Windows Bug Enables PC Hijacking, Microsoft Warns

Microsoft Corp. last week confirmed that a bug in Windows Vista, Windows Server 2008, and the release candidates of Windows 7 and Windows Server 2008 R2 could be used to hijack PCs. The vulnerability in the Server Message Block (SMB) 2 network file- and print-sharing protocol that ships with those versions of the Windows operating system was first disclosed late last Monday, when a researcher posted exploit code. Microsoft recommended that users either disable SMB 2 by editing the Windows Registry - a task too daunting for most consumers - or block TCP Ports 139 and 445 at the firewall until a patch is available. The next day, Microsoft issued a security advisory confirming the bug and the fact that it could be used to "take complete control of an affected system." Microsoft did note that the release to manufacturing, or RTM, editions of Windows 7 and Windows Server 2008 R2 are not affected, along with earlier versions of the operating system, including Windows 2000, XP and Server 2003. However, the vulnerable release candidates have been widely distributed, with millions of users downloading Windows 7 RC when it was publicly available from early May through mid-August. However, the company acknowledged that blocking those ports would cripple several services and applications.

As expected, a patch for the recently revealed vulnerability in its Internet Information Services Web server wasn't ready in time for the monthly update. The Windows bug was disclosed the same day Microsoft delivered five critical updates that patched eight vulnerabilities in Windows, including one in the JavaScript engine that ships with every supported version of the operating system. This version of the story originally appeared in Computerworld 's print edition.

HP to focus on services with new print division

Hewlett-Packard on Monday formed a new print services division with a focus on managing print and imaging hardware and software in enterprises. The unit will also provide services and software that put scanned or printed documents in workflow systems to make document management easier. The division, called Managed Enterprise Solutions, aims to unify disparate hardware such as copiers, printers and scanners in order to cut hardware and printing costs, said Vyomesh Joshi, executive vice president of HP's imaging and printing group. The company's attention has been geared toward hardware and supplies, but software and services surrounding printing and imaging are a growing opportunity, Joshi said.

There is more to printing than just hitting the print button, said Roger Douglas, director of managed print services at HP. For example, software provided with the managed services could enable an invoice to be scanned, which can automatically be put into a company's payroll system. The company sees a US$121 billion annual opportunity in the printing market, of which $64 billion is for hardware and $57 billion for software and services. The automation reduces the number of steps and cost required to manage the document, Douglas said. The documents can also be secured through a service by establishing a status to ensure documents aren't appended, Douglas said. It also reduces the chance for error through manual transcription.

For example, if a marketing logo is finalized on a particular document, its status can be appended to ensure no one changes it. The company is also changing printer designs to build in more services-related functionality. This approach is particularly helpful when editing legal documents, he said. For example, a touch screen on multifunction printers can be used to input or check the job status of scanned documents like patient records. "A lot of times customers have treated imaging and printing like an afterthought," Douglas said. The company has also expanded the availability of a program that guarantees savings for customers who sign up for its print services outside the U.S. Under the plan, HP assesses a company's imaging and printing environment and calculates the possible savings a company can realize using HP's managed services.

Managed print is all about stepping back and taking a more strategic and methodical look at how those documents are managed, he said. If customers haven't realized the savings in a year, HP will make up the difference with a credit that can be used for their next printing services contract. The unit will be a part of the company's imaging and printing division, Joshi said. The company has already signed up 100 customers since it launched that program, Joshi said. The company has pulled some personnel from the existing services division and has seen its services customer base expand since acquiring EDS. HP has a strong presence in the printer market, and the expansion of services could help the company capture a larger share in the printer space, said Edward Crowley, CEO of Photizo Group, who was at HP's press briefing Monday.

The increased level of focus on services could also benefit HP's enterprise customers, he said.

Researchers slam fickle iPhone anti-fraud feature

The iPhone's new defense - meant to prevent users from reaching phishing sites - is inconsistent at best, a security researcher said today, with some users getting warnings about dangerous links, while others are allowed to blithely surf to criminal URLs. Other experts said that the fickle feature is worse than no defense at all. But according to Michael Sutton, the vice president of security research at Sunnyvale, Calif.-based Zscaler, the new protection is "clearly having issues." At first, said Sutton, the anti-phishing feature was simply not working. "It was blocking nothing," Sutton claimed after testing iPhone 3.1's new tool Wednesday against a list of known fraudulent sites. Apple quietly added an anti-fraud feature to the iPhone's Safari browser with the update to iPhone 3.1 , released Wednesday.

