Cyber Security

Google vs. Microsoft vs. Apple: Software Security Risks – Year-End 2011

arshnet — Mon, 26 Dec 2011 09:46:29 +0000

by Abbas Mirza Dec 26, 2011 2:30 am

Google, Microsoft and Apple are constantly engaged in a struggle for industry dominance, competing in software as well as hardware ranging from computers, smart phones and multimedia devices. Meanwhile, the three companies have a common culprit that poses a present and future threat to the enterprise and consumer markets.

On the security front, it’s shocking to learn that Google and Apple have surpassed Microsoft in software related security risks. The real battle is with the security threats.

Although their business model is distinctive, they are constantly targeted and exploited by the same threats and vulnerabilities as any software dependent vendor.

Today, Google still leads the Internet search; Microsoft still owns operating systems and Apple has revolutionized the smart phone and entertainment industry with its iPhone and iPod devices. Which one is best positioned to handle security threats?

Many people assume that Microsoft always tops the list when it comes to security risks and software vulnerabilities. G7 Security recently conducted data analysis of discovered software vulnerabilities and found that in reality, the outcome was discrepant. If anyone has attempted the same, they would notice that it is an arduous task to get the details on actual attacks. Most agencies do not want to reveal the extent of sensitive security vulnerabilities. In addition, private companies, especially financial institutions, do not want to reveal that their systems have been compromised. G7 selected technology industry in private sector for vendor criteria and have employed NVD as a source for dynamic analysis of Medium to High published flaws. Software defects impairing security of Microsoft, Google and Apple. In addition, Oracle was also included as it is not only the relational database leader but also a vendor of choice by nearly all major companies.

Surprising Statistics Behind the Analysis

As one of the world’s largest and most technologically advanced nations, the United States has the most bandwidth running through. That means virtually all consumers and businesses are exposed to threats. Microsoft powers majority of the computers in the U.S. with its windows operating system. This makes it more prone to threats and attacks by the hackers. The astounding numbers (Figure 1) show that contrary to popular believe that Microsoft products contain the highest reported software flaws, in reality it is not even close to Google. This is mostly because of Google Chrome, which competes with Microsoft’s Internet Explorer in the Browser.

Following G7 Graph shows Year-End Software Vulnerabilities Discovered in 2011 (Figure 1)

Vulnerability Criteria: Software Flaws (CVE)
Vulnerability Published Date Range: Jan. 2011 – Dec. 2011

Severity ranking is based on the Common Vulnerability Scoring System (CVSS) standards which provides an open framework for communicating the characteristics and impacts of IT vulnerabilities. Its quantitative model ensures repeatable accurate measurement while enabling users to see the underlying vulnerability characteristics that were used to generate the scores. In particular, Version 2 Metrics were used (Table 1)

CVSS Version 2 Metrics (Table 1)

Access Vector	Network/Adjacent Local Network/Local Access Only
Access Complexity	Any
Authentication	Single/Multiple
Confidentiality	Partial/Complete
Integrity	Partial/Complete
Availability	Partial/Complete

Vulnerabilities Trends

Based on NVD data, Statistics on vulnerabilities shows that Microsoft software flaws has declined in 2011 to 262 number or (6.40%) of vulnerabilities discovered from 326 (7.03%) in end of the year 2010 while Google vulnerabilities have more than doubled from 222 (4.79%) in 2010 to 498 (12.16%) in year-end 2011 approximately.

Google surprisingly tops the list mainly because of the number of issues reported for Google Chrome. Like Microsoft, Apple discoveries were reduced from 452 (9.74%) in 2010 to 340 or (8.30%) percent in 2011. While Oracle followed Google and increased, but not by as much totaling at 229 (4.94%) in 2010 to 274 (6.69%) in 2011 for medium to high ranking published vulnerabilities.

Microsoft’s products that were affected by the reported issues were Microsoft Windows XP/Server, Publisher, Office 2007, IE 6 through 9 and Office 2008 for Mac among others.

Apple’s lists contained Mac OS X, Apple iTunes, Apple QuickTime, Apple Safari and Apple IOS which powers devices such as iPhone, iPod and iPad. Both Apple Safari and Google Chrome browsers incorporate Webkit framework.

Oracle was impacted by unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE. This also impacted other companies that employ JRE within their product lines. Other affected areas included Oracle Solaris 10 and 11 Express, Oracle Solaris 8, 9, 10, and 11 Express, Oracle Sun Products Suite among others.

Good news is that the overall total number of discovered treats has been declining since 2009. G7 Security validated this security trend to the total matches by year statistics that was queried based on NVD data matching with all characteristics included.

Looking ahead, expect Microsoft to stay the course in reducing and more effectively responding to threats while others thrive in achieving the same as their user base grows.

Contributors:

Anzar Hasan. CISA, C|EH
Certified Expert in various security disciplines and practices such as Ethical Hacking from a vendor-neutral perspective.

Security Matrix and Statistics are based on information gathered from U.S. government repository of standards based vulnerability management data in NVD.

NVD is sponsored by DHS and is a product of the NIST Computer Security Division, Information Technology Laboratory and is sponsored by the Department of Homeland Security’s National Cyber Security Division.

About G7 Security

G7 provides awareness and security resources in the form of News Feeds, US-CERT Security Alerts, Podcasts, and Videos among many other information security activities and tools for web and mobile devices.

(Search for “G7 Security” on App Store and Android Market for your devices). Twitter @iSecurity

Web: www.g7security.com

HBGary hack: lessons learned

amanda0fox — Wed, 23 Feb 2011 01:05:10 +0000

: G:7-Security

No matter the size of your company, you should have change management processes that require all changes to be approved by appropriate personnel. While a CEO can request to open a port on the firewall, a security person in charge should approve any such request. If you don’t have multiple roles for this then make sure that appropriate authentication is in place – i.e. verifying such critical requests through other channels.

