Friday, July 25, 2008

Fortify Your Internet Security Settings Now

The Web became a substantially more dangerous place this week, thanks largely to the publication of instructions that show cyber criminals how to exploit a pervasive, critical flaw in the Internet infrastructure.

While Internet service providers and corporations can mitigate the danger by updating the software that powers vulnerable components of their networks, data released yesterday indicates that only about half of the world's online population is currently protected by these updates.

At issue is a basic design flaw in the domain name system. DNS is the communications standard that acts as a kind of telephone book for the Internet, translating human-friendly Web site names like example.com into numeric addresses that are easier for networking equipment to handle and route.

When people type a Web site name into their Internet browser, the process of routing of that name to Internet address is generally handled through DNS servers managed by Internet service providers and corporations.

But according to research released this month, most of those DNS servers are vulnerable to a security flaw that allows miscreants to silently alter the virtual road maps that those systems rely on to route traffic. As a result, a cyber criminal could trivially rewrite those records so that when customers of a vulnerable ISP or network provider try to visit a particular Web site, they are instead taken to a counterfeit site created by the bad guys.

For example, if exploited, this flaw can easily help scammers steal personal information, such as social security numbers or bank accounts, by tricking people into entering sensitive data at fake bank and e-commerce sites.

Dan Kaminksy, the security researcher who discovered the flaw, worked in secrecy for nearly six months with a handful of other researchers to devise a fix for the flaw. On July 8, in a rare coordinated effort, dozens of software vendors - including Microsoft -- shipped security patches to help customers and network providers protect themselves.

On Wednesday, computer code demonstrating exactly how to exploit the flaw was posted online. The code also was summarily folded into Metasploit, a tool that makes exploiting the vulnerability a point and click operation within the reach of even the most novice of hackers.

In a conference call with reporters on Thursday, Kaminsky said that data from a diagnostic tool he placed on his Web site to let visitors see if their ISP had patched the problem showed a large number of providers had indeed fixed it on their end, but that many still have not addressed the issue. Kaminsky said that on July 8, when the patches were first released, roughly 86 percent of the people who used the test tool were coming from unsecured networks. As of Thursday, he said, about 52 percent of visitors were in the same boat.

Lest anyone think this vulnerability is mere hype, consider the warnings from Kaminsky and others who say the flaw is attracting plenty of attention from cyber criminals.

"This attack is being weaponized out in the field," Kaminsky said.

Joao Damas, senior programming manager at the Internet Software Consortium, the entity which maintains BIND - the open-source software provider that powers a massive share of the DNS servers worldwide - said he has seen evidence of attackers trying to exploit the flaw.

"I have seen already code that is geared at exploiting this out in the wild, and I'm not even looking for it," Damas said.

My advice to readers is to visit the testing tool on Kaminsky's site. If the response is that your ISP is vulnerable, please post a note in the comments section saying so. If your ISP has not yet addressed this important flaw, please also consider protecting yourself using one of the following methods.

--Set up your system so that it uses the DNS resolvers provided by OpenDNS, an entity that provides a free service which routes all of you Web site queries through DNS servers that are not only patched against this flaw, but which can help you better spot phishing Web sites and prevent people on your network from visiting otherwise objectionable Web sites.

--Reconfigure your DNS settings to use servers that are known to be patched against this flaw. A few of those servers include 4.2.2.1, and 4.2.2.2. To do this in Windows, click Start, Control Panel, Network Connections, and double-click on the connection name that says it's already connected. From there, scroll down to the Internet Protocol setting, and click Properties. If it is not already checked, change the radio button to "Use the following DNS server addresses," and then type in 4.2.2.1 and 4.2.2.2 in the settings below. Click "OK" to finalize the settings. Note that you will only be permitted to make these changes if you are logged in to Windows using an administrator account.

While the patch Microsoft shipped earlier this month to address this problem on Windows machines addresses a facet of the vulnerability that is much more difficult for the bad guys to exploit, Windows users should still follow these steps. Many Windows users no doubt delayed installing this update or uninstalled it, following news that it prevented users of ZoneAlarm firewall products from being able to get online. ZoneAlarm has since pushed out an update that fixes this compatibility glitch.

