Blogger’s fresh new look

Blogger Buzz: As you may have heard, things are starting to look a little different across many Google products—and today, Blogger is the next product to get a makeover.

It’s been a few years since we made major updates to Blogger’s look and feel, and there’s a lot more to these changes than just shiny new graphics. We’ve rewritten the entire editing and management experience from scratch so it’s faster and more efficient for you—and easier for us to update and improve over time.

Throughout the design process, we conducted user interviews to help identify how to make Blogger even easier and more enjoyable to use. We also watched users try our new interface and made many refinements based on their feedback.

A streamlined blogging experience
Whether you’re on a dashboard or settings page of blogger.com, you can always create or edit posts with just one click at the top of the screen. Additionally, the post editor has been expanded and simplified to give you a larger canvas for drafting and previewing your work.

Monitor and grow your audience at a glance
In the new “Overview” section of your dashboard, you’ll be able to quickly get a pulse for how people are reacting to your blog with a graph of your most recent traffic numbers, comment activity and follower counts. For extra guidance and inspiration, you’ll also find a list of helpful links, a feed of Blogger updates and a showcase of other blogs you may find interesting.

Opt in now
Starting today, we’ll gradually let all bloggers choose to turn on the new UI, so your Blogger experience won’t be updated until you enable it. Over the next few days, keep an eye out for a pop-up announcement on your dashboard with instructions on how to get started, and check out this Blogger Help Center page to learn more about what’s changed.

If you have suggestions or feedback about the new look, click the gear icon in the top right of the navigation bar and select “Send Feedback.”

We’re working hard to fundamentally revamp and improve the Blogger experience from the ground up, and we hope you enjoy the first in a series of major updates that are on their way in the coming months.

Using Gmail, Calendar and Docs without an Internet connection

Gmail Blog: The great thing about web apps is that you can access all of your information on the go, and we’ve introduced ways to use Google Apps on a variety of devices like mobile phones and tablets. But it’s inevitable that you’ll occasionally find yourself in situations when you don’t have an Internet connection, like planes, trains and carpools. When we announced Chromebooks at Google I/O 2011, we talked about bringing offline access to our web apps, and now we’re taking our first steps in that direction. Gmail offline will be available today, and offline for Google Calendar and Google Docs will be rolling out over the next week, starting today.

Gmail Offline is a Chrome Web Store app that’s intended for situations when you need to read, respond to, organize and archive email without an internet connection. This HTML5-powered app is based on the Gmail web app for tablets, which was built to function with or without web access. After you install the Gmail Offline app from the Chrome Web Store, you can continue using Gmail when you lose your connection by clicking the Gmail Offline icon on Chrome’s “new tab” page.

Google Calendar and Google Docs let you seamlessly transition between on- and offline modes. When you’re offline in Google Calendar, you can view events from your calendars and RSVP to appointments. With Google Docs you can view documents and spreadsheets when you don’t have a connection. Offline editing isn’t ready yet, but we know it’s important to many of you, and we’re working hard to make it a reality. To get started using Google Calendar or Google Docs offline, just click the gear icon at the top right corner of the web app and select the option for offline access.

IT administrators can deploy Chrome Web Store apps to users en masse by setting up organizational policies for Chrome.

Today’s world doesn’t slow down when you’re offline and it’s a great feeling to be productive from anywhere, on any device, at any time. We’re pushing the boundaries of modern browsers to make this possible, and while we hope that many users will already find today’s offline functionality useful, this is only the beginning. Support for offline document editing and customizing the amount of email to be synchronized will be coming in the future. We also look forward to making offline access more widely available when other browsers support advanced functionality (like background pages).

Firefox, Thunderbird and SeaMoney blacklist bad DigiNotar SSL certificates

Mozilla Security Blog: Mozilla just released an update to Firefox for Desktop, Thunderbird and SeaMonkey. Updates are now available for:

• Firefox for Windows, Mac and Linux (final release)
• Firefox for Windows, Mac and Linux (3.6.21 final release)
• Firefox Aurora for Windows, Mac and Linux
• Firefox Nightly for Windows, Mac and Linux
• SeaMonkey (2.3.2)
• Thunderbird (6.0.1)

We strongly recommend that all users upgrade to these releases.

If you already have Firefox, you will receive an automated update notification within 24 to 48 hours. Users can also manually check for updates if they do not want to wait for the automatic update.

New versions of Firefox for Mobile (final release and Beta), Firefox Beta for Desktop and Thunderbird will be released shortly.

Issue
Mozilla was informed today about the issuance of at least one fraudulent SSL certificate for public websites belonging to Google, Inc. This is not a Firefox-specific issue, and the certificate has now been revoked by its issuer, DigiNotar. This should protect most users.

Impact to users
Users on a compromised network could be directed to sites using a fraudulent certificate and mistake them for the legitimate sites. This could deceive them into revealing personal information such as usernames and passwords. It may also deceive users into downloading malware if they believe it’s coming from a trusted site. We have received reports of these certificates being used in the wild.

Status
Because the extent of the mis-issuance is not clear, we are releasing new versions of Firefox for desktop (3.6.21, 6.0.1, 7, 8, and 9) and mobile (6.0.1, 7, 8, and 9), Thunderbird (3.1.13, and 6.0.1) and SeaMonkey (2.3.2) shortly that will revoke trust in the DigiNotar root and protect users from this attack. We encourage all users to keep their software up-to-date by regularly applying security updates. Users can also manually disable the DigiNotar root through the Firefox preferences.

