Microsoft now allowing users to rename their Microsoft Account - again

Microsoft has quietly allowed people who have a Microsoft Account to rename their account again, after taking that feature away in December due to some users being unable to access their older content.



When Microsoft launched the first preview version of Outlook.com, they also allowed users to rename their Microsoft account with the old account turning into an "alias" of the new Microsoft account name. Unfortunately, some Microsoft account holders later reported they were unable to access their older emails, SkyDrive files, and other content when they changed their account name;  Microsoft decided to disable the account renaming feature in December.

Now it appears that Microsoft has fixed the problem. Neowin can now confirm that Microsoft account owners can now rename their accounts once again if they choose to do so. Microsoft claims that all of the old account information and contacts will transfer to the new account address "within 48 hours."



While that's good news for account holders, there was also a recent rumor that claimed Microsoft was going to allow those users to create up to 10 different aliases for their account. So far, there's no indication that feature has been added and it's possible that Microsoft won't be putting in the extra aliases support until they are sure that everything works with the account renaming feature.

View: Original Article

Dell: "Uncertain adoption" of Windows 8 is part of its reason to go private

Dell said that the "uncertain adoption of the Windows 8 operating system" was part of the reason why the PC company is submitting a plan to its shareholders to take Dell back to a private business.

Dell announced its plans to back turn itself back into a private company via a leveraged buyout with help from a $2 billion loan from Microsoft, in early February. The plan, which would pay owners of the company's stock $13.65 a share, is already being challenged by two alternative buyout offers from outside parties.


Dell's upcoming XPS 18 all-in-one Windows 8 touchscreen PC; a mix of tablet and desktop

While Microsoft may be chipping in to help raise the $24.4 billion needed for Dell's official leveraged buyout, a new filing made late on Friday with the U.S. Securities and Exchange Commission states that the launch of Microsoft's Windows 8 OS was part of the reason why Dell felt now is the time for its change from a public to a private business.

Dell's document states that, in the company's opinion, there are a number of challenges that are facing the PC industry. They include " ... the uncertain adoption of the Windows 8 operating system and unexpected slowdowns in enterprise Windows 7 upgrades." Dell also cited a general sales decline in the worldwide desktop and laptop PC market, along with an increase in tablets and smartphone sales from consumers, which Dell believes people could buy as substitutes for new PCs.

The SEC filing did not directly address the two competing bids for Dell from the Blackstone Group and billionaire Carl Icahn. However, it did say that, in its opinion, there were "a number of risks and challenges" if Dell were to remain a public company. In related news, Reuters reports, via unnamed sources, that Dell founder and CEO Michael Dell met privately with the senior managing directors of the Blackstone Group earlier this week. The report did not state what was discussed at the meeting nor its outcome.

View: Original Article

Flaw leaves servers vulnerable to denial-of-service attacks

A flaw in the widely used BIND DNS (Domain Name System) software can be exploited by remote attackers to crash DNS servers and affect the operation of other programs running on the same machines.

The flaw stems from the way regular expressions are processed by the libdns library that's part of the BIND software distribution. BIND versions 9.7.x, 9.8.0 up to 9.8.5b1 and 9.9.0 up to 9.9.3b1 for UNIX-like systems are vulnerable, according to a security advisory published Tuesday by the Internet Systems Consortium (ISC), a nonprofit corporation that develops and maintains the software. The Windows versions of BIND are not affected.

BIND is by far the most widely used DNS server software on the Internet. It is the de facto standard DNS software for many UNIX-like systems, including Linux, Solaris, various BSD variants and Mac OS X.

Attack can crash servers

The vulnerability can be exploited by sending specifically crafted requests to vulnerable installations of BIND that would cause the DNS server process—the name daemon, known as "named"—to consume excessive memory resources. This can result in the DNS server process crashing and the operation of other programs being severely affected.

"Intentional exploitation of this condition can cause denial of service in all authoritative and recursive nameservers running affected versions," the ISC said. The organization rates the vulnerability as critical

One workaround suggested by the ISC is to compile BIND without support for regular expressions, which involves manually editing the "config.h" file using instructions provided in the advisory. The impact of doing this is explained in a separate ISC article that also answers other frequently asked questions about the vulnerability.

The organization also released BIND versions 9.8.4-P2 and 9.9.2-P2, which have regular expression support disabled by default. BIND 9.7.x is no longer supported and won't receive an update.

"BIND 10 is not affected by this vulnerability," the ISC said. "However, at the time of this advisory, BIND 10 is not 'feature complete,' and depending on your deployment needs, may not be a suitable replacement for BIND 9."

According to the ISC, there are no known active exploits at the moment. However, that might soon change.

"It took me approximately ten minutes of work to go from reading the ISC advisory for the first time to developing a working exploit," a user named Daniel Franke said in a message sent to the Full Disclosure security mailing list on Wednesday. "I didn't even have to write any code to do it, unless you count regexes [regular expressions] or BIND zone files as code. It probably will not be long before someone else takes the same steps and this bug starts getting exploited in the wild."