By Thursday, things had improved, but just barely. "Yesterday, it started blocking some sites, for some users, but it was inconsistent. Apple relies on Google 's SafeBrowsing API (application programming interface) for the underlying data used to build anti-phishing and anti-malware blocking lists for the desktop edition of its Safari browser. Some sites are being blocked, others are not." That led Sutton to believe that the feature's functionality wasn't the issue, but how Apple updates users with a "blacklist" of malicious sites. Other browser makers, including Google and Mozilla, also use SafeBrowsing. "It appears some iPhones are getting timely updates [from Apple], but others are not, or are getting different [block list] feeds," Sutton said. "I'm feeling better about the feature than I was Wednesday, but clearly Apple is still have issues. URLs that are blocked by Safari in Mac OS X open and direct users to malicious pages [on the iPhone]." Like Sutton, James reported inconsistencies in the anti-fraud feature's effectiveness. "All we've come up with is that sometimes it works and sometimes it doesn't," said James. "This is clearly more dangerous than no protection at all, because if users think they are protected, they are less careful about which links they click." The new feature is turned on by default in iPhone 3.1; the option to turn it off is in Settings/Safari/Security, and is listed as "Fraud Warning." Sutton, although willing to concede that Apple overall is improving its security track record, bemoaned the state of mobile security in general, and the iPhone's in particular. "The greater concern to me is that we're making the same mistakes in mobile that we made on the desktop," he said. "On the desktop, security has gotten slowly better, but [with mobile] we have a fresh start. With the [media] coverage of the problem, maybe they're resolving it, or trying to." On Thursday, researchers at Intego, a Mac-only antivirus vendor, echoed Sutton's findings. "This feature should warn users that they may be visiting a known malicious Web site and ask if they wish to continue," said Peter James, a spokesman for Intego who writes the company's Mac security blog . "However, we have extensively tested this feature, tossing dozens of phishing URLs at it, and it simply does not seem to work.

I would have thought we would have learned from our mistakes, but there's virtually no protection in mobile browsers." According to research conducted by NSS Labs, which was hired by Microsoft to benchmark different desktop browsers' ability to block malware-laden sites, Safari in Mac OS X and Windows blocked only one-in-five malicious sites . Internet Explorer and Firefox, meanwhile, blocked 80% and 27%, respectively. Last month, NSS Labs attributed the disparities between Firefox, Safari and Google - all which use SafeBrowsing as the basis for their blacklists, to differences in how each browser tweaked, then applied, the lists. Google's Chrome blocked a paltry 7% of the sites.

Undersea Internet cables undergoing repairs after typhoon

Some undersea fiber-optic cables that carry Internet and communications traffic to parts of Southeast Asia and China have already been repaired while officials continue to assess damage to others, a spokesperson for Chunghwa Telecom said Friday.

Six of the important fiber-optic cables were damaged by undersea landslides caused by Typhoon Morakot as it passed Taiwan. One was knocked out on Aug. 9 as Morakot hit the east coast of the island and the others were damaged after the typhoon passed to the other side.

The damaged cables disrupted Internet and telecommunications between Taiwan, China, Hong Kong and parts of Southeast Asia, including Singapore and the Philippines. However, Chunghwa Telecom of Taiwan restored service quickly by using backup systems and rerouting traffic to other cables.

The APCN2 (Asia Pacific Cable Network, number two) was damaged in at least two places, said Chen Hui-yen, a deputy director at Chunghwa's network management division. One part, which runs between Singapore and Malaysia, was fixed Friday morning, she said, while a portion of the cable near Taiwan has not been repaired yet, although a team has been dispatched to the location.

She did not know the cause of the problem with the cable section between Singapore and Malaysia. She said some voice traffic and Internet traffic has been affected by the outages but rerouting has alleviated most problems.

The five other undersea cables damaged near Taiwan by Morakot were the SWM-3 (Southeast Asia - Middle East - Western Europe 3), the APCN (Asia Pacific Cable Network), C2C Cable Network East Asia Crossing (EAC), C2C Cable Network (C2C) and FLAG (Fiber Optic Link Around The Globe) North Asia Loop (FNAL).

One factor complicating repairs of the undersea cables has been trying to coordinate the various groups invested in the cables, she said. She was unable to offer a time frame for when cable repairs might be completed.

Undersea fiber optic cables carry the bulk of the world's Internet and communications traffic. Natural disasters such as earthquakes and deep sea landslides can disrupt the cables.

