Microsoft rushes Explorer 8 patch release

Microsoft's Patch Tuesday for May addresses 10 security issues, three of them that need to be addressed immediately

Just 11 days after issuing an advisory, Microsoft has released a patch for a bug in Internet Explorer 8 that bedeviled the U.S. Department of Labor earlier this month.

Microsoft's speedy release of this patch "is an outstanding example of Microsoft's responsiveness to the security community and their users," wrote Andrew Storms, director of security of operations for security software provider Tripwire, in an email statement.

This IE8 security bulletin (MS13-038) is one of 10 that Microsoft released Tuesday as part of its "Patch Tuesday" release of bug fixes and security bulletins that the company routinely issues on the second Tuesday of each month.

Microsoft marked MS13-038 as critical and the company, along with other security firms, are advising those still running IE8 to apply the fix immediately. Using an altered Labor Department Web page, attackers used this vulnerability in an attempt to install malicious code on any visitor's machine running IE8. Microsoft issued a temporary fix for this vulnerability last week.

The other critical bulletin, MS13-037, also affects Internet Explorer. This update resolves 11 issues that would have made it easy to inject malicious code into the browser from a specially crafted Web page, allowing the user to take control of a computer. The update covers the PWN2Own vulnerability, unearthed earlier this year.

Those running Windows Server 2012 should take an immediate look at MS MS13-039. This update fixes a vulnerability in the Microsoft Web IIS (Internet Information Services) that could be used in a Denial of Service (DoS) attack, through the use of an HTTP packet. Because it would be relatively simple to craft an attack using this vulnerability, organizations should apply this update as soon as possible, because exploits based on this vulnerability might start appearing in as little as a few weeks, according to Tripwire.

Ross Barrett, senior manager of security engineering at the security firm Rapid7, wrote in a statement that "while DoS attacks are generally considered second (or third) tier as far as risk, this could potentially be very disruptive to an organization, since many remote services and Active Directory integrations rely on http.sys," which is the networking subsystem used by IIS.

A "successful exploit of this bug could have serious implications for public Web servers without some kind of inline [intrusion prevention system] in front of them. Essentially, any user could launch a simple attack and the server will essentially be offline," Storms noted. He also noted that any copy of Microsoft Server 2012 -- not just those functioning as Web servers -- could be running IIS, such as a server for Microsoft Exchange or SharePoint.

The seven remaining bulletins -- none critical but all deemed important -- address bugs in Microsoft's Lync, Publisher, Word, Visio, Windows Essentials, .Net, and the Windows kernel.

---

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

Obviously, that should have been the Tab key

Excel power user flags down this passing pilot fish to help with her PC, where she has a spreadsheet open.

"She was trying to copy out information from this spreadsheet someone had sent to her," says fish. "When she pressed Ctrl+C, the spreadsheet flickered a few times, and all the data vanished.

"I replicated it a few times, and then my confused expression turned into an eye roll. I checked the list of macros in the workbook and sure enough, in very professional documented VB script, there was a macro that cleared the worksheet...assigned to Ctrl+C.

"Whoever created that spreadsheet must've thought they had invented the idea of keyboard shortcuts."

---

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

Dell deal on Windows RT, dubious Windows 8 sales numbers

Dell deal on Windows RT, dubious Windows 8 sales numbers

Along with whatever other problems Windows 8 faces, Microsoft partners interested in making machines that show the operating system off to best advantage are handicapped by a short supply of touchscreens, the top Windows executive says.

The company is hoping the problem will be solved in time to make alluring devices in time for Christmas sales, says Tami Reller, chief marketing and financial officer for the Windows division, as quoted in this CITEworld story.

“We see that touch supply is getting so much better,” Reller says. “By the holidays we won’t see the types of restrictions we’ve seen on the ability of our partners and retail partners to get touch in the volume they’d like and that customers are demanding.”

Along with that area a slew of complaints about the Windows 8 user interface, many of which may be addressed by Windows Blue, the code name for the upgrade that is also coming out later this year, likely before the holidays, Reller says.

It’s still unclear what changes Windows Blue will include although rumors say the start button and start page so familiar in earlier versions of Windows will be restored. The specifics of Windows Blue – officially called Windows 8.1 – will be revealed at the Microsoft Build developers’ conference at the end of June, she says.

Although Reller didn’t mention it during her remarks at a JP Morgan tech conference in Boston, by the end of the year Intel’s Haswell chips should be in production offering a longer battery life, higher performance and improved graphic processing for a range of devices such as ultrabooks, convertibles and tablets.

This is a convergence of events that Microsoft no doubt would have welcomed last holiday season just after Windows 8 launched in October.

