Windows 7 May Face Attacks in 2010

Windows 7 has the potential to become a security target in 2010, according to researchers, although it's held up so far.

Just days after Windows 7 was released to OEMs and partners in July, a serious vulnerability was reported in the operating system. However, Microsoft released an early patch, and no serious issues were reported in 2009.

"Many vulnerabilities did not affect Windows 7 itself but actually affected the release candidate of Windows 7," said Jason Miller, security and data team manager at Shavlik Technologies.

While Microsoft has already issued the first security patches for the new operating system, expect more vulnerabilities to come, according to Zulfikar Ramzan, a technical director and architect with Symantec Security Response.

"As long as humans are programming computer code, flaws will be introduced, no matter how thorough pre-release testing is," Ramzan said in an e-mail discussing Symantec's recent trends and predictions report. "And the more complex the code, the more likely that undiscovered vulnerabilities exist. Microsoft's new operating system is no exception, and as Windows 7 hits the pavement and gains traction in 2010, attackers will undoubtedly find ways to exploit its users."

Microsoft initiated its security development lifecycle (SDL) process as company-wide policy for developing its software in 2004. The policy likely has reduced vulnerabilities in software such as Windows 7, even though 2009 saw a record number of vulnerabilities in older Windows products -- approximately 80 bugs in all, including the infamous Conficker worm.

SDL essentially is a framework for building security into Microsoft's software. Results from its use appear to be good so far.

"If Microsoft's metrics are to be believed -- and I do believe them -- then yes [SDL has been a success]," said Randy Abrams, director of technical education at ESET. "The number of critical vulnerabilities found in the products under the SDL has dropped dramatically. The issue going forward is that critics will point out the vulnerabilities that make it through without the recognition of how many more vulnerabilities didn't make it through."

All software vendors face the challenge of responding to zero-day exploits. Much will depend on whether security experts choose to contact Microsoft privately about their discoveries or go public.

В "I recall a time [in 2009] when a panic was created around a vulnerability in Windows 7 before Microsoft had a chance to research and disclose the actual information around the vulnerability, causing deserved embarrassment for the researcher," Miller said. He added that such a jump-the-gun culture among some vendors doesn't help anybody -- not Microsoft, not researchers and definitely not users.

Going public may force Microsoft to become more responsive, but the importance of a bug can be a subjective call.

"Generally Microsoft is responsive to bug reports," Abrams said. "But there are cases when the nature of the bug is not adequately understood and it may be dismissed as far less of a problem than it really is."

For his part, Abrams suggests that Microsoft and vendors should play nicer this year.

"Both security vendors and independent researchers should report responsibly [to Microsoft]," Abrams said. "That said, the affected vendor, whether it is Microsoft or another company, needs to be responsive and transparently explain if a fix will take longer than seems to be reasonable."

Zooey Deschanel, Joseph Gordon-Levitt Are Thankful For The Past, The ‘Summer’ And The FutureMicrosoft Warns of IE 6 and IE 7 Bug

Microsoft Rings in 2010 with Commercial Cloud Services

Microsoft is starting the initial phase of commercializing its cloud computing platform this month, as planned. The company announced on Monday that developers can now upgrade their Windows Azure preview accounts to commercial subscriptions, or register for new services. Billing is slated to start in February.

Developers who are using the community technology previews of Windows Azure compute and storage, SQL Azure relational database or the Windows Azure AppFabric, which provides Service Bus connectivity and Access Control (formerly .NET Services) can upgrade to commercial services by using the Windows Live ID associated with their accounts and providing credit card or purchase order information at the Windows Azure Platform offers site on MSDN. View Microsoft's Offers Comparison Chart here.

Windows Azure Platform services are initially available in 21 countries in North America, Europe and Asia Pacific, with plans to expand to more regions sometime this year.

Developers who upgrade to commercial accounts in January will have access to usage information starting this month. Service level agreements will take effect on February 1 in conjunction with actual billing, according to Microsoft.

