Tech Thursday (1/17): Nimble & HootSuite * Dell Tablet * dlvr.it * and more

Nimble & HootSuite Announce Integration to Close the Loop on Social Selling & Customer Engagement

Total Merchant Services Acquires Fanminder

Dell Unveils New Latitude 10 Essentials Configuration for Unbeatable Tablet Value

dlvr.it Now Supports Posts To Google+

Nimble & HootSuite Announce Integration to Close the Loop on Social Selling & Customer Engagement

Providing crucial Context to Business Contacts by tying social media activity to lead generation, sales efforts and customer retention

Santa Monica, CA - Nimble, the pioneer of social relationship management now integrates with HootSuite, makers of the market-leading social media management system. Now users can connect social media best practices to Social CRM capabilities, such as identifying, connecting and nurturing prospects; businesses can finally “close the loop” on social selling and customer engagement.

The Nimble app for HootSuite enables users to transform limited social profiles into complete contact records with conversation history and context. It provides sales teams and business professionals with the contact management, sales and social business capabilities they need to turn prospects into customers, and measure the effectiveness of social activities.

The Nimble app for HootSuite allows users to view contact information, such as additional social profiles, phone number, email, bio, location and date of last contact in the HootSuite dashboard. With a simple mouse click, users can jump directly from HootSuite to the Nimble contact record and manage deeper contact details, such as viewing a complete conversation history, scheduling follow up tasks and events, logging notes, and forecasting sales.

The Nimble app for HootSuite is now available free to HootSuite and Nimble users.

Total Merchant Services Acquires Fanminder

Purchase Underscores Company’s Commitment to Help Merchants Grow and Manage Their Businesses

BASALT, Colorado -  Total Merchant Services announced today the purchase of California-based Fanminder. The acquisition adds a social, mobile marketing tool to Total’s existing portfolio of innovative payment solutions. Fanminder will immediately provide Total’s entire base of small to mid-sized merchants with enhanced social media, email and text messaging abilitiesâ€"that help stimulate sales via personal interaction with their customers and prospects.

“Merchants are demanding more, and our industry can no longer strictly sell on price and service. ISO’s and Sales Agents need to forge partnerships with a company that helps businesses manage and grow their top and bottom lines,” said Joe Kaplan, CEO, Total Merchant Services. “The acquisition of Fanminder helps accelerate our business strategy and competitive advantage. Now our sales partners can provide merchants with strategies for driving social media promotions to help grow their businesses. This results in more meaningful customer engagements through digital offers, quickly distributed through social media networks and mobile devices.”

Fanminder is a multi-channel, mobile marketing platform that enables business owners to easily design and publish everyday promotional offers to Facebook, Twitter, SMS, email and even their own websites. The platform provides simple-to-follow templates, eliminating the need and expense for a professional graphic designer. Customers redeem promotions at the store of origin and all redemptions are tracked in a dashboard, “closing the loop” for the business owner and helping them grow sales. The company is adding more than 1,000 small business customers per month and is used by 10,000
small businesses ranging from clothing boutiques to pet shops, and casual restaurants.

Dell Unveils New Latitude 10 Essentials Configuration for Unbeatable Tablet Value

New Dell Latitude 10 offers the first full-featured, enterprise-ready Windows 8 tablet experience at a price below $500 (US)

Expanding upon the success of the Latitude 10 standard configuration launched in October 2012, Dell today announced the Latitude 10 essentials configuration to offer a secure, manageable and durable
enterprise-ready tablet option to budget-conscious customers. Ideal for organizations such as schools and small businesses, the new configuration offers outstanding value with essential productivity and collaboration features and a full-featured Windows 8 tablet experience. The new Latitude 10 offers consumer customers rich entertainment features for movies, books and games, as well as compatibility with familiar applications and accessories to transition seamlessly between work and play.

As with the other Latitude 10 configurations, the new tablet is framed in magnesium alloy and covered with soft-touch paint for enhanced durability and a good grip. Corning® Gorilla® Glass delivers a responsive touch experience and vivid graphics display and stands up to the test of busy and active users. The Latitude 10 powers through typical school or work day and with optional Dell ProSupport™, an expert engineer is available 24/7 online or by phone for unexpected hardware and software remote troubleshooting to keep end-users productive no matter where they are.

The Latitude 10 is available with an optional productivity dock for in-office productivity with a traditional keyboard and mouse for desktop content creation activities. The full-size USB port provides connectivity to existing equipment and SD card reader enables easy file transfer plus back-up when Internet access is not feasible.

The Latitude 10 essentials configuration 64 GB is available today starting at $579 (US) and the32 GB will be available in the coming months at $499 (US).

dlvr.it Now Supports Posts To Google+

Starting today dlvr.it users can now post content to Google+ Pages.

In addition to posting social content to Google+, dlvr.it  users can also monitor and manage comments, track +1’s, and measure the interactions and growth trends of their Google+ audience.

Posting to Google+ has been one of the most popular requests from our 300,000+ users. And dlvr.it is thrilled to be among the early Google+ Page Management API partners.

Due to Google’s usage concerns, Google+ features are initially available to our Pro and Ultimate Users. Further, because of the fluid nature of the APIs, dlvr.it’s Google+ features are subject to change. We heard your urgent requests for Google+ support, and made this initial set of Google+ features available as quickly as possible. We look forward to your feedback.

Start delivering your content to Google+ today!

NYC Events: Upcoming NYC Business and Technology Events

As a new feature of Smallbiztechnology.com, we will be sharing upcoming New York City Business and Technology Events that we feel will help small businesses grow their business.

Below is a listing of NYC events for the upcoming week.

Sales and Marketing Clinic: Get More Sales and Loyal Customers

January 17th, 6pm - 8:30pm @ Alley NYC, 500 7th Avenue (17th Floor) New York, NY 10018 (Between 37th  and 38th Streets)

In this 2.5 hour clinic, join Ramon Ray,Infusionsoft’s sales & marketing evangelist as he teaches you Lifecycle Marketing.

The Journey To Success Entrepreneurial Expo

January 19th, 9am - 2pm @ McGinley Center Ballroom, Fordham University, 441 East Fordham Rd., Bronx, NY 10458

The “Journey to Success” entrepreneurial expo series was created by TheNetWorks Organization. The goal is to inspire people to earn income independently, provide them with ideas and opportunities, and help support them on their journey. The expo will include a presentation with guest speakers, time to visit exhibitor tables, and breakout sessions.

 Storytelling: Making Business Presentations Come Alive

January 20th, 1pm - 4pm @ GA New York City (West), 10 East 21st Street, 4th Floor, New York, NY 10010

Over three exciting hours, our Storytelling workshop will show you how to structure disparate and complex business information, and then turn that information into a logical, compelling narrative, to cater for every audience, from CEOs to VCs to your colleague next door.

We Connect You - ‘How To Date Your Leads and Marry Your Customers’ 

January 23rd, 6:45pm - 9pm @ Wander Inn, 2880 Grand Avenue, Baldwin, NY 11510

We Connect, a business development group dedicated to nurturing relationships, growing business and charitable giving, is hosting this session presented by Ramon Ray, Regional Director of Development at Infusionsoft, as he teaches you what Lifecycle Marketing is and how you can use it to turn leads into customers.

Use Video Marketing To Build Your Brand, Boost Sales and Engage Customers

January 24th, 8am - 10:30am @ Alley NYC, 500 7th Avenue (17th Floor) New York, NY 10018 (Between 37th  and 38th Streets)

Join Ramon Ray Infusionsoft’s sales & marketing evangelist and Robert Weiss of  MultiVisionDigital as they share with you the “secrets” of how to use online video to generate more sales for your business.

Sales and Marketing Clinic: Get More Sales and Loyal Customers

January 24th, 6pm - 8:30pm @ Alley NYC, 500 7th Avenue (17th Floor) New York, NY 10018 (Between 37th  and 38th Streets)

In this 2.5 hour clinic, join Ramon Ray,Infusionsoft’s sales & marketing evangelist as he teaches you Lifecycle Marketing.

If you are interested in having your local NYC Business or Technology event appear in our weekly post, please email event details to eve...@smallbiztechnology.com.

Improve Customer Service and Save Money With A Virtual Call Center

Some of the biggest companies in the world like American Express and CitiGroup are known for the exceptional customer service they provide. If you were to study the strategies of these brands, then you could see how much importance they place on customer relationship management, or what the industry calls, CRM. In short, these big enterprises know exactly how to make their customers feel special. They do so by running a tight ship at their backend offices all around the globe. Small businesses, however, cannot afford such luxuries. But does that mean their customers are not special to them Not at all - the trick lies in knowing what tools to use to achieve the performance levels of big enterprises’ customer service without doling out massive amounts of cash. One such tool is the virtual call center.

As small businesses do not have the manpower, budget or the reach which bigger companies exert, the tools they use should ideally work around those limitations while still providing the most needed benefits to get the job done. In order to manage the customer queries in the most professional manner the virtual call center tool should:

• let agents attend to queries from any possible location
• allow call queuing in case the number of callers at any point of time exceeds the number of agents available for work
• be a cloud based setup so as to avoid the extra expenditure that hardware based call centers incur.

