Thursday, March 25, 2010

Skype Mobile for Verizon Wireless Launches Today

skype logoBeginning today, new and existing Verizon Wireless customers with Android 3G smartphones and BlackBerry 3G smartphones can get Skype mobile in a number of ways. Visit www.verizonwireless.com/skypemobile or www.skype.com/go/mobile from a PC to enter the mobile phone number to receive a text message with a link to the application. Verizon Wireless customers can also text “SKYPE” to 2255 to receive the link. In addition, Android customers will be able to download the app from Android Market. New BlackBerry customers will find the application on their 3G smartphones’ home screens in the Downloads folder when activated.

Skype mobile gives Verizon Wireless 3G smartphone users with data plans a simple new way to stay in touch with friends, family and business colleagues around the corner and around the world while on Verizon Wireless’ network. Skype mobile users can:
  • make and receive unlimited Skype-to-Skype voice calls to any Skype contact around the globe;
  • send and receive unlimited instant messages with other Skype users;
  • manage the Skype contact list directly from the mobile application; and
  • call international phone numbers at competitive Skype calling rates.

Customers need a Verizon Wireless smartphone and data plan to use Skype mobile. Skype-to-Skype calls will not be charged against their monthly minute allowances or data plans. Verizon Wireless customers can visit www.skype.com to purchase Skype Credit to make Skype Out calls and make calls to international landline or mobile numbers.

Skype mobile will be available initially on millions of best-selling Verizon Wireless 3G smartphones, including the BlackBerry Storm 9530, Storm2 9550, Curve 8330, Curve 8530, 8830 World Edition, and Tour 9630 smartphones, as well as DROID by Motorola, DROID ERIS by HTC and Motorola DEVOUR.

More details can be found via the Skype Blog

Wednesday, March 24, 2010

Hackers Go Four-for-Four As Firefox 3 on Windows 7 Falls at Pwn2Own

I see a reoccurring theme here, all four teams that have competed at this years Pwn2Own contest have successfully exploited their targets and compromised the machines at hand. This time it was a Windows 7 equipped machine running Firefox 3.

@TheZDI Nils from MWR InfoSecurity (@MWRLabs) succeeded against Firefox on Windows 7 with the quintessential calc.exe launching payload.

As with most of the hacks there aren't many details given out as to how they were accomplished. Its really not surprising me that most have fallen but what is surprising me is the rate at which they are being exploited. In most cases it has taken less than 30mins. Now keep in mind most of these target hacks are exploiting third party software and not the OS itself, but it's still a bit unnerving.

Update: Via Threat Post

A 26year old German hacker known simply as "Nils" exploited a previously unknown vulnerability in Mozilla Firefox to take complete control of a 64-bit Windows 7 machine. "Nils" who heads up the security research team at U.K.-based MWR InfoSecurity, used several tricks to bypass Address Space Layout Randomization (ALSR) and Data Execution Prevention (DEP) to get his drive-by download to load an executable on the target machine.

ASLR+DEP are held up as significant roadblocks to thwart malware attacks on the newest versions of Windows but, as this contest shows, skilled hackers with enough motivation and resources can bypass those mitigations easily.

Nils said Mozilla can do a better job of opting into ASLR on Windows, a clear hint that implementation errors make it easy to bypass the Windows defenses.

Windows 7 And IE8 Fall At Pwn2Own

So far the hackers are three for three at Pwn2Own, with the ZDI now confirming that Windows 7 and Internet Explorer 8 have fallen.

@thezdi Peter Vreugdenhil (@WTFuzz) succeeded against Internet Explorer 8 on Windows 7 with a technically impressive exploit bypassing DEP.

It'll be interesting to see if the rest of the smartphones the, RIM Blackberry Bold 9700, Nokia E72 device running Symbian and HTC Nexus One running Android as well as the two browsers Google Chrome 4 and Mozilla Firefox 3 can withstand the onslaught.

Update: Via Threat Post
Dutch hacker Peter Vreugdenhil pulled off an impressive CanSecWest Pwn2Own victory here, hacking into a fully patched 64-bit Windows 7 machine using a pair of Internet Explorer vulnerabilities.

Vreugdenhil, an independent researcher who specializes in finding and exploiting client-side vulnerabilities, used several tricks to bypass ASLR (Address Space Layout Randomization) and DEP (Data Execution Prevention), two significant security protections built into the Windows platform.

“I started with a bypass for ALSR which gave me the base address for one of the modules loaded into IE. I used that knowledge to do the DEP bypass,” he added.

