Microsoft's holiday bonus: Fixes for 40 flaws - Computerworld

Computerworld - Microsoft today patched 40 vulnerabilities in Windows, Internet Explorer (IE), Office, SharePoint and Exchange, including nine pegged "critical."

Five of the 17 security updates -- Microsoft calls them "bulletins" -- fixed long-standing flaws that could be used by attackers to plant malware on a PC by tricking Windows into thinking a malicious DLL (dynamic link library) was actually a legitimate part of the OS.

Only two of the 17 updates were judged critical, Microsoft's top-most threat ranking in its four-step scoring system. Another 14 were marked "important," the second-highest rating, while the remaining update was labeled "moderate."

Microsoft put the spotlight on the two critical bulletins, as did several security experts.

"Both MS10-090 and MS10-091 are pretty critical, I think," said Andrew Storms, director of security operations for nCircle Security. "Microsoft's evaluation seems in line with what I would expect, and shows that they're giving a pretty fair and balanced representation of priorities."

Amol Sarwate, manager of Qualys' vulnerabilities research labs, agreed with Storms, putting those updates at the top of his list, too.

MS10-090 patches seven vulnerabilities in IE, six of them critical and one marked moderate. All supported versions, including 2009's IE8, are affected by one or more of the bugs. IE9, which is still in beta testing, does not harbor any of the seven vulnerabilities, Microsoft said in its advisory.

Among the patched IE bugs were three that had been publicly disclosed before today, and one that hackers have been exploiting for at least the last six weeks.

Microsoft confirmed the latter on Nov. 3 in a security advisory, but was unable to craft and test a patch in time to make it into that month's security update.

MS10-091, which in Microsoft's eyes is a Windows update, also affected browsers -- but not IE directly.

Instead, attackers could exploit the three vulnerabilities in the update -- all rated critical -- through non-Microsoft browsers that support the open-source OpenType font format by simply tricking users into visiting a malicious site.

Microsoft did not list the affected browsers, but the other four of the top five -- Firefox, Chrome, Safari and Opera -- all support OpenType fonts.

It's unclear today whether those browsers need to be patched separately, and if so whether they have been patched. For its part, Microsoft said it had reached out to the other browser makers to let them know about the OpenType bugs it was addressing.

Opera Software, whose security team co-reported one of the three OpenType vulnerabilities to Microsoft, said that other browsers did not need repair.

"The patch for Opera is the referenced Microsoft [MS10-091] patch, as it is not possible for the [browser] to protect itself against the problem, except by disabling webfonts, since the problem is in the OS's handling of fonts," said Thomas Ford, an Opera spokesman.

Is it possible to eliminate the impact of distance? This paper explores the 5 key principles successful CIOs are using to redesign IT infrastructure of any size. Learn how to be prepared to adapt your environment in a way that supports distributed employees, anytime anywhere collaboration and the need for business continuity during a disaster.

Read now.

Learn what BMC Software's chief information officer foresees for the future of the cloud.

Read now.

Discover how to increase employee engagement and productivity across your enterprise, even in a tough economy. This Alcatel-Lucent paper, featuring research from Gartner, shows how implementation of context-aware technology can ensure collaborative communications and build competitive advantage.

Read now.

View the original article here

Microsoft's Kinect Already Hacked? - PC Magazine

Has someone already won the $2,000 bounty for delivering open-source drivers that work with Microsoft's recently released Kinect motion-tracking system? Odds are looking good!

Here's the background. Adafruit Industries announced a $2,000 prize last week for anyone who managed to hack into the Kienct in an effort to unlock the device for use with hardware other than the Xbox 360. In short, here's the official challenge: "Upload your code, examples and documentation to GitHub. First person / group to get RGB out with distance values being used wins, you're smart – you know what would be useful for the community out there. All the code needs to be open source and/or public domain."

Well, user AlexP over at the NUI Group Community Forums has posted a video that appears to show a Kinect being controlled via a standard PC interface. That's the only background we have so far, so it remains to be seen whether the potential submission will actually fulfill all the criteria of Adafruit's contest.

Nevertheless, one thing is certain: Microsoft won't be very happy about the results.

"Microsoft does not condone the modification of its products," said a company spokesperson in an interview with CNet. "With Kinect, Microsoft built in numerous hardware and software safeguards designed to reduce the chances of product tampering. Microsoft will continue to make advances in these types of safeguards and work closely with law enforcement and product safety groups to keep Kinect tamper-resistant."

So why the challenge? Adafruit is hoping that the Kinect's "radar camera," as Make magazine senior editor Phillip Torrone puts it, can be unlocked for use with robotics. But as for specific purposes, the sky's the limit—Nintendo's gyroscopic Wii Remote, after all, has been transformed into everything from a VR head-tracking device to the controller of a 15-ton robotic arm.

