Every year at the CanSecWest security conference in Vancouver, Hewlett-Packard (NYSE: HPQ) runs the Pwn2Own hacking competition where big cash prizes are delivered for browser exploits.

This year no browser proved to be unhackable. The big winner of the contest was South Korean security researcher JungHoon Lee, who developed exploits for Internet Explorer and Chrome on Windows as well as Safari on OSX. For that, he walked away with $225,000 in cash.

Lee’s attack on Chrome exploits a buffer overflow race condition in Chrome, then uses an info leak and race condition in two Windows kernel drivers to get SYSTEM access according to HP’s Security Research blog. This attack bypasses the anti-exploit mechanisms included in Chrome, such as sandbox and address space layout randomization which has made the browser one of the more secure browsers.

“With all of this, lokihardt managed to get the single biggest payout of the competition, not to mention the single biggest payout in Pwn2Own history: $75,000 USD for the Chrome bug, an extra $25,000 for the privilege escalation to SYSTEM, and another $10,000 from Google for hitting the beta version for a grand total of $110,000,” Pwn2Own organizers wrote in a blog post. “To put it another way, lokihardt earned roughly $916 a second for his two-minute demonstration.”

Lee also demonstrated a viable Internet Explorer 11 attack. This attack bypassed Internet Explorer’s sandbox through something called a time-of-check to time-of-use (TOCTOU) vulnerability, which allows for elevated execution of Java Script. This earned Lee another $65,000.

Finally, Lee demonstrated an exploit for Safari with a use-after-free (UAF) vulnerability in an uninitialized stack pointer in the browser and bypassed the sandbox for code execution.

Firefox was hacked on the first day of the contest using via a out-of-bounds read/write vulnerability leading to medium-integrity code execution vulnerability.

All of the exploits were disclosed to the vendors after the conference. The vendors will be given time to patch the exploits before the code is released to the public.

The post No Browser Was Safe at Pwn2Own 2015 appeared first on VR World.

With Windows 10, Microsoft (NASDAQ:MSFT) will be introducing a brand new browser codenamed Project Spartan, with Internet Explorer finally set to become obsolete. The browser will continue on as an alternative, mainly for enterprise customers, but for other users Project Spartan will be the go-to browser.

Microsoft’s marketing chief Chris Capossela announced during the Microsoft Convergence event yesterday that the manufacturer was working on a new name and brand for the Porject Spartan browser. Some of the new features that are set to be ushered in with Project Spartan include a new Edge rendering engine that can parse HTML markup directly, with the ability to also load legacy IE11 websites.

The browser will be delivered as a universal app, which means that for the first time, the same version of the browser will be available on Windows 10 as well as Windows 10 for phones. Considering Microsoft’s One Windows vision, it is possible a slimmed-down variant of the browser will be available for Xbox One as well. Ability to update directly from the store means that Microsoft can introduce new features without having to roll out an OS update. Also available in Spartan is extension support, and Cortana is also highlighted as an integral feature in the browser.

One of the main reasons in ditching the Internet Explorer brand is the negative connotation it carriers in the tech world. Microsoft tried to shake off the negative image of the browser by rolling out commercials, but ultimately failed to challenge the growing dominance of Chrome and Firefox. With Windows 10 heralding a new direction for Microsoft as a whole, Redmond is now looking to start afresh in the browser segment as well.

Microsoft is yet to figure out a name for Project Spartan, although it is likely given market research trends that it will feature Microsoft’s brand name in front of it. Microsoft Spartan, anyone?

The post Microsoft To Ditch Internet Explorer Brand In Favor Of Project Spartan For Windows 10 appeared first on VR World.

In a move that may seem all too familiar to long-serving Microsoft (NASDAQ: MSFT) executives, another government has announced that it is investigating Microsoft for anti-competitive practices — this time in China.

In a briefing and public statement released by authorities, Zhang Mao, chief of China’s State Administration for Industry and Commerce, said that Microsoft was being investigating for bundling both its browser and media player into copies of Windows.

“Microsoft is suspected of incomplete disclosure of information related to Windows and Office software, as well as problems in distribution and sales of its media player and browser,” the statement read.

