting exploits, operating system exploits, and document exploits. Adobe Acrobat and Reader accounted for the highest number of document format exploits. Windows 7 and Windows Server 2008 R2 had the lowest operating system infection rate for both client and server platforms. 64-bit versions of Windows 7 which "appeal to a more technically savvy audience than their 32-bit counterparts" have the lowest infection rates.

In regard to malicious websites, phishers targeted gaming sites in the first half of 2010 but then targeted social networks. Yet the "number of active sites targeting gaming sites remained relatively high during the second half of the year, which suggests that more campaigns may be coming."

According to the SIR [PDF] Global Threat Assessment graph below, in the 4th quarter of 2010, the most common threat in the USA  was miscellaneous Trojans which affected 38.6% of all cleaned computers. This was down from 43.8% in the 3rd quarter. The second most common threat was Adware which affected 28.3% of all cleaned computers and was up from 23% in the third quarter. "Miscellaneous Potentially Unwanted Software" was the third most common threat in the U.S. and affected 24.6% of cleaned computers. The MSRT detected malware on 11.6 of every 1,000 computers scanned in U.S. in 4Q10 giving the States "a CCM score of 11.6, compared to the 4Q10 average worldwide CCM of 8.7."

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Microsoft Said, Our Security is Stronger than Sony & RSA, also We are not Vulnerable to DDoS"https://www.voiceofgreyhat.com/2011/07/microsoft-said-our-security-is-stronger.html</a>

critical Chrome bugs has been patched

Google on Tuesday patched several vulnerabilities in Chrome, including two a French security company said could be used to bypass the browser's anti-exploit technology.

But Chrome 11.0.696.71, which Google rolled out yesterday to users via its automatic update mechanism, does not patch the flaw that Vupen researchers said earlier this month could be exploited on Windows 7. Tuesday's security update was the second for the Chrome "stable" build -- the most polished version of the browser -- this month. Google fixed four vulnerabilities in the update, including two rated "critical," the category typically reserved for bugs that may let an attacker escape Chrome's "sandbox." Google has patched five critical bugs so far this year. One of the remaining pair of flaws was ranked "high" -- and got the researcher who reported it a $1,000 bug bounty -- while the other was labeled "low" on Google's four-step threat scoring system. The two critical vulnerabilities were credited to Google's own security engineers. Although Google declined to confirm that the two most serious bugs could be used by attackers to break out of the Chrome sandbox, and thus plant malicious code on the computer, French security firm Vupen said that that was likely. "The vulnerabilities fixed today and related to GPU and blob handling are a typical example of critical vulnerabilities that can affect Chrome and can be exploited to execute arbitrary code outside the sandbox," said Chaouki Bekar, Vupen's CEO and head of research, in an email reply to questions. Still unpatched, said Bekar, is the bug or bugs that Vupen said its researchers found, then figured out how to exploit, earlier this month. "The recent flaws we discovered in Chrome, including the sandbox bypass, remain unpatched and our exploit code works with version 11.0.696.71, too," said Bekar. Those vulnerabilities made news earlier this month when Vupen announced it had hacked Chrome by sidestepping not only the browser's built-in sandbox but also by evading Windows 7's integrated anti-exploit technologies. Within days, several Google engineers denied that the bugs Vupen exploited were in Chrome itself, claiming instead that the French firm leveraged a flaw in Adobe's Flash, which Google bundles with Chrome. Chrome has been resistant to attack, primarily because of its sandbox technology, which is designed to isolate the browser from the rest of the machine, making it very difficult for a hacker to execute code on the computer. For example, Chrome has escaped unscathed in each of the last three Pwn2Own hacking contests, an annual challenge hosted by the CanSecWest conference in Vancouver, British Columbia, and sponsored by HP TippingPoint's bug bounty program. No other browser included in Pwn2Own has matched Chrome's record at the contest. On Tuesday, Google spokesman Jay Nancarrow declined to comment further about the Vupen exploit claims, and referred to previous statements that Google was unable to investigate the bugs because Vupen would not share details of the flaws. Last year, Vupen announced a change in its vulnerability disclosure policies, saying it would no longer report bugs to vendors -- as do many researchers -- but would reveal its work only to paying customers. According to Web measurement company Net Applications, Chrome accounted for 11.9% of all browsers used last month, putting Google's program in third place behind Microsoft's Internet Explorer, with 55.1%, and Mozilla's Firefox, with 21.6%. Chrome 11 can be downloaded for Windows, Mac OS X and Linux from Google's Web site. Users already running the browser will be updated automatically.

