Javascript Security Flaws Discovered

Polish researchers have released technical details and attack code for 30 security issues affecting Oracle’s Java Cloud Service. Some of the flaws make it possible for attackers to read or modify users’ sensitive data or to execute malicious code.

Security Explorations said it would normally withhold public airings until after any vulnerability has been fixed. But apparently Oracle representatives failed to resolve some of the more crucial issues including bypasses of the Java security sandbox, bypasses of Java whitelisting rules, the use of shared WebLogic server administrator passwords, and the availability of plain-text use passwords stored in some systems.

Oracle apparently has admitted to the researchers that it cannot promise whether it will be communicating resolution of security vulnerabilities affecting their cloud data centres in the future.

Adam Gowdiak, CEO of Security Explorations said Oracle unveiled the Java Cloud Service in 2011 and held it up as a way to better compete against Salesforce.com.

Source

Juniper Boots Employees

Juniper Networks plans to reduce its global workforce by six percent and focus on its high-growth businesses. Juniper said most of the cuts would impact middle management positions and that it expected to incur cash charges of about $35 million in the first quarter, related to severance and other expenses. The company had 9,483 full-time employees as of December 31.

Juniper also said it would stop development of the application delivery controller technology, which helps remove excess load from servers, resulting in a non-cash intangible asset impairment charge of about $85 million. The company said it plans to consolidate its facilities, flog off of about 300,000 square feet of leased facilities.

Juniper added that it expected to record other non-cash asset write-downs of about $10 million in the first quarter and that it expects to carry out more restructuring in the second quarter.

Hedge fund Elliott recently claimed that Juniper shares were “undervalued” and could be worth $35-$40 if Juniper focused on revamping its core business of making routers and switches for mobile carriers such as Verizon and AT&T. Shares of Juniper are currently worth at $26.35.

Source

Oracle Updates NoSQL

Oracle has announced the availability of the latest edition of its NoSQL datatabase.

NoSQL is Oracle’s distributed key-value database. Now in it’s third version, the enhancements this time are heavily centred around security and business continuity.

Oracle NoSQL 3.0 features improvements in security with cluster-wide password based user authentication and integration with Oracle Wallet. Session level Secure Socket Layer (SSL) encryption and network port restriction are also included.

For disaster recovery and prevention, there’s automatic fail-over to metro-area secondary data centres, while secondary server zones can be used to offload read-only workloads to take the pressure off primary servers under stress.

For developers, there is added support for tabular data models that Oracle claims will simplify application design and improve integration with SQL based applications, while secondary indexing improves query performance.

“Oracle NoSQL 3.0 helps organisations fill the gap in skills, security and performance by delivering […] enterprise-class NoSQL database that empowers database developers and DBAs to easily, intuitively and securely build and deploy next generation applications,” said Oracle’s EVP of Database Server Technologies, Andrew Mendelsohn.

It’s already been a big week for the SQL community with NoSQL arriving on MariaDB for the first time, courtesy of a tie-up between SkySQL, Google and IBM on Tuesday, while yesterday Fusion-IO announced the use of Non-volatile memory (NVM) compression in MySQL to increase the capacity of SSD storage.

Both the community and enterprise versions of Oracle NoSQL Database 3.0 are available for download now from the Oracle Technology Network.

Source

Box Launches HTML 5 Tool

Box has updated developer usage plans and opened access to a document viewing tool as it looks to build momentum ahead of its IPO.

Box has made its HTML5 document viewing tool called Box View available for developers to incorporate into their companies’ products and services.

It was unveiled in beta mode last September at the firm’s annual Boxworks conference and is designed to help firms ensure that documents in any format can be viewed online. The tool is based on technology Box acquired in its acquisition of Crocodoc.

Box product manager Sean Rose explained in a blog post, “Box View is an API that converts Office and PDF documents to easily embeddable HTML5, enabling developers to create beautiful experiences around content. Gone are the days of forcing users to deal with broken and inconsistent experiences across platforms.

“With just a few simple API calls, developers can create an elegant and consistent content experience across all platforms.”

Box cited some customers that are already using this service, such as UberConference, Xero and Shake to ensure that they can send information to partners, customers and contractors quickly and easily.

Furthermore, the firm has based the pricing model for the tool on a per-use basis, rather than a traditional per-user basis.

For users of the service as a Box-branded platform – so it displays the Box logo, rather than the customer’s own logo – it’s free for 1,000 document uploads per month. After that it’s priced at 2.5 cents per document.

Custom use of the tool so the customer’s own logo is displayed costs $250 per month for 2,500 uploads. Each document after that costs five cents per upload, but enterprise users can thrash out a deal with Box for any service they expect to handle over 10,000 document uploads a month.

“Most developers will never have to pay anything for Box View, and, for those that do, Box View pricing is built to scale alongside your app’s user base,” added Rose.

As part of this encouragement to developers to incorporate Box into its tools the firm has also unveiled new pricing models around its APIs, to again focus on usage levels rather than user numbers.

Integrating with Box in general is free for developers, and up to 25,000 interactions with the Box Content API is free too. For 25,000 or more API interactions the cost is $500 per month. Any more than this and custom deals are available.

