Facebook is disclosing more details about the planned redesign for its core member profile pages, as it attempts to regain the layout's orderly, streamlined look that had been one of its trademarks and a differentiator from competitors like MySpace.
The latest plans in Facebook's ongoing redesign efforts call for profile pages to evolve from a single repository of content and applications into a tabbed interface.
The goal is to let users organize in these tabbed sub-pages the various components of their profiles, such as the activity feed, photos, personal information and applications.
Facebook members can see the latest screenshots in this album and view this video of a presentation held Wednesday by company officials about the redesign plans.
At the event, Chamath Palihapitiya, Facebook's vice president of product marketing, explained that the interface changes are intended to make profiles cleaner and simpler and give users more control over their look and feel, and emphasize the most recent and relevant information.
"We need to take a step forward with respect to the user experience and the UI that we present to the consumer because the amount of information that's being created both passively and proactively is increasing," he said.
No doubt this is due to Facebook's membership explosive growth and the company's decision a year ago to let external developers create applications for the site. Facebook currently has about 70 million members and about 20,000 applications.
Still Facebook must be careful about how its redesign affects a member's experience, as in the past some of its changes have riled users and industry observers.
The activity feed feature was blasted by users as violating their privacy, as was the Beacon ad program that broadcast online transactions made by Facebook's users to their friends list.
Already, there have been some early grumblings among external developers concerned that the redesigned profile page will steal visibility from their applications.
But Palihapitiya argued that the redesign will do the opposite rather, and generate instead "a more meaningful engagement with users" for applications by offering new integration opportunities in the profiles.
Facebook plans to let developers and members test the redesign before launching it formally next month.
Sunday, May 25, 2008
Chinese police detain woman over quake video
Chinese police in the northern city of Shenyang have detained a woman who posted a video filled with angry comments directed at victims of the devastating earthquake that rattled Sichuan province last week.
The 21-year-old woman, Gao Qianhui, was angry over a three-day mourning period that saw online entertainment and games shut down in China out of respect for those killed by the quake, according to a Xinhua News Agency report carried on Netease, a popular Chinese portal. The report, which was highlighted by Blogging for China, did not make clear what law Gao was alleged to have broken in her online outburst.
In the video, Gao is shown sitting inside what appears to be an Internet cafe. After introducing herself as a "common young girl" from Liaoning province in northeastern China, Gao complains she has no interest in coverage of the quake or its aftermath.
"How many of you died? It was just a few," Gao said. "China has so many people, anyway."
The video and apparent lack of sympathy on Gao's part for those affected by the Sichuan earthquake provoked an outpouring of anger and criticism from Chinese Internet users. The Xinhua story carried on Netease alone had more than 17,000 comments at the time of writing.
"Have you no humanity?" asked one commentator.
The 21-year-old woman, Gao Qianhui, was angry over a three-day mourning period that saw online entertainment and games shut down in China out of respect for those killed by the quake, according to a Xinhua News Agency report carried on Netease, a popular Chinese portal. The report, which was highlighted by Blogging for China, did not make clear what law Gao was alleged to have broken in her online outburst.
In the video, Gao is shown sitting inside what appears to be an Internet cafe. After introducing herself as a "common young girl" from Liaoning province in northeastern China, Gao complains she has no interest in coverage of the quake or its aftermath.
"How many of you died? It was just a few," Gao said. "China has so many people, anyway."
The video and apparent lack of sympathy on Gao's part for those affected by the Sichuan earthquake provoked an outpouring of anger and criticism from Chinese Internet users. The Xinhua story carried on Netease alone had more than 17,000 comments at the time of writing.
"Have you no humanity?" asked one commentator.
Chinese police detain woman over quake video
Chinese police in the northern city of Shenyang have detained a woman who posted a video filled with angry comments directed at victims of the devastating earthquake that rattled Sichuan province last week.
The 21-year-old woman, Gao Qianhui, was angry over a three-day mourning period that saw online entertainment and games shut down in China out of respect for those killed by the quake, according to a Xinhua News Agency report carried on Netease, a popular Chinese portal. The report, which was highlighted by Blogging for China, did not make clear what law Gao was alleged to have broken in her online outburst.
In the video, Gao is shown sitting inside what appears to be an Internet cafe. After introducing herself as a "common young girl" from Liaoning province in northeastern China, Gao complains she has no interest in coverage of the quake or its aftermath.
"How many of you died? It was just a few," Gao said. "China has so many people, anyway."
The video and apparent lack of sympathy on Gao's part for those affected by the Sichuan earthquake provoked an outpouring of anger and criticism from Chinese Internet users. The Xinhua story carried on Netease alone had more than 17,000 comments at the time of writing.
"Have you no humanity?" asked one commentator.
The 21-year-old woman, Gao Qianhui, was angry over a three-day mourning period that saw online entertainment and games shut down in China out of respect for those killed by the quake, according to a Xinhua News Agency report carried on Netease, a popular Chinese portal. The report, which was highlighted by Blogging for China, did not make clear what law Gao was alleged to have broken in her online outburst.
In the video, Gao is shown sitting inside what appears to be an Internet cafe. After introducing herself as a "common young girl" from Liaoning province in northeastern China, Gao complains she has no interest in coverage of the quake or its aftermath.
"How many of you died? It was just a few," Gao said. "China has so many people, anyway."
The video and apparent lack of sympathy on Gao's part for those affected by the Sichuan earthquake provoked an outpouring of anger and criticism from Chinese Internet users. The Xinhua story carried on Netease alone had more than 17,000 comments at the time of writing.
"Have you no humanity?" asked one commentator.
Ahead of rootkit talk, Cisco patches router flaw
Cisco has issued three security patches, fixing bugs that could crash its products and drawing a warning from the SANS Internet Storm Center.
The updates, issued Wednesday, fix denial of service bugs in the SSH (Secure Shell) software in Cisco's Internetwork Operating System (IOS), used to power its routers, and in the Cisco Service Control Engine, which is provides carrier-grade networking services.
Cisco has also patched a privilege escalation vulnerability in its Voice Portal automated telephone customer service software.
In its security advisories Cisco said that all of the bugs had been discovered by its own researchers, but SANS warned that researchers are likely reverse-engineering the patches and may release exploit code publicly.
These particular updates are getting extra attention from the security community, which is now closely investigating how malicious software might work on IOS, an operating system that has largely evaded serious scrutiny. On Thursday, for example, Core Security's Sebastian Muniz is slated to give a widely anticipated presentation on a Cisco rootkit he calls the DIK (Da Ios rootKit) at the EuSecWest conference in London.
Cisco recently changed its software update policy, saying it will now only issue IOS patches in March and September each year, unless forced to rush out a fix for serious bugs that were publicly disclosed or which were being actively exploited. On Wednesday, a Cisco spokesman couldn't immediately say whether his company considered the IOS patch, which fixes a flaw in the SSH server, an out-of-cycle update.
But Core Security Chief Technology Officer Ivan Arce said that Cisco's SSH bug-fix was not connected to his company's rootkit presentation. "It is more likely that this is related to an ongoing distributed SSH brute forcing attack that a few people reported in the incidents mailing list last week," he said in an e-mail interview.
