Teen finds bugs in Google, Facebook, Apple, Microsoft code

When he's not at school, 15-year-old Cim Stordal spends his time playing the Team Fortress video game, shooting his Airsoft pellet gun, and working in a fish shop in Bergen, Norway. But his real passion is finding bugs in software used by millions of people on the Internet.

Stordal has made the Google Security Hall of Fame, been credited with disclosing a cross-site scripting bug to Apple, been thanked by Microsoft for disclosing a vulnerability to the company, and received an elite White Hat Visa card from Facebook with $500 credit on it.

"I got a card for a self-persistent XSS [cross-site scripting flaw] at Facebook, and a nonpersistent XSS at Google, Microsoft, and Apple," he said in a recent Skype interview with CNET. (As a "self-persistent" issue, the bug Stordal disclosed was not exploitable by a third-party because it required a user to take an action to be at risk, according to Facebook.)

"I just look around at the site and find out where I can input HTML and stuff and it's not filtered in the source code. Often they filter some characters but forget some or they totally forget that input," he said. "What an attacker wants is often the cookie, which can be used to log-in as the user."

Stordal says of the sites he poked around in, Apple was the easiest to find a flaw in. "I found the Facebook [hole] after four days and the Google one after three, but Apple took me only five minutes" to find two XSS flaws, he said. (Apple representatives did not respond to a request seeking comment.)

Cim Stordal shows off the White Hat Visa card he received for disclosing a vulnerability to Facebook.

(Credit: Cim Stordal)

The companies appreciate his efforts, particularly because he tells them before going public with any of the details. "Everyone was happy about it and fixed the flaws kind of fast."

Stordal started looking for vulnerabilities in software when he was 14 years old. "I have always loved being on the PC and I already was programming some C++," he said. "So I wanted to do something new and I searched around and learned Basic."

His friends are impressed with his skills and lean on him to help keep their Web sites secure. His parents aren't really sure what to make of his research.

"They think it's kind of cool, I guess, as they don't understand what I do," he said. "But they also don't want me to stay on the computer all day."

His next move is looking for vulnerabilities on mobile devices. He's trying to set up a fuzzer (automated software testing tool) on his iPhone 3GS.

Read more »

Posted in: Apple,Ask me,Facebook,Google,Microsoft

Will Verizon ever get a 4G Windows Phone?

Verizon customers may have more 4G LTE Google Androidsmartphones to choose from than subscribers on any other U.S. carrier, but when it comes to a Microsoft Windows Phone devices, forget it.

The pickings for Windows Phone smartphones are pretty slim when it comes to Verizon Wireless and even No. 3 carrier Sprint Nextel. So what are interested consumers to do? Ask Maggie offers some advice and some predictions on when these carriers will offer more devices using Microsoft's mobile OS.

The long wait for a Verizon Windows Phone with 4G LTE

Dear Maggie,
I'm a Verizon customer, bogged down by a family plan where the contract on each line renews at a different time and a location where Verizon is the only network with good coverage. I am eligible for a new phone in about two months, and my phone is gimping along toward the finish line. I'm a current Android user, but haven't been impressed with the platform and am looking for a change.

Apple is out (for reasons unrelated to the phones themselves), and recent positive reviews of Windows Phones have made me really eager to switch. But it's got to be 4G. Verizon has nothing like this now, and I read in your column a few weeks ago that Verizon execs weren't "chomping at the bit" to get new Windows phones. Any updates, or predictions on when Verizon might get more Windows phones--or should I resign myself to another two years of Android fragmentation?

Thanks so much,
Connie

Dear Connie,
I am afraid I don't have a clear idea when Verizon will be getting more Microsoft Windows Phones. But I suspect that if your current cell phone is on the fritz it probably won't be soon enough for you.

I haven't seen anything in the market over the past few weeks to indicate that Verizon executives are preparing for a new crop of Microsoft Windows Phones.