Box VP of Platform Chris Yeh explained that this move was designed “specifically for businesses that want to leverage the APIs at scale” to help keep pace with the growth the firm is seeing.

“More than 35,000 developers are building on Box. Every month, our platform sees one billion third-party API calls, and the Box OneCloud ecosystem just reached 1,000 app integration partners,” Yeh said.

The updates come at a busy time for Box after it filed to go public earlier this week in a listing worth $250m, as it looks to build on its early success in the enterprise market.

Source

Intel Buys Into Altera

Technology gossip columns are full of news that Intel and Altera have expanded their relationship. Apparently, Altera has been Intel’s shoulder to cry on as the chip giant seeks to move beyond the declining PC market and the breakup of the Wintel alliance. Intel took the break up very hard and there was talk that Alteria might be just a rebound thing.

Last year Intel announced that it would manufacture Altera’s ARM-based quad-core Stratix 10 processors, as part of its efforts to grow its foundry business to make silicon products for third parties. Now the two vendors are expanding the relationship to include multi-die devices integrating Altera’s field-programmable gate arrays (FPGAs) and systems-on-a-chip (SoCs) with a range of other components, from memory to ASICs to processors.

Multi-die devices can drive down production costs and improve performance and energy efficiency of chips for everything from high-performance servers to communications systems. The multi-die devices will take advantage of the Stratix 10 programmable chips that Intel is manufacturing for Altera with its 14-nanometer Tri-Gate process. Intel’s three-dimensional transistor architecture combined with Altera’s FPGA redundancy technology leads to Altera being able to create a highly dense and energy efficient programmable chip die that can offer better integration of components.

At the same time, Intel officials are looking for ways to make more cash from its manufacturing capabilities, including growing its foundry business by making chips for other vendors. CEO Brian Krzanich and other Intel executives have said they will manufacture third-party chips even if they are based on competing infrastructure, which is the case with Altera and its ARM-based chips.

Source

Microsoft Issues New Policies

Microsoft Corp, under fire for accessing an employee’s private Hotmail account to prove he was illegally passing computer code to a blogger, has said it will now refer all suspicious activity on its email services to law enforcement.

The decision, announced by head lawyer Brad Smith on Friday, reverses Microsoft’s initial reaction to complaints last week, when it laid out a plan to refer such cases to an unidentified former federal judge, and proceed to open a suspect email account only if that person saw evidence to justify it.

“Effective immediately, if we receive information indicating that someone is using our services to traffic in stolen intellectual or physical property from Microsoft, we will not inspect a customer’s private content ourselves,” said Smith, in a blog post on the software company’s website. “Instead, we will refer the matter to law enforcement if further action is required.”

Microsoft – which has recently cast itself as a defender of customer privacy – was harshly criticized last week by civil liberties groups after court documents made public in the prosecution of Alex Kibkalo in Seattle federal court for leaking trade secrets showed that Microsoft had accessed the defendant’s email account before taking the matter to legal authorities.

The company said last week its actions were within its legal rights under the terms of use of its email services, but has now acknowledged that its actions raised concerns about customer privacy.

The issue is poignant for Microsoft, which routinely criticizes Google Inc for serving up ads based on the content of users’ Gmail correspondence.

It has also been campaigning for more transparency in the legal process through which U.S. intelligence agencies can get access to email accounts following the revelations of former National Security Agency contractor Edward Snowden.

“While our own search was clearly within our legal rights, it seems apparent that we should apply a similar principle and rely on formal legal processes for our own investigations involving people who we suspect are stealing from us,” said Smith in his blog. “Therefore, rather than inspect the private content of customers ourselves in these instances, we should turn to law enforcement and their legal procedures.”

Source

Malware Targets Job-seekers

A new version of the Gameover computer Trojan is targeting job hunters and recruiters by attempting to steal log-in credentials for Monster.com and CareerBuilder.com accounts.

Gameover is one of several Trojan programs that are based on the infamous Zeus banking malware, whose source code was leaked on the Internet in 2011. Like Zeus, Gameover can steal log-in credentials and other sensitive information by injecting rogue Web forms into legitimate websites when accessed from infected computers.

The ability to inject content into browsing sessions in real time has traditionally been used by computer Trojans to steal online banking credentials and financial information. However, cybercriminals are increasingly using this technique to compromise other types of accounts as well.

For example, in February, researchers from security firm Adallom found a Zeus variant that stole Salesforce.com log-in credentials and scraped business data from the compromised accounts.

The latest development involves a new Gameover variant that contains a configuration file to target Monster.com accounts, one of the largest employment websites in the world, security researchers from antivirus firm F-Secure said.

“A computer infected with Gameover ZeuS will inject a new ‘Sign In’ button [into the Monster.com sign-in page], but the page looks otherwise identical,” they said.

After the victims authenticate through the rogue Web form the malware injects a second page that asks them to select and answer three security questions out of 18. The answers to these questions expose additional personal information and potentially enable attackers to bypass the identity verification process.

Targeting Monster.com is a new development, but the Gameover malware had already been targeting CareerBuilder.com, another large employment website, for some time.

