Microsoft Corp. was forced to pick up the patching pace in the second half of 2008, the company admitted last week, as it fixed 67 percent more flaws and released 17% more security updates in the period than it had in the first six months of the year.
Included in the bugs patched during the latter months of the year was the vulnerability exploited by Conficker, a worm that led to the biggest infection outbreak in years and a minor media frenzy last week.
Microsoft patched 97 different vulnerabilities in 42 separate security update in the second half of 2008, compared to 58 vulnerabilities in 36 updates in the first half.
Vinnie Gullotto, the general manager of the Microsoft Malware Protection Center, acknowledged the increase. "The number [of patched vulnerabilities] did go up, but a lot has to do with our methodology."
Microsoft's Security Intelligence Report explained it differently. "Although the total number of security bulletins in [the second half of 2008] was on par with the last several periods, there was a significant increase in the number of CVE identifiers addressed per security bulletin in [the second half of 2008]," the report stated. The average number of Common Vulnerability and Exposure (CVE) identifiers rose from an average of 1.6 per security bulletin in the first half of 2008 to 2.3 in the final six months.
In plain English, that means Microsoft packed more individual patches into the average security update.
During the second half of 2008, Microsoft issued several multi-patch updates, including MS08-052, a five-patch update for the GDI+ component of Windows; MS08-058, a six-patch update for Internet Explorer (IE); MS08-072, an eight-patch fix for Microsoft Word; and MS08-073, a four-patch update for IE.
Gullotto also argued that the number of bugs Microsoft quashed was less important than the number of exploits actually crafted for, and released into the wild against, those vulnerabilities.
"The number of exploits against those [bugs] stayed about the same as in the first half of the year," he said. The report did not include a complete tally of all exploits aimed at Microsoft software during the last six months of the year, though it included some data related to browser and document file format bugs.
Conficker, the most prolific worm in several years got its start last year when it began to exploit unpatched Windows machines just weeks after Microsoft issued one of its two emergency updates for the period. "Fortunately, Conficker was a rarity," said Gullotto, referring to the scarcity of worms that attack the operating system and self-propagate quickly through networks.
The other "out-of-band" update was released in mid-December to plug a critical hole in IE which had already been exploited by criminals.
Even as Gullotto admitted that Microsoft had to patch more bugs as 2008 proceeded, he defended the company's track record. "We're clearly seeing the results of the progress we've made in software development," he said, pointing out that the company's newer software is more secure than older code. According to data gathered from the Malicious Software Removal Tool (MSRT), the anti-malware utility Microsoft updates and redistributes each month to Windows machines, the real-world infection rate of PCs running Windows Vista Service Pack 1 (SP1) is 61% less than that of systems powered by Windows XP SP3.
"Older versions typically do have more vulnerabilities, that's true," he said, "but one of the good things is that we're being transparent about it, we're telling people about the vulnerabilities."
Micrsosoft's new security report, labeled as "Volume 6," is available for download as a PDF file from the company's Web site.
source- Computerworld
Sunday, April 12, 2009
Semiconductor Sales Slip Worldwide
According to a final marketshare analysis by Gartner, worldwide semiconductor revenue totaled US$255 billion in 2008, down 5.4 percent, or a decrease of $14.5 billion from 2007 revenue. The steep decline in the market in the final quarter of 2008, combined with the ongoing economic weakness, signals far worse declines in 2009.
"While sales held up fairly well in the first half of 2008, in the third quarter the industry started to soften as the economy slowed, and by the fourth quarter sales were deteriorating quickly, causing revenue growth to go into negative territory," said Peter Middleton, principal research analyst at Gartner. "With the market heavily impacted by the recession, we can expect considerable market consolidation going forward."
Gartner's annual semiconductor market share analysis examines and ranks the worldwide and regional revenue for more than 275 semiconductor suppliers, in 65 separate product categories, and eight major market categories. It serves as a benchmark for both semiconductor industry performance, as well as a means for individual companies to assess their revenue performance against their competitors.
Intel held the No. 1 position for the 17th consecutive year, in this analysis, increasing its market share to 13.3 percent in 2008, although it saw its revenue decline by 0.5 percent ― a consequence of spinning off its NOR flash memory business (see Table 1). The company outperformed the industry average due to the strong performance of its notebook business in which the company gained share throughout the year.
