Microsoft confirms phishers stole 'several thousand' Hotmail passwords

Microsoft today confirmed that thousands of Windows Live Hotmail account usernames and passwords had leaked to the Internet, but said the credentials were "likely" stolen in a phishing attack. Earlier today, Neowin.net reported that more than 10,000 accounts had been compromised and speculated that Hotmail had either suffered a breach or an aggressive phishing campaign had collected the usernames and passwords by duping people into divulging the information. "We determined that this was not a breach of internal Microsoft data and initiated our standard process of working to help customers regain control of their accounts," a Microsoft spokeswoman said in an e-mail to questions posed earlier today by Computerworld . Microsoft did acknowledge that Hotmail accounts had been compromised. "Over the weekend Microsoft learned that several thousand Windows Live Hotmail customers' credentials were exposed on a third-party site due to a likely phishing scheme," the same spokeswoman added. "That's a big result for a phishing campaign," said Dave Jevans, the chairman of the Anti-Phishing Working Group (APWG), an industry association dedicated to fighting online identity theft. "But it's not outside the realm of possibility. The company denied that its Web-based e-mail service had been hacked and the account log-in information stolen because of some lapse on its part. We've seen 50,000 to 75,000 [compromised] accounts when phishers target an ISP with millions of users." Hotmail has about 400 million registered users, according to Microsoft, although the company declined to spell out how many are active users of the service. "A .05% rate, which is what 100,000 users would represent, isn't unreasonable for 10 to 20 million users," Jevans said. "They wouldn't have to spam every [Hotmail] user to get that." According to Neowin.net, which first reported the Hotmail incident, more than 10,000 accounts had been compromised.

If the 10,000 accounts for A-B are extrapolated to the full alphabet, it's possible that over 100,000 accounts were compromised. "If that's the case, this would definitely be one of the biggest single phishing events," said Jevans. "But it could be the result of a long period of time, months and months of harvesting." Although the number of phishing attacks declined earlier this year, they have recent stormed back, said Jevans. "They're close to, or at, an all-time peak," he said. However, Neowin said it had seen only a partial list - accounts with usernames starting with "A" or "B" - and suspected that the total could be much larger. Both Microsoft and Jevans recommended that all Hotmail users change their passwords, just in case. "Change it, ASAP," urged Jevans.

Computer programmers set for smash-mouth brain battle

A smart people smack-down is set to start next week where thousands of university computer researchers will pit their brains and machines in a grueling battle of logic, strategy, and mental endurance. Layer 8 Extra: 15 genius algorithms that aren't boring During the competition, ten to twelve problems are attempted in a five hour period. The 34th annual IBM-sponsored Association for Computer Machinery (ACM) International Collegiate Contest (ICPC) pits teams of three university students against eight or more complex, real-world problems, with a nerve-wracking five-hour deadline. The problems are of varying difficulty and flavor.

The goal is that every team solve two problems, that every problem is solved, and that no team solve them all, according to ACM. Contests in the past have included problems that searched for a missing boat at sea, triangulated the location of a faulty transmitter, computed golf handicaps, stacked pipe of varying diameters in a fixed width bin, coded or decoded messages, printed braille, sought an exit to a maze, processed satellite images and solved a math problem. ACM says it wants two problems that could be solved in an hour by a first or second year student, two that could be solved in an hour by a third year student, and two that will likely determine the winners. Problems are presented with no more than a page of text, a helpful illustration, a sample input set with and accepted output set, ACM states. And judging is relentlessly strict, IBM says. Teammates collaborate to rank the difficulty of the problems, deduce the requirements, design test beds, and build smart software systems that solve the problems under the intense scrutiny of expert judges. The students are given a problem statement, not a requirements document.

Each incorrect solution submitted is assessed a time penalty. They are given an example of test data, but they do not have access to the judges' test data and acceptance criteria. The team that solves the most problems in the fewest attempts in the least cumulative time is declared the winner. Some problems require a knowledge and understanding of advanced algorithms. For a well-versed computer science student, some of the problems require precision only.

Still others are simply too hard to solve - except for the world's brightest problem-solvers, according to IBM. The Battle of the Brains is the largest and most prestigious computing competition in the world, with more than tens of thousands of students from universities in approximately 90 countries on six continents participating. Previously, the 2009 ACM-ICPC World Finals took place in Stockholm, Sweden, where a team from St. Petersburg University of Information Technology, Mechanics and Optics in Russia emerged as the world champion for the second year in a row. Since IBM began sponsoring the contest in 1997, participation has grown from 1,100 to more than 7,100 teams. Regional bouts will begin in the United States on October 18 and continue through December, sweeping from continent to continent. Only 100 three-person teams will advance to the World Finals on February 5, 2010 hosted by Harbin Engineering University in Harbin, China. "The ACM-ICPC affords students the opportunity to showcase their talents and gain exposure among top recruiters," said Dr. Bill Poucher, ICPC Executive Director and Baylor University Professor. "The contest is also a forum for advancing technology in an effort to better accommodate the growing needs of the future."