Recruiters with accounts on employment websites should be wary of irregularities on log-in pages, especially if those accounts are tied to bank accounts and spending budgets, the F-Secure researchers said. “It wouldn’t be a bad idea for sites such as Monster to introduce two factor authentication beyond mere security questions.”

The authors of the Gameover Trojan program have been particularly active recently. In early February researchers from security firm Malcovery Security reported that a new variant of Gameover was being distributed as an encrypted .enc file in order to bypass network-level defenses. Later that month researchers from Sophos detected a Gameover variant with a kernel-level rootkit component that protected its files and processes, making it harder to remove.

Unlike most other Zeus spinoffs, Gameover is also using peer-to-peer technology for command-and-control instead of traditional hosted servers, which improves its resilience to takedown efforts by security researchers.

Source

IT Dissatisfaction Growing

Companies want to reduce spending on IT operations and infrastructure and shift resources to revenue-producing areas, according to two new studies. But businesses leaders and IT executives are also registering higher levels of dissatisfaction with IT as more demands are placed on technology.

The reports, by the Hackett Group and McKinsey & Co., both agree that business executives want IT to do more to improve the bottom line while companies spend less on infrastructure in the process.

The bad news for people who work in IT operations is that large businesses expect to cut IT staff positions by about 2% this year, thanks to automation and outsourcing, according the Hackett’s survey of 160 businesses with revenues above $1 billion.

One path to improved automation will likely be through adoption of software-defined infrastructures, something Bank of America plans to do.

IT budgets will grow by 1.7% this year as IT pivots, increasingly, from a service-providing operation to a revenue-generating one, the Hackett Group said in its study.

IT managers are being told that “you’ve got to grow the business, not just run the business,” said Mark Peacock, an IT transformation practice leader and principal at Hackett.

McKinsey & Co., in its online survey of more than 800 executives — with 345 having a technology focus — also found that executives want less of their budgets to go to infrastructure so more resources can be shifted to analytics and innovation.

The McKinsey survey found that business executives are less likely to say now that IT performs effectively, compared to their views two years ago.

“The IT executives are even more negative,” wrote McKinsey, with only 13% of them saying their IT organizations “are completely or very effective at introducing new technologies faster or more effectively than competitors.” That percentage was down from 22% in 2012.

The negative results “likely reflect the overall rising expectations for corporate IT,” wrote McKinsey.

When asked how to fix IT shortcomings, respondents cited improved business accountability, more funds for priority projects and a higher the level of IT talent, the report said.

The Hackett Group survey didn’t report on dissatisfaction, but it did find that the top goal for IT organizations this year is “to strengthen partnership and goal alignment between IT and the business.”

Source

Virtru Goes Office 365

Virtru has added Microsoft’s Office 365 and Outlook Desktop services to its growing list of compatible email platforms available on its encryption product.

The company, headquartered in Washington, D.C. and launched in January, is targeting people using major email providers who want stronger privacy controls for more secure communication.

The service is designed to be easy to use for end users who may not have the technical gumption to set up PGP (Pretty Good Privacy), a standard for signing and encrypting content.

Virtru is compatible with most major webmail providers, including Google’s Gmail, Yahoo’s Mail and Microsoft’s Outlook webmail, which replaced Hotmail.

Emails sent using Virtru through those services would look like gibberish, providing a greater degree of privacy. Law enforcement or other entities would not be able to read the content unless they could obtain the key.

Virtru uses a browser extension to encrypt email on a person’s computer or mobile device. The content is decrypted after recipients receive a key, which is distributed by Virtru’s centralized key management server.

Although Virtru handles key management, the company is working on a product that would allow that task to be managed on-site for users, as some administrators would be uncomfortable with another entity managing their keys.

Virtru has said it put aside funds to contest government orders such as a National Security Letter or law enforcement request that are not based on a standard of probable cause.

Source

Cisco Goes To The Cloud

Cisco Systems Inc will offer cloud computing services, pledging to spend $1 billion over the next two years to make a foray into a market currently dominated by the world’s biggest online retailer Amazon.com Inc, the Wall Street Journal reported.

Cisco said it will spend the amount to build data centers to help run the new service called Cisco Cloud Services, the Journal reported.

Cisco, which mainly deals in networking hardware, wants to take advantage of companies’ desire to rent computing services rather than buying and maintaining their own machines.

Enterprise hardware spending is dwindling across the globe as companies cope with shrinking budgets, slowing or uncertain economies and a fundamental migration to cloud computing, which reduces demand for equipment by outsourcing data management and computing needs.

“Everybody is realizing the cloud can be a vehicle for achieving better economics (and) lower cost,” the Journal quoted Rob Lloyd, Cisco’s president of development and sales as saying.

“It does not mean that we’re embarking on a strategy to go head-to-head with Amazon.”

Microsoft Corp last year said it was cutting prices for hosting and processing customers’ online data in an aggressive challenge to Amazon’s lead in the growing business of cloud computing.

Cisco could not be immediately reached for comment by Reuters outside regular U.S.business hours.

Source

« Previous Page — Next Page »