INTERNET TECHNOLOGIES

Update: Firefox plugin shipped with malicious code

Mozilla warned Wednesday that a malicious program inserted adware code into a Firefox plugin that has been downloaded thousands of times over the past three months.

Because of a virus infection, the Vietnamese language pack for Firefox 2 was polluted with adware, Mozilla security chief Window Snyder said in a blog posting . "Everyone who downloaded the most recent Vietnamese language pack since February 18, 2008 got an infected copy," she wrote. "Mozilla does virus scans at upload time but the virus scanner did not catch this issue until several months after the upload."

Mozilla is now going to add additional scans of its software to prevent this kind of thing from happening in the future, she said.

The malware in the language pack is from the Xorer Trojan, according to discussion on Mozilla's Bugzilla developer Web site, which indicates that Mozilla developers first discovered the issue on Tuesday.

"I think it (happened) just because the author's local network was infected with the virus, so it modified HTML files," wrote developer Hai-Nam Nguyen. "The infected code just display(s) annoying banner but it can't propagate."

Mozilla missed the code during its initial scan because antivirus vendors had not yet added detection for Xorer into their products, Snyder said in an interview. Antivirus vendor Panda Security first detected Xorer on Feb. 28, 10 days after the infected plugin was published.

Firefox developers have now scanned all of their plugins. The Vietnamese language pack is the only one that had this kind of code, she said.

The open-source browser maker does not know how many people were infected with the adware, but the plugin was downloaded more than 1,200 times in the past week and has been downloaded 16,667 times since November.

On Wednesday afternoon, the Web page for the plugin was off-line as Mozilla scrambled to come up with a new, adware-free version of the language pack. In the meantime, users of the software should disable the plugin, Snyder said.

Xorer added a script to the Vietnamese language pack's HTML files that would have taken Firefox users to adware servers as they were surfing the Internet, Snyder said.

Snyder did not know exactly how the adware code was added, but she said that this kind of problem could affect any software provider -- open source or not. "In most software development environments the developers aren't kept in a dark cave," she said. "They browse the Web or take those laptops to a coffee shop "

"It's just a fact of life," she added.

Other vendors have been hit with similar problems. In late 2006 Apple shipped Video iPods that contained the RavMonE.exe virus. And late last year, retailer Best Buy shipped digital picture frames that contained malware.

Although some might say Mozilla's incident underscores the risks of open-source software development, this type of issue could crop up at a company like Microsoft too, said Eric Schultze, chief technology officer at Shavlik Technologies. "Most products that ship today include HTML files in them," he said via instant message. "Any one of them could suffer from this."

Mozilla was already doing the right thing scanning their code before upload, Schultze said. "But it shows the need to have tight security on developer systems."

Kids in Second Life: Does Danger Lurk?

Second Life is no place for kids, a Republican congressman declared Monday. U.S. Representative Mark Kirk has sent a letter to the Federal Trade Commission requesting a consumer alert warning about the dangers of Second Life, which he charges could expose kids to child predators and registered sex offenders.

Company Floats Ads in Clouds Shaped Like Corporate Logos

Picture the Manhattan skyline filled with Nike swooshes. Or the golden arches of McDonald's gently drifting over Los Angeles.

A special-effects entrepreneur from Alabama has come up with a way to fill the sky with foamy clouds as big as 4 feet across and shaped like corporate logos -- Flogos, as he calls them.

Francisco Guerra, who's also a former magician, developed a machine that produces tiny bubbles filled with air and a little helium, forms the foam into shapes and pumps them into the sky.

The Walt Disney Co. will use one of the machines next month to send clouds shaped like Mickey Mouse heads into the air at Walt Disney World in Orlando, Fla., Guerra said.

"It's a shock factor when you look up and there's a logo over your head," said Guerra, whose company, Snowmasters Inc., makes machines that churn out fake snow and foam for Hollywood movies and special events.

He developed Flogos at his small factory in northern Alabama -- a perfect place for research and development, he said, partly because there aren't many people around to ask questions about the foam shapes that float above the building on test days.

A Flogo machine works a little like a Play-Doh Fun Factory, the $5 toy kids use to squeeze colorful putty into stars, circles and other shapes.

A boxlike contraption produces a specially formulated white foam in a big round tub and forces it upward through a stencil. Once the foam is several inches thick, a metal cutter slices it and a faux cloud floats into the sky.

"You want some wind because you want them to travel," Guerra said. "If there's no wind they just spiral upward slowly. We've got a ghost (stencil), and on a calm day it looks like everyone is going to heaven."

Guerra's company is working on a version...