Typhoon Morakot was originally welcomed by people in Taiwan as a potential savior for a drought that had been affecting much of the tropical island. Some cities, including the old southern capital of Tainan and the norther port city of Keelung, had already imposed water restrictions. But Morakot brought far more rain than expected, causing massive floods and landslides on the island.

The presidential office said the rains from Morakot were the heaviest in 50 years.

Typhoon Morakot has been blamed for the deaths of 116 people in Taiwan, according to government figures, and officials expect the toll to continue rising. Rescue workers believe over 300 people in one village, Hsiaolin, may have been buried alive in a massive landslide of mud and debris.

Rescue workers saved 2,200 people stranded by landslides and washed out roads and bridges in mountain villages near the southern city of Kaohsiung on Thursday. Thousands remain stranded in disaster areas and rescue work continues.

Taiwan's Council of Agriculture estimates the typhoon destroyed NT$10.67 billion (US$324.3 million) of crops and other goods, including tens of thousands of livestock such as pigs, chickens and ducks.

How to Learn Anything on the Web

A tutorial or class for almost everything and anything is available online these days. Whether you're looking to beef up your résumé with some new skills, to get a degree while waiting for the job market to pick up, or simply to have a little fun learning something new, the Web has a wealth of educational resources-many of them free of charge.

To give you some ideas, we've put together a list of sites in several categories, from skills for budding entrepreneurs and learning foreign languages to gourmet cooking and the choreography for Michael Jackson's iconic Thriller dance.

You can always Google for anything you don't see here, but be careful as you click. In researching this story, I ran into many sites that either tried to sell me classes (with little or no real free instruction) or were infested with pop-ups and adware. Antimalware software is a must. (See PC World's free downloads of antimalware programs.)

Get a Business Up and Running

So you have a business in mind? Start with a business plan that outlines the specifics of how you intend to make money-essential for attracting investors and useful for your own reality checks. BPlans.com, run by PaloAlto Software (creators of Business Plan Pro software) offers dozens of articles, sample plans, and templates to help you get going. This is one of the few sites that, while it does market a product (you need its software to edit a sample plan and use it for your own enterprise), delivers a slew of genuinely useful content for free. (And you can always simply recreate the sample plan using Word and Excel.)

Once you've launched your business, you'll have to keep financial records. But even if you use software such as Quickbooks, it's a good idea to understand how basic accounting works. Small business consultant Dave Marshall's Bean Counter site features free tutorials on basic business accounting and bookkeeping.

And because so many aspects of business require presentation skills, it's useful to have a working knowledge of Microsoft's PowerPoint. About.com's Presentation Software site provides a Beginner's Guide to PowerPoint that gathers 11 tutorials to get you going.

Your business will need a Web site too. You can pay someone a lot of money to create it, but if you would like to dig into the complexities of modern Web design, LearnWebDesignOnline.com is a good place to start, with links to tutorials, videos, and books on all aspects of site creation. Another resource is SiteGround, a Web hosting company that provides an impressive tutorials page for learning about both Web hosting in general and a wide array of specific applications for content management and site creation (WordPress, Dreamweaver, and the like).

If you're interested in putting together a news site, J-Learning.org provides guidance on everything from blogging tools and multimedia creation to SEO and legal issues-all for free.

To help bring visitors to your site, you'll need to learn the basics of search engine optimization (SEO). Search consultants SEOmoz's free Beginners Guide is a good place to start.

Improve Your Tech Skills

Okay, time out for a little self-promotion. For general hardware upgrades, setup instruction, and software tips, look no further than PC World's own How-To page. Organized by category, there's an amazing wealth of guidance (in print, video, and slide shows) for everything from swapping out a PC's processor to getting Microsoft Office to work better.

However, for professional in-depth training in specific applications, Lynda.com has established itself as the go-to place, with thousands of videos and tutorial files for hundreds of applications. It's not free, but if you're serious about learning a complicated application, its subscription-based fees are a good value. (Read PC World's recent review of Lynda.com.)

Have you ever wanted to explore the mysteries of computer programming? You can find a slew of programming tutorials online, but I like British programmer Alan Gauld's Learning to Program, an online version of a book he's written. It's not particularly slick, but he writes clearly and accessibly, and he uses Python, which experts tell me is a good programming language to start with.

