News

20 things Windows 7 MUST include

2008-07-11T11:24:50Z

Windows Vista, the OS that everyone loves to hate. Despite its enhanced security, improved CPU scheduler and excellent stability, it's still the flawed gem in many critics' eyes. But can Microsoft win back the XP crowd with its upcoming Windows 7 offering? The fact is, they have to.

]]> 20. Modularised OS

The great thing about being modular is that the OS can be modified easily. Think Linux here - in Linux everything is modular and replaceable. For example, you can replace the whole GUI component without affecting anything else. With the abundance of third party applications written for Windows, this would spur a whole new variety of customisation and open-source implementation.

19. XP Virtual Machine

It seems that the biggest issue with Vista was compatibility with older software/drivers. A solution may be to include an XP virtual machine which ensures compatibility with said software. Apple did a similar thing when they re-wrote their OS a few years back.

18. New UAC

In theory UAC was a great idea. It protected people from themselves, but it was too intrusive. An alternate idea is to teach the user the importance of limited accounts and how they prevent the accessibility of nasties such as viruses. UAC should be a single dialogue with 'Continue' and 'Cancel' and an explanation of why the user was interrupted.

17. Gaming Mode

Most Windows users like to dabble in a bit of gaming when on their PC. But the constant demand for computing power by the latest titles (read: Crysis) can leave the majority in the dark. Perhaps Microsoft can offer a mode similar to that of the current "Safe Mode" which only initiates the required services for gaming. This would minimise overhead and increase performance.

The avid performance tweakers out there may have heard of the likes of NLite and VLite for XP and Vista respectively. These pieces of software allow you to remove unwanted components from the OS before you install it. This increases available HDD space, and also improves performance depending on the services cut out. Offering the same amount of control when installing Windows 7 would settle the 'Windows is bloatware' activists out there.

15. Productive GUI

Microsoft bit the bullet with Vista and changed the GUI to be attractive. This is fine by all means, but the productivity of this new GUI wasn't exactly enhanced all that much. Small things such as multiple desktops and simpler open/save dialogues can make all the difference. Perhaps even let the user modify the GUI to their liking, i.e. toolbar sizes etc.

14. All for One and One for All

Vista came out in so many versions that even Chuck Norris was bewildered. There should only be three, Home, Business/Pro, and Server. This would lessen the current Windows ambiguity.

13. WinFS

Whatever happened to the infamous NTFS replacement? Windows 7 would really benefit from an improved file system, and such an improvement is bound to attract businesses that shunned Vista for its lack of innovation and improvement. The relational database structure should enhance overall system performance.

12. Home User Licensing

Let's say you have 3 PCs in your house, two desktops and a laptop. You want to upgrade to Windows 7, but have to pay three times for three separate licences. In a world where P2P and torrents are commonly used, how many users would slip into the world of cracks and keygens? The solution (to an extent) would be to offer a home license. A small fee to be able to use the OS up to, for example, five times in the one household would surely benefit both Microsoft and the average home user.

Arguably the Achilles heel of Vista was the slow uptake of drivers by device manufacturers. Although this is hard for Microsoft to dictate, it would be in their best interest to promote driver production during the OS development stage. Even if the drivers are beta, it sure beats being left with no hardware functionality.

10. Standards Compliant Browser

This isn't much of an OS thing, but it is bundled so we have included it. Internet Explorer 8 would win the hearts of many web developers if it was created to web standards. There's nothing more frustrating than coding a website which works fine in Firefox and Opera only to have IE spit the dummy.

9. Program Caching

Currently, Vista caches commonly used software into RAM so that it launches faster. The main problem with this approach is that it confuses users into thinking Vista is using several hundred MB of RAM just for itself. A simple toolbar notification stating 'Vista is caching your programs to improve speed. Click here for more information', would end all the confusion.

8. Microsoft Toolbox

This is an idea we came up with which we believe would benefit many users with compatibility issues. The feature would list current drivers and patches for all installed hardware, games, and software. By having this all in the one place (possibly within Windows Update) users can keep their system up-to-date without seeking drivers and patches manually.

7. OS Restoration via imaging

System restore is a great companion when things go wrong. But sometimes the damage is too severe. By integrating a user friendly imaging solution, the user would be able to install everything they want, and then simply create an image of the setup. This image would be saved on another HDD or partition ready to restore in the case of a system failure.

6. Barebones Kernel

This idea has been thrown around by Microsoft, specifically 'MinWin'. Allowing the user to choose between this and the default kernel could potentially allow older systems (i.e. XP based) to run the new OS with decent performance levels.

