Beware BlackBerry Browser Bug Until Carriers Offer Updates

BlackBerry smartphone users who frequently surf the Web via handheld will want to keep checking with their wireless carriers for BlackBerry Handheld Software updates in the coming weeks. The BlackBerry Browser dialog box informs the BlackBerry device user when there is a mismatch between the site domain name and the domain name indicated in the associated certificate, but does not properly illustrate that the mismatch is due to the presence of some hidden characters (for example, null characters) in the site domain name." The flaw relates to the BlackBerry software's certificate-handling functionality. That's because a new bug found in most current versions of Research In Motion's (RIM) device software, which makes it easier for malicious parties to execute "phishing" attacks on unsuspecting smartphone users, has been addressed via handheld software updates from RIM. From RIM's online security advisory: "This advisory relates to a BlackBerry Browser dialog box that provides information about web site domain names and their associated certificates.

A hacker could potentially recreate, or "spoof," a site commonly visited by BlackBerry users, such as RIM's BlackBerry.com, by purposely adding "null characters" to the site certificate's Common Name (CN) field. CVSS is a vendor agnostic, open standard for the security industry meant to depict the seriousness of vulnerabilities, according to RIM. The BlackBerry-maker recommends that all BlackBerry users running handheld OS 4.5 or higher check in with their wireless carriers to see if device software updates are available. The recently discovered flaw keeps the BlackBerry Browser from correctly identifying mismatched site certificates due to an inability to render said null characters. (See screenshot below for an example of how the BlackBerry Browser box should look when it encounters site certificate issues due to the presence of null characters in site CN fields.) The flaw was rated 6.8 (Medium Risk) on a Common Vulnerability Scoring System (CVSS) scale of one to ten, with one representing little or no risk and ten representing very serious risk. The problem: I just did a quick search of both AT&T and Verizon's BlackBerry download pages, but in a number of cases I could only locate earlier software versions than those recommended by RIM. Here's a list that specifies which software should be updated and to which new versions. If you encounter a BlackBerry Browser dialogue box like the ones shown in this post, you should choose to close the connection rather than subject yourself to potential phishing-related risk, according to RIM. More information on BlackBerry security can be located on the company's website. Current Software Version * BlackBerry Device Software v4.5.0.x to v4.5.0.173 or later * BlackBerry Device Software v4.6.0.x to v4.6.0.303 or later * BlackBerry Device Software v4.6.1.x to v4.6.1.309 or later * BlackBerry Device Software v4.7.0.x to v4.7.0.179 or later * BlackBerry Device Software v4.7.1.x to v4.7.1.57 or later Until you're able to sit down and update your device-or while you wait for your carrier to issue an update-RIM says to use caution when clicking unknown links in SMS text or e-mail messages, even if they're from what appears to be a trusted source.

Defunct airport fast-pass program may be revived

Tens of thousands of subscribers to a registered air traveler program, who were left feeling scammed when the company offering the service abruptly went out of business, may soon get a break. Subscribers to the Clear service, some of whom had signed up for two years or more of service just before VIP went out of business, will be offered a chance to continue their subscriptions after the deal goes through. A new investment group based in California has signed a letter of intent with Morgan Stanley, the defunct company's largest debt holder, according to the New York Times . Under a proposed plan, the investment firm will be allowed to buy the assets of Verified Identity Pass Inc. (VIP) and restart the Clear fast-lane security service, the Times reported, quoting the owner of the Emeryville, Calif.-based investment banking firm, Henry Inc. If an individual chooses not to, any personal data on that individual that had been collected by VIP for Clear, will be permanently destroyed, the Times said quoting the investment banker.

VIP was one of seven companies approved by the Transportation Security Administration (TSA) to operate a registered traveler program, which lets air travelers get through airport security checks faster. The news is likely to provide some comfort to thousands of customers of VIP who were left in the lurch when the company in June abruptly announced it could no longer offer the Clear service because it had run out of cash. It offered the service at 21 major airports, including New York's John F. Kennedy International Airport, La Guardia, Boston's Logan International and Atlanta's Hartsfield-Jackson airports. To sign up for VIP's Clear service, customers had to submit to background checks and provide identifying information, including Social Security and credit card numbers, home address, date and place of birth, phone numbers and driver's license number. More than 200,000 customers had signed up for the service when the company went out of business.