Credit
This issue was reported to us by Google, Inc.

Create PDF files on your iPhone and iPad now

Acrobat Blog: We are excited to announce that Adobe CreatePDF application is now available on iOS. With this, Adobe brings rich, high-fidelity and Acrobat-like PDF creation to the iOS devices. You can now convert all your documents on iPad, iPhone & iPod touch devices to PDF for reliable, secure sharing and viewing across PCs, tablets & Smartphones.

The application uses Adobe’s online PDF Creation service for conversion of files to PDF thereby ensuring no compromise on quality and performance.

CreatePDF on iOS Feature Highlights:

• High Quality PDF Creation – Convert all your documents to PDF files that look exactly as original using the same technology as Adobe Acrobat.
• Intuitive Interface for PDF Conversion – Convert email attachments or files stored on the cloud or any application by sending them to the Adobe CreatePDF app using ‘Open In.’
• Share – You can open the converted PDF files in other applications and also send as email attachments

Catch a glimpse of how the application works here:




Supported File Formats include:

• MS Word (docx, doc), Excel(xlsx, xls), PowerPoint (pptx, ppt)
• Adobe Illustrator (ai), Photoshop (psd) and InDesign (indd)
• Images – JPEG, BMP, PNG, GIF, TIFF
• RTF, Text and WordPerfect
• OpenOffice and StarOffice documents

We’re eager to hear your feedback. Do let us know what you think about the application and what more you would want to see in it in future. You can post your thoughts here, on the Adobe user forums, or on the iTunes Market.

Adobe CreatePDF for iOS is available for purchase at the iTunes App Store for $9.99. iOS device users can download it from here.

Hacker steals user data from Nokia developer forum

H-Online: A vulnerability in its forum software has been exploited by a hacker to compromise mobile phone maker Nokia's developer forum. The attacker used SQL injection to access the forum database at developer.nokia.com and, according to Nokia, obtained email addresses of registered users. Where configured to be publicly available, the table also includes details such as the user's date of birth, web site URL and Skype, ICQ or other IM username; this is reported to be the case for around 7 per cent of users. The database did not contain passwords or credit card information. The issue does not, according to Nokia, affect any other Nokia accounts.

The attacker, calling himself pr0tect0r AKA mrNRG, temporarily redirected the developer forum to a site containing a message for Nokia:

"LOL, Worlds number 1 mobile company but not spending a dime for a server security! FFS patch your security holes otherwise you will be just another antisec victim. No Dumping, No Leaking!!"

The link that was used to deliver the message may change browser window sizes and positions.

Nokia has apologized for the incident and has temporarily taken the forum offline. The company states that, although the vulnerability was fixed immediately, it is still investigating the incident.

Screenshots of Chinese hacking tool

Schneier on Security: It's hard to know how serious this really is:

The screenshots appear as B-roll footage in the documentary for six seconds­between 11:04 and 11:10 minutes -- showing custom built Chinese software apparently launching a cyber-attack against the main website of the Falun Gong spiritual practice, by using a compromised IP address belonging to a United States university. As of Aug. 22 at 1:30pm EDT, in addition to Youtube, the whole documentary is available on the CCTV website.

The screenshots show the name of the software and the Chinese university that built it, the Electrical Engineering University of China's People's Liberation Army­direct evidence that the PLA is involved in coding cyber-attack software directed against a Chinese dissident group.

The software window says "Choose Attack Target." The computer operator selects an IP address from a list­it happens to be 138.26.72.17­and then selects a target. Encoded in the software are the words "Falun Gong website list," showing that attacking Falun Gong websites was built into the software.

A drop-down list of dozens of Falun Gong websites appears. The computer operator chooses Minghui.org, the main website of the Falun Gong spiritual practice.

The IP address 138.26.72.17 belongs to the University of Alabama in Birmingham (UAB), according to an online trace.

The shots then show a big "Attack" button on the bottom left being pushed, before the camera cuts away.

New worm targeting weak passwords on Remote Desktop connections (port 3389)

Microsoft Malware Protection Center: We've had reports of a new worm in the wild and that generates increased RDP traffic for our users on port 3389. Although the overall numbers of computers reporting detections are low in comparison to more established malware families, the traffic it generates is noticeable. The worm is detected as Worm:Win32/Morto.A and you can see a detailed description of at http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Worm%3aWin32%2fMorto.A.

Morto attempts to compromise Remote Desktop connections in order to penetrate remote systems, by exploiting weak administrator passwords. Once a new system is compromised, it connects to a remote server in order to download additional information and update its components. It also terminates processes for locally running security applications in order to ensure its activity continues uninterrupted. Affected users should note that a reboot may be required in order to complete the cleaning process.

This particular worm highlights the importance of setting strong system passwords. Using strong passwords can go a long way towards protecting your environment -- and the ability of attackers to exploit weak passwords shouldn't be underestimated. For example, Morto tries the following passwords:

*1234
0
111
123
369
1111
12345
111111
123123
123321
123456
168168
520520
654321
666666
888888
1234567
12345678
123456789
1234567890
%u%
%u%12
1234qwer
1q2w3e
1qaz2wsx
aaa
abc123
abcd1234
admin
admin123
letmein
pass
password
server
test
user

When creating strong passwords, remember that the key to a strong password is length and complexity. Here's a few tips to keep in mind:

• An ideal password is long and has letters, punctuation, symbols, and numbers.
• Whenever possible, use at least 14 characters or more.
• The greater the variety of characters in your password, the better.
• Use the entire keyboard, not just the letters and characters you use or see most often.