Franke noted that the bug affects BIND servers that "accept zone transfers from untrusted sources." However, that is just one possible exploitation scenario, said Jeff Wright, manager of quality assurance at the ISC, Thursday in a reply to Franke's message.

"ISC would like to point out that the vector identified by Mr. Franke is not the only one possible, and that operators of *ANY* recursive *OR* authoritative nameservers running an unpatched installation of an affected version of BIND should consider themselves vulnerable to this security issue," Wright said. "We wish, however, to express agreement with the main point of Mr. Franke's comment, which is that the required complexity of the exploit for this vulnerability is not high, and immediate action is recommended to ensure your nameservers are not at risk."

This bug could be a serious threat considering the widespread use of BIND 9, according to Dan Holden, director of the security engineering and response team at DDoS mitigation vendor Arbor Networks. Attackers might start targeting the flaw given the media attention surrounding DNS in the recent days and the low complexity of such an attack, he said Friday via email.

Hackers target vulnerable servers

Several security companies said earlier this week that a recent distributed denial-of-service (DDoS) attack targeting an anti-spam organization was the largest in history and affected critical Internet infrastructure. The attackers made use of poorly configured DNS servers to amplify the attack.

"There is a fine line between targeting DNS servers and using them to perform attacks such as DNS amplification," Holden said. "Many network operators feel that their DNS infrastructure is fragile and often they go through additional measures to protect this infrastructure, some of which exacerbate some of these problems. One such example is deploying inline IPS devices in front of DNS infrastructure. Designing appropriate filters to mitigate these attacks with stateless inspection is near impossible."

"If operators are relying on inline detection and mitigation, very few security research organizations are proactive about developing their own proof-of-concept code on which to base a mitigation upon," Holden said. "Thus, these types of devices will very rarely get protection until we see semi-public working code. This gives attackers a window of opportunity that they may very well seize."

Also, historically DNS operators have been slow to patch and this may definitely come into play if we see movement with this vulnerability, Holden said.

View: Original Article

The Pirate Bay Becomes #1 File-Sharing Site as Cyberlockers Collapse

The Pirate Bay is now the most-visited file-sharing site on the Internet, taking over the lead from prominent one-click hosting sites such as 4Shared and Mediafire. After a spectacular rise in the early years of this decade cyberlockers are quickly losing ground, while BitTorrent sites continue to grow. This shift in balance can be attributed to the Megaupload shutdown, and the changes in the cyberlocker market that followed.

Less than two years ago we published an overview of the most used file-sharing sites, covering both BitTorrent and traditional cyberlockers.

At the time one-click download sites were beating BitTorrent sites by a landslide. However, the cyberlocker business changed dramatically following the Megaupload shutdown last year and now the tables have turned.

The Pirate Bay, ranked sixth last time, has become the most-used file-sharing site. While the infamous BitTorrent site certainly gained some new visitors in recent months, it mostly owes its number one spot to the traffic decline of several major cyberlockers.

The most likely explanation for the traffic drop at these sites is the Megaupload shutdown. As covered extensively in the past, many cyberlockers removed their affiliate plans, disabled public sharing or implemented other measures to keep pirates at bay.

The result is a major shift in traffic patterns, with both winners and losers. Quite a few familiar names have fallen from the list, including RapidShare, FileServe and Hotfile. Others such as Uploaded and Putlocker picked up new visitors.

The overall pattern seems to be that BitTorrent sites have regained some of the “market share” they lost earlier. Half of all sites in the file-sharing top 10 are BitTorrent related, compared to only two in 2011.
With six newcomers in the list, it’s clear that the file-sharing ecosystem has been shaken up quite a bit.

Below is the full top 10 of the most-visited general purpose file-sharing sites that are available in English. We used several traffic comparison and analytic tools to compile this list, including Compete, Quantcast and Alexa. The alexa rank is shown in the table below, as well as the # in the 2011 list.

March, 2013

#	Website	Category	Alexa rank	# 2011
torrentfreak.com
1	The Pirate Bay	Torrent index	75	(6)
2	Mediafire	Cyberlocker	115	(4)
3	KickassTorrents	Torrent index	122	(…)
4	4shared	Cyberlocker	126	(1)
5	Uploaded	Cyberlocker	170	(…)
6	Torrentz.eu	Torrent Meta-search	223	(9)
7	isoHunt	Torrent index	267	(…)
8	Putlocker	Cyberlocker	284	(…)
9	ExtraTorrent	Torrent index	305	(…)
10	Rapidgator	Cyberlocker	317	(…)

View: Original Article

Android has won: now what?

A little over five years after the creation of the Open Handset Alliance, Glyn Moody looks at Android's global market position and the challenges that Google faces to avoid Android disappearing under a plethora of other companies' interfaces and apps.



Is it really just a little over five years ago that this happened?

A broad alliance of leading technology and wireless companies today joined forces to announce the development of Android, the first truly open and comprehensive platform for mobile devices. Google Inc., T-Mobile, HTC, Qualcomm, Motorola and others have collaborated on the development of Android through the Open Handset Alliance, a multinational alliance of technology and mobile industry leaders.