5. 64bit only

The main difference between 32bit and 64bit is the amount of accessible memory or RAM. Plans to create a 32bit Windows 7 would be counterproductive, by then GPUs would use at least 1GB of VRAM, and the average system will most likely have upwards of 4GB of RAM. Considering the 4GB memory addressing limit of 32bit, you can see that confused customers won't be happy.

4. Better out-of-box burning capabilities

CD/DVD burning is a simple everyday task. Unfortunately, Vista cannot burn discs very well, and there is a severe lack of options. A decent burning service wouldn't go astray in Windows 7.

3. Diagnostic Tools

It happens all the time, you build your own PC and the OS install constantly crashes. You blame the OS, but really, something else is at fault (such as the RAM). If diagnostic tools similar to Memtest were included, issues like this could be detected without the need to find third party software.

2. Faster Boot and Shutdown

This seems to be something that constantly plagues Windows. A faster boot time would be a great first impression to many critics, and it'll save valuable time, especially when restarting for updates.

1. Simplify and manage startup items

Many users install software which starts up with Windows. All of this software opening at once causes lag and lack of usability for a considerable amount of time. A simple startup interface (not as daunting as the current MS Configuration Utility) would help users disable what they don't need running. Another feature would be to schedule programs to start after a certain amount of time. This would prevent the computer struggling to open several programs in one hit.

Cisco Launches Security, Voice, Wireless Specialties for CCNA

2008-06-25T10:49:36Z

On Tuesday Cisco Systems announced three new specialties -- Security, Voice and Wireless -- that can be added on to its popular entry-level certification, the Cisco Certified Network Associate (CCNA) .

]]> Each of the specialties, which Cisco calls concentrations, requires CCNAs to pass one additional exam. The Security (640-553) and Voice (640-460) exams are now live at Pearson Vue testing centers worldwide for 0 each -- the same price as the standard CCNA exam. The Wireless (640-721) exam will debut July 26.

Read the full article: Cisco Launches Security, Voice, Wireless Specialties for CCNA

Adobe zero day flaw being actively exploited in wild

2008-06-11T10:30:56Z

"The current malware attack has been traced back to Chinese blackhats, who are using a zero day to infect users with password stealers."

The widely used Adobe Flash Player has a zero day flaw that is being targeted by a number of attackers who set up more than 200,000 Web pages to exploit the flaw.

]]> The unspecified remote code-execution vulnerability could be exploited to cause denial of service conditions, according to Symantec, which reported the flaw on Monday.

Symantec said Adobe Flash Player 9.0.115.0 and 9.0.124.0 are vulnerable and other versions may also be affected. The flaw occurs when the flash player tries to process a malicious Shockwave Flash (SWF) file. The vulnerability is similar to an Adobe Flash Player multimedia file remote buffer overflow vulnerability, discovered by Mark Dowd of IBM, Symantec said.

Adobe said it was investigating the incident to determine if the previous flaw was incorrectly patched or if the latest wave of attacks is using a new variant.

Symantec is tracking a number of attacks which involve two Chinese sites known to be hosting exploits. Attackers are injecting malicious code into the sites using SQL-injection vulnerabilities. Up to 20,000 Web pages are serving up a script redirecting users to the malicious sites. As a result of the attacks in the wild, Symantec raised is ThreatCon to level 2.

Meanwhile, McAfee said it has discovered up to 250,000 Web pages designed to exploit the flaw. McAfee Avert Labs reported in its blog that different exploits are crafted to exploit the different versions of Adobe Flash. Exploits exist for both Internet Explorer and Firefox, McAfee said.

"McAfee Avert Labs has received submissions of samples of exploits from many sources spanning multiple domains over the past 24 hours," the research team said.

Security researcher Dancho Danchev said the flaw is "definitely worth assessing." Danchev is recommending that IT administrators consider blocking flash until the vulnerability is patched by Adobe.

"The current malware attack has been traced back to Chinese blackhats, who are using a zero day to infect users with password stealers," Danchev said in his Mind Streams of Information Security Knowledge blog.

Vista Vulnerability Study Puts Microsoft on Defensive

2008-05-20T08:51:26Z

Microsoft and some independent security researchers had the blogosphere buzzing Wednesday over a series of denunciations after one company claimed that Vista was more vulnerable to malware and other exploits than previous operating systems.

]]> Late last week, a study by Sydney, Australia-based anti-virus concern PC Tools suggested that although Vista was an improvement over Windows XP in respect to system fortitude, it is more easily encroached upon by malware and other exploits than Windows 2000.

PC Tools found that for every 1,000 machines running Vista, 639 suffered from cases of malware in varying degrees. Among machines running Windows 2000, 586 were found compromised; for Windows 2003, 478.

