With GreenBorder, Google gets deeper into Net security

Google's purchase of GreenBorder Technologies--a browser virtualization software company that creates a sandboxed environment for your existing Firefox or Internet Explorer browse--follows on the heels of Google announcing a blog from its nascent antimalware team. With rumors of a possible forthcoming antivirus acquisition, the Mountain View search giant has jumped into the Internet security business feet first.

Nerves must be raw at traditional security vendors Symantec and McAfee. Last year Microsoft announced its own security suite, Microsoft Windows Live Onecare, and proceeded to capture a lion's share of sales in the Internet security suite space. Now Google is arming itself with online security products, possibly providing these tools for free. Unlike Microsoft, Google's drive is more focused. Where Microsoft is providing tools to defragment your hard drive and backup files in addition to their firewall and antivirus choices, Google appears to be protecting their main asset: online businesses.

In a paper, "The Ghost in the Browser" (in PDF), Google's antimalware researchers looked at several billion Web sites. They studied a subgroup of 12 million web sites, within which they found 1 million engaging in drive-by downloads of malicious code. Overall that's only 0.1 percent (less than 1 percent) of all the Web sites, but any one bad experience on the Internet is enough to threaten Google's long-term usefulness. By purchasing software technology that protects the end-user from malicious code, Google is ensuring that most people enjoy an event-free experience while surfing the Internet.

Mozilla issues security updates for Firefox 2 and 1.5

By Robert Vamosi
Mozilla has released Firefox 2.0.0.4 and Firefox 1.5.0.12 to address six security vulnerabilities. Most users will automatically receive this update and be asked to restart Firefox to install it. This update will probably be the final one for Firefox 1.5. As such, Mozilla provides an easy upgrade path for current 1.5 users to upgrade to 2.0. All Firefox users are urged to install this update, as it addresses the following security issues CVE-2007-2871 (XUL Popup Spoofing); CVE-2007-2870 (XSS using addEventListener); CVE-2007-1362 (Path Abuse in Cookies) CVE-2007-2869 (Persistent Autocomplete Denial of Service) CVE-2007-2867 and CVE-2007-2868 (Crashes with evidence of memory corruption).

This update also enhances Firefox support within the Windows Vista operating system, although links within some applications still may not open in Firefox even if you have chosen Firefox as your default browser; a Windows Media Player plug-in still doesn't exist for Firefox; Windows Vista Parental Controls are not completely honored yet within Firefox; and cookies and saved forms from Internet Explorer still have to be manually imported. Mozilla has posted workarounds for these.

Finally, this release of Firefox adds language support for Afrikaans and Belarusian.

YouTube Trojan horse rides in on Web TV show's fame

According to Trend Micro, a Trojan horse that downloads a certain YouTube video could compromise your computer. The video appears to be an episode of Afterworld, a Web TV series about a society where technology is dead. Security vendor Websense has also been tracking this Trojan horse and has traced the video to a .su domain, which was originally assigned to the former Soviet Union and still remains in use today.

The use of online media files to infect end users with malware is not new. A worm last October used a JavaScript flaw in Apple Quicktime to spread on MySpace. For this attack, Websense has produced, ironically, an informative YouTube video demonstrating what happens to your computer. This YouTube Trojan steals personal information from a compromised PC and then broadcasts it to an undisclosed location.

IT Spending Shifts Away From Security

Over the next year IT managers will focus their spending on infrastructure rather than security, risk management, and compliance.
Denise Dubie, Network World

IT executives in the next 12 months will be focusing their budget dollars on projects such as server consolidation and network upgrades, as previously high priorities such as security, risk management and compliance fall off their Top 10 lists.

Goldman Sachs this week released its most recent survey of 100 IT managers, and it shows that while budgets remain flat and spending moderately steady, the technologies IT buyers are investing in most heavily have changed. For instance, IT initiatives such as server consolidation and server virtualization jumped from the middle of the pack to the first and third spots, respectively. More than 40 percent of respondents listed consolidation as a high priority for the next year, and just under 40 percent said virtualization is more directly on their radar. The financial services firm predicted the shift when server unit sales stalled last year.

