Sony gets targeted by hackers again

Hacker group LulzSec have stolen1 million user accounts from the Sony Pictures Web site. They claim the security on the site was “disgraceful” and the data was not even encrypted

Sony has been hit by a second massive data breach, hackers claim, another potential embarrassment for a company that is struggling to restore its image following the loss of millions of credit card numbers through its PlayStation Network.

The hackers, who call themselves LulzSec, said they pulled off what they described as an elementary attack to highlight Sony’s “disgraceful” security.

“Every bit of data we took wasn’t encrypted. Sony stored over 1,000,000 passwords of its customers in plaintext, which means it’s just a matter of taking it,” LulzSec said in a statement. “They were asking for it.”

Sony Pictures, a subsidiary of Sony Corporation of America, said it is aware of the LulzSec statement.

“We are looking into these claims,” said Jim Kennedy, executive vice president of global communications for Sony Pictures Entertainment.

The data which includes passwords, email addresses, phone numbers, home addresses, dates of birth was posted to the LulzSec Web site and appeared to be genuine.

Sony is already is facing questions over why it did not inform consumers more quickly after a massive cyber-attack in April targeted credit card information through its PSN and SEO network, compromising more than 100 million user accounts. At the time, experts warned the attack emboldened hackers and made them more willing to pursue sensitive information.

It is unclear who the members of LulzSec are, or where they’re based. The group didn’t immediately reply to emails sent to their Web site’s administrative and technical accounts or to a Twitter message posted to the Web.

The group’s Web site which has a pared-down, 1990s look was only registered on Wednesday, according to an Internet records search. The site’s registrant is listed as being based in the Bahamas. LulzSec recently claimed responsibility for hacking the website of the PBS television network to post a fake story in protest of a recent Frontline investigative news program on WikiLeaks.

For the past two days, the group has been mocking Sony via Twitter and alluding to a hacking operation.

Posts on the microblogging site through an account linked to the group at times chastise “silly 
Sony” and “You Sony morons,” saying “everything we have will be published in multiple ways to ensure maximum embarrassment and exposure for (Sony) and their security flaws.”

Read more »

Black Hat Hackers

Thanks to Hollywood, black hat hackers have become the iconic image of all hackers around the world. For the majority of computer users, the word hacker has become a synonym for social misfits and criminals. 

Of course, that is an injustice created by our own interpretation of the mass media, so it is important for us to learn what a hacker is and what a black hacker (or cracker) does. So, let's learn about black hat techniques and how they make our lives a little more difficult.

What Is Black Hat Hacking?

A black hat hacker, also known as a cracker or a dark side hacker (this last definition is a direct reference to the Star Wars movies and the dark side of the force), is someone who uses his skills with a criminal intent. Some examples are: cracking bank accounts in order to make transferences to their own accounts, stealing information to be sold in the black market, or attacking the computer network of an organization for money.

Some famous cases of black hat hacking include Kevin Mitnick, who used his black hat hackers skills to enter the computers of organizations such as Nokia, Fujitsu, Motorola and Sun Microsystems (it must be mentioned that he is now a white hat hacker); Kevin Poulsen, who took control of all the phone lines in Los Angeles in order to win a radio contest (the prize was a Porsche 944 S2); and Vladimir Levin, which is the handle of the mastermind behind the stealing of $10'000,000 to Citigroup.

Differences Between White Hat And A Black Hat Hacker

The difference between black hat and white hat hackers is that white hat hacker uses their skills and knowledge as a way to defend someone from attackers. That means that white hat hackers offer their services to corporations, public organizations and educational institutions.

These services include a complete revision of their computer network security, implementation of new security systems (they may be hardware or software), user training and future recommendations. All these measures will be able to combat unauthorized hacking; black hat hackers, however, will continue trying. 

Read more »

Is Hacking Always Bad?

Although the history of hacking is relatively unknown to most of the public, it's quite interesting to read about it. It doesn't matter if you aren't a computer expert or a system administrator of a big corporation. 

Computers are as much part of our history as airplanes and cars, and it should be common knowledge to know how they came to be. It's the only way you can understand the effects of computer hacking in our life.

