Ryan Clothier

Microsoft today confirmed that exploit code published last week can compromise PCs running older versions of Internet Explorer (IE), but said its security team has not yet seen any in-the-wild attacks. IE6 and IE7 account for more than 41% of all browsers used worldwide, according to the most recent data from metrics firm Net Applications. The attack code, which was posted Friday to the Bugtraq security mailing list , affects both Internet Explorer 6 (IE6) and the newer IE7, Microsoft acknowledged. "Microsoft can confirm that the publicly available exploit code affects IE6 and IE7, not IE8," a company spokesman said in an e-mail reply to questions today.

IE8, meanwhile, has an 18.1% market share. According to Danish vulnerability tracking vendor Secunia, the flaw is in IE's layout parser , and could be exploited by hackers to hijack fully-patched Windows XP Service Pack 3 (SP3) machines. Over the weekend , Symantec researchers took note of the exploit code, but said that it was shaky. "The exploit currently exhibits signs of poor reliability, but we expect that a fully-functional reliable exploit will be available in the near future," the security company's analysis team said in an entry on a company blog Saturday. Secunia rated the vulnerability as "highly critical," its second-highest threat ranking. Windows Vista, for example, ships with IE7. Windows 7, however, relies on the unaffected IE8. The company also declined to spell out plans for quashing the IE bug. "Microsoft is investigating new public claims of a possible vulnerability in Internet Explorer," the spokesman said, using boilerplate that the company regularly rolls out when it's asked about patching progress. "Once we're done investigating, we will take appropriate action to help protect customers ... [which] may include providing a security update through the monthly release process, an out-of-cycle update or additional guidance to help customers protect themselves." Microsoft will issue its next scheduled security updates in a little more than two weeks on Dec. 8. One security researcher said it's unlikely Microsoft will move fast enough to make that deadline. "Seeing as though they haven't even posted an advisory, and with the holiday this week, I'm doubting a Dec. 8 release," said Andrew Storms, director of security operations at nCircle Network Security. Microsoft declined to answer questions about which versions of Windows are vulnerable.

More likely, said Storms, is that Microsoft will offer steps that IE6 and IE7 users can take to defend themselves. To turn off JavaScript, users should select the "Tools" menu in IE, then click "Internet Options," the "Security" tab and the "Internet" content zone. On Saturday, Symantec recommended that users disable JavaScript in IE6 and IE7, a move that could stymie attacks, since the current exploit code requires JavaScript. Next, click "Custom Level" and in the "Settings" box, click "Disable" under "Active scripting." Click "OK" in the current dialog box, as well as the next.

WASHINGTON - One obvious follow-up question to the U.S. government's announcement this month that the federal stimulus has created or saved 30,000 jobs so far is this: How many were IT and engineering jobs? There is no information at Recovery.gov concerning the types of jobs either saved or created from the $16 billion in contracts awarded so far, representing 2% of the $787 billion stimulus. Unfortunately, there isn't an answer.

The Recovery Accountability and Transparency Board that provides Recovery.gov, designed to allow citizens to track funding, is posting only what it gets in reports from recipients. "We are not analyzing it in terms of types of jobs," said a board spokeswoman. "That sort of analysis may be made at a later date, once we get the additional recipient reports on grants and loans posted on the Web site," but there's no time frame for providing it, she said. This barebones information makes a rough guess possible about the quality of jobs based on description of the work, but that's it. "One of the primary reasons for the stimulus money is to create jobs and one of the primary things we would like to know from this data is what kinds of jobs were created, said Tony Fisher, the president and CEO of data management firm DataFlux Corp. The Recovery.gov site includes interactive maps and spreadsheets showing companies that have received the data, the number of jobs created or saved, and a description of some of the work. He blamed the lack of detailed information on an absence of data, a lack of consistency to the data we have and insufficient rules governing how that data is supposed to be collected and displayed. "[Recovery.gov] falls short in a number of respects in helping users understanding spending," said Craig Jennings, a senior policy analyst for OBM Watch, a nonprofit government watchdog group. This prompted the creation this month of the Coalition for and Accountable Recovery, which represents about 30 groups.