This alliance shares a common goal of fostering innovation on mobile devices and giving consumers a far better user experience than much of what is available on today's mobile platforms. By providing developers a new level of openness that enables them to work more collaboratively, Android will accelerate the pace at which new and compelling mobile services are made available to consumers.

While some called the first Android phones "iPhone killers" other pundits saw its shaky beginnings, and claimed it would never beat Apple's ascendant iPhone. Today, Android commands 70% of the global smartphone market, and even more outside the US, which remains Apple's stronghold.

Or what about tablets? Remember how people said that they were different, and that Android would never beat Apple's hugely popular iPad etc etc? And yet today, as many of us predicted, Android tablets are recapitulating the smartphone story:

Smaller, cheaper Android tablets will nibble away at the iPad's market share this year. IDC on Tuesday revised its forecasts for the tablet market through 2013, which it now believes will climb to 190.9 million total units shipped. By the end of the year, IDC predicts that more Android tablets will be shipped than iPads for the first time since the iPad's 2010 debut.

IDC altered its numbers due to consumer purchasing behavior during the last quarter of 2012, during which it saw a surge in purchases of smaller tablets.

Smartphones and tablets are arguably the two most important computer sectors at the moment, because they are both spearheading a move away from the traditional desktop, dominated by Microsoft. That company's dreadful showing in both mobile and tablets is a further confirmation that this is a time of transition, when dominance is passing from Microsoft, presumably to Google.

But of course, things are never that simple. At the very moment that most people are admitting that Android has won, we are also seeing signs that victory may be slipping through its fingers. One of the clearest manifestations of that is the rise of Samsung as a smartphone manufacturer.

Even though the recent launch of the Samsung Galaxy S4 received rather mixed reviews, there was no doubt that it was a media event comparable to the launch of a new Apple iPhone (some might argue that's not a good thing...) And Samsung's product line is far deeper than Apple's: it offers over 70 different Android models, and represents around 42% of all shipments in that sector.

But the stronger Samsung gets, the less it will regard itself as part of the larger Android ecosystem. Indeed, it will be keen to differentiate itself from rival handset manufacturers, and one obvious way to do that is to slather proprietary layers on top of the underlying operating system. Once that happens, herd instinct will probably cause the others to follow suit – each trying to out-do the other in terms of the gaudy interface it puts in front of the user and the apps that are bundled, until the Android-ness of the smartphone is more nominal than real.

And it's not just the big names who will be driving Android fragmentation. Although largely invisible here in the West, Android use in China has been increasing even more rapidly than elsewhere: it has already recently achieved an amazing 90% market share of the smartphone market there.

Interestingly, its hold in urban areas is lower – only around 70% – which implies it's well over 90% elsewhere. That's because few outside the main cities can afford high-end iPhones, and most opt for low-cost Androids instead. Those are the real game-changers not just for China, but for the world. This report explains the background:

...last year large chip makers, including the Taiwan-based MediaTek and Spreadtrum, started offering “turn-key” systems: phone designs plus a set of chips with Android and other software preloaded. Spreadtrum says it may sell 100 million units this year.

Each chipset costs $5 to $10, depending on the size of a phone’s screen and other features. In total, Liang says, his cost to make a smartphone is about $40. He says he can manufacture as many as 30,000 smartphones a day for brands such as Konka Mobile and for telecom operators like China Unicom.

Google faces new challenges

This means that Android systems can already be offered for a few tens of dollars, and that price will probably fall. It's these systems that will flood emerging economies – Asia, Africa and South America – and ensure that Android emerges as the dominant player there, too. But once more, that's not necessarily good news for Google: Chinese manufacturers have no qualms about installing their own apps and interfaces. These will be Android phones only at the lowest levels, with varying levels of compatibility. As The H reported recently, the Chinese government is unhappy with Google's dominance in the smartphone market, and can be expected to encourage any move by local manufacturers to assert their independence in this way.

Unfortunately for Google, these challenges are coming at a time when Android will be largely rudderless. News that Android's creator, Andy Rubin, has "decided it’s time to hand over the reins and start a new chapter at Google" means that Android's new boss, Sundar Pichal, will be too busy dealing with internal organisational matters as he brings Android alongside Chrome to worry much about external challenges. The fact that one of those is coming from lots of obscure Chinese companies turning out ultra-cheap pseudo-Android systems will make it even harder for him to respond.

Moreover, Google's wavering commitment to openness isn't helping it to win – or even keep – friends at this critical juncture. The introduction of DRM extensions to HTML5 on Chrome OS, is one example of this. Even worse is the following:

In a shocking move, Google has recently deleted AdBlock Plus from the Android Play Store. This is hugely disappointing because it demonstrates that Google is willing to censor software and abandon its support for open platforms as soon as there's an ad-related business reason for doing so.

