1Word? That was a gag!
Microsoft Office…for the iPhone?
SlideShare’s prank: funny, cruel, both?
Sorry, unauthorized iPhone app stores.
More on Android tethering apps.
Conficker could still be dangerous.
Tag Archives | Security
1Word for April 1st, 2009
[NOTE: Response to Technologizer’s 5Words has been terrific, but many readers have told us that they think even five-word descriptions of stories are too wordy and wasteful. So as of today, we’re relaunching the feature as 1Word. Terse enough for ya? If not, we’d be happy to go to monosyllabic words. 0Words would be doable, too. Just let us know.]
3 comments
Apple May Add Biometrics to iPhone, Laptops
Apple is attempting to patent a method to conceal a biometric sensor inside of its products to allow users to lock down their systems without having to type in passwords.
This is something that I have been waiting for. I do not have a password for my iPhone, because the very thought of having to input it every time my phone goes into sleep mode is mind-numbing. If I could confirm my identity simply by touching the screen, I’d be a happy camper. And it would be more secure than a password–no one else has my fingerprints.
Rather than adding an unwieldy biometric reader to its products, Apple’s designers have dreamed up a way to hide it. The company could go in another direction: The patent includes some unorthodox alternatives for authenticating users using its existing technology, including the device being tilted in certain directions, voice recognition, and having the user touch symbols in a specific sequence.
If Apple can make it password-free authentication work in practice, it would be a valuable feature for its products. I’m not certain what the costs involved would be, but it would be a feature that I bet enterprise customers would pay more for.
8 comments
5Words for March 26th, 2009
I’d love an interplanetary vacation:
Word creator returns to space.
Windows 7 download page: oops!
Google and Mario: finally together.
Firefox readies a security fix.
The president is tweeting again.
Birthday present coming for Gmail.
No comments
Attention: Everybody. Your Browser is Insecure. Deal With It.
Yesterday’s most significant browser-related event wasn’t the release of Internet Explorer 8–it was the upshot of day one of the Pwn2Own browser-hacking contest at the CanSecWest security conference in Vancouver, British Columbia. The competition offered cash and hardware incentives to attendees who could exploit zero-day vulnerabilities in Chrome, Firefox, IE 8, and Safari.
The results? Chrome was the only browser that escaped unscathed, apparently because of the way it sandboxes Web code to prevent it from doing damage. (Chrome has, however, been shown to be insecure in the past.) Yup, IE 8–which Microsoft says its “safer than ever”–didn’t even get through its first day on the market without being hacked.
Which wasn’t a surprise in the least–really, it would have been more startling if a bunch of enterprising hackers with money, prizes, and publicity dangled in front of them weren’t able to break into the majority of browsers they tried to attack. Every browser company has smart folks working on making software safe, but it’s painfully obvious that the people who want to show that software is insecure are just as smart.
I don’t look at the people who enter Pwn2Own as white knights–they are, after all, tampering with products to get a chance at monetary reward, and bad guys can and do learn from their attacks. But ultimately, the contest and similar stunts do the world a favor: It’s important that browser companies know about the holes in their products, and if it takes a contest to find some of them, that’s okay. (Pwn2Own’s organizers turn over information on the vulnerabilities that are discovered to the companies in question so they can fix them.)
And the results of day one of Pwn2Own are also a useful reminder to all of us who use browsers: There are less secure browsers and more secure browsers, but there’s no such thing as a fully secure browser. (Even houses with deadbolts on all the doors and pricey alarm systems get broken into.) Remember that when you hear browser companies brag about their safety measures.
Day two of Pwn2Own, incidentally, included a competition to bust into mobile-phone browsers: Android, BlackBerry, iPhone, Symbian, and Windows Mobile. They all survived, apparently–mostly because almost nobody even showed up to try and attack them. Betcha phone browsers come under a lot more scrutiny from Pwn2Own contestants in years to come…
6 comments
Hey Apple, Help Developers Write Secure iPhone Software
iPhone users have groaned and moaned about the device’s lack of basic copy-and-paste functionality, but Apple held off on delivering the feature until it got the security right. Kudos to Apple for making security a requirement, and designing its software correctly. Third-party iPhone developers should be designing software the same way.
It has become increasingly important for developers to treat security as they would any other software severe defect–stamping out problems at the very beginning of an application’s lifecycle. It’s less expensive for software makers to address security issues before an application ships, and the security and privacy of end users is safeguarded better that way.
That’s the rationale behind Apple’s decision to delay copy-and-paste. During Appple’s press conference today, Scott Forstall, senior vice president of iPhone software, explained that the company opted to address resolve security issues that arise when information is copied between applications.
I think that is of particular importance in a smartphone’s operating system–after all, users store important information on their phones that could be compromised by malware. Clearly, Apple is thinking security, but it should be empowering its developers to do the same. As far as I know, it has not invested the resources to make that happen.