Update: Via PCWorld

"[The exploit] reuses Microsoft's own code to disable DEP," said Vreugdenhil. "You can reuse Microsoft's own code to disable memory protection."

In a paper he published today ( download PDF ), Vreugdenhil spelled out how he evaded both ASLR and DEP in more detail.

"It was a two-step exploitation," Vreugdenhil said of the unusual attack. "I could have done it with one, but it would have taken too long." Using the double-exploit technique gave him control of the machine in a little over two minutes; if he had used only one exploit, the task would have required 50-60 minutes.

"I didn't know how much time I would have at Pwn2Own," he said, referring to the constraints of the contest, where hackers had limited time slots. And he didn't want to bore his audience. "I put some eye candy in the exploit," he said, referring to a progress bar he inserted that read "Please be patient while you are being exploited..."

Mac Book Pro Running OS X Falls In Under A Minute @Pwn2Own

 Correction: Miller actually hacked the full patched MacBook Pro in under 10seconds!!

Wow Charlie wasn't kidding when he said he had a bag full of hacks ready for this years Pwn2Own. The ZDI just confirmed that Miller (@0xcharlie) successfully hacked the MacBook Pro running OS X via Safari what looks like less than a minutes time. His payload returned a full command shell.

@thezdi Charlie Miller (@0xcharlie) popped the MacBook Pro via Safari. His payload returned a full command shell.

As we reported a few days ago Miller said he was ready to report on no less than 20 zero day exploits that he had discovered within OS X. It looks like he might have know at least a few that are affecting Safari as well ;)

"I can't talk about the details of the vulnerability, but it was a Mac, fully patched, with Safari, fully patched," said Miller on Wednesday, not long after he had won the prize. "It probably took five or 10 seconds." He confirmed that he had researched and written the exploit before he arrived at the challenge.

iPhone Hacked Via Safari At Pwn2Own

 Hackers,  Iozzo and Weinmann compramised their fully patched iPhone in a total of 20 seconds.

The Zero Day Initiative (ZDI), an initiative founded by TippingPoint which organizes the security competition Pwn2Own, has confirmed via Twitter that contestants Vincenzo Iozzo and Ralf Philipp Weinmann successfully exploited the iPhone via a 0day Safari hack! 

@thezdi Vincenzo Iozzo and Ralf Philipp Weinmann successfully exploit the iPhone via Safari! Their payload pulled the SMS database. #pwn2own

The team of Iozzo and Weinmann were the first candidates in the hacking contest and the iPhone, which was hacked in less than 10 minutes, is the first smartphone to fall in the contest in the last two years. The iPhone was a 3GS model and was running iPhone OS 3.1.3.

Up next Charlie Miller gets to take his crack at exploiting Safari I believe on an Apple Macbook Pro running OS X. Stay tuned for more details.

Update: additional details courtesy the ThreatPost:

The exploit crashed the iPhone's browser session but Weinmann said that, with some additional effort, he could have a successful attacked with the browser running.

"Basically, every page that the user visits on our [rigged] site will grab the SMS database and upload it to a server we control," Weinmann explained. Iozzo, who had flight problems, was not on hand to enjoy the glory of being the first to hijack an iPhone at the Pwn2Own challenge.

Halvar Flake, a renowned security researcher who assisted with the winning exploit, said the biggest hiccup was bypassing the code-signing mitigation implemented by Apple on its flagship mobile device.

"This exploit doesn't get out of the iPhone sandbox," Flake explained, noting that an attacker can do enough damage without escaping from the sandbox.

"Apple has pretty good counter-measures but they are clearly not enough. They way they implement code-signing is too lenient," Flake added.

In addition to hijacking the SMS database, Weinmann said the winning Pwn2Own exploit could have exfiltrated the phone contact list, photographs and iTunes music files. He was unsure if the exploit could have hijacked e-mails.

Weinmann declined to publicly discuss the techniques he used to find the vulnerability. "We're working on developing techniques to find a certain class of vulnerabilities. I don't want to discuss it too much."

Aaron Portnoy, a security researcher at TippingPoint Zero Day Initiative (the company sponsoring Pwn2Own), described the attack as "very impressive."

"It was a real world exploit against a popular device. They exfiltrated the entire SMS database in about 20 seconds. It was as if a Web page was loading."

TippingPoint ZDI acquired the exclusive rights to the flaw information. The company will report the issue to Apple and will withhold details until a patch is released.

Weinmann and Iozzo won a $15,000 cash prize and got the keep the hijacked iPhone.

