Sony, Gracenote warn on software security
122352
Sony 6758.T and digital music   database provider Gracenote said on Monday customers should   update software to prevent hackers from breaking into their   personal computers.
210160
File will cause portable gaming device to malfunction, company says.
309903
To: TECHNOLOGY EDITORS  Contact: Jim Dobbs of Augusta Systems, Inc., +1-304-599-3200, ext. 114, jdobbs@augustasystems.com   PITTSBURGH, June 12 /PRNewswire/ -- In an effort to bolster security and monitoring capabilities at the upcoming 2007 U.S.
515247
Symantec has released a patch for its Veritas NetBackup software, saying it had discovered a buffer overflow vulnerability in the application. The flaw exists in the web programming language PHP used within NetBackup.
345263
Blog: Critical security flaws patched in EnjoySAP and SAP Web Application Server, as well as more moderate security vulnerability in SAP Message Server, according to advisory issued by Next Generation Security Software (NGSS).
168018
It's no surprise that Symantec and Adobe are wary of Microsoft bundling its own security software and electronic document format in Windows Vista, but the companies had yet to lodge official complaints about the operating system until now.
717712
Some digital picture frames and other devices sold over the holidays may include malicious software.
530809
There&#8217;s now one more reason to be careful about opening Microsoft Office attachments.
674948
Finnish security company F-Secure has reported on new rootkit-like software discovered on USB thumb drives manufactured by Sony. Although the software doesn't appear to cause damage to a user's system, it does create a hidden directory that is inaccessible via the Windows API and some virus scanners.
514325
Microsoft Corp. MSFT.O warned Windows  users on Tuesday of two new "critical"-rated security flaws in  its software that could allow attackers to take control of a  computer and delete or copy information.
358340
(InfoWorld) - The United Nations last week became the latest organization to warn computer users about the dangers of relying on just passwords to protect online bank accounts and e-commerce shopping carts, according to Reuters The warning from the UNâs International Telecommunications Union came a little more than a year after the United Statesâ Federal Financial Institutions Examination Council (FFIEC) released similar guidance calling for stronger user authentication for online banking customers.                                                     Those kinds of warnings are music to the ears of Jon Fisher, CEO of Santa Clara, Calif.-based Bharosa, which sells anti-fraud and multifactor authentication technology to banks, health care companies, and the government. Just three years old and with 50 employees, Bharosaâs been taking on security industry behemoths such as VeriSign and EMC/RSA on their own turf and, in some cases, winning. In the past year, Fisherâs company signed deals with Wells Fargo, National City, and the U.S. Air Force. A serial entrepreneur who sold his first company at age 23, Fisher spoke with InfoWorld Senior News Editor Paul F. Roberts about how the changing regulatory environment has been good for his company. InfoWorld: What is the core intellectual property that Bharosa has? Jon Fisher: We have a proprietary, gated methodology to screen for fraud in real time. The first gate manifests itself pre-log-in via an analysis of a host of data about the user and transaction. The second gate is at the first point of authentication: the user name and password. The third gate is manifest in session where transaction and document requests occur. The fourth gate is a score of third-party data, whether thatâs enterprise, legacy, or other data thatâs fed into our fraud detection engine. IW: What should enterprises know about software like Bharosaâs? JF: Fraud detection has a place not just in achieving FFIEC compliance, but also truly bringing together disparate legacy systems [that] enterprises have had in place for some time. IW: Are you talking about single sign-on, or something else? JF: Single sign-on is an application of that. But fraud detection [can make] a decision about what advanced forms of authentication to use based on the conditions, or what kinds of transactions will manifest in certain ways, like a document request or [bill payment].Â  IW: Arenât authentication and fraud detection ultimately just parts of a bigger architectural change that will tip the scales in favor of vendors who can take care of data security in addition to authentication and storage and the networking piece? JF: Iâve been an entrepreneur for a number of years. I know that if you want to start a company and run a good company, youâve got to do something well. Weâve selected a few things to focus on and do well. Theyâre things that, in aggregate, constitute more than just a point solution. But, yes, certainly less than the array of products in unrelated areas offered by competitors. In terms of how the competition in the space breaks out in the next few years, because of the importance of fraud detection â especially in the enterprise â some very large companies are looking at the space and deciding what their strategy will be. If you have a key product like [Bharosa] fraud detection thatâs embedded deep within some of the worldâs finest enterprises, no matter how much the space matures or develops and no matter what resources competitors have, you still have to work with Bharosa. IW: In the financial services space, how much of this is being driven by FFIEC guidance around single factor authentication? Where do things stand with adoption of FFIEC? JF: There are two answers. As an objective observer, Iâd have to agree that more than 50 percent of U.S. banks will technically not comply with FFIEC-related guidance by the end of the year. However, as a principle at Bharosa, Iâm finding that FFIEC compliance has served as rocket fuel for my relatively young company. Itâs been a key driver in our growth. Weâre very much looking forward to the second phase of FFIEC guidance in 2007. Weâre also looking for the effect this guidance will have on other markets. These mandates for enterprises to update security as a function of time are great environments to work in if youâre a software company.
236933
The feature creeps Symantec and Adobe have raised objections to the inclusion of security software and electronic document technology in Windows Vista. Adobe has asked the European Commission to prevent the bundling of PDF document creation and reading tools that compete with its software.â¦
336569
A security issue has been discovered in a common feature included in several Web browsers, including Mozilla, Firefox, Opera, Konqueror and Camino.