The setup should also be such that it can handle both inbound and outbound call traffic, as having different centers is not really financially feasible for most small businesses.

With a cloud based setup, it is possible for call agents to pull up customer case histories or attributes on a customer, which gives further insight to the customer and allows the agent to handle the call better. More importantly, this also shortens the call duration, which in turn saves valuable money. When the customers find that they do not have to repeat their words, this reflects positively on the brand. With an effective IVR system in place, a virtual call center also lets the customer to stay on the queue and be serviced in the correct of preference. This is the sort of professionalism which ideally only bigger companies have managed to show so far.

Ringio call center is a solid solution for a cloud based virtual call center. Installation can be taken care of in a matter of minutes and the network between all locations is very seamless. As it uses a very powerful IVR set-up, it also prevents a lot of redundancy by making sure the right calls are handled by the right people. With the live call monitoring option, small businesses can also ensure that their CRM performance is up to the quality standards of larger companies.

Ringio supports virtual PBX and it also allows for call filtering. This means that if agents chose, they can route works calls onto their smartphones and handle business out of work hours too. These are some things small businesses do to ensure that they are always ahead of the curve and one step ahead of the competition. For those starting up a new business, they could give Ringio a try and take a progressive step towards bettering the customers’ experience with the brand. Ringio Call Center is very reasonably priced for $49 a user per month.

How One Small Business Used SAAS To Bridge A Generational Gap and Increase Productivity

The workplace, they say, is defined not just by the kind of work that’s been done but also by the people who work there day in and day out. What about the success of the business Does it depend on the kind of people actually working on the floor By “kind” I do not imply the generic “hard working” or “lazy” dichotomy but more like the divisions that are created by absolutes, like age and experience. A company with more workers in the age group of forty five and above than one where the median age is twenty seven - how do they compare A business textbook might tell you that these people are just “resources” or “employee IDs” but a seasoned or creative leader will beg to differ. It is true - age does create a difference; generation gap is not a myth. The key is to integrate both sides of the age gap under oe banner and heighten productivity. Let us see how modern SaaS (software as a service) tools can help achieve that.

There have been many debates and discussions regarding the differences between ‘Baby Boomers’, ‘Traditionalists, ‘Generation Y’ and so forth in the work environment, but from a business perspective, the main area of contention is how they each react to new technology.  The use of new technology at the work place is a natural progression. Take the example of memos on post it notes and their eventual demise at the hands of group emails. Not only does it save time, but it also makes for easy two-way communication. Now imagine the same kind of technological leap at a slightly larger scale. Bigger organizations frequently use in-house tools to keep frequent two-way communication running. Smaller companies often find that they do not have the budget to do the same. So how do they get out of this fix

Let’s look at Industrial Mold and Machine, an Ohio-based company, develops customized materials for businesses, such as pill bottles and hardware pieces. In 2010, the family-owned company
with only thirty five employees, where people not on the manufacturing floor are the only ones using computers, decided to increase productivity by introducing computer kiosks on the production floor in which the workers had to make entries about their progress, their targets and their objectives. Without a good Saas model in place, this noble idea merely turned into a hindrance for the workforce. The shift from paperwork to computer work was not easy. It was then that Socialtext, a company based in Silicon Valley that builds enterprise social software for various workplaces around the globe, was called in.

Before we delve into how Socialtext rescued Industrial Mold and Machine, let us try to understand the importance and value of enterprise social software, especially with small businesses in mind. Companies like MindTouch, PBWorks and Socialtext build special software suites for companies so that they can use new web based technologies to reduce redundancy, increase productivity and lessen the pressure on the physical labor force. They do so by integrating tools like microblogging, social media, online group platforms, open source widgets and the willingness of employees to learn new things. The last bit is especially true for those who believe that business can still be conducted in strictly traditional ways in this day and age.

By introducing the workforce to these Web 2.0 tools, smaller businesses can benefit the most, as even a minor drop in redundancy for these companies can equate to a vast growth in productivity. Moreover, when older people at the workplace make an effort to understand these tools, it resonates well with the younger folk. The divisive stereotype of the old not being good with modern technology and the young not being able to survive without it is quickly erased when the staff in its entirety makes collective progress. This is exactly what transpired at Industrial Mold and Machine.  In just one year, the company cut 40% of labor hours and increased production by 20%. By leveraging mobile technologies, the company enhanced communication processes for faster delivery of products, allowing for the company to take on 30% more business. It was also beneficial as the company attracted new talent, including a number of new employees under the age of 30, who leveraged Socialtext to quickly learn the ropes fro company experts.

The key to increased productivity in both big and small offices is the happiness of the workforce. When web 2.0 technology using SaaS tools can make the work easier and faster for everyone, it is in their best interest to embrace these services. After all, even famous companies like Google, Facebook and Twitter also use these among their staff. The productivity of these companies is super high only because the people that work there are generally happy.

Businesses overconfident about cyber security, says Deloitte

Businesses are overconfident about cyber security and should treat data security breaches as inevitable, says business advisory firm Deloitte.

A new study shows that 88% of companies in technology, media and telecommunications (TMT) do not think they are vulnerable to an external cyber threat.

Although 68% of companies said they understood their cyber risks and 62% said they had a programme in place to address them, 59% experienced a security breach, according to Deloitte's sixth annual Global TMT Security Study.

With over half of those polled aware of security breaches in the past year, Deloitte said companies should invest significant time and effort in detection and response planning.

Despite the importance of disaster recovery, only half of companies have this planning in place, the study revealed.  

“Cyber attacks are now so sophisticated and commonplace that it is impossible to be fully protected,” said James Alexander, lead partner for TMT security at Deloitte.

“Companies need to have a documented response plan in place so they can react when breaches occur. Unfortunately, not enough companies are doing this so we think companies are being overconfident in their resilience,” he said.  

Employee mistakes is top threat 

Companies rated mistakes by their employees as a top threat, with 70% highlighting a lack of security awareness as a vulnerability. Yet only 48% offer general security-related training.

It is important that employees are aware of their responsibilities in keeping data security, said Deloitte, particularly with personal smartphones and other devices entering the workplace.

The intermingling of access to business data and use of personal software applications in one device makes mobile devices a prime target for hackers and provides new entry points for attack, Deloitte said.

The study showed that only 52% of companies polled had a bring-your-own-device (BYOD) policy in place, although 74% of respondents considered the increased use of mobile devices as a vulnerability.

The studied showed that a major concern for respondents was the security of the businesses they work with as organisations become more reliant on third parties.

Some 74% of respondents said they were worried about third party breaches. Deloitte said it is important that organisations work with third parties to understand and improve security practices.

While 55% of organisations are improving their knowledge of cyber crime, only 39% are gathering information about attacks specifically targeted at their organisation, industry, brand, or customers.

A security strategy and roadmap topped the list of priorities, implying that TMT organisations now recognise that being secure is smart business, not just a regulatory requirement, said Deloitte.

Alexander said companies should aim to embed a culture of cyber security in their staff, and this should extend to the businesses that companies work with ensure strength across organisational boundaries.

“This is easier said than done, but each employee holds the keys to the castle and must understand that responsibility,” he said.

By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy

Will TurkTrust incident raise certificate use to Chrome standard

The discovery of a site that was using a fraudulent certificate, announced in a Google blog post last week, has subsequently resulted in the revocation of trust in Turkish certificate authority TurkTrust by most major browsers (Apple's Safari is the outlier at this time). Questions remain about whether the events surrounding improperly issued certifications were entirely accidental, or whether one Turkish government agency used a rogue "*.google.com" certification as part of an attempt to monitor employee Internet use.

But perhaps more important where future abuse of SSL certificates is concerned, the incident also suggests the Chrome browser is arguably more adept than the rest of the browser field in detecting inappropriately issued certificates.

Currently, security for most typical uses of the Internet rests squarely on the site certificate and certificate authority (CA) system. The existence of a properly signed (but fraudulently issued) "*.google.com" site certificate is cause for alarm because it enables fraudulent versions of Google's widely used search and Gmail services to create secure connections with unknowing users. The victimized user will not receive any indication that the supposedly secure connection isn't secure. The potential for damage, at least in theory, is broad.

The existence of a rogue intermediate certificate allows any malicious user with that certificate to create certificates that lend legitimacy to any forged site or, more commonly, enable man-in-the-middle attacks that intercept encrypted communications between the victim and the legitimate site they sought to use.

As Robert David Graham, CEO and founder of Atlanta-based Errata Security explained, "What matters is that if any CA screws up, everyone's SSL can be eavesdropped on. It doesn't matter that they are a Turkish CA."

An initial report by Google suggested that the Turkish CA breakdown was most likely a series of unintentional missteps by TurkTrust, but subsequent reporting by Reuters suggested something more deceptive might have been in play.

Reuters reported this past Thursday that "an agency of the Turkish government deployed a deceptive version of some Google webpages, possibly to monitor activity by its employees."

