Social Items

Microsoft last week Friday in a promo tagged "Microsoft Office Pre-launch Offer" commenced a free Office 2013 upgrade offer for customers who purchase the retail copy of Office 2010 for Windows. The promo is expected to run from October 19 to April 30, 2013.

Albeit, Microsoft has not set a launch date for the new OS, market watchers are of the candid view that it will ship in late January or earlier February 2013. MS Office 2013 suite preview, presented exceptionally novel features inline with the Windows 8 technologies; whereas most remarkable in the list are as follows:

SkyDrive Support: Office 2013 is fully integrated to the cloud with Microsoft Cloud service SkyDrive, and SharePoint is supported as well. And this is particularly beneficial for those who require access to their files on the go.

Sync Options: Now, Office documents saved on the Cloud can be easily synced across devices (PCs or Tablets) via Web Apps.

Touchscreen Mode: Office 2013 is built on the Windows 8 architecture, so supports touchscreen capability, especially the Read More mode in Word. It lets users scroll through documents by swiping horizontally with the fingers. While on PC with a touchscreen monitor, you can alternate between the more traditional navigation mode.

Login Account: Office 2013 application through the file tab includes Account (Outlook or Office Account), whereby users can log-in to their SkyDrive account and be able to switch between accounts.

Edit PDF: Before now, you can only save Word document in PDF, you cannot edit PDFs in Word, except when converted to Doc or DocX format. The new Office 2013 now makes it possible to open PDF files and edit it right within Microsoft Word, with file still retaining the PDF structure including the elements.

MS Office 2013 desktop software will come bundled on its own or as part of Office 365 subscription, now open to consumers as well as small businesses. So, given the above highlighted new features, will you be more likely to upgrade?

MS Office 2013: What's New?

Mobile malware threats are on the rise, especially on Android devices, the FBI last weekend issued fresh warning on latest malicious malware targeting the open-source operating system. The intelligence report compiled by Internet Crime Complaint Center (IC3) identified two variants of malware targeting Android devices, Loozfon and FinFisher.

Loozfon is invariably an information vault malware that tends to steal information by tricking users to click on seemingly innocuous links in emails on make-money-at-home programs and other related offers. While FinFisher acts as a Spyware capable of infiltrating the components of a mobile device, which can turn a mobile handset into surveillance device.

Albeit, Android malware challenge, has been on Google's drawing board and the company is not relenting in its effort to curtail the increasing threats targeting the system. AndroidPolice had on Monday reported a new resource file for the Google Play, the files are loaded into memory before any application begins to run on the system.

The resource file for Android will help analyze all the apps to determine malicious malware through the use of app signature. It will automatically red-flag any app it deems malicious or a threat to your mobile device.

Google may also be considering of incorporating anti-malware features direct into the operating system, and perhaps, given the current enormous appeal of the mobile platform, the company will have a lot to prove security-wise if ever it intends to win Enterprise patronage.

Android Malware: FBI Issues New Warning

The HTML5 "Fullscreen API" allow web developers to display web contents in full-screen mode, that is, filling-up the display screen completely. Albeit, some browsers have this capability inbuilt, the Fullscreen API differs from those in that it allow developers to access the functionality through underlined programming.

Fullscreen API is perhaps known for its spoofing potential, leading to major browser vendors canvassing for the implementation of an overlay to notify users when full-screen is activated.

SCAM websites have found ways to spoof web surfers by recreating the user agents when Fullscreen is initiated. Feross Aboukhadijeh, a San Francisco based web developer, had demonstrated the common technique in his official website.

Feross demonstrated how the Fullscreen API can aid phishing attack portals appear rather innocuous to the end users, by utilizing the API to hide the interface elements of the users' browser, thereby preventing the user from knowing the URL of the actual website visited.

The API's specified "Security and Privacy Considerations" have advisory on how browser vendors can effectively curtail the spoofing mechanism. Google Chrome, from v22 upwards have provided some level of notification as to the full-screen mode of websites visited. While, Mozilla Firefox version 10 and later, is more explicit in its notification and flagging alert.

Whereas, Apple Safari is seriously lagging behind, Internet Explorer is yet to support HTML5 Fullscreen API.

Fullscreen API: Aid To Phishing Attack?

Google has added virtual input tools to enhance typing words across languages on its web-mail service, Gmail. According to a post on its official blog, finding the right words across languages posses some difficulties, as well as ways to type the actual words, mainly due to limitation of supported letter-inputs on hardware keyboards.

The Gmail input tools comprises of 100 virtual keyboards and its transliteration, making it easy for users to type in the languages they are accustomed. Keeping in touch with family is now even more formal with the Gmail messaging enhancements.

These tools follows IMEs input method to enable familiar virtual keyboard layout, with a one-click switch between languages.

To tryout the language input tools, go to: Settings, under Language and check the box next to Enable input tools. Thereafter, the input tools icon will become visible next to Settings button in your toolbar, and you have the option to turn it off and on again.

Virtual Keyboards: Enhanced Language Transliteration

Before now, Gmail could only allow search within attachments on text or HTML documents, while other document formats like: Word, Excel and PowerPoint were not supported. The latest enhancement to the service now makes it possible to search attachments in emails in popular programs such as, PDF and Microsoft Office.

The inside attachment search procedure is thus: For instance, you need to locate a statement within your document, lets say "Search Innovations", simply input "has:attachment Search Innovations". And for format specified search, input: "has:attachment format: search term".

