Update Java to thwart active cross-platform exploit

There is a rather serious vulnerability in Java version 1.6.0_26 that is apparently being actively pursued by hackers, one that is easy to implement and allows hackers to compromise systems without being detected.

The exploit was found a couple of months ago and was addressed in the latest round of Java updates both from Oracle and from Apple for OS X users; however, many people have not yet updated their systems and hackers are working to take advantage of this flaw on these systems.

The vulnerability allows a maliciously crafted Java applet to run undetected on many browsers and allows code to execute outside of the Java sandbox with the privileges of the current user. This means that malicious code in the applet can have access to any system feature your account has access to. For standard user accounts that's restricted to the user's home folder and attached disks, but for administrators it includes the Applications folder and parts of the global library and system folders.

This behavior is not particularly new for vulnerabilities; however, this one is a bit different in that the exploit is easy to perform, does not require authentication or other user input to run, and remains hidden on most browsers.

Beyond all of these details is the real issue here, which is that packaged versions of the exploit are apparently being actively sold and distributed among hackers on underground cybercrime networks, meaning that it is very likely to be implemented on many sites. If by chance a Google search results in you clicking a site that has this exploit, then if you have Java installed, your computer could be quickly compromised. All you have to do is visit a compromised Web site with a malicious Java applet, and most browsers will not even indicate the exploit is running.

In OS X, check the Java Preferences utility to see what version of Java you are running. You can use the preferences to disable Java applets as well.

(Credit: Screenshot by Topher Kessler)

Security community Metasploit took a recent look at this vulnerability, and found that the exploit, described as "a big one," is run completely and successfully on all systems running Java prior to version 1.6.0_29-b11, including Windows XP, Windows 7, Ubuntu Linux, and Apple's OS X.

On all platforms, only Google's Chrome browser gave any notification that a Java applet was running; other browsers like Safari, Internet Explorer, and Firefox gave no indication at all. Regardless of this difference, the malicious applet ran easily and successfully in all browsers.

According to Krebs on Security, the exploit "should not be taken lightly by any computer user," since Java is installed on more than 3 billion computing devices worldwide. Krebs cites Microsoft's Tim Rains as mentioning that Java-based exploits were the most common ones seen on computer systems in the first half of 2011, suggesting that hackers would be eager to get their hands on this current exploit.

Safari's preferences have an option for disabling Java.

(Credit: Screenshot by Topher Kessler)

This is a serious issue, but luckily the last update to Java distributed by Oracle, Apple, and other companies for their operating systems includes a fix for this problem. If you keep your system fully updated and if applied the Java patch when it was released then you have nothing to worry about; however, many times people ignore updates to software that they do not use, with Java being one of them.

To see what version of Java you are running on your system, launch your Java configuration tool or runtime environment and check the version there. For Mac users, Apple has stopped including Java with OS X but has it readily available to download if you run Java applications on your system. If you have not installed Java then you are in the clear. If you have, then go to your /Applicatons/Utilities/ folder and open the Java Preferences application. In here if you see the Java SE 6 version listed as being anything below 1.6.0_29-b11, then it is highly recommended that you update Java on your system.

The latest Java update is available via software update tools, so be sure to run them on your system (Apple's is available by selecting Software Update in the Apple menu). However, you can also download the updates directly from sites like Apple's Java Update 6 for Mac OS X 10.6, and the Java Update 1 for OS X 10.7. Non-Mac users can download the update directly from Oracle.

Firefox's Java handling can be disabled through its Add-ons manager.

(Credit: Screenshot by Topher Kessler)

In addition to updating Java, there are some other steps you can take to help secure your system, especially if you do not regularly use Java Web applets when browsing the Internet (and especially since most common Web scripting is done in JavaScript and PHP, or uses Flash). In the Java preferences, uncheck the option to enable applet plug-in and Web Start applications, which will prevent downloaded applets from launching. Additionally, in Safari's preferences uncheck the security option for enabling Java.

If you use Firefox, then to disable Java go to the Tools menu and select the Add-ons option to open the Add-ons Manager window. In here, click the Plugins section to the left, and locate the Java Applet Plug-in. Then click the "Disable" button next to the plug-in to prevent Java applets from running.

Again, this threat was addressed over a month ago, so while it is only now being found to be a serious issue, the fix for it has been available and ready for a while. However, as it's a recent update many people may not have yet installed it, so again, be sure to check your system and apply the update if you are not running the latest version of Java.