The agency that carried out the alleged eavesdropping was EGO, an Ankara public transit agency. According to a Google Online Security Blog post, "Late on December 24, Chrome detected and blocked an unauthorized digital certificate for the '*.google.com' domain. We investigated immediately and found the certificate was issued by an intermediate certificate authority linking back to TurkTrust … " EGO was presumably that intermediate certificate authority, though the blog post continued to say that TurkTrust claimed they had mistakenly issued two intermediate CA certificates to organizations that should have received regular SSL certificates. The second organization for which a certificate was issued was not named.

In an ongoing Google Groups discussion, a spokesperson from TurkTrust maintained that the issuance of the rogue certification deployed at EGO was the result of solving an internal monitoring glitch with a certificate that they didn't understand was a CA certification. EGO, TurkTrust said, "had first tried to use the internal CA on the firewall. The internal clients (obviously) had given [a]trust warning, so they had decided to export the trusted cert on the webmail server. They should, of course, have chosen to install trust for the internal CA into their clients in the domain."

Google became aware of the rogue certificate at EGO because someone within the organization's network used the Chrome browser to access a Google site. Chrome now employs a mechanism that notes which certificate was previously used to access the site in question. Chrome reports back to its parent company when a certificate not sanctioned by Google is used for the google.com domain.

As of Chromium 13, Gmail connections automatically use HTTPS (even if the user uses only HTTP) and "only a very small subset of CAs have the authority to vouch for Gmail (and the Google Accounts login page). This can protect against recent incidents where a CA has its authority abused, and generally protects against the proliferation of signing authority," a Google security document explained.

At present, no other major browser offers these protections. Robert David Graham said the TurkTrust incident suggested that more changes like these are needed. "The biggest [change] is for systems to remember the previous certificate used for a site, then notify users when it changes. That's essentially how Chrome detected the problem."

Internet Explorer zero-day exploit overshadows light Patch Tuesday fixes

Internet Explorer cast a shadow over Microsoft's Patch Tuesday this week, as a fix for an IE zero-day exploit missed this month's release.

Microsoft posted a workaround to avoid the issue for the versions affected: Internet Explorer (IE) 6, IE 7 and IE 8. However, the workaround will crash the browser if it encounters the zero-day exploit while it is in-process, said Wolfgang Kandek, CTO of Qualys Inc., an IT services firm based in Redwood Shores, Calif.

Coupled with reports that the Fix it tool Microsoft released may itself be prone to failure, experts speculated that Microsoft may have to release an out-of-band patch to address the issue.

The Internet Explorer zero-day exploit could result in remote code execution if a user visits a maliciously crafted website.

Admins might expect to see an out-of-cycle update, if at all, next week at the earliest and two weeks from now at the latest, said Jason Miller, a member of the Patch Patrol Team at Roseville, Minn.-based Shavlik Technologies LLC.

January 2013 Path Tuesday: XML and printer spooling fixes

There are two critical bulletins fixed in the January 2013 Patch Tuesday updates. Microsoft's XML implementation is vulnerable to a remote code execution attack in almost every version of Windows, which includes Windows 8 and Windows Server installations.

This means systems could be targeted in a "drive-by" attack, Miller said, in that any number of applications using XML Core Services are also at risk.

The other critical bulletin dealt with Print Spooler components in Windows 7 and Windows Server 2008 R2. Despite being rated "critical", Kandek said the bulletin is of lesser importance than the XML bulletin.

"If people have good security practices, their printers will not be online," said Amol Sarwate, director of Qualys' Vulnerability Labs. Many effects of the spooling flaw can be avoided if the printer is on an office network and not online.

SCOM 2007 SP 1 admins: Expect delays

Admins who run Microsoft Service Center 2007 SP 1 should keep an eye on the bulletin for System Center Operations Manager. While a fix is in the works from Microsoft, it wasn't included with the other fixes released in Tuesday's updates.

The company is likely testing and trying to find the proper delivery mechanism for the update, Miller said.

Those with System Center Operations Manager 2007 R2 will have access to the update, but only from the download center.

Dell SecureWorks adds vulnerability management services for cloud

Dell SecureWorks announced new add-ons for its cloud security suite this week, including vulnerability management services and Web application scanning services. According to Dell, the new products were designed specifically for cloud environments, and can be integrated directly with the customer's virtual data center.

The vulnerability management service includes regularly scheduled and on-demand vulnerability scans on customer cloud services and applications by Dell SecureWorks personnel. The Web application scanning service provides the same scans for customer Web applications, including those that reside behind login pages.

Ed Ferrara, principal analyst with Cambridge, Mass.-based Forrester Research Inc., believes the Dell SecureWorks announcement "highlights the accelerating shift of security delivered to and from the cloud. As companies embrace the cloud, the ability to secure these infrastructures becomes more critical."

In addition to these new products, Dell SecureWorks is making its Global Threat Intelligence Service available to cloud customers too, with all Threat Intelligence reports and analysis accessible via the Dell SecureWorks Portal. Dell stated that cloud customers can expect announcements for more security services in the coming months.

Brief: Microsoft out-of-band patch addresses IE zero-day

Microsoft will release later today an out-of-band patch for the critical Internet Explorer zero-day exploit that surfaced this past Christmas Eve. The attack uses a flaw in memory management present in versions 6 through 8 of the browser that enables drive-by remote-execution exploits.

Microsoft issued a "Fix-It" workaround during the first week of this year, but did not issue a full patch of the problem in last week's regularly scheduled Patch Tuesday update.

Microsoft will also offer a webcast today to provide further information about the patch and the scope of the underlying vulnerability.

Thirteen principles to ensure enterprise system security

Long ago in a galaxy far away, two Jedi Knights by the names of Jerry Saltzer and Michael Schroeder published a paper titled "The Protection of Information in Computer Systems (PDF)."  Section three of that paper is a quick treatment of some essential design principles for information security.  To say that "Saltzer and Schroeder," as it has come to be known, was a seminal work in security is an understatement; everything they had to say back in 1975 is relevant today, nearly 40 years later.

\'Cool\' exploit kit said to be developed by team behind Blackhole with £6,000 price tag

A new exploit kit called the ‘Cool Exploit Kit' has been spotted with a rising number of detections over the past few months.

Said to be similar to the notorious Blackhole exploit kit but with a price tag ten times that - the Cool kit comes with a price tag of £6,000 a month, while Blackhole and other exploit kits can run anywhere from £300 to £934 a month - it comes with major investment into new exploits that will be used exclusively by Cool and not made public.

According to research by Blue Coat and security blogger Brian Krebs, the Cool kit was created by the same group who created Blackhole, led by the Russian ‘Paunch'.

Blue Coat's Chris Larsen and Jeff Doty said that Cool's rise to power has been impressive, as servers in the mixed-kit network greatly outnumber the servers that are hosting solely one type of exploit kit. “I haven't looked at all of them, but from a high-level perspective, it looks like most of them are hosting the Cool kit,” they said.

“We have also seen a couple of large IP subnets that are hosting a mix of Blackhole and Cool exploit kit sites.”

Krebs said in a recent blog that Cool is being used in ransomware attacks, and after talking with members of Paunch they emphasised that they would not buy exploits that were already public.

“It's unclear how many takers Paunch is attracting to Cool Exploit Kit with its hefty price tag, but according to Kafeine and others, the new kit is being used exclusively by two different crimeware gangs,” he said.

Ruby off the Rails, as major exploits appear online

Researchers have warned of a remote execution exploit for flaws within Ruby on Rails that were the subject of two ‘extremely critical' fixes this week.

The parameter-parsing flaws are present in all versions of the open source web application framework, and could allow attackers to bypass authentication and execute arbitrary code in apps written in Ruby on Rails.

According to Ruby on Rails, there are "multiple weaknesses in the parameter parsing code for Ruby on Rails that allows attackers to bypass authentication systems, inject arbitrary SQL, inject and execute arbitrary code, or perform a DoS attack on a Rails application".

According to reports, there could be up to 250,000 Rails-based websites potentially at risk from attack, as a proof-of-concept attack has been developed for all versions of Rails for the last six years, but has not yet been made public. However reports have emerged that proof-of-concept exploits have now appeared online.

Rapid7 chief security officer HD Moore said that the main problem is that the XML processor in Ruby on Rails can be tricked into decoding the request as a YAML document or as a Ruby Symbol, both of which can expose the application to remote code execution or SQL injection.

According to Moore's Metasploit project, which is written in Ruby on Rails, Rapid7 has updated all of its own RoR applications with the workaround. “This is more than likely the worst security issue that the Rails platform has seen to date,” he said.

Security researcher Ben Murphy said: “An attacker can execute any Ruby code he wants including system (Unix command). This affects any Rails version for the last six years.”

"I've written POCs for Rails 3.x and Rails 2.x on Ruby 1.9.3, Ruby 1.9.2 and Ruby 1.8.7 and there is no reason to believe this wouldn't work on any Ruby/Rails combination since when the bug has been introduced. The exploit does not depend on code the user has written and will work with a new Rails application without any controllers."

According to a SANS Institute blog by Rob VandenBrink, senior consulting engineer at Metafore, because of the security profile of Ruby on Rails, any security issues should be taken seriously. “However, the hype and hoopla that any site with Ruby on Rails code on it is vulnerable is just that - the vulnerability being discussed is very specific in nature, but folks hear SQL injection and (mistakenly as far as I can see) send it to the headline page,” he said.