View the original article here

Dell's Windows Phone 7 Switch: Good for Microsoft's Enterprise Hopes? - eWeek

Is Windows Phone 7 slated to become the next big enterprise device?

That becomes a more pressing question following news that Dell plans on dumping Research In Motion's BlackBerry from its corporate offices, in favor of Windows Phone 7 devices manufactured by the company. Within hours of that news leaking online, RIM responded with some biting commentary:

"We find it highly unlikely that they will actually save any money with this move and far more likely they were looking for a little free publicity," Mark Guibert, RIM's senior vice president of corporate marketing, wrote in an e-mail to Dow Jones Newswires.

In a Nov. 5 interview with The Wall Street Journal, Dell Chief Financial Officer Brian Gladden indicated that the company's switch will save around 25 percent on mobile communication costs, and that negotiations had begun with T-Mobile to carry corporate voice and data.

Dell's Venue Pro includes a 4.1-inch multitouch display and sliding QWERTY keyboard. Fronted with ultra-durable Gorilla Glass, it closely resembles RIM's BlackBerry Torch 9800, which also includes a sliding keyboard. The difference, of course, is the Venue Pro's Windows Phone 7 operating system.

Whether Dell made the switch to promote its own smartphone line or if it decided that ejecting RIM indeed translated into substantial cost savings, other large businesses are likely to debate whether to embrace Windows Phone 7 for their executives and workers.

Some analysts believe that, while Windows Phone 7's tight integration with features such as SharePoint offers a lot to the enterprise, the platform does have an Achilles' heel. "It will be hard for apps to be ported unless they are already Silverlight-compatible or built-in standard .Net mobile protocols," Jack Gold, primary analyst for J. Gold Associates, wrote in an Oct. 11 research note. "The majority of enterprise apps are not."

That being said, Gold added, businesses could find a lot of benefit in the Windows Phone 7 platform. "Business users [are] at the core of the previous Windows Mobile constituency, but many have defected over the past year," Gold wrote. "It is unclear whether Microsoft can win them back, or even keep the existing, albeit significantly diminished, base of enterprise users." Despite that, he added, "the business hub on WP7 looks compelling (provided you are an Exchange/Outlook user)."

Microsoft seems aware of the need to push Windows Phone 7 as a business device, having announced at several points its intention to include productivity-centric features such as cut-and-paste into future editions of the software. It has also been encouraging developers to build work-style apps for the platform. 

"Critics have commented on the lack of specific features like copy & paste and lack of 100s of thousands of new applications," Arpan Shah, Microsoft's director for SharePoint, wrote in a Nov. 4 posting on his corporate blog. "And while both are true, copy & paste will be available as an update in a matter of weeks (early 2011) and as for applications, it's just a matter of time."

Shah's blog posting suggests the timetable for the feature's addition is still on track. While early critics focused on that missing cut-and-paste, Windows Phone 7's first iteration will also lack support for tethering, Adobe Flash and full multitasking.  

To be fair, despite its hold on the enterprise market, the BlackBerry also lacks a large number of apps?at least in comparison to the Apple iPhone or the growing Google Android family of devices. Businesspeople have traditionally gravitated toward RIM's offerings because of their messaging abilities and reputation for security. But Microsoft wants Windows Phone 7 to appeal on those fronts as well; a substantial part of the company's marketing push, particularly its television ads, portrays the smartphones as the ultimate timesavers?at least when it comes to using mobile features. And its "Office" and "People" hubs have been designed to feed information to users in a tightly integrated, streamlined way.

But whether Dell represents the first of many companies to jump to Windows Phone 7 remains to be seen. Microsoft doubtlessly hopes that's the case. RIM most likely doesn't.

View the original article here

Microsoft's Head Is in the Clouds - TechNewsWorld

It was pretty much all about the cloud at Microsoft's (Nasdaq: MSFT) Professional Developers Conference, held last week at its Redmond, Wash., corporate campus.

CEO Steve Ballmer and other executives spoke about how the software giant's latest developments span the PC, the mobile phone and the cloud.

They also highlighted the revamp of Windows Azure as a PaaS (Platform as a Service) offering, pushing it as a next-generation operating system.

Microsoft further used the occasion to unveil major changes in its browser with the release of IE9 Platform Preview 6 for developers.

It's not clear, however, what effect its ramped-up push into the cloud will have on the software giant's competitive position in the short term.

At PDC 2010, Microsoft positioned Windows Azure as a PaaS. A PaaS lets users set up the platform they heed - -- the hardware, operating systems, IT infrastructure and tools -- automatically on the cloud, instead of having to physically source some or all of these components.