Windows RT deal
Dell has come out with a Windows RT tablet for $300 - $200 less expensive than the cheapest Microsoft Surface RT.

That’s a limited time offering and is a $150 discount off the regular price for its XPS 10, which sports a 10.1-inch display and, like all Windows RT devices, runs on ARM chips. Another short-term option tosses in a keyboard/dock for an extra $50.

At that price the bundle is still significantly cheaper than an iPad and may grab a few potential Apple customers.

When is 100 million not 100 million?
Microsoft says it’s sold 100 million Windows 8 licenses so far and seems proud of it, but the number is being picked apart by people who note that the number of licenses sold might be far higher than the number in actual use.

According to a story in ComputerWorld the count of machines running Windows 8 could be closer to 59 million.

Why would Microsoft release the higher number but not release the number of machines that have activated the software? The obvious answer: that number is embarrassingly small.

Windows 8 is bad for this business
Buffalo, N.Y. -based Synacor blames Windows 8 for a 16% drop in search-engine advertising revenues for its content-portal services.
Because Windows 8 defaults to Bing as the search engine and sets MSN as the home page, according to this story in the the Buffalo News. Part of Synacor’s business is to set its customers’ advertising pages into the start page of end users’ browsers.

“That hurts Synacor because the company generates revenue every time a subscriber uses the Google search box on the start pages that it designs, while a reduction in page views also hurts Synacor’s advertising sales on those start pages,” the News story says.

The situation has contributed to a 5% drop in revenues for Synacore.

---

Best CCNA Training and CCNA Certification and more Cisco exams log in to examkingdom.com

Microsoft's counter-attack against Windows 8 coverage makes it 'look weak'

Apple-esque communication strategy comes home to roost, argues analyst

Microsoft counter-attacked Friday, calling some media coverage of its plans to update Windows 8 sensationalist and an effort to drive website page views.

One analyst dubbed the missive by Frank Shaw, Microsoft's head of communications, as defensive. "It makes Microsoft look weak," said Patrick Moorhead, principal analyst at Moor Insights & Strategy. "Not everyone is going to be fair, but that's life."

In a Friday post to Microsoft's company blog titled "Staying centered," Shaw took swings at coverage that characterized Microsoft's plans for Windows "Blue" -- this year's update to Windows 8 and the first of what will be annual refreshes of the OS -- as a retreat, and that compared Blue to Coca-Cola's 1985 pull-back from "New Coke."

Shaw singled out stories by The Financial Times and The Economist as examples of what he argued used "sensationalism and hyperbole."

He decried negative coverage of Windows 8 in general, Windows Blue in particular. "Let's pause for a moment and consider the center," Shaw wrote. "In the center, selling 100 million copies of a product is a good thing. In the center, listening to feedback and improving a product is a good thing. Heck, there was even a time when acknowledging that you were listening to feedback and acting on it was considered a good thing.

"Windows 8 is a good product, and it's getting better every day," he maintained.

Windows 8 has been panned by many commentators -- bloggers and analysts -- as well as by the mainstream and technical press, starting even before its October 2012 launch. But Shaw seemed especially upset at the recent reaction to a mini-publicity campaign last week by Tami Reller and Julie Larson-Green, the CFO and head of development for the Windows division, respectively.

Both Reller and Larson-Green touted the upcoming Blue -- without revealing any details of its contents -- as Microsoft's response to customer feedback. "The Windows Blue update is also an opportunity for us to respond to the customer feedback that we've been closely listening to since the launch of Windows 8 and Windows RT," Reller said last Tuesday.

Some outsiders didn't see it that way, and instead interpreted Blue as Microsoft's tacit admission of mistakes and that it would backtrack from the radical "Modern" user interface (UI).

Shaw's rebuttal: "In this world where everyone is a publisher, there is a trend to the extreme -- where those who want to stand out opt for sensationalism and hyperbole over nuanced analysis," he said.

"What Shaw is doing is asking for patience," said Moorhead. "He's trying to set expectations. If people think Blue will be a 'swing you around the room' moment, it will not be that. Microsoft doesn't want people to get their expectations raised, and then have another cycle of maligning Windows 8."

But Moorhead also saw Microsoft's predicament as largely self-inflicted, the result of its communications choices coming home to roost.

"This is the result of a sub-optimal communications strategy that goes all the way back to Windows 7," Moorhead said. "Prior to Windows 7, Microsoft had a much more collaborative communication strategy with the press and analysts. But they saw Apple get traction with a much more closed approach, and opted for Apple's strategy. They started to create a more challenging relationship with analysts and the press."

But Microsoft, Moorhead said, is no Apple. "Microsoft doesn't make a good Apple," he said, repeating an argument he used last week, when he pointed out that Microsoft has a much larger ecosystem than Apple, with thousands of hardware partners, herds of resellers, a bigger pool of developers and both enterprise and consumer customers to keep in the loop.

