Microsoft botches still more patches in latest Automatic Update

No sooner did Microsoft release the latest round of Black Tuesday patches, than screams of agony began sounding all over the Internet. At this point, I've seen verified problems with KB 2817630, KB 2810009, KB 2760411, KB 2760588, and KB 2760583. Here's what we know at this point.

KB 2817630 is not a security patch, it's a gratuitously delivered functionality patch for Office 2013, and man has it had an impact on functionality. I've seen dozens of reports that installing this patch, possibly in conjunction with the KB 2810009 patch that is part of MS13-074, causes the folder pane in Outlook 2013 to disappear. An anonymous poster on the SANS Internet Storm Center offers this picture of the effect.

Thirteen hours after the first posts complaining about the problem appeared on the Microsoft TechNet forum, Microsoft still hasn't done anything. As of 00:15 a.m. PDT on Wednesday, Sept. 11, the patches are still available, still marked for automatic installation, and the KB articles have not been updated to reflect the screw-up.

It appears as if uninstalling both patches will bring the folders back, although there's a more substantive workaround offered by one of the posters on the TechNet forum:

This behaviour seems to be caused by using the latest version of the shared Office library mso.dll 15.0.4535.1002 from KB2817630 in combination with an outdated version of Outlook. Try installing KB2817503 to update Outlook to the matching version 15.0.4535.1004. I don't have the issue with the missing folder pane in this constellation. Updating Outlook with the August 2013 hotfix (KB2817503) restored the reading pane on multiple machines.

KB 2760411, KB 2760588, and KB 2760583 are parts of the MS13-072 and MS13-073 security patches for Office 2007. There are many reports of the patches being offered and re-offered and re-re- ... you get the idea. On sevenforums, poster harin35 says:

No error messages. Windows Update appears to install them; but the updates have not been installed. These are 'important' updates.When I run Windows Update again, these three updates reappear as 'important' updates.

No guidance for handling the problem is on offer in the usual forums, because the people moderating the forums haven't a clue what went wrong and Microsoft isn't saying a thing.

Again, as of 00:15 am PDT on Wednesday, Microsoft hadn't pulled any of the patches, nor had it updated the KB articles, posted any recommendations on the usual fora, issued a press release, or made one iota of effort to help its customers. 

Does this make you feel warm and fuzzy about automatic app updates in Windows 8.1? Terry Myerson, are you listening?

t/h SB

This story, "Microsoft botches still more patches in latest Automatic Update," was originally published at InfoWorld.com. Get the first word on what the important tech news really means with the InfoWorld Tech Watch blog. For the latest developments in business technology news, follow InfoWorld.com on Twitter.

View the original article here

Encryption still best way to protect data -- despite NSA

Computerworld - Though the National Security Agency spends billions of dollars to crack encryption technologies, security experts maintain that properly implemented, encryption is still the best way to maintain online privacy.

The Guardian newspaper and other media outlets this week published stories based on internal internal NSA documents that explain how the spy agency bypasses encryption technologies by using backdoors, brute force attacks, lawful intercepts via court orders and partnerships with tech vendors.

The reports, based on documents leaked to reporters by former NSA-contract employee Edward Snowden, suggest that many encryption algorithms now widely used to protect online communications, banking and medical records and trade secrets have been cracked by the NSA and its British counterpart, the GCHQ.

Steve Weis, chief technology officer at PrivateCore and holder of a Ph.D in cryptography from MIT, said despite the NSA activities, the mathematics of cryptography remains very hard to crack.

He suggested that it's likely that the NSA managed to break through insecure and outdated implementations of some encryption technologies.

For example, the documents suggest that the NSA built a backdoor into an NIST approved encryption standard called Dual EC DRBG, which is used to generate random numbers. Weis noted that the Dual EC DRBG standard has been available for six years and has been rarely used since two Microsoft engineers discovered the NSA backdoor, Weis said.

It remains unclear whether NSA experts have the ability to crack more robust encryption technologies, he said. "So far, I've not seen anything to suggest than an algorithm like AES (Advanced Encryption Standard) has been broken," Weis said.

"When properly implemented, encryption provides essentially unbreakable security," said Dave Anderson, a senior director with Voltage Security, a provider of encryption technology.

