Microsoft wins third German patent victory over Google Motorola technology

Microsoft wins third German patent victory over Google Motorola technology

Microsoft has won a third victory in Germany over Google's Motorola unit in the ongoing patent wars between the two companies.

A German court ruled that several Motorola tablets and phones infringe a Microsoft patented method for apps to handle different kinds of user input, such as on-screen letter and numeric keyboards, handwriting and drawing interfaces, and voice recognition, according to the BBC.

Samsung, HTC and others smartphone makers have licensed the technology from Microsoft, but Motorola had resisted. Google now faces additional sales restrictions on its products in Germany unless it makes significant changes to its Android operating system (OS).

Commentators believe it may be easier for Google to pay a licence fee than to issue a software update for its Android OS.

"We're pleased this decision builds on previous rulings in Germany that have already found Motorola is broadly infringing Microsoft's intellectual property," said David Howard, Microsoft's deputy general counsel.

"We will continue to enforce injunctions against Motorola products in Germany and hope Motorola will join other Android device makers by taking a licence to Microsoft's patented inventions."

Google said in a statement that it is waiting for the court’s written decision and is evaluating its options, including an appeal.

ICO to probe privacy concerns about Tesco website

ICO to probe privacy concerns about Tesco website:

The Information Commissioner's Office is to investigate claims that Tesco's website does not offer sufficient privacy protections to customers.

The UK privacy watchdog's probe comes after security experts raised a number of privacy concerns about the retailer's main website.

The main concern is about the way in which Tesco stores the passwords of shoppers after security researcher Troy Hunt revealed in a blog post that he had received a password reminder in an email from Tesco that contained his password in plain text.

This shows Tesco's password data is not being stored cryptographically, he told the BBC.

Security professionals agree that a more secure method of password recovery is for websites to email users instructions on how to reset their password, rather than revealing the password itself.

Hunt has also criticised Tesco for not using HTTPS (Hypertext Transfer Protocol Secure) across its entire site to protect users from phishing attacks and data theft.

Although users log into the Tesco website over HTTPS, the browser reverts to HTTP, which does not give users any security assurances, Hunt said.

“HTTP is stateless so the only (practical) way a state, such as being logged in, can be persisted is by passing cookies backwards and forwards between the browser and the website.

“Because they’re being sent over a HTTP connection, anyone who can watch the traffic can see [those] cookies. And copy them. And hijack your session,” he wrote.

In a subsequent blog post, Hunt claims that Tesco have security problems that go far beyond what he originally wrote about, including unverified SQL injection vulnerabilities and verified cross-site scripting vulnerabilities.

Hunt wrote that he has passed the details of cross-site scripting (XSS) vulnerability to multiple people in senior technology roles at Tesco, but the vulnerability remains unfixed.

"Interestingly, it seems that Tesco’s rather unique approach to security is now coming under scrutiny from the Information Commissioners Office in the UK. Whilst a statement such as 'We are aware of this issue and will be making inquiries' is far from a damning indictment, it will be interesting to see how this unfolds and whether the company may actually be called on those 'lousy' practices," he said.

In various statements issued to the media, Tesco maintains that its security is "robust". The company claims it is never complacent and says there is no evidence to suggest Tesco has been targeted by hackers or that customers' personal details are at risk.

Siemens issues software fix to protect against Stuxnet:

German engineering firm Siemens has issued a fix for the software vulnerabilities in its programmable logic controllers (PLCs) that were exploited by Stuxnet.

The computer worm was discovered in 2010 when it caused malfunctions at industrial plants and factories using Siemens equipment and PLCs.

Iran's nuclear enrichment plants were the supposed target of Stuxnet, which was found in the control systems for several of the country's nuclear facilities, including a nuclear facility at Natanz.

The effectiveness of the Siemens security updates, issued two years later, may never be proven, however, because Stuxnet had a "kill date" of 24 June 2012.

This means the worm has now stopped spreading, said F-Secure's chief research officer, Mikko Hypponen, in a blog post. “But that has little significance, as the operation had already been active for years and reached most of its targets by 2010," he wrote.  

The software update from Siemens comes as reports circulate of a fresh cyber attack on an Iranian nuclear enrichment project, according to the BBC.

F-Secure reported that it received an e-mail believed to have been sent by a scientist at Iran's Atomic Energy Organisation, claiming that two of its plants had been hit by another cyber attack.

Hypponen said F-Secure had not been able to confirm any of the details in the message. However, he did confirm that the message had come from within Iran's Atomic Energy agency.             

The message said: "I am writing to inform you that our nuclear program has once again been compromised and attacked by a new worm, with exploits which have shut down our automation network at Natanz and another facility, Fordo near Qom.

"According to the e-mail our cyber experts sent to our teams, they believe a hacker tool Metasploit was used. The hackers had access to our VPN. The automation network and Siemens hardware were attacked and shut down. I only know very little about these cyber issues as I am scientist, not a computer expert."

On 23 July, Iran issued a statement saying it had successfully "confronted" sophisticated malware and thwarted all the cyber attacks against the nation's infrastructure.

In June, security researchers reported that there was evidence that the creators of the Flame and Stuxnet malware cooperated at least once during the early stages of development.