Do not use same passwords for multiple applications/sites. A lot of free, good utilities, such as Password Safe exist that will allow you to automatically generate strong passwords and store them in an encrypted key chain.
You should regularly test your web applications – not only external, but also internal. While this does not guarantee that you will identify and eliminate all security vulnerabilities, it will certainly raise the overall security.
Encrypt your backups and think twice if you need all those e-mails at one place. Gmail is certainly attractive for storing years of e-mails and searching through them quickly, but imagine what would happen if someone gets access to all your e-mail.
While we’re on encryption – encrypt sensitive e-mails too – it may seem a nuisance, but it could save the day. PGP Encryption is not difficult to use, there are downsides, of course, so you should balance between usability and security.
If you are a web-application developer, and have a need to store (hashed) user passwords remember that algorithms such as MD5 were built for speed! By using today’s GPUs, it is possible to crack hundreds of millions of MD5 passwords per second. Remember to use passwords salts to make rainbow tables useless (otherwise it’s usually a matter of seconds before a password is cracked).

Finally on storing hashed passwords, try to use multiple algorithms to store passwords – something like – sha1(sha1(sha1(password))) will be unnoticeable for the end user, but will make rainbow tables useless and increase the time needed to crack a password (and increase the likelihood an attacker will have to make a custom cracking module for their purpose).

DoD discusses cybersecurity with NATO and the European Union.

amanda0fox — Fri, 28 Jan 2011 15:16:21 +0000

G:7-Security

DoD discusses cybersecurity with NATO, EU

January 28, 2011

Cybersecurity was high on the agenda this week for top leaders from the Pentagon, NATO and the European Union.

Deputy Defense Secretary William Lynn met inside the alliance headquarters in Brussels to come up with a plan to combat a recent slew of cyber attacks. According to the American Forces Press Service, the cyber defense meeting was planned at a summit in Lisbon back in November.

They reconvened for a progress report. NATO had committed to developing a cyber-incident response organization and to develop a cyber defense policy by June of this year.

The group says in a joint statement – cyber-threats have become more frequent, more organized, and more costly. They say, the attacks have reached a threshold that threatens national security and stability – in the U.S. and across Europe.

Deputy Secretary Lynn stressed the importance of public-private partnerships at this latest meeting. He said that’s because the government and military regularly use private networks to communicate. The Press Service says – about 80 to 90 percent of what the government and military do in cyberspace relies on private infrastructure.

This story is part of Federal News Radio’s daily DoD Report. For more defense news.

Facebook page of it’s founder Mark Zuckerberg Hacked

arshnet — Thu, 27 Jan 2011 22:22:18 +0000

G:7-Security

Coincidence or not, Facebook today announced two new security measures — wider use of HTTPS and the introduction of “social authentication” — less than 24 hours after the Facebook page of company founder Mark Zuckerberg was defaced by a hacker. Read More

Facebook offers protection against wireless Firesheep attack

arshnet — Thu, 27 Jan 2011 22:02:09 +0000

Facebook is rolling out a more secure way to connect to its website, which will protect users from a widely publicized wireless networking attack called Firesheep.

The social-networking site starting Wednesday will let users connect to Facebook using an HTTPS secure Web connection, which offers extra assurance that they’re connecting to the website that they intend to reach, while also encrypting the data sent between the PC and Facebook.

G:7-Security Launches Cyber Security iPhone App

amanda0fox — Wed, 05 Jan 2011 17:09:07 +0000

G:7-Security

The G7 Security announced the release of the G7 Security iPhone Application, which provides cyber tools, latest News and dynamic content on Cyber Security from Global CERTS and various other related resources from around the world right to your iPhone and iPod touch models.

Available at the iPhone App Store, the G7 Security iPhone application allows users to take advantage of the advanced capabilities of the iPhone and iPod touch user interface.

“Our systems pull security centric web content and then parses, filters and mixes them to provide rich and highly relevant information. This complex algorithm is fine tuned for Cyber Security feeds,” said Mr. Abbas Mirza, founder and developer, G7 Security.

“Our new iPhone application provides Cyber Security Alerts in Real Time from the National Cyber Alert System that contains timely information about current security issues, vulnerabilities, and exploits. They outline the steps and actions that non-technical home and corporate computer users can take to protect themselves from attack,” Said Mr. Anzar Hasan, certified security professional and consultant, G7 Security Services.

Features of the G7 Security iPhone application include:

Ping SRC by IP or Host Name
- Check to see if your server is up and running.
- Verify basic TCP/IP connection of your servers from another location then the location they are on. Being on the same network and “pinging” a box is no magic. But are you really visible from the outside?
- Verify your firewall is blocking ICMP packages.

G7 – Whois Lookups
- Look-up for domain registrant data for all top-level domains (both generic and country-code types are supported, 158 TLDs in total), and also for IP whois look-ups.

Global-CSIRT Locator – Locate Global CSIRTS on an integrated GPS enabled Google Map
Real Time Cyber Security Activity
Monthly Activity Summary Report
CERT Security Alerts
CERT Security Tips
iSecurity Tweets
Microsoft Security Response
Microsoft Security Bulletins and Alerts
Threat Level – Visual graphical image of current threat level based on Internet activity
Incident Reporting – Report an incident to G7 Security
Simple navigation – optimized for one-touch access and enhanced viewing

The G7 Security iPhone application syncs via Wi-Fi or the user’s cellular network and downloads the latest news directly to the device.

The G7 Security iPhone application also includes Cyber Security Bulletin with a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. The NVD is sponsored by the Department of Homeland Security (DHS) National Cyber Security Division (NCSD) / United States Computer Emergency Readiness Team.

Another G7 subject matter expert stated that “we further plan to classify and offer more types of information such as DNS attack method trends, incident response techniques, DNS spoofing issues, new attack trends and methods of related incidents and effective response methods.”

According to Robert Kivikoski, The G7 Security App is great and so very useful and the information you provide is of tremendous value.

Compatible with any iPhone or iPod touch with operating system version IOS 3.0, the application was designed by G7 Security and developed in cooperation with Arshnet Technologies and its development team. Android version is also available for download on Google Android Market.