Sourcefire chief architect Adam J O'Donnell said a worm could emerge to target the vulnerabilities, but such a threat would be overshadowed by more stealthy attacks.

"The worst case situation is that attackers use the vulnerability to silently compromise massive numbers of vulnerable websites, grab everything from the database, and install persistent backdoors in the infrastructure of every organisation running the vulnerable code.

“They could also silently post a client-side exploit that targets people who come to that site, commonly known as a watering hole attack. A worm would likely force everyone to fix their infrastructure immediately, while silent exploitation may not be as motivating.”

This story originally appeared on SCMagazine.com.au. Headline courtesy of Wim Remes.

Sophos launches BYOD specific EndUser Protection

Sophos has announced the launch of EndUser Protection to help tackle the increase in devices used by a businesses workforce.

According to the company, Sophos EndUser Protection provides consolidated protection for every device on a network by securing per-user rather than per-device. This means the organisation protects all user devices wherever users go.

Combining Sophos endpoint protection and mobile device management offerings, it said that the solution alleviates the burden that bring your own device (BYOD) places on IT, while simplifying and improving the security and management of every device employees are using to access corporate data.

Matt Fairbanks, chief marketing officer at Sophos, said: “Every day, I use three or four different devices for business purposes, and the consumerisation trend points to more people using even more devices.

“Our value proposition to customers and partners is complete security without complexity. And as BYOD moves more to the forefront of complete security, Sophos EndUser Protection allows more IT professionals to embrace BYOD rather than try to reverse it.”

AirWatch offers app wrapping as part of application management launch

AirWatch has announced the launch of an ‘app wrapping engine' to add security features to internal apps without writing any additional source code.

According to the company, the AirWatch wrapping engine app allows for forced authentication, enforcement of passwords, compromised device detection, prevention of copy/paste from the app and disablement of WiFi, Bluetooth and the camera.

It is delivered as part of its mobile application management offering, and AirWatch said it allows IT administrators to manage internal, public and purchased apps across employee, corporate or shared devices in organisations.

Also, the application management solution gives developers multiple options to manage internally developed apps by using security and management capabilities available through the AirWatch Software Development Kit (SDK). These include compromised status and jailbreak detection, certificate provisioning, geofencing, reporting and analytics, application health and diagnostics, dynamic server-side configuration and provisioning of apps and defining custom settings for apps.

First Java zero-day of 2013 implemented into exploit kits

Warnings have been made about a zero-day threat in Java that is reportedly being exploited in the wild.

It was spotted by researcher Kafeine, who initially held off on disclosing the flaw until it was acknowledged elsewhere, but he did release his research deciding it was necessary because the exploit could "cause mayhem".

The flaw would allow a context-dependent attacker to execute arbitrary code on a user's system using specially crafted Java content, for example when it is embedded into a web page.

One of those to talk about the flaw was security blogger Brian Krebs, who said that the authors of exploit kits Blackhole and Nuclear Pack had added the exploit.

He said: “The curator of Blackhole, a miscreant who uses the nickname ‘Paunch', announced yesterday on several Underweb forums that the Java zero-day was a ‘New Year's Gift', to customers who use his exploit kit. Paunch bragged that his was the first to include the powerful offensive weapon, but shortly afterwards the same announcement was made by the maker and seller of Nuclear Pack.”

Krebs continued with his advice to disable Java if it is not needed. Oracle did not comment at the timing of writing.

As well as being implemented into the Blackhole and Nuclear exploit kits, the source has also been posted on Pastebin and a module integrated into Metasploit.

According to Trustwave SpiderLabs' preliminary analysis, the zero-day is using a similar tactic to CVE-2012-5088, which was patched by Oracle last October.

Jaime Blasco, head of labs at AlienVault, said: “With the files we were able to obtain we reproduced the exploit in a fully patched new installation of Java. We tricked the malicious Java applet to execute the calc.exe in our lab.

“The Java file is highly obfuscated but based on the quick analysis we did the exploit is probably bypassing certain security checks  tricking the permissions of certain Java classes as we saw in CVE-2012-4681. Right now the only way to protect your machine against this exploit is disabling the Java browser plug-in. Let's see how long it does take for Oracle to release a patch.”

Wolfgang Kandek, CTO of Qualys, said: “Since there is no patch available, IT administrators should look into the option of disabling Java in the browser. This process has been made easier in the most recent version of Java 7 by including the option in the Java Control Panel.”

Kaspersky Lab's Kurt Baumgartner said that while there doesn't appear to be a high level of server-side polymorphic obfuscation in the class files themselves, the hosted exploit files are being updated and have changed since they were initially detected.

He said: “The first appearance of the exploit's prevention in our KSN community seemed to be January 6th but as we dig back further, we find related samples from mid-December.

“We have seen ads from legitimate sites, especially in the UK, Brazil and Russia, redirecting to domains hosting the current Blackhole implementation delivering the Java zero-day. These sites include weather sites, news sites, and of course, adult sites.”

European Cybercrime Centre set to open today

The European Cybercrime Centre (EC3) opens today at the European Police Office in the Hague.

Intended to help protect European citizens and businesses from cyber crime, it will pool expertise and information, support criminal investigations and promote EU-wide solutions.

Its main focus will be on illegal online activities carried out by organised crime groups, especially attacks targeting e-banking and other online financial activities, online child sexual exploitation and those crimes that affect the critical infrastructure and information systems in the EU.

The centre will conduct research and development and produce threat assessments, trend analyses, forecasts and early warnings. It will also provide a cyber crime help desk for EU countries' law enforcement units and offer operational support to EU countries and deliver high-level technical, analytical and forensic expertise in EU joint investigations.

There will be 40 full-time staff by the end of the year who will work to support anti-cyber crime efforts in EU countries.

EU Commissioner for home affairs, Cecilia Malmström, said: “The Cybercrime Centre will give a strong boost to the EU's capacity to fight cyber crime and defend an internet that is free, open and secure.

“Cyber criminals are smart and quick in using new technologies for criminal purposes; the EC3 will help us become even smarter and quicker to help prevent and fight their crimes.”

Troels Oerting, head of the European Cybercrime Centre, said: “In combating cyber crime, with its borderless nature and huge ability for the criminals to hide, we need a flexible and adequate response.

“The European Cybercrime Centre is designed to deliver this expertise as a fusion centre, as a centre for operational investigative and forensic support, but also through its ability to mobilise all relevant resources in EU Member States to mitigate and reduce the threat from cyber criminals wherever they operate from.”

The concept of the centre was first proposed in the European Commission's 2010 Internal Security Strategy, and established last March. The plans were reaffirmed by UK foreign secretary William Hague last October, when he said that the centre will receive £2 million of annual funding from the UK government.

Microsoft to release emergency patch for Internet Explorer tonight

Microsoft has announced that it will release an out-of-band patch for the zero-day vulnerability in Internet Explorer today.

According to Trustworthy Computing group manager Dustin Childs, while Microsoft has seen a limited number of customers affected by this issue, it said that the potential exists for more customers to be affected.

“The bulletin has a severity rating of ‘critical', and it addresses CVE-2012-4792. Internet Explorer 9 and 10 are not affected by this issue and as always, we encourage customers to upgrade to the latest browser version,” he said.

“We recommend that you install this update as soon as it is available. This update for Internet Explorer 6 to 8 will be made available through Windows Update and our other standard distribution channels.”

As previously reported by SC Magazine, the vulnerability could allow remote code execution of three versions of the browser and Microsoft was aware of targeted attacks that attempt to exploit this vulnerability, although Internet Explorer 9 and Internet Explorer 10 were not affected.

To help solve the situation until now, Microsoft had released a workaround Fix It and encouraged users to use the Microsoft Enhanced Mitigation Experience Toolkit (EMET) to help prevent exploitation of this vulnerability.

Ross Barrett, senior manager of security engineering at Rapid7, said: “If Microsoft's security team is correct, this vulnerability is still seeing only limited exploitation in the wild, but there is no reason to hold off only releasing a fix now that the patch is ready.

“It's always a race between security teams and malware writers, in this case given the attention this vulnerability has received it likely will not be long before exploitation becomes widespread. Getting a fix out under these circumstances is like immunising ahead of an outbreak that has already started.”

Oracle to issue Java patch following US Homeland Security warning

Oracle has announced a security update for the zero-day flaw in Java that was widely reported last week that will be released soon.

According to a statement, it has released the security alert to fix the Java 7 Security Manager Bypass Vulnerability and another vulnerability affecting Java running in web browsers, which it rates as ‘high'. 

It said: “These vulnerabilities may be remotely exploitable without authentication, i.e., they may be exploited over a network without the need for a username and password. To be successfully exploited, an unsuspecting user running an affected release in a browser will need to visit a malicious web page that leverages these vulnerabilities. Successful exploits can impact the availability, integrity and confidentiality of the user's system.”

It also acknowledged the public disclosure of technical details and the reported exploitation of CVE-2013-0422 in the wild, and strongly recommended that customers apply the updates provided by the security alert as soon as possible.

