Archive for January, 2007
Webroot: Vista’s Defender stops only 16% of spyware
(InfoWorld) - Users who put their faith in Vista's new security features and Microsoft's Windows Defender antispyware product may find themselves under attack from spyware all the same, according to the results of a study by Webroot, a leading antispyware vendor and Microsoft competitor.
On Thursday, the company released the results of what it claimed was a two-week study of Windows Defender that showed the product missed 84 percent of a sample set of 25 spyware and malicious code samples. The programs that slipped by were a mix of spyware, Trojan horse programs, and keyloggers. While many were not Vista compatible and simply crashed, others were able to install on Vista systems, said Gerhard Eschelbeck, Chief Technology Officer at Webroot.
Eschelbeck identified variants of common malware programs like DollarRevenue Trojan, PeperTrojan, and Playboydialler that made it by Windows Defender. Some of the variants were recently released, though others dated back to 2006, he said. Of the four programs Windows Defender did stop, most were non-malicious adware, he added.
"We wanted to validate the strong claims out of the industry that Vista was going to be a security solution for everybody and everything," Eschelbeck said.
Webroot picked the malicious code samples from tens of thousands of samples collected on its Phileas spyware scanning network. Webroot's Spy Sweeper product spotted all of the samples.
When asked, Eschelbeck acknowledged that 25 samples was a tiny fraction of Webroot's database of tens of thousands of malicious code samples. He also acknowledged that it may be possible for Microsoft or other competitors to pick samples of malicious code that would evade Webroot's Spy Sweeper product, given advanced knowledge of how Spy Sweeper's detection features worked.
"Nothing's impossible," Eschelbeck said.
A Microsoft representative challenged the study’s finding, saying the company was confident in Windows Defender's ability "to make the user’s computing experience a safer one."
The company also noted that Vista was "the most secure version of Windows to date" and that the operating system, "includes fundamental architectural changes that will help make customers more secure from evolving threats, including worms, viruses, and malware.
“These improvements minimize the operating system’s attack surface area, which in turn improves system and application integrity and helps organizations more securely manage and isolate their networks."
Eschelbeck said the purpose of the study wasn't to make invidious comparisons between the two products, but to raise questions about the detection capabilities and management of the Windows Defender product as Microsoft expands its profile as an enterprise and consumer security software vendor. "It's important to leave the interpretation up to individuals," he said. "People need to make their own conclusions about it."
Eschelbeck said Microsoft updates Windows Defender's spyware definitions weekly -- far too infrequently for the fast-moving malicious code scene. Eschelbeck also warned that malicious code authors would soon adapt to the architectural changes in Windows Vista that stopped many of the malicious code samples that got past Defender from working.
Microsoft, in its e-mail statement, noted that "no operating system is 100% secure" and that users should employ a defense in depth strategy involving software updates, a firewall, and anti-virus/anti-spyware program, "whether a Microsoft or third party solution."
Webroot, which is venture-funded, was an early pioneer in the antispyware software space and is one of the leading sellers of antispyware software to consumers. However, the company's prospects have been hurt by Microsoft's entry into the desktop and enterprise security business and the company's decision to offer Windows Defender as a free download.
The Webroot study is just the latest in a salvo of company-sponsored studies that seek to undermine the credibility of competing security products.
In September, a Microsoft-sponsored study by 3Sharp compared antiphishing toolbars by Google/Firefox, AOL, EarthLink, Geotrust, McAfee, and others and found the Internet Explorer antiphishing technology the most accurate. The Mozilla Foundation fired back in November with a competing study by SmartWare that found the Firefox antiphishing technology better than that of Internet Explorer. A subsequent independent study by Carnegie Mellon concluded that few of the available anti-phishing products are very reliable.
Nintendo sales and profits surge on Wii, DS Lite
(InfoWorld) - Sales and profits at Japanese games maker Nintendo are surging on strong sales of its new Wii console and DS handheld gaming device.
The company sold 3.2 million Wii consoles in November and December this year together with 17.5 million pieces of software, it said Thursday. The console launched first in the U.S. on Nov. 19, and sales totalled 1.25 million units by the end of the year. In Japan, where it debuted on Dec. 2, sales were 1.1 million units, and in Australia and Europe, where it was on sale within a week of the Japan launch, sales reached 800,000 units before the year ended.