One final note: While some people may question the sanity of making these changes given the fluid nature of ISPs working overtime to address this flaw, I would strongly urge readers to err on the side of caution. For one thing, online scam artists have shown to be increasingly eager to adopt the latest methods for scamming people online. Secondly, the stopgap solutions mentioned here are fairly simple fixes, remedies that -- even if left in place indefinitely -- will not adversely affect the online experience of most Internet users.

Infamy or beautiful friendship

IT is a high ambition of the Rudd Government to greatly deepen Australia's engagement with India. Well, it is about to get the opportunity to do just that. This week, the Indian parliament passed a momentously important vote of confidence in the Government of Manmohan Singh.

This vote could be a pivot point in modern history. It was all about India's nuclear co-operation deal with the US. That Singh won the vote means that deal proceeds through its next vital stages, during which Australia, specifically the Rudd Government, will face two moments of decision that will be crucial for us.

In 2005, Singh agreed the deal with the Bush administration. Singh's Government was a coalition of his Congress Party and a range of parties on the Left. Its main opposition is the Hindu fundamentalist party, the BJP, on the Right. And then there are a range of regional parties of no fixed ideological address.

India is not a signatory of the nuclear non-proliferation treaty and is not one of the five accepted nuclear weapons states (the US, Britain, France, Russia and China). But it possesses a nuclear weapons arsenal, so the world will not trade in nuclear materials or technology with India. This has partly blighted India's peaceful nuclear energy program.

Under the deal India will separate its peaceful nuclear energy program from its weapons program. It will put the reactors devoted to the production of electricity under complete supervision by the International Atomic Energy Agency and commit to a voluntary moratorium on further tests of nuclear weapons.

In exchange the US will help India's peaceful nuclear energy program and will encourage other nations to engage in nuclear trade with India. France and Russia will sell nuclear reactors to India.

The deal was stalled for a long time because the left parties supporting Singh, especially the communists, hated it as they saw it drawing India into the US's strategic camp. The BJP opposed the deal, saying it gave away too much Indian sovereignty.

There, it seemed, we were stuck. But Singh - one of the most admirable men involved in international politics, a technocrat economist by profession, a politician by accident, and the true father of India's economic reforms - struck out against the left parties.

He proceeded with the deal and they deserted his Government. Now, in a magnificent democratic moment, he has won a decisive vote of confidence. There was a fierce and passionate debate in parliament. Much of it was of the highest quality, some of it was of the lowest farce. Some MPs brought wads of cash into the parliament saying they had been offered bribes for their vote. But no one has ever doubted Singh's personal integrity and no one does here.

It is worth pausing to praise Indian democracy. We all have a huge stake in India's success. The confidence vote shows that even big, raucous democracies can make fundamental strategic decisions. With the resurgence of tyranny as a political ideology in Russia and China, it is absolutely critical that India succeed in combining democracy and development. And this vote gives that combination a huge shot in the arm.

The mechanics of the deal means that it will now be considered by the IAEA, perhaps as soon as next week. The IAEA is expected to provide a special set of arrangements for India.

This may be complicated by a last-ditch effort from Pakistan to get the deal scuttled. But last night the smart money was on the IAEA approving the special arrangements for India.

Then the deal must be approved by the Nuclear Suppliers Group. Here's where Australia comes in. With something like 40 per cent of the world's known uranium reserves, Australia is a key member of the NSG. So far, the Rudd Government has not said whether it will support the US-India deal at the NSG or oppose it.

It has however hinted that it would support the deal at the NSG, a hint Foreign Minister Stephen Smith repeated yesterday. Certainly Australia could kiss goodbye forever the idea of any decent relationship with India if it opposes the deal at the NSG.

Accepting the deal at the NSG would not commit Australia to supplying uranium to India. However, that will be the next big question.

If the NSG can be sorted out in the next six weeks or so, the Indians are still hopeful that they can get the deal to the US Congress for final ratification by September. It would also need a further ratification in the Indian parliament. US Democratic presidential candidate Barack Obama has indicated he will not seek to renegotiate the deal. Republican John McCain will also support the deal.