For those who do not opt for Microsoft's commercial cloud services, the CTPs will be "disabled" on February 1, 2010. At that time, developers participating in the Windows Azure storage previews will have access to read-only files and users of SQL Azure will have access to their existing databases. The final phase out of the data storage accounts will occur in March and April, as stated in the Windows Azure Team blog:

"On March 1, 2010, the SQL Azure CTP accounts that have not been upgraded will be deleted. On April 1, 2010, the Windows Azure Storage CTP accounts and Windows Azure platform AppFabric namespaces that have not been upgraded will be deleted."

Dallas, the codename for Microsoft's data-as-a-service that will enable developers to consume public and private data for SQL Azure, SQL Server, Microsoft Office among other applications, is still in the early preview phase. The first CTP was announced at Microsoft's Professional Developers Conference in November. The service as described is part of the Windows Azure platform and will offer developers access to free data as well as content for purchase. At this time, Dallas is not affected by the commercialization of Windows Azure, and the CTP accounts will remain active, according to Microsoft.

Based on early feedback, Microsoft has also changed the pricing for the Windows Azure Service Bus and Access Control "messaging operations." The Service Bus is now $3.99 per connection per month and Access Control is $1.99 per 100,000 transactions, according to the Web site. "Based on discussion and feedback from hundreds of customers during the CTP process, we have made the pricing simpler and more predictable," Microsoft stated in its Windows Azure AppFabric team blog, which offers details on the new pricing scheme.

Both services are part of Azure's AppFabric, the new moniker for .NET Services, which was renamed at PDC09 in conjunction with the introduction of the Windows Server AppFabric. "AppFabric" refers to a set of on-premise and cloud components designed to provide connectivity and services for composite apps.

The on-premises counterpart, Windows Server AppFabric, is an extension of IIS that supports Windows Communication Foundation, Windows Workflow Foundation (formerly codenamed "Dublin") and caching services ("Velocity"). The first beta was released at PDC09.

Harrison Ford Says Next Indiana Jones Movie Is ‘Full Of Opportunity’Microsoft Creates Server and Cloud Division

Google's Nexus One Looks To Reshape Smartphone Market

As expected, Google on Tuesday launched the Nexus One, a touch-based smartphone that boasts many of the features of Apple's iPhone as well as some new features, including support for native voice response within applications.

The Nexus One is manufactured by Taiwan-based HTC and is completely touch-based, without a keyboard. But what makes Nexus One stand out is that users can buy the Google-branded phone directly from the company's new online store. Customers can choose from a variety of carriers (initially T-Mobile and Verizon) or even put in a supported SIM card from another phone. This is a major departure from the current model, which requires customers to acquire a phone through a carrier.

Some analysts believe the direct model Google is offering could weaken the hold carriers have over customers. According to In-Stat analyst Allen Nogee, carriers are likely to be irritated because not only is Google competing with them, but the company has added enhancements to its Android operating system before making them available to other OEM partners.

"It changes the marketplace when you're competing against the same partners you are working with," Nogee said.

Nevertheless, if Android does make inroads, not only will it represent a threat to Apple's strong developer ecosystem, but analysts say it could further erode support for Microsoft's Windows Mobile platform, whose share continues to decline.

"It hits Microsoft by essentially killing any chances for Windows Mobile, since consumers would be unlikely to buy a Windows Mobile phone directly," said Tom Nolle, an analyst at CIMI Corp.

Indeed, many of Microsoft's partners, while not abandoning Windows Mobile, are looking to broaden the number of mobile platforms they support.

When Google first disclosed plans for Android, analysts were skeptical it would make a dent in the market. However, there are now 20 Android-based phones, including the popular Droid released by Motorola last month. A survey of more than 4,000 consumers in December by market researcher ChangeWave revealed that 4 percent of smartphone owners have one running Android, up from just 1 percent in September. But according to a study released Monday, a startling 21 percent of those who intend to buy a new smartphone within the next three months are leaning toward an Android-based device. That's up from just 6 percent since September.В 

By comparison, only 6 percent are considering Windows Mobile phones, down from 9 percent in September.