About The G7 Security Company:
(Cyber Security Research and Global Information Security Services (Section 7))

G7 Security, a leading Cyber Security company. The Company’s core purpose is to enhance security and awareness, by creating, collecting and distributing high-quality news, information and defense against cyber attacks.

This press release can be downloaded from www.g7security.com

G7 Security
Amanda Fox, Dallas, Texas USA
+1 (972) 454-9786
cyber@g7security.com

Cyber Security Challenge Launched

amanda0fox — Wed, 28 Jul 2010 16:00:32 +0000

In an attempt to find the next generation of cyber security professionals, and because there are not enough cyber security professionals to go around!, the UK Government has launched the Cyber Security Challenge.

With online and face-to-face competitions, the challenge is set to highlight the profession as a career option, and encourages anyone who thinks they are up to the challenge to enter.

Prizes range from free courses, free bursaries to go to university, access to professional expertise and resources and memberships of professional bodies.

If you think you might like to try, you can enter over at cybersecuritychallenge.org.uk, they have categories in network defense, digital forensics, and an online digital treasure hunt (to be launched later in the year); the best of the best will be invited to take part in a cyber security masterclass, being devised by EADS and HP Labs, to find an overall champion.

iSecurity

Why Facebook Users Need Protection?

amanda0fox — Mon, 21 Jun 2010 22:53:46 +0000

Senator Charles Schumer’s request last week that the Federal Trade Commission (FTC) provide guidelines for online social networks’ use of private information is well founded. Although the millions of consumers who use services like Facebook consider them free, they do exact a cost — the loss of control over one’s personal information. The new data-sharing policies Facebook announced on April 21 only inflate that cost.

In a just-released report on social networks, Consumer Reports found that posting personal information on networks like Facebook, the largest social network, can threaten you and your family in a variety of ways:

It can expose you to cybercrime. Forty-two percent of adult Facebook users said they post their full birth date and more than half said they post at least one piece of highly personal information, according to Consumer Reports’s national 2010 State of the Net survey. Those are valuable pieces of information online thieves can use.

You can jeopardize your family’s safety. Among Facebook users with children at home, 31% post their children’s names and 51% their children’s photos, the same survey found. That’s risky, considering that social networks have been known to harbor child predators.

It can expose your home. Seven percent of adult Facebook users posted their street address, 4% their home phone number, and 3% information indicating when they are away from home. Disclosing such information can invite burglars.

Your computer’s security can be placed at risk. Of the 18 million adult Facebook users who used the site’s apps (games and quizzes), 22% hadn’t given much thought to those apps’ security, while another 17% were confident that the apps are secure. Meanwhile, based on the survey, we estimate that 1.8 million computers were infected by apps obtained through one or another social network during the past year.

It may expose you to abuse. Roughly 9% of social network users experienced some type of online abuse in the past year, according to the survey, including harassment, threats, scams, and someone hijacking their account or their friends list. Yet nearly one in four adult Facebook users weren’t aware of or didn’t choose to use the service’s privacy controls.

Whether it’s your race, religion, or lifestyle, the unintended dissemination of personal information can profoundly affect every aspect of your life. For example, 45% of employers reported in a June 2009 CareerBuilder survey that they use social networking sites to screen potential employees. (More than 2,600 hiring managers participated in the survey.) And a number of cases have come to light in which insurance providers or lawyers have used personal information obtained from a consumer’s social network page to discredit them.

Facebook does offer privacy controls that you can use to limit access to some personal information. But the sensitive information Facebook manages is so voluminous and complex that it’s difficult for the average consumer to comprehend it all, much less master an array of privacy controls.

The new features Facebook announced on April 21 only compound the problem. For example, the personalization pilot program, which passes personal information to Facebook’s partner sites, requires you to “opt-out,” meaning that Facebook will disseminate such information unless you object. That seems to contradict one of Facebook’s founding principles, namely that “people should have the freedom to decide with whom they will share their information.”

We agree with Senators Schumer, Bennet, Franken, and Begich, who last week asked Facebook to provide opt-in mechanisms for information sharing, instead of requiring users to go through complicated processes to protect their privacy. And we urge the FTC to make sure social networks aren’t misleading consumers and to set strong privacy guidelines for those networks.

Article by Jeff Fox – Technology Editor, Consumer Reports (May 4, 2010)

View This Poll

Steve Jobs live from WWDC 2010 – iPhone 4 to go on sale June 24th

arshnet — Mon, 07 Jun 2010 19:57:11 +0000

Steve also mentioned that - “AT&T is going to make an incredibly generous upgrade offer. If your contract expires at any time in 2010, you can upgrade to the iPhone 4.” iPhone 4 is Powered by AT&T – (http://www.att.com/)

Following post is from Live Blog By Joshua Topolsky posted on Jun 7th 2010 12:25PM

11:56AM It’s like our own little keynote send off!

11:55AM And that’s all she wrote! Thanks for reading, and thanks to Justin Glow, Dan Chilton, and the Blogsmith and Netops teams for keeping us afloat!

11:55AM “And all the rest of the family that just supports us in a thousand ways… awesome job. So this our new baby, I hope you love it as much as we do. Thank you very much.”

11:53AM Jobs is listing off team members to applause…

11:53AM “I urge you to get your hands on one of these and see it for yourself. I just want to say thanks to the teams that have worked their tails off to create these products.” We think we know where this is going.

11:53AM “I put up this slide a little earlier this year. It represents what Apple is all about. We’re not just a tech company. Apple is more than that. It’s tech and humanity. It’s the hardware and the software working together. It’s not just a great new camera system, it’s the editing too, it’s not just a front-facing camera, it’s that plus 18 months of work on the software side. It’s the complete solution, so all of us don’t have to be system integrators.”

11:51AM “This is going to change everything… all over again.”

11:50AM “We developed a glass that’s 30 times harder than plastic.”

11:49AM And now… the A4 part!

11:49AM They’ve shown how the casing is produced.