Next: Formal Education, Languages, and Life Skills

Formal Education

The Internet has turned distance learning into a reality: Today, you can get all sorts of degrees and professional certificates through online courses. But not all online learning institutions are created equal. To avoid scams, start your search for Web-based higher education at The Sloan Consortium's Sloan-C Catalog. It's a list of degree and certificate programs offered by regionally accredited institutions who have become Consortium members (either because they've received grant support from the respected Alfred P. Sloan Foundation or through a peer-review process). You can search by discipline, type of degree or certificate, state, or institution name.

If you or someone you know wants to earn a GED (General Educational Development) credential (the equivalent of a high-school diploma), learn about the process from the organization that administers the GDE program, The American Council on Education. You can't take the test online, but dozens of sites offer to prep you-and many of them look pretty sleazy, so I'd stick with the ACE's links to practice tests and educational resources.

If you don't care about getting a degree and simply want to broaden your horizons, head over to YouTube EDU, a very cool YouTube subsite devoted to videos of interviews, courses, and lectures from professors at top colleges and universities. Some are mostly course promos (such as Carnegie Mellon physics professor Barry Luokkala's description of his Science and Science Fiction course) but some have real content (such as this MIT course on creating compilers).

Learn a Foreign Language

It's easy to find sites that sell foreign-language instruction online. But here are some neat ones that don't charge for instruction and also offer audio clips:

Chinese (Mandarin): Chinese-Tools.com, the English-language version of a site run by a native French speaker who has lived in China for six years, is a fantastic resource. It not only has audio clips (crucial since Chinese depends on tone and inflection as well as simple pronunciation), but also calligraphy instruction.

French: About.com's French Language site provides lessons for beginners as well as interesting extras including sections on idiomatic expressions and typical Gallic gestures.

Italian: Oggi e Domani (which means "today and tomorrow" in Italian) focuses on conversations in its lesson-based approach.

Russian: I found a couple of sites that seem to be duking it out for supremacy in free online Russian-language instruction: Russian Lessons.net and Learning Russian.net. Of the two, Learning Russian.net looks slicker, but Russian Lessons.net appears to have more resources.

Spanish: 123TeachMe offers Spanish lessons for beginners, advanced students, and tourists (conversational Spanish).

Life Skills

Some things you just can't learn in traditional classrooms. Real Simple has tons of how-tos for around-the house skills-I like the Daily Quick-Cleaning Checklist, which promises to get your pad presentable in under half an hour. For the truly domestically challenged, WikiHow has a page on how to make your bed.

EmilyPost.com, the Web home of the Emily Post Institute, does get a little heavy-handed on selling books by the late doyenne of good manners and her descendants, but there are lots of free articles that provide advice on specific etiquette dilemmas.

And if you're looking to make dinner with whatever's in your refrigerator, simply enter the ingredients into the search fields of FoodNetwork.com, Epicurious or RecipeSource (formerly SOAR, or the Searchable Online Archive of Recipes). For really great how-to's (not to mention recipes and juried product and equipment ratings), consider investing $35 a year (less if you subscribe in print, too) in the online version of Cook's Illustrated, the ad-free Consumer Reports of cooking.

Need help with your finances? Motley Fool is one of the oldest and best sites to learn about investing and personal finance (and their discussion boards are great, too). If you're looking ahead to retirement, the Labor Department's Consumer Information on Retirement page answers a lot of questions on private pensions, 401ks, and the like.

Next: Sports and Games, Performing Arts

Have Some Fun

Learn to play a game: ChessDryad.com's How to Play Chess page will get you from learning the mechanics of the game to classic moves, with primers and flash animations. Veteran bridge author Richard Pavlicek has put his Bridge Basics textbook online for people wishing to learn the popular card game. For neophyte poker players, Charles Bloom has put up a Texas Hold'em primer.

For sports (or anything else highly physical and visual), you can't beat YouTube: For example, I found dozens of skateboarding how-tos, but the one I actually felt I could learn from was this unpolished but accessible effort credited to one "Eswolowski" and posted by a user named tevens22.

However, not all sports stuff is on YouTube. Aspiring soccer moms and pops should check out How to Play Soccer, which not only teaches the rules of the game, but offers tips for parents who serve as coaches or spectators.

Showbiz Stuff

Aspiring musicians, dancers and filmmakers can also find instruction online. SoYouWanna.com offers a guide for making low-budget movies.

Like to sing along in perfect harmony? ChoralWiki maintains a database of free choral sheet music. If your garage band needs help figuring out the guitar solo in Dire Straits' "Sultans of Swing," head to 911tabs, a very nifty search engine for tablatures (musical annotations showing fingerings for specific pop and rock songs). You can search by song and by instrument.