For more advice on creating (and remembering) strong passwords, visit my Safety and Security Center.

For your information here are some examples of files that are being detected as Win32/Morto:

0x48AE936692FFBD14782D5C97DD067402FBB52356
0x6929EAD324EFA7A667BAE88A041F546DBBECBF26
0x188BA0E3A03BFFFF4B9C96721AC70EF68D19A86E

Hil Gradascevic
MMPC Melbourne

Start of Avira 12 Betatest!

Start of AV 12 Betatest!
It starts from today and ends on 29th of September 2011.

Finally after a long time Avira started Betatest of Avira AntiVir 12.

If you would like to test this build and feature beta releases, you can register in Avira BetaCenter: http://betacenter.avira.com

More Info: http://techblog.avira.com/2011/09/08/avira-products-version-2012-for-windows-now-available-for-beta-testing/en/

Facebook Makes a Move Toward Security

Sunbelt: Facebook recently published a guide for it's users on how to secure their online accounts from anything that threatens one's Facebook security. Among those covered are Wall, Chat, and Comment spams, weak passwords, fake applications, and account hacking. Personally, I'm quite happy that Facebook is actually doing something that concerns user security, despite it being quite late come to think about it. Still, better to have something than nothing.

The document guide contains practical tips and cases to illustrate the gravity of the attack if ignored. It also has some great, agreeable points that make it a good reference anyone can recommend to their friends and family who are on Facebook. Feel free to download here and distribute.

phpMyAdmin updates close XSS hole

H-Online: The phpMyAdmin developers have announced the release of versions 3.4.4 and 3.3.10.4 of their open source database administration tool. According to the security advisory, these maintenance and security updates close a hole (CVE-2011-3181) in the Tracking feature that leads to multiple cross-site scripting (XSS) vulnerabilities.

The exploit was discovered by Norman Hippert and is caused due to improper sanitisation when input is passed to the table, column and index names. For an attack to be successful, an attacker must be logged in via phpMyAdmin. Versions 3.3.0 to 3.4.3.2 are affected and the developers consider the problem to be serious. Updating to phpMyAdmin 3.3.10.4 or 3.4.4 fixes the problem. Alternatively, users can apply the provided patches.

Further information about the updates can be found in the 3.4.4 and 3.3.10.4 release announcements and in the project's security advisories. Versions 3.4.4 and 3.3.10.4 of phpMyAdmin are available to download from the project's site. Hosted on SourceForge, phpMyAdmin is licensed under the GPLv2.

Jobs opportunities for Apple scammers?

SophosLabs: Steve Jobs has now done what many of us thought would happen sooner or later - stepped off the very prestigious CEO plinth, taking a less taxing role as chairman of the Apple board. The new CEO will be Jobs' right-hand man Tim Cook.

Despite Jobs having been on medical leave since January this year, the markets were all a tumble once the news of his resignation hit the markets, with Apple share prices dipping at one point by 5%.

No one can dispute that Apple has a following that many companies can only dream of.

Remember when UK neuroscientists showed that when Apple fans were shown the company's iconic imagery, their brain lit up like Jesus fans shown religious depictions?

I suspect if Apple could bottle that, they could make billions. Oh, wait a minute, they've done that already, recently reporting more cash in the bank than the US government.

Considering the company's and the recently departed CEO's mega-fame, it wouldn't be a surprise if we see some scams on email, Facebook and Twitter using the news of Jobs' handing over the reins to dupe users. So keep your eyes peeled and your tap-happy fingers on check.

Put simply, don't let curiosity bite you in the ass.

Java 6 Update 27 released

Java™ SE 6 Update 27
The full internal version number for this update release is 1.6.0_27-b07 (where "b" means "build"). The external version number is 6u27.

Highlights
This update release contains important enhancements for Java applications:

• Improved performance and stability
• Certification for Firefox 5

Update release notes: http://www.oracle.com/technetwork/java/javase/6u27-relnotes-444147.html

Complete bug fix list: http://www.oracle.com/technetwork/java/javase/2col/6u27bugfixes-444150.html

Microsoft To Improve File Management Processes In Windows 8

Windows 8 News Blog: The recently created Building Windows 8 blog seems to be up in full swing, with new articles about the upcoming operating system being released regularly. Steven Sinofsky revealed in “Improving our file management basics: copy, move, rename, and delete” that Microsoft intents to improve file management processes under Windows 8.

According to Steven, Microsoft had three goals to improve the copy experience:

• One place to manage all copy jobs: Create one unified experience for managing and monitoring ongoing copy operations.
• Clear and concise: Remove distractions and give people the key information they need.
• User in control: Put people in control of their copy operations.

Consolidating the copy experience is a great idea. This means that you won’t have to deal with multiple copying windows when you run multiple copy or move operations in the operating system. All copy jobs are now consolidated in one screen.

Microsoft furthermore added the ability to pause copy processes, which goes along with a new real-time throughput graph that users can display on the system.

The copy conflicts screen gets an overhaul as well. The screen, which is very confusing and with to much text has been replaced with an easier to access conflicts window that is giving the user more control over the process.

Here are all screenshots of the new features that have been posted by Microsoft:

The consolidating of copy jobs, pausing copy jobs and a better conflict experience are all features that will be well received by users of the new operating system. Sometimes it is the little things that make more of an impact than larger changes.