11:49AM Gotta admit, this video is making this thing look extremely attractive.

11:47AM “I can’t believe this is real. That this is actually happening.” Hey people using video chat over 3G all over the world — does it feel that way?

11:46AM Joswiak: “FaceTime is going to change the way we communicate forever.” Forever? Forever ever?

11:45AM Ah… Jony Ive is pontificating! “This is so much more than just another product.”

11:45AM “So that is iPhone 4 and iOS 4. We have a video.”

11:45AM “We finally found a way to get them for free to our iPod touch users.”

11:44AM “And they come in colors… those are $29. And I’d like to talk for minute about iOS 4 upgrades. For the 3G, not all the features are supported, same with the iPod touch, and this excludes the first generation. Upgrades are free for all these products.”

11:43AM “Now there’s some accessories. A Dock. We have a case — we call it a Bunker.”

11:42AM “Pre-orders start a week from tomorrow. And we’re shipping in 5 countries. In July we’re shipping in 18 more.”

11:42AM “So what’s our lineup look like? 3GS is now $99. These go on sale June 24th.”

11:41AM “AT&T is going to make an incredibly generous upgrade offer. If your contract expires at any time in 2010, you can upgrade to the iPhone 4. You can get it up to six months early.”

11:41AM “Pricing — there’s two colors. White and black. Pricing — $199 for 16GB, $299 for 32GB.”

11:40AM “So FaceTime… that’s number 9. So that is the iPhone 4. We think it’s the biggest leap we’ve taken since the original.”

11:39AM “Now it’s based on a handful of standards… but this is going to be an open industry standard.”

11:39AM “This is one of the moments that reminds us of why we do what we do.”

11:38AM Wow — very cool. Two people speaking in sign language on the phone. We’re getting a little choked up! That’s a pretty cool use.

11:38AM Wow. You can flip the image to the rear camera. This commercial is pretty intense.

11:37AM A daughter graduating and talking to her mother!

11:37AM Ah ha… it’s the Sam Mendes commercial!

11:37AM “We made a little video to show some of the ways people might use it.”

11:36AM “So FaceTime video calling. We’re really happy with this.”

11:36AM “The video and audio quality is great. Now it’s going to be WiFi only in 2010. We need to work a little bit with the carriers…”

11:35AM It’s called FaceTime. WiFi only. iPhone 4 to iPhone 4. No setup.

11:35AM “You know I grew up with the Jetsons… and video calls… and now it’s real. What about you?” Jony: “I grew up with the same thing, and it’s real now!” Steve: “It is real… especially when people turn off their WiFi.” Jony: “We’ve had to wait an awful long time for this to become reality.” Steve: “Okay, let’s have lunch soon.”

11:33AM “Hi Jony — how are you?”

11:33AM Whoa it froze up for a second. “Now it never freezes up… did you all turn off your WiFi?”

11:33AM Wow, ha! Jony Picked up!

11:32AM “So in 2007 when we launched the iPhone, it was my privilege to make a call to Jony Ive… and I’m going to do the same thing now.” Boom, video call.

11:32AM “We’ll, we’re really pleased with it. But there is one more thing.” Whoa — the lights just went up along the side of the stage.

11:31AM “So those are the eight things I wanted to share with you on iPhone 4. What do you think so far? I think it’s a lot more than people thought it was. What do you think?” Big cheers.

11:30AM Steve says iAds are projected to represent 48% of the mobile advertising market in the second half of 2010.

11:29AM “We’ve got advertisers committing to $60m.”

11:29AM “I think a lot of people are going to try and win the car. It’s a great idea! We’re going to turn on iAd on July 1st for all iOS 4 devices.”

11:29AM “So that is iAd.”

11:28AM Steve is showing off interactivity with ads. Pretty cool, if you want to interact with a car ad.

11:27AM “So now we’ve got this cool navigator on the bottom. It spins the car. The only way you’ll be able to get one of these is through this ad on the iPhone. So if you want to get a Leaf you need to get an iPhone…”

11:26AM Wow, actually a pretty amazing ad. If you’re a geek, you will love it.

11:26AM “It loads in, and I can always X out of it. So we’re loading up a video… and here we go.”

11:25AM “I pulled one ad in process which was a Nissan ad. They’re going to use it to advertise their electric car, the Leaf. They were hesitant to have me show you, but I convinced them.”

11:25AM “So let me tell you some of the brands that will be advertising with us. Nissan, Citi, Unilever, AT&T, Chanel, GE, Liberty Mutual, State Farm, Geico, Campbells, Sears, JC Penny, Target, Best Buy, Direct TV, TBS, and Disney… those are some of the brands.”

11:22AM Ooh, an iAd demo. So, iPad, iAd, iOS, iPhone, iPod. Let it sink in people.

11:21AM “And that is number seven. Number eight… iAds. Why are we doing iAds? To help our developers earn money.”

11:21AM “Now, iBooks has the iBookstore, and it joins iTunes and the App Store. We have 150 million accounts — we think it’s the biggest on the web. We’re number one.”

11:20AM “It’s really really nice. Pretty cool, huh? So that is iBooks.”

11:19AM The PDF viewer looks pretty full featured.

11:19AM “I can make a note here… ‘I love winnie the pooh’”

11:18AM “I’m going to open one of my favorite books… ‘Winnie the Pooh’”

11:18AM “It just all works.” Demo time!

11:17AM “We’ll have it on the iPhone, the iPad, and the iPod touch. What can we do with these together? First, you can purchase and download a book. It will download wirelessly. You can download the same book to all your devices at no extra charge. Buy it on your iPad, download to your iPhone. And iBooks will automatically and wirelessly sync your current place, all your bookmarks, and all your notes.” No extra charge? We’ll take it.

11:16AM “Same bookshelf to keep your books… PDF reader… we’re really excited about this. And of course, the iBookstore right on your iPhone.”

11:15AM “Number seven — iBooks. We are bringing it to the iPhone with the iPhone 4.”