The best performer among the 2008 top 10 in Gartner's market share analysis was Qualcomm, with growth of 15.3 percent. This growth was driven by a strong first three quarters of the year, but Qualcomm felt the impact of the economic downturn in the fourth quarter of 2008 as carriers and OEMs reduced their inventory of code division multiple access (CDMA)-based devices and chipsets.
Samsung, the No. 2 vendor, saw its revenue decline 15 percent in 2008 with the company's main product lines, DRAM and NAND flash experiencing sharp price declines caused by excess supply in the market during 2008. Toshiba, in the No. 3 position, saw its revenue decrease 10.3 percent, largely because its application-specific integrated circuit (ASICs) and application-specific standard products (ASSPs) for consumer, wireless and automotive electronics showed mild growth in early 2008, but the market went into free-fall in the second-half due to the global economic downturn.
Vendor Relative Industry Performance
Market share tables by themselves give a good indication of which vendors did well or badly during a year, but they do not tell the whole story. More often than not, a strong or weak performance by a vendor is a result of the overall market growth of the device areas that the vendor participates in. Gartner's relative industry performance (RIP) index measures the difference between industry-specific growth for a company and actual growth, showing which are transforming their businesses by growing share or moving into new markets and choosing their customers wisely.
Broadcom led the RIP ranking in 2008. In the consumer ASSP business, it benefited from solid performance in the core set-top box business, augmented by Blu-ray and digital TV products and the sale of digital converter boxes for the DTV conversion in the United States. In wired communications ASSPs, Broadcom padded its considerable lead over No. 2 Infineon Technologies. Ethernet switches and broadband modem chip sales sparked this performance. In wireless ASSPs, the company grew strongly in a declining market, mainly due to sales of connectivity products, including Bluetooth, Wi-Fi and GPS.
Elpida Memory was the No. 2 vendor in Gartner's RIP ranking. Its strong performance in the ranking was because of its ability to add capacity in the DRAM market faster than the market declined, thus showing only a slight revenue decline in a market that saw strong double-digit declines.
source- Channelworld
"While sales held up fairly well in the first half of 2008, in the third quarter the industry started to soften as the economy slowed, and by the fourth quarter sales were deteriorating quickly, causing revenue growth to go into negative territory," said Peter Middleton, principal research analyst at Gartner. "With the market heavily impacted by the recession, we can expect considerable market consolidation going forward."
Gartner's annual semiconductor market share analysis examines and ranks the worldwide and regional revenue for more than 275 semiconductor suppliers, in 65 separate product categories, and eight major market categories. It serves as a benchmark for both semiconductor industry performance, as well as a means for individual companies to assess their revenue performance against their competitors.
Intel held the No. 1 position for the 17th consecutive year, in this analysis, increasing its market share to 13.3 percent in 2008, although it saw its revenue decline by 0.5 percent ― a consequence of spinning off its NOR flash memory business (see Table 1). The company outperformed the industry average due to the strong performance of its notebook business in which the company gained share throughout the year.
The best performer among the 2008 top 10 in Gartner's market share analysis was Qualcomm, with growth of 15.3 percent. This growth was driven by a strong first three quarters of the year, but Qualcomm felt the impact of the economic downturn in the fourth quarter of 2008 as carriers and OEMs reduced their inventory of code division multiple access (CDMA)-based devices and chipsets.
Samsung, the No. 2 vendor, saw its revenue decline 15 percent in 2008 with the company's main product lines, DRAM and NAND flash experiencing sharp price declines caused by excess supply in the market during 2008. Toshiba, in the No. 3 position, saw its revenue decrease 10.3 percent, largely because its application-specific integrated circuit (ASICs) and application-specific standard products (ASSPs) for consumer, wireless and automotive electronics showed mild growth in early 2008, but the market went into free-fall in the second-half due to the global economic downturn.
Vendor Relative Industry Performance
Market share tables by themselves give a good indication of which vendors did well or badly during a year, but they do not tell the whole story. More often than not, a strong or weak performance by a vendor is a result of the overall market growth of the device areas that the vendor participates in. Gartner's relative industry performance (RIP) index measures the difference between industry-specific growth for a company and actual growth, showing which are transforming their businesses by growing share or moving into new markets and choosing their customers wisely.