Sun Unveils JavaFX for Rich Internet Applications

Sun Microsystems gave developers at its JavaOne conference their first glimpse of JavaFX -- a family of products it announced last year that promise to enable developers to create rich Internet applications that run on a variety of platforms.

"JavaFX is a powerful client technology for creating rich Internet applications with immersive media and content across the multiple screens of an individual's life," said Sun Microsystems Executive Vice President Rich Green. "Java technology is now ready for the new creative audiences that have emerged in response to consumer demand for rich content."

Introducing JavaScript

Built on Java Standard Edition -- the Java platform already running on many desktop computers -- JavaFX is designed to unite billions of Java SE and Java Micro Edition devices, Sun CEO Jonathan Schwartz said when the technology was first announced last year. "It will allow any consumer electronics manufacturer to accelerate the delivery of Java/Linux-based devices -- from phones to set tops and dashboards and everything else imaginable and without fear of format lock-in or disintermediation from a competitor," he said.

In particular, Sun's new suite introduces a new high-performance declarative scripting language known as JavaFX Script. Like the rest of the Java platform, the product will be made available under the standard GPL license.

Among other things, JavaFX Script will enable the binding of applications to various data sources, Sun said, enabling developers to create compelling mashup offerings. Moreover, JavaFX Script is designed to deliver a rich end-to-end experience for developers and users alike through its close integration with other standard Java application and infrastructure components.

The scripters, social-application creators, designers, content authors and consumers who elect to join the Java ecosystem of more than six million developers will "take Java technology in exciting new directions," Green said.

On All Screens

Green said Sun's Java runtime...

Vista vs xp, continued

Since my recent post about the impending demise of Microsoft Windows XP, I have seen some articles which suggest that MS may continue to offer WinXP for sale, at least the Home version, for some time past the June 30, 2008 cutoff. Nothing certain, just hints and rumors. A Computerworld article TechNet subscribers rip Microsoft over XP SP3 ‘farce', stated that Microsoft did not release the Service Pack I for Vista to developers as promised, and went on to say that they would not release the Service Pack III for XP until after Vista SP I was released. Much confusion is produced for developers as well as end users, here, as a Microsoft developer posted that Vista SP I would be available on May 2, 2008, only to have that page removed from his blog. The alleged logic in this is that Microsoft is putting its main effort into repairing Vista prior to updating XP. It also makes sense if a company is trying very hard to push consumers into using a new OS and abandoning an older (and better, in my opinion) OS, so further profit can be extracted. Microsoft has pointed out the huge number of Vista OS sales that have occurred since its release as evidence of its popularity. Well, Duh. If Vista is the only Windows OS that one can obtain when one buys a new computer, of course its sales figures will look impressive. Only a very few, very small, "white box" computer makers continue to offer XP Pro SPII on their machines. Why do they do that? They make extremely fast gaming computers and XP works better. As the dust settles somewhat, a few matters appear to have become clearer. If you have to buy Vista, get the Home Premium version. Common wisdom has come to a consensus that it works the best of any of the Vista versions. Don't try to "upgrade" a Vista machine to XP. It isn't worth the trouble, crashes, driver changes, and incompatibilities with some of your current software. Buying a new machine with Vista pre-installed eliminates many of these frustrations. Vista does not seem to run nearly as well on laptops as on desktop machines, probably due to its greater demand on computer resources. If everything you are now running is working well for your needs on XP, I would hold out for Microsoft's "OS 7," the next OS in the pipeline, which is rumored to have had its release date moved up from 2010 to sometime in 2009. Finally, I would note that the Vista debacle is not Microsoft's intentional plan to irritate its users. With all the legal actions, interoperability problems, changes to changes, and patches to holes which were discovered by hackers even before Vista was officially released, etc., they have had a difficult time with it. It is simply my belief that they should not remove a well tested and working OS from availability before they have something better and more stable to offer. As the wise old barnstorming wing-walker would say it, "Don't leave holt of what ya got till ya got holt of somethin' else." In the interim, my plan is to stay with XP Pro, buy a copy of XP Pro before it goes off the market, eventually buy a new CPU and install XP on it, but leave a bay open for another hard drive on which Vista can be installed (as a dual boot system) in case I'm wrong. That has happened to me once or twice before in 62 years. Peace, Doc Copyright © 2008, Thomas A. Blood, Ph.D. (Source: Solo Shrink)

Fake MP3 Trojan Detected On 27% Of PCs (TechWeb)

TechWeb - InformationWeek - McAfee Avert Labs says more than half a million of the adware programs disguised as media files have been detected in less than a week.