Data Storage Today

Remote-Code Vulnerability Being Exploited in IE 6 and 7

Tue, 09 Mar 2010 13:51:17 -0500

Older versions of Internet Explorer are under attack. Microsoft warned Tuesday afternoon that cybercriminals are actively exploiting a security vulnerability that lets attackers execute malicious code from remote locations.

Microsoft's internal investigation reveals that the latest version of the browser, Internet Explorer 8, is not affected. Likewise, Internet Explorer 5.01 Service Pack 4 on Microsoft Windows 2000 Service Pack 4 is not affected.

Here's a quick list of affected versions for IT administrators looking to implement a workaround to mitigate the risk: Internet Explorer 6 Service Pack 1 on Microsoft Windows 2000 Service Pack 4, and Internet Explorer 6 and Internet Explorer 7.

"In addition to Microsoft's Patch Tuesday updates today, the company also issued an advisory for a new zero-day vulnerability affecting Internet Explorer," said Josh Talbot, security intelligence manager for Symantec Security Response. "Symantec has observed exploitation of this vulnerability in the wild and has created Trojan.Malscript!html and JS.Downloader detection to mitigate this attack."

The Root of the Problem

Microsoft said the vulnerability exists due to an invalid pointer reference being used within Internet Explorer. Under certain conditions, it's possible for the invalid pointer to be accessed after an object is deleted, according to a March 9 Microsoft security advisory. In a specially-crafted attack, in attempting to access a freed object, Internet Explorer can be caused to allow remote code execution.

"At this time, we are aware of targeted attacks attempting to use this vulnerability. We will continue to monitor the threat environment and update this advisory if this situation changes," Microsoft said. "On completion of this investigation, Microsoft will take the appropriate action to protect our customers, which may include providing a solution through our monthly security update release process, or an out-of-cycle security update, depending on customer needs."

Mitigating Factors

IT administrators can take heart in the mitigating factors that may protect their...

A 2010 Data-Migration iSCSI Wake-Up Call

Tue, 09 Mar 2010 13:16:16 -0500

PARSIPPANY, New Jersey, March 9, 2010 -- RELDATA Inc., the innovation leader in unified block and file storage solutions over iSCSI, highlighted today the challenge faced by mid-sized organizations in upgrading legacy iSCSI storage systems and the difficulties associated with migrating data to newer iSCSI storage systems. A recently published report by analyst firm DCIG details the issues resulting from rapid adoption of networked iSCSI storage systems deployed between 2006-2008, which were very popular among mid-sized organizations.

The DCIG report points out that first-generation iSCSI storage systems are now starting to show their age, and as a result, manufacturer warranties are expiring, resulting in expensive support and maintenance contracts.

"This is prompting more mid-sized organizations to start product refresh cycles for their existing iSCSI storage systems to get newer systems," said Jerome Wendt, president of DCIG. "But as they do, the costs and disruption associated with this transition to a new system start to rear their ugly head."

According to DCIG, the cost and disruption may occur in one of two possible ways: If mid-size companies decide to remain with their existing storage solutions such as Dell EqualLogic or HP LeftHand, they can leverage the migration software that may be available for their existing hardware to migrate data from the old to the new hardware so disruption generally is minimal. But there is a catch � companies are required to purchase all of their new storage from those providers to take advantage of the data migration features, leaving them with little flexibility or negotiating power when it comes to acquiring new storage since they can only buy storage from these providers in whatever storage configurations and prices they make available.

The second scenario involves switching to another storage provider, which can be "just as bad if not worse." While organizations are...

Cisco Unveils Much Faster CRS-3 Router for Net Growth

Tue, 09 Mar 2010 12:31:57 -0500

The wait is over. Cisco Systems on Tuesday finally took the lid off its hype machine to reveal ... a new router. Cisco is positioning its CRS-3 Carrier Routing System as the foundation of the next-generation Internet that will pave the way for rapid growth of video transmissions, mobile devices, and new online services.

The CRS-3 offers three times the traffic capacity of the its predecessor, the CRS-1, Cisco said, and promises to accelerate the delivery of new experiences for consumers, new revenue opportunities for service providers, and new ways to collaborate in the workplace. That's a lot of hyperbole, but analysts said it's believable.

