Court Voids $358 Million in Damages Against Microsoft

By Kurt Mackie09/11/2009

A U.S. federal appeals court on Friday vacated $358 million in damages that had been awarded by a jury to Alcatel-Lucent after Microsoft was found to have infringed patented software technology.

The U.S. Court of Appeals for the Federal Circuit in Southern California denied Microsoft's appeal of the infringement charge, but ordered a new trial to reassess the damages portion of the judgment. A copy of the 64-page appeals court order can be accessed here (PDF).

The case involved a so-called "Day patent" (U.S. Patent No. 4,763,356) that Microsoft was found to have violated in three applications: Money, Outlook and Windows Mobile. In assessing the damages, the appeals court examined only how Microsoft Outlook may have infringed. Outlook uses a popup calendar, or date-picker feature, that was found to have violated Lucent Technologies' patent. Lucent and Alcatel merged in late 2006.

The appeals court apparently could not determine how the jury calculated the damages, which were awarded as a lump sum. The court was expecting some sort of royalty figure to be specified when the jury calculated the lump-sum award. Also, it wasn't sure if the jury had based the damages on total Outlook sales -- the court agreed with Microsoft that such a calculation wouldn't be fair.

"In the present case, the jury had almost no testimony with which to recalculate in a meaningful way the value of any of the running royalty agreements to arrive at the lump-sum damages award. [p. 43]," the court stated.

The court had agreed with Microsoft's contention in its appeal that Alcatel-Lucent hadn't provided evidence of direct patent infringement. For instance, Alcatel-Lucent could only cite one person -- its expert witness -- who had gone through the steps of the invention. However, it ultimately rejected Microsoft's noninfringement claim due to "circumstantial evidence" that other Outlook users would have used the application in a way that violated Alcatel-Lucent's patent.

Dell Inc. was also a defendant in the case but the jury found "no infringement by Dell" on the patent claims. The original complaint was lodged by Lucent in 2002 against computer maker Gateway, "and Microsoft subsequently intervened," according to the court record.

Microsoft spokesman Kevin Kutz told Reuters that Microsoft was "pleased" that the damages were vacated. It's unclear when the next trial, reassessing the damages, will begin. About $8 billion worth of the three products using the technology was sold.

i4i Rebuts Microsoft’s Appeal in Patent Case‘The Final Destination’ Kills In 3-D At Box Office

i4i Rebuts Microsoft's Appeal in Patent Case

By Kurt Mackie09/09/2009

Toronto-based i4i LP filed legal papers on Tuesday rebutting Microsoft's appeal in a patent infringement case involving Microsoft Word.

Microsoft lost the case, which involves so-called "custom XML" technology used in Word and Microsoft Office. However, Redmond appealed the final judgment issued by a U.S. district court and was granted a stay, with a hearing scheduled to take place on Sept. 23.

"i4i's brief refutes each and every one of the same weak defences Microsoft repackaged from the trial and raised on appeal," said Loudon Owen, chairman of i4i, in a prepared statement.

Based on i4i's appeal, the two companies still appear to be contesting how the patent applies. For instance, a bone of contention is whether the patent specifies that the metacode mapping system is stored as a separate file from the document file it describes. i4i claims that the patent doesn't make such specification.

Microsoft has also contested the judge's conduct during the trial and has questioned a survey used by the plaintiffs used to calculate damages. Microsoft has been ordered by the U.S. District Court for East Texas to pay i4i more than $240 million in damages and penalties. Microsoft was also enjoined from selling Word in the future using i4i's technology.

i4i's Tuesday filing before the U.S. Federal Circuit Court of Appeals in Washington, D.C. suggests that Microsoft reviewed i4i's patented technology and then later decided to squeeze the company out by building similar technology into Word.

"When it suited its purposes, Microsoft touted i4i as a 'Microsoft Partner' able to provide software that Microsoft could not," states i4i's Sept. 8 appeals court filing. "But behind i4i's back, Microsoft usurped i4i's invention, destroying i4i's ability to compete in the market that it had created. [p. 4]"

Once Microsoft had built the custom XML capability into Word, i4i was deprived of that market, the i4i appeals court filing claims.