And here is a video with the announcement:

You can read the full announcement over at the Building Windows 8 website.

Restricting access to net resources for "good reasons"

This article is originally posted at Norman Security Blog, Credit to my friend 'Pondus' for sharing.

Introduction

During recent months, we have seen several examples of attempts and suggestions to restrict access to different types of net resources, and in some cases the Internet itself. Is this a method that accomplishes its end, or is it more of a "shooting the messenger" type of action?

We shall give some examples and discuss different issues in this article.

Some high-profile examples of restricting access to net resources

Among the many different incidents during the latest year, which may be seen as attempts to restrict access to net resources, we will mention the following:

• Bay Area Rapid Transit (BART) in San Francisco USA, shut down mobile telecommunication services (mobile-internet and phone service) in a particular area in order to suppress the ability to arrange a planned protest.
• Great Britain's Prime Minister suggested that restricting access to social media might be used to stop rioting like the recent incidents in several cities in Great Britain,
• Authorities in Syria and Egypt attempted to stop Internet access in order to quell the demonstrations and uprising that were ongoing and upcoming.
• PayPal, MasterCard and VISA suspended payments to WikiLeaks.
• Amazon.com stopped hosting WikiLeaks from its web servers.

Obviously, these are totally different cases. It may even be argued that not all are about restricted access to net resources. However, we find that they are relevant for our discussion, as they all in some way have to do with restricting some people or organizations their use of the net or net services.

Several of the incidents mentioned above have been met by severe protests. Individuals and protagonists organizations for the freedom of expression have shown considerable engagement. Some have chosen to express their disagreement by attacking the entities that were perceived to have initiated the blocking. Particularly those who engage in the Anonymous "group", have been active protesters and have used different types of means to protest. These means include denial of service attacks against Internet resources.
The different ways to express disaccord against what is perceived as a kind of censorship, may in itself be an interesting topic to discuss in an article. This article, however, will solely focus on restricting access to the Internet as a method to accomplish a particular goal (not as a method for protesting).

Several links to more extensive information about the cases mentioned above are available at the end of this article.

The motivation(s)

There are various reasons why restricting access to Internet resources may seem like "a good idea". A general motivation for restricting access to net resources can be stated like this:

Certain activities are seen by authorities and/or organizations as undesirable and/or illegal. By restricting access to the net or to net resources, these activities will not occur or be more limited in scope.

The restricted access in all the cases in the listing above, should be in line with this general motivation.

The structural problem

It is important to note in this context that any organization that offers a service on the Internet in principle is free to compose end user agreements, which correspond to their own values and terms of use.

The potential problem is rather of a structural character.

The Internet and mobile networks should not be viewed as products or services. A more correct way of viewing such networks, is as part of the infrastructure in a nation and between nations. Similarly, some of the services that are available on these networks should be viewed as part of the infrastructure. To mention a few:

• Access to the net itself (the service provided by net access providers)
• Access to banking systems available on the net
• Access to systems for communication between end user nodes (social media, "good old" telephone systems)
• Access to emergency numbers from telephones

The entities that operate such systems are often organizations that are allowed to act within public control and license.

The new technology problem

One of the reasons why it seems so tempting to implement restricted access to e.g. newer communication methods, is that these are not yet sufficiently integrated in society. Or more precisely: They are not yet an integrated part of what is perceived as a tool that is beyond regulation for "political" (in a wide sense) reasons.

It is inconceivable that the use of traditional telephone system would be stopped in a certain area in order to avoid certain types of communication. This is an action that would not even be among the options up for discussion.

Stopping access to mobile phones and social media on the other hand, may seem like an efficient and logical step to take in certain conditions.

Why are these communication methods viewed differently? We suggest that the reason why is that newer communication techniques are not fully understood by those who have not grown up with their presence.

In some years other sets of communication methods will supplement and in some cases replace the current. These will then be subjected to the same kind of "distrust", while today's newer communication methods will be viewed in a similar way as old-fashioned telephones are viewed now.

Western societies' dilemma

During the uprising in several countries in the Middle East, the use of social media like Twitter and Facebook were praised by western societies as useful and even instrumental in overthrowing the former regimes. Resources were allocated in order to circumvent the oppressive regimes' attempts to censor and block net access.

Planning and implementing similar restriction techniques against western nation's own citizens to oppress certain types of communication, are seen as hypocritical both by those who criticize these methods, and by those who used them in the Middle East and in other countries. A quote from an article in China state media's Global Times about Great Britain's Prime Minister Cameron's suggestion, illustrates this perfectly:

Cameron’s suggestion to block social networking websites smashes basic concepts of freedom of speech in the West, which always takes the moral high ground in criticizing the reluctant development of Internet freedom in developing countries.
The violence has brought a comprehensive and diverse influence on the whole of the West. Created by globalization and the development of the Internet, the headache of governance suffered by developing countries has now spread to their developed peers.
Democracy and freedom of speech should have their pragmatic connotations and denotations. (...)

Targeting the illegal act

More in line with modern societies' way of approaching illegal actions, would be to target the illegal act itself, rather than the communication mediums that may be used in planning undesired activities. After all, the freedom of communication is one of the fundamentals in democratic societies.

That said, one can also imagine situations when parts of any infrastructure may be temporarily closed for security reasons. This should, however only happen according to rules and regulations that are defined by proper authorities, and not according to actions that are more ad hoc and initiated by random organizations, which (by coincidence) are able to accomplish this.

