Mozilla unblocks one sneaky Microsoft add-in

Mozilla has unblocked one of the two Microsoft-made add-ons that put Firefox users at risk from attack and will probably unblock the second in the next 48 hours, the company's head of engineering said today. "We've unblocked the .NET Framework Assistant," said Mike Shaver, Mozilla's vice president of engineering, on Monday morning. Late on Friday, Mozilla added .Net Framework Assistant and the accompanying Windows Presentation Foundation plug-in to its rarely-used blocking list , which then threw up a warning to users notifying them that the pair was being barred from Firefox. Shaver was referring to one of the two Microsoft components that Mozilla automatically disabled late Friday after deciding it needed to protect Firefox users from a critical vulnerability Microsoft disclosed, and patched, last week. "We got confirmation from Microsoft over the weekend that the add-on wasn't a[n attack] vector for the vulnerability in question," said Shaver.

Mozilla has also pushed out a change that will let users running Firefox 3.5 override the block, added Shaver. The block of Windows Presentation Foundation will likely be lifted in the next two days. "Microsoft is watching the patch deployment numbers, and sharing them with us," said Shaver. "At some point, we'll take the [Windows Presentation Foundation] plug-in off the blocker. That change came out of discussions with enterprise Firefox users who said that they needed the two components to run their .NET-based software within the browser. I expect that to happen in the next 48 hours." Last week, Microsoft's security team acknowledged that its software - which had been silently installed in Firefox as far back as February 2009 - contained a critical vulnerability that could be used by hackers to hijack Windows PCs through Firefox . The vulnerability also affected all versions of Internet Explorer (IE), including IE8. However, the MS09-054 bulletin, which provided details on the vulnerability, said nothing about Firefox. Friday, Shaver cited the severity of the vulnerability and the difficulty some users have had in removing Microsoft's software as Mozilla's reasons for engaging the blocking list.

Later last Tuesday, Microsoft expanded on MS09-054 in a blog post, and confirmed that Firefox users were in danger . Microsoft maintained that Firefox users who applied the patches would be safe from attack, but Mozilla felt that was not enough. Removing the Microsoft add-on and plug-in have been a contentious issue since Microsoft first slipped them into Firefox without users' permission last February as part of the .NET Framework 3.5 Service Pack 1 (SP1) update, which was delivered via Windows Update. Later, Microsoft issued a follow-on update that made it possible to uninstall the components without a registry edit. Users were also furious that the software was impossible to uninstall without editing the Windows registry. Shaver denied that there was miscommunication between Microsoft and Mozilla, and instead characterized it as a "lack of clarity." "We're going to be in better communication," he promised, "especially about things like the version number of the [affected] plug-in." One of the problems Mozilla had last week was determining what - .NET Framework Assistant or Windows Presentation Foundation, or both - was vulnerable, and specifically what versions were at risk to attack. "This was an unusual case of using the blocker," Shaver said. "Version information was not available to us at first, and since [the software] was installed by many users, many of them were unaware they even had it, and the add-on and plug-in were difficult to uninstall, we thought it best to block them, at least for a time.

We do that with add-ons in Firefox now, which checks for those added since the last time you ran the browser. Microsoft agreed." Mozilla has used its add-on/plug-in blocking tool only nine times, including last week's incident, since it first deployed it in 2007. In the future, Firefox will include built-in tools that check whether components have been added by third-party software, then disable the add-on or plug-in by default and notify the user and allow him or her to enable the component(s). That kind of check, if it had existed earlier this year, would have kept the Microsoft software from being installed without Firefox users noticing. "We're big believers in informed user choice," said Shaver. "So we're going to improve notifications to users when plug-ins are installed. We will do the same thing for plug-ins, likely in Firefox 3.7." That version of Firefox, the second of two minor upgrades scheduled for the next six months, is currently slated to ship in March 2010. Since Version 3.0, Firefox has notified users when any new add-ons, called "extensions" by Mozilla, have been installed since the last time the browser was launched. The plan now is to make those notifications clearer, and also to warn about system-installed items before they're running, Shaver said. "We're also building our plug-in check into the product for Firefox 3.6," added Shaver, referring to the outdated plug-in campaign that Mozilla kicked off last month, and bolstered last week when it launched a plug-in checking service . Firefox 3.6 will warn users of outdated third-party plug-ins, like Adobe's Flash or Apple 's QuickTime, when the browser reaches a site that calls upon such software. "We've learned a lot from this," concluded Shaver. "We're not trying to get into an adversarial model, but this was more visible than most [blocks in the past] because of the size of the company involved and the history of the plug-in. "I would call the communication between us and Microsoft 'greatly clarified' as of now," Shaver said. That notification, however, is "poor," acknowledged Shaver, since it simply highlights the new add-ons in a window and most importantly, does so after the add-on has already been installed.