Verizon scores $245 million HHS contract

Verizon Business will make as much as $245 million providing the Department of Health and Human Services with telecom services through 2015, the company said Tuesday.

Under the contract, which was administered under the Washington Interagency Telecommunications System, Verizon will supply the HHS with voice and data services, dedicated voice mail, and audio, video and Web conferencing. The deal will be worth up to $245 million if all of its options are exercised, Verizon says. The HHS figures to be a particularly important federal agency over the next few years, as its public health research and food and drug safety programs figure to play a key role in implementing healthcare reform.

Verizon's $245 million deal is the third major government contract that the company has won this year. Earlier, Verizon signed a massive $2.5 billion deal with the Department of Defense to provide fully managed transmission services for the for its Pacific-region Defense Information Network System (DISN) that covers military installations in the Asia-Pacific region, as well as regions of Canada, Central and South America and the Middle East. The network is the Defense Department's official enterprise-class network for providing data, video and voice services. Marlin Forbes, a regional vice president for Verizon Federal, says the network supports everything from personnel and medical systems to intelligence programs.

Verizon also signed a $108 million deal in January to provide teleconferencing services to government space agency NASA. Under the terms of that contract, Verizon is due to provide NASA with audio, video and Web conferencing services through 2017. Although Verizon has provided NASA with all of its teleconferencing services since 2001, the new contract states that the carrier must also provide high-definition IP video conferencing that will serve as an upgrade to NASA's current video conferencing system.

VMware offering 'safe passage' to Virtual Iron users

VMware is trying to exploit uncertainty among customers of Virtual Iron, the virtualization vendor recently acquired by Oracle, with a new "safe passage" plan that offers Virtual Iron users steep discounts on certain VMware products if they switch.

Specifically, VMware is offering 40 percent discounts off list price for its vSphere 4 Advanced Edition and Enterprise Plus Edition, as well as vCenter Server Foundation and vCenter Server Standard.

In addition, the vendor will take 10 percent off the cost of support and subscription contracts for one year on those products. Two or three-year contracts don't qualify for the discount, however.

The offer is valid through Sept. 30, according to VMware. Customers must prove they have a current Virtual Iron support contract, and the amount of Virtual Iron sockets listed on that contract must be the same or more than the number of CPUs of VMware product they buy.

A VMware spokesman did not immediately respond Tuesday to a query about whether VMware is also offering other key enticements, such as fixed-price services engagements for handling the transition to its software.

"Migration from one platform to another is always challenging, irrespective of the tooling or resources applied to the task," said Redmonk analyst Stephen O'Grady. "Virtualization is no exception to this rule. That said, in situations such as this, where support has or will be discontinued, the drivers compelling migration often become more powerful than the obstacles to it."

Oracle bought Virtual Iron in May to round out its Oracle VM product family. It was specifically interested in Virtual Iron's dynamic resource management and rapid server provisioning capabilities, according to a FAQ document released earlier this year.

The FAQ sheet indicated Oracle has no intention of continuing to sell Virtual Iron's products in stand-alone form, saying the vendor will "fully integrate Virtual Iron technology into Oracle VM" and that any enhancements to Virtual Iron's software would be "delivered as a part of the combined solution."

But it is not clear when such a product will be released, or whether any components of Virtual Iron's technology will not survive, creating a cloudy picture for customers.

One Virtual Iron customer, the Baltimore, Maryland, law firm Goodell, DeVries, Leech & Dann LLP, is "absolutely" looking to migrate to another platform, said David Roden, director of technology.

"For us, it's almost like there's really no choice based on what we've seen from Oracle. So far, it's clear there's no future for Virtual Iron." Roden said.

Other than a few form letters, including an e-mail that told the company how to register for support through Oracle's network, the firm "hasn't really heard anything" from the vendor, according to Roden.

The firm is "not especially" interested in waiting for Oracle's merged product, because time is of the essence. "You just don't implement a new virtualization system overnight. There's no point in waiting."

Roden is starting to look at alternatives now, including VMware, but the field of prospects is small.

"The obstacle to VMware has always been price, not features or capabilities," he said. "It really comes down to, are we going to bite the bullet and spend the money for VMware or look at what is still an immature product in [Microsoft's] Hyper-V."

When it occurs, the conversion project will be a "huge" undertaking for the 135-employee firm, Roden said. "When we first put Virtual Iron in production we had zero virtual servers. Now I've got 25 of them that will have to be converted."