Opposition foreign affairs spokesman Andrew Robb has effectively homed in on the contradiction between the Rudd Government selling uranium to China - which has a terrible, though not recent, record of nuclear proliferation - while refusing to sell uranium to India, which has never passed on nuclear technology to anyone.

The Howard government had decided in favour of selling uranium to India. It is fair to say this debate has not yet moved beyond the specialists. But the Rudd Government will face a deep contradiction between supporting the US-India deal in the NSG, then saying it will not sell uranium to India. It will face an even bigger contradiction between its concern with greenhouse gas emissions and taking action, by refusing uranium to India, that impedes the development of clean energy.

Singh told the Indian parliament: "India needs to grow at 10 per cent to get rid of chronic poverty, ignorance and disease ... A basic requirement is the availability of energy ... We must make full use of atomic energy, which is a clean, environment-friendly source of energy.

"All over the world there is growing realisation of the importance of atomic energy to meet the challenge of energy security and climate change."

In his speech, Singh listed 10 countries with which India has particularly good relations. Australia was not among them.

I suspect that very soon we will enter the top 10 with a bullet or sink to a previously unimagined place of infamy in the Indian mind. This Indian parliamentary vote was mighty important for us, too.

US confident of getting IAEA,NSG nod;cites India's trackrecord

Ahead of the crucial IAEA meeting, the US today said it was confident of making "a very good case" before the UN atomic watchdog and NSG for the nuclear deal with India because of New Delhi's impressive non-proliferation record and would "expeditiously" push the agreement in the Congress.
"The civil nuclear deal is important for the United States, important for India, but also important in helping to advance the nonproliferation framework, the regime in which countries are operating," US Secretary of State Condoleezza Rice told reporters in Perth.

"I think that's why the deal has received the support of Mohamed El Baradei (chief) of the IAEA because India has a very good record on proliferation," Rice said at a joint press meet with Australian Foreign Minister Stephen Smith who gave the clearest indication so far that his country is ready to back the deal at the NSG despite its refusal to sell Uranium to India, asserting that they were two different issues.

In her first public comments after Manmohan Singh government won the trust vote, Rice said "we welcome the parliamentary vote." Rice said the US will continue to consult with countries of the IAEA Board of Governors and with the Nuclear Suppliers' Group (NSG). "But I think we can make a very good case that this is a not just a landmark deal, but a positive landmark deal," the top US official said.

Asked whether the deal will go through before the end of the Bush Administration's term in January, Rice said "it's certainly our hope that we can get through all of the processes and get this done in the Congress. And were going to work very expeditiously toward that goal." PTI

BANGALORE BLASTS: 2 DEAD, 6 INJURED

At least two persons died and six were injured when eight blasts triggered by a timer device hit Bangalore's central business district and other crowded areas.


Bangalore City Police Commissioner Shankar M Bidari and Union Home Secretary Madhukar Gupta confirmed that seven blasts shook Bangalore.


The first blast took place near Madiwala checkpost at around 1330 hrs IST with Additional Commissioner of Police, Bangalore, Gopal Hosur, confirming that a timer device was used to trigger the blasts.


All the blasts took place with 15 minutes of each other.


The crude bombs, stuffed with nuts and bolts, exploded at Madiwala, Adugodi, Nayandahalli, Pantharapalya and Vittal Mallya Road.


Laxmi, a garment factory worker, was killed while waiting at a bus stop in Madiwala on the Bangalore-Hosur Road. Her husband and another person were seriously injured.


The other dead person has been indentified as Anbu, a labourer.


Police claim to have recovered gelatin sticks, mainly used in quarry operations, from one of the blast sites.


Bomb disposal squads have been rushed to the blast sites and telephone network have been jammed to stop the spread of rumours.


Bangalore Police Commissioner Shankar M Bidari said, "We are monitoring the situation and request all residents to continue with their normal routine. The bomb squad and explosives experts are on the spot. We will deal with the situation."


