George W. Bush to Visit Facebook HQ for Live Video Q&A

Former U.S. President George W. Bush’s book tour will stop at Facebook’s headquarters in Palo Alto on Monday, with the social networking site announcing a “Facebook Live” event for 5 p.m. ET / 2 p.m. PT.

Bush has been making the media rounds over the past several weeks, appearing on The Today Show, Oprah and The Tonight Show among other programs to talk about his memoir “Decision Points.”

Like other Facebook Live events, users will have an opportunity to ask Bush questions, though at this point it’s unclear how the event will be moderated or who will be asking users’ questions.

While this will be the first appearance of Bush (or any U.S. president) on Facebook Live, the 43rd president has been on the site since June, when he set up a Facebook Page. The page currently has more than 600,000 fans and is being used to promote the book and Bush’s various media appearances.

Politics and malware make strange bedfellows

Sophos Labs: There are two stories that have been the focus of much speculation that have come to some closure today. New information confirming many peoples suspicions about Aurora and Stuxnet have been reported by Wikileaks.org and Reuters.

As has been widely reported Wikileaks began releasing over 250,000 previously secret diplomatic cables that it is assumed they received from PFC. Bradley Manning. Most of the cables are as uninteresting as reading your friends Yahoo! mail.

Quote from nytimes.com article on Wikileaks cables

One particular cable did shed some light on the "Operation Aurora" attacks on Google, Adobe and others last January. The New York Times reported that a "Chinese contact" told the embassy that the Politburo was behind the attacks.

OK, China did it, mystery solved, we can all go home now. This is what most of the press seems to be saying, but I am not quite so convinced. Yes it is probable that there was Chinese involvement in the Aurora incident, but I am not willing to claim that it was on order from President Hu Jintao as told by a "Chinese contact".

Within 24 hours of the Aurora cable becoming public, Iran and Stuxnet were back in the news. President Mahmoud Ahmadinejad denounced "enemies of Iran" for using computer code to "create problems" for their uranium enriching centrifuges. This would appear to be confirmation that Iran was in fact the target of the Stuxnet worm and the curious specificity of the malware in what it would attack and how.

Of course Mr. Ahmadinejad is pointing his finger in the direction of the United States and Israel, which up to this point there has not been much evidence to indicate this to be fact.

A separate report from Iran this morning talked of coordinated bombing attacks against two important nuclear scientists in Iran's program. Clearly there is a concerted effort to derail the Iranians, but from where anyone can guess.

What are the lessons of the day?

Firstly you should ensure that information that is valuable is protected with strong cryptography and cannot be transfered in bulk to Wikileaks (or your competitors).

Second when developing a nuclear strategy (or protecting networks that you don't want infected with malware) you should run pro-active anti-malware products which use HIPS, device control and network monitoring. Critical systems should both run anti-malware and be air-gapped from the Internet.

Hmmm. This is sounding old hat. The advice for nuclear powers, diplomats and militaries is the exact same advice as all of the rest of us should heed. This isn't about cyberwar, it's about cyber-insecurity. Nations potentially using malware to attack one another, spies, thieves and turncoats will always be used to get an advantage, and the same thing that motivates nation-states motivates criminals and competitors... Power and wealth.

Fake Trojan Removal Kit serves up ThinkPoint Rogue

You might want to steer clear of the following fake security program, being promoted as a “Windows Trojan Removal Kit” but actually hijacking your PC in the form of the ThinkPoint rogue with a mixed (24/43) detection rate.

The file is currently being offered up by your typical “fake security scan” pages, such as microsoftwindowssecurity152(dot)com. Those familiar with this particular rogue will be aware that it tends to stick with domains similar to the one above.

Installing the executable can potentially give you a bit of a headache, with what would appear to the average user to be fake “Blue Screens of Death” and payment nag screens. See here for details on how to get around the supposedly locked up desktop, and check here for some of the many variations on this theme.

Facebook co-founder launches social network Jumo for social good

CNN - Mashable: Today, users can start connecting with all their favorite social causes in one online sphere, as Facebook co-founder Chris Hughes has launched his much-buzzed-about social network, Jumo.

Hughes, who left Facebook in 2007 to become the Obama campaign's director of online organizing, soft-launched Jumo last March.

At that time the site existed merely as a homepage featuring a rather intriguing survey box that asked the site visitor an array of questions from, "If you had a daughter tomorrow, which would you name her?" to "Would you say the world is getting better or worse?"

Upon answering these queries, you could also submit your e-mail address to get more information as it came.

Since the site first came on our radar, we here at Mashable have waited with interest to see what Hughes would reveal.

Would the site have its desired effect: Bringing together those interested in social change to expedite global do-gooding? And, more simply, what would it look like? Would it be easy to use?

A couple of months ago, we got a little more insight into the project when Hughes spoke at the Mashable & 92Y Social Good Summit in New York City about the inspiration behind Jumo -- how, after the January 12, 2010, Haiti earthquake, he saw people reaching out those in need and the incredible response of the online community.

He also saw that reactions like this are not enough. Instead of having the doing-good-at-Thanksgiving-time mentality (i.e. being galvanized by big events and holidays), people need to be involved with their causes of choice year-round. And that's where Jumo comes in.

Jumo was designed to let users find, follow and support the causes important to them, and with 3,500 organizations on board at launch, would-be philanthropists should be able to find and follow something of interest upon joining. (For comparison's sake -- Apple's Ping had 2,000 artists two months out of the gate.)

We have yet to actually get our mitts on the site, but Hughes gave us a walkthrough that revealed how easy-to-use and intuitive the layout is.

In fact, it's very similar to Facebook. Upon signing up via Facebook Connect, which lets you easily find friends on the site, you can begin to shape your Jumo experience by figuring out "What You're Interested In" by way of selecting "Issues."

"This is to get a sense of who someone is, what they're passionate about, what's meaningful to them," Hughes says. "It's the first way to figure out what a person might want to see more of."

Every Issue also has a page that you can follow, allowing you to discover more organizations over time.

After choosing your Issues, you can either drill down to find more specific Issues (think education reforms, schools, at-risk youth, etc), or sort through "Projects" affiliated with that space and select which ones you would like to follow. You can also sort through Projects by location, finding those close to you, if you are so inclined.

Once you choose your Projects and click "Done," you're transferred to your homepage, which, again, is very similar to Facebook's. It even has a newsfeed of sorts with updates from all the projects, people and issues you're following.