"It's the sort of security that would take implausibly powerful supercomputers millions of years to crack. But if it's carelessly implemented, and the key management processes are not sound, this security can be reduced to the level where a hacker with a mid-market PC can crack in a few hours at most," he said an email to Computerworld.

Anderson said the NSA may have been able to take advantage of flaws in key management processes that support the encryption, rather than cracking the cryptography itself, he said. It's possible that the NSA can decrypt financial and shopping accounts, but it can happen only if the cryptography was improperly implemented through faulty, incomplete or invalid key management processes, he said.

Dave Jevans, founder and CTO of Marble Security, a maker of mobile security technology, said some of the concerns raised by the NSA documents are based on a misunderstanding of the facts.

Small and midsize businesses are moving to the cloud to host their communications capabilities. Learn how enterprise-quality phone benefits, online management, conferencing, auto attendant, and ease of use are built into a system that is half the cost of a PBX.

Read now.

View the original article here

10gen CEO: NoSQL has come far, but still needs better security, management

Credit: iStockPhoto

While NoSQL has made great strides, it will need improvements in multiple areas in order to gain wider acceptance, Max Schireson, the CEO of MongoDB NoSQL database vendor 10gen, said.

NoSQL databases are known for being able to handle great amounts of data that does not necessarily fit well into the relational model, but there is work to be done in areas such as security and manageability in order for NoSQL to gain more adoption, said Schireson at the recent NoSQL Now 2013 conference in San Jose, Calif. "There's lots of work to do before NoSQL as a sector can win."

The NoSQL ecosystem, he said, needs to mature before it can go from a 15- to 20-percent usage level to being used across all organizations with large-scale IT needs. NoSQL needs security improvements like encryption of data and integration with Kerberos and LDAP. It also needs improvements in manageability and integration. Problems like fragmentation and lack of standardization also need to be addressed, Schireson said, noting that NoSQL needs to be made more accessible for users and that it should be easier to do queries and to query different things in new ways.

He also stressed NoSQL vendor priorities, saying that "we need to value user success over short-term monetization." For example, free, open source downloads need to be well-tested and solid. Vendors also must understand what their products can do better than anything else out there and build a product ecosystem, Schireson said.

Improvement already is being seen in the number of persons with NoSQL skills, but it is still a small number, Schireson said. He cited the presence of 50,000 developers with MongoDB skills listed on their LinkedIn accounts. "[The] skill base is growing rapidly." NoSQL already has been embraced by large IT companies like IBM and Microsoft, Schireson noted, further predicting that relational databases will continue to be a big part of the market, but not as dominant as they are today.

This story, "10gen CEO: NoSQL has come far, but still needs better security, management," was originally published at InfoWorld.com. Get the first word on what the important tech news really means with the InfoWorld Tech Watch blog. For the latest developments in business technology news, follow InfoWorld.com on Twitter.

View the original article here

Gartner: Amazon still public cloud leader by a long shot

Amazon Web Services remains the top IaaS public cloud computing provider, offering the widest breadth of services of any vendor in the market, Gartner concluded in its annual Magic Quadrant report.

In addition to having a broad range of cloud-based services, AWS also has the largest capacity to handle cloud-based workloads. Its cloud operation is estimated by Gartner to be five times larger than a dozen of its top competitors in the market combined. "AWS is the overwhelming market share leader," the report reads. "It is a thought leader; it is extraordinarily innovative, exceptionally agile and very responsive to the market. It has the richest IaaS product portfolio, and is constantly expanding its service offerings and reducing its prices."

[ Stay on top of the cloud with InfoWorld's "Cloud Computing Deep Dive" special report. Download it today! | From Amazon to Windows Azure, see how the elite 8 public clouds compare in InfoWorld Test Center's review. | For a quick, smart take on the news you'll be talking about, check out InfoWorld Tech Brief -- subscribe today. ]

[MORE GARTNER:Big data has pretty much reached the peak of it's Hype, Gartner says | FROM THE ARCHIVES:Do you believe in Magic Quadrants?]

