Firefox faces browser clone war in China

The browser war in China is heating up but not quite in a way that resembles the Western markets, as Mozilla's Beijing chief explains.

While browser makers in overseas markets often tout their products' Web page rendering speeds and ability to run richer apps, China's browser landscape calls for customized browser versions that bring additional features in order to demonstrate value to users.

According to Li Gong, chairman and CEO of Mozilla's Beijing-headquartered subsidiary, Mozilla Online, the proliferation of Microsoft Internet Explorer (IE) clones and the dominance of pages coded for IE are among some of the barriers Firefox faces in the country.

"China is different from other markets in that there is a very active IE-clone market," said Li, in an e-mail interview with ZDNet Asia.

An IE clone is a browser built on IE's core rendering engine, but carries a different skin and has additional features. Citing numbers from iResearch, Li said there are some 30 different clones in use in China.

Some clone browser makers have employed aggressive tactics to get their browsers adopted, he said. Some have been willing to pay fees to be bundled with pirated Windows disks--"the easiest distribution channel", said Li--while others pay members of the media to tout their wares.

"The most outrageous example is the 360 browser," he noted. Its maker distributes free security software, which upon installation, also stealthily installs the 360 IE clone onto systems and removes other browsers without first seeking user permission, said Li.

"[The 360 browser] makes it very hard to reverse [the implementation] once the software is installed," he added.

Mozilla's answer to the competition is its Firefox China Edition, which integrates a number of services popular among Chinese users, said Li. Examples of such services include IPTV (Internet Protocol TV), music and video, he said.

Mozilla's China team, set up two years ago, also conducts community outreach programs in hopes of educating users on Web standards--a bigger bugbear to Firefox, where the proliferation of IE-optimized pages prevent "even devoted Firefox users" from exclusively using the Mozilla browser, Li noted.

"Most, if not all the large Chinese banks, have online banking [sites] that use proprietary Microsoft ActiveX controls," he explained. "This means that anyone wishing to do online banking has to use IE on Windows."

Furthermore, almost all the country's Web developers test only for IE, resulting in pages that are badly formed and inoperable by browsers using non-IE cores, said Li.

China dominated by IE, clones

According to an online chart citing StatCounter numbers, China stands out with one of the lowest adoption numbers for Firefox globally, at less than 10 percent.

Li would not vouch for the accuracy of the figures, but agreed that China has been "relatively behind" in adoption figures compared to North America and Europe.

Pointing to iResearch figures, he said IE has some 60 percent share of the Chinese market, with more than 20 percent going to IE clones.

Firefox itself has an estimated 7 percent market share, he said, adding that this is higher than the non-IE competition, which includes Opera and Safari browsers.

About 24 million unique users in China use Firefox more than once per month, he said. As of June, China's official statistics show upwards of 338 million Internet users per month, said Li.

Google set to promote Chrome extensions

Google is on the verge of launching a Web site to showcase its extensions to customize what its browser can do.

The company's latest developer preview edition, Chrome 4.0.249.0, promotes the feature on its opening screen and its new-tab page. "New! Google Chrome now has extensions and bookmark sync," the page reads, offering a link to a site that's not public yet, https://chrome.google.com/extensions. (Bookmark sync is already available.)

Extensions and support for Mac OS X and Linux are the headline features of Chrome 4.0. It's available as a beta for Windows, with Mac OS X and Linux beta availability was expected in early December. According to the Chromium development calendar, the beta was planned for December 8 release and the stable release of Chrome 4.0 is due Jan. 12.

A number of third-party galleries for Chrome extensions already are available, but programmers for the project have said on mailing lists that a Google site is planned. Earlier this year, Google shipped a version of Chrome that pointed to a collection of visual themes before the Chrome themes gallery was actually live to the public.

Extensions are a key asset of one Chrome competitor, Mozilla's Firefox; extensions permit people to customize the browser and add new features without burdening the overall project. Firefox is getting a new extensions framework, Jetpack, starting with version 3.7 due in the first half of 2010, and Mozilla has just launched its own Jetpack gallery.

Google to demo Chrome OS; Detail launch plans

Google will give a technical update on its Chrome OS.

The company is holding an event at its Mountain View campus. The event will be “a technical announcement,” but Google will be showing a few demos as well as detailing its launch plans for this year.

The Chrome OS is in its infancy, but there has been a lot of buzz around a potential launch. At the event, Sundar Pichai, Vice President of Product Management, and Matthew Papakipos, Engineering Director for Google Chrome OS, will be talking up reporters.

Garett Rogers has wondered if launching a bare bones preview of the Chrome OS is a concern. He noted:

The initial release of Chrome OS will likely be very bare-bones, bordering on useless — but depending on what kind of feedback they get, it may grow rapidly. The “release early and often” mantra adopted by many software companies that use agile practices can be extremely dangerous, however.

