In a rare move, Microsoft on Friday said it would be releasing security updates on Tuesday--outside of its monthly patch cycle--for a critical vulnerability in Internet Explorer and a moderate vulnerability in Visual Studio.
The two security bulletins will address one overall issue and are being released separately "to provide the broadest protections possible to customers," Microsoft said in a statement.
The vulnerabilities affect Windows 2000, Windows XP, Vista, Windows Server 2003 and 2008, Internet Explorer 6, 7 and 8, Microsoft Visual Studio .NET 2003, Visual Studio 2005 and 2008 and Visual C++ 2005 and 2008, according to the security bulletin advance notification.
"While we can't go into specifics about the issue prior to release, we can say that the Visual Studio bulletin will address an issue that can affect certain types of applications," the statement said. "The Internet Explorer bulletin will provide defense-in-depth changes to Internet Explorer to help provide additional protections for the issues addressed by the Visual Studio bulletin."
"The Internet Explorer update will also address vulnerabilities rated as critical that are unrelated to the Visual Studio bulletin that were privately and responsibly reported," Microsoft said.
Customers who are current with their security updates are protected from known attacks related to the updates, the company said. The updates will be released through the Microsoft Update, Windows Update, and Windows Server Update services.
A Webcast to address customer questions is scheduled for Tuesday from 1 p.m. PDT to 2 p.m. at this site.
Microsoft typically releases security patches on a monthly basis, the second Tuesday of every month, and did not say why it is making this rare, out-of-cycle release.
CNet.com
Showing posts with label vulnerability. Show all posts
Showing posts with label vulnerability. Show all posts
Saturday, July 25, 2009
Tuesday, July 7, 2009
Internet Users Warned of Serious Computer Security Hole
Microsoft Corp. has taken the rare step of warning about a serious computer security vulnerability it hasn't fixed yet.
The vulnerability disclosed Monday affects Internet Explorer users whose computers run the Windows XP or Windows Server 2003 operating software.
It can allow hackers to remotely take control of victims' machines. The victims don't need to do anything to get infected except visit a Web site that's been hacked.
Security experts say criminals have been attacking the vulnerability for nearly a week. Thousands of sites have been hacked to serve up malicious software that exploits the vulnerability. People are drawn to these sites by clicking a link in spam e-mail.
The so-called ``zero day'' vulnerability disclosed by Microsoft affects a part of its software used to play video. The problem arises from the way the software interacts with Internet Explorer, which opens a hole for hackers to tunnel into.
Microsoft urged vulnerable users to disable the problematic part of its software, which can be done from Microsoft's Web site, while the company works on a ``patch'' _ or software fix _ for the problem.
Microsoft rarely departs from its practice of issuing security updates the second Tuesday of each month. When the Redmond, Washington-based company does issue security reminders at other times, it's because the vulnerabilities are very serious.
A recent example was the emergency patch Microsoft issued in October for a vulnerability that criminals exploited to infect millions of PCs with the Conficker worm. While initially feared as an all-powerful doomsday device, that network of infected machines was eventually used for mundane moneymaking schemes like sending spam and pushing fake antivirus software.
Agencies
The vulnerability disclosed Monday affects Internet Explorer users whose computers run the Windows XP or Windows Server 2003 operating software.
It can allow hackers to remotely take control of victims' machines. The victims don't need to do anything to get infected except visit a Web site that's been hacked.
Security experts say criminals have been attacking the vulnerability for nearly a week. Thousands of sites have been hacked to serve up malicious software that exploits the vulnerability. People are drawn to these sites by clicking a link in spam e-mail.
The so-called ``zero day'' vulnerability disclosed by Microsoft affects a part of its software used to play video. The problem arises from the way the software interacts with Internet Explorer, which opens a hole for hackers to tunnel into.
Microsoft urged vulnerable users to disable the problematic part of its software, which can be done from Microsoft's Web site, while the company works on a ``patch'' _ or software fix _ for the problem.
Microsoft rarely departs from its practice of issuing security updates the second Tuesday of each month. When the Redmond, Washington-based company does issue security reminders at other times, it's because the vulnerabilities are very serious.
A recent example was the emergency patch Microsoft issued in October for a vulnerability that criminals exploited to infect millions of PCs with the Conficker worm. While initially feared as an all-powerful doomsday device, that network of infected machines was eventually used for mundane moneymaking schemes like sending spam and pushing fake antivirus software.