Making Sense of Rapid7's Metasploit Acquisition

News of Rapid7's Metasploit acquisition hit some in the information security community like a clap of thunder. But in the hours after Wednesday morning's announcement, cautious optimism began to take hold. The Metasploit Project has a deep, loyal user base, and it's always unsettling to those who rely on open-source tools when those tools are snatched up by a commercial vendor. Some IT security practitioners started to see the potential benefits of a Rapid7-Metasploit union - providing the vendor handles its new property and user base with great care. "They certainly have acquired an exceptional back-end research capability," said Pete Hillier, CISO at CMA Holdings in Ottawa. "The question is if they can ensure the continuity once the acquisition is complete?" Some are skeptical of that, including Richmond, Va.-based IT security practitioner Rick Lawhorn, who quipped in an e-mail: "The road to hell is paved with good intentions.

It also promised to "sponsor dedicated resources and contributions to the standalone, community-driven Metasploit Project to further its growth and success." "Metasploit and Rapid7 NeXpose are uniquely positioned to improve upon the industry-leading capabilities of both products and to raise the bar on the industry at large," Mike Tuchen, president and CEO of Rapid7, said in a press release. "With our broader solution portfolio, we are the first security provider to meet the demand of enterprises and government agencies in enabling them to identify and mitigate exploitable threats in their IT environment based on their security risk profile." The vendor said Metasploit Project founder HD Moore will become Rapid7's chief security officer and will remain Metasploit`s chief architect. Unfortunately, the ones who will be happy are the bad guys; with a potentially-reduced focus on making things secure and greater focus on profitability." Rapid7, a vendor of unified vulnerability management, compliance and penetration testing tools, said it will use Metasploit to enhance its NeXpose product. For his part, Moore predicts big dividends for his user base. "This acquisition provides dedicated resources to the project, accelerating our growth and allowing us to provide even better solutions to the community," he said in the Rapid7 press release. "Rapid7 recognizes the value of the community and is passionate about the success of the project." Nick Selby, a faculty member of the Institute for Applied Network Security (IANS) and managing director of Trident Risk Management, is among those expressing optimism. "The best thing about the acquisition is that enterprise customers now have three legitimate, sue-able and responsible organizations proffering tools for penetration testing," he wrote Wednesday in the IANS blog. "Quality will likely rise, average price will likely fall, and functionality will likely increase. The Rapid7-Metasploit union will likely shake up that dynamic, to the benefit of buyers and end users, he added. This is a good time to be in the market for pen-test software." See also: Why Pen Testing is Central to Pennsylvania's App Security Selby wrote that the dynamics of the pen-testing market have been that Core Security sat atop the marketplace in terms of price, scale and enterprise usability while Immunity Security "cleaned up at the lower end of the enterprise market" and dominated for vendors and professional services types who also used Metasploit as a free tool.

Boston-based IT security practitioner Zach Lanier said the acquisition is "phenomenal" news for Moore, Egypt (a Metasploit developer, now joining the project/Rapid7 full time), and Rapid7 as a whole. "Naturally, this acquisition will give Metasploit access to more resources, including more full-time team members; Rapid7's knowledge base; and technology and tools," he said. "This will also bring more visibility to Rapid7's vulnerability scanner, NeXpose, given the complementary nature of the Metasploit Framework." Though he's reluctant to simply accept that there will be little-to-no change in the Metasploit Framework's licensing and open source nature, Lanier said he's "pretty confident" Moore and others "will adamantly defend such important principles." Gadi Evron, a security strategist based in Israel, said the acquisition at least goes to show that not-for-profit work can exist in today's market and be competitive enough to draw commercial interest. Asked if he believes Rapid 7 will handle its new acquisition in a way that will benefit users or, at the least, do no harm, Evron said, "One would hope they would, just as one would hope HD made sure they would."