This is far from the first time Microsoft has been under the gun from governments for bundling software. Famously, the company was the target of antitrust regulators in the United States with the ‘United States v. Microsoft’ case near the turn of century for bundling Internet Explorer with Windows, giving Microsoft what prosecutors called an “unfair advantage” in the browser wars of the 1990s. Similar cases were brought against the company in the European Union and Korea for media player bundling, which resulted in special versions of the operating system being developed for those regions that come sans media player.

In an era of Firefox and Chrome and a plethora of mobile devices that are decidedly non-Microsoft, the very notion of a browser monopoly is archaic. However, in China, on desktops Microsoft’s Internet Explorer has considerable clout with 27.8% of the market, 12.5% of that using Internet Explorer 6.

Kicking out the foreigners

Over the past year, China’s government has undertaken an aggressive campaign to make the Chinese market as hostile as possible for foreign consumer goods and tech companies while giving local firms an arm up.

In the case of Microsoft, China, undoubtedly would like to lessen its dependence on a foreign product. According to a report from The Guardian, China is seeking to do just that by developing its own operating system.

“Creating an environment that allows us to contend with Google, Apple and Microsoft – that is the key to success,” Ni Guangnan from the Chinese Academy of Engineering, who is spearheading the project, told The Guardian. “You must change the past approach, instead of copying the previous model integrate the resources accumulated in the past with a state-run unified operating system.”

But for Chinese consumers, quality and compatibility means everything. When presented with a state-produced operating system that’s unproven, likely buggy, and has limited compatibility instead of the tried and true Microsoft Windows it’s easy to guess which one they might prefer.

The post China May be Close to Its ‘United States v. Microsoft’ Moment appeared first on VR World.

The Internet Explorer of modern times is a much different beast than the one of yore.

The browser that was once synonymous with a poor websurfing experience is a much better product than it once was, and, as a sign of the times, often outperforms the rivals that were built to crack its monopoly. But for many, the very idea of using Internet Explorer gives a perception of going back to a time of poor rendering, security holes, and ActiveX errors — which Microsoft is well aware of and at one time considered addressing via a change of the browser’s name.

In an Ask Me Anything session on Reddit Friday, Microsoft engineer Jonathan Sampson said that the Internet Explorer team was aware of their browser’s negative perception and considered a change of name.

“It’s been suggested internally; I remember a particularly long email thread where numerous people were passionately debating it,” Sampson said. “Plenty of ideas get kicked around about how we can separate ourselves from negative perceptions that no longer reflect our product today.”

Sampson said later during the crowd-sourced interview that he, and the team, are bothered that some may choose to use another browser because of experiences — and perception — that were generated when using a much earlier version of the product.

“It’s not a nice feeling. Especially knowing that often times the decision to not use Internet Explorer is largely based on experiences from a decade ago, and a much different IE,” he added. “That being said, we know it’s our job to change the public perception, and to win the hearts of users every where. Each people to open IE, and download another browser, is another person we’ll be working even harder tomorrow to win back.”

For Microsoft, a slick rebranding campaign might be what the company needs to improve the image of Internet Explorer amongst users. Consider the exodus of users to Mozilla’s Firefox after the Spread Firefox campaign. Many left because the Internet Explorer of the time had numerous gaping security holes that Microsoft was slow to address; Mozilla’s community driven open source nature could rapidly address any vulnerabilities that may spring up. Now, it’s Firefox that’s the most insecure browser of the lot year-over-year with it earning the dubious distinction of being the most hacked at the Pwn2Own competition during CanSecWest.

In an era where the statues set in United States vs. Microsoft, the antitrust case where the browser played a central role, have long since expired, Microsoft’s Internet Explorer is a much better product than it once was. Perhaps it’s time for the company to separate the past from the present, and give it a new lease on life through a re-branding.

The post Internet Explorer’s ‘Negative Perceptions’ Once Prompted Microsoft to Consider a Name Change appeared first on VR World.

So, even though Microsoft categorically denies doing anything of any sort, I and many of you know that most of what Microsoft does is usually through 3rd parties like SocialChorus that are contracted to take all of the blame for Microsoft in the event that they say something wrong or get caught doing something wrong. And as long as there’s no smoking gun, Microsoft is basically off the hook. So, it came as no surprise that Microsoft got caught trying to pay people for positive posts about Internet Explorer, a browser that is already on its way up from being considered the bottom feeder of the IT world.