The SSH server is used by administers to remotely log into a router using encryption. Bugs in the software could let an attacker repeatedly reload the device or access "spurious" parts of the router's memory and could be used to disable the hardware in a Denial of Service (DoS) attack, Cisco said in its advisory.
"While the 'Exploitation and Public Announcements' portion of all three advisories states that the vulns were discovered in-house, it's a pretty safe bet that a fair number of security researchers are feverishly reverse engineering the updates to develop exploits," wrote SANS Internet Storm Center contributor George Bakos in a blog posting.
"Anytime we see a 'spurious memory access' leading to a denial of service, thoughts immediately go to arbitrary code execution. There is no evidence that this is possible, but in light of the recent work in IOS rootkits, vulns in Cisco devices should not be taken lightly," he wrote.
The updates, issued Wednesday, fix denial of service bugs in the SSH (Secure Shell) software in Cisco's Internetwork Operating System (IOS), used to power its routers, and in the Cisco Service Control Engine, which is provides carrier-grade networking services.
Cisco has also patched a privilege escalation vulnerability in its Voice Portal automated telephone customer service software.
In its security advisories Cisco said that all of the bugs had been discovered by its own researchers, but SANS warned that researchers are likely reverse-engineering the patches and may release exploit code publicly.
These particular updates are getting extra attention from the security community, which is now closely investigating how malicious software might work on IOS, an operating system that has largely evaded serious scrutiny. On Thursday, for example, Core Security's Sebastian Muniz is slated to give a widely anticipated presentation on a Cisco rootkit he calls the DIK (Da Ios rootKit) at the EuSecWest conference in London.
Cisco recently changed its software update policy, saying it will now only issue IOS patches in March and September each year, unless forced to rush out a fix for serious bugs that were publicly disclosed or which were being actively exploited. On Wednesday, a Cisco spokesman couldn't immediately say whether his company considered the IOS patch, which fixes a flaw in the SSH server, an out-of-cycle update.
But Core Security Chief Technology Officer Ivan Arce said that Cisco's SSH bug-fix was not connected to his company's rootkit presentation. "It is more likely that this is related to an ongoing distributed SSH brute forcing attack that a few people reported in the incidents mailing list last week," he said in an e-mail interview.
The SSH server is used by administers to remotely log into a router using encryption. Bugs in the software could let an attacker repeatedly reload the device or access "spurious" parts of the router's memory and could be used to disable the hardware in a Denial of Service (DoS) attack, Cisco said in its advisory.
"While the 'Exploitation and Public Announcements' portion of all three advisories states that the vulns were discovered in-house, it's a pretty safe bet that a fair number of security researchers are feverishly reverse engineering the updates to develop exploits," wrote SANS Internet Storm Center contributor George Bakos in a blog posting.
"Anytime we see a 'spurious memory access' leading to a denial of service, thoughts immediately go to arbitrary code execution. There is no evidence that this is possible, but in light of the recent work in IOS rootkits, vulns in Cisco devices should not be taken lightly," he wrote.
Ahead of rootkit talk, Cisco patches router flaw
Cisco has issued three security patches, fixing bugs that could crash its products and drawing a warning from the SANS Internet Storm Center.
The updates, issued Wednesday, fix denial of service bugs in the SSH (Secure Shell) software in Cisco's Internetwork Operating System (IOS), used to power its routers, and in the Cisco Service Control Engine, which is provides carrier-grade networking services.
Cisco has also patched a privilege escalation vulnerability in its Voice Portal automated telephone customer service software.
In its security advisories Cisco said that all of the bugs had been discovered by its own researchers, but SANS warned that researchers are likely reverse-engineering the patches and may release exploit code publicly.
These particular updates are getting extra attention from the security community, which is now closely investigating how malicious software might work on IOS, an operating system that has largely evaded serious scrutiny. On Thursday, for example, Core Security's Sebastian Muniz is slated to give a widely anticipated presentation on a Cisco rootkit he calls the DIK (Da Ios rootKit) at the EuSecWest conference in London.
Cisco recently changed its software update policy, saying it will now only issue IOS patches in March and September each year, unless forced to rush out a fix for serious bugs that were publicly disclosed or which were being actively exploited. On Wednesday, a Cisco spokesman couldn't immediately say whether his company considered the IOS patch, which fixes a flaw in the SSH server, an out-of-cycle update.
But Core Security Chief Technology Officer Ivan Arce said that Cisco's SSH bug-fix was not connected to his company's rootkit presentation. "It is more likely that this is related to an ongoing distributed SSH brute forcing attack that a few people reported in the incidents mailing list last week," he said in an e-mail interview.
The SSH server is used by administers to remotely log into a router using encryption. Bugs in the software could let an attacker repeatedly reload the device or access "spurious" parts of the router's memory and could be used to disable the hardware in a Denial of Service (DoS) attack, Cisco said in its advisory.
"While the 'Exploitation and Public Announcements' portion of all three advisories states that the vulns were discovered in-house, it's a pretty safe bet that a fair number of security researchers are feverishly reverse engineering the updates to develop exploits," wrote SANS Internet Storm Center contributor George Bakos in a blog posting.
"Anytime we see a 'spurious memory access' leading to a denial of service, thoughts immediately go to arbitrary code execution. There is no evidence that this is possible, but in light of the recent work in IOS rootkits, vulns in Cisco devices should not be taken lightly," he wrote.
The updates, issued Wednesday, fix denial of service bugs in the SSH (Secure Shell) software in Cisco's Internetwork Operating System (IOS), used to power its routers, and in the Cisco Service Control Engine, which is provides carrier-grade networking services.
Cisco has also patched a privilege escalation vulnerability in its Voice Portal automated telephone customer service software.
In its security advisories Cisco said that all of the bugs had been discovered by its own researchers, but SANS warned that researchers are likely reverse-engineering the patches and may release exploit code publicly.
These particular updates are getting extra attention from the security community, which is now closely investigating how malicious software might work on IOS, an operating system that has largely evaded serious scrutiny. On Thursday, for example, Core Security's Sebastian Muniz is slated to give a widely anticipated presentation on a Cisco rootkit he calls the DIK (Da Ios rootKit) at the EuSecWest conference in London.
Cisco recently changed its software update policy, saying it will now only issue IOS patches in March and September each year, unless forced to rush out a fix for serious bugs that were publicly disclosed or which were being actively exploited. On Wednesday, a Cisco spokesman couldn't immediately say whether his company considered the IOS patch, which fixes a flaw in the SSH server, an out-of-cycle update.
But Core Security Chief Technology Officer Ivan Arce said that Cisco's SSH bug-fix was not connected to his company's rootkit presentation. "It is more likely that this is related to an ongoing distributed SSH brute forcing attack that a few people reported in the incidents mailing list last week," he said in an e-mail interview.
The SSH server is used by administers to remotely log into a router using encryption. Bugs in the software could let an attacker repeatedly reload the device or access "spurious" parts of the router's memory and could be used to disable the hardware in a Denial of Service (DoS) attack, Cisco said in its advisory.
"While the 'Exploitation and Public Announcements' portion of all three advisories states that the vulns were discovered in-house, it's a pretty safe bet that a fair number of security researchers are feverishly reverse engineering the updates to develop exploits," wrote SANS Internet Storm Center contributor George Bakos in a blog posting.