Facebook captures largest IT deal of quarter

The IT industry raised almost $2 billion in venture capital in the third quarter, regaining its position as the top money-grabber, Dow Jones VentureSource says in a new report. Facebook captured the IT industry's biggest investment in the quarter, with a $100 million round from undisclosed investors in mid-July. But overall, IT investment has hit its lowest point in 12 years. http://www.networkworld.com/supp/2009/outlook/hottech/010509-nine-hot-te... ">Web 2.0 companies are on the upswing, but software investments are dramatically lower than they were last year. "The slow recovery we've seen for venture capital has faltered," Jessica Canning, director of global research for Dow Jones VentureSource, said in a news release. "As liquidity and fundraising lag after the economic meltdown in 2008, investors have no choice but to keep a tight rein on investments until the industry is on more solid ground." IT companies raised $1.87 billion across 270 deals in the third quarter, compared to $1.94 billion across 248 deals in the second quarter for the IT sector. IT emerged as the top market for venture capital in the third quarter because the healthcare industry suffered a drop from $2.2 billion to $1.7 billion.

Despite receiving more venture money than the healthcare industry, investments in the IT industry are still at a 12-year-low and significantly below 2008 levels. While the IT sector is typically the leading recipient of venture capital, healthcare companies had briefly overtaken IT with their second quarter total, according to Dow Jones. Last year, IT companies took in $12.2 billion in venture investments across 1,328 deals. A bright spot for IT comes from the Web 2.0 sector, where investments surpassed the software market for the first time. With data from three out of four quarters in 2009, the industry is at just $5.4 billion across 747 deals. The information services sector - which includes most Web 2.0 companies - pulled in $627 million in new investments in the third quarter, up 11% over the same period last year.

For all industries, venture capitalists invested $5.1 billion in 616 deals in the third quarter, down 6% since last quarter and down 38% since the third quarter of 2008. If current trends persist, 2009 will be the worst investment year in U.S. venture-backed companies since 2003, according to Dow Jones. Software companies, meanwhile, raised just $581 million in the quarter, a 55% decline from the $1.3 billion invested in the same timeframe last year. "This is the [software] sector's lowest quarterly investment total since 1996," Dow Jones reports. Follow Jon Brodkin on Twitter: http://www.twitter.com/jbrodkin

Report says China ready for cyber-war, espionage

Looking to gain the upper hand in any future cyber conflicts, China is probably spying on U.S. companies and government, according to a report commissioned by a Congressional advisory panel monitoring the security implications of trade with China. Government agencies and military contractors have been hit with targeted, well-crafted attacks for years now, many of which appear to have originated in China. The report outlines the state of China's hacking and cyber warfare capabilities, concluding that "China is likely using its maturing computer network exploitation capability to support intelligence collection against the U.S. government and industry by conducting a long term, sophisticated computer network exploitation campaign." Published Thursday, the report was written by Northrop Grumman analysts commissioned by the US-China Economic and Security Review Commission.

But this report describes in detail how many of these attacks play out, including an attack that exploited an unpatched flaw in Adobe Acrobat that was patched earlier this year. Northrop Grumman based its assessment largely on publicly available documents, but also on information collected by the company's information security consulting business. Citing U.S. Air Force data from 2007, the report says at least 10 to 20 terabytes of sensitive data has been siphoned from U.S. government networks as part of a "long term, persistent campaign to collect sensitive but unclassified information." Some of this information is used to create very targeted and credible phishing messages that then lead to the compromise of even more computers. The report describes sophisticated, methodical techniques, and speculates on possible connections between Chinese government agencies and the country's hacker community, increasingly a source of previously unknown "zero-day" computer attacks. "Little evidence exists in open sources to establish firm ties between the [People's Liberation Army] and China's hacker community, however, research did uncover limited cases of apparent collaboration between more elite individual hackers and the [People's Republic of China's] civilian security services," the report says. The U.S. government has had a presence at the Defcon hacker convention for years now, and the U.S. Department of Defense has even started using it as a recruitment vehicle in recent years.