Verizon has not had a great relationship with Microsoft. In 2010, Verizon launched Microsoft's pre-Windows Phone device, the Kin. This was supposed to be a mid-range "messaging" device geared toward heavy text message users. The device was a big flop. Within months of introducing the product, Verizon canceled it and took it off its shelves.Since then, Verizon executives haven't been excited about new Microsoft products. Last year at Mobile World Congress in Barcelona, Verizon's chief technology officer, Tony Melone admitted he had doubts that Microsoft could "get the traction they are hoping for with Windows Phone 7."

Nearly a year has passed. Microsoft has updated its software and launched its first phones from Nokia. The new software and phones have gotten high marks from reviewers. But Verizon still doesn't seem excited about Windows Phone devices.

The company quietly put out one Windows Phone handset in the market in 2011. And in December when Verizon Wireless Chief Marketing Officer Marni Walden met with CNET, shedidn't seem that interested in adding more devices.

The big hang up for Verizon is that until Nokia's new Lumia 900, no Windows Phone supported 4G LTE. And for Verizon, that is the most important element for its new phones.

"We've communicated to Microsoft that LTE is critical to us," Walden told my colleague Roger Cheng in an interview in December. "We need to see a timeline that makes sense if we want to continue to represent them."

But now that Microsoft has put LTE into a smartphone, the Nokia Lumia 900, which will soon be available on AT&T's network. But so far there has been no announcement of an LTE Windows Phone for Verizon.

Despite it's rocky relationship with Microsoft, I think that Verizon will eventually carry more Windows Phone devices. And those smartphones will support LTE. But the question is when. My guess is that the earliest we might see new LTE Windows Phones for Verizon is this summer. But Verizon may hold out for the newest update to the Windows Phone software.

On Thursday, details of Windows 8, code-named Apollo, were leaked. The new software, which is not expected to show up in devices until the fourth quarter, will support multicore processors, four different screen resolutions, a removable microSD card, and near-field communication, according to the latest leaks. It may also include tight integration with Skype.

The software will also integrate nicely with Windows Phone 8 for the desktop and for tablets. The idea is that app developers will be able to create apps that can operate on smartphones as well as tablets and ultrabooks.

The new software will bring Windows Phone on par with Google Android handsets, which have already been supporting dual-core processors, NFC and 4G LTE.

So what should you do? If you really want a Windows Phone from Verizon, you can wait. But prepared for the fact that you may have to wait six to nine months for a device that supports 4G LTE. If you can't wait, then unfortunately, a new Google Android device is your only option, given you must have an LTE phone and you are unwilling to get an Apple iPhone. (Besides, the iPhone doesn't yet offer LTE.)

Sorry to disappoint you and good luck!

Windows Phone or iPhone on Sprint?

Dear Maggie,
My contract recently ended with Sprint and I want to get a smartphone. This would be my first one, but I'm torn between getting a Windows Phone or an iPhone. I currently have an aging second generation iPod and an iPad 2 with a lot of apps and music. Though I'm used to the Apple OS, I'm really interested in the Windows OS, but with only one option for Windows Phone I'm not sure if its the right choice. What should I do?

Thanks,
Joe

Dear Joe,
You are correct that there is only one Microsoft Windows Phone on Sprint's network at this point. And I don't expect the company to offer anymore until around August or September. Like Verizon, Sprint doesn't seem to have much enthusiasm for Windows Phone. Sprint seems to be waiting for the platform to gain more traction.

But it can't be underestimated how much Sprint has bet on the Apple iPhone. The company has staked its whole future on the success of the iPhone. To get the iPhone, Sprint had to promise Apple it would sell a certain volume of iPhones.

Because it subsidizes every smartphone it sells to its subscribers, Sprint initially eats the cost of the devices it sells. It eventually makes the money back from the subsidy over the life of a subscriber's contract. Still, in order to get the iPhone, Sprint promised to pay Apple at least $15.5 billion over the next four years for the iPhone, according to Reuters.

This is a high price, especially considering that there are two other carriers selling the iPhone.

So what should you do? Should you buy the one and only Windows Phone currently available on Sprint or go with the iPhone 4S? Considering that the HTC Arrive, Sprint's only Windows Phone available through a contract, is almost a year old, I'd have to say that you should probably go for the iPhone.