It also has a "Talk" section showing social updates from Projects and people you follow.

"Our real mission is to make it as easy as possible for people to be able to find these organizations and then connect with them in a substantive way," Hughes says.

The site even features its own "Like" buttons, which allow you to "Like" a news story or video posted by a Project you follow and share that story on your own profile page, which is basically a feed of your activity on the site.

That way, you can see what your friends are interested in and check out Issues and Projects they might be involved with. You can also "Like" organization pages via Facebook "Like" buttons, thereby sharing that info with your Facebook friends.

"It's all geared to answer the question: What does [insert name] care about?" Hughes says.

In addition to joining as an individual, you can also add Projects to the site -- so long as they pertain to social or environmental issues.

"We're an open platform where anyone can create a profile or an organization page. You have to be vetted by the IRS to be able to receive any money from anyone on the Jumo platform [via a donation button], but anyone can create a page," Hughes says.

By joining Jumo, a Project can pull all its social streams into one place -- Twitter, Facebook, Flickr, blogs, etc. That way, followers can check out a wealth of information on a single organization all in one framework.

Again, Project pages are a lot like Fan Pages on Facebook, however the key difference here is that the focus seems to be less on the individual than on the organization.

On Facebook, it's more about the connections you make with friends than those you do with brands/bands/etc. Jumo focuses much more on creating a space where you can learn more about organizations, and thereby take action.

At this juncture, you're probably thinking: "So what does this site actually do? Isn't this just another form of the infamous slacktivism?"

"I think that when people click a 'Like' button of follow something on Twitter or sign up for an e-mail list, it's the first statement of support for any interest," Hughes says. "It doesn't mean that they don't then go out and do things like knock on doors and go to protests or go to rallies or go volunteer or donate. They do do these things."

"We can make it easier for people to connect with the professionals working in a lot of fields in order to make change happen. There are a million different groups out there working day in, day out to provide healthcare or education services, or do good government work and I think that our challenge is not to use social media to reinvent the engagement paradigm, but instead to support the work of the people who are out there getting the job done, day in, day out."

WikiLeaks Targeted in DDoS Attack as Latest Leak Hits the Web

Mashable: Controversial whistleblower website WikiLeaks is reporting that it’s under a “mass distributed denial of service attack” just as its much-hyped leak of secret embassy cables has been leaked early on Twitter.

According to a tweet from the website’s official Twitter account, WikiLeaks is experiencing a DDoS attack. The reported attackers are not yet known. Several reports state that the website has been experiencing intermittent downtime. We are currently attempting to verify that WikiLeaks is indeed under attack.

The attack comes just hours before the site is set to release thousands of new secret U.S. documents. Those classified documents reportedly contain secret and embarrassing cables sent by the State Department. U.S. diplomats have been briefing foreign leaders about what could be in those documents in an attempt to minimize the potential damage.

The leak is out.

Unfortunately for the whistleblower website though, it looks like the leak has been leaked early to several Germans, thanks to a leaked embargo copy of Der Spiegel. Gawker reports that the leak may not be as damaging as expected — for example, the cables praise German Chancellor Angela Merkel as being like “teflon” and compares Iranian president Mahmoud Ahmadinejad to Adolf Hitler.

It’s safe to say that WikiLeaks is not having a good day.

Can you really see who viewed your Facebook profile? Rogue application spreads virally

SophosLab: Once again, a rogue application is spreading virally between Facebook users pretending to offer you a way of seeing who has viewed your profile.

As we've described a couple of times before, plenty of Facebook users would *love* to know who has been checking them out online.. but unfortunately scammers are aware of this, and use the lure of such functionality as a way to trick you into making bad decisions.

Messages spreading rapidly across the Facebook social network right now say:

OMG OMG OMG... I cant believe this actually works! Now you really can see who viewed your profile! on [LINK]

If you're tempted to click on the link you're taken to a webpage which encourages you to go a little deeper and permit an application to have access to your Facebook profile.

But do you really want complete strangers to be able to email you, access your personal data and even post messages to any Facebook pages you may administer?

If you've got this far then you really shouldn't go any further. Scams like this have been used to earn commission for the mischief makers behind them, who have no qualms about using your Facebook profile to spread their spammy links even further.

Because if you do continue, you'll find that your profile will be yet another victim of the viral scam - spreading the message to all of your online Facebook friends and family. And no, you don't ever find out who has been viewing your profile.

Ever wondered how many people fall for a scam like this? Well, the figures can be shocking. This current campaign is using a variety of different links - but via bit.ly we can see that at least one of them has already tricked nearly 60,000 people into clicking.

I've informed the security teams at both bit.ly and Facebook about these links, and requested that they be shut down as soon as possible.

Always think before you add an unknown application on Facebook, and ask yourself if you're really comfortable with ceding such power to complete strangers. Rogue application attacks like this, spreading virally, are becoming increasingly common - and do no good for anyone apart from the scammers behind them.

If you've been hit by a scam like this, remove references to it from your newsfeed, and revoke the right of rogue applications to access your profile via Account/ Privacy Settings/ Applications and Websites.

And don't forget to warn your friends about scams like this and teach them not to trust every link that is placed in front of them. You can learn more about security threats by joining the thriving community on the Omid's Blog! Facebook page.

Comment on Stuxnet and more Windows 0-days

Over the last few days, some news organizations have been saying that Stuxnet source code is available on the black market, and that clearly therefor there is an impending Internet Armageddon.

This is patently silly, on a number of levels, but silly none-the-less.

First thing is that I flat-out don't believe Stuxnet source is available for sale on the black market or anywhere. Remember how often I say that if something sounds too good to be true, it's not true? Well, the opposite applies too. If something sounds too bad to be true, it's not true either. We really don't know who built Stuxnet, or who the intended target was, be we may rest assured that whoever put that much work into it, isn't selling it, at any price. It's actually more probable that some no-honor-among-thieves bad guy is scamming fellow bad guys. "Sure, this is Stuxnet source code. Prove otherwise."

Second thing is that even if it was for sale, it would require a huge amount of expertise to make it work on something other than the original target. We can be comfortable that all process controllers work differently enough that one bit of malicious code simply won't work on all systems.

Thirdly, all AVs now detect Stuxnet, so it would have to be changed significantly to evade anyone, something that again requires a large amount of expertise.

