Saturday, May 7, 2011

technology news


Expert: Skype for Mac hole can be used in remote attack



by

A security researcher said today that he found a serious hole in the Mac version of Skype that could be used by an attacker to remotely take control of someone else's computer.
In response, Skype says it released a "hotfix"--a quick fix to hold users over until a full update is ready--for the issue in a minor update released in mid-April, but did not prompt users to update their software because there were no reports that the hole was being exploited in the wild and it was planning on issuing another update early next week.
Gordon Maddern, of Pure Hacking in Australia, says he discovered the vulnerability about a month ago. He was chatting on Skype to a colleague about a payload when the payload executed in the colleague's Skype client accidentally, Maddern writes in a blog post today.
He created a proof of concept that can be used in an attack but is not releasing details on it until Skype fixes the issue. He could not find the vulnerability in the Skype client for Windows and Linux, he said.
Maddern said he contacted Luxembourg-based Skype and received a note saying "Thank you for showing an interest in Skype security, we are aware of this issue and will be addressing it in the next hotfix."
"That was over a month ago and there still has not been a fix released," he wrote in his blog post. "The long and the short of it is that an attacker needs only to send a victim a message and they can gain remote control of the victim's Mac. It is extremely wormable and dangerous."
In a blog post, Adrian Asher of Skype explains that the vulnerability "is related to a situation when a malicious contact would send a specifically crafted message that could cause Skype for Mac to crash. Note, this message would have to come from someone already in your Skype Contact List, as Skype's default privacy settings will not let you receive messages from people that you have not already authorized, hence the term malicious contact."
"At the time they (Pure Hacking) alerted us, we were already aware of the issue and were working on a fix to protect Skype users from this vulnerability, as we take our users' security very seriously," Asher wrote.
Updated 4:13 p.m. PT with Skype saying it previously issued a hotfix and will release an update that addresses the vulnerability next week.


Shop thousands of destination activities worldwide!



Elinor Mills covers Internet security and privacy. She joined CNET News in 2005 after working as a foreign correspondent for Reuters in Portugal and writing for The Industry Standard, the IDG News Service, and the Associated Press.

IPad 2 frenzy in China

by John Paczkowski, AllThingsD
AllThingsD
The iPad 2 debuted in China this morning to what is fast becoming a standard reception: massive lines and quick stock-outs.
That the device had been unofficially available on the market--through sellers who brought it into the country after buying the device overseas--did little to quell demand, which drove hundreds of hopeful buyers to queue overnight outside Apple's four stores in Beijing and Shanghai. "When we arrived here at around 4 a.m., there were already more than 500 people waiting," an Apple security guard at the company's downtown Beijing store told Xinhua. "The crowd rose to some 1,000 people when the store opened."
Sales began promptly at 8 a.m., the first retail stock-out was reported about four hours later, and by Friday afternoon the iPad shipping estimates at Apple's Chinese Online Store had gone from "1-2 weeks" to "No Supply."
So a very strong first-day showing for the iPad 2 in China, and one that suggests Apple's decision to make China top priority is paying off in a very big way. According to Analysys International, Apple was able to claim a 78 percent share of China's tablet market with the first iPad. How much more will it claim now, given the staggering response to the launch of the second?
(Credit: M.I.C. Gadget)
Story Copyright (c) 2011 AllThingsD. All rights reserved.


Additional stories from AllThingsD

  1. Key Developer Joe Hewitt Leaves Facebook
  2. Exclusive: Sony Considers Offering Reward To Help Catch Hackers
  3. Zynga Document Discloses Major Round of Financing in the Works
  4. IPad 2 Frenzy in China

Analysts' takes: Apple going ARM on MacBooks?