"Anytime we see a 'spurious memory access' leading to a denial of service, thoughts immediately go to arbitrary code execution. There is no evidence that this is possible, but in light of the recent work in IOS rootkits, vulns in Cisco devices should not be taken lightly," he wrote.
Singaporean blogger arrested, charged with racism
A 24-year-old Chinese man was arrested in Singapore on May 20 and charged with posting racist comments on his blog, according to the Singapore Police Force.
The man, who was not named, was arrested after police received two complaints about allegedly racist comments posted on his blog, SPF said in a brief statement. The blog was not identified.
"Police take a serious view of such irresponsible blog postings in a multi-racial society like Singapore and will expend all efforts in tracking the perpetrators," the statement said.
Under Singaporean law, comments made with the "deliberate intention of wounding the religious or racial feelings of any person" can result in a jail term of up to three years and a fine.
Singapore is predominantly Chinese, but also has large Malay and Indian communities. For historical reasons, the government is generally quick to clamp down on public comments that might create tension between the country's different ethnic groups.
In 1964, tensions between the Chinese and Malay communities in Singapore twice erupted into riots that killed 36 and left hundreds wounded. Riots again broke out between the two communities in 1969, sparked by violence between Malays and Chinese in Malaysia.
In the case of the blogger arrested Tuesday, his comments were directed at a fellow passenger on Singapore's train system, local media reported.
"There he sat, unaffected by his surroundings, smelling like he didn't showered (sic) in years and wore some really scary dirty clothes," the blogger allegedly wrote, according to The New Paper. The blogger allegedly proceeded to make "offensive" comments about the man's race, the report said, without providing details.
Details of the man described in the blog, including his race, were not disclosed.
The man arrested for making the comments apologized, the New Paper said, saying he was "shocked by the furore over his blog entry, which he said was only intended for his close friends."
The man plans to make an online apology, the report said.
The man, who was not named, was arrested after police received two complaints about allegedly racist comments posted on his blog, SPF said in a brief statement. The blog was not identified.
"Police take a serious view of such irresponsible blog postings in a multi-racial society like Singapore and will expend all efforts in tracking the perpetrators," the statement said.
Under Singaporean law, comments made with the "deliberate intention of wounding the religious or racial feelings of any person" can result in a jail term of up to three years and a fine.
Singapore is predominantly Chinese, but also has large Malay and Indian communities. For historical reasons, the government is generally quick to clamp down on public comments that might create tension between the country's different ethnic groups.
In 1964, tensions between the Chinese and Malay communities in Singapore twice erupted into riots that killed 36 and left hundreds wounded. Riots again broke out between the two communities in 1969, sparked by violence between Malays and Chinese in Malaysia.
In the case of the blogger arrested Tuesday, his comments were directed at a fellow passenger on Singapore's train system, local media reported.
"There he sat, unaffected by his surroundings, smelling like he didn't showered (sic) in years and wore some really scary dirty clothes," the blogger allegedly wrote, according to The New Paper. The blogger allegedly proceeded to make "offensive" comments about the man's race, the report said, without providing details.
Details of the man described in the blog, including his race, were not disclosed.
The man arrested for making the comments apologized, the New Paper said, saying he was "shocked by the furore over his blog entry, which he said was only intended for his close friends."
The man plans to make an online apology, the report said.
Monday, May 19, 2008
Vista laid low by new malware figures
It looks as if Vista's reputation for improved security could be heading for the pages of history. PC Tools has renewed last week's attack on the platform with new figures that appear to back up its claim that Vista is almost as vulnerable as its predecessors.
According to analysis from the Australian company's ThreatFire user base, 58,000 PCs running Vista were compromised by at least one piece of malware over the six months to May 2008, equivalent to 27 percent of all Vista machines probed. Vista made up 12.6 percent, or 190,692, of the 1,513,502 machines running Windows in the user base.
In total, Vista suffered 121,380 instances of malware from its 190,000 user base, a rate of malware detection per system is proportionally lower than that of XP, which saw 1,319,144 malware infections from a user base of 1,297,828 machines, but it indicates a problem that is worse than Microsoft has been admitting to.
Only a week ago, PC Tools revealed that Vista was as likely to be hit with software vulnerabilities as Windows 2000, a claim that was denied by a Microsoft staffer in a blog.
The problem with the figures given in all cases is that it is still hard to make direct - and therefore meaningful - comparisons. As PC Tools makes clear, that malware was detected did not mean harm had been done, simply that Vista's own security had in some way been circumvented to the degree that its ThreatFire tool stepped in.
"It is important to highlight that all systems used in the research pool were at the very least running PC Tool's ThreatFire and that because the technology is behavioral-based, the data refers to threats that actually executed and triggered our behavioral detection on the client machine", said PC Tools' CEO, Simon Clausen, before aiming a kick at Microsoft's own security software.
"Furthermore, in response to alternative research from Microsoft's Malicious Software Removal Tool, PC Tools highlights that the MSRT is not a comprehensive anti-virus scanner, but a malware removal tool for a limited range of "specific, prevalent malicious software."
An obvious objection to this is that any operating system will suffer a degree of malware compromise, which could be traced back to a variety of issues including user behavior. The acid test for Vista will be its ability to resist serious attacks over the longer term, something it has so far managed to do. However, the figures do suggest that malware writers are mastering the OS, a possible sign of trouble to come
PC Tools has publicized details of some of the malware types it has found on Vista systems during its scans, including three pages of variants based on Trojan.Agent, a few of which were described as serious.
At time of writing, Microsoft had not responded to PC Tools' allegations.
According to analysis from the Australian company's ThreatFire user base, 58,000 PCs running Vista were compromised by at least one piece of malware over the six months to May 2008, equivalent to 27 percent of all Vista machines probed. Vista made up 12.6 percent, or 190,692, of the 1,513,502 machines running Windows in the user base.
In total, Vista suffered 121,380 instances of malware from its 190,000 user base, a rate of malware detection per system is proportionally lower than that of XP, which saw 1,319,144 malware infections from a user base of 1,297,828 machines, but it indicates a problem that is worse than Microsoft has been admitting to.
Only a week ago, PC Tools revealed that Vista was as likely to be hit with software vulnerabilities as Windows 2000, a claim that was denied by a Microsoft staffer in a blog.
The problem with the figures given in all cases is that it is still hard to make direct - and therefore meaningful - comparisons. As PC Tools makes clear, that malware was detected did not mean harm had been done, simply that Vista's own security had in some way been circumvented to the degree that its ThreatFire tool stepped in.
"It is important to highlight that all systems used in the research pool were at the very least running PC Tool's ThreatFire and that because the technology is behavioral-based, the data refers to threats that actually executed and triggered our behavioral detection on the client machine", said PC Tools' CEO, Simon Clausen, before aiming a kick at Microsoft's own security software.
"Furthermore, in response to alternative research from Microsoft's Malicious Software Removal Tool, PC Tools highlights that the MSRT is not a comprehensive anti-virus scanner, but a malware removal tool for a limited range of "specific, prevalent malicious software."
An obvious objection to this is that any operating system will suffer a degree of malware compromise, which could be traced back to a variety of issues including user behavior. The acid test for Vista will be its ability to resist serious attacks over the longer term, something it has so far managed to do. However, the figures do suggest that malware writers are mastering the OS, a possible sign of trouble to come
PC Tools has publicized details of some of the malware types it has found on Vista systems during its scans, including three pages of variants based on Trojan.Agent, a few of which were described as serious.