Review: Adesso WKB-4200UB Wireless Keyboard

We've reviewed our share of Adesso products over the last several months and while we've thought they all were good enough products in their own right however we had yet to find one that stood out head and shoulders above anything else we've reviewed. Well that all changed when Adesso sent us the Adesso WKB-4200UB. A few weeks ago this little beauty showed up at our door and almost immediately took over as our every day keyboard.


For starters the new keyboard is sleek and stylish. It features a black and grey design, which fittingly reminded me right away of the Oakland Raiders (no I'm not a fan). Gone is the center placement of the trackpad, which was one of the issues we had with the WKB-4000UB we previously reviewed.

Keyboard dimensions are 16.5" x 8.0" x 0.75" making it roughly 2" shorter and 1.5" skinner than our everyday keyboard which is the Logitech MX3200. The micro usb receiver is also much shorter than that of our Logitech receiver, although we still had to use both considering the WKB-4200UB lacks a compatible mouse/ 

The full specifications are as follows:
  • Connection: 2.4 GHz RF Smartlink with 12 Auto-Changeable channels (65000 IDs per channel)
  • Wireless Range Distance: 30 ft
  • 4 Internet Hotkeys: (Scroll Up/Down, Home, E-mail and Forward/Back
  • 6 Multimedia Hotkeys:(Play/Pause, Stop, Previous Track, Next Track, Vol+/Vol- and Mute )
  • 3 PC Hotkeys:(My Computer, Search and Sleep)
  • Keyboard Dimensions: 16.5" x 8.0" x 0.75"
  • Mini USB Receiver Dimensions: 1.65" x 0.75" x 0.25"
  • Weight: 2.0 lbs
  • Number of Keycaps: 87 Keys Mini Layout in an ultra-stylish design.
  • Keyboard Technology: Membrane Switch
  • Mouse Function: Touchpad with two Buttons
  • Switch Life: 5 Million Cycles
  • Switch Travel: 3.0+/- 0.3mm
  • Includes 2 AAA Battery
  • Power Consumption:

As you can see from the images the numeric keypad is gone, replaced by a very functional, very well placed trackpad. The trackpad along with the new hotkeys and media keys make this keyboard ideal for use in a media center, or office presentation type environment, yet the size and layout make it suitable for everyday use.
ADESSO Pro Touchpad Keyboard

When used for everyday things like browsing, document writing, blog posting emails ect. the trackpad is very convenient. The right hand placement is aligned almost perfectly with the position held by a normal users mouse.  Touch sensitivity is very responsive and not overly assertive. For more advanced use such as gaming or apps that need a more precise faster mouse response you'll be disappointed. The response just isn't up to par in that area.

Tactile response on all the keys is fairly good. The keys are a bit noisier than I'd like and are a little firmer what I'm accustom to. Being a slim keyboard they keys are a bit smaller than normal and some are a bit cramped, but nothing that can't be overcome by a few weeks adjustment. Integrating the numeric keys into the right side of the keyboard adds a little more functionality for a kiosk environment but seems to serve little purpose for any daily needs. You'll find yourself either forgetting to switch off/on the num lock or not using then at all.

Conclusion

I'll admit the $100 price tag we found the WKB-4200UB listed for at Newegg seems a bit high, especially when you take into consideration the fact most people are going to want to add on a decent wireless mouse. I'd like to have seen Adesso packaged it with at the very least a generic three button wireless mouse for when I'm gaming or just plain get tired of using the trackpad. But when compared to other offerings out there in terms of size, functionality and features it's really hard to beat.

From what I've seen on the market you just can't find a 2.4ghz slim wireless keyboard out there with both a trackpad and full sets of both media and hot keys. For what I'd use it for, which would mainly be a media center PC, I think the Adesso WKB-4200UB might just be perfect. You get a size and shape that easily fits on your lap, or a sleek stylish keyboard that would show nicely on the coffee table.

AT&T Launches New Music Service

AT&T today announced a new AT&T Music application that combines the most popular mobile music services – song and album downloads, streaming radio, song match, lyric search and an enhanced music player – into a single, cohesive experience for AT&T mobile phones. The service is available first as a download on three of AT&T's most popular quick messaging phones, delivering the tightest integration of mobile music services available to this category of devices.

Within one mobile broadband application, subscribers to AT&T Music can:
  • Listen to 40 commercial-free genre radio stations;
  • Customize unlimited personal radio stations;
  • Use song match to identify the tune by holding their phone up to music playing on the radio, TV or elsewhere;
  • Search for lyrics to identify song title and artist;
  • Preview, buy and download songs and albums straight to their phone; and
  • Listen to personal music saved on their mobile device, including the ability to create and manage playlists and find music by artist, album, song or genre.