The successful launch of the console had a direct effect on Nintendo's financial results.
The company reported sales in the first nine months of its financial year, the period from April to December, were ¥712.6 billion, up 73 percent on the same period a year earlier. Net profit jumped 43 percent to ¥131.9 billion, and operating profit, which more closely tracks performance of the core business, more than doubled to ¥167.6 billion.
The popularity of Nintendo's DS also contributed to the performance. Nintendo sold just under 19 million units in the April to December period, and the handheld became the fastest rising gaming platform ever in Japan. New Super Mario Bros sold 8.6 million units, and other popular titles continued to perform well, including Touch! Generations, Brain Age: Train Your Brain in Minutes a Day!, and Nintendogs, the company said.
Earlier this month Nintendo, which is based in the western Japanese city of Kyoto, raised its financial forecasts for the full year because of the strong performance.
The company said it expects sales for the year to be ¥900 billion, a 22 percent increase on its previous forecast of ¥740 billion. Net profit is expected to be ¥120 billion, 20 percent higher than previously predicted.
Nintendo kept the Wii console sales target for the full year unchanged at 6 million units but raised its Wii software sales forecast from 17 million games to 21 million games.
German army recruits SAP
(InfoWorld) - Germany's Federal Armed Forces has recruited SAP as part of an IT modernization project.
The Federal Armed Forces has agreed to license SAP software for more than 140,000 users within the framework of its Standard Software Product Families (SASPF) project, the Walldorf, Germany, business software vendor said Thursday.
The contract calls for the deployment of the vertical SAP for Defense & Security software and the integration of the company's NetWeaver integration middleware.
The Defense & Security product family, which is tailored to meet the specific demands of military and security organizations, is based on mySAP Business Suite applications.
No financial details were provided.
Several thousand users in the Federal Armed Forces currently use SAP's core ERP offering, mySAP ERP 2005 for accounting, logistics and "business warehouse," according to SAP.
Next year, the human resources department, with more than 10,000 users, will migrate from mySAP 2004 to mySAP ERP 2005, which leverages the company's enterprise SOA platform.
SOA is a way to create and manage IT systems through reusable software and services. It is proving increasingly popular among corporations looking to more effectively use their existing data.
Judge orders countersuit against HP to be refiled
(InfoWorld) - A countersuit filed against Hewlett-Packard (HP) by a former employee alleging that the company resorted to corporate espionage against Dell's plans to develop a line of printers must be withdrawn and resubmitted under a seal of the court so its contents are not public, a federal judge has ruled.
Former HP executive Karl Kamb Jr. accused HP of paying off a former executive of Dell in Japan to reveal trade secrets of Dell's plans to enter the printer business. Dell had been a reseller of HP printers until it launched its own line of printers a few years ago. Printing and Imaging is one of HP's biggest and most profitable lines of business.
In a Jan. 24 order, U.S. District Court Judge Michael Schneider directed Kamb to withdraw his counterclaim against HP and to resubmit it under seal. The judge also issued a restraining order barring any parties to the case from discussing with the media the allegations contained in the counterclaim. The message "you do not have permission to view this document" popped up Thursday when the link for the counterclaim was clicked on the Web site for access to federal court filings. The lawsuit was filed in the U.S. District Court for the Eastern District of Texas.
But news reports about the counterclaim report that Kamb accused HP of spying on him, including using pretexting to obtain his phone records.
Kamb is one of four former HP executives sued in 2005 by HP for conspiring to start a business to make and sell flat-panel TVs while they were supposed to be developing a flat-panel TV business for HP. HP's suit asks for $100 million in damages from the defendants.
"This counterclaim is wholly without merit," said HP in a prepared statement. "It's a blatant attempt to delay the prosecution of the original case against the persons filing the counterclaim. We intend to vigorously pursue our original claim and to defend ourselves against this action with equal vigor.
HP's statement continued: "The claim that pretexting was involved in this investigation is, to the best of our knowledge, patently untrue. Furthermore, as we've said in the past, HP strongly rejects such methods of investigation and has said that those methods will not again be employed on behalf of the company."
Kamb's attorney has not returned a call seeking comment.
The allegation that Kamb was spied on come amid continued legal jeopardy for former HP executives and others in a pretexting scandal. In that case, former HP Chairman Patricia Dunn is among five defendants facing felony charges in California for conducting an investigation to identify the source of leaks from HP's board to the media. Private investigators hired by HP allegedly used false pretenses to get phone companies to reveal the calling records of people who were targets of the investigation.