The fact that you already own several iOS devices also helps push you further in the iPhone camp. Also you're already familiar with the apps and the software from your iPad 2.

That said, if you're on a tight budget and you don't think you need the most cutting edge technology and you can live without certain apps that may not yet be available on the Windows Phone platform, then get the HTC Arrive. It's only $50 with a two-year contract with Sprint, compared to the $200 you will spend for a new iPhone 4S.

I hope this advice was helpful. And good luck!

Ask Maggie is an advice column that answers readers' wireless and broadband questions. The column now appears twice a week on CNET offering readers a double dosage of Ask Maggie's advice. If you have a question, I'd love to hear from you. Please send me an e-mail at maggie dot reardon at cbs dot com. And please put "Ask Maggie" in the subject header. You can also follow me on Facebook on my Ask Maggie page.

Read more »

Posted in: Microsoft,Windows

Google Privacy Creeping You Out? Microsoft Says it Has Alternatives

If you’ve been thinking Google’s privacy changes have gone too far, you’re not alone — Microsoft is with you.

Frank X. Shaw, VP of corporate communications for Microsoft, wrote in an Official Microsoft blog post Wednesday that the company noticed Google loyalists seeking alternatives in much of the web discussion following the privacy update. The PC giant, Shaw writes, has several options for those looking to escape Google and its popular line of products.

Microsoft attempts to position its web services as the anti-Google, informing new and former users that the company’s products value the users’ interests.

“The changes Google announced make it harder, not easier, for people to stay in control of their own information,” Shaw writes. “We take a different approach – we work to keep you safe and secure online, to give you control over your data, and to offer you the choice of saving your information on your hard drive, in the cloud, or on both.”

Microsoft recommends email provider Hotmail, which doesn’t display ads based on your private conversations; Bing, for its user experience; Office 365, which hides cloud-based business documents from advertisers; andInternet Explorer, which it touts as the world’s most popular Internet browser.

SEE ALSO: Google Thinks I’m a Middle-Aged Man. What About You?

Shaw also notes that Microsoft will be placing ads in major newspapers this week to the same effect.

Do you think Microsoft is taking the right steps to position its products as the premier Google alternative? Let us know in the comments if you are looking to move away from Google and which alternative web services you plan to adopt.

Read more »

Posted in: Google,Microsoft

Google: Microsoft Ad Campaign Is Full of Myths

Google doesn’t want you to believe everything Microsoft is writing about its privacy policies — especially not in the ads for alternative Microsoft products set to appear in major newspapers.

The search giant published a blog post written by policy manager Betsy Masiello, in hopes of sorting out the myths and facts behind its new privacy policy.

Microsoft, among other sources, have been criticizing Google for its disloyalty to users, acting in favor of its own self-interest. Particularly, accusations have centered around the idea that Google sells users’ private information to advertisers.

The post seeks to dispel seven “myths” about Google’s alleged privacy issues. While Masiello doesn’t outright say the post is a response to Microsoft, five of the seven myths are sourced to Wednesday morning’s Microsoft post.

Here are the seven statements Google makes to respond to what’s been said on the web:

• Google does not, as Fairsearch wrote, sell user information. Advertisers buy ads that match keywords, based on anonymous data.
• Google’s privacy controls have not changed, as Microsoft wrote they had.
• Google’s privacy changes are meant to benefit users not advertisers, as Microsoft wrote.
• Google doesn’t read your email, as Microsoft wrote.
• Google’s apps are safe and government-certified, unlike what Microsoft wrote.
• Google’s privacy changes don’t jeopardize government information, as SafeGov.org wrote.
• Google disagrees with Microsoft‘s statement that Microsoft’s privacy policy is superior to Google’s.

Are you satisfied with Google’s response or do you feel as if your private information is in jeopardy? Let us know in the comments.