The feature, however may not be a novelty as other email systems already incorporate the attachment search capability. Albeit, Google for reasons best known to it had delayed the implementation on its webmail service.

The roll-out of the feature has commenced, but certainly has not been extended to all Gmail users. The good news still remains that Gmail now fully support searching inside attachments.

Enhancement to Search Within Gmail Attachments

Mozilla had announced the beta version of its long running web-scale identity system, Persona (formerly code-named BrowserID), which is aimed at entrenching privacy and secured web experience by utilizing authentication through existent email as against actual username and password.

Mozilla Persona differs from other authentication systems like OpenID in that it uses email address as identifier and fully integrated into the browser.

Persona takes precedence from the Verified Email Protocol system, which involves only the browser and compliant website.  It relies on public key cryptography on the browser-side without invoking the identity provider in the actual authentication process.

However, users will need create and verify an account on Persona.org by defining a password and adding one or more email addresses to their account. Thereafter, "Persona Authentication" would only take a two click process for already logged in users, while those not already logged in will need to enter their Persona details in the process.

Persona is built to naturally eliminate users tracking, which provides rest of mind for privacy conscious users, and at the same time ensuring secured access.

On the contrary, if users disclose their Persona details it can be used against them and to access all connected services. Mozilla, however, have iterated its plan to introduce two-factor authentication in later versions to beef-up security.

Developers have been called upon to contribute to the open source project. Whilst, Mozilla have promptly made available an extensive tutorial on What is Persona and How it Works.

Mozilla Persona: Browser-side Authentication System

Google mid-week announced new updates to the Google Apps service which will take effect starting October 1. Google is dropping support for the older Microsoft Office (Office 97 - 2003) formats: .doc (Word), .xls (Excel), and .ppt (PowerPoint)  on the Google Docs.

The Google Docs to Microsoft Office exporting feature will only allow user download documents in the new Office formats: .docx, .xlsx, and .pptx. However, the ability to import Office files of any format to Google Docs remains unchanged.

Google Docs users who are still running the old Office 97 - 2003 versions have been afforded a free compatibility plugin by Microsoft which will allow them to open newer Office files.

And users of the Consumer Productivity Suite of Google Docs will continue to be able to export documents in the old Microsoft Office format, whereas support for the Commercial Productivity Suite have been discontinued.

Office document collaborator using the old Office format, being backward compatible, need not concern themselves whether a collaborator is using the new Office version, as the latest versions of the Suite is compatible to the old formats. But, the older version of the Suite is not compatible.

Google Apps Drop Old Office Formats

Microsoft's Internet Explorer got a handful of critical exploitations earlier in the week. The zero-day vulnerabilities affects IE9 and older versions of the browser, the exploit allows remote code execution which could enable an attacker take control of a compromised system.

The exploit takes advantage of a "use-after-free" vulnerability, a vulnerability affecting mshtml.dll component of Internet Explorer.

The company has now provided a one-click work-around to the vulnerabilities, termed "Fix it for me", which affords an automatic fix to the vulnerabilities without requiring rebooting. The one-click automatic system does not affect browser sections while being implemented.

The "fix it" tool works by protecting the system from memory corruption, which security researchers have identified as the major entry mechanism for the exploits.

Microsoft has also scheduled an out-of-cycle security update to permanently fix the glitches for Friday. And users will be able to get the security patch through the Windows Update, while it will be automatic for those who have enabled automatic update.

IE Vulnerability: Microsoft one-click Fix It

The privacy policy proposal has now been embraced by virtually all leading internet technology vendors, with Microsoft even assuming a heightened dimension to it, purporting to making the do-no-track command the default setting on the next version of its browser IE10. Now, Chrome developers build released yesterday featured the revolutionary privacy option.

Google had earlier made known its decisions to bring comparative privacy options to users and implement a solution on its advertising systems as well. The "Do Not Track" feature, albeit, helpful in targeted advertising, appears exploitative to some segment of internet users, who maintains that choice to opt-out needed to be provided.

Advertisers, however, have expressed concern as to the actual implementation of the tracking restrictions, citing that it will thwart efforts to target advertising.

Before now, Google Chrome had remained the only major browser that did not implement the "Do Not Track" command. Mozilla first introduced the privacy mechanism in Firefox early 2011, with Opera and Internet Explorer later joining the train.

The privacy settings have been implemented in the Chromium developers channel and will be available in subsequent versions of Chrome.

Chrome "Do Not Track" Compliance

Microsoft has issued deadline about the necessary changes to Windows' certificate requirements in line with its scheduled automatic security update. Starting October 9, minimum key length for digital certificate supported by Microsoft must be at least 1,024 bits.

RSA digital certificate with key less than 1,024 bits will not be supported on the Microsoft platforms, hence administrators are required to update for the minimum certificate key length. Windows ActiveX Control would be blocked for any website without the required security certification level.

Microsoft Security Response blog noted that the changes will help improve security across the Windows platforms.

The company have made available a knowledge-base help in updating for the minimum certificate key length and detailed technicalities.

Microsoft effort to secure the Windows platform is paramount following the recent security breaches targeting the system. The company hopes the update to certificate key length requirements will help strengthen the Windows ecosystem.

Certificate Key Deadline Issued by Microsoft

Subscribe to: Posts (Atom)