I could go on and on, but you get the idea. The fundamental concept exposed by Stuxnet can't be ignored, but selling Stuxnet source, and bringing the world to it's knees ain't gonna happen.

The other item deserving of a comment is the current Windows 0-day, which involves an Elevation of Privilege. EoP is much less dangerous than Remote Code Execution. You still have to get the malicious code executing on this system to take advantage of the EoP.

Yes, it's a problem, but it's easily correct, and I'd expect it corrected in the next patch rollout.

Relax, and enjoy your weekend.

Closer look at W32/Ramnit.C

Thomas Wegele, Virus Researcher from Avira wrote: In this month’s ITW malware set from the Wildlist organization two new variants of W32/Ramnit appeared. W32/Ramnit is a Worm spreading via infected executable files and infected HTML Files. It is a quite widespread malware – which is why we decided to dig deeper into it.

Upon execution the malware creates a new file in the directory where it was started. This file is named “mgr.exe”. It then gets executed and creates a copy of itself in “C:\%ProgramDir%\Microsoft\WaterMark.exe” which also gets executed after creation and in turn infects the EXE, DLL and HTML files found on the system and tries to connect to a server.

W32/Ramnit.C adds an extra section with the name “.text” to the PE Files (EXE, DLL) found. The file analysed now contains two “.text” sections after the infection.

The last section marked with a red frame is the new appended one and carries the malicious code. The file infector changes the entry point of the PE-file so that the malicious code is executed before the regular code. Right after execution of such an infected file, the aforementioned “mgr.exe” file will be created and starts infecting the files.

But W32/Ramnit.C is not only spreading via PE-files. The virus is also adding a Visual Basic for Scripting (VBS) script to HTML files on the infected system. The VBS script is concatenated at the end of the HTML file and 86.498 Bytes in size – which is very much compared to a hidden Iframe or something similar.

The VBS script contains a “DropFileName” which is “svchost.exe” and the data which is a PE file compressed using UPX as hex string. And it also has code which is used to transcode that string and write the result to that file to the hard disk.

The newly created “svchost.exe” is written in the temporary folder which is defined in the system. On Windows 7 this is for example “C:\Users\<Username>\AppData\Local\Temp” by default. After creation the script executes the malicious, fake “svchost.exe” using WSHshell.Run.

The connection to a server which W32/Ramnit.C initiates uses TCP port 443. This port is normally used for HTTPS and thus isn’t filtered by many firewall solutions. Another measure to avoid detection by firewalls is that W32/Ramnit.C uses injects itself into a hidden executed Internet Explorer process for the communication to its C&C server.

This malware spreads via web sites, for example, as infected webmasters upload infected web pages and binary files to their servers – unknowingly. Avira anti malware solutions protect users from W32/Ramnit as they detect and block it.

The Pirate Bay founders sentenced to jail

The Swedish Appeals Court upheld the conviction and jail sentences of three co-founders behind the infamous The Pirate Bay service. Peter Sunde, Fredrik Neij and Carl Lundstrom all received one-year jail sentences and $4.2 million in fines from a Swedish lower court earlier in the year.

After the court ruling, Neij has been given a 10-month sentence, Sunde received an eight-month sentence, and Lundstrom was given a four-month sentence. A different defendant will be sentenced at a later date because he was unavailable due to illness.

“Today’s judgment confirms the illegality of The Pirate Bay,” said Frances Moore, IFPI CEO said, in a press statement. “We now look to governments and [Internet service providers] to take note of this judgment…and take the necessary steps to get the Pirate Bay shut down.”

Damages have now been increased from $4.3 million up to $6.5 million, and further legal action is expected as the groups try to shut down the torrent site.

After publicly launching in 2003, The Pirate Bay quickly became one of the most popular online destinations for people seeking to download content.

The Pirate Bay is still a popular online destination, even with the now infamous service’s co-founders claiming they are no longer involved with the project. One co-founder went as far as saying the site “really sucks,” while the group’s spokesperson is not allowed to run the company.

Google Chrome and Multiple Profiles

Google Chrome has always supported multiple profiles, but you had to use a command-line flag (--user-data-dir="c:\path\to\the\profile") to associate a profile with a folder where the browser will save its state.
At some point, Google added an option that allowed you to open a new window and use a separate profile, but it was quickly removed. According to a design document from Chromium's site, this feature be available again.
"The multiple profiles feature will allow the user to associate a profile with a specific set of browser windows, rather than with an entire running instance of Chrome. Allowing different windows to run as different Chrome identities means that a user can have different open windows associated with different Google accounts, and correspondingly different sets of preferences, apps, bookmarks, and so on -- all those elements which are bound to a specific user's identity."

Users will be able to associate a profile with a Google account and log in at the browser level. This is a great feature for Chrome OS, but it will also work in Google Chrome.
Google will associate each Chrome window with an identity. "On Windows (and Linux), this is accomplished with a colored and labeled menu-enabled tag at the top of the browser frame, next to the window controls. On Mac OS X, the window frame is too small to accommodate a tag; instead, we add an item to the menu bar, with a special colored background, in the same way the Windows tab is specially colored."

Taken from Google Operation System Blog

Rainbow 0.2 is here!

For those who missed this update on Nov 18:

In the spirit of releasing early and releasing often – Mozilla bring you version 0.2 of Rainbow – an experimental Firefox add-on from Mozilla Labs that exposes audio and video recording capabilities to web pages.

What’s new in this release?

• It now support both audio and video recording on Windows, and audio recording on Linux.
• They added preliminary support for writing multiplexed media frames to a websocket.
• JS callers are now able to specify custom video resolutions, encoding quality, audio sampling rates and channels.
• Numerous bug fixes, such as behaving correctly on Mac OS X 10.5 (Leopard), and generating correctly encoded OGG files (the audio tracks of which were previously unplayable by Firefox).

For a full list of changes, check out their commit logs – or even better – contribute on Github! Also, don’t forget to read the README for additional information.

Mozilla is always delighted to hear from you – join in on their discussion forum or IRC channel. Happy hacking!

Miramar (Thunderbird 3.3) Alpha 1 available for testing

Mozilla announced Miramar Alpha 1, an early version of their next Thunderbird.

Miramar Alpha 1, available here for download, is for testers, extension developers, and other friends who are curious to follow the development of the next release of Thunderbird.

