Consumer software and hardware

Are Adobe products safe?

On January 16, 2009, Adobe learned about a vulnerability in Adobe Reader and Acrobat 9 involving the JBIG2 image compression standard. Even though there were reports that the hole was being exploited, it took Adobe nearly two months to issue a patch.

"Our process was not optimized for rapid turn around. It took us longer than we wanted it to," Brad Arkin, director of product security and privacy at Adobe, said in a recent interview with CNET.

That wasn't the only exploit targeting Adobe's PDF reader programs. About 80 percent of new exploits targeted Adobe's … Read more

iPhoto to Aperture: Carryover features compared

Apple got a lot of things right in iPhoto '09, and in the latest version of its higher-end, $200 Aperture software it's tried to replicate that same success. But did it work?

The short answer is yes. What might be more surprising to an iPhoto user is how similarly easy to use these features are in Aperture, despite being far more powerful.

Some of the carryovers include facial recognition, geotagging, and integration with third-party sites like Flickr, Facebook, and the company's MobileMe subscription service. Out of that bunch, facial recognition and geotagging are likely to be the most familiar. Where things get interesting are the extra features Apple has added to both of these, and a handful of other tools that can be found within iPhoto. Read on to get the details.… Read more

Malware crashed systems during Windows security updates

Windows systems that crashed during the latest Microsoft security update last week did so because they were infected with a rootkit program that made changes to the operating system kernel, Microsoft said late on Wednesday.

"The restarts are the result of modifications the Alureon rootkit makes to Windows Kernel binaries, which places these systems in an unstable state," Mike Reavey, director of the Microsoft Security Response Center, wrote in a blog post. "In every investigated incident, we have not found quality issues with security update MS10-015."

The patch addresses a vulnerability in the 32-bit Windows kernel … Read more

Beware strangers on IM who won't answer your questions

Web robots, commonly referred to as "bots," are software programs written to do automated tasks, like crawling the Web looking for new sites. They also appear in chat rooms and instant messaging services masquerading as real people.

Depending on the level of sophistication of the artificial intelligence, they can attempt to understand questions and respond appropriately. Usually the conversation is pre-set, which makes for some rather silly conversations.

Bots are nothing new, but not everyone has personally interacted with one. I, for one, have never been approached by a bot in a chat room or on IM, so … Read more

Adobe warns of new Reader, Flash holes

Adobe Systems on Thursday warned of new critical holes in Reader and Flash Player, released a security update for the Flash hole, and said a patch for Reader would come next week.

Updates for the following software are coming on Tuesday, according to Adobe's prenotification security advisory:

Reader 9.3 for Windows, Mac, and Unix Acrobat 9.3 for Windows and Mac Reader 8.2 for Windows and Mac Acrobat 8.2 for Windows and Mac

The Tuesday updates will also address the Flash issue, Adobe said.

Meanwhile, the company released a security update to fix a hole in … Read more

Windows security update causes 'blue screen of death' for some

Some Windows users reported on Thursday that they were getting the "blue screen of death" on their computers when they installed Microsoft's latest security updates released two days earlier.

Most of the people complaining on a Windows forum said they had the problem on Windows XP, but one person also reported problems on Windows 7.

Users posted a fix on the site that they said seemed to work, but that didn't necessarily quell the anger.

"Where at Microsoft do I send my invoice for hours spent fixing this BS?" one person wrote on Thursday.… Read more

Bill Gates criticizes the iPad

Sometimes it's hard to let go of the past. And sometimes it's impossible.

While Microsoft toyed with the idea of tablets for a very long time, somehow, it never managed to find the right creative construction to make an impact on our brittle society.

So how, then, did Microsoft co-founder Bill Gates feel when he saw his longtime adversary, Steve Jobs, hype the hope for the iPad? It was as if he was wallowing in a bath of indifference, it seems.

In an interview with BNET blogger Brent Schlender, Gates seemed to believe that his original concept of … Read more

Hacker 'Mudge' gets DARPA job

Peiter Zatko--a respected hacker known as "Mudge"--has been tapped to be a program manager at DARPA, where he will be in charge of funding research designed to help give the U.S. government tools needed to protect against cyberattacks, CNET has learned.

Zatko will become a program manager in mid-March within the Strategic Technologies Office at DARPA (Defense Advanced Research Projects Agency), which is the research and development office for the Department of Defense. His focus will be cybersecurity, he said in an interview with CNET on Tuesday.

One of his main goals will be to fund … Read more

26 Windows, Office holes patched in 13 bulletins

Microsoft fixed 26 vulnerabilities in 13 security bulletins as part of its Patch Tuesday, including critical ones for Windows that could be exploited to take control of a computer and one that has resided in the 32-bit Windows kernel since its release 17 years ago.

The top priorities for deployment are bulletins plugging holes in the SMB (Server Message Block) Protocol, Windows Shell Handler, ActiveX via Internet Explorer, DirectShow, and the 32-bit version of Windows, Jerry Bryant, a lead senior security communications manager at Microsoft, wrote in a blog post.

The DirectShow bulletin should be at the top of the … Read more

Microsoft, Google split over browser bug bounty

To entice security researchers to look for holes in the Chrome browser, Google has announced it will pay $500 for bugs found in the code. But several experts say that's not enough money to motivate skilled vulnerability researchers.

"I think it's ridiculous," Charlie Miller, a senior security researcher at Independent Security Evaluators, said when asked Monday for his opinion of Google's new bug bounty program. "It's insulting. It's so low."

Under Google's new "experimental" incentive program, announced last week, people will get paid $500 for select interesting and … Read more