At time of writing, Microsoft had not responded to PC Tools' allegations.
SEC goes after eight former AOL executives in fraud case
The U.S. Securities and Exchange Commission on Monday filed a lawsuit against four former AOL Time Warner executives, charging them with falsely boosting the company's advertising revenue by US$1 billion. In addition, four other former AOL executives settled with the SEC on related fraud charges, agreeing to pay hundreds of thousands of dollars each in penalties.
The SEC filed the charge on Monday in the U.S. District Court for the Southern District of New York against John Michael Kelly, former chief financial officer of AOL Time Warner; Steven E. Rindner, former senior executive in the company's Business Affairs unit; Joseph A. Ripp, former chief financial officer of the company's AOL division; and Mark Wovsaniker, former head of accounting policy. The executives, according to the SEC, essentially funded AOL's own advertising revenue by giving companies money to buy online advertising.
AOL conducted the "round-trip" funding in several ways, the SEC says. For example, in some cases it would pay inflated prices for goods or services in exchange for the vendor purchasing advertising in the amount that AOL overpaid. AOL also paid more for businesses it purchased so that the seller would then buy advertising, the SEC alleges.
The scheme boosted the company's advertising revenue by more than $1 billion, the SEC says. The SEC is asking that the executives return ill-gotten gains, pay civil penalties and be barred from serving as company officers or directors. The SEC is also charging Kelly and Wovsaniker with misleading the company's external auditor about the transactions.
The AOL executives engineered the fraudulent practices in order to boost the company's advertising performance in a struggling market, the SEC said. "In mid-2000 ... AOL faced a growing crisis with regard to its advertising revenue as the market for online advertising began shrinking," the suit reads. "Kelly insisted that AOL achieve the revenue targets that he and others in AOL's executive offices had set in 2000."
In addition to that complaint, the SEC has settled a suit against former AOL Time Warner executives for their involvement in the same scheme. The executives who settled include David M. Colburn, former head of the Business Affairs unit; Eric L. Keller, former senior manager in the Business Affairs unit; James F. MacGuidwin, former controller; and Jay B. Rappaport, former senior manager in the Business Affairs unit. Colburn agreed to pay disgorgement and prejudgment interest of about $3.2 million and a penalty of $750,000; MacGuidwin will pay disgorgement and prejudgment interest of $2.1 million and a penalty of $300,000; Rappaport agreed to pay disgorgement and prejudgment interest of $493,629 and a penalty of $250,000; and Keller will pay disgorgement and prejudgment interest of $699,868 and a penalty of $250,000.
In addition, Colburn and MacGuidwin agreed not to serve as officers or directors of a public company for 10 years and seven years, respectively.
The fraudulent filings occurred between 2000 and at least 2003, and the company has since restated its earnings for those periods, the SEC said.
AOL has been struggling as it shifts its business from one that was primarily built on monthly dial-up subscription charges to one based on advertising-supported online content.
AOL did not reply immediately to a request for comment on the suits.
The SEC filed the charge on Monday in the U.S. District Court for the Southern District of New York against John Michael Kelly, former chief financial officer of AOL Time Warner; Steven E. Rindner, former senior executive in the company's Business Affairs unit; Joseph A. Ripp, former chief financial officer of the company's AOL division; and Mark Wovsaniker, former head of accounting policy. The executives, according to the SEC, essentially funded AOL's own advertising revenue by giving companies money to buy online advertising.
AOL conducted the "round-trip" funding in several ways, the SEC says. For example, in some cases it would pay inflated prices for goods or services in exchange for the vendor purchasing advertising in the amount that AOL overpaid. AOL also paid more for businesses it purchased so that the seller would then buy advertising, the SEC alleges.
The scheme boosted the company's advertising revenue by more than $1 billion, the SEC says. The SEC is asking that the executives return ill-gotten gains, pay civil penalties and be barred from serving as company officers or directors. The SEC is also charging Kelly and Wovsaniker with misleading the company's external auditor about the transactions.
The AOL executives engineered the fraudulent practices in order to boost the company's advertising performance in a struggling market, the SEC said. "In mid-2000 ... AOL faced a growing crisis with regard to its advertising revenue as the market for online advertising began shrinking," the suit reads. "Kelly insisted that AOL achieve the revenue targets that he and others in AOL's executive offices had set in 2000."
In addition to that complaint, the SEC has settled a suit against former AOL Time Warner executives for their involvement in the same scheme. The executives who settled include David M. Colburn, former head of the Business Affairs unit; Eric L. Keller, former senior manager in the Business Affairs unit; James F. MacGuidwin, former controller; and Jay B. Rappaport, former senior manager in the Business Affairs unit. Colburn agreed to pay disgorgement and prejudgment interest of about $3.2 million and a penalty of $750,000; MacGuidwin will pay disgorgement and prejudgment interest of $2.1 million and a penalty of $300,000; Rappaport agreed to pay disgorgement and prejudgment interest of $493,629 and a penalty of $250,000; and Keller will pay disgorgement and prejudgment interest of $699,868 and a penalty of $250,000.
In addition, Colburn and MacGuidwin agreed not to serve as officers or directors of a public company for 10 years and seven years, respectively.
The fraudulent filings occurred between 2000 and at least 2003, and the company has since restated its earnings for those periods, the SEC said.
AOL has been struggling as it shifts its business from one that was primarily built on monthly dial-up subscription charges to one based on advertising-supported online content.
AOL did not reply immediately to a request for comment on the suits.
McAfee anti-fraud researcher charged with fraud
One of the researchers behind ScanAlert, the "Hacker Safe" certification company McAfee recently acquired, is facing fraud charges in Indiana.
Brett Oliphant, whose title had been vice president of security services before the Napa, California, company was acquired by McAfee in January, is facing 11 counts of securities fraud in transactions that allegedly brought in more than US$1.215 million.
Oliphant and his brother Bryan were charged in December. Their trial is set for Nov. 18 at the Elkhart County Superior Court in Indiana.
ScanAlert built technology for auditing and then certifying Web sites as "Hacker Safe." McAfee paid $54.9 million for the company in January and has since renamed the certification service "McAfee Safe."
The Hacker Safe and McAfee Safe marks are designed to reassure potential customers that the Web site they are visiting has been tested for vulnerabilities and is unlikely to have been hacked by online fraudsters.
Oliphant's arrest was not widely known until blogger Ronald van den Heetkamp posted news of it on Monday. Van den Heetkamp has been critical of McAfee's certification service in the past.
The ScanAlert vice president had led the development of his company's vulnerability scanning technology and managed the company's research division.
A McAfee spokesman declined to comment on the matter or confirm whether Oliphant was still with the company. "McAfee does not comment on the private affairs of others, legal or otherwise," he said in an instant message.
Brett Oliphant, whose title had been vice president of security services before the Napa, California, company was acquired by McAfee in January, is facing 11 counts of securities fraud in transactions that allegedly brought in more than US$1.215 million.
Oliphant and his brother Bryan were charged in December. Their trial is set for Nov. 18 at the Elkhart County Superior Court in Indiana.