Until now, the internet and software development communities have relied on Google to be safely on their side when it comes to building open platforms, encouraging innovation, and giving users maximum choice about how their computers will function. But with today's news, that commitment to openness suddenly looks much, much weaker.

Nor does Google have many friends left among the handset manufacturers. After the upbeat start five years ago, the Open Handset Alliance (OHA) has faded away – the last "What's New" item on its home page is dated 18 July 2011. It is probably no coincidence that shortly afterwards, on 15 August 2011, Google acquired Motorola Mobility, thus placing itself in direct competition with the other OHA members, who were presumably pretty cheesed off.

Despite these bad things happening, it's worth emphasising how much Google has achieved with Android. Single-handedly it has established open systems and Linux as the default approach for mobile computing – both for smartphones and tablets. That may explain in part the sudden flowering of alternatives, all of which take for granted the fact that their systems will be Linux-based and open to varying degrees.

Indeed, the usually dull Mobile World Congress turned into an astonishing celebration of both those aspects. The clear stars of the show were Mozilla's Firefox OS and Ubuntu Touch, with Jolla Sailfish and Tizen playing supporting roles. Significantly, these were seen as being far more innovative than the mainstream offerings at the show.

Of course, whether all – or even any – of those can flourish is still unclear. But the fact that they even exist, let alone are being received with interest, offers an astonishing contrast with the mobile sector five years ago, when free software was largely irrelevant and almost completely ignored. For all the global successes of the new top dogs Google and Android, that is the real victory here.

View: Original Article

US deploys B-2 stealth bombers over S. Korea, North Korea readies rockets

 US deploys B-2 stealth bombers over S. Korea




SEOUL (AFP) – Two nuclear-capable US B-2 stealth bombers flew what the US military described as “deterrence” missions over South Korea on Thursday, in a move sure to further inflame tensions with the North.

The two planes, flying out of Whiteman Air Force base in Missouri, flew the 13,000 mile round-trip in a “single continuous mission,” dropping dummy ordnance on a target range in the South, the US military said in a press release.

“This …. demonstrates the United States’ ability to conduct long range, precision strikes quickly and at will,” the statement said.

The two bombers were participating in an ongoing South Korea-US joint military exercise that has infuriated North Korea and prompted threats from Pyongyang to unleash an “all out war” backed by nuclear weapons.

The use of stealth fighters will further inflame tensions, given that the North was already incensed by the participation of B-52 bombers in the exercise.

“The B-2 bomber is an important element of America’s enduring and robust extended deterrence capability in the Asia-Pacific region,” the US statement said.

In a telephone call with his South Korean counterpart Thursday, US Defense Secretary Chuck Hagel had stressed that all US military capability would be extended to the South, including “the nuclear umbrella, conventional strike means and missile defence.”

Source : Vanguard


North Korea readies rockets after U.S. show of force

 

SEOUL/WASHINGTON (Reuters) - North Korea put its missile units on standby on Friday to attack U.S. military bases in South Korea and the Pacific, after the United States flew two nuclear-capable stealth bombers over the Korean peninsula in a rare show of force.

North Korean leader Kim Jong-un signed off on the order at a midnight meeting of top generals and "judged the time has come to settle accounts with the U.S. imperialists in view of the prevailing situation", the official KCNA news agency said.

KCNA said North Korea and the United States could only settle their differences by "physical means". The North has an arsenal of Soviet-era short-range Scud missiles that can hit South Korea but its longer-range Nodong and Musudan missiles, which could in theory hit U.S. Pacific bases, are untested.

China, the North's sole major ally, repeated its calls for restraint on the Korean peninsula at a regular foreign ministry briefing on Friday and made no criticism of the U.S. flights.

"We hope that relevant parties will work together in pushing for a turnaround of the tense situation," foreign ministry spokesman Hong Lei told reporters.

On Thursday, the United States flew two radar-evading B-2 Spirit bombers on practice runs over South Korea, responding to a series of North Korean threats. They flew from the United States and back in what appeared to be the first exercise of its kind, designed to show America's ability to conduct long-range, precision strikes "quickly and at will", the U.S. military said.

The news of Kim's response was unusually swift.

"He finally signed the plan on technical preparations of strategic rockets of the KPA (Korean People's Army), ordering them to be on standby for fire so that they may strike any time the U.S. mainland, its military bases in the operational theaters in the Pacific, including Hawaii and Guam, and those in South Korea," KCNA said.

South Korea's Yonhap news agency reported there had been additional troop and vehicle movements at the North's mid- and long-range missile sites, indicating they may be ready to fire.

It was impossible to verify the report which did not specify a time frame, although South Korea's Defense Ministry said on Friday that it was watching shorter-range Scud missile sites closely as well as Nodong and Musudan missile batteries.

The North has launched a daily barrage of threats since early this month when the United States and the South, allies in the 1950-53 Korean War, began routine military drills.

The South and the United States have said the drills are purely defensive in nature and that no incident has taken place in the decades they have been conducted in various forms.

The United States also flew B-52 bombers over South Korea earlier this week.

