Huffington Post – huffingtonpost.wordpress.com

Archive for May 23rd, 2008

Microsoft has opened a new front in the battle with Google, the search engine group, in the increasingly ferocious struggle for control of the online services market.

The software giant has said that users of its popular e-mail and instant messaging tools on mobile phones will display advertisements for the first time. Those using Windows Live on phones will also see ads.

Mobile telephony is regarded as an increasingly important component of the digital advertising market as new devices, such as Apple’s iPhone, improve the use of web-based services.

While it represents a small part of spending on digital advertising, it has significant potential because of the ability for advertising to be coupled with location using GPS.

Microsoft bought ScreenTonic, an advertising platform, which was an early leader in delivering advertisements to mobile phones, for an undisclosed sum last year.

Microsoft, whose share of the search market has slipped as Google’s has grown, is trying to recover the initiative in the online advertising market, which is expected to double in size to $80 billion by 2010.

Google has built a $20 billion (£10.2 billion)-a-year business from online advertising, mostly from sponsored links next to search results. It began testing a mobile version of its search-based advertising service in 2006.

Mobile advertising spending in Western Europe is expected to rise from $1 billion in 2007 to $1.5 billion this year, according to eMarketer, the research firm.

Source

It is incredible just how big the effects of the newly discovered error in open source key generation is

For all the criticism of Microsoft and its security flaws, the software giant has made an impressive turnaround. While Vista has been derided for a variety of reasons, most would agree that it’s much more secure than Windows XP. Recently, a hacker conference showed just how vulnerable systems running Mac OS X are, due to their slow rate of patches. The Mac machine was hijacked within 10 minutes, while the Linux and Windows boxes survived the day.

Now an even worse security flaw has been found in some of the basic code used by a wide variety of Linux security programs. The error originated back in May 2006 when workers on the open-source security project committed a grave and unrealized error.

A simple programming error reduced the entropy in the generated program keys created by the OpenSSL library. Why does this matter? The OpenSSL library’s key generation and other routines are used by the SSH remote access program, the IPsec Virtual Private Network (VPN), the Apache Web server, secure email clients, programs that offer secure internet portals and more.

Just two lines of code created crippling security holes in four different open source operating systems, 25 application programs, and millions of internet-attached computer systems. The vulnerability was publicly discovered for the first time May 13, after having left the door open nearly two years. A patch has been distributed, but that can do nothing to repair the damage that has occurred to compromise systems. Worse yet, it appears that through the installation of compromised keys on other systems, numerous systems not even running the code have likely been compromised.

To understand the error fully, a basic discussion on cryptography is essential. On a network anyone can peek at traffic, which is bad news for anyone sharing personal information. However, by using keys, information can be encrypted and then decrypted on the other side by a friendly computer with the proper key. As a “secure key” is typically 128 bits, which is 2128 or about 3.4*1038, the possibility of breaking the key by merely by a brute force attack is out of the realm of modern computing power. A brute force attack simply involves guessing every single number, but to try to do this on a number of this size would take many years.

Clickry Post Source Link