"As the district court found, once customers have Microsoft's XML features in Word, they are reluctant to purchase i4i's products. [p. 80]"

i4i's 84-page appeals court finding can be accessed here.

Christopher Nolan’s ‘Inception’ Still A Mystery After Teaser TrailerCourt Grants Stay in Microsoft vs. i4i Patent Case

Microsoft Warns of Another Server Message Block Bug

By Jabulani Leffall09/09/2009

The all-critical patch release of hotfixes served up by Redmond Tuesday hadn't even cooled off yet when Microsoft issued yet another security advisory on late Tuesday night.

This time the flash advisory is for potential vulnerabilities in Microsoft's Server Message Block (SMB). The advisory describes SMB as a "network file sharing protocol used in Microsoft Windows." The company is currently preparing a security update for future release.

According to the advisory, Microsoft is looking into "new public reports of a possible vulnerability in SMB implementation" affecting Windows Vista, Windows Server 2008 and the Windows 7 release candidate.

Windows 7 and Windows Server 2008 R2 are not affected, nor are Windows XP and Windows 2000.

Redmond said that it is "not aware of attacks that try to use the reported vulnerabilities," nor has it received any direct customer complaints about the issue.

The off-cycle advisory -- the second in as many weeks -- comes on the same day after Microsoft's September patch was made available. That patch addressed five "critical" security issues associated with Web components in Windows and other Microsoft software. Microsoft has also given notice of another yet-to-be fixed bug in a File Transfer Protocol (FTP) component.

SMB is used for client-server traffic handling, and Microsoft's security advisory recommends a workaround that involves modifying the Windows registry and "blocking TCP ports 139 and 445 at the firewall."

SMB bugs have been seen before. In November of 2008, Redmond confirmed that it took seven years to deliver a fix for SMBRelay attacks. That fix finally arrived in Microsoft's November's patch. At the time, Microsoft Security Response Center spokesperson Christopher Budd admitted in a blog post that Microsoft's security staff was unable to "make changes to address the issue without negatively impacting [other] network-based applications."

Independent security researcher Laurent GaffiГ© apparently broke the news about the SMB vulnerability on Tuesday night in his blog and then contacted Microsoft about the issue. Redmond apparently wasn't pleased.

"Microsoft is concerned that this new report of a vulnerability was not responsibly disclosed, potentially putting computer users at risk," the security advisory said. "We continue to encourage responsible disclosure of vulnerabilities."

Microsoft said it is working with partners in its Microsoft Active Protections Program on the issue.

DirectShow Subject to Attacks, Microsoft Warns‘Twilight’ Documentary Sheds Light On The Real Forks

Microsoft Describes Profit Strategy at Citigroup Event

By Kurt Mackie09/09/2009

Microsoft's chief financial officer fielded questions about Microsoft's business at the Citi Annual Technology Conference on Wednesday.

Chris Liddell, Microsoft's CFO, faced some pointed inquiries about Microsoft profit-generating strategies at the New York City-based event, which was sponsored by Citigroup. The banking concern recently showed some profitability of its own in its second quarter report after receiving $45 billion in U.S. taxpayer money through the Troubled Asset Relief Program (TARP) in October.

Despite the tough economy, Liddell said that Microsoft has seen good performance in the June quarter (or the end of Microsoft's fiscal year) on enterprise licensing renewals.

"We are incredibly happy that the renewal rates we are able to achieve in the enterprise were in line with what we've been able to achieve historically. But it's a very difficult environment," Liddell said. "People are very much subscribing to the value proposition that we have as a company."

Microsoft has been moving more toward a subscriber-based licensing model with its software-as-a-service business line, which Liddell characterized as a "high-growth area in the next five-plus years." The online services business model, which typically involves monthly fees rather than annual fees, provides a stronger connection to the customer compared with Microsoft's traditional annuity model, "although it hurts us from an accounting point of view up front," he said. However, Liddell admitted that Microsoft's Software plus Services model implied lower margins for the company.