Each year Gartner compiles its Magic Quadrant for public cloud vendors by examining the estimated 15 largest market players based on estimated market share, then it ranks them based on their understanding of market needs and the company's ability to execute. In addition to the breadth and depth of services, AWS also has a robust partner ecosystem with leading technology providers offering its services through Amazon's cloud, including some of the biggest systems integrators. Gartner does warn of some cautions when using AWS services though, including complexity around its pricing and support offerings. Individual AWS offerings are rarely bundled, which can complicate purchasing choices.

No other company is really close to Amazon in terms of its offerings, according to Gartner, but there are a variety of niche players. Outsourcer CSC, for example, receives high marks in the report and is named as the only other leader in the market. Based on VMware's suite of cloud computing offerings, CSC has a very different enterprise-focused model compared to Amazon though, Gartner says. "[CSC] has a solid platform that is attractive to traditional IT operations organizations that still want to retain control, but need to offer greater agility to the business and are willing to embrace data center transformation," Gartner says. Amazon, in comparison, is more of an outsourcing play, with a limited on-premises or "private cloud" option for customers to deploy on their own premises.

Microsoft and Rackspace are listed in the "visionaries" category, while telco-oriented providers Verizon Terremark and Savvis are in the "challengers" quadrant, along with Dimension Data. Joyent, Tier 3, Virtustream, Fujitsu, SoftLayer (now owned by IBM), GoGrid, HP, and IBM are considered "niche players" by Gartner.

The IaaS market for cloud computing is rapidly evolving, but it represents the fastest-growing need among Gartner clients. "As each provider has unique offerings, the task of sourcing their services must be handled with care." Most of the vendors included have service-level agreements that ensure the cloud will have 99.95 percent uptime; some even guarantee up to 99.999 percent.

Gartner warns that security remains a major issue with cloud computing, with the extent of security measures from each provider varying significantly. While a vendor may provide some base-level of security, in many circumstances, such as with AWS, it's up to the customer to select what additional security features they want. The same is generally true with enterprise-class support, which is offered as an option for customers if they choose from many providers, like AWS. 

Customers are using the cloud for more complex workloads now compared to a year ago. Gartner recommends using cloud services for purposes such as test and development, hosting cloud-native applications, e-business hosting, enterprise applications, general business applications, and batch computing, depending on the provider.

Senior Writer Brandon Butler covers cloud computing for Network World and NetworkWorld.com. He can be reached at BButler@nww.com and found on Twitter at @BButlerNWW. Read his Cloud Chronicles here.

View the original article here

ImmunoCellular Stagnates With Trial Read-Out Still Months Away

By Jake King

ImmunoCellular Therapeutics' (IMUC) on Wednesday the 7th said that the company expects trial results in the fourth quarter of 2013 or first quarter of 2014 from its ongoing Phase IIB trial of the dendritic cell-based immunotherapy ICT-107 in patients with newly diagnosed glioblastoma. This small-cap's investor base is largely retail, suggesting a run-up to the trial results; see Celsion (CLSN) from August '12-January '13 for an example of what the retail community's infatuation can do for a stock ahead of exciting top-line data. While IMUC began a pre-release run-up in July, we expect the stock to stagnate until later in the third quarter, as top-line results aren't expected until 4Q13 at the earliest.

PropThink covered Immunocellular in detail in February of this year. Dr. Dee Kotak outlined why he's bullish on the forthcoming ICT-107 trial results in GBM. Depending on the trial meeting its primary endpoints with statistical significance, the results could be robust enough for submission to the FDA based on the Phase IIb data-set, pending a possible bridging study for the currently utilized -107 (the company switched manufacturers mid-study).

Recall that analysis of the Phase IIb trial begins after 64 events (deaths). On June 7, IMUC announced that following a pre-specified interim analysis, an independent Data Monitoring Committee recommended continuing the trial through completion. The interim look was triggered by 32 events. While IMUC is guiding for top-line data in 4Q13 or 1Q14, this is based on event-rate assumptions and is by no means a hard deadline. ImmunoCellular has no plans to announce the 64th event or beginning of the data analysis. The company anticipates 3-4 months (top-line data 6 weeks after database lock) for complete analysis, substantially longer than other similarly sized oncology programs.

We expect the stock to again run into the expected results, with some momentum beginning again early next quarter or following the company's third quarter conference call, as management may hint at timing of the 64th event.