They also had to provide fingerprints, iris scans and digital images of their faces. The company made matters worse by hinting that it would sell the data it had collected to fulfill its debt obligations. VIP's decsion to shut the service raised concerns about the fate of the data that had been collected by the company. Many participants were left feeling scammed when VIP announced that it couldn't refund their subscriptions because it had run out of money. The motion was in response to a lawsuit brought by concerned customers.

Days after the company's closure, the chairman of the House Committee on Homeland Security asked the TSA to ensure that all information collected by VIP was properly protected and destroyed . In August, a federal judge in New York issued an injunction prohibiting VIP from selling, transferring or disclosing to any third-party the data it collected while operating the Clear service. The injunction, however, was later lifted on a technicality. For the moment, the purchase does little to alleviate the major complaint in the lawsuit, which is that VIP's customers didn't get a refund from their subscriptions. "That is something that they are entitled to regardless of whether or not other companies" purchase VIP, he said. Todd Schneider, an attorney with Schneider, Wallace, Cottrell, Brayton, Konecky LLP, a San Francisco law firm representing one of the parties in the lawsuit, today said he was unclear on the ramifications of the reported purchase of VIPs assets by the investment banking firm. A hearing in the case has been scheduled for Oct. 16, where Schneider plans to again ask the judge to bar VIP from selling its data assets to any third party.

News of the proposed purchase comes as the House Committee on Homeland Security is scheduled to hold a hearing today on the future of the registered air traveler program.

Sybase smooths enterprise path for iPhones

Sybase is extending its Afaria mobile-device management platform and database software to the Apple iPhone, taking advantage of new enterprise features in Version 3.1 of the iPhone's software to give IT departments more control and capabilities on the popular handset. Going on sale in the middle of this month, Sybase's Afaria 6.5 will finally give administrators the kinds of controls they have had previously for mobile platforms such as Symbian, Microsoft Windows Mobile 6.1, Research In Motion BlackBerry and PalmOS. Apple's recent iPhone 3.1 release added the capability to lock down certain settings on a device so the user can't change them using the phone's configuration utility, said Mark Jordan, senior product manager for Afaria. Though many enterprise employees bring iPhones into the office and rely on them for personal communications, the device originally caught on as a consumer gadget for music, Web browsing and entertainment applications, and has only gradually made inroads as a workplace tool. That allowed Sybase to give enterprise IT departments the power to do things such as block applications, define the required password strength and lock down Wi-Fi and VPN (virtual private network) settings.

With the new Afaria, enterprises can make and change settings on employees' iPhones over the air based on overall policies for certain departments, job descriptions and other criteria. Administrators can now establish a trusted relationship between Afaria and the employee's phone using a certificate, he said. Among other capabilities, they can also require device authentication for access to a corporate directory and set up compliance reporting on the employee's use of the phone. Also on Tuesday, it announced tools for the Sybase SQL Anywhere database to be used for synchronization of data between an iPhone application and a back-end database. Sybase announced Afaria's iPhone capabilities on Tuesday at the iPhone Developer Summit in Santa Clara, California.

Using SQL Anywhere, internal developers and software vendors can build in bi-directional synchronization between an on-device app and relational databases including Sybase, Oracle, SQL Server, DB2 and MySQL. This frees employees from having to depend on the cellular data connection to get work done while on the road, Jordan said. Also on Tuesday, the company's Sybase 365 subsidiary introduced a turnkey system for mobile banking on the iPhone. There is a beta test program now open for SQL Anywhere for iPhone. With it, banks can allow their customers to check balances, transfer funds among accounts, securely communicate with bank representatives, find branches and automatically dial the bank, Jordan said. The Sybase mBanking 365 iPhone platform is available now and is already deployed by BBVA Compass as the BBVA Compass Mobile application.