"All Microsoft can do right now is to look internally and get its own house in order," said Giovanni Gallucci, organizer of the Windows Mobile Developer Camp.

But while many analysts are skeptical of Microsoft's prospects for gaining substantial share with Windows Mobile, some say it's too early to count the company out.

"I continue to get a wink, wink, nudge, nudge from sources internally at Microsoft about a phone on the Zune platform," Gallucci said. "Microsoft is big enough to buy some time if they just announce something that is new and exciting. Many companies would have already folded, but Microsoft has the luxury to underperform in the mobile space with their war chest."

Google's latest effort could change the stakes for Microsoft, according to In-Stat's Nogee. "Google has breached that middle ground by making its own phone," he said. And while it remains to be seen whether Microsoft will follow suit, the Nexus One may give Microsoft a stronger hand with OEMs. "I wouldn't write Microsoft off yet," he said.

‘Spider-Man 4′: What A Tangled Web It WoveGoogle Reportedly To Offer Its Own Phone

Microsoft Beefs Up Interoperability Agreements

Microsoft provided more details about its settlement with the European Commission (EC), particularly with regard to interoperability agreements.

In a blog post on Thursday, Dave Heiner, Microsoft's vice president and deputy general counsel, claimed that the company has pledged to implement a threefold approach to interoperability that EC Commissioner Neelie Kroes outlined in past speeches.

Heiner summarized that approach: companies should disclose technical information, provide a remedy if the information is inadequate and charge equitable royalty rates for associated intellectual property.

Kroes had also specifically called for companies to follow open standards as one of the best ways to achieve interoperability. However, Heiner omitted the word, "open," from his comment. He said that "products from different firms can work well together when they implement common, well-designed industry standards."

Microsoft's interoperability pledge announced this week appears to continue ideas the company put forth in February 2008. At that time, the company announced broad interoperability principles as well as APIs for software developers working with Microsoft's mainline products, including Windows client and server operating systems, Exchange, Office and SharePoint, among others. Microsoft has been releasing documentation for that purpose, with "hundreds of Microsoft developers" devoted to the effort, according to Heiner.

The new elements to Microsoft's interoperability pledge appear to be warranty and patent-sharing templates. Those documents, and more, can be accessed at the end of a statement about the settlement by Brad Smith, Microsoft's senior vice president and general counsel.

Essentially, companies can sue if they think Microsoft is not following through with providing proper API documentation, according to a blog post by Groklaw, a frequent Microsoft critic and a site devoted to software legal issues. The Groklaw post noted that nothing has really changed for commercial software companies working with open source software under the GNU General Public License because Microsoft's interoperability agreement appears to restrict commercial distribution of software without royalty agreements first being in place.

The Free Software Foundation Europe (FSFE) backed that view.

"The patent commitments are clearly insufficient, because they don't allow commercial exploitation," said Carlo Piana, FSFE's legal counsel, in a released statement. "This keeps out competition from Free Software, which in many areas is the biggest competitor to Microsoft's programs."

The European Committee for Interoperable Systems (ECIS) was also skeptical.

"Whether the public undertaking will create a more level competitive playing field where open source software is not subject to Microsoft patent FUD [fear, uncertainty, doubt], as has been the case in the past, is not yet clear," the ECIS declared in a released statement (PDF).

Microsoft has previously dealt with open source software producers by promising not to sue them for infringing Microsoft's intellectual property, provided that they sign agreements with Microsoft. A deal struck with Novell over the interoperability of Novell's SuSE Linux Enterprise Server and Windows back in November of 2006 caused an outcry from many open source software vendors as Microsoft pressed companies for similar agreements.

The EC's inquiries about interoperability with Microsoft's products stem from a complaint by Sun Microsystems about the interoperability its Solaris UNIX-based operating system with Microsoft COM objects and Active Directory. In addition, the EC separately investigated an allegation that Windows Media Player had been integrated with Microsoft's Windows operating system in a way that violated European competition laws, as described in Case T-201/4.