"We've long been a leader in mobile music and have been at the forefront in evolving the category to offer some robust experiences, but those experiences have largely been available though separate applications," said Mark Collins, senior vice president of Data and Voice Products for AT&T Mobility and Consumer Markets. "We recognized a need to create a 'no dead-ends' experience that weaves together all of the most popular music services, so customers don't have to jump in and out of different applications depending on how they want to access mobile music."

The app was designed to deliver deep integration of tasks while maintaining simple, easy-to-use navigation. A customer with a song line stuck in his or her head can enter those lyrics into the lyric lookup function to identify the song and artist and, from there, view full lyrics, access the artist's bio, preview and buy the song, or create a personalized radio station from that song.

AT&T plans to enable full song and album downloads through direct deals with Sony Music Entertainment, EMI Music and indie music distributor The Orchard. Details on additional content providers will be announced in the future.

The new AT&T Music experience is available today on the LG Xenon, Samsung Solstice and Samsung Impression. AT&T plans to make the service available as a download on additional handsets soon and will begin preloading the service on devices beginning this summer.

Feature enhancements, such as the ability to purchase and manage ringtones and ringback tones from within the application, are also planned.

The service is available for $6.99 per month to customers who subscribe to an unlimited data plan. Song and album purchases are charged a la carte.

Customers with currently compatible handsets can download the new AT&T Music experience through the AT&T App Center, available directly from their phone or www.att.com/appcenter. Customers can also text MUSIC to 7299 to receive a link to download the application; messaging rates apply.

Source: AT&T

Users Continue To Open Spam Despite Warnings

According to a recent research study by MAAWG (Messaging Anti-Abuse Working Group) tens of millions of people continue to open, read, forward or respond to spam. This despite the fact that they are aware of how bots and viruses spread through risky email behavior.

In the new survey (found here), more than half of the users said they had opened spam, clicked on a link in spam, opened a spam attachment, replied or forwarded it – activities that leave consumers susceptible to fraud, phishing, identity theft and infection. While most consumers said they were aware of the existence of bots, only one-third believed they were vulnerable to an infection.

"Consumers need to understand they are not powerless bystanders. They can play a key role in standing up to spammers by not engaging and just marking their emails as junk," said Michael O'Reirdan, MAAWG chairman.

"When consumers respond to spam or click on links in junk mail, they often set themselves up for fraud or to have their computers compromised by criminals who use them to deliver more spam, spread viruses and launch cyber attacks," O'Reirdan said.

The research findings on awareness of bots, email security practices, and attitudes toward controlling spam were generally consistent with the first MAAWG consumer survey in 2009 covering North America. The new 2010 survey was expanded to cover Western Europe and looks at consumers' attitudes in Canada, France, Germany, Spain, the United Kingdom and the United States.


It Won't Happen to Me Syndrome

Less than half of the consumers surveyed saw themselves as the entity who should be most responsible for stopping the spread of viruses. Yet, only 36% of consumers believe they might get a virus and 46% of those who opened spam did so intentionally.

This is a problem because spam is one of the most common vehicles for spreading bots and viruses. The malware is often unknowingly installed on users' computers when they open an attachment in a junk email or click on a link that takes them to a poisoned Web site, according to O'Reirdan.

Younger consumers tend to consider themselves more security savvy, possibly from having grown up with the Internet, yet they also take more risks. Among the survey's key findings:
  • Almost half of those who opened spam did so intentionally. Many wanted to unsubscribe or complain to the sender (25%), to see what would happen (18%) or were interested in the product (15%).
  • Overall, 11% of consumers have clicked on a link in spam, 8% have opened attachments, 4% have forwarded it and 4% have replied to spam.
  • On average, 44% of users consider themselves "somewhat experienced" with email security. In Germany, 33% of users see themselves as "expert" or "very experienced," followed by around 20% in Spain, the U.K. and the U.S.A., 16% in Canada and just 8% in France.
  • Men and email users under 35 years, the same demographic groups who tend to consider themselves more experienced with email security, are more likely to open or click on links or forward spam. Among email users under 35 years, 50% report having opened spam compared to 38% of those over 35. Younger users also were more likely to have clicked on a link in spam (13%) compared to less than 10% of older consumers.
  • Consumers are most likely to hold their Internet or email service provider most responsible for stopping viruses and malware. Only 48% see themselves as most responsible, though in France this falls to 30% and 37% in Spain.
  • Yet in terms of anti-virus effectiveness, consumers ranked themselves ahead of all others, except for anti-virus vendors: 56% of consumers rated their own ability to stop malware and 67% rated that of anti-virus vendors' as very or fairly good.  Government agencies, consumer advocacy agencies and social networking sites were among those rated most poorly.