At the root of Microsoft staffer Austin Wilson's refutation of those findings is the assertion that the numbers PC Tools used to reach its conclusion don't stem from data with a proper control factor; essentially, the net wasn't cast wide enough to capture the true effect of malware on Vista.

"We study the malware space very carefully and publish our results twice a year in the Security Intelligence Report," Wilson wrote in the Vista security blog. "This report is compiled from statistics on malware infections based on over 450 million executions of the Malicious Software Removal Tool (MSRT). Microsoft is a member of AMTSO (Anti Malware Testing Standards Organization) and its charter includes defining test methodology so that there is a minimum quality bar to all testing of this type."

It wasn't just Microsoft; criticisms of PC Tools' report came from as far away as Eastern Europe in the form of IT pros such as Dennis Kudin, CTO of Ukraine-based Information Security Center Ltd. In a blog post of his own, Kudin wrote, "I think [the study] is a very dangerous delusion. First of all, the difference between 639 and 586 is not big and can be easily explained."

Reached by Redmondmag.com for comment on the issue, Michael Greene, PC Tools' vice president of product strategy, said that it's not enough to just identify the presence of malware on systems, and that his company takes a "behavioral approach" to identifying what the real dangers are or could be. He added that this type of thinking is what prompted the research in the first place.

"Our thing is, don't take our word for law that it's malware," Greene said. "Run your scanners to look at the severity of what's happening. With our findings, what you see is how unique pieces of malware got on these machines in question and the question you ask is, 'How did they get through?' Look, everybody knows that Vista is more secure than XP, but the problem isn't solved."

Regardless of the arguments being volleyed back and forth, the "problem" is, indeed, not solved. Security experts agree that administrators need a layered approach, especially in light of other research findings regarding malware that spotlight different strains -- worms, Trojan horses, rootkits, spyware, malicious adware, grayware and certain bots, for starters.

In fact, one of the preliminary results from Symantec Corp.'s Internet Security Threat Report released last month suggests that "the release rate of malicious code and other unwanted programs may be exceeding that of legitimate software applications." Moreover, Finland-based anti-virus company F-Secure announced recently that as much malware was launched in 2007 as there was over the previous 20 years.

"I think what we know from the various reports that are out there is that there are threats," said Andrew Storms, director of IT security operations at San Francisco-based nCircle Network Security. "The question is not the degree of what's out there but what the actual risks are and how to mitigate them."

XP SP3 Available Via Windows Update

2008-05-13T10:21:28Z

Microsoft said that users of Windows XP can now gain access to Service Pack 3 through Windows Update and the Microsoft Download Center.

Users of Windows XP can now gain access to Service Pack 3 through Windows Update and the Microsoft Download Center, according to an announcement issued by Microsoft today. Distribution of the service pack through Automatic Updates will be available "in the next few months," the announcement added.

]]> A so-called "slipstream build" of Windows XP SP3 is also currently available to Microsoft TechNet Plus and MSDN (Microsoft Developer Network) subscribers, according to a Microsoft notice that was posted on Friday (May 2). This kind of build contains the complete Windows XP operating system plus SP3, all in one image file. The build is currently available in nine languages, including English.

Microsoft had promised this Windows XP SP3 update to its developer subscribers on April 29. The company set that date after hearing grumblings that manufacturers were getting the update before paid subscribers. Windows XP SP3 was released to manufacturers on April 21.

General access to XP SP3 via Windows Update and Microsoft Download Center was postponed after Microsoft found an incompatibility problem with Microsoft Dynamics Retail Management System (RMS).

The warning still applies for all users of Microsoft Dynamics RMS, including subscribers accessing the Windows XP SP3 slipstream build. Until a fix is released, Microsoft has advised that Windows XP SP3 not be installed if it will be used with the RMS application. A similar problem exists with Windows Vista Service Pack 1, which is also incompatible with the RMS application.

Microsoft's TechNet blogs identify Windows XP SP3 as "build 5512," which some subscribers already have. Microsoft TechNet blogger Chris Keroack confirmed in response to a question that 5512 is "the final build" for Windows XP SP3. He added that a "separate hotfix" will be issued to address the Microsoft Dynamics RMS compatibility problem, without specifying a date.

If that weren't complicated enough, installers of Windows XP SP3 may have to jump through some hoops if they want to avoid some issues with Internet Explorer when installing this service pack. Users who have IE 7 loaded on Windows XP SP2 will not be able to uninstall that browser version if they immediately apply SP3, according to a Microsoft program manager. One way to avoid that snag is to uninstall IE 7 first before installing the service pack, and then reinstall IE 7 afterward.