Among the problems is site navigation difficulty and an inability to search by recipient. Along with OBM Watch, some of its other members include the Center for Responsive Politics, OMB Watch, Sunlight Foundation, Economic Policy Institute. The stimulus is expected to create IT jobs but there's never been any estimate about how many. The groups criticized the usability of the Web site, and said it needed functions, such as ability to search by recipient. Both IT and engineering jobs have declined in the recession. Mark Loughbridge, IBM's chief financial officer, said this month that public sector was again the fastest growing sector with 2% growth, led by health care and education. "Now I think this is quite logical given the rollout of stimulus spend globally," he said told analysts on a third quarter earnings call this month.

However, IT firms are expecting the stimulus to perk up spending. Meanwhile, Sun Microsystems Inc. said this week it is cutting 3,000 jobs as it awaits the acquisition of Oracle Corp.

Europe's head of competition has criticized Oracle for what she characterized as a lack of cooperation over the investigation of Oracle's planned acquisition of Sun Microsystems, a spokesman for the European Commission said. Kroes said the Commission was willing to move quickly toward a final decision but "underlined that a solution lies in the hands of Oracle," according to the spokesman. In a meeting with Oracle President Safra Catz in Brussels on Wednesday, Competition Commissioner Neelie Kroes "expressed her disappointment that Oracle had failed to produce, despite repeated requests, either hard evidence that there were no competition problems or, alternatively, proposals for a remedy to the competition problems identified by the Commission," a Commission spokesman said.

An Oracle spokeswoman said the company declined to comment. The Commission said it was concerned about Oracle, the world's top seller of database software, taking ownership of MySQL, the leading open-source database, which Sun acquired last year. Oracle's proposed US$7.4 billion Sun acquisition was approved by U.S. regulators in August, but two weeks later the Commission announced it would launch an investigation of the deal, citing "serious concerns" about its effects on competition in the database market. Oracle had hoped to complete its acquisition of Sun by now, but the Commission's probe, which could last up to 90 days, has held up the deal and may not be completed until January. Oracle CEO Larry Ellison said last month that Sun is losing $100 million a month while it waits for the deal to close.

Meanwhile Sun's sales have been declining as rivals IBM and Hewlett-Packard take advantage of the uncertainty around Sun's business with aggressive migration plans. He has also asserted that Oracle's database competes with Microsoft's SQL Server and IBM's DB2 products, and not with MySQL. Sun announced a big round of layoffs yesterday, citing the additional time it is taking to close the deal with Oracle. Oracle is widely expected to make deeper job cuts if the deal closes. The company said it will lay off 3,000 workers around the world over the next 12 months.

Apple will launch a tablet-style device sporting a 9.6-inch display in February 2010, according to sources cited by a Taiwanese Web publication today. The tablet will feature the 9.6-inch screen, the multi-touch user interface made famous by the iPhone and iPod Touch, and a processor created by P.A. Semi, the Santa Clara, Calif. microprocessor design company that Apple purchased over a year ago . Apple's device will also reportedly include a HSPDA (High Speed Download Packet Access) module. The Taiwan Economic News said industry sources have claimed several component suppliers are building parts for an upcoming Apple tablet computer, which will launch in about five months.

HSPDA is the 3G cellular data protocol used by AT&T in the U.S.; AT&T is currently Apple's exclusive carrier partner in the United States. Verizon uses the EVDO Rev. T-Mobile, which is an Apple partner in Germany and Austria, also uses HSPDA in the U.S. If true, it would put the brakes on rumors that Verizon , which has supposedly been in talks with Apple, will replace AT&T on the computer maker's A-list. A (Evolution-Data Optimized) data protocol instead. Talk of such a device, which some analysts have dubbed an "iPod Touch on steroids," has been both brisk and long-running. The selling price for Apple's tablet, said the Taiwan Economic News 's sources, will be between $800 and $1,000. This is far from the first time that tales of an Apple tablet have been told.