History of Hacking

Hacking is not limited to computers. The real meaning of hacking is to expand the capabilities of any electronic device; to use them beyond the original intentions of the manufacturer. As a matter of fact, the first hackers appeared in the 1960's at the Massachusetts Institute of Technology (MIT), and their first victims were electric trains. They wanted them to perform faster and more efficiently. So, is hacking always bad? Not really. It only depends on how to use it. But it wasn't until a group of these hackers decided to exert their knowledge in the computer mainframes of the MIT.

During the 1970's, a different kind of hacker appeared: the phreaks or phone hackers. They learned ways to hack the telephonic system and make phone calls for free. Within these group of people, a phreaker became famous because a simple discovery. John Draper, also known as Captain Crunch, found that he could make long distance calls with a whistle. He built a blue box that could do this and the Esquire magazine published an article on how to build them. Fascinated by this discovery, two kids, Steve Wozniak and Steve Jobs, decided to sell these blue boxes, starting a business friendship which resulted in the founding of Apple.

By the 1980's, phreaks started to migrate to computers, and the first Bulletin Board Systems (BBS) appeared. BBS are like the yahoo groups of today, were people posted messages of any kind of topics. The BBS used by hackers specialized in tips on how to break into computers, how to use stolen credit card numbers and share stolen computer passwords.

It wasn't until 1986 that the US government realized the danger that hackers represented to the national security. As a way to counteract this menace, the Congress passed the Computer Fraud and Abuse Act, making computer breaking a crime across the nation.

During the 1990's, when the use of the internet widespread around the world, hackers multiplied, but it wasn't until the end of the decade that system's security became mainstream among the public.

Today, we are accustomed to hackers, crackers, viruses, Trojans, worms and all of the techniques we need to follow to combat them. 

Read more »

A Closer Look at a Vulnerability in Gmail

Gmail is one of the major webmail service provider across the globe. But as we all know Gmail still carries that 4 letter word BETA. Sometimes we may wonder, why Gmail is still in the testing stage even after years of it’s emergence. Here is one small reason for that. 

Gmail follows a strict rule that doesn’t allow it’s users to have their first or the last namecontain the term Gmail or Google. That is, while signing up for a new Gmail account the users cannot choose a first or last name that contains the term Gmail or Google. You can see this from the below snapshot.

This rule is implemented by Gmail for obvious reasons, because if the users are allowed to keep their first or the last name that contains the term Gmail or Google, then it is possible to easily impersonate the identity of Gmail (or Gmail Team) and engage themselves in phising or social engineering attacks on the innocent users. This can be done by simply choosing the first and last name with the following combinations.

First Name        Last Name

Gmail                       Team

Google                     Team

Gmail                       Password Assistance 

From the above snapshot we can see that, Gmail has made a good move in stopping the users from abusing it’s services. However this move isn’t just enough to prevent the malicious users from impersonating the Gmail’s identity. Because Gmail has a small vulnerability that can be exploited so that the users can still have their name contain the terms Gmail or Google. You may wonder how to do this. But it’s very simple.

1. Login to your Gmail account and click on Settings.

2. Select Accounts tab

3. Click on edit info

4. In the Name field, select the second radio button and enter the name of your choice. Click on Save Changes and you’re done!

Now, Gmail accepts any name even if it contains the term Google or Gmail. You can see from the below snapshot

Allowing the users to have their names contain the terms Gmail or Google is a serious vulnerability even though it doesn’t seem to be a major one. This is because a hacker or a malicious attacker can easily exploit this flaw and send phishing emails to other Gmail users asking for sensitive information such as their passwords. Most of the users don’t even hesitate to send their passwords since they believe that they are sending it to Gmail Team (or someone authorized). But in reality they are sending it to an attacker who uses these information to seek personal benefits.

So the bottomline is, if you get any emails that appears to have come from the Gmail Team or similar, don’t trust them! Anyone can send such emails to fool you and take away your personal details. Hope that Gmail will fix this vulnerability as soon as possible to avoid any disasters.

Read more »

Phishing Tools Available Online

Tools that can help people potentially defraud innocent surfers are available for free download on the internet, it has been claimed.

The do-it-yourself kits provide all the essential tools for launching phishing attacks – those that use spoofed emails and fraudulent websites to trick people into giving out personal financial data.

Phishing scams are on the up. Security company MessageLabs has intercepted an average of 250,000 phishing emails a month so far in 2004, compared to just 14 phishing-related emails back in August 2003.