Microsoft announced Virtual Machine Role, as well as Server Application Virtualization -- two new Windows Azure capabilities that will make it a PaaS.

Virtual Machine Role lets users run an instance of Windows Server 2008 R2 on Microsoft's cloud. This lets developers move their apps to the cloud more easily.

Server Application Virtualization lets devs transfer app images to Windows Azure.

Microsoft also announced Windows Azure services, which let developers create rich cloud apps. One is the Windows Azure AppFabric Composition Model. The model provides critical application deployment and management capabilities that help devs assemble services more quickly.

Another service is the Windows Azure Marketplace. This includes DataMarket, previously codenamed "Project Dallas." The Windows Azure Marketplace offers premium (for-pay) and public content, including demographic, financial, mapping and entertainment data. It was launched Friday and has more than 35 content providers offering data subscriptions.

Microsoft also introduced the Extra Small Widows Azure Instance for developers. This is priced at 5 US cents per compute hour.

"This emphasis on the cloud is likely Ray Ozzie's signature contribution to Microsoft, and it looks like he actually did an impressive job of getting a lot of folks who don't normally work together to cooperate," Rob Enderle, principal analyst at the Enderle Group, told TechNewsWorld.

"I think the impact is going to be positive for Azure," John Barnes, chief technology officer at Model Metrics, told TechNewsWorld. "We're going to evaluate it because we're hearing more and more positive things about it."

However, Microsoft may find the going tougher than expected. "Depending on the enterprise, there's still some skepticism about the cloud," Barnes said.

It will be five to 10 years before people fully accept moving everything to the cloud, he added.

Microsoft did not respond to TechNewsWorld's requests for comment by press time.

As for IE9, the next version of Microsoft's browser, the focus is strongly on HTML5. The company is working on interoperability, committing to the W3C and the standards process. The IE9 beta has been downloaded 10 million times since it was launched about six weeks ago, Microsoft said.

Microsoft on Friday made IE9 Platform Preview 6 available for developers at IETestDrive.com. This preview offers better performance and quality, as wel as increased standards support.

For example, IE9 now supports CSS3 2D transforms. It also supports full hardware acceleration.

"IE9 is the only browser in the market that is 100 percent hardware accelerated," Enderle said. "The others haven't been able to pull this off yet, and it's a huge improvement over IE8 as a result."

Although Microsoft's pushing of hardware performance will slow down adoption of IE9 at first, it will appeal to those who buy new hardware and are most likely to buy other devices, Enderle pointed out. "It's called going where the money is, and this practice is more consistent with Apple's (Nasdaq: AAPL) practice than it is with Microsoft's," he added.

"Microsoft's seen what happened with Google (Nasdaq: GOOG) Chrome and has tried to make its browser much faster and tighter," Model Metrics' Barnes remarked.

Still, this may not be enough to stem the growing popularity of Google's Chrome browser, which been making inroads into the browser market at Microsoft's expense, of late.

"Whether people will go back to IE after having used Chrome or Firefox remains to be seen," Barnes said.

Why the heavy play on HTML5? Is Microsoft tired of Adobe (Nasdaq: ADBE) Flash?

"Flash has issues, and, while Microsoft will continue to support it, Flash is somewhat of an embarrassment because it should have been Microsoft's technology," Enderle said.

"Flash has its roots in 'Chrome Effects,' a project that was killed because of internal politics. Microsoft probably would just as soon see Flash go away," he added.

"Flash, HTML5 and Silverlight all have their places," Model Metrics' Barnes suggested. "I think HTML5 is great for cross-platform and cross-browser compatibility."

Flash and Silverlight have a place in the short term, and they'll probably coexist with HTML5 for the next three to five years, Barnes said. "I know Adobe's doing a lot with Flash, and it talks a lot about how HTML5 and Flash can coexist -- and the same can be said for Silverlight."

Apple, too, is pushing for HTML5 instead of Flash, which it describes as old technology and prone to malware attacks.

Talk of a move toward mobile computing has been gaining traction for some time. Apple seems to have taken this to heart, revamping its MacBook Air family's user interface with features formerly only seen in mobile devices.

Is Microsoft missing the boat here? There's almost nothing heard about a mobile version of IE9.

Perhaps not. At PDC 2010, Microsoft demonstrated using Visual Studio Express for Windows Phone to develop apps. VSE is the free version of Visual Studio.

Devs can use a variety of ways to get data with WinPho7. These include REST, JSON and Web services, and Microsoft on Friday announced it's shipping a new OData library devs can use. This provides standards-based OData to consume and query data on the Web.

"The Windows Phone 7 offering has the best browser Microsoft has ever put in a phone," said Enderle. "It's just that Microsoft had issues with Flash initially."

View the original article here