Broadcom led the RIP ranking in 2008. In the consumer ASSP business, it benefited from solid performance in the core set-top box business, augmented by Blu-ray and digital TV products and the sale of digital converter boxes for the DTV conversion in the United States. In wired communications ASSPs, Broadcom padded its considerable lead over No. 2 Infineon Technologies. Ethernet switches and broadband modem chip sales sparked this performance. In wireless ASSPs, the company grew strongly in a declining market, mainly due to sales of connectivity products, including Bluetooth, Wi-Fi and GPS.
Elpida Memory was the No. 2 vendor in Gartner's RIP ranking. Its strong performance in the ranking was because of its ability to add capacity in the DRAM market faster than the market declined, thus showing only a slight revenue decline in a market that saw strong double-digit declines.
source- Channelworld
Outsourcing Not the Big Savings Firms Expect, Study Says
The recession is pushing businesses to cut the cost of their software portfolios, but most companies overestimate the savings that offshoring can deliver, according to Compass Management Consulting.
Companies rushing to outsource their software development for quick savings actually risk significant losses in productivity because developers do not fully understand business requirements, according to the consultants.
While staff costs may be 40 percent lower in offshore locations, Compass research found these savings were undermined by a 60 percent drop in productivity in operations where the full lifecycle of application development has been outsourced.
"This means that the decision to migrate development, when you include additional management control, increased infrastructure spend, employee attrition, language, and cultural issues, can end up costing up to 20 percent more than current in-house operations," said the consultant group.
Compass analysed over 200 outsourcing contracts, accounting for a total value of more than £3bn over the past two years.
Many organisations are already replacing legacy systems and updating applications to reduce costs, said Nigel Hughes, a consultant at Compass. "Complexity of the application environment is a major driver of overall cost escalation in IT, and 2009 is the best chance since the year 2000 issue to make radical change."
Staff attrition related to moving application development to offshore locations, particularly the loss of functional expertise, will have having a "negative effect" on productivity.
"With lower productivity in many offshore locations and currency movements that are working against UK buyers, it is important to outsource the right type of development project and ensure that business analysis skills are kept in-house in order to make any savings," said Hughes.
"More than 70 percent of a typical software budget is spent on maintaining legacy systems. Top performers are clear that they cannot run a 21st century operation supported by 20th century technology," said Hughes.
But Compass said that rationalising software estates by consolidating applications could reduce spend by 20 to 40 percent within less than a year.
Compass advised companies to keep strategic applications in-house, and look at outsourcing "non-strategic, non-critical and low complexity applications".
"For the strategic, complex and business critical applications, it makes more sense to retain the analysis skills that will drive the innovation and value in-house," said Hughes.
source- computerworld
Companies rushing to outsource their software development for quick savings actually risk significant losses in productivity because developers do not fully understand business requirements, according to the consultants.
While staff costs may be 40 percent lower in offshore locations, Compass research found these savings were undermined by a 60 percent drop in productivity in operations where the full lifecycle of application development has been outsourced.
"This means that the decision to migrate development, when you include additional management control, increased infrastructure spend, employee attrition, language, and cultural issues, can end up costing up to 20 percent more than current in-house operations," said the consultant group.
Compass analysed over 200 outsourcing contracts, accounting for a total value of more than £3bn over the past two years.
Many organisations are already replacing legacy systems and updating applications to reduce costs, said Nigel Hughes, a consultant at Compass. "Complexity of the application environment is a major driver of overall cost escalation in IT, and 2009 is the best chance since the year 2000 issue to make radical change."
Staff attrition related to moving application development to offshore locations, particularly the loss of functional expertise, will have having a "negative effect" on productivity.
"With lower productivity in many offshore locations and currency movements that are working against UK buyers, it is important to outsource the right type of development project and ensure that business analysis skills are kept in-house in order to make any savings," said Hughes.
"More than 70 percent of a typical software budget is spent on maintaining legacy systems. Top performers are clear that they cannot run a 21st century operation supported by 20th century technology," said Hughes.