Cisco results top estimates

Cisco Systems on Wednesday posted first-quarter results that far exceeded Wall Street's expectations, though revenue and profits were down from a year earlier. Likewise, earnings per share for the quarter came in $0.05 better than expected, at $0.36. The non-GAAP figure excludes expenses, charges and other one-time items. Revenue for the quarter ended Oct. 24, the first of Cisco's fiscal year, was US$9.0 billion, compared to the $8.74 billion expected by financial analysts, according to a poll by Thomson Reuters.

Sales in the quarter were down 12.7 percent from a year earlier. On a sequential basis, revenue was up 6 percent from the fourth quarter, while earnings per share were up 16 percent. "Our Q1 results continued to reflect strong sequential growth trends that meet or exceed expectations during normal economic times," Cisco CEO John Chambers said in a statement. "We view the improving economic outlook, combined with solid execution on our growth strategy, as creating unparalleled opportunity to drive more value into the core of the network. The non-GAAP earnings per share were also down, by 14.3 percent. Simply said, we believe that key market transitions across collaboration, virtualization and video will drive productivity and growth in network loads for the next decade, and are evolving even faster than expected. "A new model of productivity based on collaboration is clearly emerging, and we believe this may be the most profound opportunity for businesses in our 25 years as a company," Chambers added. Cisco's board had previously authorized up to $62 billion in stock repurchases.

Cisco also said its board of directors authorized up to $10 billion in additional repurchases of its common stock. There is no fixed termination date for the repurchase program. The remaining authorized amount for stock repurchases under this program, including the additional authorization, is approximately $13.1 billion.

Benioff trumpets Force.com platform's success

Salesforce.com CEO Marc Benioff on Thursday attempted to cement an image of the vendor as a full-blown application development platform provider, not merely a purveyor of SaaS (software-as-a-service) applications. More than 135,000 custom applications have been built with Force.com and more than 200,000 programmers now belong to the company's developer network, the company said. The colorful CEO pulled a familiar arrow from his rhetorical quiver during a keynote address at the Dreamforce conference in San Francisco, decrying the annual software maintenance fees vendors like Oracle charge, and imploring customers of those companies to align themselves with Salesforce.com and its Force.com development platform. "They think it's their purpose in life to collect those taxes on software development [technologies] that were developed a decade ago," he bellowed. "When are you going to ask for innovation instead of paying maintenance?" But according to Salesforce.com, many already have. Salesforce.com claims its system, available by subscription starting at US$25 per user per month, allows companies to develop applications much more quickly and less expensively than with traditional development stacks.

Also, since companies are using Salesforce.com's own cloud infrastructure, there is no need to invest in hardware. Part of the reason for this is that developers do not need to test their applications against multiple combinations of databases, application servers and other components. But Force.com development also presents a trade-off, since it could difficult to port an application built there elsewhere. CA on Thursday announced plans to release CA Agile Planner, a Force.com-built system for managing agile software development projects. Still, Salesforce.com is beginning to attract ample interest from some of the industry's largest software vendors.

Agile development lets teams create many incremental iterations of an application, allowing for continual feedback from end-users and managers along the way. Both companies described how they built ERP (enterprise resource planning) applications on Force.com. BMC executives also took the stage to showcase the company's own Force.com project, a service-desk application that will be released in 2010. The keynote also showcased how Force.com is being used by businesses as well as ISVs. Benioff introduced officials from a variety of companies, including countertop maker Vetrazzo and the Japanese convenience-store chain Lawson. Force.com may indeed be a more convenient method of developing applications, especially if a company isn't dealing with a wealth of legacy systems, said Michael Coté, an analyst with Redmonk. "Just having a Web site to log into, that's a better way of getting IT in general," he said. IT shops will have plenty of cloud development platforms to choose from in the months and years ahead, including Microsoft's Azure, Coté said.