The North has put its military on highest readiness to fight what it says are hostile forces conducting war drills. Its young leader has previously given "final orders" for its military to wage revolutionary war with the South.

ECONOMIC ZONE

Despite the hostile rhetoric from Pyongyang, it has kept open a joint economic zone with the South which generates $2 billion a year in trade - money the impoverished state can ill-afford to lose.

Pyongyang has also canceled an armistice agreement with the United States that ended the Korean War and cut all communications hotlines with U.S. forces, the United Nations and South Korea.

"The North Koreans have to understand that what they're doing is very dangerous," U.S. Defense Secretary Chuck Hagel told reporters at the Pentagon on Thursday.
"We must make clear that these provocations by the North are taken by us very seriously and we'll respond to that."

The U.S. military said that its B-2 bombers had flown more than 6,500 miles to stage a trial bombing raid from their bases in Missouri as part of the Foal Eagle war drills being held with South Korea.

The bombers dropped inert munitions on the Jik Do Range, in South Korea, and then returned to the continental United States in a single, continuous mission, the military said.

Thursday's drill was the first time B-2s flew round-trip from the mainland United States over South Korea and dropped inert munitions, a Pentagon spokeswoman said.

Victor Cha, a North Korea expert at the Center for Strategic and International Studies, said the drill fitted within the context of ramped-up efforts by the Pentagon to deter the North from acting upon any of its threats.

Asked whether he thought the latest moves could further aggravate tensions on the peninsula, Cha, a former White House official, said: "I don't think the situation can get any more aggravated than it already is."

South Korea denied suggestions on Friday that the bomber drills contained an implicit threat of attack on the North.

"There is no entity on the earth who will strike an attack on North Korea or expressed their wishes to do so," a spokesman for the South's Unification Ministry said.
Few believe North Korea will risk starting a full-out war.

Still, Hagel, who on March 15 announced he was bolstering missile defenses over the growing North Korea threat, said all of the provocations by the North had to be taken seriously.

"Their very provocative actions and belligerent tone, it has ratcheted up the danger and we have to understand that reality," Hagel said, renewing a warning that the U.S. military was ready for "any eventuality" on the peninsula.

North Korea conducted a third nuclear weapons test in February in breach of U.N. sanctions and despite warnings from China, its one major diplomatic ally.

Source : Reuters

Google shows interest in Mozilla's ASM.js

A Chrome programmer seeks support for a new Mozilla technology to bridge the C and JavaScript languages -- even though Google has competing ideas.

Some low-level benchmarks show ASM.js software outperforming ordinary JavaScript in both Firefox and Chrome, and coming close to the speed of native software.

At least some at Google want to embrace a Mozilla-backed project to speed up Web apps written with JavaScript -- even though it competes directly with Google's own Native Client and Dart programming technology.

Mozilla has been working for months on a technology called ASM.js, which it hopes will boost JavaScript performance, especially in combination with a related Mozilla-spawned technology called Emscripten. JavaScript powers Web apps such as Google Docs, and ASM.js is a special "extremely restricted" subset of the programming language that's designed to make it easier for developers to bring existing software written in the C programming language to the Web.

Yesterday, Mozilla held a coming-out party for ASM.js, announcing a cooperation with Epic to bring its Unreal game engine to ASM.js. The same day, Google effectively announced a plan to support it within Chrome's V8 engine that processes JavaScript.

"Optimizations should be added to V8 to generate good code for the ASM.js subset of JavaScript," Chrome programmer Kenneth Russell said in a Chrome feature-tracking item for ASM.js. "The implementation cost should be small compared to the potential upside -- the ability to run significant existing code bases with close to the speed of C inside the JavaScript engine."

Securing support from other browser makers is crucial to the success of a programming technology. Without that support, programmers can only target a single browser, which undermines the advantages of universality that the Web can offer.

Google didn't respond to a request for comment about its position on the matter.

Browser makers often ally to bring a new technology to market and to help coax Web programmers to use it. What's particularly notable about Google's support is that the company already has other competing projects well under way.

The C language is often used for programs like streaming-media codecs and video game physics engines, but today's browsers can't use modules written in C unless it's packaged as a browser plug-in. And increasingly, plug-ins are frowned upon because they're inconvenient to install and maintain, a security risk, and sometimes a problem for processor and battery usage.

Thus, Web developers are striking out in new directions such as ASM.js to find better ways to let browsers handle C software.

For Google, it's Native Client (NaCl) and its sibling Portable Native Client (PNaCl). This software runs a restricted set of C instructions, compiled from the original source code using special tools, and runs it in a special protected sandboxed area. C developers must adapt their software for Native Client's restrictions, but Google argues that in many cases the change is very easy, and indeed some games on the Chrome Web Store use Native Client.

Another project, less directly competitive, is a Google programming language called Dart. With it, Google hopes for a better alternative to JavaScript.