HDTVs, Blu-Ray Players Push Web Connections

Connected TVs, set-top boxes, and Blu-ray Disc players aren't new, but they continue to make new connections with Web sites and services, from YouTube and Netflix to Amazon and Internet radio sites. Some offer a lot more than others, but all are building up their portfolios of Web video and interactive services. The definition of "connected" varies widely between consumer electronics vendors. Some of the newest entries were on display last week at the CEDIA (Custom Electronic Design and Installation Association) event in Atlanta.

Available on networkable Bravia sets, the video service will also appear on a new networkable Sony Blu-ray Disc player, the BDP-N460, which will ship later this fall priced under $250. (Sony Bravia TVs also offer Web content such as stocks, weather, and Twitter, via their Bravia Widgets.) LG Electronics, meanwhile, announced the addition (via a firmware upgrade later this month) of the Vudu on-demand service to the Netcast Entertainment Access service on its $399 BD390 Blu-ray Disc player. Sony, which already offers movies, TV shows, and music from some two dozen partners, including Amazon movies on demand, Slacker radio, and YouTube, announced that it will add Netflix to its Bravia Internet Video lineup later this fall. The service already offers access to CinemaNow, Netflix, and YouTube content. And Samsung's networkable Blu-ray Disc players, including the BD-P1600, BD-P3600, and BD-P4600, will add YouTube access to the existing Pandora and NetFlix services. Samsung's Internet@TV service, which already had a dozen Yahoo widgets, now offers on-screen access to Rallycast fantasy sports applications, including Facebook messaging and access to team stats. Pioneer, meanwhile, demo'd a new platform for connected electronics.

The prototypes at CEDIA featured everything from video-on-demand services to backup. Code-named Project ET, it is designed to allow device designers and/or consumers to choose the content and services they want by clicking on menu buttons in the service's Web portal. Pioneer officials said the platform could exist on a set-top box of its own or on a Blu-ray Disc player or other networkable device (one demo setup featured a Blu-ray player with 1 terabyte of built-in storage. The company hopes to show a product based on the platform within the next few months.

Beyond iTunes: streaming music services

Mention "streaming music services" around the typical gaggle of Mac users and it's like you've suggested that the Mona Lisa would benefit from the application of devils horns, an eye patch, and the words "Windoze Rulez!" scrawled across her beguiling mug with permanent marker. After all, if some music is good, more is better, right? Yet, the true multimedia Mac can greatly benefit from such services. And more is exactly what these services provide. (Note that unlike music purchased from iTunes or Amazon, streaming tracks aren't saved on your computer and can't be synced to an iPod or iPhone-similar to listening to streaming radio stations in iTunes). Some streaming services such as Pandora and Last.fm are available for free.

Other, commercial-free services such as Rhapsody and Napster, require that you pay a monthly subscription fee. Their operation is supported by advertising and they don't allow you to choose the specific tracks and albums you want to listen to. But for that fee you can listen to exactly the tracks and albums you choose. Pandora Billed as a "new kind of radio," Pandora is a streaming service that plays music based on artists and tracks you choose as well as the positive and negative feedback you provide about the music it plays. These services shake out this way. For example, if you chose Joni Mitchell as an artist starting point, Pandora would first stream a track from Ms. Mitchell, then, perhaps, a Dar Williams track, and then other tracks it believes reflect the character of her work based on an analysis of the music.

Thumbs Down lets Pandora know that it's missed the mark, and that information is considered for future tracks. If you particularly enjoy a track that comes along, click a Thumbs Up icon to tweak the settings so you get more music like this track. You can bookmark tracks and artists and move to these bookmarks to learn more about the artist as well as utilize links to purchase their work. Additionally, Pandora's pages feature advertising and you'll hear the occasional audio ad between tracks. The free version of Pandora limits you to 40 hours of listening per month. All Pandora listeners are limited to six song skips per hour.