According to anti-virus company Sophos, the DIY kits contain all the graphics, web code and text required to construct fake websites that look like legitimate online banking or shopping sites. They also include spamming software which would let you send out millions of phishing emails as bait for potential victims.

“Until now, phishing attacks have been largely the work of organised criminal gangs, however, the emergence of these ‘build your own phish’ kits mean that any old Tom, Dick or Harry can now mimic bona fide banking websites and convince customers to disclose sensitive information such as passwords, PIN numbers and account details,” said a spokesman for Sophos.

“There is plenty of profit to be made from phishing. By putting the necessary tools in the hands of amateurs, it’s likely that the number of attacks will continue to rise.”

Surfers that receive a suspicious email that claims to come from an online bank or e-commerce site should delete them and not click on any included links.

Read more »

How I’d Hack Your Weak Passwords

If you invited me to try and crack your password, you know the one that you use over and over for like every web page you visit, how many guesses would it take before I got it?

Let’s see… here is my top 10 list. I can obtain most of this information much easier than you think, then I might just be able to get into your e-mail, computer, or online banking. After all, if I get into one I’ll probably get into all of them.

1. Your partner, child, or pet’s name, possibly followed by a 0 or 1 (because they’re always making you use a number, aren’t they?)
2. The last 4 digits of your social security number.
3. 123 or 1234 or 123456.
4. “password”
5. Your city, or college, football team name.
6. Date of birth – yours, your partner’s or your child’s.
7. “god”
8. “letmein”
9. “money”
10. “love”

Statistically speaking that should probably cover about 20% of you. But don’t worry. If I didn’t get it yet it will probably only take a few more minutes before I do…

Hackers, and I’m not talking about the ethical kind, have developed a whole range of tools to get at your personal data. And the main impediment standing between your information remaining safe, or leaking out, is the password you choose. (Ironically, the best protection people have is usually the one they take least seriously.)

One of the simplest ways to gain access to your information is through the use of a Brute Force Attack. This is accomplished when a hacker uses a specially written piece of software to attempt to log into a site using your credentials. Insecure.org has a list of the Top 10 FREE Password Crackers right here.

So, how would one use this process to actually breach your personal security? Simple. Follow my logic:

• You probably use the same password for lots of stuff right?
• Some sites you access such as your Bank or work VPN probably have pretty decent security, so I’m not going to attack them.
• However, other sites like the Hallmark e-mail greeting cards site, an online forum you frequent, or an e-commerce site you’ve shopped at might not be as well prepared. So those are the ones I’d work on.
• So, all we have to do now is unleash Brutus, wwwhack, or THC Hydra on their server with instructions to try say 10,000 (or 100,000 – whatever makes you happy) different usernames and passwords as fast as possible.
• Once we’ve got several login+password pairings we can then go back and test them on targeted sites.
• But wait… How do I know which bank you use and what your login ID is for the sites you frequent? All those cookies are simply stored, unencrypted and nicely named, in your Web browser’s cache. (Read this post to remedy that problem.)

And how fast could this be done? Well, that depends on three main things, the length and complexity of your password, the speed of the hacker’s computer, and the speed of the hacker’s Internet connection.

Assuming the hacker has a reasonably fast connection and PC here is an estimate of the amount of time it would take to generate every possible combination of passwords for a given number of characters. After generating the list it’s just a matter of time before the computer runs through all the possibilities – or gets shut down trying.

Pay particular attention to the difference between using only lowercase characters and using all possible characters (uppercase, lowercase, and special characters – like @#$%^&*). Adding just one capital letter and one asterisk would change the processing time for an 8 character password from 2.4 days to 2.1 centuries.

Password Length	All Characters	Only Lowercase
3 characters 4 characters 5 characters 6 characters 7 characters 8 characters 9 characters 10 characters 11 characters 12 characters 13 characters 14 characters	0.86 seconds 1.36 minutes 2.15 hours 8.51 days 2.21 years 2.10 centuries 20 millennia 1,899 millennia 180,365 millennia 17,184,705 millennia 1,627,797,068 millennia 154,640,721,434 millennia	0.02 seconds .046 seconds 11.9 seconds 5.15 minutes 2.23 hours 2.42 days 2.07 months 4.48 years 1.16 centuries 3.03 millennia 78.7 millennia 2,046 millennia

Remember, these are just for an average computer, and these assume you aren’t usingany word in the dictionary. If Google put their computer to work on it they’d finish about 1,000 times faster.

