French researchers demo attack on Chrome

French security firm Vupen said today its team has figured out a way to bypass security measures in Chrome and offers a video demo it says is a successful attack against the browser running on a Windows machine.

"We are (un)happy to announce that we have officially Pwnd Google Chrome and its sandbox," the Vupen Security blog said. "The exploit shown in this video is one of the most sophisticated codes we have seen and created so far as it bypasses all security features including ASLR [Address Space Layout Randomization]/DEP [Data Execution Prevention]/Sandbox, it is silent [no crash after executing the payload], it relies on undisclosed (0day) vulnerabilities discovered by VUPEN and it works on all Windows systems (32-bit and x64)."

In the video, someone using Chrome v11.0.696.65 on Windows 7 Service Pack 1 (x64) is tricked into visiting a malicious Web page hosting the exploit. Once the machine is compromised, the exploit code downloads a Calculator program from a remote location and launches it outside the sandbox at "medium" integrity level, according to Vupen.

"While Chrome has one of the most secure sandboxes and has always survived the Pwn2Own contest during the last three years, we have now uncovered a reliable way to execute arbitrary code on any installation of Chrome despite its sandbox, ASLR and DEP," the post said.

Vupen, which did not respond to an e-mail seeking comment today, said it would not publicly disclose the exploit code or technical details of the vulnerabilities but will share them with its government customers as part of its vulnerability research services.

Asked for comment, a Google spokesman said: "We're unable to verify VUPEN's claims at this time as we have not received any details from them. Should any modifications become necessary, users will be automatically updated to the latest version of Chrome."

Chrome's sandbox technology is designed to isolate code from other parts of the computer so that if malicious code does get in, its damage is limited. Adobe has added sandbox technology to Reader.

Read More

Facebook plugs third-party access to user accounts

Tokens are like "spare keys" that Facebook users grant to applications that allow them to perform actions on their behalf or access their profile

Facebook has plugged a hole that was inadvertently providing advertisers and other third parties access to user accounts via tokens that serve as "spare keys," Symantec said today after disclosing the problem to the social-networking company.

"Facebook was notified of this issue and has confirmed this leakage," Nishant Doshi, a senior software engineer at Symantec, wrote in a blog post. "Facebook notified us of changes on their end to prevent these tokens from getting leaked."

"We estimate that as of April 2011 close to 100,000 applications were enabling this leakage," Doshi wrote. "We estimate that over the years, hundreds of thousands of applications may have inadvertently leaked millions of access tokens to third parties."

A Facebook spokesperson told CNET that the company could not find any evidence that private user information was being shared with unauthorized third parties and that contractual obligations prohibit advertisers and developers from obtaining or sharing user information in a way that violates the site's policies.

"We have no evidence of this information being used in a way that violated our policies, but nonetheless, we take any potential issue seriously and quickly took steps to prevent this from happening with apps on Facebook," a company statement said.

User access tokens, which are akin to "spare keys," allow applications to perform certain actions on behalf of the user or to access the user's profile, according to Doshi. Most tokens expire after a short time, but the application can request offline access tokens, which allow them access until the user changes the password, even when the user is not logged in, according to his post.

The leak was happening when an application used a legacy Facebook application programming interface with older authentication schemes, instead of the new OAuth 2.0 data sharing protocol, Doshi said. (Google began supporting OAuth in mid-2008.) If certain parameters were used in the coding, the tokens would be sent in a URL to the application host, and from there could be leaked to advertisers and analytic platforms via iFrame applications embedded in the page, he said.

Its unclear how many people are affected by this problem.

"There is no good way to estimate how many access tokens have already been leaked since the release Facebook applications back in 2007," Doshi wrote. "We fear a lot of these tokens might still be available in log files of third-party servers or still being actively used by advertisers."

Facebook users can change their passwords to invalidate any leaked access tokens, effectively changing the lock on your profile, he said.

The Symantec research prompted Facebook to make some changes in its developer road map, including requiring all sites and apps to migrate to OAuth 2.0 and obtain an SSL (secure sockets layer) certificate by October 1.

"We have been working with Symantec to identify issues in our authenticationflow to ensure that they are more secure," the company said in a post on its developer blog. "This has led us to conclude that migrating to OAuth & HTTPS (Hypertext Transfer Protocol Secure) now is in the best interest of our users and developers."

Joey Tyson, a security engineer at Gemini Security Solutions who blogs about social networking at TheHarmonyGuy.com, said Facebook has been progressively improving the security of its platform and that many apps have limited permissions now. "This is a problem worth addressing, but it may not be as serious as some people are thinking it is, and it's certainly not as widely exploited as some people may fear," he sai

Read More

Google testing new search results pages?

When it comes to change, sometimes it's hard to believe in. And sometimes it's just hard to believe your eyes.

Some people have begun to notice that their Google search pages look different from those they had come to know, love, and take for granted.