You can upgrade to Pandora One for $36 a year. Those with free accounts can skip 12 songs total per day. Do this and the audio ads disappear as does the daily skip limit (though you're still limited to six skips per hour), and you receive a higher quality, 192kbps stream. It bases the music it streams on the music you play on your computer or iPod as well as the Last.fm stations you create and listen to. (Any information it collects is volunteered by its users.) In addition to its analysis tools,  Last.fm compares the music libraries of its users, making recommendations based on intersecting tastes (similar to iTunes' Genius feature). When you sign on, you create a profile page, which lists the tracks you've listened to, lists similar artists you might be interested in, and features comments from other Last.fm users who've chosen to remark on the track. Pandora is not available outside of the U.S. Last.fm Last.fm is another free music community streaming service.

This reflects Last.fm's emphasis on community and social networking. From within the service you find links to purchase tracks from the iTunes Store, Amazon MP3, and 7digital. Last.fm also has its commercial side. For $3 a month you can listen to Last.fm without interruptions and do so without advertising. Last.fm is free in the United Kingdom, U.S., and Germany. While Last.fm doesn't offer on-demand listening, you can listen to a 30-second preview of any tracks it has in its library.

A €3 monthly fee is required for listening outside these countries. Instead, today's Napster is a music subscription service as well as a music store where you can purchase DRM-free 256kbps MP3 files. Napster Take a word association test a few years ago, utter the term "Napster," and the response would surely be "piracy." The notorious file sharing service that was Napster is no more. Priced at $5 a month, a Napster subscription entitles you to access to Napster's multi-million track streaming library. Napster's music can be streamed through your computer or a compatible device such as the Sonos Multi-Room Music System and Logitech's Squeezebox systems.

Additionally, you receive credit for five MP3 downloads each month. Similar to the iTunes Store you can visit genre pages to find particular kinds of music. In addition to tracks and albums, Napster offers radio stations that stream particular genres of music. These pages feature new releases, top albums, tracks, and artists; playlists, and staff picks. These stations include such genres as rock, blues, comedy, electronica, heavy metal, hip-hop, jazz, reggae, and classical.

Rhapsody Real Networks' Rhapsody is another subscription music service. You can also listen to tracks from Billboard's charts as well as watch music videos. Priced at $13 a month, Rhapsody, like Napster, gives you access to millions of streaming audio tracks and you can play all of them on demand. Also as with Napster, you can stream Rhapsody's music not only to your computer but to a Squeezebox and Sonos system. Although no downloads are included with a subscription, you're welcome to purchase unencrypted 256kbps MP3 tracks and albums from Rhapsody.

TiVo subscribers can also access Rhapsody's service (Rhapsody account required). The Rhapsody experience is similar to Napster is other ways. You can also create playlists of music that you can later stream. On its Web site you'll find new releases, staff picks, top albums and tracks, and genre pages and channels. Rhapsody recently released an iPhone app that allows Rhapsody-to-Go subscribers ($15 a month) to stream Rhapsody's content to their iPhones or iPod touch. The current Rhapsody app has met with little enthusiasm due to the generally poor quality of the stream, but company has indicated that it's working on providing better sound from its app.

Western Digital launches WD TV Live

Western Digital announced Tuesday the launch of its new WD TV Live HD Media Player. Available now for $149.99, the WD TV Live hopes to transform your television into a home media hub. The WD TV Live is an upgrade over the previous WD TV model, now adding Ethernet connectivity and digital theater sound to its extensive features.

The concept remains the same: you plug the WD TV into a television set and any external hard drive. Western Digital says it designs products with users in mind and has paid particular attention to how user friendly the UI is. The WD TV is designed to take your media files from your external hard drive and play them on your TV. The device supports many different types of audio and video files, such as H.264, MKV, VIDEO_TS folders, and FLAC audio, and can play back HD video in full 1080p resolution. While providing high definition capabilities, it's designed to be easily navigable for the average user. First, it adds Digital Theater Sound (DTS) support (it previously supported Dolby Digital) for surround sound capabilities.

Since the introduction of the original WD TV, the Western Digital team has sought consumer input, said Seema Lindskog, a director of marketing for WD. In addition to offering an improved UI with a movie preview screen feature, the WD TV Live has two major advantages over its predecessor. With the addition of an Ethernet port, the WD TV Live can access popular Web services such as YouTube, Pandora, and Flickr with the click of a button. While some people may see this an oversight, Western Digital seems to be targeting this product for users with large media libraries who would quickly fill up a built-in hard drive. It can also stream content from an external hard drive, a Mac, or a Windows PC. The Ethernet capabilities of the WD TV Live make it easy to centralize your media, though the WD TV Live itself does not have any storage capacity. Also, not including storage in the unit allows the company to keep the price down.