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">critical Chrome bugs has been patched"https://www.voiceofgreyhat.com/2011/05/critical-chrome-bugs-has-been-patched.html</a>

Windows Phone App Analyser By David Rook aka SecurityNinja

 Windows Phone App Analyser By David Rook aka SecurityNinja

David Rook, (aka SecurityNinja) has officially released Windows Phone App Analyser. Version 1.0 of the application allows for the evaluation of Windows Phone 7 .xap files and supports the automatic decompilation of the .dll files within them. The tool is inspired by static security analysis tool Agnitio, also from Security Ninja, and presents a tree view of the contents of the .xap file allowing manual review of the files; clicking on .dll files decompiles them to .cs files for viewing or passing to an automated review using CAT.NET or FxCop. 

The Windows Phone App Analyser also allows researchers to run Microsoft's own Capabilities Detection tool which works out what capabilities the app uses and allows comparison with the app's manifest declarations. 

Key Features Of Windows Phone App Analyser :- 

• Analyse Windows Phone application source code from a security point of view.

• Automatically decompile Windows Phone .xap application to easily analyse the original source code

• Launch and review results from third party scanning tools (CAT.NET, FxCop and the capabilities detection tool).

Features such as keyword editor, store paths to scanning tools so you don’t have to browse to them, option to automatically execute automated scans etc., will be included in the next couple of releases. 

For detailed information & to download Windows Phone App Analyser Click Here

 

 

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Windows Phone App Analyser By David Rook aka SecurityNinja"https://www.voiceofgreyhat.com/2012/01/windows-phone-app-analyser-by-david.html</a>

Oracle Released Emergency Update to Patch Java 0day (CVE-2012-4681)

Oracle Released Emergency Update to Patch Java 0day (CVE-2012-4681)

Zero-day vulnerabilities in Java, which was on the spotlight for last few days; takes a new direction. Several security firms have already declared that, this newly found Java exploit had been added to Blackhole, a popular hacker's tool that bundles numerous exploits and tries each in turn until it finds one that will work against a personal computer. As expected  Oracle has released an emergency update to address those zero-day vulnerabilities. This Security Alert addresses security issues CVE-2012-4681 (US-CERT Alert TA12-240A and Vulnerability Note VU#636312) and two other vulnerabilities affecting Java running in web browsers on desktops. These vulnerabilities are not applicable to Java running on servers or standalone Java desktop applications. They also do not affect Oracle server-based software.

These vulnerabilities may be remotely exploitable without authentication, i.e., they may be exploited over a network without the need for a username and password. To be successfully exploited, an unsuspecting user running an affected release in a browser will need to visit a malicious web page that leverages this vulnerability. Successful exploits can impact the availability, integrity, and confidentiality of the user's system.

In addition, this Security Alert includes a security-in-depth fix in the AWT subcomponent of the Java Runtime Environment.

Due to the severity of these vulnerabilities, the public disclosure of technical details and the reported exploitation of CVE-2012-4681 "in the wild," Oracle strongly recommends that customers apply the updates provided by this Security Alert as soon as possible.

Supported Products Affected

Security vulnerabilities addressed by this Security Alert affect the products listed in the categories below.  Please click on the link in the Patch Availability column or in the Patch Availability Table to access the documentation for those patches.

Affected product releases and versions:

Java SE	Patch Availability
JDK and JRE 7 Update 6 and before	Java SE
JDK and JRE 6 Update 34 and before	Java SE

Patch Availability Table and Risk Matrix

Java SE fixes in this Security Alert are cumulative; this latest update includes all fixes from previous Critical Patch Updates and Security Alerts.

Patch Availability Table

Product Group	Risk Matrix	Patch Availability and Installation Information
Oracle Java SE	Oracle JDK and JRE Risk Matrix	Oracle Security Alert for CVE-2012-4681 My Oracle Support Note 1486726.1. Developers can download the latest Java SE JDK and JRE 7 and 6 releases fromhttp://www.oracle.com/technetwork/java/ja vase/downloads/index.html. Users running Java SE with a browser can download the latest JRE 7 release from http://java.com/. Users on the Windows platform can also use automatic updates to get the latest JRE 7 and 6 releases.

Also Java 7 Update 7 is now available to download for Windows (32- and 64-bit), Linux (32- and 64-bit), Mac OS X (64-bit), Solaris x86 (32- and 64-bit) and Solaris SPARC (32- and 64-bit). JDKs with the updated Java runtimes are also available. Users with Java installed on their systems, whatever operating system, should install the updates as soon as possible because malicious software that uses the vulnerability is already in circulation. For detailed information click here. 

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Oracle Released Emergency Update to Patch Java 0day (CVE-2012-4681)"https://www.voiceofgreyhat.com/2012/08/Oracle-Released-Emergency-Update-to-Patch-Java-0day.html</a>