For those using IE 8 Beta 1 on Windows XP SP2, Microsoft recommends uninstalling this beta version first before installing Windows XP SP3. Doing so avoids a similar issue where the option to remove IE 8 Beta 1 may be subsequently grayed out after applying SP3.

Microsoft TechNet subscribers can download the Windows XP SP3 slipstream build by going here.

General users of Windows XP can either wait for SP3 to become available through Automatic Updates or download it from Windows Update.

The news about the release was publicized via a Microsoft blog. The rapid response team for a public relations firm that represents Microsoft, Waggener-Edstrom, did not respond by press time to our request for comment on this story.

Windows 2008 Exams Go Live

2008-03-19T09:44:28Z

Microsoft releases three new exams for its newest network operating system in March.

Windows 2008 Exams Go LiveThe Microsoft Learning Group has released three new exams for Windows Server 2008. All three are available worlwide at Prometric testing centers. The release comes quickly on the heels of the official release of Microsoft's newest network operating system software in Los Angeles at the end of February.

]]>

70-640 TS: Windows Server 2008 Active Directory, Configuring

70-642 TS: Windows Server 2008 Network Infrastructure, Configuring

70-643 TS: Windows Server 2008 Applications Infrastructure, Configuring

Microsoft recommends that candidates taking these exams have at least a year of experience implementing and administering a Windows Server networking environment that has at least 250 users spread over at least three physical locations and three or more domain controllers. Ideally, those candidates should also have some experience setting up and administering security policies, maintaining connnectivity with remote users, and managing messaging or database servers.

Exams 70-640 and 70-642 are required exams for MCITP: Server Administrator. Candidates must pass all three to obtain the MCITP: Enterprise Adminstrator.

Microsoft provides an upgrade path to the MCITP: Server Administrator and MCITP: Enterprise Administrator titles, which allows MCSA and MCSE on Windows Server 2003 certificate holders to bypass these MCTS exams.

More info: Transition your MCSA and MCSE on Windows Server 2003 skills to Windows Server 2008

Vista SP1: The hits just keep coming

2008-02-26T08:39:46Z

Amid reports by some users of endless-loop reboots and less-than-impressive performance gains with Windows Vista Service Pack (SP) 1, now there's a new SP1 gotcha. Microsoft accidentally released SP1 to some users on Windows Update this week. While some greeted the mistake with glee, as they didn't want to wait until next month to get it, others weren't yet ready to have it pushed to them.

Adrian Kingsley-Hughes has the details, courtesy of a Microsoft spokesperson:

"Today (February 21), a build of SP1 was posted to Windows Update and it was inadvertently made available to a broad group."

Microsoft officials have maintained that the company had no plans to push SP1 via Windows Update until Microsoft was able to resolve driver compatibility problems discovered during the SP1 beta-testing process.

Among the few good news tidbits about SP1, another of my colleagues, Ed Bott, notes that SP1 removes another of Windows Genuine Advantage's "fangs" by making two known activation cracks more easily identifiable.

Meanwhile, in what some Microsoft watchers portrayed as bad news, a list of applications that worked with Vista but break when SP1 is installed is now out from Microsoft. I have to say I was surprised how few apps (12) were on the list (which includes programs that are blocked from installing; programs that don't run; and programs that experience a loss in functionality). There are new versions available of a number of these programs (but not all) that do work with SP1, as detailed in the Microsoft Knowledge Base article linked above.

A spokeswoman for the Windows client division sent me the following statement, re: Vista SP1 and application compatibility:

"We have made application compatibility remediation and tools be a major priority over last year…. Today, customers have 10 times the number of logoed Windows Vista applications to choose from (from 254 at launch to over 2500 today). Over 150 enterprise applications, such as antivirus and VPN software, have been updated to work with Windows Vista. Customers can be assured that the majority of today's most popular and best selling software runs on Windows Vista."

Vista users: Anything new to report, regarding applications that run (and don't) with Vista and Vista SP1?

By Mary Jo Foley for ZDNet

]]>

Windows 7 = Vista Release 2

2008-01-30T09:15:05Z

All the kerfuffle over Windows 7 - leaked memos, shaky handheld video clips of leaked builds, equally shaky tentative release schedules - is amusing. I don't have any inside information to offer, only a perspective drawn from 17 years of watching the Windows development process in action. The most common comment I've read lately is that Microsoft has accelerated the development schedule of Windows 7 in a desperate attempt to replace Windows Vista. Dave Methvin at Information Week argues that Windows 7 may mean Vista's "early demise." APC Mag speculates on the meaning of this "early release" complete with a screenshot it calls "probably fake." Randall Kennedy at InfoWorld piles onto the meme with this prediction:

Will Microsoft ship Windows 7 early in an effort to salvage its enterprise reputation? I'm guessing yes, if for no other reason than they can. It won't take a major engineering effort to turn the ashes of Vista (which, despite its reputation, did incorporate some good ideas) into a solid OS that corporate IT actually wants.