11:15AM “Now there’s another major miilestone we’re about to hit. This month we will sell our 100 millionth iOS device. iPads, iPhones, iPod touch… there is definitely a market for your applications.”

11:14AM “It will be out soon.”

11:14AM GM candidate in devs hands today for iOS 4!

11:14AM “Microsoft has done a great job on this. Check it out, it’s kinda cool.”

11:13AM Wow. So they are actually adding Bing.

11:13AM “I wanted to hit on the enterprise stuff. Data protection, device management, multiple Exchange accounts… and on the consumer side, we have Google search and Yahoo!, and we’re adding Bing.” Whoa. Whoa.

11:12AM “Its really really helpful. So that gives you a brief view of iOS 4.”

11:11AM “So boom, there’s my four apps.” Finally a “boom”!

11:11AM “It makes it really easy to follow. Now I’d like to go back to the home screen, and I’m going to create a folder. All I have to do is hold my finger on an icon, and drag it onto another icon, so I will drag this sports app onto another sports app and it automatically names it.”

11:10AM “I’m gonna go back to mail… and I can swipe to the right and there’s the audio controls for whatever audio app I’m using. And let me show you a few things in mail. You can see I have the unified inbox, and I’ve also got threading. I can see all of the messages in a single conversation.”

11:09AM “I’m going to play some music, now I’m going to check some mail. Now I’m going to go to webpage and fine out if we did turn off our WiFi devices.” Yep. Huge applause.

11:08AM “We’ve added folders, and a whole bunch of other things I won’t have time to demo today, but I’d like to demo these few things.”

11:08AM “There are some big new features — the first being multitasking. People said you weren’t the first, but we figured it out. If you don’t do it right, you kill the battery.”

11:07AM “And we’re going to give it some metal!”

11:06AM iOS 4!

11:06AM “So number 6 — iPhone OS 4. The most advanced mobile operating system in the world. First off, we’re going to rename it.”

11:06AM Thanks 3G card!

11:05AM Guess what — we’re not doing that.

11:05AM He’s asking people to set their laptops on the floor.

11:05AM Oh my god. Jobs is asking everyone to turn off their network cards and MiFis!

11:04AM “I think you’re going to like it a lot. Before I begin number 6… our guys were running around like crazy backstage… we figured out why the demo crashed….” Oh no, they’re turning off the Wifi!

11:03AM “Isn’t that awesome? So iMovie for iPhone… you’ll be able to buy this for $4.99… if we approve it.” Ha!

11:03AM Steve is back.

11:03AM “Thanks very much!”

11:03AM Big applause for the video. It was pretty stunning.

11:03AM Video recording looks amazing. The quality is extremely impressive.

11:02AM “Here’s a version at 720p, produced entirely on the phone.”

11:02AM Transitions automatically change when you switch themes.

11:01AM Five different themes. Only five?

11:01AM Automatically records geolocation then adds them into certain themes.

11:00AM Transitions, titles… it’s all here!

11:00AM You can add photos, they automatically get the Ken Burns effect.

10:59AM In the edit window you have a timeline along the bottom and your footage up top — buttons dot the corners.

10:58AM “Thanks very much. I’ve been doing this a long time. This year I had a chance to work on iMovie for iPhone, and it’s one of the most exciting apps I’ve ever worked on. It’s really amazing.”

10:58AM “I want to show it to you… I want to invite Randy Ubillos…”

10:57AM “It’s pretty remarkable, but we’re going even further.” iMovie for iPhone!

10:57AM “We pioneered tap to focus, and we now have it for video… and we have one click sharing… and the LED flash will stay on for video recording. You can record, edit, and then with a few taps email it right on the phone.”

10:56AM 720p at 30fps!

10:56AM “So we’re really happy. We think we have a great camera. But that’s not all… because it also records HD video.”

10:56AM “The pictures we’re taking are pretty remarkable. These haven’t been touched in any way. It kills you what kind of quality you get. These were all taking by our employees, just culled some of the better ones I saw.”

10:55AM “In addition to that, when most people increase megapixels they make them smaller, but we’ve kept ours the same size. They don’t capture less photons. 5x digital zoom, tap to focus, and we’ve got an LED flash.”

10:54AM “Now everybody loves to talk about megapixels, but we tend to ask the question how do we make better pictures? Megapixels are nice, but what these cameras are really about is capturing photons and low light photography. So we’ve gone from 3 megapixel to 5 megapixel, but we’re using a backside illuminated sensor.”

10:53AM “So that’s number four. Number five: this is a great one. A whole new camera system.”

10:53AM “So the gyro joins our four other sensors. These phones are getting more and more intelligent about the world around them.”

10:53AM The audience is ooh and aahing… “I practiced this a little bit.” Oh, there you go — the stack is done for!

10:52AM Steve is knocking blocks of wood out.

10:52AM Ha! It’s like a game of Jenga!

10:51AM Wow — Steve did a turn and the block went with him. Pretty darn cool.

10:51AM “This is a little app that we wrote…” It’s a stack of wood in 3D space.

10:51AM “I’d like to give you a demo of this. And since this does not require the network… I should be okay.”

10:50AM “We’re adding a 3 axis gyro, and we tied the gyro and accelerometer, compass, and gyro together for six axis. It’s perfect for gaming.”

10:50AM Big cheers for that.

10:50AM “Number four, we have another new piece of hardware. We’re adding a gyroscope.”

10:49AM Dual mics, 802.11n WiFi, GPS, compass, accelerometer.

10:49AM Quad band HSDPA, 7.2Mbps

10:49AM “And 300 hours of standby.”

10:48AM “Because we’ve been able to make the batter bigger and because the A4 is so good, we’ve improved the battery life. 7 hours of 3G talk, 6 hours of 3G browsing, 10 hours of WiFi browsing, 10 hours of video, 40 hours of music…”

10:48AM “Third — the iPhone 4 is powered by the A4 chip. This was designed by our own team. This is wonderful to have in the iPhone. You take the back off — first thing you notice is that the iPhone 4 is packed to the gills. There’s the A4 right there… micro SIM — we needed the space! You can see the biggest component is the battery.”