Read more »

Posted in: Google,Microsoft

Microsoft warns users against Google's privacy policy changes

Google has touted the overhaul it announced last week as a simplification of detailed but obtuse policies and a way to provide a better user experience

LOS ANGELES: Microsoft Corp slammed search rival Google Inc with full-page newspaper ads Wednesday, saying that recent changes at Google that allow it to internally merge the data it collects on user activity across services such as YouTube and Gmail are meant to allow advertisers to better target customers.

Google has touted the overhaul it announced last week as a simplification of detailed but obtuse policies and a way to provide a better user experience.

Microsoft offered up its own Web-based alternatives, saying for instance that users of its free email service, Hotmail, don't have to worry about the content of their emails being used to help target ads.

The attack ads appeared in newspapers including USA Today, The Wall Street Journal and The New York Times.

"Every data point Google collects and connects to you increases how valuable you are to an advertiser," Microsoft says in the ad.

In response, Google published a blog post in which it refuted what it called "myths" about its new privacy policy, saying, "Our privacy controls have not changed. Period."

The company does not dispute that it serves up ads based on words in private emails written by users of Gmail, but says such scanning is automated and is similar to how many email providers filter out spam. It has operated that way since Gmail's introduction in 2004.

Both companies offer several controls to prevent advertisers from tracking users' online activity.

Online expert Danny Sullivan, editor-in-chief of the website Search Engine Land, said that Google's privacy policy simplification has turned into a public relations "nightmare," but only because it again focused attention on the kind of data that Google has collected for years.

He said Microsoft is in no position to point fingers, since it also collects a lot of user data from its search engine, Bing, and will adjust search results based on information it finds in users' Facebook accounts if they are logged in.

"I think they're largely about the same," Sullivan said. "It would not be hard to go through and pick any major Internet company, talk about the kind of data they collect and start getting people paranoid."

Read more »

Posted in: Google,Microsoft

Microsoft Certifications List

Microsoft Certifications by Name

Microsoft Certification helps validate the skills you use every day. It helps you improve your technology problem-solving skills and your performance on the job. Go ahead. Strive for the rewards, respect, and recognition you deserve. Become a Microsoft Certified Professional!

Get to the next level with certification

The following tables list Microsoft Certifications by name and describe how they enable IT professionals to help display and validate their skills and experience.

IT professional


MCTS


A Microsoft Certified Technology Specialist (MCTS) certification helps enable IT professionals to target specific technologies and to distinguish themselves by demonstrating in-depth knowledge and expertise.


MCITP


A Microsoft Certified IT Professional (MCITP) certification helps enable IT professionals to demonstrate comprehensive skills in planning, deploying, supporting, maintaining, and optimizing IT infrastructures.


MCDST


A Microsoft Certified Desktop Support Technician (MCDST) certification helps enable IT professionals to demonstrate technical and customer service skills in troubleshooting hardware and software operation issues in Microsoft Windows environments.


MCSA


A Microsoft Certified Systems Administrator (MCSA) certification helps enable IT professionals to demonstrate their ability to administer network and systems environments with Windows Server 2003–based business solutions. 
Note For newer Microsoft technologies, such as Microsoft Exchange Server 2010, Windows Server 2008, or Microsoft SQL Server 2008, you should pursue the MCITP certification.


MCDBA


A Microsoft Certified Database Administrator (MCDBA) certification helps enable IT professionals to demonstrate their ability to design, implement, and administer Microsoft SQL Server databases.


MCSE


A Microsoft Certified Systems Engineer (MCSE) certification helps enable IT professionals to demonstrate their ability to design and implement an infrastructure solution with Windows Server 2003–based business solutions. 
Note For newer Microsoft technologies, such as Exchange Server 2010, Windows Server 2008, or SQL Server 2008, we recommend that you pursue the MCITP certification.


Microsoft Certified Technology Specialist for Microsoft Dynamics


A Microsoft Certified Technology Specialist certification helps enable IT professionals to demonstrate their proficiency with Microsoft Dynamics and related business products.


Microsoft Certified IT Professional for Microsoft Dynamics


A Microsoft Certified IT Professional certification helps enable IT professionals to demonstrate professional proficiency with Microsoft Dynamics in one of three areas: applications, developer, or installation and configuration.


