Microsoft patches critical flaws in Windows 8, Windows RT

Microsoft today patched 19 vulnerabilities in Windows, Internet Explorer 9 (IE9), Excel and the .Net development framework, including four flaws in the just-released Windows 8 and its tablet spin-off Windows RT.

Of Tuesday's six security updates, four were labeled "critical," Microsoft's most-severe threat ranking, while the remaining pair were pegged as "important" or "moderate." Of the 19 vulnerabilities patched today, seven were tagged as critical.

"The IE9 [bulletin] is the one that should be patched first," said Andrew Storms, director of security operations at nCircle Security, in an interview today. "It's a drive-by," he added, referring to the tactic that only requires hackers to trick users into browsing to a malicious website.

Doing that with an unpatched copy of IE9 could result in a successful hijacking of a Windows 7 or Vista PC. IE9 only runs on those two operating systems.

No other versions of Microsoft's browser, including the new IE10, were affected by MS12-071. IE10 is bundled with Windows 8 and Windows RT, and today shipped as a "Release Preview" for Windows 7.

Storms put MS12-075 second on today's to-do list.

That update patches three vulnerabilities in Windows kernel mode drivers, one of which was labeled critical. The latter was a bug in the operating system's parsing of TrueType fonts, which could be exploited only by determined attackers, said Storms.

"Despite the fact that it looks nasty, it's not very realistic to expect working exploits," argued Storms, ticking off the many requirements for a successful attack, including the need to spoof a proxy server.

Microsoft rated the bug as "2" on its exploitability index, the company's threat estimate, essentially agreeing with Storms. "Exploit code would be difficult to build," Microsoft said of the TrueType bug.

That vulnerability was reported to Microsoft by Google's bug bounty program. In late September, Google paid a pair of researchers $5,000 for rooting out the vulnerability, part of a $29,500 payday for nine different researchers.

Windows 8 and Windows RT harbored four of the 19 bugs, three of them critical and the fourth ranked important.

The two critical flaws in MS12-072 were pegged for Windows 8 and its offspring, as was the TrueType font bug in MS12-075 and one of the vulnerabilities in MS12-074, which patched all versions of the .Net framework.

A Windows RT-related vulnerability was also fixed in MS12-076, an update for all versions of Excel, including the one within Office RT, the mini-suite bundled with Microsoft's tablet OS. Only the not-yet-available-at-retail Excel 2013 escaped unscathed.

"I'm sure Microsoft is disappointed to have released Windows 8 in late October and have already issued patches for it," said Storms. "But truth be told, a lot of code is reused, and it shouldn't be surprising to see bug fixes in Windows 8. Despite all the hype about newer platforms being the most secure, bugs will be found and bugs will be fixed."

November's six security updates can be downloaded and installed via the Microsoft Update and Windows Update services, as well as through WSUS.

Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, on Google+ or subscribe to Gregg's RSS feed. His email address is gkeizer@computerworld.com.

See more by Gregg Keizer on Computerworld.com.

Read more about malware and vulnerabilities in Computerworld's Malware and Vulnerabilities Topic Center.

Read more »

Cisco Q1 profit and revenue grew despite weakness in Europe

Cisco Systems posted higher revenue and profit in its fiscal first quarter despite weak orders in Europe, as results in the U.S. were strong, the networking company reported on Tuesday.

Revenue hit US$11.9 billion in the quarter, up 6 percent from a year earlier, the company said. Net income rose by almost 18 percent to $2.1 billion, with earnings per share of $0.39. Chairman and CEO John Chambers attributed the company's profit in part to strong cost containment. Cisco's fiscal first quarter ended Oct. 27.

The trends toward mobile and cloud computing are helping Cisco, Chambers said on a conference call with financial analysts.

"The network has never played a more central role," Chambers said.

Not counting certain one-time items, earnings per share was $0.48. That beat analysts' consensus estimate of $0.46 per share according to a poll by Thomson Reuters. Analysts had expected $11.8 billion in revenue, an estimate Cisco also slightly exceeded.

For the current quarter, Cisco expects revenue to grow between 3.5 percent and 5.5 percent.

(More to come.)

Stephen Lawson covers mobile, storage and networking technologies for The IDG News Service. Follow Stephen on Twitter at @sdlawsonmedia. Stephen's e-mail address is stephen_lawson@idg.com

Read more »

Bank of America to challenge Square, Verifone in mobile payments

Bank of America Merchant Services will extend its mobile payments service to small retailers in December, allowing them to use smartphones and tablets as point-of-sale terminals.

The entry of the country's largest processor of electronic payments into the small-retailer sector of the market further endorses use of phones as payment terminals and will mean stiffer competition for existing players like Square and Verifone.

Bank of America's Mobile Pay on Demand service will be available from Dec. 3 and will be compatible with Android and Apple iOS devices. The bank will supply a credit card reader and an application that are installed on the retailers' mobile devices.

Targeted at businesses that process only a few credit card payments each day, the Bank of America service will charge retailers 2.7 percent for swiped-card Visa, Mastercard and Discover purchases and 3.5 percent plus $0.15 for transactions where the card number is keyed in. American Express processing is also supported at fees ranging from 2.3 percent to 3.5 percent.

Competitor Square, which popularized the sector when it launched an iPhone payment device in October 2010, charges 2.75 percent per transaction or a $275-per-month flat fee with no transaction charges.