All the injured have been taken to Mallya Hospital near Rajaram Mohan Rai circle.


Bangalore was rocked by a major terrorist attack in December, 2005 when some unidentified extremists opened fire in the Indian Institute of Science complex killing an Indian Institute of Technology-Delhi professor MC Puri.


Bomb disposal squads and forensic experts have rushed to the blast spots for investigations

Google Says Google News Not Priceless

Despite no ads or any obvious revenue generation, Google News is worth $100 million to Google, according to VP Marissa Mayer.

How does zero equal $100 million? As one of Google's many for free peripheral services, enough people sort of ride the Google wave over to the search engine from the News page. In Google's estimation, all that referral traffic is worth a pretty penny.

An angle like that sort of puts in perspective what the search giant gets out of its colossal new product fail rate: a few things that stick and send people over to the money pot. Google's a portal (a media portal, at that), as many have argued for years, and portals require some side activities to keep the consumer engaged.

Hot Trends, for example, even gives you the terms to search for. Smart, eh?

Google Health? Consider that a branding freebie; Google decided correctly contextual ads for Preparation H next a hemorrhoids diagnosis wouldn't just bring bad PR, but was also a little creepy. Need a lawyer for the mesothelioma problem?

Yeah, probably good Google said no thanks to that. Internally, they probably figure Google Health helps facilitate searches on the users' own terms.

Hard to say what it means exactly, but Mayer's valuation is also interesting considering the rumored price tag on Digg.com. If Digg sells to Google for $200 million, is that an admission Digg's worth twice as much Google News?

Thursday, July 24, 2008

Knol: Google does a pedia

Knol doesn’t rely on just anybody to create its collection of knowledgeable articles. You get to be the author, the buck stops here byline on a contribution, and if you write it, you kind of own it. Unlike Wikipedia, which it is compared to, Knol has a commercial bent. You get to run ads, too, and, in theory, make some money off of your expertise. It’s not a new concept, but it is a Google concept, and that’s about all it takes for the world domination theorists to come out of the woodwork. But, does it have legs?

After months of teasing and internal testing, Google officially launched its eagerly-anticipated online encyclopedia announced in December . The service dubbed Knol aims to organize the collective knowledge of Internet users into a searchable, browsable service that has been compared to Wikipedia. However, this is where similarity with world's famous online encyclopedia stops. At first glance, Knol feels more inviting and Web 2.0-like, which may attract those put off by the academic appeal of Wikipedia. But, ultimately, it will come down to content and Google thinks it got it right with Knol.

"Knols are authoritative articles about specific topics, written by people who know about those subjects," explained Knol product manager Cedric Dupont and software engineer Michael McNally in a Google blog post Wednesday. You will not have to be a rocket scientist to post a knol because everyone can become an author. And you also get a chance to earn some money on content you post, if you opt to run.

Similarly to the Facebook culture, Google will try to persuade authors to use their real names (although this will not be a requirement) and to stand behind their work, unlike Wikipedia where mostly anonymous authors post articles. Google says it will provide optional author identity confirmation via telephone or credit card verification. Verified authors will have a "verified" stamp added to their knols.

With Knol, multiple authors will be able to write about the same topic. "The key principle behind Knol is authorship. Every knol will have an author (or group of authors) who put their name behind their content. It's their knol, their voice, their opinion. “We expect that there will be multiple knols on the same subject, and we think that is good," said Google.

It remains to be seen if Knol will have more fact-checked content than stuff on Wikipedia, where entries are sometimes gamed for nefarious purposes, limiting its efficacy at times. Readers can suggest edits to a knol but its author always remains in charge able to accept, reject or modify a reader's suggestions before their contribution becomes visible. Google thinks this fact alone can mean a world of difference to the authority of its offerings. Readers will also have the opportunity to submit comments, rate or write a review of a knol.

Google didn't forget about the fun factor either so it inked an agreement with the New Yorker magazine to allow an author to add one cartoon per knol from the magazine's cartoon repository. Another interesting features allows knol authors to choose between two licensing methods for their work: the ubiquitous, and open Creative Commons or a full copyright license which reserves all rights to the author.