"The big move upward coincides with an increasing number of comments from CIOs about the deployment of virtualization in production and test environments and the recent dislocation between industry-standard server unit and revenue growth," the report reads. But that doesn't mean all equipment makers will see a loss. "We expect blade growth to remain strong relative to stand-alone or rack-mounted servers, highlighted by HP's c-Class offerings, which grew by 45 percent in the January quarter," the firm says, adding that HP beat out its primary competitor IBM in that market.

Another significant advance could mean more money for Cisco. Both VOIP and network upgrades landed in IT decision-makers' Top 10 lists, with more than 30 percent planning to invest in voice and another third indicating a LAN or network upgrade would be on the road map in the next 12 months. According to the firm, for every US$1 spent on VOIP gear another $3 is spent on network upgrade equipment, which can be seen as nothing but good news for the network gear vendors -- in particular Cisco.

"Increasing VOIP demand would have positive pull-through effects for Cisco's enterprise network infrastructure business, particularly switching, as well as Cisco's VOIP equipment business," the report reads. "We expect to see significant market share shifts away from Nortel and Avaya to Cisco."

Investments in PC hardware could be driven by a growing trend toward laptop adoption, Goldman Sachs says, but the firm does not credit the release of Microsoft's Vista as the driving factor for about 25 percent of respondents indicating an upgrade in client machines as a top priority. And for software, survey respondents indicated ERP and business intelligence would remain high priorities going forward. ERP landed in the No. 2 position, with more than 40 percent planning projects with it, and more than 35 percent said they were looking into business intelligence software -- positive signs for software makers SAP and Oracle, which recently spent $3.3 billion to acquire Hyperion Solutions.

On the downward slide were security, practically a constant in the top three priorities in recent years, and compliance and risk management, which also fell out of the Top 10 lists probably due to previous work done to get ahead of regulations. Goldman Sachs attributes the slide to mature products and confident buyers.

"A slippage in security may indicate some increased comfort with security issues in the enterprise," the firm writes. "It could also be partially a result of few high-profile security breaches or highly disruptive malware incidents in recent memory."

Folder Lock v5.7.3

Folder Lock is a fast file-security program that can password-protect, lock, hide and encrypt any number of files, folders, drives, pictures and documents in seconds. Protected files are hidden, undeletable, inaccessible and highly secure. It hides files from kids, friends and co-workers, safeguards them from viruses, trojans, worms and spyware, and even protects them from networked PCs, cable users and hackers. Files can also be protected on USB Flash Drives, Memory Sticks, CD-RW, floppies and notebooks. Protection works even if files are taken from one PC to another on a removable disk, without the need to install any software. It locks files in Windows, DOS and even Safe Modes. Additional Options include Stealth Mode, Hacker Attempt Monitoring, Shred files, AutoLock, Auto Shutdown PC, Lock your PC, Erase PC tracks, 256-bit Blowfish Encryption and Context Menu in Explorer. It is Windows Vista/2003/XP/2000/NT/Me/98/98S compatible and works on all kinds of disk types like FAT16, FAT32, NTFS. Folder Lock is the most downloaded file-security program in the market today.

Download Folder Lock v5.7.3

Contest Winner: Vista More Secure than Mac OS

The security researcher who took home $10,000 in a highly-publicized MacBook Pro hijack, has been at the center of a week's worth of controversy.
Gregg Keizer, Computerworld

Dino Dai Zovi, the New York-based security researcher who took home US$10,000 in a highly-publicized MacBook Pro hijack on April 20, has been at the center of a week's worth of controversy about the security of Apple Inc.'s operating system. In an e-mail interview with ComputerWorld, Dai Zovi talked about how finding vulnerabilities is like fishing, the chances that someone else will stumble on the still-unpatched bug, and what operating system -- Windows Vista or Mac OS X -- is the sturdiest when it comes to security.

Friday, the vulnerability was first identified as within Safari, but by Monday, QuickTime was tagged. Why the confusion? I knew exactly where the vulnerability was when I wrote the exploit; that is part of the basic vulnerability research usually required to write a reliable exploit. I intentionally did not reveal where exactly the vulnerability was in order to prevent others from reverse engineering the vulnerability from those details. Initially, I was only revealing that the vulnerability affected Safari on Mac OS X, the target of the contest. However, now ZDI [3com TippingPoint's Zero Day Initiative] has been willing to publicly reveal that it affects many more system configurations, including all Java-enabled browsers on Mac OS X and Windows if QuickTime is installed.

