Google quashes 13 Chrome bugs, adds PDF viewer – Computerworld

Google on Thursday patched 13 vulnerabilities in Chrome as it shifted the most stable edition of the browser to version 8.

Chrome 8 also debuted Google’s built-in PDF viewer, an alternative to the bug-plagued Adobe Reader plug-in, and included support for the still-not-launched Chrome Web Store.

The 13 flaws fixed in Chrome 8.0.552.215 are in a variety of components, including the browser’s history, its video indexing and the display of SVG (scalable vector graphics) animations.

Four of the baker’s dozen are tagged as “high” level bugs, Google’s second-most-serious rating, while five are pegged “medium” and four are labeled as “low.”

Google paid $4,000 in bounties to five researchers for reporting vulnerabilities. Since mid-August, Google has handed out over $29,000 in bug bounty payments.

Among the researchers credited with submitting flaws was Nirankush Panchbhai, who works in Microsoft’s vulnerability research group. Panchbhai was not one of the researchers paid a bounty.

via Google quashes 13 Chrome bugs, adds PDF viewer – Computerworld.

LinkedInPinterestEvernoteWordPressBlogger PostEmailShare

Hackers exploit newest Flash zero-day bug – Computerworld

Adobe today confirmed that hackers are exploiting a critical unpatched bug in Flash Player, and promised to patch the vulnerability in two weeks.

The company issued a security advisory that also named Adobe Reader and Acrobat as vulnerable.

“There are reports that this vulnerability is being actively exploited in the wild against Adobe Reader and Acrobat,” said Adobe in its warning. The company said it’s seen no sign that hackers are also targeting Flash Player itself.

Those reports came from Mila Parkour, an independent security researcher who notified Adobe early today after spotting and then analyzing a malicious PDF file. According to Parkour, the rigged PDF document exploits the Flash bug in Reader, then drops a Trojan horse and other malware on the victimized machine.

Adobe said that all versions of Flash on Windows, Mac, Linux and Android harbored the bug, and that the “Authplay” component of Reader and Acrobat 9.x and earlier also contained the flaw. Authplay is the interpreter that renders Flash content embedded within PDF files.

via Hackers exploit newest Flash zero-day bug – Computerworld.

LinkedInPinterestEvernoteWordPressBlogger PostEmailShare

Adobe hits Reader users with 23-patch ‘whammy’ – Computerworld

Adobe patched 23 security vulnerabilities in its Reader PDF viewer on Tuesday, most of them critical, including one that has been exploited by hackers for at least a month or possibly much longer.

Tuesday’s patch job set a record for 2010, and came close to last year’s biggest update, a 29-fix collection Adobe shipped in October 2009.

In September, Adobe promised to speed up the delivery of today’s patches, which were originally meant to ship next week, because attackers were already leveraging a bug in Reader’s and Acrobat’s font parsing.

“Adobe is hitting customers with a double whammy today,” Andrew Storms, director of security operations at nCircle Security, said via e-mail. “Adobe products continue to be at the top of the target list for malware writers.”

“They patched a zero-day flaw in Flash in late September, and today they are releasing their quarterly Acrobat update ahead of schedule because of another zero-day,” Storms said.

Tuesday’s Reader and Acrobat updates also included a patch released more than two weeks ago for Flash, Adobe’s media player. Both Reader and Acrobat include code to run Flash embedded in PDF documents.

Of the 23 bugs Adobe patched, the most notable was the one revealed Sept. 7 by Mila Parkour, an independent security researcher who reported the attack after discovering rigged PDFs attached to e-mail messages.

via Adobe hits Reader users with 23-patch ‘whammy’ – Computerworld.

LinkedInPinterestEvernoteWordPressBlogger PostEmailShare

Microsoft helps Adobe block PDF zero-day exploit – Computerworld

Microsoft last Friday urged Windows users to block ongoing attacks against Adobe’s popular PDF viewer by deploying one of Microsoft’s enterprise tools.

Adobe echoed Microsoft’s advice, saying the Enhanced Migration Experience Toolkit (EMET) would stymie attacks targeting Reader and Acrobat.

Called “scary” and “clever,” the in-the-wild exploit went public last week when security researcher Mila Parkour reported it to Adobe after analyzing a rogue PDF document attached to spam. Adobe first warned users Wednesday of the threat, but at the time gave users no advice on how to protect themselves until a patch was ready.

Microsoft stepped in on Friday.

“The good news is that if you have EMET enabled … it blocks this exploit,” said Fermin Serna and Andrew Roths, two engineers with the Microsoft Security Response Center (MSRC) in an entry on the group’s blog.

via Microsoft helps Adobe block PDF zero-day exploit – Computerworld.

LinkedInPinterestEvernoteWordPressBlogger PostEmailShare

Newest Adobe zero-day PDF exploit ‘scary,’ says researcher – Computerworld

The exploit for a critical unpatched bug in Adobe Reader that’s now circulating is “clever” and “impressive,” security researchers said this week.

In an exploit first uncovered on Tuesday by Washington-based researcher Mila Parkour, attackers are using rigged PDF documents that include code to exploit a zero-day vulnerability in the widely used Reader PDF viewer as well as in Acrobat, Adobe’s PDF creation software.

The sophisticated exploit bypasses two important defenses that Microsoft erected to protect Windows, ASLR (address space layout randomization) and DEP (date execution prevention), researchers have confirmed.

“It’s pretty clever,” said Chet Wisniewski, a senior security adviser at security software vendor Sophos. “It circumvents protections like ASLR and DEP. “Its techniques are certainly out of the ordinary and a lot more sophisticated than the garden-variety [PDF] exploit.”

via Newest Adobe zero-day PDF exploit ‘scary,’ says researcher – Computerworld.