Selected further reading about the examples used

• Amazon Says WikiLeaks Violated Terms of Service (The Wall Street Journal, 3 December 2010)
• PayPal shuts out WikiLeaks (CNet, 4 December 2010)
• MasterCard Pulls Plug on WikiLeaks Payments (CBS News 6 December 2010)
• Wikileaks' Visa payments suspended (BBC News 7 December 2010)
• PayPal Busted for Bogus Wikileaks Excuse (Gawker, 8 December 2010)
• Egypt severs internet connection amid growing unrest (BBC News, 28 January 2011)
• How Was Egypt's Internet Access Shut Off? (Scientific American, 28 January 2011)
• Internet Access in Syria Goes Down Amidst Protests (PCMag, 3 June 2011)
• DataCell files a complaint with the European Commission (DataCell news item, 14 July 2011)
• RIM’s BlackBerry Messenger reportedly used by London rioters (Financial Post, 8 August 2011)
• David Cameron considers banning suspected rioters from social media (The Guardian, 11 August 2011)
• Riots lead to rethink of Internet freedom (Global Times, 13 August 2011)
• FCC looking into BART mobile phone shutdown (InfoWorld, 15 August 2011)
• San Francisco Subway Spokesman Says Cellphone Shutdown Was His Idea (Wired, 16 August 2011)

German Federal Office for Information Security warns of hacked online shops

H-Online: The German Federal Office for Information Security (BSI) is warning  of online shops which infect users with malicious software by exploiting security vulnerabilities in the user's browser, operating system or applications. The affected shops have themselves been hacked by attackers exploiting security vulnerabilities in outdated versions of open source online shop software osCommerce.

As reported by The H two weeks ago, osCommerce shops are currently being hacked en masse. The vulnerabilities used for the hack were fixed in November last year with the release of osCommerce 2.3, but many companies running online shops have yet to update to a secure version.

The BSI is advising companies running osCommerce-based online shops to check which version of the software they are using and to update to one of the current versions (2.3.1 or 3.0.2) if necessary. Older versions should be checked to see whether the installation has been compromised, as a matter of urgency. The BSI is further advising users to keep virus signatures up to date and to install all available security updates for their operating system and applications.

Although the BSI produces advisories for a German audience, their advice is worth considering; around 8 million osCommerce pages on web sites around the world have shown up on search engines carrying the malicious software.

Update: Google Buys Motorola

Google Operating System Blog: Google found a way to solve the problem of Android patents and it's only three times more expensive than acquiring the Nortel patents: buying Motorola for $12.5 billion.

"Motorola has a history of over 80 years of innovation in communications technology and products, and in the development of intellectual property, which have helped drive the remarkable revolution in mobile computing we are all enjoying today. (...) In 2008, Motorola bet big on Android as the sole operating system across all of its smartphone devices. It was a smart bet and we're thrilled at the success they've achieved so far," says Google's CEO, Larry Page.

A few days ago, Motorola's CEO said that the company owns "one of the strongest and most respected patent portfolios in the industry. We have over 17,000 patents granted and over 7,000 patents pending with particular strength in 2G and 3G essential, non-essential patents important to the delivery of competitive products in the marketplace, video particularly compression, decompression and security technologies and finally, a leading position in 4G LTE essential." Sanjay Jha also said that IP was important to differentiate from other Android vendors. It's clear that Motorola didn't want to license its technology to other Android OEMs, so Google's solution was to buy Motorola.

Samsung, HTC, Sony Ericsson and LG had a unanimous reaction. "We welcome Google's commitment to defending Android and its partners." After all, it's Google who created the software, so Google has to spend $12.5 billion to solve the mess.

Google promises that Android will continue to be an open platform, but the other Android OEMs will have their reasons to doubt. Google's biggest acquisition to date could be an answer to Android's problems, but also the beginning of the end for Android as an open-source mobile operating system. Motorola released two of the most important Android devices (the original Droid and the XOOM tablet) and Android smartphones saved it from bankruptcy, but Motorola is a US company that can't compete outside of US and it doesn't have a good track record when it comes to releasing the latest software updates. Buying this company to save the Android ecosystem will only work if Motorola disappears.

An interesting quote from Motorola's CEO (June 2011): "I expect consolidation to occur. Our customers are consolidating, and our supply base is also consolidating. But my view is that consolidation occurs in some interesting ways. I'm not convinced that handset manufacturers acquiring other manufacturers is the best way for value to be created for shareholders. Consolidation across content manufacturers and hardware and software manufacturers -- I see a bunch of different ways for this consolidation to occur, to create shareholder value and create different structures to the industry. You've already seen the acquisition of Palm by HP, a very interesting acquisition that brought software and hardware assets together. The relationship between Microsoft and Nokia also speaks to that. Do we expect Motorola to be an independent company? I don't know yet. I hope very much that we are."

Mozilla Plans To Hide Firefox Version

gHacks: One “by-product” of the rapid release cycle of the Firefox web browser is the version number increase that goes along with every new release of the web browser. Firefox this year jumped from Firefox 3 all the way to the latest version Firefox 8, and we are not even at the end of the year.

Mozilla interestingly enough plans to hide the version number in the Firefox web browser. Asa Dotzler added an entry to Bugzilla to remove the version of the browser from the about Window dialog in the browser.

