Gregarius » BetaNews.Com » février 23, 2013

BetaNews.Com (4 non lus)

Microsoft claims expired SSL Certificate caused Azure outage

Publié: février 23, 2013, 4:47pm CET par Alan Buckingham

Microsoft's cloud service, Windows Azure, along with Team Foundation Service, suffered a major outage yesterday that also affected non-enterprise people, as it resulted in problems with the Xbox Live as well. However, according to the Xbox Status page, the Live system, along with Xbox Music and Video, which were also affected, is back up and running.

Now, as of this morning we have some information on the root cause of the much-publicized problem. Brian Harry, Product Unit Manager for Team Foundation Server, blames the nine-hour outage on "an expired SSL certificate in Windows Azure storage". Harry goes on to explain that the company stores "source code files, Git repos, work item attachments and more" there and that "the expired certificate prevented access to any of this information, making much of the TFService functionality unavailable".

Ironically, this is not the first time the company has been plagued by this problem. Several years ago Team Foundation Services was hit by an expired certificate which it blamed on an operational oversight. Harry promises that the company will be investigating what led to this most recent oversight and went on to state "I apologize to all of our affected customers and hope you’ll give us a chance to learn and continue to deliver you a great service".

Photo Credit: Ralf Juergen Kraft/Shutterstock
Mac malware invades Microsoft, too

Publié: février 23, 2013, 3:11am CET par Joe Wilcox

How's this for a helluva endorsement for Windows security over OS X? Today, Microsoft acknowledged falling prey to "similar security intrusion" as Apple and Facebook. They got nabbed by a Java exploit affecting Apple's OS.

"We found a small number of computers, including some in our Mac business unit that, were infected by malicious software using techniques similar to those documented by other organizations", says Microsoft security chief Matt Thomlinson.

Apple made similar admission on February 19 and Facebook a week ago. Apple issued an OS X fix removing Java, while Facebook disabled the tech. Microsoft disclosed no such action for its users. Party line: No data was taken.

Facebook offers the most details on what happened: "After analyzing the compromised website where the attack originated, we found it was using a 'zero-day' (previously unseen) exploit to bypass the Java sandbox (built-in protections) to install the malware. We immediately reported the exploit to Oracle, and they confirmed our findings and provided a patch on February 1, 2013, that addresses this vulnerability".

My question: Who among the big companies discloses next? Surely these three aren't the only ones running Macs and Java.

Microsoft's full statement:

As reported by Facebook and Apple, Microsoft can confirm that we also recently experienced a similar security intrusion.

Consistent with our security response practices, we chose not to make a statement during the initial information gathering process. During our investigation, we found a small number of computers, including some in our Mac business unit, that were infected by malicious software using techniques similar to those documented by other organizations. We have no evidence of customer data being affected and our investigation is ongoing.

This type of cyberattack is no surprise to Microsoft and other companies that must grapple with determined and persistent adversaries (see our prior analysis of emerging threat trends). We continually re-evaluate our security posture and deploy additional people, processes, and technologies as necessary to help prevent future unauthorized access to our networks.

Matt Thomlinson
General Manager
Trustworthy Computing Security

Photo Credit: Jirsak/Shutterstock
Expect more-sophisticated Bank DDoS attacks this year

Publié: février 23, 2013, 1:40am CET par Joe Wilcox

What's the end of February without some scare tactics? Gartner warns that one-quarter of distributed denial of service attacks this year will be against applications. Really? That low? I'm surprised the number isn't higher. After all, as enterprises shore up the network perimeter, HTTP remains open wide enough to drive a freight train through and for that long duration.

The attacks seek to overtax CPUs, disrupt applications and, ultimately, distract IT and security personnel. While they look over there, the bad boys are work over here. Gartner sees DDoS attacks as part of a larger trend singling out financial institutions.

"A new class of damaging DDoS attacks and devious criminal social-engineering ploys were launched against U.S. banks in the second half of 2012, and this will continue in 2013 as well-organized criminal activity takes advantage of weaknesses in people, processes and systems", Avivah Litan, Gartner vice president, says. He emphasizes there is a "new level of sophistication in organized attacks against enterprises" and that "they will grow in sophistication and effectiveness" this year.

These attacks increase in intensity -- blasting some financial institutions with up to 70 Gbps of "noisy network traffic", via ye old Internet pipes. 5 Gbps are more typical.

"To combat this risk, enterprises need to revisit their network configurations, and rearchitect them to minimize the damage that can be done", Litan says. "Organizations that have a critical Web presence and cannot afford relatively lengthy disruptions in online service should employ a layered approach that combines multiple DoS defenses".

I guess unplugging the Internet isn't the answer. How will we do online banking?

Photo Credit: Seleznev Oleg/Shutterstock
Apple nearly catches up to Samsung in smart-connected device shipments

Publié: février 23, 2013, 12:05am CET par Joe Wilcox

Analysts wouldn't generate new business without something fresh to sell. So they create new categories to tabulate, or dream up strange labels to describe them. Few quarters back, IDC rolled up PCs, smartphones and tablets into the "smart-connected devices" segment. Four things counted separately became something new, which also give schmoes like me something else to write about.

Yesterday, while my heart nearly failed writing about Chromebook Pixel, IDC released numbers for the segment, claiming 28.3 percent growth for fourth quarter and 29.1 percent for all 2012. Samsung nudged ahead of Apple to top the category for the quarter, with slightly wider lead for the year. Considering that smartphones make up 60.1 percent of the segment, the top-five ranking makes sense: Lenovo, HP and Dell follow the leaders. The two bottom-feeders mostly sell PCs, which lost share year over year.

Samsung actually snatched the top spot from Apple, with share rising to 21.2 percent from 14.6 percent for the quarter and to 20.8 percent from 12.3 percent for the year. The fruit-logo company moved up to 20.3 percent share from 20.1 percent in Q4 and to 18.2 percent from 16.3 percent for all 2012. However, Apple's quarterly nudge, which seemingly is nothing, hides more dramatic changes from earlier in the year.

"The fourth quarter market share numbers showed a fairly dramatic resurgence for Apple" Bob O'Donnell, IDC program vice president, explains. "After falling well behind Samsung early in 2012, Apple came roaring back in final quarter of the year thanks to its latest hits -- the iPhone 5 and the iPad Mini -- and reduced the market share gap to less than a single percentage point. The question moving forward will be whether or not Apple can maintain its hit parade against the juggernaut of Samsung".

Both vendors largely benefited from smartphones and tablets -- the latter accounted for 10.7 percent of smart-connected device shipments last year. Smartphone shipment rose 46.1 percent and tablets 78.4 percent year over year in 2012. Meanwhile, desktop PCs fell by 4.1 percent and laptops by 3.4 percent.

"Smartphones and tablets are growing at a pace that PCs can't realistically keep up with because of device prices and to some extent disposability", Ryan Reith, IDC program manager, says. "The average selling price for a tablet declined 15 percent in 2012 to $461, and we expect that trend to continue in 2013. However, smartphone APSs are still lower at $408. We expect smartphones to continue to carry a shorter life cycle than PCs for the years to come based on price, use case, and overall device size".

In other words, phones will dominate the category for some time to come.

Photo Credit: CLIPAREA l Custom media/Shutterstock