LinkedInPinterestEvernoteWordPressBlogger PostEmailShare

FTC settling case over ‘fake’ iTunes reviews | Politics and Law – CNET News

A PR firm accused of writing phony iTunes reviews of its clients’ iPhone apps is settling the case with the Federal Trade Commission.

As part of the proposed settlement (PDF), PR firm Reverb Communications and owner Tracie Snitker must remove any iTunes reviews that were written by Reverb employees posing as ordinary customers and who failed to disclose a relationship between Reverb and its game developer clients. The agreement also bars Reverb and Snitker from posting further reviews on iTunes that pretend to be from independent consumers or that neglect to disclose any connection between the company and its clients, according to the FTC.

via FTC settling case over ‘fake’ iTunes reviews | Politics and Law – CNET News.

LinkedInPinterestEvernoteWordPressBlogger PostEmailShare

PDF: SCOTUS Ruling – BILSKI ET AL. v. KAPPOS, UNDER SECRETARY OF COMMERCE FOR INTELLECTUAL PROPERTY AND DIRECTOR, PATENT AND TRADEMARK OFFICE

LinkedInPinterestEvernoteWordPressBlogger PostEmailShare

Supreme Court Rules Narrowly In Bilski; Business Method & Software Patents Survive | Techdirt

As I expected it appears that the Supreme Court has ruled somewhat narrowly in the Bilski case (pdf), which many had hoped would end the scourge of business method and software patents. Instead, the court effectively punted the issue. Technically it affirmed the overall decision from the Federal Circuit that Bilski’s specific patent was invalid for being way too broad, but much more importantly for everyone else, it rolled back the Federal Circuit’s “machine-or-transformation” test, which many believed effectively ruled out pure software patents. Instead, the court said that the courts “should not read into the patent laws limitations and condi-tions which the legislature has not expressed.” In other words, business method and software patents survive.

I’m sure there will be much more analysis of this decision going forward, but on a first pass, despite “affirming” the Federal Circuit ruling, this one looks like a big win for supporters of business method and software patents. Basically, the court just said it would rule on this particular patent and not make any real statements on the overall patentability of business methods or software. So, in effect, it’s no real change on how the patent system works.

via Supreme Court Rules Narrowly In Bilski; Business Method & Software Patents Survive | Techdirt.

LinkedInPinterestEvernoteWordPressBlogger PostEmailShare

Nitro PDF Launches Free PDF Reader and PDF Creator

There are many free tools that let you read documents as PDF, but when it comes to creating your own, it can be tricky to find one that doesn’t leave watermarks, or require laborious registration.

Thanks to Nitro PDF Software, however, users have another choice when it comes to creating PDFs. Called Nitro PDF Reader, it’s the only free PDF viewer to also offer free PDF creation.

Preparing for the Digital Document Revolution

With Nitro PDF Reader, you can create PDF files from over 300 different formats, while also adding comments, annotations and markups for digital collaboration, fill and save PDF forms, stamp signatures, extract text and images, and type text directly onto the PDF file.

Fig. 1. Nitro offers users quick access to all the tools and tasks from the one location, without having to search through countless menus and toolbars.

Likened to Microsoft Office, another giant that aims to be overthrown in the “revolution,” Nitro Reader’s interface offers users intuitive, visual representations of tasks and tools, devoid of onscreen clutter or drop-down menus.

Nitro PDF Reader is 100% compatible with other leading PDF readers and editors, including the Adobe Acrobat family of products, and provides functionality very similar to other paid products.

via Nitro PDF Launches Free PDF Reader and PDF Creator.

Reblog this post [with Zemanta]
LinkedInPinterestEvernoteWordPressBlogger PostEmailShare

Best, Best & Krieger Ditches Paper | Law Technology News

Best, Best & Krieger is a full-service law firm with nearly 200 attorneys in eight offices across California. We focus on complex legal issues facing public agencies, businesses, and individuals and we take very seriously decisions about how to safeguard our information found on paper and in electronic files. Yet we also strive to be as prudent as possible in our IT spend.

Like many law firms, BB&K saw the need to evaluate our continuing reliance on paper. We looked at the risk of potentially losing vital case files through an event like a fire or flood, along with the inefficiencies of handling and physically storing paper, and made the decision to use less paper and find more effective ways to create, use, and archive electronic files.

One of the first steps we took in implementing a policy of paper reduction involved standardizing the electronic format for information storage. We use Microsoft Office Suite to create and exchange files electronically. Unfortunately, these authoring formats lack the security features legal professionals need because a document's original content can be easily changed.

The Portable Document Format is an ideal way to share and store information because it maintains the integrity of a digital document while also providing secure, reliable access both internally and with outside counsel and courts. PDF is an open standard and our firm decided to look at our options in PDF creation and editing software that could meet both our business needs and budget.

We had copies of Adobe Acrobat PDF software on some desktops but determined it was not the best fit for our organization. With a mix of non-graphics professionals — like attorneys and firm management — it became clear that Adobe's one-size-fits-all approach would not meet our requirements. We selected Nuance PDF Converter Professional over the competition because it was competitively priced, reasonably licensed and delivers the core application capabilities found in Acrobat. We deployed 425 copies of PDF Converter Professional throughout the firm, saving approximately $135,000 compared to the costs that a similar sized deployment of Adobe Acrobat would have incurred.

via Law.com – Best, Best & Krieger Ditches Paper.

LinkedInPinterestEvernoteWordPressBlogger PostEmailShare