Agencies
Tuesday, April 14, 2009
Is Google showing signs of vulnerability?
With three rounds of layoffs announced since the year began, Google Inc is showing rare signs of vulnerability. As it prepares to deliver first-quarter results on Thursday, investors are anxious to see if the Google machine has any visible cracks, or if the No 1 US Internet search company continues to sidestep the worst of the storm.
"Whenever Internet companies cut costs, people take any cost cutting as a really negative signal," said Sanford Bernstein analyst Jeff Lindsay. But he said Web searches on Google continue to increase, while revenue from paid clicks, people clicking on Google's text-based search ads, appears to be holding up.
"We think they've been cutting costs prudently and sensibly, and it's probably a good indication that they're going to have good margin performance," said Lindsay, who rates Google's stock "outperform." With global economies sputtering, and one recent report forecasting a 5 percent decline in US online advertising spending this year, business conditions for Google and other Internet companies are as bad as they have ever been.
Analysts expect a sequential drop in revenue for the first time in Google's history as a public company. The average forecast, according to Reuters Estimates, is for first-quarter revenue of $5.53 billion, a 3 percent fall quarter over quarter, or a 6.6 percent gain year on year. Still, that is better than Google's rivals.
Yahoo Inc has projected sales falling as much as 16 percent year-over-year in the first quarter. And some analysts expect revenue at Time Warner Inc's AOL unit to slide 19 percent or more in the first quarter from a year ago. Thus Google's stock, which was trading at around $378 on Monday, has risen 23 percent since the eve of its last quarterly earnings report, outperforming the broader market. Google shares trade at 18 times forward earnings versus the 38 times multiple for rival Yahoo.
Shares outperform
Analysts, on average, expect Google to earn $4.20 a share in the first quarter, up about 2 percent from $4.12 in the year-earlier period, according to Reuters Estimates. Roughly 97 percent of Google's revenue comes from advertising. Of that, the vast majority is tied to Google's search-based advertising system.
Because advertisers only pay when a Web surfer clicks on one of Google's search ads, analysts say the ads provide customers with a better return than other forms of advertising such as broadcast radio ads or Internet banner ads. But JP Morgan analyst Imran Khan said in a recent note to investors that the tight credit market could force small businesses, which he reckons accounts for 20 percent of Google's revenue, to cut back on ad spending.
Google does not give financial guidance but Wall Street will be paying close attention to the comments executives make about the economy on Thursday's conference call. Google said in March that it was laying off 200 workers in its sales and marketing groups, following job cuts in its recruiting group and its shuttered broadcast radio advertising business in January and February.
"It is not news that Google is being impacted by the economy. The real question is how much will the economy impact Google from here on out and how long will this recession last," said Cowen & Co analyst James Friedland. "If the ad pie keeps shrinking, eventually Google's ad pie will shrink," said Friedland, who has an outperform rating on Google. While the company ended 2008 with $15.8 billion in cash and short-term securities on its books, investors and analysts are also eager for any updates about how Google plans to use the money.
Agencies
"Whenever Internet companies cut costs, people take any cost cutting as a really negative signal," said Sanford Bernstein analyst Jeff Lindsay. But he said Web searches on Google continue to increase, while revenue from paid clicks, people clicking on Google's text-based search ads, appears to be holding up.
"We think they've been cutting costs prudently and sensibly, and it's probably a good indication that they're going to have good margin performance," said Lindsay, who rates Google's stock "outperform." With global economies sputtering, and one recent report forecasting a 5 percent decline in US online advertising spending this year, business conditions for Google and other Internet companies are as bad as they have ever been.
Analysts expect a sequential drop in revenue for the first time in Google's history as a public company. The average forecast, according to Reuters Estimates, is for first-quarter revenue of $5.53 billion, a 3 percent fall quarter over quarter, or a 6.6 percent gain year on year. Still, that is better than Google's rivals.
Yahoo Inc has projected sales falling as much as 16 percent year-over-year in the first quarter. And some analysts expect revenue at Time Warner Inc's AOL unit to slide 19 percent or more in the first quarter from a year ago. Thus Google's stock, which was trading at around $378 on Monday, has risen 23 percent since the eve of its last quarterly earnings report, outperforming the broader market. Google shares trade at 18 times forward earnings versus the 38 times multiple for rival Yahoo.
Shares outperform
Analysts, on average, expect Google to earn $4.20 a share in the first quarter, up about 2 percent from $4.12 in the year-earlier period, according to Reuters Estimates. Roughly 97 percent of Google's revenue comes from advertising. Of that, the vast majority is tied to Google's search-based advertising system.