Jabra Stone

Manufacturer: Jabra
Part number: 100-99300000-60


General
Product Type - Headset - Bluetooth 2.1 EDR

Width - 2 in


Depth - 1 in


Height - 2.3 in


Weight - 0.2 oz


Recommended Use - Cellular phone


Compatible Mobile Devices - Bluetooth devices


Additional Features - Multiuse, Voice dialing, Volume control, Answer/end button, Battery level indication, Noise Blackout Extreme technology


Headphones


Headphones Type - Headphone - Monaural


Headphones Form Factor - Over-the-ear


Connectivity Technology - Wireless - Bluetooth 2.1 EDR


Sound Output Mode - Mono


Microphone


Type - Built-in


Microphone Operation Mode - Omni-directional


Remote Control
Type - None


Wireless Link
Transmission Range - 33 ft


Miscellaneous
Included Accessories - Portable charging unit, Belt cup, AC charger, Earge


Power
Power Device - Headset charging stand - External


Battery - Headset battery - Rechargeable


Run Time (Up To) - 8 hour(s)


Standby Time - 288 hour(s)


Manufacturer Warranty


Service & Support - 1 year warranty


Service & Support Details - Limited warranty - 1 year

CNET Review

The Good: The Jabra Stone has a one-of-a-kind design that combines a headset with a portable charger. The headset fits easily over the ear and is small enough not to be noticed. Features include multipoint technology and A2DP streaming.

The Bad: The Jabra Stone's controls are difficult to use; we wish it had a snugger fit; and the call quality could be improved. It also fits around only the right ear.

The Bottom Line: While we love the style, portability, and feature set of the Jabra Stone, it does suffer from a few design and performance issues.

Source code for Skype eavesdropping trojan in the wild

Earlier this week, Swiss programmer Ruben Unteregger who has been reportedly working for a Swiss company ERA IT Solutions responsible for coding government sponsored spyware, has released the source code of a trojan horse that injects code into the Skype process in order to convert the incoming and outgoing voice data into an encrypted MP3 available at the disposal of the attacker.

Here’s how the trojan, currently detected as Trojan.Peskyspy, works:


“When the Trojan is executed, it injects a thread into the Skype process and hooks a number of API calls, allowing it to intercept all PCM audio data going between the Skype process and underlying audio devices. Note: Since the Trojan listens to the data coming to and from the audio devices, it gathers the audio independently of any application-specific protocols or encryption applied by Skype when it passes voice data at the network level.

Note: The incoming and outgoing audio data are stored in separate .mp3 files. The Trojan also opens a back door on the compromised computer, allowing an attacker to perform the following actions:
- Send the .mp3 to a predetermined location
- Download an updated version
- Delete the Trojan from the compromised computer”

Skype is often dubbed a “national security threat” by governments all across the globe due to their — at least publicly acknowledged — inability to crack the 256-bit encryption VoIP calls.

And while some of these governments are reportedly spending surreal amounts of tax payer’s money (Rental of the Skype-Capture-Unit per month and instance EUR 3.500) in order to achieve their objectives, others are taking the cost-effectiveness path by attacking the weakest link in the process - the end user infected with a targeted DIY government sponsored spyware recording all ongoing and incoming Skype calls, thereby bypassing the need to attack the encryption algorithm.

Thousands of web sites compromised, redirect to scareware

According to eSoft, they’ve been monitoring the campaign since September, with another 720,000 affected sites back then.

There are now over a million affected sites serving scareware, with only a small percentage of them currently marked as harmful. Google has been notified. As always, NoScript and your decent situational awareness are your best friends.

Security researchers have detected a massive blackhat SEO (search engine optimization) campaign consisting of over 200,000 compromised web sites, all redirecting to fake security software (Inst_58s6.exe), commonly referred to as scareware.

More details on the campaign:


The compromised sites are hosting legitimately looking templates, using automatically generated bogus content, with a tiny css.js (Trojan-Downloader.JS.FraudLoad) uploaded on each of them which triggers the scareware campaign only if the visitor is coming a search engine listed as known http referrer by the gang - in this case Google, Yahoo, Live, Altavista, and Baidu :

“Cyveillance has discovered a complex attack vector that uses Google search results to distribute malicious software (malware) to unsuspecting Internet users. Using this attack vector, users click on links within Google search results and are routed to sites that attempt to download malware to their computers. The attack method also relies on inattentive webmasters who do not update the software on their sites and often unknowingly provide the material that appears in the search results.

The common string albums/bsblog/category is found in the URLs for all these blogs. By simply using the Google search parameter allinurl, along, you can see how many other sites contain the same string. As can be seen in the image above, more than 260,000 URLs are presented in Google’s search index leading to blogs similar to the ones illustrated in our example.

As you can see, only a small portion of sites in the search results carry a warning provided by Google. The reason for the small number of warnings is likely because the actual attacks do not take place on the website URLs in the search results, but on the sites you’re redirected to thereby decreasing the chances that Google will designate the destination sites as harmful.”