ScanAlert built technology for auditing and then certifying Web sites as "Hacker Safe." McAfee paid $54.9 million for the company in January and has since renamed the certification service "McAfee Safe."
The Hacker Safe and McAfee Safe marks are designed to reassure potential customers that the Web site they are visiting has been tested for vulnerabilities and is unlikely to have been hacked by online fraudsters.
Oliphant's arrest was not widely known until blogger Ronald van den Heetkamp posted news of it on Monday. Van den Heetkamp has been critical of McAfee's certification service in the past.
The ScanAlert vice president had led the development of his company's vulnerability scanning technology and managed the company's research division.
A McAfee spokesman declined to comment on the matter or confirm whether Oliphant was still with the company. "McAfee does not comment on the private affairs of others, legal or otherwise," he said in an instant message.
Users report more trouble with Windows XP SP3
The latest service pack for Windows XP continues to cause problems for users. According to an online user forum, the latest glitch in Windows XP Service Pack 3 (SP3) causes problems with the remote desktop access feature of Windows Home Server.
On the We Got Served U.K.-based Windows user forum, Windows XP users running Windows Home Server, Microsoft's home storage and local networking server, report that SP3 is cutting off their access to the server from their PCs. The remote desktop access feature would ask users to add their home server's Web site address in order to access it even after they already had, users reported.
According to a user on Microsoft's Windows Home Server forum, the problem arose because Windows XP SP3 by default disables Terminal Services Active X control as part of its security model. The user, ColinWH, posted a fix for the problem that outlines how to enable the Terminal Services ActiveX control in Internet Explorer.
The Windows Home Server problem is not the first that users -- or Microsoft -- have had with the latest XP service pack. Scheduled for release on April 29, Windows XP SP3 was held up for a week by Microsoft because of incompatibilities between the service pack and one of Microsoft's own applications, retail chain management software called Microsoft Dynamics RMS. The problem even affected the Windows Vista Service Pack 1 set of updates.
Then, after the service pack's release on May 6, users reported that XP SP3 put some AMD-based PCs into endless reboots. Eventually, the problem was identified as affecting certain Hewlett-Packard PCs, and Microsoft posted information for fixing it on the Web.
Microsoft could not be immediately reached for comment on Monday.
On the We Got Served U.K.-based Windows user forum, Windows XP users running Windows Home Server, Microsoft's home storage and local networking server, report that SP3 is cutting off their access to the server from their PCs. The remote desktop access feature would ask users to add their home server's Web site address in order to access it even after they already had, users reported.
According to a user on Microsoft's Windows Home Server forum, the problem arose because Windows XP SP3 by default disables Terminal Services Active X control as part of its security model. The user, ColinWH, posted a fix for the problem that outlines how to enable the Terminal Services ActiveX control in Internet Explorer.
The Windows Home Server problem is not the first that users -- or Microsoft -- have had with the latest XP service pack. Scheduled for release on April 29, Windows XP SP3 was held up for a week by Microsoft because of incompatibilities between the service pack and one of Microsoft's own applications, retail chain management software called Microsoft Dynamics RMS. The problem even affected the Windows Vista Service Pack 1 set of updates.
Then, after the service pack's release on May 6, users reported that XP SP3 put some AMD-based PCs into endless reboots. Eventually, the problem was identified as affecting certain Hewlett-Packard PCs, and Microsoft posted information for fixing it on the Web.
Microsoft could not be immediately reached for comment on Monday.
Network management SaaS provider pushing into U.S.
Paul Beliveau, the network solutions architect for Cambridge, Mass.-based Biogen, recalls coming into work one day in 2006 only to discover that one of the biotechnology company's networks was being clogged by World Cup soccer.
Specifically, he found that capacity at one of his Madrid circuits was being completely used up by employees streaming live video of the tournament while at work. When he called the Madrid branch to tell them of the problem, however, the branch office manager shrugged it off.
"He was willing to live with poor application performance for the time being," says Beliveau, who monitors network health for Biogen offices in 22 countries. "I think he was afraid that shutting off the World Cup would cause a revolt."
But despite the fact that this particular branch manager didn't want his help, Beliveau says he is able to quickly identify and isolate similar network problems at offices around the world by using software produced by NetEvidence, a software-as-a-serivce (SaaS) provider based in the United Kingdom. This particular SaaS, known as Highlight, gives its users a browser-based user interface designed to help companies monitor and manage network performance around the globe.
"What we're trying to do is make the visibility of what's going on in the network accessible to a wider range of people," says Andi Willmott, the business development director for NetEvidence. "In the same way that Apple is trying to make phone functionalities easier with the iPhone, we're trying to take a similar approach to network management software with Highlight."
One of Highlight's key features is its color-coded tile interface that delivers network performance measurements for stability, load and health. Thus, when Beliveau starts up his computer every morning, he sees a series of tiles on his screen that display network health for every Biogen office in the world. If an office's tile is "green," then it's generally healthy. Yellow or red indicate that the network is or may become overloaded.
From there, Beliveau says he can dig deeper into the trouble areas and figure out the root cause right down to the application level. For instance, he can figure out how much in-the-cloud network traffic is produced by Lotus Notes, and how much is produced by peer-to-peer applications such as eDonkey. What makes the software so special, Beliveau says, is its ease of use and the accuracy of the measurements it uses to grade network performance.
"The logic that goes behind the changing color tiles is exceptional," he says. "The NetEvidence engineers know what makes networks perform so well. They measure the thresholds for network performance in a way that I could never figure out on my unless I put lot of time and effort into it."
As a SaaS, Highlight is continuously collecting data on traffic patterns and their effects on network stability, load and health. The software takes that data and stacks it up against NetEvidence's own measurements and thresholds for network health. The data is then sent back to the user with updates every three minutes.
Willmott says that many companies in Europe and in Asia have been using the Highlight software for years, but that the company is only now aggressively marketing it within the United States. He says that the company has had to account for certain cultural changes between the United States and Europe when developing its marketing strategy, which is why the company has decided to partner with various cable, wireless and telecom carriers to create its route to the U.S. market.
"The European market has historically been very slanted toward fully managed services," Willmott says. "Whereas out here, they balance has shifted the other way. People want more ownership and control over their network."
Highlight generally costs about US$50 a month per router, although networks with highly customized architecture might require more expensive services. NetEvidence says that Highlight is also a completely customizable commercial model where users can purchase the software for a smaller number of routers to start, and can then add it to more routers as they see fit. The SaaS requires no installation by the user and no hardware on the premises, and can be fully managed by the company.
Specifically, he found that capacity at one of his Madrid circuits was being completely used up by employees streaming live video of the tournament while at work. When he called the Madrid branch to tell them of the problem, however, the branch office manager shrugged it off.
"He was willing to live with poor application performance for the time being," says Beliveau, who monitors network health for Biogen offices in 22 countries. "I think he was afraid that shutting off the World Cup would cause a revolt."
But despite the fact that this particular branch manager didn't want his help, Beliveau says he is able to quickly identify and isolate similar network problems at offices around the world by using software produced by NetEvidence, a software-as-a-serivce (SaaS) provider based in the United Kingdom. This particular SaaS, known as Highlight, gives its users a browser-based user interface designed to help companies monitor and manage network performance around the globe.