If true, that wouldn't be much of a surprise. The Adobe Acrobat attack was supplied by black hat programmers to attackers who targeted an unnamed U.S. firm in early 2009. Working nonstop in shifts, the attackers snooped around the network until an operator error caused their rootkit software to crash, locking them out of the system. It might be disguised to look like the schedule or registration form for an upcoming conference, for example. In a typical targeted attack, the victim receives an email message containing a maliciously crafted office document as an attachment. When it's opened, the zero-day attack executes and cyberthieves start collecting information that might be used in future campaigns.

In some cases they've installed encrypted rootkits to cover their tracks, or set up staging points to obscure the fact that data is being moved off the network. They sniff network and security settings, look for passwords, and even alter virtual private network software so they can get back into the network. In another case cited by Northrop Grumman, the attackers clearly had a predefined list of what they would and would not take, suggesting that they had already performed reconnaissance on the network. "The attackers selected the data for exfiltration with great care," the report states. "These types of operational techniques are not characteristic of amateur hackers." Earlier this year, Canadian researchers described a similarly sophisticated cyberespionage network, called GhostNet, launched against international government agencies and pro-Tibetan groups such as the Office of His Holiness the Dalai Lama. Although the GhostNet report authors did not link the spying to the Chinese government, some researchers did.

Facebook Prototypes Lets You Test Latest Apps

Facebook launched a new applications feature late Tuesday that will let you test the latest tools the social network is working on. Here's a breakdown of the five features you can try out: Desktop Notifications (Mac OS X only): A Mac OS X growl notification app that sits on your menu bar and alerts you when someone writes on your Facebook Wall or sends you a message. Called Facebook Prototypes, it's similar to Google Labs as it allows you to try out new features that, as Facebook says, are "not quite ready for prime time, are a bit esoteric, or don't quite fit." There are five new features currently available, most of which were created during a recent Facebook Hackathon event-an all-night coding session where Facebook techies work on projects they don't have time to develop during regular business hours.

You can also update your Facebook status within the application or navigate directly to your profile, News Feed, or Compose Message window. With one click, your friends can add the event to their personal calendar program like Google Calendar, Microsoft Outlook, or iCal. Enhanced Event E-mails: Adds an iCal file to event notifications sent to your Facebook friends via regular e-mail. For this feature to work, your friends must have event e-mail notifications enabled in their Facebook account settings. Click on the tag and Facebook will try to find other News Feed posts with similar attributes.

Similar Posts: Adds a "Similar Posts" tag under posts in your News Feed, such as status updates, shared links, and videos. Photo Tag Search: Integrated into the Facebook photo dashboard, Photo Tag Search lets you search photos posted by you and your friends for up to fifteen people at once. Plug your name and your friends' names into the search bar, and Facebook will show you all the photos where all of you are tagged. Say you want to find a photo of you and three friends. This feature will only find photo tags for people you're connected to on Facebook.

Click on it, and your News Feed will show the most recent Facebook posts your friends have been commenting on. Recent Comments Filter: Places a "comments" button on the column to the left of your News Feed. The Prototype applications include several great features, and while some of them are a little rough, they do add great functionality to your Facebook experience. Sometimes it inexplicably asks you for your login credentials, but it's a great little program if you want to stay on top of Facebook without logging on to the service. If you're on Mac OS X, I highly recommend trying out the Desktop Notifications app. To activate the prototypes, click on the Facebook Applications page and then click on 'Prototype' in the left hand column.

Connect with Ian Paul on Twitter (@ianpaul).