Future MacBooks running the same ARM chips that populate the iPad and iPhone?
Future MacBooks running the same ARM chips that populate the iPad and iPhone?
(Credit: Apple)
The rumor that Apple will drop Intel chips and move future MacBooks to the same kind of silicon that powers Apple's iPhone and iPad has got analysts pondering the prospect. Here are a few reactions.
As a preface to the comments below, one analyst cited Microsoft's announcement that Windows 8 will not run exclusively on Intel chips but also on ARM--the same chip architecture that powers Apple's iPhone and iPad. So, in a way, Microsoft is already on record with a transition to ARM.
Smart move for Apple vis-a-vis its developers: "This would be, in part, an ecosystem building opportunity. It would be saying to developers that Apple has the opportunity to increase the size of the TAM (Total Available Market) for developers to write for, while also changing the face of computing by bringing key characteristics such as instant-on and long battery life to the notebook clamshell form factor." --Richard Shim, analyst, DisplaySearch.
Apple has switched architectures before but...: "Apple has switched architectures in the past, so it is certainly possible they could switch to ARM. I don't see why they would do it, though. Even with a 64-bit architecture, ARM processors will not offer performance competitive with the high end of Intel's line, so Apple might be sacrificing all of its professional users. ARM may offer some battery life and cost benefits for mainstream laptops, but given that Intel is focusing on these parameters, I don't think the benefits would be sizable. Also, as indicated by its recent 22 [nanometer] announcement, Intel has a manufacturing technology advantage that will prevent ARM from getting very far ahead, if at all. So I am skeptical." --Linley Gwennap, principal analyst, The Linley Group.
It's just a matter of time: "Apple likes vertical integration, has proven ability to migrate software among instruction sets, and can derive adequate performance from non-Intel CPUs. Thus, I think it's only a matter of time before we see Apple computers with keyboards using ARM CPUs. I agree...that it makes sense to wait for the 64-bit ARM instruction set to break cover. My guess is that they'll use a homegrown CPU out of the chute. They've had CPU-development capability long enough in house to have something ready in 2012." --Joseph Byrne, The Linley Group.
Performance, performance, performance: "The concern is performance. Who knows for sure by 2013 what ARM will have? But Intel's 22-nanometer chips will be widely available by then. That will make it tough for other people to compete on a raw performance basis. You can offset by saying we're at the point where there's good-enough computing [so] we don't need that performance. But that's a hard argument to accept because we've said that for years. And yet people keep wanting to buy faster and faster PCs. Oh, and by the way, new software soaks up any extra CPU cycles. That said, over the years [Apple has] done two huge instruction set transitions and they've done them very successfully. So, it's not out of the realm of possibility--in order to give [Apple] a single instruction set in a combined platform. And they could do it in phases, where the MacBook Air stuff goes to iOS and ARM and they keep the higher-end stuff on Intel." --Bob O'Donnell, analyst, IDC
The risk factor: "Has Apple beefed up its chip team? I don't think they have. Besides, silicon is not their forte. I think it would be a strategic mistake. Intel can offer them extremely competitive products, leading-edge process technology, and throwaway prices. So, what's the advantage? There's going to be more risk than upside. If they misexecute on a product line, then the entire product strategy is at risk. And the price-premium argument completely goes away." --Ashok Kumar, analyst, Rodman and Renshaw

Ringbow: A new way to click a touch screen



The Ringbow is a wireless accessory controller designed for touch-screen devices.
(Credit: Rafe Needleman/CNET)
At a California Israel Chamber of Commerce demo event yesterday, I got a walk-through of an unusual and, as-pitched, probably hopeless idea for improving the interface of touch-screen devices: The Ringbow, a ring-mounted, wireless pointing stick.
The Ringbow does solve a problem in an elegant way. Touch-screen apps generally have only limited ways to control them, so access to menu commands or secondary functions requires trips to full menus, which slows down the user. The Ringbow is a finger-mounted five-way controller (four compass directions plus pushing down) that makes blasting through accessory menus faster than it would be in most apps.

Also at CICC: Fellowup, the Grandma-approved contact manager
In a demo (see video; note that the wire is for an extra battery pack the prototype device requires), selecting drawing submenu options (color picker, line weight chooser, pen type), and then making selections in those submenus, was much faster than it would otherwise be. Ringbow CEO Efrat Barit proposes that software vendors who make complex graphical apps (such as Adobe) could make their products easier and faster to use for professionals by adding Ringbow shortcuts.
There are also benefits in games, where a ring-mounted controller adds a lot of control options that one otherwise doesn't have in a touch-screen device.