What works for Apple, in other words, is not necessarily what works for Microsoft.

"Microsoft needs to return to their earlier Windows communications strategy," said Moorhead. "They were one of the biggest technology companies that pioneered social media, they were once very collaborative with the press."

But the world's changed since Windows 7, when Stephen Sinofsky took over as head of Windows development and brought the more secretive, closed communications approach he'd used when he ran Office development, to the OS group. Sinofsky was ousted from Microsoft last fall.

"It is an echo chamber," Moorhead acknowledged. "Users, bloggers and the press all have opinions they can easily express. But because Microsoft isn't as close to analysts and the press as they used to be, maybe the result [of last week's blitz about Blue] was a lot different, and more negative, than Microsoft expected."

Other analysts have also noted the changes in how Microsoft interacts with outsiders, including themselves, the press, OEMs and developers. How and what it communicated to OEMs and developers -- and when -- negatively affected Windows 8, they believe.

"The lack of high-quality apps is a direct result of their secrecy," said Michael Cherry of Directions on Microsoft, who knocked the Redmond, Wash. firm for not providing tools, documentation and testing systems far enough in advance of the launch, or getting OEMs on board with innovative designs for the operating system's 2012 debut.

"This wasn't the sole reason for Windows 8's problems," said Cherry, "but it is the price you pay for being secretive."

Microsoft sounds frustrated, Moorhead observed, that its broader business isn't put into perspective, but that outsiders are focused on the Windows division, which contributed 28% of the company's total revenue in the first quarter. The Business group, whose biggest money maker is Office, accounted for 31% in that same period.

---

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

Facebook Home attracts close to 1 million downloads

The Android app has been available for about a month

Facebook has attracted "just about" 1 million downloads of its Home application in its first month of availability.

The app, which takes the place of the home screen on supported devices, puts Facebook much more at the center of the phone. Rather than an app launch or home screen appearing when a phone is woken from sleep, the user sees the Facebook Home screen and pictures and updates from their friends.

"That's very much in line with our expectations for the launch," said Cory Ondrejka, director of mobile engineering at Facebook, during a briefing for reporters. "We thought that was a large enough number to start getting data."

The users are typically early adopters who have specifically searched the Android Play Store to find the app, said the company. Facebook isn't currently using its main app to promote Home, but word has spread via the social network.

Putting Facebook updates in front of users has led to a 25 percent increase in the amount of time they spend using Facebook, Ondrejka said.

"Facebook is already the most-used app on mobile devices, so being able to bump that is something we are very excited about," he said.

A new version of Facebook Home will launch Thursday, along with the latest version of the Facebook app.

The latest version of the software addresses bugs, but Facebook is working on subsequent versions that will address feedback and complaints from those first million users. They include a new way to launch non-Facebook apps and an easier way to initiate chats.

The complaints about the app launcher were mostly related to the way it reorganized apps. If users had spent time organizing and curating their home screen, the Home app changed that.

"Any launcher that juggled apps would get this feedback," said Ondrejka. "Since I've spent time curating my apps, I don't want Facebook to move them around."

A new version of the app launcher, previewed on Thursday but due in a future update, looks much more like the traditional Android home screen.

One of the more subtle changes coming with Thursday's update is in the way the app handles loading on phones that aren't supported.

Users of unsupported devices still won't be able to download and install the app from the Android Play Store, but updates will be available to users who have installed it through a process called sideloading.

Sideloading involves getting a copy of the software from a phone that is supported and manually loading it onto an unsupported device. A software block would try to prevent that, leading users to hack the software to force it on the phone. A side effect of that is the inability to get updates.

With the latest version, users will get an alert that tells them their handset isn't supported but the manual hack to the software won't be required.

Facebook puts the number of those who have downloaded the app onto unsupported devices at "over 10,000" people, which is more than 1 percent of the current user base.

Support is not imminent for additional handsets.

"We're working on it now. We're excited about a couple of the new phones that are out there," said Adam Mosseri, product director at Facebook. "It will be months."

---

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

Windows 8 Update: Gates: Windows 8 is about the iPad

Also, a Windows 8 tablet for less than $400 is a natural for BYOD

Windows 8 is Microsoft's best effort to catch up with Apple and grab tablet sales away from the iPad by including things iPads just don't have, according to Microsoft founder Bill Gates.

These things include keyboards and Microsoft Office, Gates says in an interview with CNBC. "With Windows 8 Microsoft is trying to gain share in what has been dominated by the iPad-type device," Gates says.

He says Windows 8 was designed to wrap PCs into a tablet form, as exemplified by Microsoft's own Windows 8 hardware Surface PRO and Surface RT.