In fact, no big vendor has invested in a major security push with developers–except for Microsoft. Microsoft has published its Security Development Lifecycle (tools and processes that the company uses to build security into its software), has released free threat assessment tools for developers, and set up training programs for sharing security-related knowledge and experiences.
Over the past several weeks, I spoke with Microsoft about the future of the Security Development Lifecycle. While the SDL is not a cure-all, security vulnerabilities in Microsoft software have dropped marked since it was adopted. It would not surprise me if there were security tools incorporated into the next version of the company’s Visual Studio development environment.
Apple would be smart to take a similar approach with the iPhone, sharing its internal principles for writing secure software with third-party developers whose applications also need to be as rock-solid as possible. For that matter, so should Palm, and every other smartphone software producer.
At today’s event, Harry asked the last question, concerning the App Store approval process, and Apple marketing chief Phil Schiller pointed to security checks as one reason why giving third-party apps the go-ahead takes time. Overall, I’m encouraged by Apple’s commitment to security, but today’s iPhone 3.0 announcement didn’t answer the broader question: What is it doing to make certain that iPhone developers know how to write applications that are safe, period?
8 comments
Seven Tools to Make Your PC Smile
You have an insatiable need for free tools, I know, and there’s no reason to deprive you. I have seven gems for you, and all but one are freebies. Plus I have a quick follow-up about passwords and security.
Dump the Dupes
You think you might have a couple of duplicate files on your system? (Don’t be silly — of course you do.) Easy Duplicate File Finder (see image) is a handy freebie that will dig around and show you where they’re lurking. I like being able to choose specific folders, use a mask to find only certain files, and either rename or move dupes.
7 comments
Malware is Messing with Facebook Users
A rogue application has struck Facebook for the second time within a week, reports Trend Micro’s Malware Blog. The malware uses social engineering to hoodwink Facebook users into installing it, and then proceeds to harvest their personal information. But don’t panic yet – it’s not that easy to do.
When a user installs the application, it propagates itself by spamming their friends profiles with fake but official sounding notices that they have violated the Facebook terms of service. In order to avoid “penalties,” the user is instructed to install the application. If the would-be victim falls for it, the cycle repeats.
Trend Micro has pointed out the obvious: Facebook should review its application hosting policy. The firm also recommended that users take responsibility for what they are installing, and to do some research beforehand.
One possible solution is a verification process for applications, but the problem would have to be more prevalent to justify its costs, said Caleb Sima, an HP executive that is the former co-founder and CTO of SPI Dynamics.
“Really, I don’t have much to say about this as I have been expecting it for a while. Its no different then email. I send you a link to a program you allow it to install it takes your contacts list and spams it out. There is nothing new here. Its just applied as a Facebook app or message.”
He also predicted that malware could start arising with any type of ‘app stores.’
The silver lining is that Faceobok applications are much harder to write and distribute than e-mails are, so it won’t be as big of a problem, Sima explained. Vigilance is the best course of action, he added. “Ultimately I don’t think there is much that Facebook can do about it besides act quickly to remove rogue apps when they are reported.”
2 comments
Microsoft Research Envisions Leap in Browser Security with "Gazelle"
Microsoft Research has re-imagined the Web browser to include its own operating system. In a technical report published on February 19, researchers argued that a radical change in browser architecture is necessary, because Web sites have evolved from static documents into dynamic Web applications that draw content from multiple sources.
Their proposed solution is a browser, code-named Gazelle, that is designed with a multi-principal operating system at its core. The researchers explained that Gazelle would be more secure than traditional Web browsers, because its OS would manage the protection of system resources and better isolate Windows from the Web.
“Our prototype implementation and evaluation experience indicates that it is realistic to turn an existing browser into a multi-principal OS that yields significantly stronger security and robustness with acceptable performance and backward compatibility,” the researchers wrote.
Gazelle blazes a path that no modern browser has followed, including Internet Explore 8 and Google Chrome, they added. However, it might not be entirely necessary to go back to the drawing board: Microsoft has managed to make the current incarnation of Internet Explorer safer over the years by taking measures sucvh as restricting what system resources the browser may access and limiting application privileges through User Account Control in Windows Vista. It is also attempting to create a new standard to isolate Web content for greater security.
Ultimately, the Gazelle project does not necessarily mean that Microsoft is coming up with a replacement for Internet Explorer; Microsoft research projects do not always become products. Nonetheless, some industry watchers, including Mary Jo Foley, believe that the company may give Gazelle greater exposure at its TechFest ‘09 research fair this week.
(Gazelle photo by Erik A. Drablos from Wikipedia.)
One comment
5Words for February 20th, 2009
Let’s get newsy, shall we?
Found: Atlantis. In Google Earth!
Intuit questions Mint user claims.
Greeeeaaaaat: Conficker worm variant appears.
Pirate Bay: YouTube pirates more.
Senior citizen shoots analog TV.
NetFlix may offer streaming subscriptions.
Asus might make Android netbooks.