Adding functionality to touch screens

However, I am skeptical that developers will pick up on this new concept in great numbers, despite Barit's statement that mobile apps developers are "excited" about the technology. There's just this huge chicken-and-egg problem here: You don't want to develop for an accessory nobody has, and nobody's going to buy a Ringbow without software that uses it.
I did use a Ringbow and can confirm that it does indeed make a touch-screen application's user interface faster (at least it did in the demo I tried), but clever developers could add new modalities to their apps without requiring new hardware. Multitouch concepts can be used for direct access to menu options; already users are familiar with "pinch" and "rotate" gestures, and OS X users are accustomed to a two-finger tap on a trackpad as the equivalent of a right-click on a mouse. Other multitouch gestures could be added to the touch lexicon for other functions. An expanded multitouch interface might not be as fast as a Ringbow, but at least developers won't have to worry about users who don't have the device.
Rather than the Ringbow getting traction in consumer apps and games on touch-screen devices, I see it being used in other specialized environments. It'd be great as a secondary controller in military and service vehicles, and arguably very useful for people who otherwise have their hands full but need access to technology--in medicine, perhaps. I would not bet against this technology being taken up in military and industrial applications, but it's too early in the history of touch-screen devices to say they need this kind of hardware to make them more usable.


Mozilla fights DHS over anti-MPAA, RIAA utility

No judge has ever declared a Firefox plug-in called MafiaaFire Redirector to be illegal. But that didn't stop the U.S. Department of Homeland Security from trying to censor it from the Web.
The Mozilla Foundation says DHS requested the removal of MafiaaFire, which describes itself as a utility that "automatically redirects you to the correct alternate site" if the main domain has been seized by the U.S. government.
Harvey Anderson, Mozilla's general counsel, told CNET today that the request from DHS was made over the phone. Anderson replied in writing, posing a list of questions in an April 19 e-mail, including this important one: "Is Mozilla legally obligated to disable the add-on?"
Anderson says DHS hasn't replied, and the plug-in has not been removed.
A DHS spokesman told CNET this afternoon that "ICE's Homeland Security Investigations does not comment publicly on our interaction with Internet intermediaries on intellectual property theft enforcement issues." ICE stands for the Immigration and Customs Enforcement division.
The reason DHS doesn't like the MafiaaFire plugin is obvious: It makes the government's tactic of seizing domain names less useful. FirstRow.net, Atdhe.net, and Torrent-Finder.com are among the domains seized on grounds that they're allegedly infringing copyrights of U.S. companies.
One response to a domain name seizure is, simply, to move to a new one, preferably in a top-level domain that can't be easily reached by DHS and the U.S. judicial system. That's what the popular sports video-streaming Web site, Atdhe.net, did after its domain went offline. It's now at Atdhenet.tv (and, just in case, Atdhe.me as well).
MafiaaFire helps to make this process a little easier by redirecting Firefox automatically to the replacement Web site. Its unflattering name arose out of a protest against the RIAA and MPAA--aka "the Music and Film Industry Association of America"--and the "mad-with-power ICE."
If a government official applies pressure on a private company to delete a file or document, that can raise constitutional and free speech issues. In the 1963 case known as Bantam Books v. Sullivan, the U.S. Supreme Court ruled that a commission's extra-judicial notification that some books or magazines were objectionable was an illegal "system of informal censorship."
"Whether the add-on is unlawful, or whether any speech is unlawful, is for the courts to determine, not for DHS to determine," says Aden Fine, staff attorney with the ACLU's Speech, Privacy and Technology Project. "Nobody from DHS should be going around trying to get speech removed from the Internet before a court decides."