To be successfully exploited, an attacker needs to trick an unsuspecting user into browsing a malicious website and the execution of the malicious applet within the browser of the unsuspecting users then allows the attacker to execute arbitrary code in the vulnerable system. “These vulnerabilities are applicable only to Java in web browsers because they are exploitable through malicious browser applets,” it said. 

However according to Polish research group Security Explorations, the update will leave several critical security flaws unfixed. The group claimed to have discovered several bugs in the software over the past year, but said that Oracle has not acknowledged the discovery of flaws, or added them to this or other patches.

Wolfgang Kandek, CTO of Qualys, said: “Oracle has made a statement that we can expect a fix for the current Java 7 zero-day vulnerability shortly, but has not given a specific date yet. However, next week on 15th January is Oracle's quarterly Critical Patch Update Tuesday when Oracle updates all of its other software packages with security fixes.”

The announcement came after the US Department of Homeland Security encouraged computer users to disable Java in web browsers, as attackers could trick targets into visiting malicious websites that would infect their PCs with software capable of exploiting the bug in Java.

“Due to the number and severity of this and prior Java vulnerabilities, it is recommended that Java be disabled temporarily in web browsers,” it said in its advisory.

“This and previous Java vulnerabilities have been widely targeted by attackers, and new Java vulnerabilities are likely to be discovered. We are currently unaware of a practical solution to this problem.”

Ross Barrett, senior manager of security engineering at Rapid7, said: “Oracle has moved quickly to release a fix for the vulnerability (CVE-2013-0422) which as of last week was publicly known to be ‘weaponised' in widely available black market exploit kits.

“This fix is available now as Java 7u11 and anyone who uses Java in their browser should update immediately. This fix changes the default Java browser security settings to require user consent to execute Java applets which are not digitally signed, or are self-signed, which indicates that Oracle has made a minor concession against ease-of-use to try to protect users from the next time a Java vulnerability is exploited in the wild.”

Anonymous responds to Swartz death with defacement and calls for change

Following the death of internet activist Aaron Swartz over the weekend, Anonymous has attacked the Massachusetts Institute of Technology (MIT) and announced that it is targeting the US Department of Justice.

Swartz was a co-author of an early version of the RSS technology, an internet freedom activist and early developer of Reddit. He died on Friday. He had been facing charges over the download of millions of academic papers from online archive JSTOR, which he denied, and was due to face trial next month.

Following a statement was issued by MIT president Rafael Reif saying that it would fully analyse "MIT's involvement from the time that we first perceived unusual activity on our network in fall 2010 up to the present", Anonymous defaced two MIT websites, as detailed by Cnet.

Its message called the prosecution of Swartz "a grotesque miscarriage of justice" and "a distorted and perverse shadow of the justice that Aaron died fighting for".

It named four goals that it wanted to achieve in the wake of Swartz's death. These were:

• To be a basis for reform of computer crime laws, and the overzealous prosecutors who use them

• To be a basis for reform of copyright and intellectual property law, returning it to the proper principles of common good to the many, rather than private gain to the few

• To be a basis for greater recognition of the oppression and injustices heaped daily by certain persons and institutions of authority upon anyone who dares to stand up and be counted for their beliefs, and for greater solidarity and mutual aid in response

• To be a basis for a renewed and unwavering commitment to a free and unfettered internet, spared from censorship with equality of access and franchise for all.

According to a Pastebin statement, Anonymous is also launching ‘Operation Angel', part of which will be after Swartz's funeral when it "intends to pursue reform within the Department of Justice (DOJ) and other government agencies to prevent the kind of unnecessary harassment that Aaron Swartz was victim to".

It said: “Some of the brightest men and women in the fields of information technology and security are being targeted by agencies that lack a basic understanding of the so-called crimes they are accusing people of. We will do this for Aaron Swartz and everyone like him.”

Red October espionage campaign targets governments and organisations

A high-level cyber espionage campaign that successfully infiltrated computer networks at diplomatic, governmental and scientific research organisations has been detected.

According to Kaspersky Lab, for the last five years the campaign has been conducted by Russian-speaking attackers that targeted users in Eastern Europe, members of the former USSR and countries in Central Asia, Western Europe and North America.

Named Red October, or Rocra for short, Kaspersky Lab said that it is still active, with data being sent to multiple command-and-control (C&C) servers, which work as proxies and hide the location of the true C&C server. It said that the attackers created more than 60 domain names and several server hosting locations in different countries, although mainly in Germany and Russia.

What is different about this framework is that it uses at least three different exploits for previously known vulnerabilities: CVE-2009-3129 in Microsoft Excel; CVE-2010-3333 in Microsoft Word; and CVE-2012-0158 (also Word).

It said that the attackers created a multi-functional framework, capable of applying a quick extension of the features that gather intelligence. It said that the system is resistant to C&C server takeover and allows the attacker to recover access to infected machines using alternative communication channels.

It is capable of stealing data from mobile devices and removable disk drives, stealing email databases from local Outlook storage or remote POP/IMAP servers and siphoning files from local network FTP servers.

Kaspersky Lab claimed that Rocra infects by using spear phishing tactics and, once in, a module actively scans the local area network, and finds hosts vulnerable for MS08-067 (the vulnerability exploited by Conficker) or which are accessible with administrator credentials from its own password database. Another module collects information to infect remote hosts in the same network.

Detected in October 2012, Kaspersky Lab said that it had counted several hundreds of infections worldwide, with the most (38) in Russia. It believed that the exploits appear to have been created by Chinese hackers, while the Rocra malware modules were created by Russian-speaking operatives. It also said that there were more than 1,000 modules belonging to 30 different module categories, with some created as far back as 2007. 

It said: “The main purpose of the operation appears to be the gathering of classified information and geopolitical intelligence, although it seems that the information gathering scope is quite wide. During the past five years, the attackers collected information from hundreds of high profile victims although it's unknown how the information was used.

“All the attacks are carefully tuned to the specifics of the victims. For instance, the initial documents are customised to make them more appealing and every single module is specifically compiled for the victim with a unique victim ID inside.”

It also said that while there were similarities to the Flame virus, it could not find any connections between Rocra and the Flame/Tilded platforms.

Office workers see daily phishing messages, with some hit ten times a day

A significant portion of office workers receive phishing emails at work during the working day.

According to a survey by PhishMe of 1,000 office workers, around 60 per cent said that they received phishing emails, while six per cent received more than ten phishing messages every day. The company claimed that this level shows that technical controls are failing to stop these messages as they pass through the system.

“They end up in user's inboxes, and for many companies it is purely down to luck if that employee responds,” said Scott Greaux, vice president of product management and services at PhishMe. “Our research shows that almost 60 per cent will fall for a well-designed phishing email - opening your systems to the criminals and hackers.”

PhishMe executive vice president Jim Hansen said that the survey also found that 41 per cent of respondents had no idea if their senior executives had been phished or not, and claimed that this was a case for training and building a fast and compelling theme that is straightforward.

Speaking at the Infosecurity Europe 2013 press conference in London, he said: “You need to get away from penetration testing and teach people, get them to be part of the program. The challenge is that they are passive, they walk past a poster and chats at lunch are not very effective.”

Security vendors accused of playing catch-up and failing when it comes to mobile security

Security vendors have been accused of failing to meet the demands set by mobile devices.

Speaking at a CISO panel at the Infosecurity Europe 2013 press conference in London, Andrew Yeomans, board member of the Jericho Forum, said that the next threat landscape will be caused by vendors that have been slow in meeting the demands to change.

He said: “They have been significantly slower out of the box. They know what is secure and know how to secure Windows, Unix, so the immediate threat is a lack of knowledge of the operating system and best practice, and what they had in the past is no longer necessary.”

Yeomans also said that by letting people buy their own devices companies "put admin and control on top of them".

Peter Gibbons, head of IM security at Network Rail, said: “This has crept up on everyone and it feels like vendors have missed it, and big suppliers in mobile device management (MDM) are not traditional technology companies, and now the leaders have missed a trick.

“This has been tipped on its head with the traditional method of releasing into the enterprise, as they usually understand your needs to meet the requirements with the user and that is how you get their technology. Now it is the other way round.”

Gibbons also said many traditional security vendors have launched mobile-related products, but this has happened so quickly that there is no decent product. “I get 10-15 calls from vendors who say that they can show me a product, but mobile vendors have broken into it,” he said.

Tracy Andrew, information security and compliance officer at Field Fisher Waterhouse, said that it is so fast and dynamic, that the bigger players cannot cover all the bases and that the smaller vendors can react quicker but often do not have the right solution to bring to market as it is not ready.

Nigel Stanley, analyst at Bloor, said: “With the work I have done, the smaller companies are more agile than the bigger companies and they talk about mobile solutions. If I were one of the bigger companies I would be worried as they talk anti-virus, when what we want is proper mobile device management.”

Venafi: CAs are not wholly to blame for certificate-based attacks

Attacks within the certificate infrastructure are due to mismanagement rather than attacks on certificate authorities (CAs).

Speaking at the Infosecurity Europe 2013 press conference in London, Calum MacLeod, EMEA director of Venafi, said that organisations are managing keys and certificates poorly, leading to a lack of knowledge of how many certificates users have, specifically SSL certificates.