Now, I could go on for hours and hours more about all sorts of ways to compromise your security and generally make your life miserable – but 95% of those methods begin withcompromising your weak password. So, why not just protect yourself from the start and sleep better at night?

Believe me, I understand the need to choose passwords that are memorable. But if you’re going to do that how about using something that no one is ever going to guess AND doesn’t contain any common word or phrase in it.

Here are some password tips:

1. Randomly substitute numbers for letters that look similar. The letter ‘o’ becomes the number ’0′, or even better an ‘@’ or ‘*’. (i.e. – m0d3ltf0rd… like modelTford)
2. Randomly throw in capital letters (i.e. – Mod3lTF0rd)
3. Think of something you were attached to when you were younger, but DON’T CHOOSE A PERSON’S NAME! Every name plus every word in the dictionary will fail under a simple brute force attack.
4. Maybe a place you loved, or a specific car, an attraction from a vacation, or a favorite restaurant?
5. You really need to have different username / password combinations for everything. Remember, the technique is to break into anything you access just to figure out your standard password, then compromise everything else. This doesn’t work if you don’t use the same password everywhere.
6. Since it can be difficult to remember a ton of passwords, I recommend using Roboformfor Windows users. It will store all of your passwords in an encrypted format and allow you to use just one master password to access all of them. It will also automatically fill in forms on Web pages, and you can even get versions that allow you to take your password list with you on your PDA, phone or a USB key. If you’d like to download it without having to navigate their web site here is the direct download link.
7. Mac users can use 1Password. It is essentially the same thing as Roboform, except for Mac, and they even have an iPhone application so you can take them with you too.
8. Once you’ve thought of a password, try Microsoft’s password strength tester to find out how secure it is.

By request I also created a short RoboForm Tutorial. Hope it helps…

Another thing to keep in mind is that some of the passwords you think matter leastactually matter most. For example, some people think that the password to their e-mail box isn’t important because “I don’t get anything sensitive there.” Well, that e-mail box is probably connected to your online banking account. If I can compromise it then I can log into the Bank’s Web site and tell it I’ve forgotten my password to have it e-mailed to me. Now, what were you saying about it not being important?

Often times people also reason that all of their passwords and logins are stored on their computer at home, which is save behind a router or firewall device. Of course, they’ve never bothered to change the default password on that device, so someone could drive up and park near the house, use a laptop to breach the wireless network and then try passwords from this list until they gain control of your network – after which time they will own you!

Now I realize that every day we encounter people who over-exaggerate points in order to move us to action, but trust me this is not one of those times. There are 50 other ways you can be compromised and punished for using weak passwords that I haven’t even mentioned.

I also realize that most people just don’t care about all this until it’s too late and they’ve learned a very hard lesson. But why don’t you do me, and yourself, a favor and take a little action to strengthen your passwords and let me know that all the time I spent on this article wasn’t completely in vain.

Please, be safe. It’s a jungle out there.

Read more »

How I’d Hack Your Weak Passwords

If you invited me to try and crack your password, you know the one that you use over and over for like every web page you visit, how many guesses would it take before I got it?

Let’s see… here is my top 10 list. I can obtain most of this information much easier than you think, then I might just be able to get into your e-mail, computer, or online banking. After all, if I get into one I’ll probably get into all of them.

1. Your partner, child, or pet’s name, possibly followed by a 0 or 1 (because they’re always making you use a number, aren’t they?)
2. The last 4 digits of your social security number.
3. 123 or 1234 or 123456.
4. “password”
5. Your city, or college, football team name.
6. Date of birth – yours, your partner’s or your child’s.
7. “god”
8. “letmein”
9. “money”
10. “love”

Statistically speaking that should probably cover about 20% of you. But don’t worry. If I didn’t get it yet it will probably only take a few more minutes before I do…

Hackers, and I’m not talking about the ethical kind, have developed a whole range of tools to get at your personal data. And the main impediment standing between your information remaining safe, or leaking out, is the password you choose. (Ironically, the best protection people have is usually the one they take least seriously.)

One of the simplest ways to gain access to your information is through the use of a Brute Force Attack. This is accomplished when a hacker uses a specially written piece of software to attempt to log into a site using your credentials. Insecure.org has a list of the Top 10 FREE Password Crackers right here.