"It's too bad Cisco led up to this router announcement with so much hype. People were expecting Armageddon or something. They had this countdown timer as if something big was going to happen," said Zeus Kerravala, a vice president at Yankee Group. "At the end of the day what Cisco announced was a big, fast router. But that's what Cisco does. We expect Cisco to release bigger, faster routers. It's what they built their company history on."

Lighting-Fast Router

The Cisco CRS-3 can handle up to 322 terabits per second. To put that speed into perspective, this router would allow the entire printed collection of the Library of Congress to be downloaded in just more than one second. Or every man, woman and child in China to make a video call -- simultaneously. And every motion picture ever created to be streamed in less than four minutes.

The Cisco CRS-3 makes possible unified service delivery of Internet and cloud services. A Network Positioning System provides layers three to seven application information for the best path to content. And a cloud virtual private network for Infrastructure as a Service lets customers "pay as you go" for computing, storage and network...

TIBCO Announces TIBCO Spotfire 3.1 Analytics

Tue, 09 Mar 2010 13:50:29 -0500

TIBCO today announced TIBCO Spotfire 3.1, the latest version of its in-memory analytics platform making predictive analytics accessible within Spotfire's visual user experience. Spotfire 3.1 responds faster than BI and more flexibly than spreadsheets, equipping everyone in the enterprise �- whether in business, technical, or scientific roles -� to easily analyze complex data, customize their discovery experience, and share their story through mashups, portals, or interactive dashboards. With this release, TIBCO makes predictive analytics a mainstream feature of any business application, allowing any enterprise decision-maker to perform "what-if" scenarios on demand and find new insights in complex data instantly.

"The TIBCO Spotfire Analytics Platform continues to evolve, putting more power into the hands of our analytics team and allowing us to cut time to decision, while guiding our users to more strategic insights," said Ramona Hovey, senior vice president, Products and Services for DrillingInfo Inc., an information and data analysis service for the oil and gas industry whose clients include major oil companies and large and small independents that produce over 90% of all U.S. oil and gas. "By exploiting innovative Spotfire technologies, such as Web-based business analytics, we are looking to build highly responsive, real-time business models to provide our internal and external clients with accelerated business innovation, growth, and collaboration."

"Support for scenario evaluation, predictive analytics, collaboration, and guided analytics of tools such as TIBCO Spotfire enables business decision makers at any level to discover new and actionable insights while proactively detecting and responding to events," said Dan Vesset, vice president of business analytics at IDC. "This ability not only improves productivity, but also minimizes IT investment."

Superior Data Exploration & Analysis

Spotfire 3.1 extends Spotfire's dominant position as the industry's leading visual data exploration and analysis solution. Users now have more tools to explore, interact with, and present their data,...

IRI Upgrades High-Volume Data Migration Tool

Tue, 09 Mar 2010 12:49:22 -0500

MELBOURNE, Fla. (March 10, 2010) -- Innovative Routines International (IRI) Inc., a leading developer of data manipulation software, is now shipping release 2 of NextForm for large file and data type conversions.

According to users like Collin Perry of Sailpoint Technologies, NextForm v1 "worked well for converting our CSV and LDIF files" but a GUI job specification editor would "help users master the functionality and run faster." Thus, v2 is controlled through an easy-to-use Java GUI called "NextForm Builder."

"NextForm Builder represents a substantial ergonomic improvement in sequential file and field remapping," explains David Friedland, IRI's business development vice president. "The wizard allows you to point and click between XML, COBOL and text, LDIF and CSV files, and between EBCDIC and ASCII fields, packed decimal and numeric, etc."

Unlike other conversion tools (especially for XML and LDIF) that cannot handle high volumes, NextForm converts multi-gigabyte files quickly and with maximum flexibility. Users can also reformat files by changing field layouts from fixed to variable (or vice versa), move fields around, limit fields on output, or create multiple output files (and formats) from a single input format. The NextForm Builder GUI features a preview option to validate conversions, and supports both immediate execution and job exportation for command line or batch operations.

NextForm on Windows starts at US$400, and is discounted in volume. Additional fees apply on Unix platforms, and for COBOL index file support.