One of the defendants in the state case, private investigator Bryan Wagner, pleaded guilty Jan. 12 in Federal District Court in San Jose, California, to similar charges. His attorney is going to petition in State Superior Court in San Jose Friday for the state charges against Wagner to be dismissed.
The other defendants, including former HP attorney Kevin Hunsaker and two other detectives, have not responded publicly to reports that the state has offered a plea bargain in which five felony charges, including conspiracy, would be withdrawn if they plead guilty to one misdemeanor count each.
Tech firms swarm on data protection problem
(InfoWorld) - Enterprise IT administrators didn't need the recent stories about large-scale data breaches at TJX Co. (network compromise potentially exposing credit data on hundreds of thousands of customers) or Canadian Imperial Bank of Commerce (lost hard drive with personal financial information on 470,000 mutual fund customers) or Nationwide Health Plans (backup tapes with data on 28,000 patients stolen from a lockbox) to convince them that data protection was an urgent problem in need of attention. Frankly, corporate boards of directors and auditors have been screaming it in their ear about it for a while now.
The biggest problem thus far, has been a dearth of enterprise-ready endpoint protection products that can monitor and lock down data transfers both online and offline without crippling productivity. But with the RSA Security Conference just over the horizon, news of a whole crop of new products due out on the market in the coming months may finally give IT some weapons to address the threats posed by USB stick drives, iPods, and other gaping holes in enterprise network protection.
Last week, CheckPoint's newest acquisition, PointSec, unveiled PointSec Protector, an enterprise data protection product that combines encryption technology Pointsec acquired with Reflex Magnetics to secure computer ports, storage devices, and e-mail.
PointSec started as a mobile data protection company focused on smartphones, PDAs, and other devices. That vision is broadening as employees’ use of personal removable media devices such as USB drives, Bluetooth smartphones, digital cameras, and music players pose a major security challenge, said Martin Leamy, president of PointSec.
The endpoint security news is coming hot and heavy this week, too. On Monday, startup endpoint security firm Provilla Inc. pulled the covers off LeakProof , an enterprise leak prevention product, said Glenn Kosaka , vice president of marketing at the Mountain View, California firm.
Taking a page out of Google's playbook, Provilla offers a free version of LeakProof, dubbed LeakSense, that will allow firms to see data transfer activity on their endpoints.
The new solution uses data fingerprinting technology, which Provilla calls "DataDNA," to tag sensitive data. DataDNA allows policies to be attached to specific pieces of information rather than whole documents. Policies are monitored and enforced by client software installed on the endpoints.
A DataDNA Server appliance acts as a central management console for configuration of policies and creation of DNA signatures from sensitive content. The Server scans network-attached storage and servers as well as all endpoints to find sensitive content in both structured and unstructured format. A Management Dashboard allows administrators to create and maintain security policies, view alerts and summaries of suspicious activity, and monitor the status and health of endpoint agents, the company said.
Benjamin Powell, a senior IT security analyst said his employer, a large financial institution, is deploying the LeakProof product in production for around 1,000 users after trying the product in beta for 11 months.
The company will use Provilla to monitor source code and data files and some types of data elements like credit card and social security numbers, he said.
Powell said the product was much needed, given that network based protections are easy to circumvent using USB devices or Bluetooth connections. However, Powell is looking forward to an update that will introduce login-based rather than machine-based privileges and policy enforcement, and a way to deal with offline policy exceptions, he said.
The drumbeat on data protection has been beating steadily for months now, as news about lost or stolen laptops and lost employee and customer data cast an unsavory light on the likes of HP, Starbucks, MCI, the University of California, and the Veterans Administration.
Those headlines have auditors pushing hard for companies to address the data leak problem, said Steve Roop, vice president of marketing at data protection firm Vontu, which is planning to announce its own major product upgrade on Monday.
"The big trend we've seen in the last six months is that auditors are giving very specific dates to do scanning, clean up data shares, and remove confidential data," said Roop.
Data theft and data protection are going to be major themes at the annual RSA Security Conference in San Francisco, which kicks off on Feb. 5, with more news from data protection news from companies like Tizor, Imperva, AppSec Security, and others on tap in the days and weeks ahead.