The survey was conducted online between January 8 and 21, 2010 among over a thousand email users in the United States and over 500 email users in each of the other five countries. Participants were general consumers responsible for managing the security for their personal email address.

Both the survey's key findings and the full report are available at the MAAWG Web site, www.MAAWG.org. The 2010 research was conducted by Ipsos Public Affairs, and the full report includes country comparisons for many of the questions along with detailed charts.

My thoughts

Honestly this doesn't surprise me much, not when you consider the billions of dollars that are being made each and every year off the same old tried and true spam tactics. What did surprise me was the shear volume of people that said they opened and forwarded the spam knowingly. I mean its one thing to want to check it our for yourself but its another to forward it on to an unsuspecting friend who then thinks its coming from a credible source.

Think people, think! Your action not only affect you but others around you. That suspicious email you might be reading just for the hell of it might be the one that not only steals your identity but that of a friend or relative or worse causes millions of dollars of information to be stolen from your company. Please practice safer internet habits!

Source: MAAWG

Tuesday, March 23, 2010

Adobe to Launch CS5 April 12th

Adobe will release the next major version of its Creative Suite collection April 12 via Adobe TV. A teaser site is now live where you can watch some video previews, keep track via a countdown clock and register to watch the global launch on the 12th. Overall, we can't wait to see what new features CS5 will have to offer even if it is out of our price range.

Readers wanting to checkout the launch are invited to pre-register by clicking the image below.

Adobe CS5 - First look April 12

Samsung Announces The Android Powered Galaxy S

Samsung Electronics Co. Ltd., a leading mobile phone provider, today introduced the Galaxy S (Model: GT-I9000), a smart phone that makes users’ lives more convenient, more exciting, and more integrated. JK Shin, president and head of Samsung Electronics’ Mobile Communications Business announced the global launch of the Galaxy S at his keynote speech at the International CTIA Wireless 2010. The Galaxy S will be available in Europe, North America, Latin America, Australia, and Asia soon.

samsung galaxy s

The Android-powered Galaxy S incorporates a 4-inch Super AMOLED screen and a 1 GHz application processor that enables vibrant HD videos, rich augmented reality content through Layar Reality Browser, and advanced LBS (Location Based Services). The ‘Social Hub’ provides always-on social networks connectivity allowing users to enjoy communications with their friends, colleagues, and families whenever they want and wherever they are.

The Galaxy S is designed to provide immersive, intelligent and integrated experiences, with the power to enrich people’s lives through best-in-class services and technologies. The Galaxy S will allow users around the world to experience the “Smart Life,” which Samsung anticipates will shift the way that consumers view smart phones and how they interact with them in their daily lives.

The Galaxy S immerses users in a world of rich multimedia. The large 4-inch Super AMOLED display delivers unrivalled screen quality, with less reflection, free viewing angles and super-fast touch-response. The mDNIe (mobile Digital Natural Image engine) – a technology used in Samsung’s best-selling LCD and LED TVs – boosts an even sharper and crisper viewing experience for photos, videos, and e-books. It creates a perfect environment to record, edit and play HD video, to browse the Internet, and to read your favorite e-books. A variety of applications from Android Market™ allows users to even more extend the benefits and excitement of smart phone experience. Plus, users have access to Google mobile services, such as Google Search, Gmail, and Google Maps.

Living a “Smart Life” requires intelligence, and the Galaxy S delivers just that by utilizing personal preferences to gather information online that each user needs and wants. With a user-defined daily briefing, lightning-fast processing speeds and location-based search options like Layar Reality Browser – the Galaxy S gives users the information they need wherever and whenever needed. The Galaxy S represents the next level of intelligence in smart phones.

The Galaxy S integrates every aspect of life in a smart and sophisticated way. In addition to wireless integration with a variety of other devices, such as notebooks, TVs and cameras, the highly advanced Social Hub plugs users quickly and conveniently into their complete world of social networking and email.

“The Android-powered Galaxy S will set a new standard for smart phones,” said JK Shin, president and head of Mobile Communications Business. “The Galaxy S is the perfect device for people in all corners of the world who want that extra edge; to be more effective, productive, better connected, and in tune with their smart life – both personal and professional – all in a very easy and simple way.”