10:47AM “It’s the window into your apps, your media… into your content. And we have something that’s the best window on the planet.” Well, that’s hyperbolic a touch.

10:46AM “It makes it so your apps run automatically on this, but it renders your text and controls in the higher resolution. Your apps look even better, but if you do a little bit of work, then they will look stunning. So we suggest that you do that. So that is the Retina Display. Awesome text, awesome images, and awesome video. We think this will set the standard, and no one is going to come close.”

10:45AM 78% of the pixels on iPad.

10:45AM 3.5 inch display.

10:45AM IPS technology — “Quite a bit better than OLED.”

10:44AM 800:1 contrast ration, 4x better than the 3GS

10:44AM Bang! 960 x 640 display.

10:44AM Seeing the NYT load has never been so exciting. “Scott, you have any ideas?” Someone yelled Verzion! Ha!

10:43AM “One more time… sorry guys…” Wait, it’s loading. The audience is oohing!

10:43AM Someone is going down for this network glitch.

10:43AM “I’m afraid we have a problem and I’m not going to be able to show you much today… let’s just go take a look at some photos here… take a look at that.” Wow, this is striking — huge difference in quality.

10:42AM “Okay, we’re going to switch over to some backups here, I have a feeling we might have the same problem…” Deadly silent here. Oooh, error ballon about the dock connector! “Well geez…” Wow.

10:41AM “You know you could help me out, if you’re on WiFi if you could just get off… well we’re having a little problem here.” Oh boy, the iPhone 4 is NOT loading.

10:41AM “So now I’m going to go to some websites. I’m going to go to the NYT… let’s compare.” Loading slowly… “Our networks in here are always unpredictable…”

10:40AM “Look at the icon, look at the text, look at the icon of the clock… isn’t that amazing?”

10:40AM “Look at that difference…” There is something notable here — but the RD is definitely darker…

10:39AM “So let me get them both fired up here.”

10:39AM “So I’d like to show this to you live. I have a 3GS here, and I’ve got a new iPhone 4.”

10:39AM “Pretty amazing, isn’t it?”

10:39AM “Once you use a Retina Display, you can’t go back. When you get to character based languages it’s also striking. And it’s not just text. It’s images and video as well.”

10:38AM “We are comfortably over that limit. Here’s a normal display on the left, and the RD on the right. Can you see it?”

10:38AM “People haven’t even dreamed about a display like this. But there’s more — it turns out there’s a magic number that is right around this ppi that when you hold it away from your face… all of sudden things start to look like continues curves. Like text in a fine printed book.”

10:37AM “Because we have four times as many pixels, we get really, really sharp text. Now the retina display as 326 pixels per inch.” Wow.

10:37AM “Why is that important? Let’s say we want to draw the letter A — as you can see, we can get far more precision. And we play all sorts of tricks.” He’s showing anti aliasing.

10:36AM “Second one, this is a biggie. Something we call the Retina Display. What’s that? In any display there are pixels. We dramtically increased the pixel density, Four times the amount.”

10:36AM “It’s the thinnest smartphone ever. Stainless steel, glass on the front and back. Extraordinary build quality. I don’t think there’s another consumer product like this. So this is our all new design for the iPhone 4. And that’s the first one.”

10:35AM “It’s never been done before.” Uh, we called this!

10:35AM “This doesn’t look like Apple… what are these lines? They are part of the primary structural elements of the phone… this is part of brilliant engineering. It uses the band as part of the antenna system!”

10:34AM “Now because there have been photos around, people have asked ‘what’s this’” The lines!

10:34AM “Bottom, mic, top, headset jack, noise cancellation mic…”

10:33AM “Here are the volume controls… we have a front facing camera, micro SIM tray, camera and LED flash on the back…”

10:33AM “As a matter of fact, it is the thinnest smartphone on the planet.”

10:33AM “It is 24% thinner than the iPhone 3GS.”

10:33AM “And it’s really thin. This is the new iPhone 4.”

10:32AM “You gotta see this in person. This is beyond the doubt, the most precise thing, and one of the most beautiful we’ve ever made. Glass on the front and back, and steel around the sides. It’s like a beautiful old Leica camera.”

10:32AM “You ain’t seen it…”

10:32AM “I don’t know if you’ve ever seen this.” Ha! Huge cheers!

10:31AM “Now, this is really hot. There are over 100 new features, but I’m going to cover 8. The first one? An all new design.”

10:31AM “We’re introducing iPhone 4.”

10:31AM “It started to change things. In 2008 we added 3G and the App Store, in 2009 the 3GS was twice as fast, and we added some other cool features like video… in 2010 we’re going to take the biggest leap since the original iPhone.”

10:30AM “So let’s get back to iPhone. In 2007 iPhone reinvented what we thought of as a smartphone. It’s hard to remember what it was like. It was really different before the iPhone.”

10:30AM “Here’s another one — mobile browser usage. iPhone is at 58.2%, and Android is at 22.7%… that may help you put things in perspective.”

10:29AM “There have been a lot of stats floating around, market research, studies. Some are okay, some are questionable. I’d like to give you two pieces of data. The first is a report that just came out from Nielsen. They said what is the marketshare in the US? RIM, #1 with 35%, iPhone, 28%, Windows 19%, Android 9%… Nielsen said we’re over three times the marketshare of Android.”

10:28AM “And that’s what makes the app store the most vibrant on the planet. Not only for users but developers as well. Now I’d like to talk about the iPhone.”

10:27AM “I have a few great pieces of info to share with you this morning. Last week we crossed 5b downloads. This next thing is my favorite stat of the whole show. You know we give 70% of revenue to developers. So how much have we paid? To date? Just a few days ago we crossed $1b.” Wow, ha. A check made out to “developers” for a billion!

10:26AM Steve is back. “You know he was playing that in real time there… that’s pretty cool.”