All of those predictions miss one big point: There's nothing "early" about the rumored H2 2009 release date of Windows 7. Last June, I argued that Windows Vista was the functional equivalent of Windows 95, with plenty of wrenching architectural changes that spelled pain for early adopters. Most of those problems were fixed with Windows 98. Likewise, despite the current love fest for XP, most people forget that its first years were plagued with bugs, driver hassles, and security problems (remember Blaster?) that weren't stamped out until XP Service Pack 2.

Windows 7 is following perfectly in the footsteps of those two releases. I went and charted the history of Microsoft's Windows releases from 1990 (Windows 3.0) forward, inserting Windows 7 into the mix with a September 30, 2009 release date, which is exactly midway into the second half of 2009. Each bar on the chart represents the number of days after the final release of the previous edition.

Let's start with the history of Windows from the business side:

The biggest bar, of course, is Windows 2000, which went through the longest development cycle of any Microsoft operating system release ever. Windows XP was able to piggyback on that work with a release less than two years later. Getting SP2 out the door with major changes to the security subsystems took roughly 1000 days, and many people at Microsoft, including Steve Ballmer, wanted to give it the full release treatment, a decision that Windows boss Jim Allchin nixed. (See Mary Jo Foley's October 2006 interview with Allchin for more details on this decision.)

Microsoft has a more complicated history when it comes to consumer versions of Windows, as this chart makes clear:

After Windows 98, Microsoft tried to cash in with two quick releases, Windows 98 Second Edition in 1999, and the ill-fated Windows Me in 2000. The business and consumer tracks were synched up for good with the release of Windows XP in October 2001.

What I found most fascinating about looking at this history is that the most stable and successful releases of Windows arrived roughly 1000 days after their trouble-plagued predecessors. Windows 98 arrived 1036 days after the original release of Windows 95. XP Service Pack 2 was released 1016 days after the launch of XP Home and Professional. And if those rumors are true, Windows 7 should arrive roughly 1000 days after Vista's launch.

I certainly don't expect any big changes in Windows 7. In fact, I'm willing to bet that one of its key design goals is that any driver or app written for Windows Vista must work perfectly on Windows 7. All of the compatibility and reliability fixes that have already gone into Windows Vista will be part of Windows 7 from day 1, making it much less likely that users will experience the sorts of headaches that early adopters experienced in the first six months after Vista's release.

I expect to see Internet Explorer 8, a bunch of new digital media features, and some tweaking of User Account Control to make it less obtrusive. Mary Jo is right to call this "a smaller, more finite release" not a big bang like Vista. Those who are predicting that Windows 7 will include some radically stripped-down kernel (the so-called MinWin project) or a new file system are missing the point completely.

Author: Ed Bott

Souce: ZD Net

]]>

Time for MAC security software?

2008-01-29T08:21:05Z

Mac bigots love to kid Windows users about all our viruses, rebuilds and exploits. And they're right. The question is: Why is Windows so vulnerable? Mac-philes would like to believe their platform is intrinsically safer. The other theory is that hackers attack those systems with the most market share. And perhaps the theory most on target: Hackers just love to mess with Microsoft.

]]> If market share is the issue, then eventually Apple will have to worry. With the success of its TV commercials, the Mac is gaining market share (unfortunately, only in the high-end consumer market, as Steve Jobs continues to utterly ignore the enterprise and low-end consumer PC markets).

Sophos believes Apple should be worried now. The security vendor argues that organized crime is basing new extortion plots around Mac attacks. And malware, which isn't yet a crisis, is increasingly written with the Mac in mind.

Vista help is on the way

2008-01-29T08:17:41Z

Many in IT won't adopt a new Microsoft OS until its first service pack (in Vista's case, it might take a few).

Well, bucko, here's your chance to take the plunge. It seems that Vista SP1 could ship as soon as the middle of next month.

]]> Usually, a service pack fixes a bunch of bugs and a gaggle of glitches. Vista's issues are more fundamental. Vista requires a mental shift and total readjustment in how it works. That does not a service pack address.

Meanwhile, Microsoft released a bunch of minor Vista tweaks and fixes, one of which boosts the performance of Vista graphics.

Macs Vulnerable to Malware? Say It Ain't So!