So, how would one use this process to actually breach your personal security? Simple. Follow my logic:

• You probably use the same password for lots of stuff right?
• Some sites you access such as your Bank or work VPN probably have pretty decent security, so I’m not going to attack them.
• However, other sites like the Hallmark e-mail greeting cards site, an online forum you frequent, or an e-commerce site you’ve shopped at might not be as well prepared. So those are the ones I’d work on.
• So, all we have to do now is unleash Brutus, wwwhack, or THC Hydra on their server with instructions to try say 10,000 (or 100,000 – whatever makes you happy) different usernames and passwords as fast as possible.
• Once we’ve got several login+password pairings we can then go back and test them on targeted sites.
• But wait… How do I know which bank you use and what your login ID is for the sites you frequent? All those cookies are simply stored, unencrypted and nicely named, in your Web browser’s cache. (Read this post to remedy that problem.)

And how fast could this be done? Well, that depends on three main things, the length and complexity of your password, the speed of the hacker’s computer, and the speed of the hacker’s Internet connection.

Assuming the hacker has a reasonably fast connection and PC here is an estimate of the amount of time it would take to generate every possible combination of passwords for a given number of characters. After generating the list it’s just a matter of time before the computer runs through all the possibilities – or gets shut down trying.

Pay particular attention to the difference between using only lowercase characters and using all possible characters (uppercase, lowercase, and special characters – like @#$%^&*). Adding just one capital letter and one asterisk would change the processing time for an 8 character password from 2.4 days to 2.1 centuries.

Password Length	All Characters	Only Lowercase
3 characters 4 characters 5 characters 6 characters 7 characters 8 characters 9 characters 10 characters 11 characters 12 characters 13 characters 14 characters	0.86 seconds 1.36 minutes 2.15 hours 8.51 days 2.21 years 2.10 centuries 20 millennia 1,899 millennia 180,365 millennia 17,184,705 millennia 1,627,797,068 millennia 154,640,721,434 millennia	0.02 seconds .046 seconds 11.9 seconds 5.15 minutes 2.23 hours 2.42 days 2.07 months 4.48 years 1.16 centuries 3.03 millennia 78.7 millennia 2,046 millennia

Remember, these are just for an average computer, and these assume you aren’t usingany word in the dictionary. If Google put their computer to work on it they’d finish about 1,000 times faster.

Now, I could go on for hours and hours more about all sorts of ways to compromise your security and generally make your life miserable – but 95% of those methods begin withcompromising your weak password. So, why not just protect yourself from the start and sleep better at night?

Believe me, I understand the need to choose passwords that are memorable. But if you’re going to do that how about using something that no one is ever going to guess AND doesn’t contain any common word or phrase in it.

Here are some password tips:

1. Randomly substitute numbers for letters that look similar. The letter ‘o’ becomes the number ’0′, or even better an ‘@’ or ‘*’. (i.e. – m0d3ltf0rd… like modelTford)
2. Randomly throw in capital letters (i.e. – Mod3lTF0rd)
3. Think of something you were attached to when you were younger, but DON’T CHOOSE A PERSON’S NAME! Every name plus every word in the dictionary will fail under a simple brute force attack.
4. Maybe a place you loved, or a specific car, an attraction from a vacation, or a favorite restaurant?
5. You really need to have different username / password combinations for everything. Remember, the technique is to break into anything you access just to figure out your standard password, then compromise everything else. This doesn’t work if you don’t use the same password everywhere.
6. Since it can be difficult to remember a ton of passwords, I recommend using Roboformfor Windows users. It will store all of your passwords in an encrypted format and allow you to use just one master password to access all of them. It will also automatically fill in forms on Web pages, and you can even get versions that allow you to take your password list with you on your PDA, phone or a USB key. If you’d like to download it without having to navigate their web site here is the direct download link.
7. Mac users can use 1Password. It is essentially the same thing as Roboform, except for Mac, and they even have an iPhone application so you can take them with you too.
8. Once you’ve thought of a password, try Microsoft’s password strength tester to find out how secure it is.

By request I also created a short RoboForm Tutorial. Hope it helps…

Another thing to keep in mind is that some of the passwords you think matter leastactually matter most. For example, some people think that the password to their e-mail box isn’t important because “I don’t get anything sensitive there.” Well, that e-mail box is probably connected to your online banking account. If I can compromise it then I can log into the Bank’s Web site and tell it I’ve forgotten my password to have it e-mailed to me. Now, what were you saying about it not being important?