10:26AM “You can start rocking out today — it’s available in the app store for $2.99.”

10:26AM Oh goodness. There is air guitar happening on stage. And the music just got super loud! “You rock!” Big cheers for that.

10:25AM “As you can see we have the obvious tapping mechanics. With the introduction of a new strumming mechanic, our team has made gameplay perfect.”

10:24AM “The game comes with classic rock from Queen and the Rolling Stones…”

10:24AM “We developed a brand new experience for the iPhone and iPod touch…”

10:23AM “Next up, Activision. Karthik Bala is here to tell us about Guitar Hero.”

10:23AM Available end of June.

10:22AM “Thanks, that’s our game!”

10:22AM We’re guessing this is really awesome if you play Farmville. We don’t. Play it.

10:22AM “With Farmville on the iPhone, you’ll be able to farm anytime, anywhere. But I’m most excited about how good tractoring just got.”

10:21AM “We now have withering crop push notifications.” Big laughs.

10:21AM In app purchases for the marketplace… if that’s your thing. Ha! “Is that a Snow Leopard?” “It sure is, and it’s only on the iPhone.”

10:20AM “We have over 70m active users. They’ve raised over $2m for Haiti.” Demo time. Ah, syncs with your Facebook farms, apparently.

10:19AM “Thank you for having us today. Today we’re introducing ‘Farming’ for the iPhone. ‘Farmville’ is our most popular game, and we’re excited to bring it to the most popular mobile platform in the world.”

10:19AM Steve is back. “That’s great. Next up, zygna. Let me have them explain it.” Mark Pincus from Zygna is out.

10:18AM “Netflix is taking advantage of Apple’s adaptive bitrate technology. And it allows us to seamlessly switch between networks.” Oh snap — 3G is a go.

10:17AM Search, instant queue… yep… Netflix. On the iPhone.

10:17AM You can pick up your viewing place from iPad to iPhone (we assume other streaming you’re doing on Netflix say… on the Xbox…)

10:17AM Demo time!

10:16AM “We just launched Netflix for the iPad, and it’s been a huge success. It’s the #1 most downloaded in entertainment apps. But I’m happy to announce Netflix for iPhone coming this summer, for free.”

10:16AM Reed Hastings from Netflix is out!

10:16AM “I’d like to highlight the eBay app — a quote from John Donovan about the massive sales eBay has done in the iPhone app — $600m.” “Now I’d like to talk about something else… Netflix, Netflix on the iPhone.”

10:15AM “If you were in our shoes, you’d be rejecting for the same reasons. Even with this, 95% are approved in seven days. Sometimes you read these articles and you think something is going on…”

10:14AM “What about the ones we don’t approve? Well why is that? What are the reasons? 1: the app doesn’t do what you said it would. 2: It uses private APIs… and if they change the app will break… and the third reason? They crash.”

10:13AM “Guess what? 95% of all apps submitted are approved within 7 days.”

10:13AM “So we have two platforms we support. Now you’ve heard about our process of approving apps. We get about 15k submissions a week. They come in at up to 30 different languages.”

10:12AM “Anyone can write HTML5 apps. The second one is the App Store. It’s the most vibrant app store on the planet.”

10:12AM “Next, I’d like to talk about the App Store. Before I do that, I want to make something clear. We support two platforms: HTML5 — it’s a completely open, uncontrolled platform. And we fully support it.”

10:11AM “So PDF viewing built right in. That enhancement will be out later this month. So that is my update for the iPad.”

10:10AM “We’re also adding PDF viewing in the app. We’ve put a selector right up top, you can select PDFs, you get a whole new bookshelf. They just look gorgeous.”

10:10AM “Publishers tell us that sales of there eBook sales are at 22% right now. 22% in iBooks. We’re making some changes today — notes, you can make notes right here, new bookmarks, and a new page displaying your notes and bookmarks.”

10:08AM “A friend of mine wrote this, and he sent me an email and he said I could use it. I earned more in the first day of selling Elements than I did in the past 5 years of Google ads on periodictable.com” Ouch

10:07AM “Here’s an app that’s really cool — it’s called The Elements.”

10:06AM Big cheers — and Steve is back out. “We’re in 10 countries today, we’ll be in 19 by July. So there are now 8500 iPad apps in the app store. It can run iPhone apps too. These 8500 apps have been downloaded over 35m times. That’s about 17 apps per iPad that have already been downloaded. That’s a great number. Let me show you a few.”

10:05AM Yes, people are freaking out all over the world about the iPad. Really really freaking out.

10:05AM “We’re selling one every 3 seconds. We’ve started shipping international… and we have a little real of press coverage, can we roll that?” A clip of international coverage of the iPad…

10:04AM “It is magical, I know it because I got this email: I was sitting in a café with my iPad, and it got a girl interested in me!.” “So there’s proof.” Huge cheers.

10:03AM “I want to give you some updates, and I want to start with the iPad. It’s changing the way we experience the web, email, photos, maps, video, you name it. It’s a whole new way to interact with the internet, apps, content and media.”

10:03AM “We’re excited about this year’s conference and thrilled to have you here.”

10:02AM “We apologize to folks who couldn’t be here… this is the biggest place we can get, so… anyway.” Laughs!

10:02AM “We have a great conference for you this week. Over 5200 attendees, 57 countries, and we sold out in eight days.”

10:01AM Wow, lots of flashes going off right now. “Thank you. It’s great to be here. Thank you so much.” “We love you Steve!” “Thanks I think.”

10:01AM Huge applause! Steve is out!

10:00AM Okay… the lights are dimming in time with the song’s end. Something might be happening. Like now.

9:59AM Hmm… “What a Wonderful World” just came on. Loud.

9:56AM “Welcome to WWDC 2010 — please turn off your cellphones and PDAs.” PDAs!? Thank you for being a friend, Apple.

9:51AM It’s your last chance for predictions! Better get them in in comments before it all gets underway. We predict there’s going to be a new Mac Plus. The Plus 3GS.