But Compass said that rationalising software estates by consolidating applications could reduce spend by 20 to 40 percent within less than a year.
Compass advised companies to keep strategic applications in-house, and look at outsourcing "non-strategic, non-critical and low complexity applications".
"For the strategic, complex and business critical applications, it makes more sense to retain the analysis skills that will drive the innovation and value in-house," said Hughes.
source- computerworld
Conficker-Infected Systems Spew Spam
Windows PCs infected with the Conficker worm have turned into junk mail-spewing robots capable of sending billions of spam messages a day, a security company warned.
According to Kaspersky Lab, a Moscow-based antivirus firm, yesterday's update to Conficker, which in some cases was accompanied by the Waledac spam bot, has resulted in a floodtide of junk e-mail.
"In just 12 hours, one bot alone sent out 42,298 spam messages," said Kaspersky researcher Alex Gostev in a message Friday. "A simple calculation shows that one bot sends out around 80,000 emails in 24 hours. Assuming that there are 5 million infected machines out there, the [Conficker] botnet could send out about 400 billion spam messages over a 24-hour period!"
The spam is pitching pharmaceuticals exclusively at the moment, said Gostev, primarily erectile dysfunction medications such as Viagra and Cialis, with message subject headings including "She will dream of you days and nights!" and "Hot life -- our help here. Ensure your potence [sic] today!"
Gostev also noted that almost every message contained a unique domain in the embedded link, a tactic spammers sometimes use to side-step anti-spam filters, which analyze the frequency which any one domain is used. "We detected the use of 40,542 third-level domains and 33 second-level domains," said Gostev. "They all belonged to spammers and the companies that ordered these mailings."
Most of the domains are hosted in China, he added.
Conficker, the worm that first appeared in November 2008, exploded in early 2009 to infect several million machines and set off a near-panic as an April 1 trigger date approached, was fed a new version early Thursday that restored its ability to spread and beefed up its defenses against security tools. If it successfully updated an already-infected PC, Conficker.e -- as the new variant has been labeled -- also downloaded and installed a noted spam bot, Waledac.
Waledac has its own checkered history, in that it's assumed to have been created by some of the same hackers who operated the notorious Storm botnet during 2007 and 2008.
The spam coming from Conficker.e-infected systems is actually generated and sent by the Waledac bot Trojan.
Some Conficker bots have also downloaded and installed Spyware Protect 2009, one of the many "scareware" programs in circulation. Scareware is the term given to fake anti-malware software that generates bogus infection warnings and then nags users with endless alerts until they pay to $50 to buy the useless program. According to Microsoft, the scam -- also called "rogue software" -- is one of the biggest threats to Internet users. In the second half of 2008 alone, Microsoft's antimalware tools cleaned nearly 6 million PCs of scareware-related infections.
Yesterday, another researcher raised the alarm about the new Conficker and the software it drops, saying that the spam and scareware angles were clearly the first solid evidence of how the worm's makers planned to profit from their crime. "I don't want to be a scaremonger," said Kevin Hogan, director of security response operations at Symantec Corp. "But the situation now, as Conficker does go back to propagating, is actually more serious than a couple of weeks ago.
Source -pcworld
According to Kaspersky Lab, a Moscow-based antivirus firm, yesterday's update to Conficker, which in some cases was accompanied by the Waledac spam bot, has resulted in a floodtide of junk e-mail.
"In just 12 hours, one bot alone sent out 42,298 spam messages," said Kaspersky researcher Alex Gostev in a message Friday. "A simple calculation shows that one bot sends out around 80,000 emails in 24 hours. Assuming that there are 5 million infected machines out there, the [Conficker] botnet could send out about 400 billion spam messages over a 24-hour period!"
The spam is pitching pharmaceuticals exclusively at the moment, said Gostev, primarily erectile dysfunction medications such as Viagra and Cialis, with message subject headings including "She will dream of you days and nights!" and "Hot life -- our help here. Ensure your potence [sic] today!"
Gostev also noted that almost every message contained a unique domain in the embedded link, a tactic spammers sometimes use to side-step anti-spam filters, which analyze the frequency which any one domain is used. "We detected the use of 40,542 third-level domains and 33 second-level domains," said Gostev. "They all belonged to spammers and the companies that ordered these mailings."