Oracle profits rise but sales fall in Q1

Oracle's first-quarter net income rose by 4 percent year-over-year to US$1.1 billion, but revenue fell by 5 percent to $5.1 billion, the company said Wednesday. New software license sales fell 17 percent year-over-year to $1 billion, indicating that customers are still reluctant to make new software investments amid the ongoing recession. Earnings per share were $0.22. Excluding one-time charges, Oracle reported earnings per share of $0.30, partly meeting the expectations of analysts polled by Thomson Reuters, who had on average predicted earnings of $0.30 per share and $5.25 billion in revenue.

Oracle managed to increase profits even as revenue fell by "substantially improving" its operating margins, company President Safra Catz said in a statement. Associated expenses were just $226 million, meaning the profit margin for this part of Oracle's business was greater than 90 percent. Oracle's results were also bolstered by growth in revenue for software license updates and support, which jumped 6 percent to $3.1 billion. Oracle blamed the dip in new license sales partly on weak business at other software vendors. "They sold less of their applications, and so they drive less database with them," Catz said in a conference call. Oracle announced plans to acquire Sun earlier this year, but the acquisition is being held up by an antitrust review by European authorities. The earnings report comes a day after Oracle announced a new Exadata data warehousing and OLTP (online transaction processing) appliance jointly developed with Sun Microsystems.

Oracle executives offered no new details about the deal Wednesday, but said integration planning work is proceeding. The company is well-positioned to compete against IBM with its recently updated database and middleware products, he said. During the call, CEO Larry Ellison repeatedly targeted IBM, who Oracle will soon be battling in both software and hardware markets. Oracle shares were down $0.78 in after-hours trading to $21.35.

Lenovo founder shares slogans, tells tales of 1980s China

The chairman of Lenovo, the world's number four PC maker, shared Chinese revolution-spirited slogans and the unlikely story of his company's growth out of a government-managed economy in a motivational speech to Chinese small business owners on Friday. Lenovo faced tough odds even though its founders were from the Chinese Academy of Sciences, a Chinese state-controlled institute for national research projects. Liu Chuanzhi, one of 11 former government researchers who founded the predecessor to Lenovo in 1984, recalled how the company fought through trade barriers, high component prices and domination by foreign brands in a talk that highlighted how fast China's economy has grown in the last three decades. "In 1993 almost the whole market was foreign-branded computers," Liu said at the forum for small and medium businesses in Hangzhou, a scenic city in eastern China.

The academy gave the company founding capital of 200,000 yuan, or about US$30,000 today. Things only grew worse when the company was scammed out of two-thirds of the money, he said. "When we came out, we not only lacked funds but also had no idea what to do," Liu said. That sum, far from enough, would not have been enough to buy three computers in China in the 1980s, Liu said. Lenovo, formerly called Legend Group, was founded early in China's process of market economic reforms and had to work in a tightly regulated environment. The low quality of components such as hard drives in China also hindered the company, he said.

China tried to protect domestic PC makers in the 1980s by charging a massive 200 percent tariff on foreign computers, said Liu. "The result of this protection was that foreign computers were very difficult to get into China and could only be smuggled, but China also could not make its own computers very well," he said. Lenovo's first PC did not reach the market until 1990. Lenovo struggled with low margins even as it built market share against foreign brands like IBM and Compaq in the 1990s. Government regulation also continued to slow the industry's growth. Lenovo's global presence gained a huge boost when it bought IBM's PC unit in 2005. The company's sales in developed markets have since slumped in the global economic recession and it has restructured to bring its focus back to China and other emerging markets. Chinese residents had to register with the government to become Internet users even late in the decade, said Liu. Lenovo today is the top PC vendor in China. Liu also emphasized the importance of company culture, describing Lenovo's as an example. "Make the company's interests the top priority, seek truth in forging ahead, take the people as the base," Liu said.

To succeed like Lenovo, companies must "love to battle, know how to battle, and conduct campaigns with order," Liu said, using language reminiscent of "The Art of War," an ancient Chinese book on military strategy by Sun Tzu. Chinese president Hu Jintao has promoted the slogan "take the people as the base" as a part of socialist theory. Liu attended a Chinese military college in the 1960s and worked on a Chinese farm during the Cultural Revolution, a chaotic period when many graduates were sent to the countryside for re-education.