Beware BlackBerry Browser Bug Until Carriers Offer Updates

BlackBerry smartphone users who frequently surf the Web via handheld will want to keep checking with their wireless carriers for BlackBerry Handheld Software updates in the coming weeks. The BlackBerry Browser dialog box informs the BlackBerry device user when there is a mismatch between the site domain name and the domain name indicated in the associated certificate, but does not properly illustrate that the mismatch is due to the presence of some hidden characters (for example, null characters) in the site domain name." The flaw relates to the BlackBerry software's certificate-handling functionality. That's because a new bug found in most current versions of Research In Motion's (RIM) device software, which makes it easier for malicious parties to execute "phishing" attacks on unsuspecting smartphone users, has been addressed via handheld software updates from RIM. From RIM's online security advisory: "This advisory relates to a BlackBerry Browser dialog box that provides information about web site domain names and their associated certificates. A hacker could potentially recreate, or "spoof," a site commonly visited by BlackBerry users, such as RIM's BlackBerry.com, by purposely adding "null characters" to the site certificate's Common Name (CN) field.

CVSS is a vendor agnostic, open standard for the security industry meant to depict the seriousness of vulnerabilities, according to RIM. The BlackBerry-maker recommends that all BlackBerry users running handheld OS 4.5 or higher check in with their wireless carriers to see if device software updates are available. The recently discovered flaw keeps the BlackBerry Browser from correctly identifying mismatched site certificates due to an inability to render said null characters. (See screenshot below for an example of how the BlackBerry Browser box should look when it encounters site certificate issues due to the presence of null characters in site CN fields.) The flaw was rated 6.8 (Medium Risk) on a Common Vulnerability Scoring System (CVSS) scale of one to ten, with one representing little or no risk and ten representing very serious risk. The problem: I just did a quick search of both AT&T and Verizon's BlackBerry download pages, but in a number of cases I could only locate earlier software versions than those recommended by RIM. Here's a list that specifies which software should be updated and to which new versions. If you encounter a BlackBerry Browser dialogue box like the ones shown in this post, you should choose to close the connection rather than subject yourself to potential phishing-related risk, according to RIM. More information on BlackBerry security can be located on the company's website. Current Software Version * BlackBerry Device Software v4.5.0.x to v4.5.0.173 or later * BlackBerry Device Software v4.6.0.x to v4.6.0.303 or later * BlackBerry Device Software v4.6.1.x to v4.6.1.309 or later * BlackBerry Device Software v4.7.0.x to v4.7.0.179 or later * BlackBerry Device Software v4.7.1.x to v4.7.1.57 or later Until you're able to sit down and update your device-or while you wait for your carrier to issue an update-RIM says to use caution when clicking unknown links in SMS text or e-mail messages, even if they're from what appears to be a trusted source.

Microsoft aims to spark new business for Web developers

Microsoft has launched a program that gives Web development professionals the chance to get free software and technical support to help them get new businesses off the ground. The program is similar to Microsoft's BizSpark program launched last year, which provides software and other resources to startups, and the DreamSpark program, which does the same for students. Web development companies with less than 10 employees can apply for the new WebsiteSpark program, which was unveiled at the PICNIC conference in Amsterdam Thursday.

Eddie Amos, general manager for Microsoft's developer platform and tools group, said the company added WebsiteSpark because it realized there was a "hole" in the enablement programs where Web professionals are concerned. In the Web development and Web design space many companies already use products from Adobe and other Microsoft competitors. The programs also provide a way for Microsoft to get young companies and developers using its software in their businesses. Through WebsiteSpark - which companies can apply for online - Microsoft will provide three licenses for Visual Studio 2008 Professional Edition, two licenses for Expression Web 3 and one license for Expression Studio 3. Qualifying companies also receive four processor licenses for production use of both Windows Web Server 2008 and Microsoft SQL Server 2008 Web Edition. Cyrus Massoumi, whose company ZocDoc has been a part of Microsoft's BizSpark program, said getting free software and support has been a great benefit. The program also includes two technical-support incidents per company, access to community support through connections with other Microsoft partners and unlimited access to technical managed newsgroups on the Microsoft Developer Network.

ZocDoc provides a Web site through which people can book doctors' appointments. "The program enables us to work with Microsoft's latest technologies without worrying about cost, and the savings for our data center are significant," said Massoumi, ZocDoc's CEO and founder. The 2.0 version is available online for download. In addition to unveiling WebsiteSpark, Microsoft Thursday also updated its Web Platform Installer software, which simplifies the installation of Microsoft Web development software to make it easier to build Web applications.