Miramar Alpha 1 is built on top of the next generation of Mozilla’s layout engine, Gecko 2.0 and includes a new Addon Manager and over 190 platform fixes to improve performance and stability. We expect to release further interim releases as we work towards a major new release of Thunderbird.

Please read the release notes for more details.

Beware the Justin Bieber erection Facebook scam

That's possibly the most unlikely headline I've ever had to write in my computer security career, but never mind..

My guess is that regular readers of the Naked Security site might not be ardent fans of Justin Bieber - but chances are that some of you have young daughters or nieces who can't get enough of the pint-sized pop hamster.

If that's the case then they might be intrigued by a message that is spreading virally across the Facebook social network claiming to be footage of... and how can I put this delicately? I don't think I can.. Justin Bieber with an erection.

Messages like the following are being seen:

WTF !! I just saw that Justin Bieber got erection in a public interview.lol

Probably not the type of message you would typically click on from your office computer, but maybe a young teenybopping music fan in your household would find the subject matter irresistible to investigate further.

And if they do click on the link they are taken to a Facebook page with the message "Justin Bieber gets a boner in Public !!!", and an invitation to "Click to watch" a video.

The page contains a graphic claiming that the application is a "Facebook verified app" (which seems unlikely given the subject matter).

Would young female fans of Justin Bieber be likely to go further - I suspect so..

As is normal in scams like this on Facebook, you are then presented with a message from Facebook asking you to confirm that you are happy for the third party application to have all sorts of access to your Facebook account - including the ability to post messages to your wall.

This is your last chance to be sensible, and not put your account at risk. Unfortunately far too many people are tricked by social engineering to give suspicious third party apps like this full reign to mess around with their Facebook accounts. If they're not using the modern day equivalent of David Cassidy to lure users into granting permission, they're pretending to be new Facebook functionality like "Dislike" buttons, or pretending to be free tickets with an airline.

But if you do make the mistake of clicking further, then you will find that you are not watching a video of Bieber having trouser trouble, but instead being asked to take a survey.

Surveys like this generate revenue for the scammers who are behind the application - they earn commission for every survey that is completed.

In the background. meanwhile, the rogue application has abused your social networking account spreading the spam virally via your wall to your Facebook friends and family.

It's only natural that scams like this will continue for as long as users continue to fall for silly tricks like this, and the scammers continue to find it financially rewarding.

If you've been hit by a scam like this, remove references to it from your newsfeed, and revoke the right of rogue applications to access your profile via Account/ Privacy Settings/ Applications and Websites.

Don't forget - if you know young people who use Facebook, you should warn them about scams like this and teach them not to trust every link that is placed in front of them.

If you're a member of Facebook and want to learn more about security threats you should join the thriving community on the Omid's Blog! Facebook page.

Do you think Facebook is doing enough to stamp out survey scams like this, or is it the fault of the Facebook users themselves? Let us know what you think by leaving a comment below.

Miley Cyrus and cybercriminals make strange bedfellows

Miley Cyrus is eighteen years old since yesterday.

I don't know if her father, legendary "Achy Breaky Heart" singer Billy Ray Cyrus, will be joining in her birthday celebrations, but I imagine he'll be quietly wiping away a tear as his daughter finally becomes officially an adult (at least as far as the age of consent in her home state of Tennessee is concerned).

The pop singer and Hannah Montana star has had her fair share of encounters with the world of cybercrime during her short life.

For instance, a couple of years ago, a hacker called "Trainreq" took advantage of the fact that Miley Cyrus was using the same password on multiple websites, and broke into her Gmail account, stealing candid photographs of her "posing provactively" in her underwear and swimsuit.

I found it astonishing that parts of the media felt comfortable reproducing the stolen photographs - did no-one at the time care that the poor girl was only fifteen years old?

And last year, Miley Cyrus proved that she hadn't learnt many lessons about password security after her Twitter account was compromised by hackers who posted offensive messages in her name.

You can't really imagine her Disney overlords being too happy with that kind of image being associated with their squeaky-clean star.

But now Miley Cyrus is 24 hours from being all grown up. Not that another bunch of cybercriminals are waiting for her to reach the age of consent.

A message spreading across Facebook claims to link to video footage of Miley Cyrus with her latest boyfriend.

Miley Cyrus went too far with her hot boyfriend. Wow! she is wild.
With hot boyfriend she went too far!
Fun Video

If you were an admirer of Miley, you might well be tempted to click on the link and ask questions later. Such an action would take you to a webpage which tricks you into believing that you are about to see scandalous video footage of the star going "too far" with her boyfriend.

And what do you know? The perpetrators of this latest scheme are using a photo that Miley Cyrus apparently took herself, baring her midriff - I wouldn't be surprised if it's one of the pictures that was stolen from her Gmail account when she was fifteen years old.

Clicking further will take you to a rogue Facebook application that asks you to grant it permission to access your Facebook profile, post to your wall and so forth. In this way it's very similar to many other scams we've seen spreading virally in the past (we saw a rather sordid example involving another teen pop sensation, Justin Bieber, this weekend of instance).

The scammers' end game is to trick you into taking an online survey. You're tricked into believing that you need to complete the survey in order to see the promised content. The bad guys, meanwhile, are earning commission for every survey completed, and are using your Facebook account to spread the links even further.

If you've been hit by a scam like this, remove references to it from your newsfeed, and revoke the right of rogue applications to access your profile via Account/ Privacy Settings/ Applications and Websites.

If you know young people who use Facebook, don't forget to warn them about scams like this and teach them not to trust every link that is placed in front of them. Furthermore, you can learn more about security threats by joining the thriving community on the Omid's Blog! Facebook page.

There's only one thing left to say. Happy birthday for tomorrow, Miley. Your dad is a legend.

Christmas Tree app virus hoax spreads on Facebook

Thousands of Facebook users are warning each other about a Christmas Tree virus said to be spreading in the form of a rogue application on the social network.

The only problem with this warning? It's utterly bogus.

Here's a typical message being shared widely on Facebook:

WARNING!!!!!!.....DO NOT USE THE Christmas tree app. on Facebookplease be advised it will crash your computer. Geek squad says its oneof the WORST trojan-viruses there is and it is spreading quickly.Re-post and let your friends know. THANKS PLEASE REPOST!

Users believe they're doing the right thing when they share warnings like this - but unfortunately they haven't checked their facts. Although anyone could at any time create a rogue application with the name "Christmas Tree" of course, we're not aware of any malware which uses this disguise.