Exclusive: Third attack against Sony planned

A group of hackers says it is planning another wave of cyberattacks against Sony in retaliation for its handling of the PlayStation Network breach.
An observer of the Internet Relay Chat channel used by the hackers told CNET today that a third major attack is planned this weekend against Sony's Web site. The people involved plan to publicize all or some of the information they are able to copy from Sony's servers, which could include customer names, credit card numbers, and addresses, according to the source. The hackers claim they currently have access to some of Sony's servers.
Should the planned attack succeed, it would be the latest blow in a series of devastating security breaches of Sony's servers over the past month. The failure of Sony's server security has ignited investigations by the FBI, the Department of Justice, Congress, and the New York State Attorney General, a well as data security and privacy authorities in the U.K., Canada, and Taiwan.
Several weeks ago the hacker group known as Anonymous targeted several Sony Web sites, including Sony.com and SonyStyle.com, with a distributed denial-of-service (DDoS) attack in retaliation for what its members saw as Sony's unfair legal action against hacker George Hotz. Two weeks ago Sony's PlayStation Network, along with its Qriocity service and Sony Online, were the target of an attack that exposed the personal information of more than 100 million Sony customers. Sony was forced to shut down PSN, Qriocity, and Sony Online, and is currently working to bring them back online after rebuilding the security of its servers.
Sony says it doesn't know who orchestrated what it's calling a "highly sophisticated, planned" attack, but it has dropped hints that the group Anonymous is involved. Kazuo Hirai, chairman of Sony Computer Entertainment, told a Congressional subcommittee in a letter yesterday that the intruders on its servers planted a file named "Anonymous" containing the statement "We are Legion," part of the group's tagline.
Anonymous issued a statement yesterday denying it was involved in the PSN breach. "While we are a distributed and decentralized group, our 'leadership' does not condone credit card theft," the statement said.
Now it seems the same group of hackers that was able to infiltrate the PSN servers is planning to hit back against Sony.
Sony did not immediately respond to a request for comment.

NASA delays Endeavour launch until at least May 16

NASA said today that it has decided to push back the final launch of the space shuttle Endeavour until at least May 16. This is the third delay since the shuttle's April 29 launch was scrubbed due to problems with its hydraulic systems.

The shuttle Endeavour atop pad 39A shortly after a launch scrub was announced on April 29. NASA said today it would delay the launch until at least May 16.
(Credit: NASA TV)
In a release, NASA said that Endeavour will launch no earlier than May 16. After the April 29 scrubbing, the agency targeted May 2, then May 8, and now mid-May at the earliest. NASA managers have got to be worried that each subsequent delay is threatening the space shuttle program's last-ever launch, that of Atlantis, which is currently slated for June 28.

NASA said it will hold a press conference Monday to update the public on the status of repairs to Endeavour's hydraulic systems. "Kennedy [Space Center] technicians are continuing work to resolve an issue in a heater circuit associated with Endeavour's hydraulic system that resulted in the [April 29] launch postponement," NASA said in a release today. "Technicians determined the failure was inside an aft load control assembly, which is a switchbox in the shuttle's aft compartment, and possibly its associated electrical wiring."
The agency acknowledged that it has yet to uncover the underlying cause of the switchbox failure, but said its technicians are substituting hardware that might have been the problem. "This weekend, technicians will install and check out new wiring that bypasses the suspect electrical wiring connecting the switchbox to the heaters," the release stated. "They will also run the heaters for up to 30 minutes to verify they are working properly and complete retesting of the other systems powered by the switchbox."
While NASA is currently targeting May 16 as the earliest possible date for launching Endeavour on its final mission, the agency said that there are launch opportunities available until May 26. It did not address what would happen if Endeavour cannot be launched until after May 26, but presumably that would mean that the Atlantis mission would have to be pushed back.

Seinfeld launches a Web site for 10-year-olds

Not everyone finds Jerry Seinfeld funny. And those who do find him funny don't find all of him funny.
Seinfeld seems to understand this and has decided to use the Web in order to portion out his finer moments.
This week, he launched JerrySeinfeld.com, a place that says it's a personal archive. But it isn't a site that hosts every single skit, show and stand-up that Seinfeld performed.
Instead, it's a site for 10-year-olds.
Why, suddenly, would Seinfeld be interested in young kids? For this, you merely have to click on the "What is This?" section of the site.
"When I was 10 years old, I started watching stand-up comedians on TV. I fell in love with them and I'm just as fascinated with stand-up comedy today," he says.