642533
(InfoWorld) - MicrosoftÂ released its February set of security updates Tuesday, including critical fixes for bugs in Office and the scanning engine used by the company's security products. The security software flaw is of particular concern because it could, in theory, be very easily exploited by an attacker to run unauthorized software on a victim's PC. The bug has to do with the way that Microsoft's Malware Protection Engine, used by Windows Live One Care and Windows Defender, processes PDF files. Windows Defender is available for free and ships with Microsoft's Vista operating system. "An attacker could exploit the vulnerability by constructing a specially crafted PDF File that could potentially allow remote code execution when the target computer system receives, and the Microsoft Malware Protection Engine scans, the PDF file," Microsoft said in its bulletin on the patch. This engine is also used by Microsoft's Antigen and Windows Forefront Security products, meaning that Exchange servers running these products could also be compromised. Although there is not yet any known attack that exploits this flaw, it could become a serious problem for Windows users running Microsoft's security products, according to Amol Sarwate, vulnerability lab manager at Qualys. "These attacks are very difficult to avoid," he said. "These products run automatically in the background." Symantec rated this scanning engine flaw the most critical of the vulnerabilities patched on Tuesday. Microsoft actually released the patch for this flaw on Jan. 26, although it did not notify customers of this bug until Tuesday's bulletin, said Mark Griesi, a security program manager with the company's Trustworthy Computing group. Griesi said that there was no particular reason why Microsoft declined to notify customers of the update. But the fact that this was Microsoft's first security product patch since implementing its monthly system apparently contributed to the decision. "It was one of those first-time situations: 'Should we say something now or should we just wait,'" he said. "This time we decided to wait. We won't do it again." In total, six of Microsoft's 12 updates are rated as "critical," the other six have the less-serious rating of "important." Among the patches is a widely anticipated update for Microsoft Word , which fixes six bugs in Microsoft's word processing software. Hackers had been exploiting a number of these bugs in very targeted attacks over the past few months. The updates fix 20 bugs in total, including all four of the Word flaws that hackers had been exploiting, Griesi said. Other critical patches fix bugs in the ActiveX HTML Help control and Microsoft Data Access Components, both used by Windows, as well as flaws in Office and Internet Explorer.
275692
Microsoft Corp.'s Word 2003 and Excel 2003 can be crashed by attackers who feed the business applications malformed documents, Symantec Corp. reports.
337538
How far is too far when it comes to the freedom of software? Plus: Palm slipping, Windows sliding.
58499
(InfoWorld) - When Windows Vista ships next year, customers might have a tougher time getting their security software to work properly, executives from Symantec said Wednesday. At issue are two new features being introduced with Vista: an enhanced Windows Security Center as well as a feature in the 64-bit version of Vista called PatchGuard. Microsoft says it is adding these features to lock down the operating system, but Symantec believes that they will be harmful to customers by making it harder for them to use third-party software. "There's no question that they're leveraging a monopolistic position to limit customer choice," said Chris Paden a Symantec spokesman. While Symantec executives did accuse Microsoft of being more difficult to work with on Vista than with previous operating system introductions, they stopped short of accusing Microsoft of antitrust violations. "It's not anti-competitive behavior, because Vista hasn't even hit the market yet, " Paden said. Security vendors like Symantec are in a state of heightened sensitivity these days as they've begun to compete with Microsoft head-on, and the specter of further antitrust actions looms over Microsoft's every move in the security space. Last week the European Union's spokesman on competition, Jonathan Todd, warned that theÂ market could be threatenedÂ if Microsoft doesn't allow security vendors a fair chance of competing. Symantec and other security vendors dislike PatchGuard because it prevents them from accessing the Windows kernel. They say it will stop them from delivering important features like Symantec's "anti-tampering" technology, which prevents malicious programs from modifying Symantec's own software. PatchGuard will also make it more difficult for security vendors to protect against malicious software that takes advantage of kernel-level bugs, said Eric Sites, vice president of research and development with Sunbelt Software. "There are a lot of new exploits coming out that exploit kernel-level drivers, " he said. "If we're able to get into the kernel, we can watch for things like that, but with what Microsoft is doing we can't do that." Microsoft declined to be interviewed for this article, but in an interview with IDG News last week a Microsoft executive said that PatchGuard was simply an effort toÂ prevent the kernel from being misused. "We think that there's a significant amount of confusion around... certain security features in the product that we think raise the foundation," said Stephen Toulouse a senior product manager in the Security Technology Unit. "What we're doing is we're walling off the kernel from attackers, because the functionality that is currently there was never meant to be used by anybody -- by software vendors or attackers." But PatchGuard is enabled only in the 64-bit version of Windows. Because there are few 64-bit applications written for Vista, most of Vista's initial users are expected to run the operating system in 32-bit mode, and their security software will still be able to access the kernel. A more immediate issue for Symantec is many Vista users will find that both the Windows Security Center and Symantec warnings will pop up simultaneously. This doesn't happen with Windows XP because Symantec's software is able to automatically disable the Windows warnings, but with Vista users will have to turn off the Security Center themselves. This will make things unnecessarily complicated for many customers, said Rowan Trollope, Symantec's vice president of consumer engineering. "Most users can't figure out how to do that," he said. With two warnings popping up, each with different wording, users will be confused at best, and may simply begin ignoring security warnings altogether, said Sites. Some observers have speculated that Symantec may press the EU for action against Microsoft in this matter, but Trollope and Paden wouldn't say what Symantec planned to do to address these problems. "We're looking at all the possibilities now," said Trollope, "And none of them are good for customers."ADVERTISEMENTMAKE SOA REAL WITH IBM WEBSPHERE PODCASTStreamline processes and maximize efficiency within a proven service oriented architecture. Take back control of your business processes with IBM WebSphere.