Often times people also reason that all of their passwords and logins are stored on their computer at home, which is save behind a router or firewall device. Of course, they’ve never bothered to change the default password on that device, so someone could drive up and park near the house, use a laptop to breach the wireless network and then try passwords from this list until they gain control of your network – after which time they will own you!

Now I realize that every day we encounter people who over-exaggerate points in order to move us to action, but trust me this is not one of those times. There are 50 other ways you can be compromised and punished for using weak passwords that I haven’t even mentioned.

I also realize that most people just don’t care about all this until it’s too late and they’ve learned a very hard lesson. But why don’t you do me, and yourself, a favor and take a little action to strengthen your passwords and let me know that all the time I spent on this article wasn’t completely in vain.

Please, be safe. It’s a jungle out there.

Read more »

3 Reasons Why Mac OS X and Linux Won't Succeed against Windows

Let me state from the get go that this is not a Mac OS X vs. Linux vs. Windows Vista article. It will not provide a conclusion over the superiority of one operating system alone and will only be limited to a total of three reasons why Mac OS X and Linux won't succeed against Windows Vista.

Success in this context is equivalent to a scenario where either Mac OS X or Linux, or both, would negatively influence the adoption of Vista to such an extent that Microsoft's share on the operating system with Windows would suffer and become eroded. But in the end it is not about Vista, or a specific version of the three operating systems.

The bottom line is that between the end of 2001 and early 2007, or from XP to Vista, neither Mac OS X nor Linux managed to dislodge Windows.

1. Windows Saturation

Since both Linux and Mac OS X are valid alternative platforms to Windows, each with its own footprint on the operating system market, the concept of a Microsoft monopoly is not valid by any means. Near-monopoly would more accurately describe the Redmond company's dominant position with its operating system, or even a Windows saturation of the market. According to the latest estimates for the install base of each platform as of mid 2007, Windows is on top of the world. The initial vision of Microsoft Co-founder Bill Gates was to put a computer on every desktop in every home. Gates is currently transitioning out if his day-to-day role with the Redmond company and will complete the quasi-divorce from Microsoft as of mid 2008, in favor of Ray Ozzie - Chief Software Architect and Craig Mundie - Chief Research and Strategy Officer. And by 2008, Microsoft will have achieved a key milestone, a landmark fragment of Gates' vision.

Earlier this year, at the Financial Analyst Meeting 2007 on July 26, Steve Ballmer, Microsoft Chief Executive Officer, delivered a perspective over the evolution of Windows in the company's 2008 fiscal year, or from July 1, 2007 until June 30, 2008.

"The install base of Windows computers this coming 12 months will reach 1 billion. If you stop and just think about that, parse that for a second, by the end of our fiscal year '08, there will be more PCs running Windows in the world than there are automobiles, which is at least to me kind of a mind-numbing concept. I think it talks about the way the value has been driven from the Windows PC, and all of the applications from Microsoft to third parties that go with it," Ballmer stated.

And this is only on the client side. But Microsoft has also a strong presence on the server side with its Windows operating system. Clearly client- and server-side are two completely different dimensions. And the fact of the matter is that Linux is regarded as a prominent server platform, while the client version has failed to surpass the single-digit desktop market share since the introduction. Analyst firms Gartner and IDC, in their latest quarterly server numbers, gave Microsoft 67.1% of the market with Windows, and Linux 22.8%. Apple also produces a server operating system, along with the client version, but Mac OS X Server is an insignificant presence, although the Cupertino-based company is pushing ahead and will deal its next move concomitantly with Leopard in October.

And what is even more relevant for Microsoft's dominance on the server-side is the fact fat the Redmond company is accepting the reality of Linux. The interoperability and intellectual property assurance agreement inked with open source distributer Novell in November 2006, is nothing more than Microsoft's way of evolving inside heterogeneous environments, running mixed solutions, as Linux is an established presence and not going anywhere for now.

"I would look at the server market. Windows Server has done well, but has not grown as quickly in recent years as Linux has," stated Brad Smith, Senior Vice President, General Counsel, Corporate Secretary, Legal & Corporate Affairs, Microsoft, explaining the company's position in relation to the lost antitrust battle in Europe.