An upcoming NextForm version will reformat variable blocked (VB) and spanned (VBS) files, and change between big and little endian data � both at the file and field level. This will allow users to track, convert, and process their data across platforms, regardless of its source.

For more details, please visit www.iri.com/NextForm or email: nextform@iri.com.

About IRI, The CoSort Company

Founded in 1978, Innovative Routines International (IRI),...

Energizer USB Charger Software Contains Malware

Mon, 08 Mar 2010 14:06:28 -0500

Some Windows PC users may hope the Energizer bunny didn't keep going and going. It turns out the Energizer DUO USB battery charger is a vehicle for attacks on PCs, according to the Department of Homeland Security's Computer Emergency Readiness Team.

US-CERT researchers said Friday that the software that installs with the Energizer charger contains a Trojan horse that gives malicious hackers a back door into Windows machines.

"An attacker is able to remotely control a system, including the ability to list directories, send and receive files, and execute programs. The backdoor operates with the privileges of the logged-on user," US-CERT said. "Removing the Energizer USB charger software will also remove the registry value that causes the backdoor to execute automatically when Windows starts."

A Trusted Source

Although the fix seems relatively easy for consumers who are aware they have been infected, the path in was also straightforward. Rob Enderle, principal analyst at the Enderle Group, said consumers were probably not expecting the Energizer software to carry a malicious payload.

"Typically in a Windows 7 or even a Windows Vista install, if you mess around with ports you should get a warning," Enderle said. "Because consumers got the software from a trusted source, chances are you'll bypass the warning and go ahead and install it because you think you are only installing the battery monitor. This is a nasty piece of work."

Enderle questioned the origin of the software, noting that Trojans seem to make their way into programs when the software is developed outside the U.S. Chances are, he said, the software was developed in China or some other foreign country.

What's So Unusual?

Symantec also investigated the Energizer malware and discovered that the Trojan listens for commands on port 7777. That by itself is not so unusual, the company said, but Symantec researchers were surprised that...

Building Your Own Computer: Not Just for Nerds

Tue, 09 Mar 2010 07:12:21 -0500

Buy a standard off-the-shelf computer and you're probably making compromises. It's rare to find a pre-configured system that meets your needs to a tee.

The simplest way to make sure that every piece of technology in a new desktop PC fits your requirements is to build it yourself. You don't have to be a nerd to manage the task anymore, either. The key thing is to enter into the planning stage by ensuring that the individual pieces -- the components -- are compatible with one another.

The key components of any PC are the case, power supply, motherboard and processor (including fans and heat conductive paste), memory, graphics cards, optical drive, and hard drive.

"Once you have these components, you can create a PC system that would suffice for most users," says Christian Kissinger from German electronics specialists Conrad Elektronik.

Each one of the components listed above is available in hundreds of variants. Deciding which one should grace the inside of your new creation is largely a matter of determining what kind of tasks the computer will be performing. A computer being used just for email messages and surfing the net doesn't require the horsepower under the hood that a gaming PC needs, for example.

Evaluating the individual components is thus a relatively important part of the process, says Josef Reitberger from the computer magazine Chip, but it can also be fun. He suggests checking the top products lists in well-known magazines.

Reitberger feels the challenge of physically constructing the PC itself is often overblown. "Good cases are constructed so that amateur tinkerers just have to tighten a few screws," he notes. And those even usually come included with delivery.

The process is a key part of the PC.

If you've already decided on a specific model, then the next step is finding a suitable motherboard. Once that...

Tax Time Brings Out the Fraud Artists

Wed, 10 Mar 2010 05:03:14 -0500

How do you know that the sender of an e-mail that has landed in your inbox is trying to steal your money or your identity? The message comes right out and asks for it.

Tax season means computer criminals are going to be out in force, pumping out bogus e-mails that purport to be from the Internal Revenue Service. These messages ask you to supply personal information in all kinds of scams. Often the scam e-mails offer help speeding up the preparation of tax returns or securing a big refund.

The e-mails also might just be a cover for criminals to install malicious software on your computers, by tricking you into opening attachments or visiting poisoned Web sites.