Because advertisers only pay when a Web surfer clicks on one of Google's search ads, analysts say the ads provide customers with a better return than other forms of advertising such as broadcast radio ads or Internet banner ads. But JP Morgan analyst Imran Khan said in a recent note to investors that the tight credit market could force small businesses, which he reckons accounts for 20 percent of Google's revenue, to cut back on ad spending.
Google does not give financial guidance but Wall Street will be paying close attention to the comments executives make about the economy on Thursday's conference call. Google said in March that it was laying off 200 workers in its sales and marketing groups, following job cuts in its recruiting group and its shuttered broadcast radio advertising business in January and February.
"It is not news that Google is being impacted by the economy. The real question is how much will the economy impact Google from here on out and how long will this recession last," said Cowen & Co analyst James Friedland. "If the ad pie keeps shrinking, eventually Google's ad pie will shrink," said Friedland, who has an outperform rating on Google. While the company ended 2008 with $15.8 billion in cash and short-term securities on its books, investors and analysts are also eager for any updates about how Google plans to use the money.
Agencies
Thursday, November 27, 2008
Mumbai attacks: Are other cities not vulnerability?
Whatever group lies behind the attacks in Mumbai, security experts say one thing has been made abundantly clear: a massive city can be reduced to mayhem if a group of men is well-enough armed and prepared to die.
Rather than hijacking planes as in September 11, or smuggling delicately wired car bombs into a city, the Mumbai gunmen chose a frontal style of armed assault, killing more than 100 people, wounding around 250 and causing immense panic in a thriving city of 13 million.
Security specialists say the attack was probably months in the planning and appears to have been finely tuned in its execution, but it ultimately relied on only an estimated 25 gunmen lightly armed with assault rifles and hand-grenades.
Their ability to roam around and sustain the attack, while all the while being willing to die in the onslaught, made it all the more difficult to combat and far more drawn out than an instantaneous suicide bomb attack might have been.
"It's virtually impossible to stop 20 guys with guns from attacking anywhere in the world if they are prepared to die," said Sajjan Gohel, an analyst with the Asia-Pacific Foundation, an independent security and intelligence group based in London.
"That is the thing about the fedayeen strategy," he said, using an Arabic term used to describe self-sacrificial gunmen who have operated in Iraq, Kashmir and across the Muslim world.
"It's even more effective than a suicide mission. With a suicide mission, you blow up your explosives and you're gone. With a fedayeen attack, you try to last out as long as possible, killing as many people as possible," he told Reuters.
Nearly 20 hours after the attack began late on Wednesday night, Indian soldiers and the militants were still exchanging gunfire and more than 100 people were trapped inside the Taj Mahal hotel, one of two five-star hotels popular with Western tourists and businessmen that were targeted in the assault.
Indian authorities closed stock, bond and foreign exchange markets, schools were shuttered and panicked foreigners on holiday or on business were desperate to flee, reducing India's business powerhouse to a tense, semi-warzone.
"Men armed with automatic weapons are able to run amok and keep the situation going for much, much longer," Henry Wilkinson, a senior analyst with Janusian Security Risk Management, a London-based consultancy, told Reuters.
"Whether it's intended or not, that creates an extended drama which is all the more terrifying."
AL QAEDA
Given the boldness of the assault, its high-level of planning and the fact that foreigners were specifically targeted, security specialists believe there is likely to have been a degree of inspiration from or link to external groups allied to Al Qaeda, such as the Pakistan-based Lashkar-e-Taiba.
They say the tactics are different from the more common, post-9/11 attacks seen in Iraq and Afghanistan, but still bear similar hallmarks.
"It's very interesting that they didn't go in using car bombs, it was more of a direct armed assault on a city," said Wilkinson. "It's very reminiscent of the attacks in Saudi Arabia in 2003, when the gunmen were going around trying to find Westerners and kill them."
Wilkinson highlighted the fact the Mumbai gunmen appeared to have used only assault rifles and hand-grenades, giving them much more mobility and freeing them up to take hostages.
"I would suggest that using guns and hand-grenades was a deliberate choice... The amount of planning and training they must have done to carry out such an attack is impressive."
Such an assault might be mounted virtually anywhere in the world, he said, making cities in Europe and the United States vulnerable, even if such an outcome remains unlikely.
In London in 2005 four suicide bombers killed 52 people on public transport and brought the city to a standstill.