Some of the questions honed into Microsoft's competition in the online search space. Liddell was asked how much Microsoft was willing to spend to catch up with No. 1 search competitor Google. That question was answered by Microsoft's CEO Steve Ballmer last year, who suggested Microsoft might spend "at least $1.2 billion or $1.5 billion a year to stay competitive." At the Citi event, Liddell replied that Microsoft has already budgeted for search and that it's been flat year over year. Microsoft's launch of Bing and its deal with Yahoo were conducted primarily to gain market share in search, he explained. For Microsoft, "a one percentage share gain [of the search market]… certainly would be a huge share gain for us," Liddell said.

Liddell answered a lot of questions about Microsoft's strategy on netbooks -- which are the low-cost, low-tech, laptop-like devices that threaten to cut into Microsoft's client operating system profits. Liddell noted that despite the low cost of netbooks, people are willing to pay for the Windows experience, citing a 92 percent attach rate. Netbooks are currently sold with either Linux or Windows Home Edition, but Liddell suggested that there's a potential for Microsoft to profit from users of Windows 7-based netbooks who would be willing to upgrade to higher priced editions of the operating system.

Liddell dismissed the threat of Linux against the possibility that Windows 7 will be higher priced than Windows XP on netbooks.

"The average price for Windows … is around $60," Liddell said. "For a four-year experience, it's about $15 per year. There are very few people in this room or that I would talk to who would learn an entirely new operating system with less functionality and less applications for the price $15 per year. So this is not an expensive product."

Microsoft expects to face "relatively tough" times through the rest of the calendar year, Liddell said. Still, people will eventually need to buy computers, and Microsoft expects to see a potential for "hardware refresh cycle" maybe next year.

Liddell may have disappointed the financial analyst crowd by saying that Microsoft's headcount reductions would be "broadly flat for the foreseeable future." He said that Microsoft did not increase salaries this year and has cut expenses associated with travel, contracts and vendor-spending costs.

Liddell's talk at the Citi event can be heard at Microsoft's investor relations Web site here.

Microsoft: Windows 7 Will Face ‘Tough’ Market‘Harry Potter And The Half-Blood Prince’ Stars Answer Fan Questions

September Patch Aims at Windows Web Components

By Jabulani Leffall09/08/2009

Microsoft on Tuesday rolled out its September security patch, which is notable for containing five "critical" security bulletins.

Expect a couple of themes with this patch. First, all of the fixes address remote code execution (RCE) risks. Second, every bulletin deals with Web components, from server connections to corrupt files distributed through e-mail.

The first critical patch is said to plug a hole in the Microsoft JScript Scripting Engine used in every supported Windows OS. The exploit can be triggered via a specially crafted corrupt file or even by clicking on an infected Web page with "malformed script," according to Microsoft. A hacker exploiting this vulnerability could set user administrative rights and could "view, change or delete" data.

The second patch touches an RCE vulnerability only in Vista and Windows Server 2008. It pertains to a single privately disclosed bug in the Wireless Local Area Network (LAN) AutoConfig Service. Client workstations and server systems without enabled wireless cards are immune to this bug, but it's a potential problem for networks with Wi-Fi access.

Potential malicious Windows Media Format files, such as corrupt audio or video files, are a consistent vector for client side attacks. These files are the focus of critical item No. 3. The patch is designed to fix vulnerabilities in Windows Media Format Runtime versions 9.0, 9.5 and 11 in every supported Windows OS.

TCP/IP Bug: A Focus for Security Pros
Fix No. 4 deals with a Transmission Control Protocol/Internet Protocol (TCP/IP) bug. The patch doesn't apply to Windows XP, but it does apply to all other OSes.

"In addition, it has maximum criticality only on Vista and Windows Server 2008, the newest generation of the OS family," said Wolfgang Kandek, chief technology officer at Qualys.