In May, for example, Wall Street analyst Gene Munster, of Piper Jaffray, used circumstantial evidence and checks with Asian component suppliers to bet that Apple would release a $500-$700 tablet next year. By now, although the continuing chatter makes some sense, it's getting harder to swallow the gossip, said Ezra Gottheil, an analyst with Technology Business Research who covers Apple. "It makes sense, it hangs together, sure," said Gottheil today. "But I'm starting to think that this is just a bunch of people believing each other, or maybe even an Apple disinformation campaign." What struck Gottheil today was the specificity of the report out of Taiwan. "The sources named the companies and they named the components," he said. "That's not how Apple does business." Rather, Apple goes to great lengths to make sure its suppliers keep mum about the work they're doing for the company, Gottheil maintained. "The signs are there that it makes sense for Apple to be doing something in the 'bigger than an iPod Touch' space, but I'm not sure this report adds any evidence to those signs," Gottheil said. "It's almost starting to look like people [are] just playing with the idea or even having fun with it." Tablet rumors picked up significantly just prior to Apple's annual developers conference in early June, but analysts then predicted - correctly, as it turned out - that the company would not unveil such a device at the time.

Apple has been pretty forthcoming about its environmental policies in recent years, but given the company's high profile, groups such as Greenpeace have continually pushed for even more transparency. Apple has taken flak in this department for trailing behind the likes of Dell and HP, both of which publish their annual carbon emissions, to the tune of 471,000 tons and 8.4 million tons respectively. This week, Apple overhauled the environmental section of its website with more data about its efforts, most prominently featuring an extensive breakdown of the company's annual corporate carbon emissions. Apple, on the other hand, calculates it generates 10.2 million metric tons of greenhouse gas emissions in a year.

For example, those companies' figures don't take into account the impact their products have on the environment during their lifetime. Although Dell and HP's numbers might sound significantly more environmentally friendly, it turns out that they're limited in what they actually measure. Apple, on the other hand, has explicitly broken down exactly where those 10.2 million tons come from: 38 percent from manufacturing, 5 percent during transportation, 53 percent from product use, 1 percent from recycling, and 3 percent from its own facilities. It would seem the ball is now in the court of competitors like Dell and HP, who will may quickly come under pressure to provide results as extensive as Apple's own. More to the point, the information Apple is now providing about its carbon footprint aims to reframe the debate over what it means to be an environmentally-friendly company.

Some environmental experts have lauded Apple's efforts and are hopeful that the move will spur those competitors to follow Apple's lead. But even the harshest of Apple's critics have acknowledged that Apple seems to be making genuine strides in the direction of environment friendliness. [via BusinessWeek] As always, there are also naysayers who think that Apple is only disclosing selective information that paints it in a positive light.

Security firm Tiversa Inc. has provided the House Oversight and Government Reform Committee with more reasons to ban peer-to-peer networks in government - some 200 sensitive military documents it recently accessed via such technology. One document contained personal data on dozens of soldiers from the Third Special Forces Group based out of Fort Bragg N.C. and included the names and ages of their spouses and children. The documents include personal data on U.S. troops based overseas, details on sensitive military projects and defense contracts and documents that violate International Traffic in Arms Regulations (ITAR) rules, according to a Tiversa executive.

The House Committee had asked Tiversa to try to access such data for use in its debate on a proposed bill that would ban the use of P2P technology on government networks. That followed Tiversa's disclosure that it had unearthed details about the Obama's Marine One helicopter on a server located in Iran. The request stemmed from a House hearing in July during which Tiversa had disclosed that it found details on safe house locations for the family of President Barack Obama, presidential motorcade routes and other sensitive data on a government P2P network. Those details were apparently inadvertently leaked to the Iranian system from a P2P network. "In an effort to understand the magnitude of P2P risks, and draft appropriate legislation, the Committee asked us to provide additional examples following the hearing in July," said Scott Harrer, brand director of the Cranberry Township, Pa.-based Tiversa. Most of the documents found by Tiversa were marked "secret" and appear to include information from all branches of the military, Harrer said.