Read more: http://reviews.cnet.com/8301-13727_7-57335639-263/update-java-to-thwart-active-cross-platform-exploit/#ixzz1fQjmo45O

Read More

Why tech needs more IPOs like Zynga's $1B offering

(Credit: Flickr user ToonariPost)

Zynga has finally put numbers to what it wants to raise in an IPO: anywhere from $.85 billion to $1.15 billion. That's 100 million shares at a range of $8.50 to $10 a share.

Before you conclude that this is just another manipulative march of the high tech financiers, take another look. In a number of ways, Zynga is breaking with startup-looking-to-go-public business as usual. The likely reason is the number of newly-public tech companies that have already seen their stock prices drop below IPO levels. Maybe it signals a new direction for tech IPOs, and that would be a good thing all around.

The teasing come-on
Investors--both the big institutions as well as individual consumers--are mad for tech stocks. Past history is the guide to this current performance. People hope to get in early on the next Google (GOOG) or Apple (AAPL). Or if not something that big, at least a stock that will jump some in price and let them take a profit.

Tech companies moving into the IPO phase have used that desire to their advantage. Many, including LinkedIn (LNKD) and Groupon (GRPN), use a tactic called a low-float IPO. They (under the insistent tutelage of their investment bankers) release a small amount of stock, knowing that scarcity will drive up share price, at least in the short run. If done right, inside investors get to sell off shares at a pretty profit, while those who hop on the bandwagon afterward can lose when share prices don't move up enough to let them get out.

And now for something completely differentYou can even get situations like Groupon, where mere weeks after going public, buyers' remorse set in and the stock fell below the IPO price. Even some recent good sales news that boosted the price still left it below the $20 IPO watermark. (It's worth noting that this phenomenon is not entirely limited to tech stocks -- savvy investors have long known that IPO shares are often a better value months, rather than hours, after the initial offering.)

Although at first rumors predicted that Zynga would go the low-flow route, the company's just-amended S-1 filing was a surprise. Not only would there be 100 million shares available -- 14.3 percent of all shares outstanding in the A, B, and C stock classes together -- but in the $8.50 to $10 range, it would have a lower initial price than other recent IPOs. (To be realistic, many tech IPOs increase in price in the last week or two if there's enough demand in evidence.) And the company is actually profitable.

Not all is kind looks and soft words. Because of the stock class structure, voting is heavily tilted to the insiders, and Zynga changed the way it recognized revenue last quarter, which made the latest round of black ink possible. But on the whole, it's a company that can make money and that has pulled back some from the frenzy to drive up short-term stock prices so insiders can get theirs and the heck with everyone else. It's exactly what tech startups need more of: Profits and long-range thinking that considers the investors, not just the founders and original VCs.

Related articles

• Zynga IPO could raise as much as $1.15 billion (aboutware.blogspot.com)

Read More

Child proofing your Internet-enabled gadgets

More and more parents are giving their kids tablets, game consoles, laptops, and other Internet-connected devices as special holiday gifts. But how do you keep Junior safe as he's downloading apps, playing games online and exploring the World Wide Web?

Putting the iPod Touch on lock-down

Dear Maggie,
My 10-year-old daughter wants an iPod Touch for Christmas. I'm sure it's because all of her friends have one and are playing games and other apps on it. But I am nervous about getting her one. I trust her, but I do not think she needs all of the technologies that come on an iPod Touch. I really do not want the outside world getting in touch with her! Is there some type of other technology or device I can get her so she can play apps and at the same time not have a Skype phone, camera, video, GPS, etc.? I feel so old school, but I do not think a 10-year-old needs to be texting, etc!!! All and any advice would really be helpful!

Thanks,
Paula

Dear Paula,
I think you are absolutely right that a 10-year-old doesn't need instant access to the Internet at all times on her iPod Touch. But as you allude to in your question, it's getting harder for parents to find gadgets for their kids that aren't connected to the Internet. I've got some news for you. There are ways to turn the iPod Touch into a safe device for a child. But it will require you to make a few changes to the settings on the device.

Apple does a pretty good job of offering parental controls on all its iOS devices, so that you can restrict Internet access. For example, even though you can't shut off the Wi-Fi radio as part of the parental control setting, you can block the use of the Safari Internet browser. You can restrict access to YouTube. And you can disable app downloads on the device, so that she can't install a texting app or Skype or any other app that you think is inappropriate.

Still, I want to note that you will not be able to completely turn off the Wi-Fi radio on the iPod Touch through these parental controls. You can turn off the Wi-Fi radio in the settings, but that these settings are not passcode protected, so your daughter could easily turn on the Wi-Fi radio.