At first, it would appear that the campaign is an isolated one and is maintained by a cybercrime enterprise yet to be analyzed. However, analyzing it reveals a rather anticipated connection - the massive blackat SEO campaign has been launched by the same people who operate/or manage the campaigns for the Koobface botnet. For instance, the domains mentioned by Cyveillance, as well as the newly introduced ones over the past couple of hours, are the very same domains currently embedded on Koobface infected hosts.

Go through related posts - The ultimate guide to scareware protection; My scareware night and how McAfee lost a customer; Scareware scammers hijack Twitter trending topics; 9/11 related keywords hijacked to serve scareware; Koobface Botnet’s Scareware Business Model - Part One; Koobface Botnet’s Scareware Business Model - Part Two
How did they manage the compromise the sites? Through web application vulnerabilities as the attack vector, with OWASP’s recently updated Top 10 most critical web application security risks, highlighting some of the riskiest ones.

What's next for Microsoft's Azure cloud platform?

In the past year, customers and developers testing Windows Azure have been running primarily brand-new (and largely Web 2.0 style) apps on Microsoft’s cloud operating system. But when will Azure be tuned to handle host legacy enterprise apps? And when and how will users be able to take advantage of some of the Azure technologies inside of their own “private clouds”?

Microsoft officials didn’t share dates for its next phases of the Windows Azure platform. But they did talk about some of their plans for their next steps with Microsoft’s cloud platform during meetings and sessions at the company’s Professional Developers Conference (PDC) on November 17.

Microsoft said the Windows Azure platform — which is the Windows Azure operating system and the SQL Azure database — is feature-complete as of today. (Officials said a few weeks ago that Microsoft wouldn’t begin charging customers to use the platform until February 1, 2010.)

“Our initial focus on the platform was on enabling Web 2.0 customers to develop and run their apps on it,” said Amitabh Srivastava, Senior Vice President in charge of Windows Azure. These kinds of applications are Xcopy-deployable, while older, legacy apps typically are not, Srivastava said.

Microsoft’s next Azure steps — which it will be executing largely in parallel — will be to get existing, and typically more complex, line-of-business apps to run on the platform and to make it possible for customers to implement Azure technologies in their own data centers (a k a, to be able to create private clouds).

To enable existing apps to run on Azure, Microsoft is planning to make virtual machines (VMs) available to developers, which they will be able to customize and run their legacy apps inside them. Srivastava wouldn’t provide a timetable or more details as to how or when Microsoft will do this. Apps running in VMs won’t be able to take full advantage of the elasticity, multitenancy, and other cloud functionality, but they still will derive some benefits, such as automatic cloud backup for apps running on the Azure platform. (The name of this VM capability will be “Windows Server Virtual Machine Roles on Windows Azure,” Microsoft execs later told me.)

On the private cloud front, Microsoft didn’t have much new to say at the PDC. Microsoft officials have said in the past that Microsoft won’t allow customers to run the Azure operating system in their own datacenters. Microsoft’s main focus here continues to be to provide customers with software like Windows Server, SQL Server, Exchange Server, etc., for them to run in their own datacenters. That said, Microsoft isn’t simply leaving the delivery of a private cloud solution to Amazon and other cloud competitors.

“Lots of the technologies we have in the cloud are things people want to run in their datacenters,” Srivastava
acknowledged.(He cited as an example the ability to run a scalable cloud-storage appliance on premises.)

Microsoft is working on a longer-term solution that would allow the company to offer datacenter containers that can be dedicated to individual customers, Srivastava said. That way, clouds can be customized for individual users and users will be able to manage these containers themselves. Again, Srivastava wasn’t ready to talk about deployment specifics or timetables for this. That said, “Project Sydney” (Microsoft’s newly announced connectivity offering for private datacenters and public clouds) shows the general direction where we are going,” Srivastava said.

Microsoft officials made a vague reference in this morning’s keynote to System Center in the cloud. I asked Srivastava if this meant Microsoft was looking to offer System Center as a Microsoft-hosted service, the way that it is offering Exchange and Office Communications Server as Microsoft-hosted offerings. That isn’t the case, he said; instead, Microsoft has opened up the Windows Azure management programming interfaces so that System Center — as well as third-party management products like HP OpenView — can manage Azure-hosted applications.

Not everything about what’s next for Azure is a longer-term direction. In sessions on November 17, Microsoft officials outlined some of the nearer term deliverables for Microsoft’s cloud platform. The recently introduced content-delivery-network (CDN) support for blobs in Windows Azure’s storage system is one of those deliverables. Another is a capability Microsoft is calling “Windows Azure Drive” (also known as Xdrive) which allows Azure developers to create a drive inside their virtual machines, providing them with an automatic back up capability. Microsoft plans to officially “turn on” Xdrive support in January, officials said.