Neither NaCl nor Dart, though, has much support outside Google. No other browser makers have shown any enthusiasm for either technology, and in some cases they've been downright hostile, as in the case of Mozilla opposing NaCl and Microsoft bad-mouthing Dart. Adding new programming foundations to the Web is a very big deal, since significant developer adoption means that all browsers forever must support that foundation alongside others. And as a technical matter, supporting multiple programming foundations running simultaneously is fraught with technical complexities.

Google hopes that with NaCl, it can get browser-executed software downloaded over the Net to run with performance that's within a few percentage points of native code. Mozilla's Emscripten and ASM.js projects promise nothing close to that -- but also don't require a profound rewrite of the Web programming stack.

"It's early to say, but our preliminary benchmarks of C programs compiled to ASM.js are usually within a factor of 2 slowdown over native compilation with clang," the ASM.js FAQ says.

A compiler's job is to change software written by humans in a high-level programming language into the lower-level software a computer can understand. In the case of Emscripten, it compiles C only to ASM.js JavaScript, and the browser itself handles conversion of that software into the truly native instructions for a processor to execute. By using ASM.js, though, Mozilla expects to have much higher performance than with the ordinary, broader set of JavaScript instructions.

View: Original Article

First targeted attack to use Android malware discovered

Kaspersky uncovers trojan spread by "spear-phish" to Tibet activists.

Malware used to spy on Tibetan activists and other ethnic groups in China is nothing new. But a new Trojan discovered by researchers at Kaspersky Labs has widened the scope of this digital espionage and intimidation. The malware uses a combination of e-mail hacking, "spear phishing," and a Trojan built specifically for Android smartphones. Kaspersky claims this is the first discovery of a targeted attack that uses mobile phone malware.

On March 25, the e-mail account of a Tibetan activist was hacked and then used to distribute Android malware to the activist's contact list. The e-mail's lure was a statement on the recent conference organized by the World Uyghur Congress that brought together Chinese democracy activists and Tibet, Southern Mongolia, and East Turkestan human rights activists. The e-mail claimed to have an attachment that was a joint letter from WUC, the Unrepresented Nations and Peoples Organization, and the Society for Threatened Peoples. If the targets opened the attachment, however, they received malware packaged in an Android APK file.

When opened, the Trojan installs an app called "Conference" on the Android devices' desktops. If the app is launched, it displays a fake message from the chairman of the WUC—while sending back a message to a command and control server to report its successful installation. The malware provides a backdoor to the device via SMS messages sent by the server. On command, it returns the phone's contact lists, call logs, data about the smartphone, its geo-location data, and any SMS messages stored on it to a server via a Web POST upload.

The server itself is running on a Chinese-language configured Windows Server 2003 machine sitting in a data center in Los Angeles. In addition to providing an upload point for the data stolen from Android devices, it also hosts more Android malware in its home page and provides a public Web interface (in Chinese) that allows direct control over phones that have been infected with the malware. While the server itself is at an IP address registered to a company called Emagine Concept, a domain pointed at the machine is registered to Shanghai Meicheng Technology Information Development Co., Ltd., a Chinese company with a contact in Beijing.

Original Article: Ars Technica

KickassTorrents Circumvents Censors With New Ka.tt Domain

In a surprise move the popular BitTorrent site KickassTorrents moved to a new domain today. The immediate effect of the switch is that after the ISP blockade last week, some UK users are once again able to access the site. This is the second domain change in two years for the infamous torrent site. Previously, KickassTorrents traded its .com domain to prevent it from being seized by U.S. authorities.

With millions of visitors a day KickassTorrents (KAT) is one of the largest torrent sites on the Internet, trailing only behind The Pirate Bay.

This status has put the site on the radar of the U.S. Government and a wide variety of anti-piracy groups.

Last year this unwanted attention resulted in a nationwide ISP blockade in Italy and a week ago several UK ISPs were ordered by the High Court to follow suit.

Today, however, estranged KAT users on some ISPs in Britain can access the site again just fine. A few hours ago KickassTorrents moved from the Kat.ph domain to Ka.tt, rendering the blockades useless, at least for the time being.

On several ISPs users are unable to access the new site, which suggests these block KAT’s IP-addresses as well so the domain change does very little.

“Yes, it’s official and it was kind of unexpected. We changed our domain name from kat.ph to ka.tt [...]. Kat.ph will still be redirecting visitors to ka.tt, so your bookmarks will be fine,” KAT announces.

The statement made by the site doesn’t specify whether recent UK blockades have anything to do with the move to Trinidad and Tobago’s TLD. There are of course other reasons why the torrent site might want to switch domains (see update below).

Earlier this month KAT had its homepage removed from Google. In addition, more than a million KAT pages have been delisted from the search engine following DMCA takedown requests from copyright holders. These pages are no longer blocked on the new domain.

Or perhaps it’s a more pressing matter. It’s not unthinkable that the previous .ph registrar kindly asked KAT to find a new home, perhaps following behind the scenes lobbying efforts from copyright holders.