"What we're trying to do is make the visibility of what's going on in the network accessible to a wider range of people," says Andi Willmott, the business development director for NetEvidence. "In the same way that Apple is trying to make phone functionalities easier with the iPhone, we're trying to take a similar approach to network management software with Highlight."
One of Highlight's key features is its color-coded tile interface that delivers network performance measurements for stability, load and health. Thus, when Beliveau starts up his computer every morning, he sees a series of tiles on his screen that display network health for every Biogen office in the world. If an office's tile is "green," then it's generally healthy. Yellow or red indicate that the network is or may become overloaded.
From there, Beliveau says he can dig deeper into the trouble areas and figure out the root cause right down to the application level. For instance, he can figure out how much in-the-cloud network traffic is produced by Lotus Notes, and how much is produced by peer-to-peer applications such as eDonkey. What makes the software so special, Beliveau says, is its ease of use and the accuracy of the measurements it uses to grade network performance.
"The logic that goes behind the changing color tiles is exceptional," he says. "The NetEvidence engineers know what makes networks perform so well. They measure the thresholds for network performance in a way that I could never figure out on my unless I put lot of time and effort into it."
As a SaaS, Highlight is continuously collecting data on traffic patterns and their effects on network stability, load and health. The software takes that data and stacks it up against NetEvidence's own measurements and thresholds for network health. The data is then sent back to the user with updates every three minutes.
Willmott says that many companies in Europe and in Asia have been using the Highlight software for years, but that the company is only now aggressively marketing it within the United States. He says that the company has had to account for certain cultural changes between the United States and Europe when developing its marketing strategy, which is why the company has decided to partner with various cable, wireless and telecom carriers to create its route to the U.S. market.
"The European market has historically been very slanted toward fully managed services," Willmott says. "Whereas out here, they balance has shifted the other way. People want more ownership and control over their network."
Highlight generally costs about US$50 a month per router, although networks with highly customized architecture might require more expensive services. NetEvidence says that Highlight is also a completely customizable commercial model where users can purchase the software for a smaller number of routers to start, and can then add it to more routers as they see fit. The SaaS requires no installation by the user and no hardware on the premises, and can be fully managed by the company.
Workday revs on-demand ERP
On-demand ERP (enterprise resource planning) vendor Workday announced an update to its software Monday as it rides a wave of publicity from a recent high-profile customer win.
Payroll is a major new component of Workday 4.0. To date the company, which was formed by PeopleSoft founder Dave Duffield, has focused on human capital management (HCM) -- otherwise known as human resources -- as well as financials and procurement. A company spokesman described the payroll capability as key to landing bigger customers.
"I think as we get into these larger enterprise deals, those are the places where payroll is tightly coupled with HCM ... We'll continue to link to [payroll providers such as] ADP or Ceridian, but this does open up new opportunities in larger enterprises," said Andrew McCarthy, communications director.
McKee Foods is serving as a pilot customer for the payroll function, which will be generally available later this year. Initially, Workday will support processes for U.S. payroll, with Canada and Europe to follow. The company claims its underlying payroll framework and calculation engine mean it won't have to rewrite the entire stack from scratch for new regions.
Workday made the right move by developing the capability, according to one observer. "Definitely, payroll is a must," said China Martens, an analyst with the 451 Group.
"Clearly, they've learned from the past on the internationalization front," she added. "Where PeopleSoft, like its peers, to be fair, ran into some trouble was in not doing enough on the internationalization of its software when going global."
Workday is also integrating its software with third-party products. A link to Salesforce CRM will enable users to automatically activate and deactivate users from the Salesforce system as they are hired and leave the company.
While customers would require a separate license for those third-party applications, Workday will support the integration, spokesmen said.
The software updates arrive as Workday is enjoying a wave of buzz. News broke last week that it had scored a major deal with manufacturer Flextronics, which has 200,000 employees, and that Salesforce is now using its HCM module.
Observers say the Flextronics win -- beyond a major boon for Workday -- serves as a general validation that the software as a service (SaaS) model can work in the largest enterprises.
"Workday is on the forefront," said Ray Wang, an analyst with Forrester Research. "Their win against Oracle and SAP proves that SaaS can scale in the big leagues."
.
But as Workday begins servicing such sizable accounts, there are lingering questions about the cost efficiency of the on-demand model. ERP juggernaut SAP has drawn back its rollout plans for Business ByDesign, its hosted ERP offering for the midmarket, saying it needs to fine-tune it to ensure a satisfactory profit.
Workday's product has a smaller footprint, which will help it avoid such growing pains, spokespeople asserted.
Payroll is a major new component of Workday 4.0. To date the company, which was formed by PeopleSoft founder Dave Duffield, has focused on human capital management (HCM) -- otherwise known as human resources -- as well as financials and procurement. A company spokesman described the payroll capability as key to landing bigger customers.
"I think as we get into these larger enterprise deals, those are the places where payroll is tightly coupled with HCM ... We'll continue to link to [payroll providers such as] ADP or Ceridian, but this does open up new opportunities in larger enterprises," said Andrew McCarthy, communications director.
McKee Foods is serving as a pilot customer for the payroll function, which will be generally available later this year. Initially, Workday will support processes for U.S. payroll, with Canada and Europe to follow. The company claims its underlying payroll framework and calculation engine mean it won't have to rewrite the entire stack from scratch for new regions.
Workday made the right move by developing the capability, according to one observer. "Definitely, payroll is a must," said China Martens, an analyst with the 451 Group.
"Clearly, they've learned from the past on the internationalization front," she added. "Where PeopleSoft, like its peers, to be fair, ran into some trouble was in not doing enough on the internationalization of its software when going global."
Workday is also integrating its software with third-party products. A link to Salesforce CRM will enable users to automatically activate and deactivate users from the Salesforce system as they are hired and leave the company.
While customers would require a separate license for those third-party applications, Workday will support the integration, spokesmen said.
The software updates arrive as Workday is enjoying a wave of buzz. News broke last week that it had scored a major deal with manufacturer Flextronics, which has 200,000 employees, and that Salesforce is now using its HCM module.
Observers say the Flextronics win -- beyond a major boon for Workday -- serves as a general validation that the software as a service (SaaS) model can work in the largest enterprises.
"Workday is on the forefront," said Ray Wang, an analyst with Forrester Research. "Their win against Oracle and SAP proves that SaaS can scale in the big leagues."
.
But as Workday begins servicing such sizable accounts, there are lingering questions about the cost efficiency of the on-demand model. ERP juggernaut SAP has drawn back its rollout plans for Business ByDesign, its hosted ERP offering for the midmarket, saying it needs to fine-tune it to ensure a satisfactory profit.
Workday's product has a smaller footprint, which will help it avoid such growing pains, spokespeople asserted.
Analysts: Microsoft likely eyeing Yahoo search assets
Although Microsoft provided no details Sunday about what deal it might cut with Yahoo, it seems highly likely that search advertising would be a major piece.
Search advertising continues to be the largest segment of online advertising and is the fuel that has propelled Google's revenue and profits to levels that have made Microsoft green with envy. "There's got to be some search component to the deal," said industry analyst Greg Sterling of Sterling Market Intelligence.