Both attacks underline just how hard it is for democratic states to protect themselves against such attacks without draconian security measures and powerful intelligence.
"I can't see any reason -- if there is a terrorist group that has the capability... attacks like this in Europe or the United States can't be discounted," he said.
One advantage for Indian authorities and any intelligence services called in to help investigate the Mumbai attacks is that at least nine gunmen are reported to have been seized.
In a suicide bombing, forensics can help investigators establish only so much. In this case, those detained are likely to reveal much more intelligence about who plotted the attack.
"The fact that a few of them have been seized is highly significant," said Wilkinson. "I think a lot more information about these attacks and who was behind them is going to come to light."
Source: Reuters
Rather than hijacking planes as in September 11, or smuggling delicately wired car bombs into a city, the Mumbai gunmen chose a frontal style of armed assault, killing more than 100 people, wounding around 250 and causing immense panic in a thriving city of 13 million.
Security specialists say the attack was probably months in the planning and appears to have been finely tuned in its execution, but it ultimately relied on only an estimated 25 gunmen lightly armed with assault rifles and hand-grenades.
Their ability to roam around and sustain the attack, while all the while being willing to die in the onslaught, made it all the more difficult to combat and far more drawn out than an instantaneous suicide bomb attack might have been.
"It's virtually impossible to stop 20 guys with guns from attacking anywhere in the world if they are prepared to die," said Sajjan Gohel, an analyst with the Asia-Pacific Foundation, an independent security and intelligence group based in London.
"That is the thing about the fedayeen strategy," he said, using an Arabic term used to describe self-sacrificial gunmen who have operated in Iraq, Kashmir and across the Muslim world.
"It's even more effective than a suicide mission. With a suicide mission, you blow up your explosives and you're gone. With a fedayeen attack, you try to last out as long as possible, killing as many people as possible," he told Reuters.
Nearly 20 hours after the attack began late on Wednesday night, Indian soldiers and the militants were still exchanging gunfire and more than 100 people were trapped inside the Taj Mahal hotel, one of two five-star hotels popular with Western tourists and businessmen that were targeted in the assault.
Indian authorities closed stock, bond and foreign exchange markets, schools were shuttered and panicked foreigners on holiday or on business were desperate to flee, reducing India's business powerhouse to a tense, semi-warzone.
"Men armed with automatic weapons are able to run amok and keep the situation going for much, much longer," Henry Wilkinson, a senior analyst with Janusian Security Risk Management, a London-based consultancy, told Reuters.
"Whether it's intended or not, that creates an extended drama which is all the more terrifying."
AL QAEDA
Given the boldness of the assault, its high-level of planning and the fact that foreigners were specifically targeted, security specialists believe there is likely to have been a degree of inspiration from or link to external groups allied to Al Qaeda, such as the Pakistan-based Lashkar-e-Taiba.
They say the tactics are different from the more common, post-9/11 attacks seen in Iraq and Afghanistan, but still bear similar hallmarks.
"It's very interesting that they didn't go in using car bombs, it was more of a direct armed assault on a city," said Wilkinson. "It's very reminiscent of the attacks in Saudi Arabia in 2003, when the gunmen were going around trying to find Westerners and kill them."
Wilkinson highlighted the fact the Mumbai gunmen appeared to have used only assault rifles and hand-grenades, giving them much more mobility and freeing them up to take hostages.
"I would suggest that using guns and hand-grenades was a deliberate choice... The amount of planning and training they must have done to carry out such an attack is impressive."
Such an assault might be mounted virtually anywhere in the world, he said, making cities in Europe and the United States vulnerable, even if such an outcome remains unlikely.
In London in 2005 four suicide bombers killed 52 people on public transport and brought the city to a standstill.
Both attacks underline just how hard it is for democratic states to protect themselves against such attacks without draconian security measures and powerful intelligence.
"I can't see any reason -- if there is a terrorist group that has the capability... attacks like this in Europe or the United States can't be discounted," he said.
One advantage for Indian authorities and any intelligence services called in to help investigate the Mumbai attacks is that at least nine gunmen are reported to have been seized.
In a suicide bombing, forensics can help investigators establish only so much. In this case, those detained are likely to reveal much more intelligence about who plotted the attack.
"The fact that a few of them have been seized is highly significant," said Wilkinson. "I think a lot more information about these attacks and who was behind them is going to come to light."
Source: Reuters
Subscribe to:
Posts (Atom)