Firefox users who currently want to know which version of the browser they are running can click on Firefox > Help > About Firefox to find out.

The original idea by Asa is to remove the version information in the about window and replace it with the more general information that the user is running the latest version of the browser.

When a user opens the About window for Firefox, the window should say something like “Firefox checked for updates 20 minutes ago, you are running the latest release.”

Experienced Firefox users, or at least those who know where to look, can still access the version information on the about:support page.

What is Mozilla hoping to achieve with the removal of the version number listed in the about window? No information is posted on Bugzilla, it is however likely that Mozilla wants to reduce the impact a version number change has on the global community, and especially on the update ratio of users.

Removing the version number does not change the fact that Firefox is reaching what is generally perceived as major versions more frequently, and most tech news sites will still use the version number when they write about those changes. The idea is to make versions less important.

Then again, we would not have that discussion if Mozilla had made the decision to use “minor” version increases for the rapid release cycle. Instead of having to deal with Firefox 4, 5, 6, 7 and 8, we would have then had to deal with Firefox 4.1, 4.2., 4.3, Firefox 5 and Firefox 5.1.

Mozilla is basically trying to use the argument that opponents of the major version increase had when they were first announced:

The opponents said that versions do not mean anything if the browser does not deliver, and that it does not make sense to increase the browser version if the changes are only minor.

Mozilla now says that versions do not mean anything, and that users simply should not look at them anymore.

Hiding the browser versions, and the supposed change is nothing more than that, does not resolve the underlying issue. Especially not so if the update screen still displays the new version the browser will get updated to.

Firefox 6 Released Early

Mashable: Firefox 6 isn’t scheduled to be released until Tuesday, but Mozilla has uploaded installation files to a FTP server for those who want to get their hands on the upgraded browser early.

Although the new version doesn’t sport any major UI changes, the browser is reportedly 20% faster than Firefox 5. Startup time has been improved, especially for those with lots of tabs and groups. Users can now determine whether they want to load their tab groups when launching the browser, or load them within the Panorama grouping tool.

Other improvements include a new permissions feature that allows users to set site-specific permissions for a number of variables, including passwords and pop-ups; a plugins check, which lets users see if they’re running the latest versions of their extensions; highlighted domain names in the address bar; an improved Web Console; and a Scratchpad tool for developers testing JavaScript within the browser.

Installation files are available for Windows, Mac and Linux systems.

Google buys Motorola Mobility, Android's top supporter

BetaNews: Google thoroughly rocked the smartphone world on Monday morning by announcing it will be acquiring Android phone maker Motorola Mobility for approximately $12.5 billion. Motorola Mobility has existed as a standalone entity for just 8 months, and has produced some of the most successful Android smartphones such as the first Droidwith Verizon Wireless.

Most importantly, though, Motorola Mobility holds one of the most valuable wireless patent portfolios in the business, and this acquisition serves as a follow up to the Nortel Patent auction where Google placed bids, but lost out to a consortium of bidders that included Apple, EMC, Microsoft, Ericsson, Research in Motion, and Sony.

The results of that auction turned into quite a war of words, when Google publicly accused the consortium of buyers of wanting those patents strictly to sue Google for Android patent violations.

Irrespective of patents, Motorola Mobility has been a committed Android manufacturer that devoted one hundred percent of its catalog of devices to Android. Without the manufacturer's total support, Android's position in the smartphone market would no doubt look very different than it does today.

"Motorola Mobility's total commitment to Android has created a natural fit for our two companies. Together, we will create amazing user experiences that supercharge the entire Android ecosystem for the benefit of consumers, partners and developers. I look forward to welcoming Motorolans to our family of Googlers," said Larry Page, CEO of Google in a statement on Monday.

Google's announcement said the transaction will close at the end of 2011 or beginning of 2012, and Motorola Mobility will run as a separate business.

Twitter finally released a "Stalkers" app? No, it's a phishing scam

Sophos Labs: Twitter users are being hit today by messages claiming to link to a new app from Twitter which will track your stalkers.

However, the messages are really designed to steal your Twitter usernames and passwords.

Here's a typical message that users are seeing:

Twitter finally released an app that tracks your "Stalkers" get it here [LINK]

If you click on the link you are taken to what appears to be a legitimate Twitter page, asking you to confirm your username and password before the "Stalkers" app can access your account.

However, if you look at your browser's URL you will see that the page is not hosted by Twitter at all.

If you make the mistake of entering your username and password then you will handing over the keys to your account to phishers, who would then be able to use your account to read your private messages, send messages (perhaps spam-related or containing malicious links) to your followers.

Worst of all, if you're one of those people who uses the same password as you use elsewhere on the internet - you've now told the cybercriminals how to access, say, your Gmail, Hotmail or PayPal accounts as well.

If you found your Twitter account was one of those sending out the phishing messages, or if you made the mistake of entering your username and password, then you must change your password as soon as possible.

Not just on Twitter, but also make sure you're not using the same password anywhere else on the net.

And remember, it's important that you don't use a word from the dictionary as your password. It's easy to understand why computer users pick dictionary words as they're much easier to remember, but as I explain in this link a good trick is to pick a sentence and just use the first letter of every word to make up your password.

You can always use password management software such as KeePass or 1Password to remember complex passwords if you find it too difficult.

There's some other house-cleaning you should do on your Twitter account too. Visit the Applications tab in "Account Settings", and revoke access for any third-party application that you don't recognise.