The fix deals with a rare server-side function and resolves several "privately" reported vulnerabilities, according to Microsoft. It addresses vulnerabilities in both Windows and Cisco Systems products. Microsoft says there are holes that could allow RCE exploits if malicious TCP/IP packets are sent over the network.

As a fail-safe, Microsoft recommends "firewall best practices," which include cutting hackers off at the pass by limiting exposed connection ports.

"Microsoft hasn't seen a serious bug in its TCP/IP stack in a long time, so it's pretty likely this is the exploit most people will focus on," said Andrew Storms, director of security at nCircle. "This update follows on the heels of a new zero-day 'blue screen of death' vulnerability and the combination of these two serious vulnerabilities will shake a lot of people's confidence in the integrity of Microsoft's networking stack."

The fifth and final patch in the slate describes a vulnerability in the DHTML Editing Component ActiveX control. This control found in Internet Explorer 5 and later IE versions. If a hacker gains control of this function, he could dump code that will execute when a user clicks on a corrupt Web page. The patch is rated critical on Windows 2000 and XP. It's doesn't apply to Vista and Windows Server 2008.

FTP Bug Still at Large
Fix No. 4 should be installed first, said Jason Miller, security and data team manager at Shavlik Technologies, joining a chorus of observers.

He also pointed out what wasn't in this month's slate, namely a fix for a File Transfer Protocol (FTP) service bug, which was disclosed in a security advisory last Thursday. The proof of concept for this bug is less than two weeks old, but the bug has become notable. Microsoft has now updated its advisory to reflect that the vulnerability is being used in "limited attacks."

"Administrators should look at addressing this vulnerability through workarounds provided by Microsoft until a security patch becomes available," Miller said.

Microsoft's Senior Security Program Manager Jerry Bryant said in an e-mailed statement that a patch will be released "once [such an update] has reached an appropriate level of quality for broad distribution."

All of the five patches that were released on Tuesday may require restarts.

Meanwhile, for IT pros who may want to do more housekeeping after implementing the critical fixes, there is the monthly knowledgebase article detailing nonsecurity updates via Microsoft Update, Windows Update and Windows Server Update Services.

‘We Live In Public’: Yesterday’s Future Revisited, By Kurt Loder‘Critical’ Windows Fixes Expected on Patch Tuesday

Vendors Rip Microsoft Over Alleged Security Issues

By Jabulani Leffall09/08/2009

Software security vendors like to point to glitches in Microsoft products, but they don't always get much acknowledgment from Redmond.

The latest potshots are coming from Sophos, a security software company, as well as database security firm Sentrigo, plus BeyondTrust, which specializes in enterprise password protection. These vendors recently issued public challenges to Redmond concerning security in Windows and other Microsoft products.

For its part, Microsoft said through a spokesperson that it doesn't comment on the theories and opinions of vendors. Yet Redmond's growing network of executive-level bloggers have gone toe-to-toe with no less than two of these vendors in as many weeks.

Sophos' Beef With XP Mode
Sophos is one of Microsoft's most outspoken little-guy critics, even though it partners with Redmond on many security initiatives. Last week, the feud concerned Windows 7's XP Mode, which provides a virtualized Windows XP desktop running in Windows 7.

Sophos panned Windows XP Mode as a potential security disaster.

"Windows 7's planned XP compatibility mode risks undoing much of the progress that Microsoft has made on the security front in the last few years and reveals the true colors of the OS giant," said Richard Jacobs, Sophos' CTO in a July post.

The problem pointed out by Sophos' CTO (and Microsoft emphasizes it too) is that Windows XP Mode requires the maintenance of two OSes -- both Windows 7 and a virtualized Windows XP. Security patches have to be applied separately for each OS, and there's no centralized management control to simplify such patching. While Microsoft has been clear about this, Jacobs has intimated that Windows XP Mode is a security disaster in the waiting.