Analysts think that Knol's success will be determined by its ability to achieve a critical mass of contributors and readers. "It's a long shot, if you had to give it odds on whether this will change the world or not," said Gartner analyst Andrew Frank. The analyst explains that there are not many companies that have the resources and courage to challenge Wikipedia. "It's interesting and certainly shows how Google is one of the few companies with the scale to be able to do an experiment like this without being intimidated by Wikipedia," he said.

Most of the content on Knol at launch iwas medical articles. Interestingly enough, on the same day, Harvard Medical School, the Stanford School of Medicine, the University of Michigan Medical School and the University of California Berkeley School of Public Health were all supporting the launch of The Medpedia Project . It's kind of bizarre that Google does a lot of things that are passive-aggressive acts of competition. Or maybe they just get fed up of sending all that traffic to Wikipedia, and not seeing any ad money coming back. Damn those world domination theorists!

Facebook's portal for the masses

This week, Facebook took a number of strategic steps toward its goal of giving people the "power to share and make the world more open and connected." That's how founder and CEO Mark Zuckerberg described the mission statement for Facebook.

With that mission statement, similar to Google's mission to "organize the world's information and make it universally accessible and useful," Facebook is highlighting its noble aspirations, but underneath the "make the world a better place" is the fact that both Facebook and Google, as well as Yahoo, Microsoft, MySpace, and others want to be the portal for the masses.

(Credit: (CC) Brian Solis )
By portal, I mean more than just a place to share content with friends, search or wire up a social graph. If the Web is becoming social at its core, Facebook (90 million and growing at hundreds of thousands per day) and its competitors want to be the center of their members' lives in the same way that MyYahoo became a personalized home base for millions of users over the last decade.

As evidence of Facebook's portal ambitions, the company introduced Facebook Connect, which will let users access and feed their Facebook profiles and friends on any Web site. Facebook is the identity system and portal through which the content from other sites flows--all roads leading to Facebook, which is distinct from what Google's more open and distributed approach with Friend Connect. Facebook Connect is not yet generally available, but demos from Digg and Six Apart, among others, indicate that it has substance.

Om Malik extrapolates from Facebook Connect that Facebook is building a money machine:


You are essentially telling Facebook's proverbial brain what topics -- blogs or specific posts -- with which you like to engage. In other words, you just told the system a little bit about yourself. Now imagine such information coming from dozens of Facebook Connect partners.


Each service adds a few more data points about you inside the Facebook brain, which is quite aware of your activities inside the Facebook ecosystem. The brain can then crunch all that information and build a fairly accurate image of who you are, what you like and what might interest you. With all that information at its disposal, Facebook can build a fairly large cash register.

The cash register is an advertising platform, a follow on to Beacon, that leverages the social graph and each member as a potential marketing engine. With all the data and user permissions, ad targeting could be more precise. Zuckerberg has also talked about a payments system, a la PayPal, for the platform. After getting Chat launched, Facebook is likely working on making its e-mail application more robust as part of building out the portal.

Microsoft is poised to bring its Web search and paid search results into Facebook's U.S. site.

With 400,000 developers, according to Facebook, working on the platform, thousands of applications--from e-commerce to games--and widgets with any kind of feed will be available for each user's Facebook portal.

Facebook also has more than 10 million users of its mobile services, which is the next major frontier for building user portals. For example, Facebook Connect for Mobile, due for release in the fall, will allow members to hook up with friends over mobile devices to play games with friends and learn which friends downloaded applications of shared interest.

Challenges for Facebook are scaling to support the increased amount of data pouring into its servers and adapting to different geographies. More than two-thirds of Facebook users are outside of the U.S., but all of Facebook's servers are inside the U.S. Decreasing latency, which leads to increased page views, will be a key to Facebook's ability to keep up with demand.

If Facebook can continue to roll out new features, maintain its growth pace and improve site performance, it will be on a collision course with the Web portal giants who were born in the 20th century. Of course, one of those Web giants may pay mega-billions to consolidate the market, but it's unlikely that Facebook will give up its independence any time soon.