2008-01-28T08:24:36Z

IT security firm Sophos this week let the cat out of the bag, spilled the beans, and otherwise debunked the widely treasured myth that Macs are invulnerable to malware in its Sophos Security Threat Report 2008 (registration required); released Tuesday. The report said that, among other things, "in 2007 [organized] criminal gangs for the first time arrived at Apple's doorstep with the intention of stealing money." Proof, the firm said, that "hackers are extending their efforts beyond Windows."

]]> Of course, the Mac platform has never been invulnerable to malware of any sort, though since the advent of Mac OS X such malicious code had generally been confined to labs in which researchers played out "what if" scenarios that never came to fruition. Serious crimeware developers simply hadn't bothered with the Mac until late, perhaps for the same reason game developers left the platform alone for so long: The audience was too limited to be worth the effort.

Not that malware is particularly rampant on the Mac at this point. There were some iterations of the OSX/RSPlug Trojan horse that made the phishing/ID theft rounds in November. However, "Macs have a long way to go in the popularity stakes before they overtake PCs, particularly in the workplace, [but] their increased attractiveness to consumers has proven irresistible to some criminal cybergangs," according to Graham Cluley, senior technology consultant at Sophos, commenting on the report in a statement released this week.

And, of course, Mac users are as vulnerable as their PC-using counterparts to Web and e-mail scams. "The Mac malware problem is currently tiny compared to the Windows one," Cluley said, "so if enough Apple Mac users resist clicking on unsolicited [Web links] or downloading unknown code from the web then there's a chance they could send a clear message to the hackers that it's not financially rewarding to target Macs. If they fail to properly defend themselves, however, there's a chance that more cybercriminals will decide it's worth their while to develop more malware for Mac during 2008."

The Bigger (Non-Mac) Threats
Still, in the larger world of data security threats, including malware, the Mac is still barely a blip on the radar, and it should be noted that the OSX/RSPlug Trojan did not make the top-10 list of the most dominant malware threats of the year in the Sophos study. This honor went to the following, according to the report:

1. Mal/Iframe: 53.3%
2. Mal/ObfJS: 9.8%
3. Troj/Decdec: 6.6%
4. Troj/Psyme: 6.2%
5. Troj/Fujif: 5.8%
6. JS/EnclFra: 3.9%
7. Troj/Ifradv: 2.4%
8. Mal/Packer: 1.2%
9. Troj/Unif: 1.0%
10. VBS/Redlof: 0.8%

Other forms of Web-borne malware made up the remaining 9 percent.

The Sophos report, like other recent reports, also cited converged consumer electronic devices, such as Apple's iPhone and other smart phones and handheld devices, as technologies to watch for their vulnerabilities and potential for "opening up new vectors of attack for hackers." The report also said low-cost ultramobile PCs are likely to attract the attention of malicious developers over the coming year.

The Much Bigger (National) Threats
Finally, the report also found that malicious activities on national levels are likely to increase in the coming year, saying that it became much more common in 2007 for nations to accuse one another of "cybercrime." Actual accusations of these attacks in 2007 ranged from government-sponsored corporate espionage to distributed denial of service attacks.

"2008 is likely to bring more accusations, but so far there has been no actual evidence of state sponsored cyberspying," said Cluley. "While spying has been happening for centuries, it is important to remember that hackers are experts at covering their tracks, making it difficult to determine the exact source of an attack. There is no doubt, however, of the importance of securing critical computers inside government [organizations] from hackers, no matter whether they are motivated by politics, espionage or simply money."

Whether government-sponsored or merely individually inspired, the origins of Web-borne threats can be linked to specific countries, and the distribution figures have changed fairly dramatically over the last year. Where in 2006, according to the report, the United States was the launch point for the bulk of Web-based malware, China took over the No. 1 slot in 2007, responsible for 51.3 percent of such code. The United States came in second at 23.4 percent. Other countries lagging far behind the two leaders included Russia (9.6 percent), Ukraine (3 percent), Germany (2.3 percent), and Poland (0.9 percent). The U.K., France, Canada, and the Netherlands each accounted for 0.7 percent.

Windows 7 May Arrive in Second Half of 2009

2008-01-25T08:47:16Z

Following reports that Microsoft recently released the "Milestone 1" code for Windows 7 -- its next desktop operating system following Vista - to several partners, TG Daily is reporting that a new roadmap for the software shows a release during the second half of 2009.

]]> Microsoft has said previously that Windows 7 (previously code-named "Blackcomb" and "Vienna") is scheduled for release in 2010. The roadmap showing the 2009 schedule was provided to TG Daily by a source; Microsoft refused to comment on the date.

