iOS 7 security update patches lockscreen flaw

September 27, 2013 09:16 AM ETNetwork World - Apple yesterday released an iOS 7 software update that fixes a security flaw that let users bypass the iPhone lockscreen to access a range of onboard information and online accounts.

IOS 7.0.2 seems to be mainly a security patch, but the update screen also says there is a new Greek alphabet keyboard option for entering a passcode.

A day after iOS 7 was released earlier this month, Forbes' Andy Greenberg reported that a U.S. soldier had somehow uncovered a rather complex series of actions that let him bypass the lockscreen, at least on existing iPhones that updated to the new firmware.

[MORE iOS7:iOS 7 tips and tricks you need to learn]

[NEWS:Quick look: The interesting rise and quick fall of Blackberry]

The actions involved swiping upwards on the lockscreen to bring up the iOS Control Center, then opening the alarm clock app, then holding down the power button to show the "power off" and "cancel" options, then tapping "cancel," and finally quickly double-clicking the home button to bring up the multitasking screen for various apps.

According to Greenberg's account, the user could then access the phone's camera and stored photographs and, more importantly, the ability to share the photos via various associated accounts, and therefore access them: including email, Twitter, Facebook and Flickr.

John Cox covers wireless networking and mobile computing for Network World.Twitter: http://twitter.com/johnwcoxnwwEmail: john_cox@nww.com

Read more about software in Network World's Software section.

Reprinted with permission from NetworkWorld.com. Story copyright 2012 Network World, Inc. All rights reserved.

View the original article here

Microsoft botches still more patches in latest Automatic Update

No sooner did Microsoft release the latest round of Black Tuesday patches, than screams of agony began sounding all over the Internet. At this point, I've seen verified problems with KB 2817630, KB 2810009, KB 2760411, KB 2760588, and KB 2760583. Here's what we know at this point.

KB 2817630 is not a security patch, it's a gratuitously delivered functionality patch for Office 2013, and man has it had an impact on functionality. I've seen dozens of reports that installing this patch, possibly in conjunction with the KB 2810009 patch that is part of MS13-074, causes the folder pane in Outlook 2013 to disappear. An anonymous poster on the SANS Internet Storm Center offers this picture of the effect.

Thirteen hours after the first posts complaining about the problem appeared on the Microsoft TechNet forum, Microsoft still hasn't done anything. As of 00:15 a.m. PDT on Wednesday, Sept. 11, the patches are still available, still marked for automatic installation, and the KB articles have not been updated to reflect the screw-up.

It appears as if uninstalling both patches will bring the folders back, although there's a more substantive workaround offered by one of the posters on the TechNet forum:

This behaviour seems to be caused by using the latest version of the shared Office library mso.dll 15.0.4535.1002 from KB2817630 in combination with an outdated version of Outlook. Try installing KB2817503 to update Outlook to the matching version 15.0.4535.1004. I don't have the issue with the missing folder pane in this constellation. Updating Outlook with the August 2013 hotfix (KB2817503) restored the reading pane on multiple machines.

KB 2760411, KB 2760588, and KB 2760583 are parts of the MS13-072 and MS13-073 security patches for Office 2007. There are many reports of the patches being offered and re-offered and re-re- ... you get the idea. On sevenforums, poster harin35 says:

No error messages. Windows Update appears to install them; but the updates have not been installed. These are 'important' updates.When I run Windows Update again, these three updates reappear as 'important' updates.

No guidance for handling the problem is on offer in the usual forums, because the people moderating the forums haven't a clue what went wrong and Microsoft isn't saying a thing.

Again, as of 00:15 am PDT on Wednesday, Microsoft hadn't pulled any of the patches, nor had it updated the KB articles, posted any recommendations on the usual fora, issued a press release, or made one iota of effort to help its customers. 

Does this make you feel warm and fuzzy about automatic app updates in Windows 8.1? Terry Myerson, are you listening?

t/h SB

This story, "Microsoft botches still more patches in latest Automatic Update," was originally published at InfoWorld.com. Get the first word on what the important tech news really means with the InfoWorld Tech Watch blog. For the latest developments in business technology news, follow InfoWorld.com on Twitter.

View the original article here

Microsoft will craft XP patches after April '14 -- but not for you

Just because Microsoft doesn't plan on giving Windows XP patches to the public after April 8, 2014, doesn't mean it's going to stop making those patches. In fact, Microsoft will be creating security updates for Windows XP for months -- years, even -- after it halts their delivery to the general public.

Those patches will come from a program called "Custom Support," an after-retirement contract designed for very large customers who have not, for whatever reason, moved on from an older OS. As part of Custom Support -- which according to analysts, costs about $200 per PC for the first year and more each succeeding year -- participants receive patches for vulnerabilities rated "critical" by Microsoft. Bugs ranked as "important," the next step down in Microsoft's four-level threat scoring system, are not automatically patched. Instead, Custom Support contract holders must pay extra for those. Flaws pegged as "moderate" or "low" are not patched at all.

[ Get all the details you need on deploying and using Windows 7 in the InfoWorld editors' 21-page Windows 7 Deep Dive PDF special report. | Stay abreast of key Microsoft technologies in our Technology: Microsoft newsletter. ]

"Legacy products or out-of-support service packs covered under Custom Support will continue to receive security hotfixes for vulnerabilities labeled as 'Critical' by the MSRC [Microsoft Security Response Center]," Microsoft said in a Custom Support data sheet. "Customers with Custom Support that need security patches defined as 'Important' by MSRC can purchase these for an additional fee.

"These security hotfixes will be issued through a secure process that makes the information available only to customers with Custom Support," the data sheet promised.

Because Microsoft sells Custom Support agreements, it's obligated to come up with patches for critical and important vulnerabilities. And it may be required to do so for years: The company sells Custom Support for up to three years after it retires an operating system.

Custom Support and the XP security updates that result have been one reason why some experts have held out hope that Microsoft will backtrack from retiring XP next April. Their reasoning is straight-forward: Microsoft will have patches available -- its engineers won't have to do any more work than they already committed to doing -- so handing them out to all would be a simple matter.

Or not. Most experts have said that the chance Microsoft will prolong Windows XP's life run between slim and none. And giving away patches to everyone risks a revolt by those big customers who have paid millions for Custom Support.

But Microsoft does have options. Computerworld sees six.

1. Continue patching for free
If Windows XP remains a major presence, as it appears likely, with projections as high as 33.5 percent of all personal computers at the end of April 2014, Microsoft could decide to continue patching the aged OS with free fixes for critical vulnerabilities, maybe even those rated important.

Such a move would be unpalatable to Custom Support customers, but Microsoft could renegotiate the fees -- unlikely -- or remind those companies of the program's other benefits, which include access to support representatives, as well as to prior patches and hotfixes.

View the original article here