Suddenly, the pages seem cleaner. Suddenly, there's more white space. And suddenly the colors are greener and the underlinings beneath each search result have disappeared.

Naturally, this has led to troubling words from troubled minds.

Some have called the potential new look "ugly." Yes, ugly.

When it comes to design, though, sometimes things just get old. Partly because you've looked at them too often and partly because the world has moved and new designs offer new ways of looking at things.

To my own eyes, the intention behind the new design is to make the pages more elegant and perhaps, therefore, to make you feel as if the results are actually more considered and accurate, rather than the morass that seems to rain down currently.

Moreover, perhaps the new design emphasizes white space because Google wants to experiment more with the placement of more challenging types of advertising--you know, the sort you might enjoy rather than merely endure.

There appear to be several versions popping up in different corners of the Web, so perhaps some of you might let me know what you have been seeing and how you have been seeing it.

Taste is always a subjective thing. But wouldn't you like just a little more elegance and breathing room on your Google search pages?

Read More

USB puppet by Availabot

Here's a USB device from Availabot that jumps up when your buddy comes online on IM, and goes down when he/she goes offline! 

Read More

µTorrent 3.0 Beta Released

Finally, the long-awaited beta build of µTorrent 3.0 is released. The client comes packed with lots of new features and updates, among which there are ratings, speed streaming, and even portability options, which means that the client would create the best user experience ever.

BitTorrent Inc. recently announced the release of the 3.0 beta version of the client, and its new updates will please a lot of users who were waiting long for secure remote access, ratings, sharing content by drops, quicker streaming, simplified interface and even a portable mode working off a removable drive (USB).

One of the new features – torrent ratings – will allow you to rate and comment on downloads right from the client, which enhances community sense within µTorrent. Another one, called “drop files to send” will let µTorrent users to share files with the others with the drag&drop of the mouse, even if the recipients are not BitTorrent users. It works by creating a link with a personalized message through which the other party can download the files even if they don’t have µTorrent installed.

More features of the beta build of µTorrent 3 include the streaming enhancements. Now the client will enable users to watch the pieces of downloaded video files much faster due to some progressive sequential download methods. Many would love this feature as it could help the users decide if they want to finish downloading films like the highly discussed “Hobo with a Shotgun” at all.

Besides, µTorrent now acquires a new portable mode which will enable people run the client directly from a removable drive like USB. In other words, since now you are able to carry the client on you so that you could use it to download files wherever you like.

Finally, the client has the new simplified interface. BitTorrent Inc. team announced that they have been developing the new version of µTorrent focusing on convenience and better streamlined user experience. Indeed, that’s exactly what they managed to deliver. Now the user can at any moment minimize parts of the client interface for a simplified view. This is supposed to not just help the newcomers to focus their attention on the most important features of µTorrent, but also let the others to cut out distractions and focus solely on searching for, getting and playing files.

µTorrent 3.0 beta is already available online.

http://www.utorrent.com/downloads

Read More

ONBUX-The Best PTC site in the World

ONBUX,one of the owsum PTC site that i have came across.It pays in real with 2$ minimum cashout.Till now onbux has paid me 2$ nd referral packs are also very cheap.A lot of cheap upgrading packages.Do chk guys!!!

Register on ONBUX through this link

http://www.onbux.com/?rh=ca89e790e56f5c7bfb725b47c69bb2a7

Read More

Football (Soccer) Customization Set

Whether you follow the game at an international level, play in a local league of your own, or just play for fun, football (soccer) is an awesome game to be involved in. Now you can bring the passion and excitement of the game straight to your desktop with our Football (Soccer) Customization set.

Icon Packs

Download Link:http://rapidshare.com/files/450075038/soccer_icons_by_TwistXp.zip

Extract the zip folder and then use the icons.

Applying Icons

If you’d rather change all the different icons in one place, you can use the freeware IconTweaker application that gives you access to change pretty much any icon in Windows XP.

Click on the round “icons” icon on the left-hand panel, and then you can customize any of the built-in icons… just click the Change button.

And then click the Open button and pick the icon file you want to use.

There’s a lot more to this application, for instance you can use it to create a theme that you could re-apply later… or you could download icon themes and apply them.

SCREENSHOTS

                                                       

Read More

WizMouse Enables Mouse Over Scrolling on Any Window

WizMouse is a free and lightweight Windows application that enables a simple but effective trick: the ability to scroll the contents of a window that is under your mouse cursor without shifting the focus to that window.

It may not seem like much, at first glance, but the ability to scroll a window without having to click on it and shift the focus of your current window is a huge time saver. Once WizMouse is installed simply mousing over any open window and engage your scroll wheel for instant scroll with no additional click or shift in focus necessary. You’ll get so used to it you’ll forget that it wasn’t built into Windows from the start.

Hit up the link below to grab a copy of WizMouse, a free and Windows only application.

WizMouse [Antibody Software]

Read More