Furthermore, since when was Geek Squad a reliable source for information about new malware? Wouldn't you be more sensible to check with an established anti-virus company? A legitimate warning would at the very least have included some links to further information - such as a statement on Geek Squad's website.

Ironically, the hoax is probably spreading much faster than any of the genuine commonly encountered Facebook viruses at the moment.

Please don't share virus warnings with your online friends until you have checked them with a credible source (such as an established computer security company). Malware can be killed off fairly easily, but misinformation like this can live on for months, if not years, because people believe they are "doing the right thing" by sharing the warning with their friends.

If you're a regular user of Facebook, be sure to join the Omid's Blog! page on Facebook to be kept informed of the latest security threats.

PS. Those of you very long in beard may recall that in the late 1980s there was a real virus called "Christmas Tree" (also known as "CHRISTMA EXEC"). It displayed a crude picture of a Christmas Tree using the ASCII character set, and infected computers on IBM's internal network and other systems.

However, as this was way back in 1987 I'm pretty confident that this hasn't inspired the latest scare on Facebook!

Over 40 security fixes for iPad, iPhone and iPod Touch in iOS 4.2

Yesterday, Apple pushed out the much anticipated update to its mobile operating system - iOS 4.2.

Although most of the headlines have focused on new functionality Apple has introduced, such as bringing folders and multi-tasking to the iPad, there's a much more important reason why you should be considering updating your Apple iPhone, iPod Touch or iPad.

Security.

According to an Apple knowledgebase article, iOS 4.2 includes more than 40 security fixes designed to better protect iPhone, iPod Touch and iPad users.

It's critical that users of Apple's popular gadgets update their operating system as soon as possible. Fixes included in the iOS 4.2 update include patches for the web browser. Without these users could be at risk when they visit booby-trapped websites - code embedded on the website could cause iOS applications to crash, or even plant and run malicious code on the device.

In addition, iOS 4.2 fixes a flaw which made it possible for hackers to push malicious configuration files onto iPhones, iPads and iPod Touches, and a problem with the way Excel files can be imported that could lead to malicious code being executed.

Users of the iPhone, iPod Touch and iPad can receive their iOS 4.2 update via the normal route - downloading it as an update via iTunes.

Lost laptop leads to first Data Protection Act fine for UK firm

 
The Information Commissioner's Office (ICO) has fined two organizations for serious breaches of the Data Protection Act - the first to be issued under new tougher guidelines in the UK.

The security breach at Sheffield-based firm A4e happened in June 2010, after the company issued an unencrypted laptop to an employee in order to do work from home. The laptop was subsequently stolen from the employee's house.

That wouldn't have mattered too much, of course, if the laptop hadn't contained sensitive information. Unfortunately it carried personal data relating to 24,000 people who had used community legal advice centers in Hull and Leicester.

Personal details recorded on the laptop included full names, dates of birth, postcodes, employment status, income level, information about alleged criminal activity and whether an individual had been a victim of violence.

It is understood that an unsuccessful attempt was made to access the data on the hard drive shortly after the computer was stolen. Quite rightly, A4e reported the incident to the ICO, and subsequently notified the people whose data could have been accessed.

The ICO have now fined A4e a total of £60,000, saying that the data loss could have caused individuals "substantial distress", and admonished them for not putting encryption in place despite knowing the amount and type of sensitive data being held on the laptop.

And that's the point, of course. The entire problem and the subsequent fine was entirely avoidable - if the laptop had been properly encrypted, as Information Commissioner Christopher Graham noted:

"Thousands of people's privacy was potentially compromised by the company’s failure to take the simple step of encrypting the data".

In a separate incident, Hertfordshire County Council has also been fined £100,000 by the ICO after it faxed details of a child sex abuse case to a member of the public.

Both Herefordshire County Council and A4e have apologized for the serious security breaches.

The ICO was granted new powers by the British government earlier this year allowing it to fine companies up to £500,000 for breaches of the Data Protection Act.

More information about the ICO's powers can be found on the ICO's website, where it has published more information on the Data Protection Act.

You can read more opinion on this case from Graeme Stewart, who blogs about security in the public sector for Sophos.

Clearly more organizations need to wake up to the danger of data loss - storing sensitive information on an unencrypted laptop is a time bomb waiting to happen. Not only could you put your customers, staff and partners at risk - you could also be putting your company at risk of a substantial fine.

Safe holidays season

Avira TechBlog: Thanksgiving and according holidays are very close – a time in which many people have the time to do (online) shopping. The cyber criminals are eager for their share, so it’s time to remember some safety measures.

We are expecting to see spam and phishing campaigns luring the recipients to visit malicious web sites. These web sites usually look quite legal and official. As precaution, don’t follow links from emails to online stores and online payment systems, but use bookmarks or type in the addresses directly into the browser’s address bar. And of course just visit shops which you already know. Some scams can be identified by very low prices – if they look too good to be true, they usually are!

Another scheme we often see is Search Engine Poisoning. While searching for some products, the cyber criminals either buy advertisements on the search engine or abuse the search engine so their malicious web sites are ranked high and show up among the first search results. Here it is helpful to have a webfilter in place which warns of known spam, phishing and rogue web sites; most web browsers have a basic filter built-in, so make sure to have it activated. Avira AntiVir Premium and Avira Premium Security Suite offer a even more sophisticated WebGuard to protect users from harmful web sites.

Yet another method to squeeze money out of victims used by cyber criminals is infecting them with faked anti virus solutions. These are for example hidden as updates or needed video codecs on web sites and either are installed by the user or by security vulnerabilities in installed software like the web browser, the PDF reader, Flash Player or Java. Thus safety can be increased by making sure to only use the latest software versions and to install all available updates from within the software – there usually is an update check integrated. Also, using a anti malware solution like the basic protection of Avira AntiVir Personal or solutions with many more protection layers like Avira AntiVir Premium or the Suite will help avoiding infections.

Knowing about these threats will help enjoying the holidays and the time with the beloved.

7-Zip version 9 is out

For those who missed this update on Nov 18:

7-Zip 9.20 was released.