What shape the tie-up might take is anyone's guess. It could be some sort of joint venture in which the companies pool assets and create a larger ad network, Sterling said. Or it could be an agreement for Yahoo to outsource part of its search advertising business to Microsoft, along the lines of what Yahoo has reportedly been negotiating for weeks with Google, he said.
What's clear is that since Microsoft withdrew its offer to buy Yahoo for $33 per share on May 3, Yahoo's management and board have been bombarded with complaints from shareholders.
Last week, billionaire investor Carl Icahn turned up the heat even more when he put forth a slate of 10 candidates and announced his intention to launch a proxy fight to oust Yahoo's board at the company's shareholders meeting in July, and strike an acquisition deal with Microsoft.
"Yahoo is under pressure to show shareholders some deal, probably with Google but maybe not just with Google, to give them some assurance of value on the immediate term," he said.
Of course, it's not great news for Yahoo shareholders that Microsoft is now only interested in doing a limited, narrow deal with Yahoo, said Brian Bolan, research director at Jackson Securities.
To Bolan, it seems evident that Microsoft has rethought its plan to buy all of Yahoo. "The clear indication of this is that Microsoft has looked through this soup-to-nuts and it has realized there's only a couple of parts of Yahoo that they really want. They don't want to duplicate services and features much in the way Yahoo has done over the years within its own properties," Bolan said.
One thing Microsoft does want and need is better search technology and better search monetization, so it's likely that Microsoft is eyeing Yahoo's assets in this specific area. But whatever form the deal takes, it will not be worth anywhere near what Microsoft had been ready to pay to acquire Yahoo, he said.
Consequently, Bolan expects Yahoo's stock to take a significant hit on Monday, as disappointed investors react to Microsoft's statement that it's not currently interested in a full-blown acquisition. "That's going to take a lot of the M&A [merger and acquisition] premium out of the stock," Bolan said.
"The stock has been running up on the idea of a bunch of people buying shares to try to force this [Microsoft acquisition] deal, to try to make this happen," he added.
A limited deal with Microsoft means that Icahn will likely push ahead with his proxy fight, so that with control of the board, he can carve out an acquisition deal, which at that point will likely be for somewhere at or a bit above the mid-$20 per share range, Bolan said.
And if no acquisition deal materializes for Yahoo, its stock will likely fall apart, said Bolan, who currently has a "sell" recommendation and a $17 price target on the stock.
Microsoft announced its $44.6 billion cash-and-stock bid for Yahoo on Feb. 1, but abandoned its three-month courtship on May 3, saying that Yahoo had rejected a revised offer for $33 per share, an increase of about $5 billion. Yahoo formally rejected Microsoft's original offer on Feb. 11, saying it undervalued the company.
Yahoo's stock closed at $19.18 per share on the day before the initial Microsoft offer, which boosted it to almost $30. However, on Monday, May 5, the first day of trading after Microsoft's offer withdrawal, Yahoo's stock closed down 15 percent at $24.37, after dropping as low as $22.97 during the day.
Not surprisingly, various large Yahoo shareholders have expressed their displeasure with Yahoo's board and management for, in their view, not negotiating in good faith with Microsoft and causing the talks to collapse.
Yahoo co-founder and CEO Jerry Yang and other top Yahoo executives have since then tried to shift the blame to Microsoft, alleging that the $33-per-share offer was never put in writing and that Microsoft unexpectedly walked away at a time when Yahoo was still open to negotiating.
At the same time, Yang has failed to seal a deal in which Yahoo would outsource part of its search advertising business to Google, a move that could give Yahoo a significant revenue boost. Those negotiations with Google were cited by Microsoft CEO Steve Ballmer as a major reason to withdraw the offer because, in Ballmer's view, outsourcing search ads to Google would weaken Yahoo's competitive position in online advertising.
After Microsoft withdrew its offer, its top officials have repeatedly said that the company is no longer interested in acquiring Yahoo, arguing that Microsoft can strengthen its Internet business via internal efforts. On Sunday, Microsoft reiterated that it "is not proposing to make a new bid to acquire all of Yahoo at this time." However, Microsoft did add that it "reserves the right to reconsider that alternative."
Search advertising continues to be the largest segment of online advertising and is the fuel that has propelled Google's revenue and profits to levels that have made Microsoft green with envy. "There's got to be some search component to the deal," said industry analyst Greg Sterling of Sterling Market Intelligence.
What shape the tie-up might take is anyone's guess. It could be some sort of joint venture in which the companies pool assets and create a larger ad network, Sterling said. Or it could be an agreement for Yahoo to outsource part of its search advertising business to Microsoft, along the lines of what Yahoo has reportedly been negotiating for weeks with Google, he said.
What's clear is that since Microsoft withdrew its offer to buy Yahoo for $33 per share on May 3, Yahoo's management and board have been bombarded with complaints from shareholders.
Last week, billionaire investor Carl Icahn turned up the heat even more when he put forth a slate of 10 candidates and announced his intention to launch a proxy fight to oust Yahoo's board at the company's shareholders meeting in July, and strike an acquisition deal with Microsoft.
"Yahoo is under pressure to show shareholders some deal, probably with Google but maybe not just with Google, to give them some assurance of value on the immediate term," he said.
Of course, it's not great news for Yahoo shareholders that Microsoft is now only interested in doing a limited, narrow deal with Yahoo, said Brian Bolan, research director at Jackson Securities.
To Bolan, it seems evident that Microsoft has rethought its plan to buy all of Yahoo. "The clear indication of this is that Microsoft has looked through this soup-to-nuts and it has realized there's only a couple of parts of Yahoo that they really want. They don't want to duplicate services and features much in the way Yahoo has done over the years within its own properties," Bolan said.
One thing Microsoft does want and need is better search technology and better search monetization, so it's likely that Microsoft is eyeing Yahoo's assets in this specific area. But whatever form the deal takes, it will not be worth anywhere near what Microsoft had been ready to pay to acquire Yahoo, he said.
Consequently, Bolan expects Yahoo's stock to take a significant hit on Monday, as disappointed investors react to Microsoft's statement that it's not currently interested in a full-blown acquisition. "That's going to take a lot of the M&A [merger and acquisition] premium out of the stock," Bolan said.
"The stock has been running up on the idea of a bunch of people buying shares to try to force this [Microsoft acquisition] deal, to try to make this happen," he added.
A limited deal with Microsoft means that Icahn will likely push ahead with his proxy fight, so that with control of the board, he can carve out an acquisition deal, which at that point will likely be for somewhere at or a bit above the mid-$20 per share range, Bolan said.
And if no acquisition deal materializes for Yahoo, its stock will likely fall apart, said Bolan, who currently has a "sell" recommendation and a $17 price target on the stock.
Microsoft announced its $44.6 billion cash-and-stock bid for Yahoo on Feb. 1, but abandoned its three-month courtship on May 3, saying that Yahoo had rejected a revised offer for $33 per share, an increase of about $5 billion. Yahoo formally rejected Microsoft's original offer on Feb. 11, saying it undervalued the company.
Yahoo's stock closed at $19.18 per share on the day before the initial Microsoft offer, which boosted it to almost $30. However, on Monday, May 5, the first day of trading after Microsoft's offer withdrawal, Yahoo's stock closed down 15 percent at $24.37, after dropping as low as $22.97 during the day.