This is not the first time that KAT has dumped a domain to avoid being censored. Two years ago when domain seizures where in fashion KAT moved its site to the non-U.S. controlled .PH domain as a precaution.
Whatever the reason for the current change, the hundreds of thousands of KAT users who were unable to access the site directly due to the ISP blockades are happy for now.

Update: KAT informs TorrentFreak that the change was indeed made in response to the ISP blockades. Aside from Italy and the UK KAT is also blocked in the United Arab Emirates, and they want to find out how long it takes before the new domain is blocked.



View: Original Article

MPAA: "Red Flags" Make Hotfile Liable for Pirate Users

The MPAA and file-hosting service Hotfile are gearing up for their trial in a U.S. court later this year. This week the movie studios told the court that Hotfile does not qualify for safe harbor protection as it knew about the “massive infringing use” of its service, citing last week’s verdict against BitTorrent site isoHunt. The file-hosting site disputes the allegations and says that there’s no evidence of any wrongdoing on their part.

As one of the largest file-sharing sites on the Internet, Hotfile has become a prime target for Hollywood.

Two years ago the inevitable finally happened when the MPAA filed a lawsuit against the file-hosting service. Since then there have been dozens of court filings and Hotfile even sued MPAA member Warner Bros. right back for allegedly abusing its copyright takedown tools.

The case is now heading towards trial later this year but the bickering in court hasn’t stopped.

The MPAA is using its recent win against BitTorrent site isoHunt to insist that Hotfile does not qualify for safe harbor protections. In the United States, safe harbor protects service providers from being held liable for copyright infringements carried out by their users, but this right doesn’t apply when certain conditions are met.

One of these conditions is “red flag” knowledge, a situation where it is obvious that the service provider is assisting people in pirating copyrighted material. In isoHunt’s case the court raised a “red flag” because the site owner pointed users to “obviously” copyright infringing material in the forums and according to the MPAA something similar happened in Hotfile’s case.

The MPAA points out that Hotfile received and in many cases responded to hundreds of user requests for technical support, where users were downloading files with names referencing popular movies and television programs.

Hotfile disputes this in a filing of its own by pointing out that it’s far from obvious that certain titles were infringing. They note that 50% of the files were uploaded exclusively for personal storage, meaning they would fall under fair use. Hotfile further points out that some file names were rather ambiguous and that many artists and studios uploaded content themselves.

“Here there is no evidence that Hotfile ‘actively encouraged infringement’ or ‘solicited and assisted’ with ‘particular copyrighted works’ that were ‘obviously’ ‘both copyrighted and not licensed’,” the file-hosting service replies.

The MPAA responded to some of Hotfile’s arguments, pointing again to the recent isoHunt ruling (Fung II). The movie studios did not respond to the fair use argument, or the suggestion that some files were uploaded by copyright holders themselves.

“As for ‘red flag’ knowledge, Fung II’s holding that it is objectively obvious that ‘current and well-known’ movies and television programs are not ‘licensed to random members of the public’ is in all respects identical to this case.”

“There as here, the names of the files made obvious that they represented copyrighted content, and Hotfile’s attempt to distract the Court by pointing to a small number of ‘closer calls’ is no defense with respect to the vast number of instances presenting no such ambiguity,” MPAA writes.

The MPAA further told the court that under the isoHunt decision it can be argued that Hotfile doesn’t qualify for safe harbor protection because it substantially influenced the (infringing) actions of users through the affiliate system.

“Here, Hotfile’s payments to users to upload content, including infringing content, are precisely the kind of ‘substantial influence’ that, under Fung II, would disqualify a defendant from the safe harbor when the ‘financial benefit’ prong is also met,” MPAA states.

Hotfile responded to this claim by pointing out that MPAA previously stated that it reserved this issue for trial, and the file-hosting service added that their top affiliates were legitimate software distributors.

“Hotfile’s affiliate program does not have a ‘substantial influence’ over infringement, because ‘popular’ does not equal infringing: the top paid affiliates were selling open source software and the Studios’ allegedly infringed content was not even among the top 100 most downloaded files on the site,” Hotfile writes.

The latest standoff in court once again shows that both sides have totally different views on virtually every aspect of the case.

The trial is currently scheduled to start in September but it’s still not clear what will be at stake. The MPAA wants Hotfile to be shut down as soon as possible and there are still several motions for default judgment pending.

The judge now has to decide how to go forward. Whatever the outcome, the case is expected to set an important precedent for the future of similar cloud hosting services that operate in the United States.

View: Original Article

Websense: Most Java-enabled browsers vulnerable to widespread Java exploits

Most browser installations use outdated versions of the Java plug-in that are vulnerable to at least one of several exploits currently used in popular Web attack toolkits, according to statistics published by security vendor Websense.

The company recently used its threat intelligence network, which monitors billions of Web requests originating from “tens of millions” of endpoint computers protected by its products, to detect the Java versions that are installed on those systems and are available through their Web browsers. Websense provides Web and email gateway security products for businesses, but it also has a partnership with Facebook to scan links clicked by users on the social networking site for malicious content.