7-Zip for 32-bit Windows:
http://downloads.sourceforge.net/sevenzip/7z920.exe
Mirror: http://www.filehippo.com/download_7zip_32/

7-Zip for 64-bit Windows x64:
http://downloads.sourceforge.net/sevenzip/7z920-x64.msi
Mirror: http://www.filehippo.com/download_7-zip_64/

What's new after 7-Zip 4.65 (2009-02-03):

• 7-Zip now supports LZMA2 compression method.
• 7-Zip now can update solid .7z archives.
• 7-Zip now supports XZ archives.
• 7-Zip now supports PPMd compression in ZIP archives.
• 7-Zip now can unpack NTFS, FAT, VHD, MBR, APM, SquashFS, CramFS, MSLZ archives.
• 7-Zip now can unpack GZip, BZip2, LZMA, XZ and TAR archives from stdin.
• 7-Zip now can unpack some TAR and ISO archives with incorrect headers.
• 7-Zip now supports files that are larger than 8 GB in TAR archives.
• NSIS and WIM support was improved.
• Partial parsing for EXE resources, SWF and FLV.
• The support for archives in installers was improved.
• 7-Zip now stores NTFS file timestamps to ZIP archives.
• Speed optimizations in PPMd codec.
• Speed optimizations in AES code for Intel's 32nm CPUs.
• Speed optimizations in CRC calculation code for Intel's Atom CPUs.
• New -scc{WIN|DOS|UTF-8} switch to specify charset for console input/output (default = DOS).
• New -scrc switch to calculate total CRC-32 during extracting / testing.
• New additional "Open archive >" item in context menu allows to select archive type for some files.
• It's possible to specify Diff program in options (7-Zip File Manager).
• 7-Zip now can open/copy/compress disk images (like \\.\c:) from \\.\ folder.
• 7-Zip File Manager now doesn't use temp files to open nested archives stored without compression.
• The console version now doesn't show entered password.
• New small SFX module for installers (in Extra package).
• Disk fragmentation problem for ZIP archives created by 7-Zip was fixed.
• Some bugs were fixed.
• New localizations: Hindi, Gujarati, Sanskrit, Tatar, Uyghur, Kazakh.

Wanted: more than 2,000, in Google hiring spree

Reuters: Google Inc plans to hire more than 2,000 people around the globe, bumping up its workforce as it expands into new markets and battles for talent with faster-growing rivals.

The world's largest Internet search engine, whose finance chief told investors in September that the Internet industry was waging a "war for talent," has job openings listed for 2,076 positions on its website, according to a Reuters tally on Thursday.

The number of job openings is up nearly six-fold from a similar tally of job listings page conducted in March 2009.

The hiring spree is taking place alongside a string of more than 20 acquisitions this year that have already helped swell Google's ranks to more than 23,300 employees at the end of September, up nearly 18 percent since the beginning of the year.

"We've been ramping up our hiring and the number of open jobs over the course of the last year," Google spokesman Jordan Newman said.

He would not comment on the exact number of openings, but said the jobs listings Web page was completely up to date and is monitored very carefully.

Google, which controls about two-thirds of the global Internet search market, is looking for new opportunities to grow by branching out into a variety of markets, including Android smartphone software, online display advertising and Web-based productivity software.

Those fledgling forays come as it fends off social networking giant Facebook, which is challenging Google for online advertising dollars and for engineering talent, as well as iPhone maker Apple Inc in the mobile market.

This month, Google internally announced plans to give all of its employees a 10 percent raise in 2011, according to media reports, a move that many in the industry interpreted as an attempt to retain its best workers.

Google's current job openings are primarily for engineers and sales staffers, with roughly half of them in the United States. Some of the jobs were listed as temporary, but most appeared to be full-time positions.

The job listings provide a window into the breadth of its vast operations across the globe, with openings for everything from a University Program Specialist in Senegal to a Building Ambassador at Google's headquarters in Mountain View, California.

The company, which has also faced increasing regulatory scrutiny in recent years, has more than 50 legal job openings around the globe.

And it lists more than 50 open positions in China, including an Events Manager tasked with raising "awareness and usage" of Google products in the country, as well as a half-dozen recruiters.

That expansion comes about a year after Google relocated its Web search engine to Hong Kong, following a very public spat with the Chinese government over its refusal to bow to Beijing's Web censorship requirements.

Something new from AOL: Project Phoenix

Take a look in the email I got from AOL:

Hi!

There are hundreds of millions of people of all ages using email across the globe today. And because communication is often very personal, we realize a one-size-fits-all solution isn't always the right answer. So, while we're proud of the AOL Mail that you know and love today, earlier this week we launched a new email product, code named: Project Phoenix.

One of the reasons we're so excited about Phoenix is because we think it's a great solution for people that want to do more than just email — like text, chat and sharing quick updates with their friends and family. BUT -- for those of you that like your inbox the way it is — don't worry — nothing's changing, and we're happy to continue to support your current AOL Mail experience.

However, we spent a lot of time talking with our users to understand what they might want in a new email experience, and I'm excited to share with you some of the new features of Phoenix:

• It's faster... enough said!
• It has more personality — meaning — we've added dots and underscores, as well as new domains (wow.com, love.com, ygm.com and games.com) to help you get the email address you've always wanted (e.g. jane@wow.com or john.doe@love.com).
• It's easier to find and view the photos, maps and file attachments contained in your message — all in one place.

We'll be rolling Phoenix out to everyone early next year, but in appreciation of our loyal email users — that's you! — we wanted to let you know that this new product is coming.
If you're interested in being one of the first to try Phoenix, you can go to phoenix.aol.com

and put yourself on the invite list.

We're proud and honored to have you as an AOL customer, and we hope to continue providing you with the best communications experience on the Web.

Thank you!

Mike Maser
SVP, Marketing
AOL, Inc.

P.S. Need help? Visit AOL Mail's help pages and community support forum And to keep up with AOL Mail happenings, follow us on Twitter or Facebook.

VirusTotal Google Chrome browser extension a.k.a. VTchromizer

VirusTotal has just coded a Google Chrome browser extension to interact with VirusTotal. The extension adds an option to the context menu to analyze links with VirusTotal's URL analysis engine.

Unlike the VTzilla Firefox extension, it does not embed an additional "Scan with VirusTotal" option in the browser's file download dialog (mainly because Chrome's API does not allow to do so). Having said this, it does include a top menu bar popup that enables quick VirusTotal searches and direct submission of the page being viewed to VirusTotal.