Key Features
  • Daily Briefing: Offers instant access to weather, news, stocks, and the scheduler.
  • All Share: Enables inter-device connectivity via DLNA (Digital Living Network Alliance) technology.
  • Home Cradle: Enables use as a digital photo frame, table clock, calendar, and music station.
  • Write and go: Jot down an idea first and later decide on a format such as SMS/ MMS, email, calendar or memo.
  • Swype: Provides fast and easy way to input text on screen while on-the-move.
  • ThinkFree: Apps to view and edit Microsoft Office 2007 documents.
  • Smart Alarm: Wakes up with a natural alarm sound and automatically turned-on display light.
The Galaxy S is exhibited at The International CTIA Wireless at booth # 1023.

Source: Samsung

AT&T's Cup Runneth Over With Smartphones

AT&T may have exclusivity to sale the iPhone, which is one of the hottest phones on the market, but that's not keeping the company from adding even more hot phones to their line-up.

Last month the company made the move to Google's Android platform when they added the Motorola Backflip, the companies first Android powered device. Then they continued adding to an already packed line-up when earlier this month they added four new smartphones, the Pantech Link and Pursuit as well as the Samsung Sunburst and Strive.

This week the company made slightly bolder moved when they added the Palm Pre Plus and Pixi Plus and their second Android-based smartphone the Dell Aero. Add to that the announcement from Google that they have released a 3G ready Nexus One that is compatible with AT&T's network and it looks like AT&T customers might have a tough decision to make when it comes to buying that next phone.

Opera Mini Submitted to Apple's App Store Will It Get In?

As of today Opera has officially submitted their Opera Mini for iPhone application for inclusion into the Apple App Store now the question is will the popular mobile browser be accepted or denied by the iron fist of Apple?

We are all very aware that Apple likes to keep a strangle hold over the app's it accepts and denies and they often remove, or simply reject, any applications that might compete against their own software. So the question is will they step up and allow users to use Opera Mini over their own Safari Browser?

According to Opera the Opera Mini for iPhone browser is fast, really fast, powering through Web pages up to six times faster than Safari. They give credit for the speeds due to server-side rendering, Opera Mini compresses data by up to 90 percent before sending it to the phone, resulting in rapid page loading and more Web per MB for the end user. This allows Opera mini to deliver more information MB/MB than Safari meaning it would substantially drop a users data usage.



I for one hope it gets in not because I'm an Opera fan, in fact I'm not even an iPhone/iPad user. But I hate to see good hard work kept out because someone is afraid of a little competition. 

Check out Opera's iPhone count-up counter on My Opera community site and enter the contest to win an iPhone.

Monday, March 22, 2010

What Does Hacker Charlie Miller Have Up His Sleeve For Pwn2Own 2010?

Charlie Miller quickly gained notoriety two years ago at the CanSecWest security conference when he and his team used an exploit in the Safari web browser to hack the brand new MacBook Air in just under 2mins winning himself and his team not only the new MacBook Air but also $10,000 from security firm TippingPoint Technologies.

A year later he repeated the feat when he used yet another of his already known exploits to win him his second MacBook Air and an additional $5,000.

This year looks like it will be a three-peat for Miller who took second slot and first draw for Safari yet again. The security expert claims to have found no less than 20 zero-day exploits within OS X. Miller via Twitter last week stated he will present details on how he found the exploits during the conference but he made it clear he will not reveal the exact details on how the exploits work.

While the full details will not be disclosed Miller eluded to the approach in finding the zero-day flaws. According to his interview with Heise Security, Miller discovered the new vulnerabilities by fuzzing, a process which involves bombarding an application's input channels with as much corrupted data as possible. His presentation is subtitled: "An analysis of fuzzing 4 products with 5 lines of Python". The expert explained: "The talk is about what you really find when you fuzz and it tries to draw conclusions about what to expect in the future when you fuzz a mature product." Parts of the presentation apparently consist of statistics, for instance, about which percentage of flaws causes crashes, and which percentage can be exploited remotely.

Pwn2Own 2010 should be an interesting event this year, not only because of the flaws Miller found but because many including Miller himself are predicting the fall of the iPhone this year, this coming in-spite of the fact that last year not a single smartphone was hacked.

If you want full detail on the event including a schedule checkout the TrippingPoint Blog and to follow along with real-time updates and real-time feedback follow the TippingPoint Zero Day Initiative via theirTwitter account @theZDI.

Sunday, March 21, 2010

Linux Geeks Get Their Very Own Store

Earlier this month The Linux Foundation, a non-profit organization well know for their supports in the efforts in accelerating the growth of Linux, announced the launch of Linux.com. The new site is a Linux themed merchandise store where people can purchase a newly launched line of original T-shirts, hats, mugs and other items that reflect “geek culture.”