However, "not everyone is lucky enough that they can start from a clean slate," he added. Therefore, the best approach may be to initially experiment with small projects, especially because doing so will help companies determine "how this new way of delivering software affects the business," he said.

FCC identifies roadblocks to broadband adoption

Several factors, including a lack of a broadband subsidy program at the U.S. Federal Communications Commission, have contributed to gaps in broadband adoption in the U.S., a new report from an FCC task force said. The task force suggested that broadband deployment and adoption programs should be included in the FCC's Universal Service Fund (USF) program, which now subsidizes primarily telephone service for rural areas and low-income U.S. residents. Several "critical gaps" in the nation's broadband efforts must be filled before all U.S. residents can get broadband, said the task force, working on a national broadband plan for the FCC. The task force report identified several often-mentioned factors for a lack of broadband adoption, including the cost of the service and a lack of deployment in some areas, but it also focused on some less obvious issues.

Part of the fund, with an annual budget of about US$7 billion, should be shifted to broadband, the task force said. Freeing up new spectrum can take several years, and a handful of studies have predicted a spectrum shortage by the mid-2010s due to growth in subscribers and use of bandwidth-heavy applications, said Ruth Milkman, chief of the FCC's Wireless Telecommunications Bureau. "We know there's a spectrum gap, and we know we need to act in the near term," she said. In addition, the task force recommended that the FCC begin looking for additional wireless spectrum for mobile broadband. The task force report also suggested that video and a convergence between television sets and computers will drive the demand for broadband. There may be ways for the FCC to encourage a retail set-top box market, the task force said. But the TV set-top-box market has seen relatively few innovations in recent years, with most cable subscribers leasing their set-top boxes from their providers, commission staff said.

Another roadblock to broadband adoption is a lack of information about broadband services, the task force said. There is "no shortage of issues" that the FCC should address in its national broadband plan, due Feb. 17, said Eric Carr, general manager of the FCC's Omnibus Broadband Initiative. It can be difficult for consumers to compare the performance of their broadband service to advertised speeds or compare the performance of different broadband providers, the report said. FCC members generally praised the task force's report, but Commissioner Michael Copps said he wanted to see a greater emphasis on civic engagement as a driver for broadband adoption. I want to see a little more heightened emphasis on the point of civic engagement ... and on the point of how this encourages interactivity among the citizens of this great country of ours." Task force members talked about the need for a "fact-based" look at broadband needs, but there are bigger issues as well, Copps said. "This is an exercise that goes beyond metrics and beyond tangibles," Copps said. "I would urge you to look at the intangibles that are involved here.

India schedules 3G license auction for December

India's auction of 3G and WiMax licenses is now scheduled to be held in December, according to a notice on the Web site of the country's Department of Telecommunications. Bidding for 3G licenses will start Dec 7, with the WiMax auction scheduled to start two days after the 3G auction is complete, according to the notice. The auction was originally scheduled for January of this year, but was postponed after disagreement within the government on the minimum cost of the licenses.

Both Indian and foreign companies are allowed to bid for the licenses, but foreign companies will have to set up joint ventures with Indian investors to run services in the country. The Ministry of Communications will license four slots for 3G in each of India's 22 service areas, with a fifth slot reserved for two government-run telecommunications companies. A group of ministers, set up to resolve the dispute over pricing the licenses, has named Indian rupees 250 billion (US$5 billion) as the minimum revenue from the auction of the 3G and WiMax licenses in the country, India's Minister of Communications, A. Raja said last month. A telecommunications company bidding for 3G licenses in all 22 circles will have to pay at least Indian rupees 35 billion, according to the new minimum pricing proposed by the Indian government. Two companies, Bharat Sanchar Nigam Ltd. and Mahanagar Telephone Nigam Ltd., were allotted 3G spectrum ahead of the auction, and have started offering services. By the pricing announced last year, they would have to pay about rupees 20 billion.

The government said last year that these companies would have to pay license fees equal to the highest bid in each service area. The final date for applications from bidders is Nov 13.