You may find more information (including the download links) about both VTchromizer and VTzilla here:VirusTotal browser extensions

Adobe Reader X is now available!

Adobe Reader X is now available! Download Reader X for desktop at http://get.adobe.com/reader/ or access the mobile app on the Android Market via your Android device.

With over one billion downloads, Adobe Reader continues its leadership as the global standard in PDF viewing and interaction.

Reader X for desktop enables an even greater level of interaction with the ability to share feedback through the use of Sticky Notes and Highlighter tools, as well as view a larger variety of content types including drawings, email messages, spreadsheets, videos, and other multimedia elements. You can also take advantage of the added security of Protected Mode in Reader X, which helps ensure safer viewing of PDF files.

With Reader X for Android, they’ve addressed some of the most important features adobe users have requested including support for Tablets, go to page, search, opening Portfolios and password protected PDF files, and sharing PDF files via email. Adobe Reader for Android was first released back in May of this year and has amassed over 3 million downloads in that short period of time. In Reader X for Android they’ve also expanded language support to a total of thirteen including English, French, German, Italian, Spanish, Dutch, Danish, Brazilian-Portuguese, Swedish, Russian, Czech, Polish and Turkish.

To learn more about the new Adobe Reader X please visit Adobe home page on Adobe.com. Follow Reader X news on Twitter @Adobe_Reader.

MySpace deal looks to Facebook to gain and retain users

BBC: The once dominant MySpace has turned to the company that stole its crown, Facebook, for help to drive users to its ailing site.

The two launched Mashup with Facebook, to let MySpace users log in to their Facebook accounts through their MySpace page.

This means users can port over their likes and interests listed on Facebook.

In turn users will get a stream of entertainment content based on these preferences.

"We feel this is a complementary service to Facebook," said Mike Jones, MySpace chief executive.

"This new feature is a great illustration of our strategy around social entertainment and enabling the real-time stream."

MySpace is among more than a million websites letting Facebook members extend their social graph on the world's biggest social network to other parts of the web.

Facebook's vice-president of partnerships Dan Rose said the sharing of information was a strategy that "makes a lot of sense."

"Sharing entertainment and music interests is part of many of our friendships, online and off.

"MySpace is giving people an easy way to bring their favourite bands, celebrities and movies from Facebook to create a personalised experience on MySpace from the start," added Mr Rose.

Wins and loses

Is this partnership an illustration that MySpace has conceded supremacy to Facebook?

Industry analyst Augie Ray of Forrester Research told BBC News there were gains for both companies with this deal.

"People have come to think of MySpace in a certain way and while I don't think this deal will help them attract a lot of users it is necessary that those people on the site enjoy the MySpace experience and I think this helps.

"This is also a good opportunity for Facebook to demonstrate that the information you have about yourself and about your friends belongs to you. In many respects this is about Facebook changing attitudes over ownership of data than anything else."

Adam Ostrow of social media news site Mashable.com said he believed the arrangement underlined who ruled this world.

"It's official acknowledgement on the part of MySpace that Facebook has indeed become top dog in the social networking space, and its better to be with them than against them at this point."

MySpace, which is owned by Rupert Murdoch's News Corp, has an estimated 130 million users while Facebook has over 500 million.

Facebook's demise ?

And what of Facebook's future?

According to one internet expert, the world's biggest social network only has five years left before it starts to see users drift off the way they did with MySpace and rival social site Bebo.

At a marketing conference in Sydney, Australia, this week, Dr Jeffrey Cole claimed that Facebook would not fare any better at holding on to its audience than these sites have in recent years. Appearing at the same Ninemsn Digital Marketing Summit four years earlier, Dr Cole predicted the demise of MySpace.

"The same thing will happen to Facebook but it's going to take a lot longer," said Dr Cole, a director of the World Internet project which tracks how the internet affects media consumption.

"And it's not going to be replaced by one big social networking community but it's going to fragment."

Google Docs editing comes to Android and iOS

Native Google Docs support has finally arrived for Android and iOS (the mobile version of Google Docs has been available for over three years). Edits show up in near real-time (so they aren't completely seamless) and Android even lets you insert text using voice recognition.
The biggest improvement is the new layout, which makes mobile document editing much easier and allows for collaboration from other Docs users. Currently, Google Docs supports devices with Android 2.2 (codename Froyo) and up, as well as Apple devices with iOS version 3.0 or newer. Unfortunately, Google doesn't specify if third-party browsers will work with the new Google Docs or whether it plans on adding new platforms such as Windows Phone and webOS.

The new functionality will be rolling out over the next few days to English-language users. To use it, just head over to docs.google.com with a compatible device. From there, create a new document or edit an existing one by just pressing the Edit button.

'Naked' scanners fooled by creased clothing

Controversial "naked" body scanners currently being tested at Hamburg's airport are constantly malfunctioning due to folds in passengers' clothing, broadcaster NDR reported on Tuesday.

The public radio station said the trial of the body imaging security scanners has been plagued by serious problems. The units, which have been in use since September, are apparently unable to tell the difference between foreign objects and such things like pleated clothing.

The scanners use millimeter-wave technology to produce outline images of bodies, with each scan lasting less than three seconds.
While some passengers are being asked to remove thicker clothes such as jumpers, NDR reported that the devices are regularly malfunctioning due to creases in lighter clothes such as blouses and skirts.
Although use of the scanners remains optional, every passenger must now also be patted down and pass through a metal detector, whether or not they have been scanned.

The extra security checks are causing delays, resulting in longer lines and irritated passengers.
New software due to be installed to solve at least part of the problem is not yet ready for use, NDR reported.

The scanners has previously been criticized by civil liberties campaigners the world over, mostly due to fears of how the images would be stored.

Plans to fast-track tests of the controversial body scanners were announced in January following the foiled “underwear bomb” attack in Detroit on Christmas Day 2009. The trial period is due to run until the end of March 2011.

Taken from thelocal.de

Microsoft: Google is a hard habit to break

Microsoft says Google is a bad habit, and it's hard for people to break it in order to try alternatives, such as the company's search engine, Bing. "It's a hard thing. Habits die hard," Yusuf Mehdi, Microsoft's Senior Vice President of Online Audience Business, said at the Web 2.0 Summit in San Francisco, according to PC World.

Mehdi is referring to users' tendency to use Google for online searches without a second thought. It's almost second nature to them. Many people even head to Google as their first webpage when they're testing to see if they have an Internet connection.