As you were working with the vulnerability and exploit, did you know that it would impact non-Mac OS X systems? I had suspected that it might affect other platforms running QuickTime, but I did not have time to look into it.

You found the vulnerability and crafted an exploit within 9 or 10 hours. And you've said 'there was blood in the water.' Does that mean you had a head start -- in other words, prior research -- or was it all built from scratch? Is it really that easy to dig up a vulnerability? I had found other vulnerabilities in Mac OS X and even QuickTime in the past, so I had some familiarity with the code, but I only discovered this vulnerability that night. My quote that there was "blood in the water" referred to the fact that there were reports of other vulnerabilities in QuickTime, and even Java-related vulnerabilities in QuickTime over the last few years. In my experience, if a certain software package has had vulnerabilities in the past, it is more likely to contain other undiscovered vulnerabilities.

Halvar Flake and Dave Aitel, two prominent security researchers, use the fishing metaphor to explain vulnerability finding. Some days you go out and catch nothing, some days you catch something great. Sometimes you hear about some great fishing happening in a stream somewhere and there are lots of fish to catch until everyone else starts fishing there and the stream becomes overfished. In this case, I suspected that there would be good fishing in QuickTime and I got lucky and found something good in a short amount of time. This is far from the first time that I've gone fishing for vulnerabilities, however.

After the positive ID of the vulnerability, there were some unconfirmed claims that your exploit had been snatched at CanSecWest. Although those reports have been discounted, what can you tell us about how you protect your findings? And what are the chances that someone will independently dig out the vulnerability based on the limited information made public? I do everything that I consider reasonable to protect my security research. I keep exploits in encrypted disk images that are only mounted when necessary on hardened systems that are not always powered on. I am very conservative in what details I share and with whom in order to tightly control knowledge of the vulnerabilities. I often give my exploits non-obvious code names so that I can refer to them over non-encrypted channels without revealing anything about them. [But] with the details that have been released so far, I believe that is a very real possibility that someone may be able to independently dig out the vulnerability, but it won't exactly be trivial and I hope that whoever does acts responsibly with it.

With the ongoing 'Mac OS X is safe' vs. 'You're in denial' debate, what would you recommend to a Mac user as reasonable security precautions? I recommend that Mac users make their primary user a non-admin account, use a separate keychain for important passwords, and store sensitive documents in a separate encrypted disk image. I think these are fairly straightforward steps that many users can take to better protect their sensitive information on their computer.

As a researcher who works often in Mac OS X, what's your take on the amount of information that Apple releases when it patches vulnerabilities? I think that the amount of information that Apple releases with its patches is sufficient in the level of detail for a knowledgeable user to determine the criticality of the vulnerabilities. They do not, however, provide guidance on the level of criticality of the security update for less technical users. I do not think this is too much of an issue, though, as I believe that the vast majority of users should simply patch the security vulnerabilities as soon as possible regardless of their criticality.

How important in this case was it that 3com TippingPoint stepped up with a $10,000 prize? Would you have bothered if the prize money had not been there? For me the challenge, especially with the time constraint, was the real draw. I also hoped that the live demonstration of a Mac OS X exploit would provide some much needed hard evidence in the recent Mac security debates.

From your research on both platforms, is there a winner between Mac OS X 10.4 and Vista on security? I have found the code quality, at least in terms of security, to be much better overall in Vista than Mac OS X 10.4. It is obvious from observing affected components in security patches that Microsoft's Security Development Lifecycle (SDL) has resulted in fewer vulnerabilities in newly-written code. I hope that more software vendors follow their lead in developing proactive software security development methodologies.

What are you spending most of your time on these days? Last October, for instance, there were news stories that mentioned you showed a VM rootkit to developers at Microsoft. I recently co-authored a book, The Art of Software Security Testing: Identifying Software Security Flaws, which was just published by Addison-Wesley Professional in December. Also since around that time, I have been managing information security for a financial firm in New York City. I do still spend some of my free time researching software vulnerabilities, VM hypervisor rootkits, and 802.11 wireless client security.