Follow me on Twitter at @boelectronic if you want to keep up-to-speed with the latest threats, and learn how to protect yourself.

Google Apps highlights – 8/12/2011

This is part of a regular series of Google Apps updates that Google post every couple of weeks. Look for the label “Google Apps highlights" and subscribe to the series.

This week we have news from the Gmail and Google Docs teams, which both made interface changes to streamline how you use those applications. We also introduced some new keyboard shortcuts and made improvements to spreadsheet charts and functions.

New preview pane in Gmail Labs
The Gmail team has heard requests from many of you for an inbox preview pane, and last Thursday we introduced this option as a Gmail Lab. Now you can quickly scroll through a list of messages and see their contents, marking mail as “read” as you go. Once you enable this feature from the Labs area in Settings, you can choose between a vertical or horizontal split in your Gmail window.

Sharper, smoother Gmail mobile interface
Last week we also brought a higher-resolution Gmail interface for people who access their inbox through a mobile browser on a high-resolution display, like the iPhone 4. We also simplified the process to check for new mail—just pull down on the Message List. Transitions between different pages in the interface are also smoothly animated now.

New look and keyboard shortcuts for the documents list
Google Docs also got some big interface improvements to the documents list last week as part of a Google-wideproject to streamline and simplify many of our applications. You can switch to the new design by clicking “Try the new look” under the gear icon in the upper right. We’ve also added dozens of new keyboard shortcuts to navigate through the documents list, create new files, share items and more. Just type ? to see the keyboard shortcut cheat sheet.

Automatic spreadsheet function snippets
There are spreadsheet functions you probably know by heart, and others like GoogleTranslate where you might need a tip now and again, so on Tuesday we introduced spreadsheet function snippets. When you start typing a function into a cell, we’ll instantly show you a list of matching functions. Hovering over a function displays its proper syntax and the function’s purpose. We hope this feature saves you trips to the Google Docs Help Center.

New chart types, and chart improvements for documents and drawings
We also made spreadsheet charts more powerful and easier to work with. After you create a chart, it’s now simpler to copy an image of your chart and embed it into a document or drawing. There are more chart types to choose from now, too—from candlestick and combo charts to GeoMaps and TreeMaps.

Who’s gone Google?
At the end of July, we opened our doors in Japan to more than 1,500 business technology leaders from the region for a lively discussion about the future of business technology. At the event, we heard from Softbank Group, Casio, Nortiz and Toda Corporation, who have all decided to switch to Google Apps from their legacy solutions. More than 60,000 other businesses around the world also switched to Google Apps since our last update here too, including Cox Schepp, Journal Communications, Crown Partners and ITV.

In the government sector, we were pleased to see that the U.S. General Services Administration completed their transition of 17,000 employees and contractors to Google Apps, an impressive feat considering it’s been just six months since they decided to “go Google.”


I hope these product updates and customer stories help you and your organization get even more from Google Apps. For more details and the latest news, check out the Google Apps Blog.

Posted by Jeremy Milo, Google Apps Marketing Manager on Google Official Blog.

Expert says Adobe omits mention of 400 Flash Player flaws

H-Online: Officially, Adobe's current update for Flash Player has closed only 13 holes, but unofficially it is said to have closed several hundred. Security specialist Tavis Ormandy, who works for Google, claims that he discovered 400 holes and notified Adobe of them. The specialist has now complained that, while the holes have been closed, they haven't been mentioned in the official advisory, and he hasn't been given credit for their discovery.

Ormandy says that he plans to release his own advisory soon. Ormandy is quite a well-known security specialist; he regularly discovers critical software holes and, for instance, started a dispute with Microsoft last year.

Why Adobe has only mentioned 13 holes and left the rest officially undocumented is as yet unclear. One reason could be that Google and Adobe have agreed to co-operate in troubleshooting Flash Player. Flaws that are found in this context are probably treated as having been discovered internally – and Adobe's guidelines state that such flaws are not mentioned explicitly in official advisories. Microsoft pursues a similar strategy for holes that are discovered internally.

Another issue of contention appears to be the point at which a flaw becomes a hole. In Adobe's view, a hole apparently requires a CVE number and a PoC exploit, while Ormandy probably only reported "unique bugs", most of which were discovered via fuzzing.

At least Ormandy receives adequate credits in Google's release notes for the Flash update in Chrome 13.0.782.112: the Google Team said that it would like to thank Ormandy "for donating a large amount of time and compute power to identify a significant number of vulnerabilities".

Protect Your Kids from Cyber Predators

Posted by the Stop. Think. Connect. Campaign on Homeland Security

Cyber predators are real. They use the anonymity of the Internet to target victims, especially today’s youth, with unwanted solicitations, harassment, and fraud. It’s important that parents discuss ways to stay safe online with their children, particularly before they use social networking sites.

US-CERT offers the following tips for parents to help ensure their children stay safe online:

• Monitor computer activity – Keep your computer in an open area and be aware of what your children are doing, including who they’re talking to and what websites they’re visiting.
• Inform children of online risks - Discuss appropriate Internet behavior that is suitable for the child's age, knowledge, and maturity. Talk to children about the dangers and risks of the Internet so that they recognize suspicious activity and secure their personal information.
• Keep lines of communication open - Let your children know that they can approach you with any questions or concerns about behaviors or problems they may have encountered on the Internet. 

Stop. Think. Connect. Protect yourself and help keep the web a safer place for everyone. For more information on Stop.Think.Connect., please visit www.dhs.gov/stopthinkconnect.