Statistics look a tad different on the client-side. OneStat gives Windows a global usage share of 96.72% in mid 2007, while Mac OS X is credited with 2.70% and Linux with just 0.36%. W3Counter has Windows at approximately 93% of the market with 3.75% for Mac OS X and 1.37% for Linux, barely more than the percentage of Windows 98. Market Share by Net Applications also gives Windows the lion's share with over 93%, followed by Mac OS X with 6% and Linux still under 1%. The numbers are important because they reflect the fact that there is no empty space to grow for either Linux or Mac OS X. Windows is hugging the market, leaving little elbow room for its rivals. Both Linux and Mac OS X need a consistent amount of momentum to go against Microsoft, but in the Windows saturated market there is no way for that momentum to be gained. Things are simpler for Windows Vista. Microsoft's latest operating system has a natural growth trajectory by replacing older version Windows, and especially Windows XP. By definition, Windows users will look to Microsoft to provide their next operating system.

2. Security

There is a generalized perception of Linux and Mac OS X superiority over Windows when it comes down to the level of security each operating system provides as a de facto standard. The status quo is a direct result of a cocktail mixed with various ingredients, starting from the "inherent" and arrogant superiority attributed to Mac OS X and Linux supporters, continuing with obscure market shares and inexistent threat environments for the UNIX based and the open source operating systems. For Windows users on the other hand, the success of the operating system has as a logical consequence, the downside of running on the most attacked platform on the market. The simple fact that Windows is a large and facile target, in terms of the volume of potential victims, focusing on the threat environment is synonymous with insecurity. Just look at the "Top ten web threats" from Sophos in September or from "Virus Top Twenty for August 2007" from Kaspersky. Not a single piece of Linux or Mac OS X malware.

This is why Microsoft has invested heavily in security and in delivering the perception of security to the public since the release of Windows XP SP2 in 2004. Vista is constantly applauded as the most secure operating system to date, as a direct result of the implementation of the Secure Development Lifecycle methodologies in the building process of the operating system. The SDL is meant to deliver a result as close to the perfection of secure as default perfection is possible, and to reduce the maximum severity rating of the flaws that do get into the final product. Users have to understand that there is no panacea solution to security and that the number of vulnerabilities in Windows, Linux and Mac OS X will never be zero.

Still, the first characteristic of both Linux and Mac OS X is the fact that both operating systems deliver the perception of security by default. And not only the perception. There are long time Linux and Mac OS X users that have never run an antivirus and never got infected with a piece of malware. This is security that Windows Vista is unable to deliver. But at the same time, Microsoft has poured a consistent amount of work into catching up to the rival platforms, because security was the one aspect where Windows was suffering a stigmata of inferiority compared to Mac OS X and Linux. Now the Redmond company is able to market not only a product designed to be secure via SDL, but also a mature security environment and industry built around the operating system, the latter giving it the edge on Linux and Mac OS X. This is how, with Vista, Microsoft is reducing the relevance of security as a decisive factor in choosing an operating system.

You can access both "Windows Vista 6-Month Vulnerability Report" put together by Jeff Jones, Security Strategy Director in Microsoft’s Trustworthy Computing group, or the independent "Symantec Internet Security Threat Report - Trends for January–June 07", for a perspective on the vulnerabilities impacting Windows, the major distributions of Linux including Red Hat, Novell SUSE, and Ubuntu, and Mac OS X 10.4 Tiger.

3. Evangelism

Evangelism is the zealous marketing of the operating system not to end users, but to software developers. Windows, as well as Linux and Mac OS X are platforms first of all. But the success of an operating system is relatively independent of its quality. However, it is directly dependent on the ecosystem of third-party solutions that are orbiting around it. An operating system will provide a center of gravity for additional software products from developers, partners, information technology professionals and end users. Microsoft, Apple and Linux distributors such as Red Hat, Novell or Canonical, the makers of Ubuntu, all offer support, tools, services and resources to developers building on top of their platforms. Evangelism is what keeps current partners happy and converts developers to one platform as opposite to another.

And make no mistake about it. Microsoft is dead-on focused on software developers. Back in 2001, the Redmond company gave birth to the Developer and Platform Evangelism Division. And Microsoft has been militating Windows with zeal. At this point in time the Redmond company can throw behind Windows not only household names such as Bill Gates, Steve Ballmer, Ray Ozzie or Craig Mundie, but also the immense mass of Microsoft employees. The company's workforce, approximately 80,000 strong are all Windows missionaries to a higher or a lesser degree.