The Linux Store has been open for a few weeks now and features tons of great geek items. You can check them all out at http://store.linux.com/.

In addition to the new Linux store The Linux Foundation has also launched a desing contest for your would be graphic artists and designers. The Linux.com T-shirt Design Contest is calling for your best designs themed around the Linux and or Geek culture. 

Design submissions are due by April 11, 2010. The top five designs will be available for community vote at Linux.com through June 6, 2010. The winning design will be included on T-shirts available for purchase in the Linux.com Store and the designer will be awarded with travel to Boston, Mass., to attend LinuxCon (http://events.linuxfoundation.org/events/linuxcon) in August.

All revenue generated from the Linux.com Store will go directly towards Linux Foundation activities, events and strategic initiatives. The Linux Foundation uses funds from a variety of revenue streams to support the work of Linux creator Linus Torvalds and to sustain important services such as technical events; travel grants for open source community members; a vendor-neutral forum for projects such as MeeGo; and free training resources direct from the kernel community; among others.

Saturday, March 20, 2010

5 Reasons Tablets Suck And You Won't Buy One

Tuan Nguyen, from Tom's Hardware, has put together a great piece outlining some of the issue faced by the newest wave of tablet pc's. Mainly the article points out the fact that tablet, or slate pc's have been around for ages and yet despite that fact many out there in the tech world look at this newest wave of enthusiasm towards the platform as being the one that will finally catch on.

Nguyen opens the article with a great sub-headline:

"Let's admit it: tablets suck. They've been around for at least a decade and many are faster and offer more capabilities than Apple's iPad. But why haven't you bought one yet?"

For more checkout his full article "5 Reasons Tablets Suck And You Won't Buy One" , personally I think he brings out some really interesting points. A few of which some of you might take notice of since I'm sure there are several readers out there dying to jump on the bandwagon.

Friday, March 19, 2010

Make Older Firefox Extensions Compatible With Easy Hack

Ever wanted to run older extensions with your new Firefox release just to find the author hasn't created an updat3e yet. Well there are two easy ways to force compatibility of older extensions with some of the newer versions of the popular browser.
The first and easiest way is to use the Nightly Tester Tools Add-on. This extension is a quick easy way to run those add-ons and extensions you use with either new or nightly builds of Firefox, Thunderbird, Sunbird and Toolkit Seamonkey (Suiterunner).


The following is a brief list of the extension’s features, for the full set of features please take a look at the features list.
  • Extension compatibility fixing
  • Titlebar customisation
  • Build ID retrieval
  • Screenshots
  • Breakpad information
  • Restoring tabs from previous session
  • Leak log analysis
Another easy way is to simply hack the existing code in the old add-on itself. This might sound a bit more complicated however it's a fairly simple process that only requires a user to change a few things.

To perform the hack for yourself, you'll want to start by downloading and saving the Firefox extension from .XPI to .ZIP. Once you've done that you can use your favorite ZIP program, I recommend 7Zip, and unzip it. From there you need to look for the install.rdf file open that file with “Notepad” so that you can change the number for the “maxVersion”.

The exact code looks like this


Once you've changed the "maxVersion" to whichever build you are working on now zip up the contents again, rename the file from .ZIP back to .XPI, and then you can simply drag the file into the Firefox add-ons window to install it.


It should be noted that forcing an incompatible extension to install is risky. There are many cases where Firefox will stop working completely or behave incorrectly because an incompatible extension is being forced to work where the author never intended.

i-Got-Control App Turns iPhone, iPod touch, iPad Into Universal Remote

i-Got-it Corp. announces the launch and immediate availability of i-Got-Control, a plug-and-play accessory that turns an iPhone, iPod touch or iPad into a universal remote, allowing the user to control virtually any infrared device — TVs, stereo systems and more — at home or on the go.

Boasting an industry-leading database of more than 40,000 IR codes for consumer electronic devices worldwide, the i-Got-Control accessory and its associated iTunes app support a nearly unlimited number of IR electronics worldwide, making it easy to take control anytime, anywhere. And, with i-Got-Control's built-in IR library, users can CONNECT, SELECT and CONTROL their A/V components quickly and hassle-free — with no Wi-Fi network, wires or batteries needed.

"i-Got-Control empowers users to operate A/V devices, as well as many other pieces of IR equipment, including lighting and HVAC systems, no matter where they are," said Doug Schwartz, president of i-Got-it.com. "It also features an extensive built-in IR library, which means that — unlike most remote controls and other similar products in the marketplace — i-Got-Control does not require 'learning,' making it simple and easy to set up and use."