Half of Corporate Adobe Reader Users Run Outdated Versions

SOFTPEDIA: According to statistics gathered by cloud security provider Zscaler, 56.4% of enterprise users have out of date Adobe Reader plug-in versions inside their browsers.

The company gathered statistics about browser plug-ins and presented the results in its "State of the Web" report [pdf] for the second quarter of 2011.

"Nearly every browser is running some combination of plug-ins, add-ons or extensions. As with most software, older versions of plug-ins typically have more security vulnerabilities. This adds up to a tempting target for hackers," the company warns.

Adobe Flash is the most widely spread plug-in, being present in 93.62% of browsers scanned by Zscaler. However, only 8.44% of those installations are out of date.

Adobe Reader, which is the third-most popular plug-in with an install rate of 83.37% in the corporate environment is much more likely to be outdated.

Fortunately, Java, one of the most targeted browser plug-ins, has a very low deployment rate on enterprise computers, only 9.25% of them having it installed.

Even so, 6.49% of those run an outdated version which supports the theory that Java is commonly attacked because it has a poor update rate.

When it comes to corporate networks it is not mass exploitation attacks that are the primary concern, but targeted ones in which attackers exploit vulnerabilities to install information stealing trojans.

"These overlooked apps can be exploited to gain full control of an endpoint machine. When that endpoint machine is a member of a corporate domain, the hackers gain full access to all corporate data," the Zscaler researchers warn.

It's worth noting however that these Adobe Reader stats might not reflect the actual risks. That's because Zscaler has not released a more detailed analysis of the actual versions.

Adobe Reader X (10.0) features sandboxing technology which makes it unlikely for attackers to successfully exploit vulnerabilities. This means that computers running any 10.x version, even oudated ones, can be fully protected against attacks.

Fake Firefox update includes password-stealing trojan

H-Online: Security specialist Sophos reports that it has discovered new spam email messages that claim to be an advisory related to an update to the open source Firefox web browser. The fake advisory asks users to update their Firefox installations, "for security reasons", and includes a download link to the supposed update.

According to Graham Cluley of Sophos, the download leads to an executable file that bundles an installer for the Windows version of Firefox 5.0.1 and a password-stealing trojan (Troj/PWS-BSF). As noted by Cluley, users should always exercise caution when clicking on links in emails.

Users can download the latest stable version of Firefox directly from the Mozilla project. Alternatively, users can upgrade to the new versions either by waiting for the automated update notification or by manually selecting "Check for updates" from the Help Menu.

Get Ready for Microsoft 13 updates for August Patch Tuesday

The Hacker News: Microsoft has announced that it will release 13 bulletins to address 22 vulnerabilities in Windows, Office, Internet Explorer, .NET and Visual Studio on its next Patch Tuesday. Another "critical" bulletin affects Windows server operating systems, and addresses a code-execution risk on unpatched systems. Also of note is an update restricted to newer versions of Windows (Windows 7 and Windows 2008) that tackles a potential, though difficult to exploit, code-execution risk.

Scheduled for release next Tuesday 9th August. Wolfgang Kandek, CTO of Qualys, commented that the update will have patches for end-users, server administrators, office users and software developers.

He said:

“Top priority should be given to a critical bulletin that affects Internet Explorer 6 through 9 on Windows 7, XP, Vista, 2003 and 2008. If left unpatched, attackers could use this vulnerability to remotely take control of victims' systems.The second critical bulletin affects Windows server operating systems, and server administrators should apply patches immediately as this vulnerability also leads to remote code execution. The third remote code execution bulletin only affects the newest Windows 7 and Windows 2008 operating systems and could be a little difficult to exploit as compared to the other two.”

Microsoft's pre-alert advisory can be found here.

Facebook CAPTCHA fail

SophosLabs: Facebook has taken security to a whole new level.

I think this speaks for itself.

QuickTime 7.7 closes security holes

H-Security Online: Version 7.7 of QuickTime is now available for users running Windows XP SP2 or later and Mac OS X v10.5.8 Leopard. The maintenance and security update addresses a total of 14 security vulnerabilities in the multimedia application.

QuickTime 7.7 closes holes on both platforms that could be used by an attacker to, for example, crash the application or execute arbitrary code on a victim's system. For an attack to be successful, a victim must first open a specially crafted file or a malicious web site. A cross-origin issue that may lead to the disclosure of video data from another web site has also been fixed. The company notes that, for Mac OS X 10.6 users, these holes have already been addressed in 10.6.8; the latest version of Mac OS X, 10.7 Lion, is not affected.

Further information about the security update, including a full list of vulnerabilities fixed, can be found in a post on Apple's Security Announce mailing list. QuickTime 7.7 is available to download for Windows and Mac OS X Leopard. Mac OS X users can upgrade to the latest release using the built-in Software Update function; Windows users who have Software Update for Windows can update by selecting 'Apple Software Update' from the Start menu.

See also:
About the security content of QuickTime 7.7, security advisory from Apple.

A major update in Google Chrome: Instant Page and 5200+ revisions

The Google Chrome team announced the arrival of Chrome 13.0.782.107 to the Stable Channel for Windows, Mac, Linux, and Chrome Frame. Spanning 5200+ revisions, Chrome 13, contains some exciting new features like Instant Page rendering. To find out about other new features, check out the Official Chrome Blog.

Change log is available here: Google Chrome Releases: Stable Channel Update