Do you want an example of Microsoft evangelism at work? Just look at Windows Vista. The number of applications supported by the operating system has grown from 650 at launch to over 2,000 by mid 2007. Additionally, the number of compatible devices grew from 1.5 million to over 2.2 million with in excess of 11,000 items labeled with the Works or with Certified for Windows Vista logos. And this in just the first six months of availability of the operating system. Microsoft Evangelism, on top of the ubiquity of the company's operating system, is the reason why the best and latest games come first to Windows and the reason why top worldwide applications and programs along with software entertainment products, are centered on the platform and not ignoring it.

The same scenario is valid for Linux and Apple but to a smaller degree. And with the Cupertino-based company the evangelism strategy is quite different, and it involves mainly the persona of Chief Executive Officer Steve Jobs. Apple however is doing not so much evangelism as pure marketing, because this is the trademark of Jobs. Gates is a monopolist turned philanthropist, the world's wealthiest man, and the one that will take Windows to an install base of 1 billion in 2008. Gates has "killed" competitors on the market and has gone head to head with the authorities in the Unites States and Europe, and Microsoft came out all right, more than ever regarded as an untouchable software monolith. Jobs instead can sell. He has the Mac Guy aura all over him, and he is able to sell every piece of hardware that Apple packages in a bubblegum white design, and every item of software produced in Cupertino. And first and foremost, Jobs is the living and breathing example that there can be a successful operating system outside of Microsoft's Windows.

In contrast, Linux has close to nothing. The Linux world, in fact the entire open source universe is an example of fragmentation. There is no center of gravity, no common criteria or ground and no balance. There is only a puzzle of disparate entities and interests, continually unsynchronized and in a perpetual motion. Linus Torvalds, the original developer of the Linux kernel is nothing more than a background figure. He is the all time good guy of operating system development and the embodiment of utopic open source principles and policy. But Torvalds and Linux evangelism are concepts that do not mix. Instead of being the driving force behind Linux adoption, Torvalds is just its passive father and nothing more. Fortunately for the Linux world, new figures emerge such as Canonical founder Mark Shuttleworth. Now with Ubuntu, an operating system regarded as inferior to the products of Red Hat or Novell, Linux has got some comprehensive examples of evangelism, but it is too early to tell what the results will be. Still, for the first time since the availability of Linux, Ubuntu makes end users feel less alienated by the open source operating system.

A subject that can be easily correlated with evangelism is the support original equipment manufacturers and system builders are pouring in each of the three operating systems. Now obviously, this is not the case for Apple. The Cupertino company is a closed environment producing both the hardware and the operating system. This strategy has obviously hurt adoption, but with emulators, hypervisors and virtualization technology the Mac actually has a winning chance. For this Windows XP and Windows Vista had to be welcomed with open arms on Mac computers. With the introduction of Boot Camp, Apple is simply keeping up with the virtualization industry, offering an alternative. But either way Microsoft operating systems can run on a proprietary Apple platform, which gives users, and especially Windows users, the choice of either a PC or a Mac for their next new computer.

At the same time Microsoft has the support of all major original equipment manufacturers and system builders. Companies such as HP, Dell, Lenovo and Acer are all traditional Microsoft partners. According to estimates from Gartner, by the end of 2007, no less than 257.1 million personal computers will be sold worldwide, up from 231.5 units in 2006. The vast majority of these computers will come preinstalled with the Windows operating system. In order to get an idea of what this means you have to understand that in 2007, Apple will sell approximately 8 million Mac computers, but no more than 10 million. Now the fact of the matter is that PCs can easily run either Windows or Linux, and companies such as Dell with Ubuntu and HP with Red Hat Enterprise Linux Desktop 5 are also offering the open source operating system but on the note of a pet project aimed at a niche of the market, an accessory to the Windows offerings rather than an actual business.

As of February 2008, Windows XP will no longer be available to the retail and original equipment manufacturer channels. From 2008 until Windows 7 (Seven) is scheduled in 2010, Microsoft and its OEM partners will be selling only Windows Vista. And the estimated 257.1 million PCs to be sold by the end of this year will only grow in 2008.
Source: Silver Blade

Read more »