MacLeod said: “Forget keys and certificates, this has become the prime component of every piece of malware and anti-virus is no longer able to tackle this. Anti-virus is no longer able to help address this problem, and the market for stolen certificates is $5 billion.”

He claimed that with over 1,600 CAs issuing certificates, why would one CA be trusted over another “The problem is not with the technology, it is the mismanagement of the technology. For all we hear about, there is a lot more we don't hear about,” he said.

“Companies switch on SSL by default, but users don't manage it, so it is difficult to control. By signing malware with digital certificates, there is a greater chance of success. As part of your security strategy you need to protect yourself; a firewall is there to block a connection, but now malware is there so need to protect against digitally signed malware.”

He said that with hackers attacking at the weakest point, that is now certificates, and they have financial value, yet many organisations have no idea where their SSL certificates are.

He said: “Not a single one can tell you where they are. It is black magic, it is weird so don't do it. There can be weak points such as infrastructure or certificates - also CAs are unregulated and you don't know which [company is] issuing the certificates. You can talk to anyone, they don't know how many they have got or when they expire. What length of encryption key is being used Anything less than 2,048 bits is hackable.”

MacLeod claimed that businesses need to take responsibility as there is no need to trust any one of the 1,600 CAs globally, but you need to trust your own infrastructure. “If you don't use them, you don't need to trust them, so narrow down to a few. We build defences and those that attack us find the back doors and if we don't respond, they just walk in,” he said.

Asked by SC Magazine if he felt that the DigiNotar incident was a watershed moment when it came to CA security, he said that this was the first instance of being out of control, but before that there had been VeriSign and Comodo, while with Stuxnet, there was a question of a stolen certificate. He said: “DigiNotar raised the issue of the problem. Like insurance, it takes one thing to realise it is a serious issue.”

Cassidian: Industrial control systems are still vulnerable to basic attacks

We are not learning the lessons when it comes to protecting industrial control systems, despite increased attacks, according to the defence and security specialist.

Speaking at the Infosecurity Europe 2013 press conference in London, Andrew Beckett, head of cyber security consultancy and professional services at Cassidian, said that while 80 per cent of attacks on industrial control systems were unintended, the problem is often down to old technology that is brought down by standard malware and volumes of traffic.

He said: “If you want to attack a country and disrupt its operations, attacking the industrial heartland is the way to go.

“Why are these attacks so effective Because they are relatively soft targets, They have not benefited from security controls like government or defence systems and because of their age, they don't receive updates, yet they are about critical availability as run 24/7.

“You can see engineers walk in and out with laptops and data transferred by USB sticks; often there is no malicious intent but endpoints does not have the same levels of protection, so controlling multiple entry points is a problem. There is also poor network segmentation and a lack of division, so it is easy for a worm to spread and replicate across the network.”

Citing examples such as in August 2005 when Chrysler auto plants were shut down by a worm that caused a $14 million loss and the Iranian systems hit by Stuxnet in 2010, Beckett said that a poor job has been done on cleaning up Stuxnet, and that anyone who wants to reprogram it will have a ready-made botnet to launch the next attack.

“Having a defensive perimeter is not enough. The problem with defending network and with malware is that it is carried in and out; the perimeter is breached or breachable, so you need to protect individual segments and you need defence in-depth, and that is largely missing from industrial networks,” he said.

New zero-day emerges in Java, just four days after previous flaw was patched

Just days after patching the zero-day vulnerability in Java, Oracle is facing another known exploit with an underground price tag of $5,000.

According to security blogger Brian Krebs, an administrator of an exclusive cyber crime forum has posted a message saying he was selling a new Java zero-day to two buyers at $5,000 each. Krebs said: “The hacker forum admin's message promised weaponised and source code versions of the exploit. This seller also said his Java zero-day, in the latest version of Java (Java 7 Update 11), was not yet part of any exploit kits.”

The seller said at the time of posting that they had sold the first exploit, and Krebs said that the thread had since been deleted so he assumed that the seller must have found a second buyer for the exploit.

“To my mind, this should dispel any illusions that people may harbour about the safety and security of having Java installed on an end-user PC without taking careful steps to isolate the program. I should note that this same thing happened not long after Oracle released a Java update in October; a few weeks later, a Java zero-day was being sold to a few private users on this same Underweb forum,” he said.

Paul Ducklin, head of technology for Sophos Asia Pacific, said: “The value the seller is placing on this exploit sounds a bit low to me: he's expecting total earnings of just $10,000 for a reliable, working and current Java zero-day.

“I don't mean to sound as though I think cyber criminality is glib and workaday. I'd simply have thought that he could have asked and got more. There are many possible reasons for that value, not least that I'm ill-informed about competitive pricing in the underground, and two interesting ones spring to mind: there isn't a new exploit; or it's not a very good one and it's just a wind-up.

“The widespread news coverage recommending that you turn off Java is pushing down the price. Let's hope that the reason is the latter.”

Oracle released the security update for the zero-day flaw in Java over the weekend, with a rating of 'high'. Ross Barrett, senior manager of security engineering at Rapid7, said: “This fix is available now as Java 7u11 and anyone who uses Java in their browser should update immediately.

“This fix changes the default Java browser security settings to require user consent to execute Java applets that are not digitally signed, or are self-signed, which indicates that Oracle has made a minor concession against ease-of-use to try to protect users from the next time a Java vulnerability is exploited in the wild.”

Report claims that German police are using commercial spyware

The German police have been reported to be using an intrusion software kit with the capability to monitor and record conversations.

According to a report by Netzpolitik, a secret document of the German Ministry of the Interior showed that the German federal police office has purchased the commercial Spyware toolkit FinFisher of Eleman/Gamma Group.

In October 2011, SC Magazine reported on research from Chaos Computer Club (CCC) that alleged that the German police force was using a backdoor Trojan that was capable of monitoring online activity and recording Skype calls.

The report claimed that since then, many German authorities have stopped using DigiTask spyware and started to create their own state malware. It said that the Federal Criminal Police Office plans to finish the development of their own surveillance malware until the end of 2014.

A translated memo said: “The Federal Criminal Police Office has acquired, for the event a use is necessary, a commercial product of the company Eleman/Gamma.”

The report said: “The Gamma Group of Companies, a network of companies linked to offshore secrecy, is behind the infamous FinFisher/FinSpy IT intrusion software kit developed in Germany and used by authoritarian regimes across the world to spy on political activists.

“The software is highly sophisticated and can completely take over a variety of devices, including Windows, OS X, Linux, iOS, Android, Symbian, BlackBerry and Windows Mobile. A promotional video advertises the ability of ‘remote intrusion' via fake updates from mobile carriers and internet providers.”

Although Gamma has not revealed details of its software, research suggests that the FinFisher/FinSpy toolkit consists of a basic Trojan module that can remotely load additional ‘feature modules', such as a module for recording Skype conversations.

CCC spokesperson Frank Rieger was quoted as saying: “With the purchase of Gamma FinFisher, the Federal Criminal Police Office has chosen a vendor that has become a symbol for the use of surveillance technology in oppressive regimes worldwide.

“FinFisher also consists of various components, which can be loaded when needed, thereby allowing the installation of spying capabilities that go far beyond the already questionable ‘wiretapping at the source'.”

Update

In an email to SC Magazine, Martin J Muench, founder of Gamma Group, said that he was unable to discuss clients, but that it designs and markets its products as powerful tools in the fight against sophisticated groups involved in terrorism and organised crime.

He said: “Gamma only supplies the FinFisher product range to government organisations and law enforcement agencies. The FinFisher range provides evidential quality reporting on a pre-set maximum number of suspects at any time.

“Generally reports available from intrusion software from other suppliers in the market have not been of a sufficient evidential standard to be used for successful prosecution.

“FinFisher provides the capacity for the law enforcement agencies carefully to monitor and control the extent of any investigation and provides a comprehensive activity log for the entire operation. As the system also comes with a pre-set limit on the number of suspects that may be investigated at any time, it prevents ‘trawling'.

“The authenticity of the collected evidence is verifiable (including by the use of tools which detect attempts to alter or falsify evidence) to a standard that permits this to be used in a prosecution.”

Remote zero-day hole found in Linksys routers

A zero-day vulnerability has been discovered in popular Cisco Linksys routers that allows hackers to gain remote root access.

The hole affects default installations of Linksys routers and is demonstrated in a proof-of-concept video.

An exploit was successfully tested against a Linksys model WRT54GL router by researchers at security firm DefenseCode who said other models "are probably also affected".

Cisco says it has sold more than 70 million Linksys routers globally.

DefenseCode said all firmware versions are vulnerable, and claimed Cisco incorrectly stated the hole was fixed in its latest firmware release.

“Due to the severity of this vulnerability, once again we would like to urge Cisco to fix this vulnerability,” it said in a statement.

A patch is due out this week, days ahead of DefenseCode's scheduled release of the full vulnerability details.

A Cisco spokeswoman told SC Magazine Australia: “Linksys takes the security of our products and customers' home networks very seriously.

“Although we can confirm contact with DefenseCode, we have no new vulnerability information related to our WRT54GL or other home routers to share with customers at this time. We will continue to review new information that comes to light and will provide customer updates as appropriate.”