9:46AM The room is filling up rather quickly. Certainly the media folks have gotten settled by now, but lots of attendees are streaming in.

9:38AM Hey, if you guys want, click on that Digg badge and vote us up. No pressure, but if you don’t a puppy will die.

9:37AM We think they mean to calm everyone down with this music, which makes sense since crazies were literally shoving people out of the way to get to seats. Engadget lost a tooth.

9:29AM Jazz… what could it mean? the iTrumpet? Probably.

9:29AM We’re in our seats with just about a half hour to go. The vibe is pretty electric here — but there’s some smooth jazz playing on the sound system.

8:51AM We’re outside the doors about to head in. There will be a stampede, and we will be crushed.

It all starts today at the times below!

07:00AM – Hawaii
10:00AM – Pacific
11:00AM – Mountain
12:00PM – Central
01:00PM – Eastern
06:00PM – London
07:00PM – Paris
09:00PM – Moscow
02:00AM – Tokyo (June 8th)

iPhone 4 – Powered by AT&T – (http://www.att.com/)]]>

Steve Jobs – “This changes everything. Again!”

-Abbas

How Do You Build a Secure Web Application?

arshnet — Sun, 04 Oct 2009 02:50:53 +0000

Securing Your Application

To build secure Web applications, a holistic approach to application security is required and security must be applied at all layers.

If you were to review and analyze the top security issues across many Web applications, you would see a pattern of problems. By organizing these problems into categories, you can systematically tackle them. These problem areas are your application’s vulnerability categories.

Application Vulnerability Categories

What better way to measure the security of a system than to evaluate its potential weak points? To measure the security resilience of your application, you can evaluate the application vulnerability categories. When you do this, you can create application security profiles, and then use these profiles to determine the security strength of an application.

These categories are used as a framework throughout this guide. Because the categories represent the areas where security mistakes are most frequently made, they are used to illustrate guidance for application developers and architects. The categories are also used as a framework when evaluating the security of a Web application. With these categories, you can focus consistently on the key design and implementation choices that most affect your application’s security. Application vulnerability categories are described in Table 1.0.

Table 1.0: Application Vulnerability Categories

Category	Description
Input Validation	How do you know that the input that your application receives is valid and safe? Input validation refers to how your application filters, scrubs, or rejects input before additional processing.
Authentication	“Who are you?” Authentication is the process where an entity proves the identity of another entity, typically through credentials, such as a user name and password.
Authorization	“What can you do?” Authorization is how your application provides access controls for resources and operations.
Configuration Management	Who does your application run as? Which databases does it connect to? How is your application administered? How are these settings secured? Configuration management refers to how your application handles these operational issues.
Sensitive Data	Sensitive data refers to how your application handles any data that must be protected either in memory, over the wire, or in persistent stores.
Session Management	A session refers to a series of related interactions between a user and your Web application. Session management refers to how your application handles and protects these interactions.
Cryptography	How are you keeping secrets, secret (confidentiality)? How are you tamperproofing your data or libraries (integrity)? How are you providing seeds for random values that must be cryptographically strong? Cryptography refers to how your application enforces confidentiality and integrity.
Parameter Manipulation	Form fields, query string arguments, and cookie values are frequently used as parameters for your application. Parameter manipulation refers to both how your application safeguards tampering of these values and how your application processes input parameters.
Exception Management	When a method call in your application fails, what does your application do? How much do you reveal? Do you return friendly error information to end users? Do you pass valuable exception information back to the caller? Does your application fail gracefully?
Auditing and Logging	Who did what and when? Auditing and logging refer to how your application records security-related events.

Security Principles

Recommendations used throughout this guide are based on security principles that have proven themselves over time. Security, like many aspects of software engineering, lends itself to a principle-based approach, where core principles can be applied regardless of implementation technology or application scenario. The major security principles used throughout this guide are summarized in Table 2.0

Table 2.0: Summary of Core Security Principles

Principle	Concepts
Compartmentalize	Reduce the surface area of attack. Ask yourself how you will contain a problem. If an attacker takes over your application, what resources can he or she access? Can an attacker access network resources? How are you restricting potential damage? Firewalls, least privileged accounts, and least privileged code are examples of compartmentalizing.
Use least privilege	By running processes using accounts with minimal privileges and access rights, you significantly reduce the capabilities of an attacker if the attacker manages to compromise security and run code.
Apply defense in depth	Use multiple gatekeepers to keep attackers at bay. Defense in depth means you do not rely on a single layer of security, or you consider that one of your layers may be bypassed or compromised.
Do not trust user input	Your application’s user input is the attacker’s primary weapon when targeting your application. Assume all input is malicious until proven otherwise, and apply a defense in depth strategy to input validation, taking particular precautions to make sure that input is validated whenever a trust boundary in your application is crossed.
Check at the gate	Authenticate and authorize callers early — at the first gate.
Fail securely	If an application fails, do not leave sensitive data accessible. Return friendly errors to end users that do not expose internal system details. Do not include details that may help an attacker exploit vulnerabilities in your application.
Secure the weakest link	Is there a vulnerability at the network layer that an attacker can exploit? What about the host? Is your application secure? Any weak link in the chain is an opportunity for breached security.
Create secure defaults	Is the default account set up with least privilege? Is the default account disabled by default and then explicitly enabled when required? Does the configuration use a password in plaintext? When an error occurs, does sensitive information leak back to the client to be used potentially against the system?
Reduce your attack surface	If you do not use it, remove it or disable it. Reduce the surface area of attack by disabling or removing unused services, protocols, and functionality. Does your server need all those services and ports? Does your application need all those features?

Summary

An ever-increasing number of attacks target your application. They pass straight through your environment’s front door using HTTP. The conventional fortress model and the reliance on firewall and host defenses are not sufficient when used in isolation. Securing your application involves applying security at three layers: the network layer, host layer, and the application layer. A secure network and host platform infrastructure is a must. Additionally, your applications must be designed and built using secure design and development guidelines following timeworn security principles.