So has Windows 7 been pushed forward? Redmond magazine columnist and All About Microsoft blogger Mary Jo Foley writes that it's possible Microsoft's been planning to release Windows 7 in 2009 all along: "What better way to convince customers on the fence about upgrading to Vista or waiting for the next Windows build that they should make the move? ('Do you really want to wait at least three more years?')"

Foley points out that Microsoft had previously given a 2009 ship date for Windows 7; 2009 would fit with Microsoft's previously announced two-year release schedule; and the timing makes perfect sense for a 2009 holiday release.

"Could Windows 7 ship before Microsoft's publicly stated date of 2010? Definitely. In fact, I will almost be surprised if it doesn't," she wrote.

SPEC, Google pressure component makers on power

2007-12-21T11:31:38Z

In May of last year, SPEC began soliciting feedback from the industry on a forthcoming slate of power efficiency benchmarks. The first of those benchmarks, SPECpower_ssj2008, is now out, but a recent report from Google indicates that the big villains in datacenter power consumption are now memory and networking components that don't provide much in the way of power optimization. In May of last year, SPEC began soliciting feedback from the industry on a forthcoming slate of power efficiency benchmarks. The first of those benchmarks, SPECpower_ssj2008, is now out, but a recent report from Google indicates that the big villains in datacenter power consumption are now memory and networking components that don't provide much in the way of power optimization. In other words, not matter how power efficient an Intel or an IBM makes its chips, the likes of Seagate and Western Digital will now dominate the results of SPEC's new benchmark.

In this short analysis piece, I'll take a look at both the SPEC announcement and the Google report, and at what the two of them say about the future of the datacenter.

SPEC's new power benchmark
SPECpower_ssj2008's UNIX-like name is easily parsed: it's the 2008 release of a SPEC power benchmark that simulates typical server-side Java business applications. The workload's performance is steadily dialed down from 100 percent to idle in 10 percent increments, in order to measure the amount of power that the server (measured with a power analyzer) draws under the varied load conditions.

SPEC describes the benchmark as "scalable, multi-threaded, portable across a wide range of operating environments, and economical to run." "It exercises CPUs, caches, memory hierarchy, and the scalability of shared memory processors (SMPs)," SPEC claims, "as well as implementations of the Java Virtual Machine (JVM), JIT (just in time) compiler, garbage collection, threads, and some aspects of the operating system."

The fact that the new SPEC benchmark quite appropriately measures total system power at the wall, thereby accounting for the contributions of every part of the system to the total power draw, means that system integrators will begin putting increased pressure on component makers to offer more meaningful power optimization options. Specifically, a recent report published by two Google engineers in the IEEE's Computer magazine (see below) indicates that 2006 was the year that the CPU stopped being the majority contributor to server power draw in the search giant's massive datacenters. So as this benchmark gains traction, we'll see more and more makers of hard drives and networking equipment touting new and innovative power optimization features.

Google: What works for mobile and embedded doesn't necessarily work for servers The authors of the Google report took a broad look at power usage in the datacenter and came away with a few key conclusions. First is the aforementioned fact that the share of total server power consumption for which the CPU is responsible dropped from over 55 percent in 2005 to under 45 percent in 2007. This means that the CPU, even when running at peak performance, may no longer be responsible for the majority of a server's power draw.

The other parts of the server, especially the hard drive and RAM, are now major power sinks. Moving off of the individual server box, networking switches are also a large contributor to datacenter power draw.

The problem with these non-CPU parts isn't so much that they draw a lot of power, but that their power draw doesn't really scale well with their usage level. In other words, a hard drive running at full tilt draws almost the same amount of power as it does running at 50 percent. Unlike modern CPUs, which use voltage and frequency scaling to offer a range of power/performance states, other system components have a much more limited ability to scale power with usage.

Most non-CPU devices approach power optimization by offering a sleep state, in which the device is inactive but can be awakened. While sleep states are fine for embedded and mobile devices, which can find plenty of opportunities to spin down the hard drive without seriously affecting the user experience, Google's profiles of server utilization indicate that these sorts of sleep-based power optimizations don't work well in the datacenter.

Google's data indicates that servers spend most of their time operating at between 10 and 50 percent utilization. So the components in these severs rarely have an opportunity to idle in an inactive sleep state. And even if they were idle, the latency penalty for waking a hard drive from sleep is too large to make sleep a viable option.

What's needed, the authors argue, are more active low-power states in hard drives, RAM, and networking equipment. Instead of just the typical "awake" and "asleep" modes, which are fine for mobile and embedded, component makers and networking equipment vendors must figure out how to offer a variety of intermediate power states that let servers dial back performance in exchange for less power.

