By Wolfgang Gruener
Chicago (IL) – Microsoft was not able to slow the market share loss of its Internet Explorer (IE) web browser in December. IE surrendered more than 1.5 points in December, according to Net Applications, while Firefox, Chrome and Safari posted substantial gains. Over the past 12 months, IE has lost almost 8 points, leaving the browser with the least amount of market share since 1999.
Net Applications released updated global browser market share numbers today, indicating that IE is losing users at an accelerated pace. The browser’s share dropped from 69.77% in November to 68.15% in December. Most rivals were able to pick up a portion of what IE surrendered. Firefox gained more than half a point and ended up at 21.34%, Safari approaches the next big hurdle with 7.93% and Chrome came in at 1.04%, the first time Google was able to cross the 1% mark. Opera remained stable 0.71%, but it is clear that the Norwegian browser cannot attract any users IE loses.
Over the past 12 months, IE gave up 7.9 points of market share, while Firefox gained 4.5 points and Safari nearly 2.4 points. Chrome, released in September of this year, is an entirely new player and Opera was able to add 0.7 points to its usage share and remains just above Netscape, which is still listed at a slowly declining 0.57%.
As reported previously, the main reason for IE’s market share loss remains the installed base of corporate IE6 users (and some home users), which is where Microsoft’s browser is most vulnerable at this time. While IE7’s market share has not declined much (from about 45% during the week and about 50% on weekends in the beginning of the year to about 44% during the week to 48% on weekends at the end of the year) and IE8 Beta 1 and 2, released in March and August of 2008, have grown to 0.96% share, IE6 is declining rapidly and at a much faster pace than IE7 and IE8 are able to gain.
Since IE6 is used primarily within corporations, its market share is much higher during the week than it is on weekends. As a result, all other browsers gain on weekends and especially during a holiday. Because of that circumstance, Net Applications noted that the December numbers should be taken with a grain of salt. However, it is worth the note that IE6 achieved during the week market share numbers of about 28% during the week and about 21% on weekends in early 2008. In December, these numbers were down to about 20% during the week and 15% on weekends.
There are very few browser market share numbers available that would provide a credible and especially comparable indication how IE’s market share has evolved in the late 1990s and early 2000s. However, based on what we were able to dig up, there seems to be an agreement that IE5 was IE4 that took Microsoft to about 60% in early 1999 and IE5 (released in March 1999) lifted the browser’s market share above 70% by early 2000.
The market share loss of IE6 is a problem Microsoft will have to address soon, if the company remains serious about the browser market, especially if it intends to fine tune the browser to work well with its cloud operating system Windows Azure. As far as we can see right now, IE8 will not be able to stop the bleeding, as it follows the same design ideas Microsoft has had in place with previous browsers. While Apple, Mozilla and Chrome have found effective ways to quickly transition their users from an older browser to a newer software, Microsoft is clearly struggling to move users from IE6 to a more recent version.
For example, Firefox 2.0 usage share has been declining consistently over the past six months, from about 17% in the beginning of June to currently about 3.3%. In the same time, Firefox 3.0 climbed from less than 1% into the 18-19% range.
Original here
Saturday, January 3, 2009
PlayStation 3 used to hack SSL, Xbox used to play Boogie Bunnies
by Joseph L. Flatley
Between the juvenile delinquent hordes of PlayStation Home and some lackluster holiday figures, the PlayStation has been sort of a bummer lately, for reasons that have nothing to do with its raison d'etre -- gaming. That doesn't mean that the machine is anything less than a powerhouse -- as was made clear today when a group of hackers announced that they'd beaten SSL, using a cluster of 200 PS3s. By exploiting a flaw in the MD5 cryptographic algorithm (used in certain digital signatures and certificates), the group managed to create a rogue Certification Authority (CA) which allows them to create their own SSL certificates -- meaning those authenticated web sites you're visiting could be counterfeit, and you'd have no way of knowing. Sure, this is all pretty obscure stuff, and the kids who managed the hack said it would take others at least six months to replicate the procedure, but eventually vendors are going to have to upgrade all their CAs to use a more robust algorithm. It is assumed that the Wii could perform the operation just as well, if the hackers had enough room to spread out all their Balance Boards.
Original here
Original here
MD5 collision creates rogue Certificate Authority
by Scott Merrill
At the 25th Chaos Communication Congress (CCC) today, researchers will reveal how they utilized a collision attack against the MD5 algorithm to create a rogue certificate authority. This is pretty big news, so read on.
When you make a secured connection to a website via HTTPS, a public key certificate is sent from the server to your computer. This certificate contains a digital signature which your computer uses to verify the identify of the site to which you’re connecting. Certificates are “signed” by a Certificate Authority (CA), which acts as a kind of middle-man: you trust the CA, so you can trust the certificates signed by the CA. Anyone can create a certificate authority, though, so most browsers have a list of known reputable and trustworthy CAs. When your computer gets a certificate from a server, your browser checks the CA that issued it to determine whether the CA is trustworthy. If the CA is trustworthy, your browser assumes that the certificate being presented is trustworthy.
The public key cryptography utilized by Certificate Authorities is evolving, as are most things in the technology world. Some CAs used the MD5 algorithm to compute the digital signatures for certificates. MD5 has been known for some time to be weak against collision attacks, but running a CA is a pretty complex operation, so the entities behind them are slow to change.
Researchers attacked the MD5 algorithm using 200 PlayStation 3 systems and were able to construct a bogus Certificate Authority that looks like a known trusted CA. What this means is that these guys could generate a certificate for www.amazon.com which, when presented to your browser, would be accepted as the real thing. The digital signature on the fake certificate is listed as coming from a supposedly reputable CA, so your browser happily accepts it, reassuringly showing you the little padlock icon.
Okay, so how does this affect you? If the researchers’ results can be duplicated by a malicious agent, they could generate any number of certificates that would be trusted by browsers all around the world. This alone might be sufficient, though this attack could be coupled with a sophisticated DNS attack to make it really really really hard for anyone to realize that they’d been suckered. Your browser would report that you’re at yourbank.com; your browser would report that you were using HTTPS to protect the connection; and your browser would report that the SSL certificate being used for that HTTPS connection really did belong to yourbank.com. Granted, the level of effort required to perform such an attack is currently enormous, and the potential gains are probably limited, so it’s likely not the kind of thing that would be pulled on average Internet users. But it’s still something about which to be concerned.
The attack outline states “[w]ith optimizations the attack might be done for $2000 on Amazon EC2 in 1 day.” Thankfully, the researchers are not releasing their specific implementation. That’s somewhat reassuring, but expect conniving folks somewhere to try to recreate the researchers’ results for less academic purposes.
The PDF concludes with this: “No need to panic, the Internet is not completely broken” and assures us that the “affected CAs are switching to SHA-1″. SHA-1 is believed to be weak against certain attacks, though, so it might be better for the vulnerable CAs to jump right to SHA-2 or SHA-3.
Bottom line: as always, be cognizant of your browsing habits. If something looks or feels fishy, don’t provide any account names or passwords. Use different passwords for different websites, so that if you do get suckered by a phishing attack the phishers don’t get the keys to your online kingdom.
Original here
Subscribe to:
Posts (Atom)