Still, with the parental controls enabled, you can lock-down the iPod Touch enough so that your daughter doesn't turn her iPod Touch into a Skype-phone or texting device.If you don't want her to have access to Wi-Fi at all, another option for you is to put a password on your home Wi-Fi router. (And don't let her know what that password is.) That way she won't be able to connect to the Internet from her iPod Touch while she is in the house. But this doesn't solve the problem for when your daughter takes her iPod Touch to a friend's house, where that family is likely to have Wi-Fi.

Setting up the restrictions is easy, too. They can be accessed right on the device. All you need to do is to set up a 4-digit passcode. (Make sure your daughter doesn't know it.) Then you go into Settings > General > Restrictions, and you enter a four-digit passcode. And finally, you can click on different options to restrict access to:

• iPod songs with explicit lyrics
• Safari
• YouTube
• iTunes
• Installing Apps
• In-app purchases
• Camera

While the parental controls are helpful if you want to completely turn off a lot of settings, they aren't as useful if you still want to provide access but you'd rather filter inappropriate content. Apple's parental controls are generally an all-or-nothing type of setting. So if you restrict access to the Safari browser or YouTube, your daughter won't be able to access those things at all. This might be fine now. But as she gets older, you may want to allow her more freedom. And that is where things get a bit more tricky. Parents may want to enable more functionality, but they still want to ensure their children aren't accessing inappropriate content or apps.

Luckily, there are several apps that can help you monitor your daughter's browsing and usage on her iPod Touch, if you ever feel like you want to allow her a bit more freedom. Mobicip Safe Browser is a popular Web filter. It can be downloaded from the App Store for $4.99 and it's used instead of the Safari browser on the iPhone, iPod Touch, and iPad. It's basically a browser that filters Web content to ensure it's safe for your daughter. iRover Surf Safe is another app that offers similar functionality. And there are many more.

But keep in mind that that filtering software isn't perfect. And some apps are better than others, so make sure you read user reviews before you buy one. I personally have not tested a lot of these apps, so I can't recommend specific ones, but doing a Google search should provide you with some options. Some reviewers of the Mobicip app complain that the app doesn't always filter out inappropriate sites, but it may filter out pages that are perfectly fine.

I think with the appropriate parental restrictions in place, your daughter will still be able to enjoy listening to music, playing games and using other apps on her device.

Good luck! And happy holidays!

Internet saftey first

Dear Maggie,
We are probably getting our kids computers this year. We have waited and held off, but it is becoming something they actually need for school. They are 10 years old and 8 years old. Do you have any advice about which laptops/Internet programs can help keep us in good shape. To think of them out there in Internet land all alone is frightening!

Thanks,
Cecily

Dear Cecily,
My first bit of advice is not to get a laptop for each of your kids. I'm not sure if that is something that the school is requiring or not. But they seem a bit young to own their own laptops.

I think your family might be better served with a single computer that everyone shares. And it shouldn't be a laptop that can be carried into someone's room. Most parenting experts say it's important to make sure children's online time is out in the open, where you can physically keep an eye on what's on the screen. If you give them laptops, it's harder to do that.

Anyway, I would invest in a nice desktop computer that you can put in a part of your house where there is more opportunity for adult supervision. You may not want it in the family room where others may be watching TV, but a den or office is fine so long as it's a place where you or another parent is frequently around. The idea is that you want to see what your kids are doing online. And the best way to do that is to have them doing it in front of you.

Also, if you just have one computer that the entire family uses, it's easier for you to manage. You will only have to install and use parental control software on one computer. And you'll only have to check browsing history on one computer.

As I mentioned in my answer to the previous question, Apple does a nice job with parental controls on its iOS products. And it also offers similar controls on its Mac computers. Each family member can get an "account" for the computer, so everyone signs in as an individual. And then you can customize access for each account, restricting what time of day each person can use the computer as well limiting what he or she can do once on the computer.

The nice thing about Macs is that if you live near an Apple store it's very easy to get help. So if you need some extra help with the parental controls, you can go to the store and ask someone or sign up for a class.

But Macs are expensive. So if you want more bang for your buck, a Windows PC is probably a better deal. And like the Mac, Windows-based PCs also have plenty of parental controls built-in. In Windows 7, you can limit how much computer time your children have, as well as which programs and games they can use (and perhaps more importantly, when). With the Parental Controls in Windows Media Center, you can also block access to objectionable TV shows and movies.

If you feel you need more granular tools for your PC or Mac, there are lots of software packages that you can download that can help you manage and monitor your kids' Internet usage. My CNET Reviews colleague Seth Rosenblatt recommends Norton's OnlineFamily.Norton software. In his review of the product a couple of years ago he said:

"There's a wide range of control over what sites a child can access. The restrictions can vary from a strict no-access policy that can block specific sites and site categories, to a more lenient notification e-mail sent to the parents when the child visits sites that parents merely want to be warned about. On the child's side, kids are given the option of e-mailing their parents when they're blocked--if the parents allow those e-mails in the first place."