Most of the domains are hosted in China, he added.
Conficker, the worm that first appeared in November 2008, exploded in early 2009 to infect several million machines and set off a near-panic as an April 1 trigger date approached, was fed a new version early Thursday that restored its ability to spread and beefed up its defenses against security tools. If it successfully updated an already-infected PC, Conficker.e -- as the new variant has been labeled -- also downloaded and installed a noted spam bot, Waledac.
Waledac has its own checkered history, in that it's assumed to have been created by some of the same hackers who operated the notorious Storm botnet during 2007 and 2008.
The spam coming from Conficker.e-infected systems is actually generated and sent by the Waledac bot Trojan.
Some Conficker bots have also downloaded and installed Spyware Protect 2009, one of the many "scareware" programs in circulation. Scareware is the term given to fake anti-malware software that generates bogus infection warnings and then nags users with endless alerts until they pay to $50 to buy the useless program. According to Microsoft, the scam -- also called "rogue software" -- is one of the biggest threats to Internet users. In the second half of 2008 alone, Microsoft's antimalware tools cleaned nearly 6 million PCs of scareware-related infections.
Yesterday, another researcher raised the alarm about the new Conficker and the software it drops, saying that the spam and scareware angles were clearly the first solid evidence of how the worm's makers planned to profit from their crime. "I don't want to be a scaremonger," said Kevin Hogan, director of security response operations at Symantec Corp. "But the situation now, as Conficker does go back to propagating, is actually more serious than a couple of weeks ago.
Source -pcworld
Office 14 Web Apps: Microsoft Takes on Google Docs and Netbooks
CIO — The next version of Microsoft Office, code-named Office 14, will include lightweight but fully-functional versions of Word, Excel, PowerPoint and OneNote that can run in a browser.
Called Office Web Applications, the service will be in beta later this year, according to Microsoft, but the final versions of the Office Web apps won't come until the desktop version of Office 14 is also done. Steve Ballmer announced in February that this won't happen until 2010.
Office Web Applications follow through on Microsoft's promise to deliver "software plus services" and are a belated move to get productivity tools online to curb the threat of free, Web-based apps from Google, Zoho and OpenOffice.org. Microsoft currently has a free service called Office Live Workspace that lets users view and share — but not edit — Office documents. Office Live Workspace never took off in a meaningful way with most enterprise users.
To keep more users from moving to Office alternatives, Microsoft is not tying the forthcoming Office Web Applications to Internet Explorer. The company has confirmed that Office Web Applications will work on the Firefox browser and Apple's Safari browser. It has also insinuated, though not fully confirmed, that Office Web Apps will work on the iPhone.
So via the Firefox browser, Microsoft Office will run on Linux machines, giving Office a route onto Linux-based netbooks and smartphones that it didn't have before. If Linux-based netbooks begin to increase market share, Microsoft will be losing OS dollars, but would at least be able to offer Office apps on Linux machines.
Source-cio
Called Office Web Applications, the service will be in beta later this year, according to Microsoft, but the final versions of the Office Web apps won't come until the desktop version of Office 14 is also done. Steve Ballmer announced in February that this won't happen until 2010.
Office Web Applications follow through on Microsoft's promise to deliver "software plus services" and are a belated move to get productivity tools online to curb the threat of free, Web-based apps from Google, Zoho and OpenOffice.org. Microsoft currently has a free service called Office Live Workspace that lets users view and share — but not edit — Office documents. Office Live Workspace never took off in a meaningful way with most enterprise users.
To keep more users from moving to Office alternatives, Microsoft is not tying the forthcoming Office Web Applications to Internet Explorer. The company has confirmed that Office Web Applications will work on the Firefox browser and Apple's Safari browser. It has also insinuated, though not fully confirmed, that Office Web Apps will work on the iPhone.
So via the Firefox browser, Microsoft Office will run on Linux machines, giving Office a route onto Linux-based netbooks and smartphones that it didn't have before. If Linux-based netbooks begin to increase market share, Microsoft will be losing OS dollars, but would at least be able to offer Office apps on Linux machines.
Source-cio
Subscribe to:
Posts (Atom)