Over the past month, the company submitted more than 200 more examples of P2P network data that it has accessed, Harrer said. The company has reported on its findings to the Naval Criminal Investigative Service, Army Criminal Investigation Command and the Air Force Office of Special Investigations, he added. "We have recently seen these files being downloaded in foreign countries, including China and Pakistan," Harrer said. "We have also seen user-issued searches for this type of sensitive data emanating from outside the U.S., so people are in fact actively looking for it." Tiversa's latest disclosures will likely add to growing concerns about the security of P2P networks. In January, Eric Johnson, a professor of operations management at the Dartmouth College Tuck School of Business disclosed how he had found numerous health-care documents on P2P networks. Numerous others have highlighted similar data leaks as well. For example, Johnson said he found a 1,718-page document containing Social Security numbers, dates of birth, insurance information, treatment codes and other health care data belonging to about 9,000 patients at a medical testing laboratory. In many cases, the software is not installed properly and ends up exposing not just the files that the user wants to share, but also every other file on their computers.

Such leaks typically occur when a user installs a P2P client such as Kazaa, LimeWire, BearShare, Morpheus or FastTrack on a computer for the purposes of sharing music and other files with others on the network. A bill that would make it illegal for P2P developers to make software that causes files to be inadvertently shared over a P2P network without a user's knowledge was passed by the House Energy and Commerce Committee last week. The so-called Informed P2P User Act would also require developers to clearly inform users about files that are being made available for searching and sharing, and would mandate that a user agree to the file-sharing first.

Here's a look back at a busy week in Google news stories:   IBM aims at Google, Microsoft with new Webmail  IBM introduced LotusLive iNotes, an on-demand e-mail, calendaring and contact management system meant to compete with the likes of Gmail and Microsoft Exchange. Similar to a bulletin board system, Google Wave, the brainchild of a pair of twins, lets users create shared, ongoing, real-time conversations called Waves. Pricing starts at $3 per user per month, undercutting Google Apps Premier Edition, which costs $50 per user per year.   Google Wave invite-only preview sets off Google Wave mania Google on Wednesday sent out more than 100,000 invitations to developers to preview Google Wave, a new communications and collaboration tool that Google plans to release next year. The application makes it easy for users to share videos, photos and maps.

Google removed the site's home page from its search results in response to a complaint it received under the U.S. Digital Millennium Copyright Act. And big applications vendors like SAP and Salesforce.com are already rallying around it.   Google removes The Pirate Bay home page from search results File-sharing site The Pirate Bay was once again in the crosshairs of copyright owners. A search for "The Pirate Bay" Friday turned up a message at the bottom of the first search-results page that said: "In response to a complaint we received under the US Digital Millennium Copyright Act, we have removed 7 result(s) from this page. Textscape alleges Google is violating a patent that covers a method for managing a body of text on a computer that was granted to the company in 1998. Textscape says Google's Chrome's browser improperly uses the innovation.   Google celebrates 11th birthday PC World writes: "Google has come a long way in its eleven-year history, from its humble beginning as a Stanford University research project in 1998, to the global, multi-billion dollar online presence Google enjoys today."   Google eyeing Firefox with Chrome Frame plug-in? If you wish, you may read the DMCA complaint that caused the removal(s) at ChillingEffects.org."   Google, Adobe sued by Textscape over patents  Google and Adobe Systems have been sued by a New Jersey company for allegedly violating patents used for processing text, according to recent court filings. Computerworld reports that Mozilla's chief engineer says Google might build a Chrome Frame plug-in for the Firefox browser.

Features include an equations editor and a language translator. Separately, Computerworld reported that Mozilla officials said Chrome Frame for Microsoft IE could result in "browser soup."    Google Apps takes aim at students Google hired interns to help it figure out how to make Google Apps more appealing to young people, according to PC World. Google expands search control with new options Google is adding new functionality to a side panel that could provide quicker access to relevant search results. The side panel can be activated by clicking the "show options" button on the search results page. The company is adding options to filter search results by blog and news items to the side panel accompanying search results.

These options will provide users quick access to more relevant sources, said Nundu Janakiram, product manager for search at Google. IDG News Service, PC World and Computerworld contributed to this roundup For more on Google, visit Network World's Google Subnet, an independent Google community.