However, TechCrunch recently discovered that a Twitter employee (and someone I follow on Twitter) recently stated that Microsoft tried to get him to post positive things about IE for money. As did Michael Arrington, one of the founding members of TechCrunch until he moved on to ‘bigger and better’ things.

Today Microsoft offered to pay me to blog about Internet Explorer. There’s not enough bitcoin in the world..

— Paul Stamatiou (@Stammy) June 17, 2014

So, naturally, Microsoft denied any wrongdoing and stated, “action by a vendor is not representative of the way Microsoft works with bloggers or other members of the media,” and that the “program has been suspended.”

But the truth is that Google has already caught on to what Microsoft has been doing and has notified both Microsoft and SocialChorus that they are investigating the manner and could penalize them for having done so. In fact, Google have penalized themselves for posting Chrome ads on Google and as a result for quite a bit of time Chrome was essentially impossible to search on Google. Sure, this is a merely procedural thing and Google will never fully block their own products from being seen, but you get the point. There is a very high chance Google could penalize both SocialChorus and Microsoft for having partaken in these activities and could result in more of a negative impact for IE than if they just let people use it and realize how much better it has gotten. I know I definitely like using it more now than I ever have in the past. (no, I did not get paid to say that)

The post Microsoft Pays People to Say Good Things About IE appeared first on VR World.

Internet Explorer has had a pretty bad reputation over the years as a pretty awful browser, and from the IE6 through the IE9 days, that was a pretty accurate statement. However, nowadays Internet Explorer is fairly good and the only browser on Windows worth anything for touch. The guys and gals over at FireEye managed to discover this Zero Day Exploit and dubbed the entire operation, “Operation Clandestine Fox.” They claim that this zero day exploit targets IE9 through IE11 browsers, which make up about 26% of all browser users around the world which is pretty significant. Microsoft has also put out a security bulletin on the issue stating that users using IE6 through IE11 could be affected, which would broaden the scope of this issue by millions more users.

While Microsoft claims this issue is occurring in “limited attacks” the potential for this attack to grow is now exponentially greater now that the issue has been discovered but not yet fixed. We don’t know the details of how long FireEye waited to let Microsoft resolve this issue before they announced it, but I have a feeling they didn’t just post about it and expect Microsoft to deal with the repercussions. Microsoft is a much more serious company when it comes to security, which is what makes this IE zero day vulnerability all the more puzzling. The fact that such a zero day has managed to exist through potentially all versions of IE and only get caught now is also a bit suspicious (now that we live in the post-Snowden era where anything could be deliberate).

The vulnerability itself as described by the FireEye team is that the exploit leverages a previously unknown use-after-free vulnerability as well as a well-known flash exploit to achieve arbitrary memory access and bypass Windows’ ASLR and DEP protections. What this ultimately means for users is that if you’re using Internet Explorer right now, you should probably stop doing so and switch to Chrome or Firefox until this issue gets resolved. Personally, I use four different browsers simultaneously, but I don’t really recommend that to anyone, especially in this case. If you must absolutely use Internet Explorer, then you should disable Flash (or uninstall it) and use your browser with a proper anti-virus application, even though it would just be easier to use Chrome or Firefox in the meantime.

The post Time to Run and Hide from Internet Explorer, For Now appeared first on VR World.

Browser wars are back, and they’re back in full strength: who is going to win? Mozilla Firefox leads the market share of alternative browsers and in some countries, such as Germany – enjoys leading market share. Google’s Chrome came out of beta, and then returned to beta status within the same year (1.0 beta becomes 1.0 – and 2.0 beta arrived this week) , while Apple made great progress forward with more stable and mature Safari. Version 4 is currently the leading browser in recently released Peacemaker, browser benchmark from “The Flying Finns” (Futremark).

So, what is Microsoft doing? Releasing its last internet browser based on current Internet Explorer technology. IE8 is the default web browser for Windows 7, but it is removable due to the completely new browser engine coming in late 2010.

IE8 was released some hours ago, and this version of “Exploder” will have to hold the fort for Microsoft until the next-gen technology debuts. If you want to try IE8, head over to official Microsoft’s Internet Explorer 8 download page or go to alternative sites such as TechPowerUp! or Softpedia.

The post Microsoft releases IE8: Last gasp or a fresh start? appeared first on VR World.