IE8, Safari 4, Firefox 3, iPhone fall on day 1 of Pwn2Own

The first day of the annual Pwn2Own contest in which security researchers can win cash and hardware if they successfully compromise machines using zero-day exploits is finished. Internet Explorer 8 on Windows 7, Firefox 3 on Windows 7, Safari 4 on Mac OS X 10.6, and iPhone OS 3 were all compromised during the competition. Google's Chrome was the only browser left standing—and in fact, was completely untested. None of the researchers at the competition even tried to attack Chrome.

So far, little is known about the successful exploits. Until vendors have been informed of the flaws and those flaws have been patched, details will not be made public.

The iPhone was not successfully hacked in 2009's competition, but was predicted to fall this year, and those predictions have come true. A zero-day Safari flaw was used to gain access to text messages stored on the device by Vincenzo Iozzo from German security firm Zynamics and Ralf-Philipp Weinmann, a post-doctoral researcher at the University of Luxembourg. Notable in the exploit was that it bypassed both iPhone's Data Execution Protection as well as its requirements that all code be signed.

A little more is known about the IE8 exploit, including an (abridged) video of the browser being taken down. The successful researcher, Peter Vreugdenhil, has published a rough outline of the techniques used to bypass IE8's DEP and ASLR protections.

The Safari hack came from Charlie Miller; this makes three years in a row now that Miller has pwned—and hence owned—a Mac at pwn2own. Thus far, nothing further about either this exploit or the Firefox one appears to have been published.

Neither the iPhone exploit nor the IE8 exploit managed to escape the OS-supplied sandboxes that protect these platforms. Without escaping the sandboxes, the impact that flaws can have is reduced, preventing, for example, writing to hard disk (and hence, preventing installation of malware). Nonetheless, read-only access is still valuable for data theft.

It is this sandboxing that might explain why Google's Chrome was untouched; no researcher even attempted to attack it. It is certainly not the case that Chrome has no security flaws—a couple of days before the Pwn2Own draw was made to decide who got to attack which machine and in what order, Google published an update to Chrome that fixed a range of security flaws, some of which were deemed to be high-risk. Google's sandboxing shouldn't be impenetrable, but it is sufficient to make the standard harmless exploit payload—starting up Windows calculator—harder to do.

Source: Arstechnica.com

Mozilla Labs builds add-on to bring address book to Firefox

Firefox's flexible XUL framework and sophisticated add-on system offer a rich platform for enhancing browser functionality. Mozilla Labs takes advantage of this capability as it experiments with new concepts for augmenting Web interaction. Some of the latest experiments to emerge from Mozilla Labs aim to make contacts and identity a core part of the browser.

Mozilla has announced the availability of an experimental new add-on for Firefox that is designed to import information about the user's contacts from a variety of Web services and other sources. The add-on makes contact details easily accessible to the user and can also selectively supply it to remote Web applications. The initial implementation can import data from Gmail, Twitter, and the local system address book on OS X. It can optionally use the Gravatar service to find contact avatars.

After the add-on has imported and indexed the user's contact data, it becomes available to the user through an integrated contact management tool that functions like an address book. There are a number of ways that the contact information could potentially be useful in the browser itself. One of Mozilla's first experiments is an autocompletion feature that allows users to select a contact when they are typing an e-mail address into a Web form.

A number of more compelling usage scenarios involve making the user's contact information available to remote Web services. Consider, for example, the popular social networking website Foursquare, which requests access to your Gmail account so that it can connect you with your friends. Instead of giving it access to your Gmail account and all of your contacts, you could use the contacts add-on to selectively provide limited details about specific groups of contacts.

The add-on is designed in a manner which ensures that contact information is only made accessible to Web services with the user's explicit permission. In many ways, it could potentially be more secure and respectful of privacy than the existing mechanisms that are already widely used today by many social networks to automatically establish friend relationships for new users.

To make the browser's contact database accessible to Web applications, the add-on uses the W3C Contacts API specification. It's an emerging standard developed by Nokia that defines JavaScript methods for interacting with contact data. The functionality described by the standard is intended to allow Web applications to seamlessly integrate with the user's browser-integrated address book.

The API is still in the editing stage, but appears to be relatively comprehensive. It supports adding, removing, and updating items in the browser's contact database and also provides methods for searching and iterating over contacts.