Getting started with i-Got-Control is easy. Simply download the free i-Got-Control application via iTunes and connect the compact accessory to an iPhone (OS is 3.0 or higher), iPod touch or iPad. Launch the i-Got-Control application and select the devices to control via pre-defined, user-friendly screens. Last, choose the make and model of the IR devices and save the settings. It's that simple.

The graphic user interface is highly intuitive, providing master volume control, as well as both audible and visual feedback. In addition, if a particular device's IR code cannot be found, i-Got-Control's user-friendly learning capabilities make it easy to control virtually any device. And, with a price of only $69.95, i-Got-Control makes it simple to take control anywhere, anytime.

For more information, please visit www.i-got-it.com

Source: i-got-it-corp

Monday, March 15, 2010

iPads Go On-sale, We Hit The Snooze Button

Apple began accepting pre-orders for its hotly anticipated iPad tablet last Friday and according to at least one report the iPad is a very hot seller possibly selling as many as 120k units on Friday alone.

Pricing on these hot little devices range from $499 for a 16GB Wi-Fi version up to $829 for the 64GB Wi-Fi 3G enabled iPad. The devices will not ship until April, but Apple fans can now place their orders via Apple's online store.

Given the fact that most of the general public has yet to set eyes on the device, let alone handle it these preliminary numbers are a bit surprising (at least to this geek). I've mentioned before that I was not overly impressed by the initial details of the iPad, nor do I plan on buying one anytime soon. But I do stop short of saying I'll never own one, at least not before I have the chance to set eyes and hands on the device.

I know the iPad is based on the same OS that drives the iPhone and iPod Touch and much of the functionality of the device should be similar. However until you actually get your hands on one and test it you will not now how they compare. For one the device might simply be to large to offer the same ease of use. They may also lack the same responsiveness and feel that their brethren do.

Apple fanboys can be Apple fanboys but this geek is going to sit in a holding pattern and wait and see what other device come down the chutes before making a move.

Intel Tries To Match OCZ With New $125 SSD's

Earlier this month OCZ made a big move in the SSD market when they announced their new sub $100 Onyx series solid state drives. Today Intel looks to keep pace by offering a new more affordable 40 GB Intel X25-V Value series SATA SSD priced at $125.

Both the OCZ Onyx series and the Intel Value series will come in 2.5" form factors and will feature Intel's feature sustained sequential read speeds up to 170 MB/s and write speeds up to 35 MB/s, while the Onyx series is slightly slower read speeds at up to 125MB/s but a more robust write speed at up to 70MB/s.

Wednesday, March 10, 2010

WD Introduces My Passport AV Designed Specifically For Audio Video Devices

With the ever increasing number of media devices featuring USB ports for USB drives to add storage and play multimedia content from the drive to an HD TV more consumers are opting to add ultra portable drives to their systems. Today WD introduced the new My Passport AV portable media drive designed specifically to meet the requirements of this demanding video streaming environment. These new drives delivers the formatting and low-power consumption that assures out-of-the-box compatibility with many leading CE (consumer electronics) devices.

The new 320 GB My Passport AV portable media drives are designed to operate seamlessly with the Direct Copy feature offered in Sony's new Handycam video recorders Blu-ray Players gaming consoles, televisions and many other popular media players.

My Passport AV Compatibility
My Passport AV portable media drives are formatted FAT32 and are compatible with Windows XP, Windows Vista, Windows 7, Mac OS X and Apple's Tiger, Leopard, and Snow Leopard. My Passport AV portable media drives utilize the same drive technology found in WD AV drives inside leading cable and satellite set-top boxes and DVRs (digital video recorders) around the world.

The My Passport AV portable media drives are compatible with the following devices:

  • WD TV family of media players;
  • 2010 and later Sony camcorders with Direct Copy functionality;
  • Sony 2010 Blu-ray Disc Players including BDP-S370, BDP-S470, BDP-S570;
  • Sony 2010 Blu-ray Disc Home Theater Systems including BDV-E370, BDV-E570;
  • JVC LT-32P689 television;
  • Samsung LN32A550 television;
  • Phillips 42PFLA332D television;
  • Microsoft Xbox 360 (compatible with the USB media playback feature); and,
  • Sony PlayStation 3.

For a complete list of devices compatible with the My Passport AV portable media drives, please visit the WD Web site. A product specification sheet and photos of My Passport AV drives are available on the company's Web site at http://www.westerndigital.com/MyPassportAV.

Source: Western Digital