Google estimates that if servers could achieve power efficiencies from 60 to 90 percent in the typical operating range (i.e., 10 to 20 percent utilization), then overall datacenter power usage (including secondary usage like cooling) could be cut in half.

I suspect that the advent of the SPECpower family of benchmarks will help push the industry toward this goal, because server makers like IBM, HP, and Dell who want to be able to tout their products' power efficiency in the 10-50 percent utilization range will start demanding that non-CPU components do the kind of dynamic power optimization that we've all come to expect from microprocessors.

Author: Jon Stokes
Source: Ars Technica]]>

Trojan Hijacks Google Text Ads

2007-12-20T09:01:01Z

BitDefender nabs a new Trojan commandeering Host files to deliver third-party advertising instead of Google's. Malware authors are beginning to nibble at Google's text advertising money pie.

According to a warning from anti-virus vendor BitDefender, a new Trojan is making the rounds, hijacking Google text advertisements and replacing them with ads from a different provider.

The Trojan.Qhost.WU threat works by modifying the hijacked computer's Hosts file to redirect the initial query to the Google AdSense servers to a malicious host.

Instead of getting advertising content from Google's "page2.googlesyndication.com" domain, the Trojan, discovered Dec. 17, instructs the infected machine to fetch ads from a different, third-party ad server, according to BitDefender virus researcher Attila Balazs.

BitDefender did not identify the rogue third-party ad server.

Balazs said the threat is a worry for Webmasters and end users.

"Users are affected because the advertisements and/or the linked sites may contain malicious code, which is a very likely situation, given that they are promoted using malware in the first place. Webmasters are affected because the Trojan takes away viewers and thus a possible money source from their websites," he said in a statement.

Over the past year, malicious hackers have turned their attention to ad networks as vehicles for drive-by malware downloads.

In November, security researchers found DoubleClick serving up massive amounts of ads for bogus anti-spyware programs in place of legitimate advertising. Before that, advertisements served by RealNetworks' RealPlayer were also used to exploit a zero-day software vulnerability.

]]>

Say Hello to the IT Certification Council

2007-12-06T08:58:05Z

Last month, a number of notable certification leaders came together to form the Information Technology Certification Council (ITCC) to seek ways to revitalize growth in the field. Founding members of the consortium include test deliverers (Prometric and Pearson VUE), vendor-neutral certification organizations (CompTIA and the Linux Professional Institute), educators (Kaplan) and IT giants (Microsoft, Novell, Sun, HP, IBM).

]]> According to the press releases put out by almost every named founder, the consortium will focus on issues ranging from "exam security, perceptions versus realities of IT certification value and return on investment, and training to testing ratios." Each member added its own paragraph to its press release. For example, from the Linux Professional Institute:

"LPI applauds this initiative and recognizes the importance of participating in a constructive effort to continually enhance the value of IT certification. In addition, we will ensure that the concerns and aspirations of Linux and Open Source IT professionals will be well-represented within this co-operative effort," said Jim Lacey, president and CEO of the Linux Professional Institute.

CompTIA wrote:

"Organizations that benefit the most from their investment in technology are the ones that understand that certified IT professionals have the job skills necessary to run IT infrastructures efficiently and reliably," said Neill Hopkins, vice president, skills development, CompTIA. "The positive impact of IT certification is measurable in many ways: greater network availability, higher worker productivity and improved security are just a few examples. All of these factors have a positive impact on a business's financial bottom line. That's why more and more organizations view IT certifications as a business necessity."

And Prometric added:

"Prometric has seen a real comeback in the certification market, driven largely by the fact that the knowledge, skills and abilities learned as part of a four-year degree program are no longer in sync with the demands in the IT job marketplace," said Ray Kelly, senior vice president, Client Services, Sales and Marketing at Prometric. "Employers are increasingly looking to certifications as proof of a specialized skill set, while candidates are demanding them to secure higher salaries and coveted positions. As the leader in providing scaleable testing solutions to the IT industry, we are delighted to support the ITCC and believe that by joining forces with other leaders, we can be influential in furthering the growth of the industry."

Maybe I'm missing something, but two questions come to mind when I read about this consortium. One, where's Cisco in all of this? Given its Networking Academy, its large certified base and its commitment to certification, isn't it imperative that Cisco be on board? It's hard to imagine such an industry giant not having its name included in this roster.

And two, isn't this what CompTIA is really supposed to be doing right now? According to its own Web site,

"CompTIA is committed to advancing the long-term success and growth of the IT industry by helping organizations maximize the benefits they receive from their investments in technology; and by helping individuals to obtain the skills and credentials they need for productive careers in IT."

If the trend continues, what will be the next step? Will the ITCC itself join a consortium to figure out what the industry needs?