The add-on also supports Plaxo's Portable Contacts standard, which is associated with the OpenSocial initiative. Mozilla says that its new contacts add-on is using the Portable Contacts format to store data internally.

Mozilla is enthusiastic about opportunities for making the new contacts add-on integrate with Raindrop, the experimental communication platform that is being developed by Mozilla Messaging. There is also a chance that we could eventually see contact synchronization support integrated in Weave. As the browser increasingly becomes the central hub of Internet communication, native support for managing and accessing contacts could be a valuable enhancement.

Source: Arstechnica.com

Firefox 3.6 sees 100M downloads, now pushing notifications

Firefox 3.6—the latest version of the popular open source Web browser—was officially released in January, but there are still many users who have not yet updated. In an effort to increase awareness about the availability of version 3.6, Mozilla announced today that it will start rolling out upgrade notifications to its users through the browser's built-in update system.

According to Mozilla's statistics, the new version has already been downloaded over 100 million times since its release in January. That doesn't include the significant number of existing users who have already migrated to 3.6 by using the browser's built-in upgrade system without being prompted to do so.

Firefox is arguably one of the most successful open source software projects. Mozilla celebrated last year when Firefox surpassed 1 billion total downloads. The current number of active daily users is said to be over 350 million.

Getting such a large user base to migrate to the latest version is not an easy task, but Mozilla always manages to get the job done. Studies show that Firefox ranks high in update effectiveness, getting over 85 percent of its users to switch to a new version within 21 days after release. The only browser that has a better upgrade penetration rate is Chrome, due to its highly aggressive background updater.

Firefox 3.6 is a somewhat modest incremental update. It brought several noteworthy new features for users, such as the Personas lightweight theming system. It also offers some compelling new capabilities for Web development, including CSS gradients, client-side filesystem APIs, and the @font-face feature.

For more details about the automated upgrade process, you can refer to the announcement in the Mozilla Developer Center.

Source: Arstechnica.com

KeeFox Integrates KeePass and Firefox (At Long Last)

Firefox: KeeFox brings tight integration between the cross-platform, open-source password manager KeePass and Firefox, providing automatic logins, form filling, and more.

On Tuesday Kevin sang the praises of LastPass for password management, but a lot of readers are still in love with KeePass and aren't ready to trust their passwords with a third-party service, no matter how secure. Unfortunately, despite some solid plug-ins, KeePass's browser integration isn't close to as tight as LastPass's. That's where KeeFox comes in.

This extension is still a little rough around the edges (it's relatively young), but if you're a die-hard KeePass user and Firefox is your browser of choice, it's worth a little effort getting it set up. Once you do, the extension does automatic form filling, logs into sites instantly, offers one-click saving for adding new passwords to KeePass, and more.

The KeeFox extension is a free download, currently Windows only. If you use KeePass, this extension seems like a must have.

KeeFox [via Productive Geek]

Source: Lifehacker.com

Week in tech: Chrome OS, HTML5, China, Ubuntu 10.04a, and Firefox 3.6

It was a busy week as controversy continued to rage over the Google-China dust-up and Mozilla released a solid new version of Firefox. But first, Google.

Ars sat down with the engineering director of Google's Chrome OS project to talk about the past, present, and future of the project. There's a lot of good detail about the relationship between Chrome and Android, the genesis of Chrome OS, and much more.
The Google/China story has enough legs to qualify as a "centipede" at this point. After saying that it would no longer censor Chinese search results and that it was ready to pull out of China, Google also admitted to being the victim of a sophisticated cyberattack that went after more than 30 companies. The Chinese government responded harshly.

The Ubuntu development community pushed out the second alpha version of Ubuntu 10.04. It offers a few new apps and drops HAL in favor of DeviceKit. Check out our hands-on for the scoop on 10.04.

Firefox 3.6 was released this past week. We tested it extensively and found that its incremental improvements combined with a lot of developer-friendly features to make for an extremely solid release.

Ever wanted to know more about quantum computing but were afraid to ask? Check out our definitive guide to quantum computing. It covers the basics of qubits, two-qubit systems, and a primer on quantum physics 101 so you can wrap your brain around the topic.

As the e-book reader wars heat up and we await the unveiling of the Apple tablet, Amazon tried grabbing a bit of the spotlight by announcing a new royalty program for the Kindle. Authors can now earn up to 70 percent from each e-book sold, with a couple of catches.

Looking to make a love connection online? Data from popular dating site OKCupid reveals what kind of photos draw the most attention, and the results may surprise you.