MTA


A Microsoft Technology Associate (MTA) certification helps students explore career options in technology, prepare for advanced studies and MCTS exams, and demonstrate their fundamental knowledge of hardware and IT infrastructure.




Developer


MCPD


A Microsoft Certified Professional Developer (MCPD) certification helps enable IT professionals to demonstrate comprehensive skills in designing, developing, and deploying applications for a particular job role. These certifications show that you have the skills required to perform the job successfully.


MCAD


A Microsoft Certified Application Developer (MCAD) certification helps enable IT professionals to demonstrate their ability to use Microsoft technologies to develop and maintain department-level applications, components, Web or desktop clients, or back-end data services.


MCSD


A Microsoft Certified Solution Developer (MCSD) certification helps enable IT professionals to demonstrate their ability to design and develop leading-edge business solutions with Microsoft development tools, technologies, platforms, and the Windows operating system.


MTA


A Microsoft Technology Associate (MTA) certification helps students explore career options in technology, prepare for advanced studies and MCTS exams, and demonstrate their fundamental knowledge of software technology.




Advanced certifications


Microsoft Certified Master


The Microsoft Certified Master program helps enable experienced IT professionals to demonstrate and validate their ability to successfully design and implement solutions that meet the most complex business requirements.


Microsoft Certified Architect


The Microsoft Certified Architect program recognizes and provides advanced certification to practicing architects in an enterprise setting.





Home and office user


MOS


A Microsoft Office Specialist (MOS) is globally recognized for demonstrating advanced business skills in using Microsoft Office 2010, the 2007 Microsoft Office system, and Windows Vista; or highly developed skills in using other Microsoft desktop software.

Read more »

Posted in: Microsoft,Microsoft Certification

MOS Certification - Microsoft Office Specialist

Microsoft Certifications – Overview:

Microsoft has recently revamped their certificates programs to be more targeted. TheCertifications Overview provides a map of how the certifications fit together. In addition, the newer Microsoft Certifications have lifecycle policies that are new to the Microsoft Certification program. These policies were put in place to ensure that Microsoft Certifications remain up-to-date on relevant Microsoft technologies.

Training for the Microsoft Certifications can be accomplished in a classroom or via distance or e-learning programs. More information about theMicrosoft training programs can be found on the training pages.

The MOS (Microsoft Office Specialist) certification program certifies a level of expertise with Microsoft Office desktop programs, including Microsoft Office Word, Microsoft Office Excel, Microsoft Office Outlook, Microsoft Office PowerPoint, Microsoft Office Access and Microsoft Office Project. There are four levels of certification available: Specilaist, Expert, Master and Master Instructor. The testing is further broken into versions of Office, including Misrocosft Office 2000, Microsoft Office 2003, Microsoft Office 2007, Microsoft Office XP and Microsoft Office Vista.

Certification requires successful completion of Office Specialist Exams. The exams are administered atauthorized locations worldwide.

Read more »

Posted in: Microsoft

MCDST - Microsoft Certified Desktop Technician - Information and Training

MCDST Certification and Resources:

The Microsoft Certified Desktop Support Technician (MCDST) is an entry-level Microsoft certification. If you are looking for a way to get into the IT industry or to supplement your skills and education, the MCDST is a great certification to start with.

The Microsoft Certified Desktop Support Technician (MCDST) credential shows that you have the skills to successfully support end-users and to successfully troubleshoot desktop environments that are running the Microsoft Windows operating system.

MCDST candidates are required to pass two core exams. The training and exams are currently focused on the XP environment. To update the certification to reflect Windows Vista knowledge, there is a one course upgrade and exam required. For other Vista related certifications, check out the MCTS - Windows Vista and the MCITP certification information - either the MCITP Enterprise Support Technician or the MCITP Consumer Support Technician options.

Training for the MCDST exam is widely offered. There are elrarning and self paced booklets available from the Microsoft MCDST perparation area. Other training facilities include Career Academy and hands-on intensive boot-camp style training from MCSEClasseswhich are available in many areas.

Read more »

Posted in: Microsoft