Scam e-mails can be stunningly convincing, so you often can't tell just by looking at them whether they're real or fake. They can use authentic-looking IRS logos and even e-mail addresses: Scammers can make it appear as if they're writing from a legitimate government e-mail address, so you can't trust the "from" line in e-mails you receive.

So what should you do to protect yourself?

Don't supply your personal information, such as Social Security numbers or credit card numbers, to anyone e-mailing you for it. The e-mails might state that they just need a few pieces of personal information to get started. The IRS doesn't discuss tax matters with people by e-mail.

Also, don't open attachments or follow links in unsolicited e-mails. When it comes to computer security, if someone's offering you something online that you didn't ask for, chances are you probably don't want it.

Symmetricom Offers Embedded Sync Software Solution

Mon, 08 Mar 2010 09:51:37 -0500

SAN JOSE, Calif. - March 8, 2010 -- Symmetricom, Inc. (NASDAQ: SYMM), a major supplier of precise time and frequency technologies, today announced the company is introducing a new line of embedded software solutions. These new comprehensive solutions enable network equipment manufacturers (NEMs) to easily incorporate Symmetricom's proven synchronization technology into their offerings to provide their customers with more versatile, high performing solutions.

"Providers have been demanding increased visibility and control of their evolving network infrastructure," commented James Armstrong, EVP and general manager at Symmetricom. "As Carrier Ethernet adoption increases, there is a growing need for synchronization solutions that provide greater levels of flexibility, robustness and management capabilities. Symmetricom's embedded solutions enable NEMs to deliver just that."

Symmetricom's line of embedded solutions enables NEMs to leverage years of real-world experience and provide their customers carrier-class reliability and precision along with enhanced levels of scalability and technology integration. Symmetricom embedded technology is more versatile than silicon solutions, has been field proven in trials and deployments and shown to be industry-leading in performance. With Symmetricom embedded solutions, NEMs now have a simpler and faster path to integrate a wide range of timing technologies while achieving smaller footprints, lower power consumption, improved manageability and overall cost reductions.

Symmetricom embedded solutions are based on its acclaimed timing technologies, such as BesTime, a patented technology developed and extensively tested for primary reference source quality timing and extended to packet timing technology. These embedded solutions offer the flexibility to support a variety of platforms around popular embedded processors and operating systems and include a set of APIs and a reference design board.

The availability of Symmetricom's IEEE 1588 (PTP) embedded technology expands the company's end-to-end suite of synchronization solutions. Now, both NEMs and operators can benefit from Symmetricom's expertise and its high performance, integrated solution set which includes boundary...

Google Challenges MS Office with DocVerse Purchase

Fri, 05 Mar 2010 13:51:23 -0500

Google delivered the latest salvo in its battle to wrest control from Microsoft over office productivity with its purchase of DocVerse, a Microsoft Office collaboration startup. The Wall Street Journal reported the purchase price was $25 million.

DocVerse was founded in 2007 by former Microsoft executives Shan Sinha and Alex DeNeui. The first product is a plug-in for Microsoft Office that allows users of the desktop software to collaborate on Office documents.

"DocVerse offers the first-ever product to truly enable real-time sharing and editing of Microsoft Word, PowerPoint and Excel files. Its key advantage is that it does not require you to learn a new way to work by seamlessly plugging into Microsoft Office," the company says on its web site.

Announcing the purchase on a company blog, Jonathan Rochelle, group product manager for the Google Apps team, praised DocVerse as a "small, nimble team of talented developers who share our vision, and they've enabled true collaboration right within Microsoft Office. With DocVerse, people can begin to experience some of the benefits of web-based collaboration using the traditional Microsoft Word, Excel and PowerPoint desktop applications."

Beating Microsoft

"Google Apps have been about collaboration, but this will make it easier for people who work within Microsoft Outlook and Office to adopt Google Docs," said Greg Sterling, principal analyst with Sterling Market Research.

In their blog announcement, Sinha and DeNeui said they started the company at a time when it was becoming clear that a new paradigm for productivity apps was emerging. "The world started moving toward easy-to-use web applications, like Google Docs & Apps, offering a new way to work with all kinds of benefits," they said. "However, for the many people who use desktop software, like Microsoft Office, transitioning to the cloud was a challenge."

Microsoft's strategy has been Windows Live Workspace -- a way...