Not surprisingly, various large Yahoo shareholders have expressed their displeasure with Yahoo's board and management for, in their view, not negotiating in good faith with Microsoft and causing the talks to collapse.
Yahoo co-founder and CEO Jerry Yang and other top Yahoo executives have since then tried to shift the blame to Microsoft, alleging that the $33-per-share offer was never put in writing and that Microsoft unexpectedly walked away at a time when Yahoo was still open to negotiating.
At the same time, Yang has failed to seal a deal in which Yahoo would outsource part of its search advertising business to Google, a move that could give Yahoo a significant revenue boost. Those negotiations with Google were cited by Microsoft CEO Steve Ballmer as a major reason to withdraw the offer because, in Ballmer's view, outsourcing search ads to Google would weaken Yahoo's competitive position in online advertising.
After Microsoft withdrew its offer, its top officials have repeatedly said that the company is no longer interested in acquiring Yahoo, arguing that Microsoft can strengthen its Internet business via internal efforts. On Sunday, Microsoft reiterated that it "is not proposing to make a new bid to acquire all of Yahoo at this time." However, Microsoft did add that it "reserves the right to reconsider that alternative."
First Firefox 3.0 release candidate launches
Mozilla has launched Firefox 3.0 release candidate 1 (RC1), which it claims includes 14,000 updates.
Mozilla claims that Firefox 3.0 will see improved performance, stability and code simplification.
In Firefox 3.0 Mozilla has aimed to improve password management, and has added a new download manager and resumable downloading. Key security features in Firefox 3.0 include enhanced malware and web forgery protection, as well as greater antivirus integration and Vista parental control accessibility.
Mozilla also claims that Firefox 3.0 integrates better with the Windows, Mac and Linux platforms.
Mozilla claims that Firefox 3.0 will see improved performance, stability and code simplification.
In Firefox 3.0 Mozilla has aimed to improve password management, and has added a new download manager and resumable downloading. Key security features in Firefox 3.0 include enhanced malware and web forgery protection, as well as greater antivirus integration and Vista parental control accessibility.
Mozilla also claims that Firefox 3.0 integrates better with the Windows, Mac and Linux platforms.
Mass SQL injection attack targets Chinese Web sites
Web sites across China and Taiwan are being hit by a mass SQL injection attack that has implanted malware in thousands of Web sites, according to a security company in Taiwan.
First detected on May 13, the attack is coming from a server farm inside China, which has made no effort to hide its IP (Internet Protocol) addresses, said Wayne Huang, chief executive officer of Armorize Technologies, in Taipei.
"The attack is ongoing, ... even if they can't successfully insert malware, they're killing lots of Web sites right now, because they're just brute-forcing every attack surface with SQL injection, and hence causing lots of permanent changes to the victim websites," Huang said.
In a SQL injection attack, an attacker attempts to exploit vulnerabilities in custom Web applications by entering SQL code in an entry field, such as a login. If successful, such an attack can give the attacker access to data on the database used by the application and the ability to run malicious code on the Web site.
A screenshot of a Web site belonging to the Mackay Memorial Hospital in Hsinchu, Taiwan, showed the rendering of the site had been affected and displayed the SQL string injected by the attack, Huang said.
Thousands of Web sites have been hit by the attack, he said, noting that 10,000 servers alone were infected by malware last Friday. Most of the affected servers are located in China, while some are located in Taiwan, Huang said. The attackers appear to be using automated queries to Google's search engine to identify Web sites vulnerable to the attack, he said.
Among the sites hit by the attack on Friday were Soufun, a real estate Web site, and Mycar168, a site for automobile enthusiasts.
The attackers aren't targeting a specific vulnerability. Instead they are using an automated SQL injection attack engine that is tailored to attack Web sites using SQL Server, Huang said. The attack uses SQL injection to infect targeted Web sites with malware, which in turn exploits vulnerabilities in the browsers of those who visit the Web sites, he said, calling the attack "very well designed."
The malware injected by the attack comes from 1,000 different servers and targets 10 vulnerabilities in Internet Explorer and related plugins that are popular in Asia, Huang said.
The vulnerabilities are MS06-014 (CVE-2006-0003), MS07-017 (CVE-2007-1765), RealPlayer IERPCtl.IERPCtl.1 (CVE-2007-5601),GLCHAT.GLChatCtrl.1 (CVE-2007-5722), MPS.StormPlayer.1 (CVE-2007-4816), QvodInsert.QvodCtrl.1, DPClient.Vod (CVE-2007-6144), BaiduBar.Tool.1 (CVE-2007-4105), VML Exploit (CVE-2006-4868) and PPStream (CVE-2007-4748).
Mass SQL injection attacks have increasingly become a security threat. In January, tens of thousands of PCs were infected by an automated SQL injection attack. That attack exploited a vulnerability in Microsoft's SQL Server.
First detected on May 13, the attack is coming from a server farm inside China, which has made no effort to hide its IP (Internet Protocol) addresses, said Wayne Huang, chief executive officer of Armorize Technologies, in Taipei.
"The attack is ongoing, ... even if they can't successfully insert malware, they're killing lots of Web sites right now, because they're just brute-forcing every attack surface with SQL injection, and hence causing lots of permanent changes to the victim websites," Huang said.
In a SQL injection attack, an attacker attempts to exploit vulnerabilities in custom Web applications by entering SQL code in an entry field, such as a login. If successful, such an attack can give the attacker access to data on the database used by the application and the ability to run malicious code on the Web site.
A screenshot of a Web site belonging to the Mackay Memorial Hospital in Hsinchu, Taiwan, showed the rendering of the site had been affected and displayed the SQL string injected by the attack, Huang said.
Thousands of Web sites have been hit by the attack, he said, noting that 10,000 servers alone were infected by malware last Friday. Most of the affected servers are located in China, while some are located in Taiwan, Huang said. The attackers appear to be using automated queries to Google's search engine to identify Web sites vulnerable to the attack, he said.
Among the sites hit by the attack on Friday were Soufun, a real estate Web site, and Mycar168, a site for automobile enthusiasts.
The attackers aren't targeting a specific vulnerability. Instead they are using an automated SQL injection attack engine that is tailored to attack Web sites using SQL Server, Huang said. The attack uses SQL injection to infect targeted Web sites with malware, which in turn exploits vulnerabilities in the browsers of those who visit the Web sites, he said, calling the attack "very well designed."
The malware injected by the attack comes from 1,000 different servers and targets 10 vulnerabilities in Internet Explorer and related plugins that are popular in Asia, Huang said.
The vulnerabilities are MS06-014 (CVE-2006-0003), MS07-017 (CVE-2007-1765), RealPlayer IERPCtl.IERPCtl.1 (CVE-2007-5601),GLCHAT.GLChatCtrl.1 (CVE-2007-5722), MPS.StormPlayer.1 (CVE-2007-4816), QvodInsert.QvodCtrl.1, DPClient.Vod (CVE-2007-6144), BaiduBar.Tool.1 (CVE-2007-4105), VML Exploit (CVE-2006-4868) and PPStream (CVE-2007-4748).
Mass SQL injection attacks have increasingly become a security threat. In January, tens of thousands of PCs were infected by an automated SQL injection attack. That attack exploited a vulnerability in Microsoft's SQL Server.
Subscribe to:
Posts (Atom)