Jacobs touted the progress that Microsoft has made with its Security Development Lifecycle but added that "XP Mode reminds us all that security will never be Microsoft's first priority." In an August post, Jacobs added that "Microsoft as a whole needs to be much more open about [security issues] or users are going to get a rude awakening in terms of management costs, unexpected security vulnerabilities and/or performance impact."

In a return shot, Windows developer and blogger James O'Neill said that people (like Jacobs) with the title of chief technology officer should have a "better grasp of the key facts before reaching for the insulting rhetoric." Roger Halbheer, Microsoft's chief security advisor for Europe, Middle East and Africa, also questioned Jacobs on his facts.

Sentrigo Scolds Redmond on SQL Server
Sentrigo announced last week that it had discovered a "significant vulnerability" in SQL Server. The company issued a statement describing a flaw that "allows any user with administrative privileges to openly see the unencrypted passwords of other users," or the credentials presented by applications accessing the server using SQL Server authentication.

Microsoft handled the Sentrigo allegation in a low-key manner but still discounted Sentrigo's claims. Microsoft's response didn't mention Sentrigo by name.

"We checked with the security researchers who reported the issue and they confirmed that this is an information disclosure issue requiring the attacker to first have administrative control of the installation," Jonathan Ness of Redmond's MSRC Engineering team noted in a security blog. "Therefore, we do not consider this a bulletin class vulnerability."

BeyondTrust: UAC in Windows 7
BeyondTrust pointed to Windows 7's User Account Control (UAC), a much maligned security feature that was first introduced in Windows Vista. UAC has ongoing unresolved issues, even in Windows 7, the security firm claimed.

"Despite its good intentions, Vista's UAC was widely criticized due to its frequent user prompting, as well as application compatibility issues for standard users," Beyond Trust said in an e-mail statement just before Labor Day weekend. "Despite its good intentions, Vista's UAC was widely criticized due to its frequent user prompting, as well as application compatibility issues for standard users."

As far back as February, Microsoft countered the notion that the UAC function was fundamentally faulty. In addition, security researchers Rafael Rivera and Long Zheng had described an exploit that could turn off the UAC prompt, which typically notifies the user of changes about to be made to the computer. In response, Microsoft announced two planned changes to the UAC in Windows 7.

Complaints as Marketing?
Complaints serve to keep vendors in the news. They also help Windows users understand problems that Microsoft doesn't want publicized or may have missed.

Such research claims and stabs at Microsoft are "cheaper than buying advertising for products and services," according to Phil Lieberman of Lieberman Software.

"In my experience, Microsoft tends to react proportionately to the amount of ink given to an issue brought up by vendors or the press," Lieberman said. "Real or fictitious threats all get a hearing and a response. They also react in proportion to the real risks but generally pretty quietly."

DirectShow Subject to Attacks, Microsoft WarnsWhat Does Disney’s Acquisition Of Marvel Mean For Fans?

Windows: Coming to a Mainframe Near You?

By Stephen Swoyer09/08/2009

IBM likes to promote its System z mainframe as the virtualization platform par excellence, and with good reason. Not only is System z home to z/VM, the most mature hypervisor on the market, but thanks to its proprietary hardware innards and best-in-class software portfolio, it boasts what is arguably the market's most granular and manageable virtualization solution.

It doesn't, however, offer the industry's most comprehensive virtualization solution. For one thing, Big Blue supports only a few hand-picked operating environments (chiefly VSE and Linux) in addition to /OS. Conspicuously missing is support for Microsoft's Windows platform, to say nothing of other enterprise-grade operating systems such as OpenSolaris or Mac OS.

This is in spite of the fact that IBM long ago made its peace with Windows. It's an aggressive Windows OEM, supports Windows -- admittedly, not running in a virtual context -- on its System i platforms and, of course, is an ambitious player in the commodity (x64) virtualization segment. In fact, IBM's System z virtualization story is arguably inferior to that of rival Hewlett-Packard, which supports (or plans to support) many of its platforms -- HP-UX, Tru64 Unix and OpenVMS -- running in a virtual context, along with Linux and Windows. Rival Unisys lets users run Windows, Unix or Linux on top of its ES7000 or ClearPath servers, along with (in the latter case) both flavors of its proprietary mainframe operating system software.