Retailers that sign up before the end of the year will get a yearlong subscription to iDeals Marketing Platform Pro. The service allows businesses to publish simple websites and through them offer discounts and loyalty programs to customers.

If a customer wants to take advantage of a discount or collect loyalty points, they link their credit card to an iDeals account. When the card is swiped, it's matched with the customer's iDeals account and the discount applied or the loyalty point awarded. At launch, the discount will be applied later in the form of a credit back to the card. Later, it's hoped that the offer will be applied immediately.

The same platform also allows retailers to push out offers to social media and deals platforms like Bing Deals and 8 Coupons.

At launch, the Bank of America service will only pull credit card data from the magnetic strip on the cards.

A rival, Verifone, launched a payment device for smartphones and tablets last week that is compatible with the "chip and PIN" credit cards that are in use in many countries. Chip and PIN has become the dominant technology in Europe and relies on a smartcard credit card and personal identification number rather than a signature.

The new Bank of America service is for in-person payments. A similar service, Mobile Pay Business, is already offered by the bank for retailers that process many payments per month in person, by mail and by phone.

Bank of America Merchant Services is a joint venture of Bank of America and First Data, the largest electronics payment network operator.

Martyn Williams covers mobile telecoms, Silicon Valley and general technology breaking news forThe IDG News Service. Follow Martyn on Twitter at @martyn_williams. Martyn's e-mail address ismartyn_williams@idg.com

Read more »

Cisco to build small cellular base stations, Chambers says

Cisco Systems plans to build small cellular base stations, building upon its fast-growing business in Wi-Fi base stations for mobile operator networks, Chairman and CEO John Chambers said on Tuesday.

The move will bring the networking giant into a major part of communications infrastructure that until now it has left mostly to the handful of major manufacturers that are steeped in the cellular world, such as Ericsson, Nokia Siemens Networks and Alcatel-Lucent. But Cisco won't build the full-size "macro" base stations that have formed the basis of that business until now, instead focusing on so-called "small cells" that cover smaller areas.

Mobile operators can deploy small cells in densely populated areas to increase their networks' capacity to carry calls and data services. With proper coordination between the small and macro cells, carriers can serve more subscribers using the same amount of radio spectrum, which is at a premium in many areas.

Cisco executives have said in the past that the company was studying how it might participate in the cellular radio market. On a conference call Tuesday about Cisco's first-quarter financial results, Chambers gave a definitive answer.

Responding to an analyst's question about radio-access networks, Chambers said Cisco has had great success so far with Wi-Fi access points it makes for mobile operators. Revenue in that business is only about US$100 million per year, a relatively small number for Cisco, but that figure roughly doubled in the quarter from a year earlier on the strength of several new deals with carriers, Chambers said.

"Then, we're going to move into small cell, and then we're going to combine small cell with [service-provider] Wi-Fi, with 3G, with 4G, with our architectural plays," Chambers said. While specifying that Cisco won't make "traditional" base stations, the large radios that are typically found on towers, he said Cisco would make the kinds of base stations designed to go on top of light poles. That's the type of deployment envisioned for public, outdoor small cells.

Cisco has been selling itself in the mobile carrier arena as a provider of unified end-to-end infrastructure that ties the wireless edge of the network to fast wired connections and network management capabilities on the back end. But until now its wireless pitch has been limited mostly to Wi-Fi access points, a technology that Cisco dominates in homes and offices and which is starting to play a crucial role in mobile carrier networks. Where service providers can use Wi-Fi, they tap into unlicensed spectrum that can carry customers' data traffic at speeds comparable to 4G, easing the burden on their expensive licensed frequencies.

Cisco is not entirely new to cellular base stations, having worked with partner ip.access on the AT&T MicroCell, a tiny "femtocell" designed for use in a consumer's home. But entering into the public small-cell business will expose Cisco to both a much bigger opportunity and a long list of technical and sitingchallenges that are still being worked out. Key among these is the ability of long-range macrocells to coordinate with small cells so that the two can deliver the maximum efficiency and not interfere with each other.4

Combining small cells with Wi-Fi in the same access point may be a natural move for Cisco and is one that other vendors are already working on. A hybrid cellular and Wi-Fi access point holds the promise of both simplicity for location and mounting and flexibility for serving subscribers with the best possible technology in a given situation.

Stephen Lawson covers mobile, storage and networking technologies for The IDG News Service. Follow Stephen on Twitter at @sdlawsonmedia. Stephen's e-mail address is stephen_lawson@idg.com

Read more »

Review of Casino Online in Casino-now.it

Review of Casino-now.it

Casino Online is one of the most popular online casino gaming site. visit the site http://www.casino-now.it/ to play live casino games right now. Get 5.000 € right now after signup. Casino Online sponsors the responsible gaming. Casino online also links to top sites like casino.com, mansioncasino.com, club 777, lesacasino.com, etc. But remember online casino is only for people who is above 18 years old.  Online casino is game care certified with 3 stars. Transaction during deposit is encrypted with verisign the most secure connection service. Casino online is also know as the best online casinos of Italy. online casino has many facilities like signup bonus, free bonus slots machine ( no deposit bonus), refer a friend and get rewards for playing the slot machine, etc. And the last but not least the European most popular casino game live roulette can be available through casino online. So what you are waiting for play right now http://www.casino-now.it/.

Read more »