Patient data revealed in medical device hack

Researchers have exploited critical vulnerabilities in two popular medical management platforms used in a host of services, including assisting surgeries and generating patient reports.

The dangerous unpatched flaws within the Philips Xper systems allowed researchers to develop an exploit within two hours, capable of gaining remote root access on the device.  

From there, attackers would have administrative access to a host of patient data stored in connected databases. The affected machine can operate any medical device that uses the common HL7 standard.

Cylance researcher Billy Rios told SC Magazine Australia: “We have a remote unauthenticated exploit for Xper, so if you see an Xper machine on a network, then you can own it.”

The holes were so severe that the US Department of Homeland Security (DHS) and Food and Drug Administration (FDA) stepped in to pressure Philips to fix the system.

“We've dropped exploits before on medical systems like Honeywell and Artridum, but we've never seen the FDA move like that. It was quicker than anything else I've seen before," said Rios.

After initial bids to contact Philips failed, researchers Rios and colleague Terry McCorkle sought assistance from the DHS, the FDA and the country's Industrial Control Systems Cyber Emergency Response Team (ICS CERT).  Two days later, DHS control system director Marty Edwards told the researchers the agency would from then on handle all information security vulnerabilities found in medical devices and software.

The announcement comes a month after the US government Accountability Office said in a report that action was required to address medical device flaws, adding that the FDA did notï'¿ consider such security risks "a realistic possibility until recently".

Once an extensive 200Gb forensic imaging process of the Windows-based platform had completed and the system was booted into a virtual machine, it took the researchers ‘two minutes' to find the first vulnerability.

Rios said: “We noticed there was a port open, and we started basic fuzzing and found a heap overflow and wrote up a quick exploit for it. The exploit runs as a privileged service, so we owned the entire box - we owned everything that it could do.”

The researchers suspect the authentication logins for the system, one with a username Philips and password Service01, are hardcoded and unchangeable by users, but when they warned Philips the company refuted the claim.

The Xper Physio monitoring five platform was formerly used by a Utah hospital and purchased from an unnamed reseller that sold the Dell Blade-like machine for a cut-rate of $200, delivered to Rios' home address.

That move broke the resellers' contractual obligations with Philips, which requires the return of unwanted devices ostensibly to safeguard against such security gaffes.

“That you need to jump through some hoops to get the hardware is not some sort of defence,” Rios said. “That's security through obscurity.”

The dealer was reported to the DHS and the equipment was returned to Philips.

Further holes were found in patient monitoring tool SpaceLabs ICS-Xprezz. The iOS application allowed doctors and medical practitioners to access a string of devices that monitor patient vitals.

The app could also allow attackers to access corporate networks. “It uses RDP into a Windows box, but you can change that box to whatever you want: I ran cmd.exe and a who am I and was amazed,” McCorkle said. “I can't imagine what they are actually deploying in hospitals.”

It also stored passwords to allow users to instantly login, a feature that could become a security risk should devices be lost or stolen.

Websense announces appointments of new chief executive and CTO

Websense has announced the appointment of John McCormack as CEO.

Succeeding Gene Hodges, who has announced that he is to retire after serving as both CEO and a board member since January 2006, McCormack assumed the position having been president since 2009. He joined the company in July 2006 as senior vice president of product development.

The company has also appointed Russ Dietz as the company's chief technology officer, having joined the company in November 2012. He said: “I look forward to extending the company's technology platform as well as expanding its market leadership. My goal is to drive continued innovation in the delivery of integrated content security, both in the cloud and through on-premise appliances, maintaining our corporate commitment that no one stops more security threats than Websense.”

Also joining the company is Charles Boesenberg as an independent director, who has previously served on the board of Symantec, was CEO and chairman of the board of NetIQ and has held senior executive level positions at companies including Apple and IBM.

John Carrington, chairman of the Websense board of directors, said: “The board and I would like to thank and congratulate Hodges for a strong fourth quarter performance and for all that he has accomplished in transforming Websense into a leading content security provider.

“We wish Hodges the best in his retirement, and we are confident that he leaves Websense well-positioned as we continue to extend our technology leadership and achieve corporate objectives.

“John McCormack has taken the lead in the successful execution of our strategic initiatives, enabling us to generate solid fourth quarter billings growth amid the continued expansion of our field sales organisation.

“As president, he has demonstrated his executive acumen while leading our worldwide sales and sales engineering teams; our marketing, product management, business development and technical support organisations; as well as the Websense Security Labs and research and development.”

McCormack said: “I look forward to continuing this momentum as we expand our sales coverage and reach more customers with our innovative content security solutions.”

US power companies were shut down by USB-transmitted viruses

A US power company was shut down for three weeks by a virus brought in by an infected USB stick.

According to media reports, a US Department of Homeland Security report did not identify the plant but said that the virus was introduced last October by an employee of a third-party contractor that does business with the utility, according to Reuters.

The US Department of Homeland Security's Industrial Control Systems Cyber Emergence Response Team (ICS-CERT), which helps protect critical US infrastructure, described the incident in a quarterly newsletter that was accessed via its website on Wednesday.

It also described a second incident, in which the Cert said it had recently sent technicians to clean up computers infected by common as well as ‘sophisticated' viruses on workstations that were critical to the operations of a power generation facility. According to USA Today, that was at another plant, where government computer experts discovered ‘common and sophisticated malware' on several workstations, including two that were critical to the plant's operation.

ICS-CERT said that it responded to 198 cyber incidents reported by energy companies, public water districts and other infrastructure facilities in the fiscal year ending 30th September 2012. Its report said: “ICS-CERT's onsite discussions with company personnel revealed a handful of machines that likely had contact with the tainted USB drive. These machines were examined immediately and drive images were taken for in-depth analysis.

“ICS-CERT also performed preliminary onsite analysis of those machines and discovered signs of the sophisticated malware on two engineering workstations, both critical to the operation of the control environment. Detailed analysis was conducted as these workstations had no backups, and an ineffective or failed clean-up would have significantly impaired their operations.”

Gadget makes old monitors ready for Windows 8

Many people who have tried Microsoft's new Windows 8 operating system without a touch screen have hated it because of the inability to use touch and swipe commands to get things going. Now, a company has made a digital pen to allow people to use Windows 8 on their old monitors for less than the cost of buying a new touch-enabled computer.

The device was unveiled this week at the International CES, an annual showcase in Las Vegas for the latest smartphones, tablet computers and other consumer-electronic devices.

WHAT IT IS: E Fun, a West Covina, California-based company, has come out with the Apen Touch8, a cordless pen that works in tandem with an attachment that plugs into the Windows computer's USB port.

HOW IT WORKS: The attachment, which is really an infrared and ultrasonic receiver, clips magnetically to the side of the screen, which can be as large as 17 inches (43 centimeters) diagonally. The pen emits an infrared beam out of its tip. The receiver attachment sends the pen's signals to the computer, which interprets its precise location.

Pushing down on the pen results in a separate ultrasonic signal, which is equivalent to a touch screen sensing when you are touching it. Just like that, you can swipe and tap your way through Windows 8. The pen runs on a watch battery, which should last about 500 hours and is replaceable.

WHY IT'S HOT: Windows 8, Microsoft Corp.'s effort to make desktop and laptop computers work more like tablet computers, was released in October to mixed reviews. A major problem is the fact that many of the features require a touch-screen monitor to work, making the experience unpleasant for those with older machines. Apen Touch8 offers a way for those with older computers to experience the newer touch-based functions.

AVAILABILITY: The pen is to go on sale in North America by the end of March for $80.

- AP

Pat Pilcher: The wait is over - the Steam box is here

There has been an endless amount of speculation around a Steam games console, and today the world's largest online PC game distributor announced the Piston Steam box at CES. Developed for Steam by Xi3, the box (codenamed Piston) will be able to tap into the Steam service to download thousands of PC based gaming titles.

The box itself is fairly petite, being only marginally larger than a block of cheese. That it can be picked up in one hand also makes ideal for transporting to and from LAN parties. Another key benefit of the Piston's PC DNA will be that gamers can use a mouse keyboard combination or a traditional games controller.

The Piston is powered by Linux, and an AMD Athlon 64 CPU. Its entry level spec does however appear a little light on internal storage with only 2GB of RAM, and 8GB of flash storage. This said, the entry level Piston is a very reasonable US$850.

The Piston's user interface (otherwise known as big picture) has also been optimised for use on big screen HD capable TV. The Piston started off as an unsuccessful Kickstarter project last year, but disappeared without a trace after it gained the backing of Valve (the owner of the steam service).