IBM officials tend to demur when asked about the likelihood of running Windows in conjunction with z/VM. In an interview from late last year, for example, Karl Freund, vice-president of strategy and marketing for System z with IBM, said that "very few if any" mainframe customers had expressed a desire "to do that."

Freund didn't flatly rule out a Windows-on-System-z strategy, but instead positioned IBM's System x platforms, running in tandem with System z, as ideal virtual hosts for most Windows workloads. "We already have a solution to offer [mainframe customers] who want to do something like [virtualize their Windows assets]," said Freund, who, toeing IBM's oft-repeated line, likes to position System z as more of a hub -- and less of a one-size-fits-all monolith -- from which to manage and secure an enterprise-wide virtualization effort.

Vince Re, chief mainframe technologist with software giant CA Inc., likewise downplays the desirability of a Windows-on-System z strategy. He stressed that CA doesn't speak for IBM but contends that "the vast majority of [mainframe] customers just aren't interested in that." If anything, Re suggested, the ball is in Microsoft's court: Redmond can't champion the cause of Windows in the datacenter while continuing at the same time to ignore the mainframe, he maintained.

Re, like IBM's Freund, rejected the claim that the lack of a z/Windows offering somehow calls into question System z's virtualization bona-fides. "You also have to consider the cost [of running Windows workloads on the mainframe]. Linux [on System z] is mature, it's proven. You've got 10 years of development behind it, so it's at a point where [workloads] can run efficiently [on System z]," he said, adding, "Windows would be starting from scratch."

It is possible to run Windows applications, if not Windows itself, on top of a number of Unix-like operating systems, including Linux. There's the long-standing WINE Is Not an Emulator (WINE) Project that, after 15 years of development, finally shipped as a version 1.0 release last June. WINE supports most Linux distributions and all three flavors of BSD, in addition to OpenSolaris and Mac OS (via Darwine).

That's the good news. The bad news is that WINE doesn't do emulation, much less virtualization. Because most Windows applications are written for 32- or 64-bit x86 chips, they would first have to be recompiled (for System z CMOS) in order to run in WINE on top of z/Linux. There's another requisite: WINE is by no means a turnkey solution. Windows programs often have to be tweaked or custom-configured to properly run in its context.

What's more, WINE is more of a workstation-oriented offering. Past sponsors have included Corel, steward of the once-dominant WordPerfect Office productivity suite, and Google. It is, therefore, a less-than-ideal tool for workload consolidation on an enterprise scale -- at least for the kinds of adopters who would undertake to do as much on top of System z.

All Isn't Lost
There are alternatives to WINE, such as Mantissa's z/Vos which was announced just six months ago. It runs in z/VM and purports to let mainframe shops run any of several different operating environments (including Windows) on top of z/VM. z/Vos made a big splash at Winter SHARE and, once it ships, could very well amount to the best thing for Big Iron shops since zLinux itself.

Absent z/Vos, there's another compelling solution. Industry veteran Wayne Kernochan, a principal with consultancy Infostructure Associates, highlights Mono, an open source project first conceived by the former Ximian Inc., to create a version of Microsoft's .NET framework capable of running atop Linux, several flavors of BSD, Mac OS and Windows itself. Six years ago, Novell acquired Ximian and became Mono's steward; then, just months later, Novell acquired German Linux pioneer SuSE.

That chain of events paved the way for the Mono of today, which runs in z/Linux.

More precisely, Kernochan explained, Novell markets a Mono Extension for its SuSE Linux Enterprise Edition (SLES) 11, which runs on System z. This combination -- namely, of SLES 11 and Novell's Mono Extension -- makes it possible for SuSE shops to run .NET applications on top of System z. And that, Kernochan maintains, makes for an intriguing proposition.

Economy, Virtualization Eat Into Linux Growth‘G.I. Joe’ Set Visit Yields Explosions, Stunts And Nostalgia