The FTC recently filed a complaint against Intel over its business practices in the CPU market. Intel finally got around to posting its response this past week, and it's a doozy. Highlights include some damning comments from AMD execs made during the middle of the past decade.

Carbon sequestration has been touted as a way to deal with the buildup of greenhouse gases in the atmosphere. Researchers have developed a copper complex that is capable of reacting with carbon dioxide at a slightly elevated electric potential. The process turns the carbon dioxide into a usable byproduct which can be recycled and reused for this purpose multiple times.

Akamai's State of the Internet report reinforces the United States' reputation as a broadband sluggard. The average broadband speed in the US is 3.9Mbps, placing the country in 18th place. Topping the list? South Korea, with an average speed of 14.6Mbps.

Source: Arstechnica.com

New service hamstrings Google data hoarding

Alarmed by the vast amount of personal information Google collects from its users, a hacker has unveiled an anonymization service that prevents the internet giant from tracking searches and websites visited by a specific individual.

Dubbed GoogleSharing, the anonymizing proxy service is designed exclusively for communications with Google. It mixes together requests from many different users so the search engine's data collectors are unable to tell where they originate.

"Google thrives where privacy does not," GoogleSharing creator Moxie Marlinspike wrote in announcing the service. "If you're like most internet users, Google knows more about you than you might be comfortable with."

This is often the case even when users aren't logged in to a given Google account. In addition to every search query an individual has ever made, other personal details open to snooping include what search results and news articles are clicked on, every destination ever looked up on Google Maps and thanks to Google Analytics, many website visits that didn't involve a Google search. Those using Gmail also divulge the content of every email ever sent and received.


GoogleSharing is designed to hamstring Google's data hoarding ways for all its services that don't require a login. Using it is as simple as installing this Firefox plugin, which redirects Google-bound traffic to a proxy. There, requests are stripped of all identifying information and replaced with the details of a different GoogleSharing user. The Google response is then proxied back to the user. By sharing the identities of many different people, the requests become much harder for Google to correlate and analyze.

"The result is that you can transparently use Google search, images, maps, products, news, etc... without Google being able to track you by IP address, cookie, or any other identifying HTTP headers," Marlinspike explained. And only your Google traffic is redirected. Everything else from your browser goes directly to its destination."

The service was unveiled on Tuesday, a day after Microsoft said its competing Bing search engine would cut the amount of time it tracks user searches to just six months. Google, by contrast, holds on to searches for nine months, and even then changes only parts of the data collected while leaving the all-important cookie data alone. Last month, Google CEO Eric Schmidt said if you'd prefer your most intimate or work sensitive net activity not be tracked and retained, "maybe you shouldn't be doing it in the first place."

Marlinspike, a hacker who has identified weaknesses in the widely used SSL protocol, readily concedes that anonymizers such as Tor are more appropriate for people who want to conceal their online activities from a wide variety of actors. But those services can often be extremely slow. For those concerned only about Google, GoogleSharing makes more sense.

Marlinspike has also released the source code used by the proxy so it can be examined or used to create alternative services by others.

Of course, it's impossible for people to connect to Gmail, Google Calendar, and other services that require a login without identifying themselves, so GoogleSharing doesn't work in those situations. In such cases, the Firefox plugin simply forwards request directly to Google. Other Google services that can't be anonymized include Chat, Checkout, Sites, Docs, Photos, Reader, or Health.

Marlinspike has pledged that GoogleSharing will log absolutely nothing. All requests sent to the proxy - and all responses returned - are automatically encrypted using HTTPS, although traffic passing between the proxy and Google is often sent in the clear because Google, like most other websites, still doesn't provide universal SSL support. ®

Source: Theregister.co.uk

Firefox 3.6 Portable Available for Your Thumb Drive Needs

Windows: It's always exciting when a new release of your favorite browser comes out, but if you're a Firefox Portable user, you've always got to twiddle your thumbs a touch longer. Well twiddle no longer; Firefox 3.6 Portable is available for download.

The quick-on-their-toes team at PortableApps.com put together their release less than a day after Mozilla's official release, and—like yesterday's Firefox 3.6 release—it's packed full of speed increases, one-click themes, and plenty more.

Firefox 3.6 Portable is a free download, Windows only.

Mozilla Firefox, Portable Edition [PortableApps.com]

Source: Lifehacker.Com