By Pat Pilcher

\

\ \ \ \ '); } if(arrData[i].parent_comment_id_2 > 0) { strParent2 = $('\

\ \ \ \

\ '); } if(arrData[i].parent_comment_id_2 > 0) strParent1.prepend(strParent2); blockQuotes.append(strParent1); // insertion of ad var the_first_part = ''; var the_last_part = ''; var arrString = published_comment.split("

"); if(arrString.length == 1){ the_first_part = published_comment; the_last_part = ''; } else { arrFirstParts = arrString.splice(0,arrString.length-1, 1); the_first_part = arrFirstParts.join("

"); the_last_part = arrString[arrString.length-1]; } if(intLoop == 3){ adIncrement ++; adNum = comment_id; } var replyStr = ''; if(blnAcceptingComments){ replyStr = 'Reply'; } // Build the actual comment if(city != ""){ city = '('+city+')'; } else{ city = ''; } $('

').appendTo(commentsDisplay); intLoop ++; } if(intLoop

Stand-outs from biggest ever gadget show

The world's largest gadget show wrapped up on Friday (US time), and the organisers said it was the biggest ever, beating last year's record in terms of the floor space companies purchased to display their wares.

What was it that drew more than 3,500 companies and 150,000 people to Las Vegas for this mega-event Here are four gadgets that exemplified the top trends at this year's International CES.

Sony's 55-inch (140-centimeter) ultra-high-definition TV

The introduction of high-definition and flat-panel TVs sent US shoppers on a half-decade buying spree as they tossed out old tube sets. Now that the old sets are mostly gone, sales of new TVs are falling. To lure buyers back, Asian TV makers are trying to pull the same trick again. They're making the sets sharper. This fall, Sony and LG introduced 84-inch (213-centimeter) sets with four times the resolution of regular high-definition sets. They provide stunning sharpness, but they're too big for most homes, and at more than US$20,000, too expensive. At the show, the companies unveiled smaller "ultra-high-definition" sets, measuring 55 inches (140 centimeters) and 65 inches (165 centimeters) on the diagonal. They will go on sale this spring.

Prices were not announced, but will presumably be a lot lower than for the 84-inch (213-centimeter) sets, perhaps under US$10,000.

Both the size and price of these smaller ultra-HD TVs should make them easier buys, but the higher resolution will be a lot less noticeable on a smaller screen, unless viewers sit very close. Analysts expect ultra-HD to remain an exclusive niche product for some years. There's no easy way to get ultra-HD video content to the sets, so they will mostly be showing regular HD movies. However, the sets can "upscale" the video to make it look better than it does on a regular HD set.

Analyst James McQuivey of Forrester Research believes the TV makers are focusing on the wrong thing. He doesn't think consumers really care that much about picture quality.

"What matters most is not the number of pixels or the quality of the pixels themselves ... but the increasing convenience of the content's discovery and delivery. This is why TV makers should be investing in a better experience rather than a bigger one," McQuivey wrote in a blog post.

LG's 55-inch (140-centimeter) OLED TV

Organic light-emitting diodes, or OLEDs, make for thin, extremely colorful screens. They're already established in smartphone screens, and they have a lot of promise for other applications as well. For years, a promise is all they've represented. OLED screens are very hard to make in larger sizes. Now, LG is shipping a 55-inch (140-centimeter) OLED TV set in Korea, and is expected to bring it to the US this spring for about $12,000.

Beyond being thin, power-thrifty and capable of extremely high color saturation, OLEDs are interesting for another reason: they can bend. LCDs have to be laid down on flat glass substrates, but OLEDs can be laid down on flexible glass or plastic. The major obstacle here is that flexible substrates tend to let through air, which destroys OLEDs, but manufacturers seem to have tackled the problem. Samsung showed off a phone that can bend into a tube. It consisted of a rigid plastic box with electronics and an attached display that is as thin as a piece of paper. The company suggested that in the future, it could make displays that fold up like maps big screens that fit in a pocket.

We're likely to see the benefits of bendy OLEDs sooner in a less eyebrow-raising but more practical implementation. It may never have occurred to you, but all electronic screens, except for cathode-ray tubes, are flat. With OLEDs, they don't have to be. LG and Sony showed TV sets with concave screens at the show not very useful, but an interesting demonstration. In the future, you could have a phone with a screen that laps over onto the edges, providing you with "smart" buttons with labels that change depending on whether you're in camera mode or music mode. You could have a coffee mug with a wrap-around news and weather ticker. A revolution in design awaits.

By the way, you won't have to choose between ultra-HD and OLED screens Sony, Panasonic and LG showed prototype TVs that combine the technologies.

The Pebble Watch

The Pebble is a "smart" timepiece that can be programmed to do various things, including showing text messages sent to your phone. The high-resolution display is all digital, so it can be programmed with various cool "watch faces." But what's really interesting about the Pebble is how it came to be and that it exists at all.

Young Canadian inventor Eric Migicovsky couldn't find conventional funding to make the watch, so he asked for money on Kickstarter, the biggest "crowdfunding" website. In essence, he asked people to buy watches before he actually had any to sell. The fundraising was a blowout success. Migicovsky raised $10.3 million by pre-selling 85,000 Pebbles. At CES, he announced that the watches were ready to ship.

Kickstarter's goal is to bring things and events into fruition that otherwise wouldn't happen, by creating a shortcut between the people who want to create something and the people willing to pay for it. The effect is starting to become apparent at CES. At least two other "smart" watches funded through Kickstarter were on display. Some startups were at the show to drum up interest in ongoing Kickstarter campaigns, including a Swedish company that wants to make a speaker with a transparent body, and a California outfit that wants to produce a swiveling, remote-controlled platform for cameras.

Creative Technology Ltd's Interactive Gesture Camera

This $150 camera, promoted by Intel, attaches to a computer much like a Webcam. From a single lens, it shoots the world in 3-D, using technology similar to radar. The idea is that you can perform hand gestures in the air in front of the camera, and it lets the computer interpret them. Why would you want this That's not really clear yet, but a lot of effort is going into finding an answer. CES was boiling with gadgets attempting to break new ground when it comes to how we interact with computers and appliances like TV sets. The Nintendo Wii game console, with its innovative motion-sensing controllers, and the Microsoft Kinect add-on for the Xbox 360 console, which has its own 3-D-sensing camera, have inspired engineers to pursue ways to ditch or at least complement the keyboard, mouse, remote control and even the touchscreen.

Samsung's high-end TVs already let viewers use hand gestures to control volume, and it expanded the range of recognized gestures with this year's models. Startup Leap Motion was at the show with another depth-sensing camera kit, this one designed to mount next to a laptop's touch pad, looking upward.

So far, though, the "new interaction" field hasn't had a real hit since the Kinect. Consumers may be eager to lose the TV remote, but there's a holdup caused by the nature of the setup: to effectively control the TV, you need to take command not just of the TV, but of the cable or satellite set-top box. TV makers and the cable companies don't really talk to each other, and there's no sign of them uniting on a common approach. Only when both devices can be controlled by hand-waving can we permanently let the remote get lost between the couch cushions.

-AP

Experts Debate Whether J.C. Penney, Sears Will Survive

We are on the brink of a major change in many industries. In retail specifically, experts are debating whether some big brands will survive. For those small business owners and entrepreneurs who have set their sights on this market or serve customers within it, the outcome will be critical. Other entrepreneurs can learn the importance of adapting to change, so essential to businesses regardless of their size.

Shopocalypse

The last retailer standing. J.C. Penney and Sears are among the big brands struggling in a tough and changing economy, and some say the moment of truth has come for both. Other giants that continue to struggle despite the overall success of many retailers during the all important Christmas season include Target, Kohl’s, and domestic Gap. Forbes

Sweet smell of success. Still, J.C. Penney and Sears remain at the center of a major revolution in their industry, led earlier by innovative brands like J. Crew, to focus on uniqueness and community over simple price cutting. Whether these companies win or loose their fight, the struggle is also of interest to entrepreneurs facing their own pressures to adapt in the marketplace. Bloomberg

Problems with Profitability

Mind over market. Clients often give Matthew Needham a list of excuses why they can’t grow their businesses, mentioning that there aren’t enough customers or that the economy is in bad shape. Turns out, though, that the real problem has to do with state of mind. Just as large brands are actively working to target new customers and transform their markets, smaller businesses must adjust their mindsets for success. The Big Red Tomato Company

Shopping cart syndrome. Some businesses may face an even more infuriating problem when it comes to improving their revenue and expanding their customer base, especially online. A recent study suggests that problems online buyers experience with e-commerce sites may account for many lost sales. These include trouble using captcha functions, problems with promo codes and gift card redemption, and more. There are sales you, too, could be missing if your Website isn’t what it should be. Grow Smart Biz

Revenue Renaissance

A brand with a plan. Other companies may have a much more basic problem. Markets change from year to year, and if you aren’t updating your business plan on at least an annual basis, your business could suffer the consequences. Fortunately, the process of keeping your business plan up to date is a simple one. Summer Alexander suggests these easy steps to get started. Summer Alexander Research

Missing the target. Sometimes a failure to generate sales has nothing to do with your products, services, or business modelâ€"it’s your marketing that fails you, says B2B marketing blogger Susan Fantle. A few simple problems can scuttle your marketing efforts, costing you sales. Here, Fantle talks about how to avoid those problems and how to develop a strategy that will lead to success. B2B Marketing Smarts

Building blocks. More than specifics like marketing strategy, target audience, or products and services, it may turn out that your company’s overall characteristics will determine whether your businesses grows, stagnates, or withers away and dies. Blogger Kelvin Cech believes there are four basic building blocks upon which growing businesses are built. See whether you have these essential components in your business. Function Writing Group