IMUC's previous CEO, Dr. Manish Singh, who bowed out late last year, was known for talking up the possibility of an early submission based on the current study. But CEO Andrew Gengos, who joined the company in December of 2012, is walking down expectations for a NDA submission following completion of the study. Notably, Gengos spent time on Wednesday's conference call discussing what "success" might look like in the trial. Remember, the -107 study is 80% powered to show a 9-month OS benefit in the -107 arm. Gengos mentioned that success might look like an OS benefit trend or positive results in a sub-group of patients, essentially suggesting to investors that not achieving a 9-month OS benefit isn't the end but will guide the company in planning a Phase III program. Gengos is clearly taking a more conservative approach then Dr. Singh and tempering investor expectations ahead of the event.

Still, an analyst on the Wednesday conference call asked what the company would do if ICT-107 achieves a 9-month OS benefit with statistical significance. Gengos responded that success, "as you put it" would be presented in the best possible light to the FDA. Although Gengos noted the possibility for submission and that they would do everything feasible to get positive results in front of the FDA, a "Phase III program" was mentioned repeatedly.

It's worth noting that the company's other pipeline programs - ICT-121 in recurrent glioblastoma and ICT-140 in ovarian cancer - are beginning to progress. In June, an investigator-sponsored Phase I, 20-patient study of ICT-121 was initiated at Cedars-Sinai Medical Center. ImmunoCellular is providing the ICT-121 vaccine. The primary objective of the open-label trial is to assess the safety and tolerability of ICT-121. Secondary objectives include OS and PFS at six months after surgery. Like the ICT-107 trial, patients will be HLA-A2 positive. The company anticipates enrolling 1-2 patients per month, which could take up to 20 months to complete. Although the trial is currently open, no patients have yet been enrolled. The delay, according to IMUC, is related to manufacturing.

ImmunoCellular plans to conduct an open-label Phase II trial of ICT-140 in 30 patients with ovarian cancer who are at high risk of having a first recurrence. 20 patients will be treated with standard of care plus ICT-140, while 10 will receive standard of care. Should the results from the first cohort of patients support further enrollment, the company will randomize another 20 patients to be treated, plus 10 more comparator patients. The Phase II should begin in 1Q14.

ImmunoCellular ended the quarter with $25.5M in cash. Cash use in the first half of the year totaled $4.1M following the receipt of $3M from warrant exercising. In addition, recall that IMUC entered into an At-the-Market sales agreement on April 18, 2013 for up to $25 million in aggregate. The company raised $400K during Q2 through the ATM, and since the end of June raised another $2.1M, for $2.5M net from the ATM facility. ImmunoCellular expects to continue at a $800K-$1M monthly burn rate (management indicated the top-end of this range through year-end), suggesting sufficient capital to reach key milestones.

Investors have been vacating IMUC since the quarterly update on Wednesday given the unclear timelines on the top-line release; the stock is down 12%. We expect the stock to continue trading sidewise through this month and September as traders put money to use elsewhere. Given the high volatility that will be associated with the event, an options straddle may be the ideal way to be involved.

You can read our previous coverage of ImmunoCellular here.

Disclaimer: PropThink is a team of editors, analysts, and writers. This article was written by Jake King. We did not receive compensation for this article, and we have no business relationship with any company whose stock is mentioned in this article. Use of PropThink’s research is at your own risk. You should do your own research and due diligence before making any investment decision with respect to securities covered herein. You should assume that as of the publication date of any report or letter, PropThink, LLC and persons or entities with whom it has relationships (collectively referred to as "PropThink") has a position in all stocks (and/or options of the stock) covered herein that is consistent with the position set forth in our research report. Following publication of any report or letter, PropThink intends to continue transacting in the securities covered herein, and we may be long, short, or neutral at any time hereafter regardless of our initial recommendation. To the best of our knowledge and belief, all information contained herein is accurate and reliable, and has been obtained from public sources we believe to be accurate and reliable, and not from company insiders or persons who have a relationship with company insiders. Our full disclaimer is available at www.propthink.com/disclaimer.

Disclosure: I am long IMUC. I wrote this article myself, and it expresses my own opinions. I am not receiving compensation for it. I have no business relationship with any company whose stock is mentioned in this article. (More...)

View the original article here