The Java telemetry data gathered by Websense showed that only 5.5 percent of Java-enabled browsers have the most up-to-date versions of the software’s browser plug-in—Java 7 Update 17 (7u17) and Java 6 Update 43 (6u43)—installed. These two versions were released on March 4 in order to address a vulnerability that was already being exploited in active attacks at the time.

According to Websense, an exploit for that vulnerability has since been integrated into the Cool Exploit Kit, a Web attack toolkit used by cybercriminals to launch mass drive-by download attacks that infect computers with malware when visiting compromised or malicious websites.

Cool Exploit Kit is a high-end attack toolkit that requires a subscription of $10,000 per month, so there’s an argument to be made that not many cybercriminals can afford it. However, Websense’s data shows that a large number of Java-enabled browser installations are also vulnerable to exploits used in much cheaper and widespread exploit kits.

For example, the company found that around 71 percent of Java-enabled browser installations were vulnerable to an older exploit that’s currently present in four different Web attack toolkits: RedKit, CritXPack, Gong Da and Blackhole 2.0. The exploit targets a Java vulnerability called CVE-2012-4681 that was patched by Oracle in August 2012.

More than 75 percent of the Java-enabled browsers scanned by Websense used a Java plug-in version that was more than six months old, and nearly two-thirds used a version that was more than a year old. Users of those browsers don’t benefit from the security controls introduced by Oracle in Java 7 Update 11 that prevent Java applets from running inside browsers without confirmation by default.

The data shows that when it comes to Java, zero-day attacks—attacks exploiting vulnerabilities that were previously unknown to the public—should not be getting all of the attention, security researchers from Websense said in a blog post.

Other security experts have said in the past that Oracle should find a way to improve the adoption rate of Java updates, possibly by offering the option of silent, automatic updates like Google or Adobe did in Chrome, Flash Player and Adobe Reader. Silent software updates are not popular in corporate environments, where patches need to be tested for compatibility and stability issues before being deployed on systems, but they would probably help reduce the fragmentation of Java versions in the consumer space if implemented.

View: Original Article

New Trojan Can Hack You In A "Flash"

Are you sitting down? I know this will come as a shock, and I want to prepare you. Adobe Flash is the source of a new attack against PCs. Honestly, in this case it really is not Adobe's fault (unlike some other past cases), but the software is still the vehicle used in this drive-by. Microsoft reports that Trojan:Win32/Preflayer is in the wild and changes the home page for Internet Explorer, Google Chrome, Mozilla Firefox, or Yandex.

"These sites appear to be a type of search engine, but there are pop-up advertisements displayed on the pages, and there was an instance where I was redirected to a different page not of my choosing", Jonathan San Jose, Microsoft antivirus researcher, says.

The Trojan attacks in the guise of a fake Adobe Flash update that pops up on the user's screen. According to the software giant's threat report "to trick you into thinking that it's a legitimate installer, it also downloads and runs the actual Flash Player installer". That makes this a bit scarier than the average fake Flash updates that we have grown accustomed to encountering over the past few years.

The browser home page is changed to one of the following addresses:

• www.anasayfada.net
• www.heydex.com

Microsoft details how the Trojan works in its threat report, including the attacks on Chrome, Firefox, Yandex and, of course, Internet Explorer. Microsoft also outlines steps to remove the virus, but users should probably be clued in to not get it, given that the pop-up box for installation is written in Turkish.

Folks, Flash is dangerous. It also causes non-critical, but still annoying, browser problems. Many web sites have moved on to HTML5, but for those that have not, do yourself a favor -- enable click-to-run in your web browser and pick and choose carefully where you make that click. By all means, do not trust pop-up ads. If you need to update, then visit the official Adobe site and do so manually. It really is a jungle out there.



Source: http://betanews.com/...you-in-a-flash/

It's not just you: the entire Internet is slow right now

Global internet slows after 'biggest attack in history'

The entire Internet has been experiencing a traffic slowdown this week, and it's all being blamed on a Dutch-based web host who allegedly has launched massive denial of service attacks.



If you have been trying to stream your favorite movie on Netflix today, or download your legally purchased copy of BioShock Infinite, you may be thinking that your connection is slower than normal. In this case, the problem may not be with your local ISP but with the entire Internet.

The BBC reports that the source of all these issues is a denial of service attack on the domain name servers run by Spamhaus. Its CEO, Steve Linford, claims that their servers have been under attack for over a week with peaks of 300 GB a second. Even though Spamhaus has stayed up and running, the attacks have caused Internet traffic globally to slow down.

So what caused this attack? Spamhaus also hosts blacklists that are designed to stop email spam around the world. Recently, the non-profit organization used its email spam list to block servers from Cyberbunker, a Dutch-based web hosting service. Spamhaus claims that Cyberbunker is working with other criminnal groups in Eastern Europe and Russia to launch these denial of service attacks. A spokesperson for Cyberbunker did state that in their opinion, Spamhaus was abusing their power by blocking Cyberbunker but did not actually admit to being involved in the cyber attacks.

View: Original Article