Seinfeld in his bow tie period.
(Credit: CC Alan Light/Flickr)
So, with this site, he's releasing three little bits of himself every day. But he's only releasing the bits that still amuse him. In addition, he says that he will be posting new things he's doing.
But, at heart, it really is for the young, the excitable, those who still bathe in the wonderment of what might be, rather than the nostalgia of what has gone.
"Somewhere out there are 10-year-olds just waiting to get hooked on this strange pursuit," Seinfeld says on the site. "This is for them. I'm just hoping somehow it will keep this silliness going."
Silliness is something that needs to be curated. I am, frankly, astonished that there isn't a National Society for the Protection of Silliness. Especially in the US of A.
Indeed, Seinfeld--a strange, populist sort of Kafka--has resolutely defended the sillinesses of life against assaults from all sorts of hideous sectors and lobbies.
How reassuring that he has chosen to release consistent spurts of silliness onto a Web that is mired in the hacking and shellacking of others.
And no one understands silliness better than 10-year-olds.



Volkswagen to produce a range of plug-ins in 2013

The 260 mpg Volkswagen XL1 concept car.
The 260 mpg Volkswagen XL1 concept car.
(Credit: Volkswagen)
Volkswagen jumped on the plug-in bandwagon and will produce a range of plug-in hybrid vehicles starting in 2013. Volkswagen CEO Martin Winterkorn made the announcement at the Vienna Motor Symposium this week, but he didn't specify which vehicles will get the plug-in power-train.
"The plug-in hybrid offers precisely what many customers expect: unlimited internal combustion engine performance combined with attractive electric mobility ranges in everyday driving," Winterkorn said. The company acknowledges that electric vehicles will play a large role in the automotive future, but finds plug-ins to be a happy medium until infrastructure, technology, and consumers make pure EVs a viable option.
Earlier this year, the German auto manufacturer debuted the XL1 concept plug-in car at an auto show in Qatar. Based on the L1 concept, the gullwinged tandem two-seater has a carbon fiber chassis and is powered by a 48-horsepower two-cylinder TDI engine and an electric motor that produces 27 hp. The lightweight aerodynamic vehicle reportedly achieves up to 260 mpg.
VW will begin limited series production of 100 XL1s in 2013, said Winterkorn in an interview with Automotive New Europe. Germany will be the first country to receive the XL1, followed by the U.S. and China at a later date.

SF shelves cell phone radiation ordinance


San Francisco officials have indefinitely delayed implementation of the city's Right to Know ordinance, which would have required retailers to display a phone's Specific Absorption Rate (SAR) at the point of sale and distribute materials educating consumers on cell phone radiation. A revamped version of the legislation is likely to be introduced in its place, but no further details have been announced.
First passed last June, the ordinance (PDF) quickly prompted a lawsuit from the wireless industry's lobbying arm, the CTIA. In addition to claiming that the law was unconstitutional because only the FCC and FDA have oversight over radio frequency emissions, the CTIA contended that the SAR provision was misleading to consumers and that it infringed on the First Amendment rights of retailers.
As a result of the lawsuit, the San Francisco Board of Supervisors delayed the ordinance's implementation date several times--most recently to June 15--and held two closed door meetings with City Attorney Dennis Herrera's office to discuss the issue. Board members wouldn't tell CNET what transpired during the meetings nor would they comment on the CTIA's warning that the city would be stuck with its legal fees if the trade group won the lawsuit.
It's clear, however, that the city isn't backing down completely. Supervisor John Avalos, who voted for the measure last year, could introduce amended legislation as early as next week. Though Frances Hsieh, one of Avalos' legislative aides, wouldn't discuss specifics, it's expected that any amendment will remove the SAR provisions.
"We're working with the Mayor's Office, the City Attorney's Office, and advocacy groups to vet out the specifics," she said. "We want a solid set of amendments when we introduce them."
Ellen Marks, the director of government and public affairs for the Environmental Health Trust, supported the original legislation. Marks said she's fine if the SAR provision is removed from the ordinance, but she'd like to see something similar to a new California State Senate bill that would require a radio-frequency warning label on phones and product packaging.
The ordinance "is only a temporary hold," she told CNET. "I have positive feelings that the city will stand up to this frivolous lawsuit and move forward with amendments."