He also explained that the software offers "House Rules" that "can be customized to suit the needs of individual children within each family, a useful feature since a teenager will have different browsing and social-networking interests than an 8-year-old."

Norton isn't the only such software available. There is also Net Nanny and SocialGuard from ZoneAlarm, among many others.

Seth also added that most paid security suites, such those from Kaspersky, Norton, and BitDefender, will include at least basic parental controls.

"I tend to advise people that if you've already got a paid security option on your computer, it's best to simply activate the parental control module," he said. "The top-shelf suites do not cause performance hits on your computer they way they did five or 10 years ago."

I hope this was helpful. And good luck!

Related articles

• Child proofing your Internet-enabled gadgets (news.cnet.com)

Read More

Kindle Fire already headed for No. 2 in the tablet biz

The Kindle Fire has proven to be an instant hit.

(Credit: Sarah Tew/CNET)

Well, it certainly didn't take long for Amazon's Kindle Fire to bring on the heat.

After only two weeks in the market, the Kindle Fire has skyrocketed ahead of many of its tabletcompetitors, according to IHS iSuppli. The market researcher is so confident in the Kindle Fire's success, that is already projecting it as the second-most popular tablet in the world, behind onlyApple's iPad.

The success of the Kindle Fire answers what had been a lingering question about the tablet business: whether consumers wanted tablets, or just iPads. The Kindle Fire's $200 price tag, along with other tablets that saw heavy discounts around Black Friday, are resetting expectations about how much consumers will pay for such a device.

That may bode poorly for manufacturers looking to compete directly against the iPad with more expensive components, larger and brighter displays, and even cellular service. So far, those companies have only seen middling interest in their products.

IHS projects Amazon will ship 3.9 million Kindle Fire tablets in the fourth quarter, giving it 13.8 percent of the global market, well ahead of No. 3 Samsung, which is expected to have 4.8 percent of the market despite offering a wide range of Galaxy Tab tablets. Both are still far behind Apple, which will hold 65.6 percent of the market.

"Nearly two years after Apple Inc. rolled out the iPad, a competitor has finally developed an alternative which looks like it might have enough of Apple's secret sauce to succeed," said IHS analyst Rhoda Alexander.

The Kindle Fire was largely helped by its more affordable price tag, significantly undercutting most other tablets. Amazon has an advantage because it can sell the product at a loss or minimal profit and make it up later by selling products and services through the device.

In fact, the most successful tablets have either started low, or dropped to a more affordable level. Nielsen had previously pegged the Hewlett-Packard TouchPad, which due to a fire sale that brought its price down to $99, as the second most popular tablet.

The BlackBerry PlayBook also performed well over Thanskgiving weekend, thanks to a massive discount that brought its price down to $200. Best Buy said it sold out of the devices.

As a result of the Kindle Fire's strength, IHS upped its forecast for total global tablet shipments by more than 4 million to 64.7 million units, representing a 273 percent increase over a year ago. Likewise, IHS boosted its longer term forecast, with shipments now expected to rise to 287.2 million by 2015.

Related articles

• Amazon Kindle Fire already headed for No. 2 in the tablet biz (news.cnet.com)

Read More

Android bumps up smartphone lead over Apple's iOS

(Credit: ComScore)

Android continues to woo more customers, increasing its lead over Apple's iOS in the U.S. smartphone arena, according to new stats from ComScore.

For the three months ended October, Android's share of U.S. smartphone users grew 4.4 points over the prior three months, helping it scoop up 46.3 percent of the market. Apple stayed firmly in second place, gaining an extra percentage point to win a 28.1 percent share.

In third place was BlackBerry maker RIM with 17.2 percent of the market, a loss of 4.5 points from the prior three months. That left Microsoft's Windows Phone with 5.4 percent and Nokia's Symbian with 1.6 percent, both losing a small fraction of a percentage point.

Overall, 90 million people in the U.S. owned smartphones during the three-month period ending October, a 10 percent gain from the prior period.

Among all mobile handset makers, Samsung remained the top dog with 25 percent of the market. LG and Motorola followed in second and third place, respectively, both losing a small slice of the market. That put Apple in fourth place with a 10.8 percent share and RIM in the fifth spot with 6.6 percent.

Using its MobiLens service, ComScore surveyed more than 30,000 mobile customers in the U.S to compile its numbers.

ComScore's findings echoed a similar report from Nielsen pointing to Android's widening lead over iOS. A recent study from Zscaler also showed Android outpacing BlackBerry and IOS in the enterprise market.

Read More