"So if you have Surface, Surface PRO you've got that portability of the tablet but richness -- in terms of the keyboard, Microsoft Office -- of a PC," he says. "So as you say PCs are a big market. It's going to be harder and harder to distinguish products whether they're tablets or PCs."

Microsoft sees customers are unsatisfied by limitations of pure tablets with touchscreens and no support for Office. "A lot of those users are frustrated," Gates says. "They can't type, they can't create documents, they don't have Office there so we're providing something with the benefits they've seen that have made [tablets] a big category but without giving up what they expect in a PC."
Small, cheap Acer tablet

A product listing for a rumored Acer mini tablet popped up briefly on Amazon.com last week for the surprisingly low price of $379.99 before the item was taken down.

But the specifications listed for the device indicate that it can support a full-blown PC version of Windows 8 on an 8.1-inch tablet.

The low price makes them attractive to consumers and increases the possibility that Windows 8 devices will become a factor in BYOD programs. At the same time these small tablets become more attractive to businesses because they can support all legacy applications that run on Windows 7 including the full version of Microsoft Office.

A separate version of Windows 8 -- Windows RT -- is designed for tablets that are based on ARM processors, but they only run Windows Store applications and a truncated version of Office. Windows RT devices also can't join domains.

The Acer product in question is the W3-810-1600, pictured below in a photo that was posted two weeks ago by the French website minimachines.net but taken down at Acer's request.

The screen resolution is 1280x800 pixels is the low end of minimum requirements for Windows 8 devices set by Microsoft, according to specifications posted by The Verge.

While it's OK to build devices to that spec, it's not without ramifications. The devices can't support snap screens, which is a feature that displays two applications at once -- one small and one large -- and to reverse which one is bigger with a simple touchscreen swipe.

---

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

Companies explore self-detonating data as security control

Self-detonating data would put expiration dates on sensitive documents

The popular Snapchat photo-messaging app used mainly by Android and iOS mobile device owners to share images that then self-destruct after 10 seconds is the sort of security idea that businesses say can help them secure online transactions with business partners.

“It puts controls on what people see, and I can put expiration dates on sensitive documents,” says Marc McDonald, owner of Chicago-based Midland Metal Products that a few months ago started using the software-as-a-service called VIA from Intralinks Holdings that now lets the maker of store fixtures share computer-aided design files for custom manufacturing with business partners. Midland Metal Products restricts download of sensitive information and also sets a time for the files to self-destruct. McDonald says the password-controlled VIA option is simpler and has more security controls than the Dropbox option he’d previously used.

While Intralinks sometimes casually refers to the collaboration service, which is priced at $25 per user per month as a “Snapchat for the enterprise,” it’s not related to the real Snapchat, which was launched in September 2011 by Stanford students Evan Spiegel and Bobby Murphy as a way to share “impermanent photos” taken on mobile devices through their Snapchat app.
We've been getting a lot of inquires about Snapchat apps."
— Jason Novak, assistant director of digital forensics, Stroz Friedberg

After a short period of time, each Snapchat image is said to be deleted from the devices and the Snapchat servers. The still-evolving Snapchat service, which has started to receive venture-capital funding, is proving popular with teens and young adults that now send millions of Snapchat photos and videos each day. Snapchat is also starting to be noticed in business circles in connection with questions about whether unauthorized photos and images of sensitive business information are being sent via mobile devices.

“We’ve been getting a lot of inquires about Snapchat apps,” says Jason Novak, assistant director of digital forensics at Stroz Friedberg, the New York-based firm which focuses on cybercrime issues and providing digital evidence that will stand up in court, if need be.
One big question is whether Snapchat does leave any trail of evidence of use on a mobile device. Stroz Friedberg says its forensics analysis can detect a trail of use of Snapchat for the Apple iPhone, though not evidence of specifically what photos or videos were sent. It hasn’t yet completed forensics for Snapchat on an Android device.

In its digital forensics tests it did with Snapchat for the iPhone, Stroz Friedberg found Snapchat maintains what’s called the user.plist file which is not encrypted. The file is a way to identify, preserve and analyze that the user of the iPhone did send something to a recipient via Snapchat. Novak says it’s possible to clear the Snapchat plist file on the device if the user knows how.

He points out that other Snapchat-like services oriented toward mobile have sprung up -- such as Facebook’s Poke, as well as Wickr and Silent Circle which take advantage of encryption as well. These type of services are presenting digital forensics with new challenges, Novak notes. Mobile devices such as smartphones and tablets that use these type of services remains a new and evolving field beyond traditional computer-based forensics which is now more automated.

---

Best CCNA Training and CCNA Certification and more Cisco exams log in to examkingdom.com