Read more: http://www.cnet.com/8301-17918_1-20060548-85.html#ixzz1LexR2XnJ

Google help wanted: Antitrust lawyer


It's the confluence of two phenomena: Google is on a hiring binge and the company is increasingly under regulators' antitrust microscope. So the search giant is looking to hire a new antitrust lawyer.
The company posted a help wanted ad on LinkedIn looking for a "Competition Counsel" at their Mountain View, Calif., headquarters. The job posting was first reported by Bloomberg.
The posting describes the role as one that both helps guide product development as well as participate in legal matters. "You'll be willing and able to work on a variety of competition matters including antitrust litigation and regulatory proceedings. You must be well suited to providing internal counseling on a wide variety of projects and business practices," according to the posting.
Regulators have ratcheted up their antitrust probes of Google as the company grows and reaches into new markets. Last month, the company signed a consent decree with the Department of Justice to secure approval for the company's $700 million deal to buy travel technology provider ITA Software. Citing antitrust concerns, a federal judge in March rejected a settlement the company struck with authors and publishers in an effort to digitize every book ever published. And in November, the European Commission opened an investigation into complaints that it was skewing search results against rivals.
Google has said, as recently as its quarterly earnings call last month, that 2011 will be the biggest hiring year in the 24,400-employee company's history.

Read more: http://news.cnet.com/8301-1023_3-20060572-93.html#ixzz1Lexp1jqf

DARPA seeks help for interstellar starship

DARPA wants to go to the stars.
Yesterday, the Defense Advanced Research Projects Agency issued a call for concepts for a 100-year starship study program. The idea? To motivate research that could potentially "develop a viable and sustainable model for persistent, long-term, private-sector investment into the myriad of disciplines needed to make interstellar space travel practicable and feasible."

This, one can imagine, is the kind of feasibility study that would have been necessary decades ahead of time if the starships at the center of shows like "Star Trek," "Babylon 5," and "Deep Space 9" had really existed.
DARPA may be peopled with dreamers, but it also has a pretty impressive track record. Its predecessor, ARPA, played a central role in the creation of the Internet, and among many other accomplishments, DARPA researchers helped inspire autonomous cars via the agency's DARPA Grand Challenge, and they helped bring about stealth-fighter technology.
DARPA did not respond to a request for comment.
So while some are certainly going to scoff at the notion of a 100-year project (PDF file) to explore interstellar space, DARPA's ambitions should not be taken lightly. Particularly given some of the reasons behind the would-be project, and the steady decline in America's development of young engineers, mathematicians, and technologists.
"The genesis of the 100 Year Starship Study is to foster a rebirth of a sense of wonder among students, academia, industry, researchers, and the general population to consider 'why not,'" DARPA wrote in its request for information, "and to encourage them to tackle whole new classes of research and development related to all the issues surrounding long-duration, long-distance spaceflight. DARPA contends that the useful, unanticipated consequences of such research will have benefit to the Department of Defense and to NASA, and well as the private and commercial sector."
But because today's financial realities preclude the massive amount of investment that would be required to undertake a very long-term project like the development of a starship, DARPA is understandably turning to outside interests to begin the work. The agency said is is looking for "ideas for an organization, business model, and approach appropriate for a self-sustaining investment vehicle. The respondent must focus on flexible yet robust mechanisms by which an endowment can be created and sustained, wholly devoid of government subsidy or control, and by which worthwhile undertakings--in the sciences, engineering, humanities, or the arts--may be awarded in pursuit of the vision of interstellar flight."
This calls to mind, of course, large-scale competitions like those put on by the X Prize Foundation. On the other hand, the phrase "wholly devoid of government subsidy" would seem to prohibit the offering of a substantial prize to someone deemed successful at answering DARPA's requirements. It did say that it expects to offer someone not more than several hundred thousand dollars in start-up expenses in order to meet its requirements.
In particular, those requirements include: "Long-term survivability over a century-long time horizon;" "Self-governance, independent of government participation or oversight;" "Self-sustainment, independent of government funding;" and "Relevance to the goal of moving humanity toward the goal of interstellar travel, including related technological, biological, social, economic, and other issues."
These are grand goals, and it's hard to imagine anyone reading these words being alive to see the conclusion of a project like this. Yet without such ambitions, our society would almost certainly lose the benefits that could come from the realization of such goals, benefits that come from the spread of government-sponsored technology to educational institutions and private industry--and from the wonder such projects inspire in people young and old. This may be wishful thinking on DARPA's part, but how can we not wish to go along for the ride?