This week's settlement with the EC originated from a complaint by Opera Software on browser competition in Europe. Microsoft also agreed to a browser screen for Windows, making it easier for users to choose a browser other than Microsoft's Internet Explorer.

Although Microsoft settled the browser competition complaint, a statement from the EC indicated that the Commission will continue to observe how the interoperability agreements are carried out.

Windows Phones To Arrive in Coming Months‘Spider-Man 4′ Scrapped, Studio Plans 2012 Reboot

VMware Enters E-Mail Business with Zimbra Buy

VMware on Tuesday said it is acquiring Zimbra from Yahoo, extending VMware's reach beyond system virtualization.

Zimbra is the largest provider of open source e-mail and collaboration software, with 55 million mailboxes. Its technology is used in numerous hosted e-mail platforms including Yahoo Mail as well as the hosted services from Comcast and NTT Communications.

Zimbra's open source e-mail and calendaring solution is also available to enterprises as virtual appliances and is used by Bechtel Corp., Digg.com and Stanford University, among others, said VMware CTO Steve Herrod in a blog post.

VMware intends to offer Zimbra as an alternative e-mail solution to Microsoft Exchange Server. The company will offer Zimbra through its vSphere family of virtual appliances.

"The Zimbra virtual appliance will automatically benefit from the built-in VMware vSphere scalability, availability and security services," Herrod noted. "We see this on-premise virtual appliance distribution and deployment model as a very simple yet effective approach for providing employees with collaboration capabilities, especially for small and medium-sized businesses (SMBs)."

VMware has temporarily taken the Zimbra virtual appliance off the market with plans to release an upgraded version shortly, Herrod said.

Zimbra changing hands was much needed for both Yahoo and VMware, said Burton Group analyst Bill Pray. Yahoo had acquired Zimbra over two years ago with the goal of offering enterprise services but failed to execute a viable enterprise business, Pray said. Google has had greater success in penetrating the enterprise market for e-mail and collaboration services, as have Cisco, IBM and Oracle, he said.

VMware, which already offers Exchange Server on vSphere, can now offer Zimbra as an alternative, Pray said. "It gives them the opportunity to have that discussion. How successful they will be will depend on how fast Microsoft can take that away from them by developing their Hyper-V technology even further over time, and also how much they can break out of the mold as this being an infrastructure play and not being a provider of communications and collaboration services."

VMware also sees Zimbra as an opportunity to offer cloud-based e-mail and calendaring services as an option to online alternatives such as Microsoft's Business Productivity Online Standard Suite (BPOS), Redmond's e-mail and collaboration solution consisting of Exchange Online, SharePoint Online, Live Meeting and Office Communications Online.

VMware may have the opportunity to capitalize on the grievances of Microsoft partners over recent BPOS price cuts.В "I suspect that is what VMware is banking on, some of that partner discontent, to leverage some of those partners, bring them over and have them sell Zimbra instead of Exchange," Pray said.

But the issue with that is as Microsoft grows the Exchange Online business and competes against IBM, Cisco and Google, that there will be economics of scale that vendors can recognize. "By hosting millions of mailboxes, which will drive their costs down and continue to drive price points down, it will be very difficult for the smaller partners to compete in hosted e-mail in any kind of effective manner, particularly at an enterprise scale because they won't be able to get to that same price point as Microsoft," Pray said.

Despite the acquisition, Herrod said VMware intends to continue offering vSphere for Exchange Server. That makes sense, Pray said, given that many who are going to stick with Exchange will still prefer VMware's virtualization offerings -- at least until Hyper-V reaches parity. That's not expected to happen this year, however, Pray said. "VMware can build off the fact that they're in many, many enterprises. And in actuality, when Exchange is virtualized, it most commonly is virtualized on VMware."

Microsoft and Yahoo Finalize Search Contract‘Avatar’: The Early Reviews Are In!