That's what Microsoft is up against, despite all the money it has invested in Bing, which launched over a year ago. Bing has gained share since then, but it is still nowhere near Google. Microsoft has been running advertising campaigns, both online and offline. Awareness is not, however, enough to break people's routine.

Google says Bing is its biggest competitor: bigger than either Facebook or Apple. Furthermore, the search giant has retaliated and significantly improved its services in the last year, including Instant results and Instant Previews. Even if you never plan on using Bing, you have to thank Microsoft for stepping up the competition in the search space, essentially making Web search better for everyone.

Facebook takes on traditional e-mail with Social Inbox

Facebook has announced a new product that will compete directly with the e-mail services provided by Yahoo, Microsoft, Google, and AOL. Facebook believes traditional e-mail is too slow and cumbersome; it needs be brought into the modern world of messaging. The site has thus launched Facebook Messages, which merges texts, online chats, and e-mails into one central hub. Users see all of them in their Social Inbox and can reply in any way they want. The social networking giant says this product is the biggest it has worked on to date.

Facebook Messages' main goal is to ensure users "see the messages that matter". Facebook has 500 million users (more than any other e-mail service) and all of them will eventually be offered a @facebook.com e-mail address. That being said, the new system will be closer to chat (messages get sent when you hit the Enter key) than traditional e-mail: there will be no subject lines, nor cc or bcc fields. Incoming message will be placed in one of three folders: Friends, Other (for things like bank statements), and Junk. Users can choose to store conversations so that they can have a complete archive of communications with a given person.

The new product will be introduced slowly over the next few months. Once you receive an invitation, you'll be able to get started and also invite friends.

"This is not an e-mail killer," Facebook co-founder Mark Zuckerberg announced. "Maybe we can help push the way people do messaging more towards this simple, real-time, immediate personal experience. E-mail is still really important to a lot of people. We think this simple messaging is how people will shift their communication."

Taken from TechSpot

The Beatles are Onboard But Why are there Still Musicians like Kid Rock and AC/DC holding out on iTunes?

PC Magazine: The Beatles have finally given iTunes a ticket to ride, allowing their iconic music to be added to Apple's catalog. But while the Fab Four might be the most notable iTunes holdout, they certainly aren't the last. A dwindling number of artists are still resistant to joining Apple's music download service.
Searches on iTunes for AC/DC, Kid Rock, Tool, Garth Brooks, and Def Leppard will return disappointing results: karaoke and cover tracks, not material from the artists themselves. Reasons for non-compliance with Apple vary.
AC/DC and Apple have an ideological agreement; the Australian band protests Apple's policy that offers albums piecemeal.
"We don't make singles, we make albums," the band's guitarist Angus Young said in a Telegraph article. "If we were on iTunes, we know a certain percentage of people would only download two or three songs from the album – and we don't think that represents us musically."
Country singer Garth Brooks has similar qualms with individual song downloads. Brooks has reportedly met with Apple on multiple occasions to refute the policy.
"They truly think that they're saving music," the singer said in a 2009 USA Today report. "I looked at them right across the table with all the love in the world and told them they were killing it. Until we get variable pricing, until we get album-only downloads, then they are not a true retailer for my stuff, and you won't see my stuff on there."
Multiple sources said that with meandering anthems that overlap into one another, ambient rock band Tool has the same misgivings about iTunes.
But Kid Rock's reservations represent another faction. Rather than a philosophical disagreement, the artist believes that the royalties Apple rewards to artists are too low. He told the BBC in 2008 that "iTunes takes the money, the record company takes the money, and they don't give it to the artist."
Bob Seger and Kid Rock share the same management, which could explain why Seger, who was inducted into the Rock and Roll Hall of Fame in 2004, can't be found on iTunes either.
In 2007, Kid Rock's sixth album "Rock 'n' Roll Jesus," debuted at number one on the Billboard top 200 chart, despite its absence from iTunes. But that was a different era, when holdouts still included big names like Radiohead.
In 2007, Radiohead made its album "In Rainbows" available on the Web; allowing fans to name their price. In 2008, Radiohead made its full catalogue available on iTunes, according to Billboard..
Now the Beatles have joined the iTunes world, too. "In 1964, the band that changed everything came to America. Now they're on iTunes," said a note on Apple's homepage.

Facebook bug disables thousands of female user accounts

Thousands of female Facebook users had their accounts inexplicably disabled today. They did not violate Facebook's terms of use but nevertheless, they are seeing messages claiming their accounts are "inauthentic," according to Me & Her.

Facebook has confirmed the issue and is asking users to scan and upload a copy of a valid driver's license in order to reactivate their accounts. The mass-deactivations are a small percentage of Facebook's total subscriber base, but the number of users affected is easily in the thousands.

While Facebook is in the process of restoring the affected accounts, the way it is going about doing so is a hassle for the users affected. Instead, Facebook should reactivate all the deactivated accounts and then manually go through them again. This is Facebook's fault and the burden should be on the social networking giant, not its users.

"Earlier today, we discovered a bug in a system designed to detect and disable likely fake accounts," a Facebook spokesperson said in a statement. "The bug, which was live for a short period of time, caused a very small percentage of Facebook accounts to be mistakenly disabled. Upon discovering the bug, we immediately worked to resolve it. It's now been fixed, and we're in the process of reactivating and notifying the people who were affected."

Taken from TechSpot

Yahoo announces more changes

THE INTERNET SEARCH OUTFIT without a search engine, Yahoo has announced a package of products that it hopes will make it more relevant again.

At the Web 2.0 Summit in San Francisco, Yahoo showed off a host of products that it claimed would deliver to consumers a more "personally relevant Web experience with new social and local features".

You guessed it, more social networking and more experiences than you can poke a stick at.

Yahoo's updates include Twitter and Zynga integration, the global rollout of its Messenger Beta with new social features, the launch of its Local Offers program, and local search apps for taking action right from the search results page.

Yahoo claims that its new role is to connect punters with the people, places and things that matter most to them.

Apparently some people think that making a restaurant reservation, finding a discounted tee time or playing online games with friends are very important.

Blake Irving, Yahoo EVP and chief product officer said that the changes will make Yahoo an even better place for everyone to stay entertained, productive, and informed.

All of these new features are built on Yahoo's cloud and technology platforms, which apparently allow for "in-depth partner integrations".

Taken from theinquirer.net