Gartner To Acquire Burton Group

Gartner on Tuesday said it has agreed to acquire Burton Group, a smaller but well-regarded IT research and advisory services firm, for $56 million in cash.

The move comes just one month after Gartner agreed to acquire AMR Research for $64 million in cash.

Burton Group, which has 41 research analysts and projected revenues of $30 million in 2009, will continue to operate as a separate subsidiary, the companies said.

"It's looking like it will be business as usual for us," a Burton Group spokesman said. "We'll retain most of our brand and our offerings won't change other than we will have this new piece to us."

How that will play out remains to be seen. Gartner has acquired several rivals in the past including Meta Group and Dataquest, both of which were ultimately melded into the parent firm.

Burton Group is known for its enterprise-focused IT research and reference architecture designed to give Global 2000 companies options for implementing infrastructure from operating systems, network platforms, collaboration and service-oriented architectures. Its key practice areas include application development, cloud computing, infrastructure, identity and security.

"Burton Group's focus on pragmatic, in-depth IT research, consulting and events will be a valuable and significant complement to the current Gartner portfolio," wrote Jamie Lewis, Burton Group CEO and research chair, in a posting on the company's Web site.

In a FAQ posted on Gartner's Web site by CEO Gene Hall, the company said it intends to retain all of Burton Group's analysts.

"Burton Group is the industry leader at what they do," the FAQ read. "Over time, we will invest in the development of Burton Group's products and services to expand the functional IT areas they cover in order to increase the value they provide to existing and new clients."

2010 a Boom Year for Cloud Computing?After ‘Avatar,’ Which 3-D Films Will Rule the Box Office?

Chrome Gains Browser Market Share at IE's Expense

After a year of dramatic growth, Google's Chrome has become the third most popular browser behind Microsoft's Internet Explorer and Mozilla's Firefox, with Apple's Safari moving to the fourth position.

Less than a year and a half after its debut, Chrome's market share in December 2009 was 4.6 percent -- triple its January 2009 share of 1.5 percent, according to Web metrics firm Net Applications.

The browser's increasing popularity has come at the expense of Internet Explorer (IE), which dropped seven points in the same time period, from 69.7 percent to 62.7 percent, according to Net Applications. IE's market share decreased by approximately one percent nearly every month in the second half of 2009.

On a positive note for Microsoft, data shows that IE 8 has nearly become the company's top browser version in use, at 20.9 percent in December, while the eight-year-old IE 6 was at 21 percent.

Chrome's rapidly increasing market share has been helped by Google's extensive advertising on its sites -- including the main search page-- and the recent release of beta editions for Mac and Linux. The browser's December increase of 0.7 percent was the largest since Google launched the browser and may have been partly due to the release of the beta editions.

In addition, Chrome's market share could receive a boost in 2010 with the release of Chrome OS netbooks, which require use of the Chrome OS.

However, Victor Janulaitis, CEO of Janco Associates, said in an e-mail interview that it should not be assumed that Chrome's market share will continue to increase. "We see a tendency of some to balk at the вЂcentralization' of control that Google is placing on data and personal information," he said.

If Chrome does continue to increase, it most likely would take from Firefox's market share, as that product seems to be stalled, Janulaitis commented.

In 2009, according to the data, Firefox's share grew from 22.1 percent to 24.6 percent, just short of the 25 percent milestone. In the same period, Safari increased its shares from 3.6 percent to 4.5 percent.

Will there ultimately be a "winner" in the browser competition, or more likely a leveling out for the top browsers? Janulaitis had a prediction: 65 percent IE, 20 to 25 percent Firefox and 10 to 15 percent Chrome.

Based in California, Net Applications measures usage with a pool of about 160 million unique visitors each month, obtained by tracking the systems the company monitors for its clients. Other companies that track browser usage come up with similar trends, though different numbers, such as StatCounter and StatOwl.

Google Fixes Bugs in Chrome Frame Affecting IE 8‘Avatar’ Dominates At Box Office