Mobile Security Update - AnyConnect released to the Android market

(galaxy s,samsung galaxy s,samsung tab,galaxy tab,samsung galaxy tab,samsung android,android,samsung galaxy s2,galaxy s2,samsung galaxy 2,nokia,nokia mobiles,samsung mobiles,mobiles in india,sony mobiles,nokia mobile,sony ericsson,sony ericsson mobiles,nokia india,samsung mobile)
Cisco has followed up its release of the AnyConnect VPN client for Apple iOS devices with the launch of Cisco AnyConnect for Samsung. Available from June 27 2011 AnyConnect is supported on the following devices:(galaxy s,samsung galaxy s,samsung tab,galaxy tab,samsung galaxy tab,samsung android,android,samsung galaxy s2,galaxy s2,samsung galaxy 2,nokia,nokia mobiles,samsung mobiles,mobiles in india,sony mobiles,nokia mobile,sony ericsson,sony ericsson mobiles,nokia india,samsung mobile)

Galaxy S model GT-I9000 (Gingerbread Maintenance Release)Galaxy S model SC-02B (Gingerbread Maintenance Release)Galaxy S II model GT-I9100Galaxy S II model SC-02C
AnyConnect is also supported on Tab 7 running Android 2.3.3+ or Galaxy Tab 8.9 running Android 3.0+.
Android images must be official carrier or Samsung provided versions, and not home-brew or third-party builds of Android.
Cisco AnyConnect provides reliable and easy-to-deploy encrypted network connectivity from Samsung Android devices by delivering persistent corporate access for users on the go. This includes native application access to business email, a virtual desktop session, or most other Android applications.
Through the use of Datagram Transport Layer Security (DTLS), TCP-based applications and latency-sensitive traffic (such as voice over IP [VoIP]) are provided an optimised communication path to corporate resources.
Further details from the Android marketplace as below
FEATURES:
Automatically adapts its tunnelling to the most efficient method based on network constraints, using TLS and DTLSDTLS provides an optimised connection for TCP-based application access and latency-sensitive traffic, such as VoIP trafficNetwork roaming capability allows connectivity to resume seamlessly after IP address change, loss of connectivity, or device standbyWide Range of Authentication Options: RADIUS, RSA SecurID, Active Directory/Kerberos, Digital Certificates, LDAP, or multifactor authenticationSupports certificate deployment using AnyConnect integrated SCEP and the certificate import URI handlerPolicies can be configured locally, and automatically updated from the security gatewayAccess to internal IPv4 network resourcesAdministrator-controlled split / full tunnelling network access policy
Feedback has been mixed, with a number of Android users unhappy that only a small number of Android devices are compatible with the software. Users who have devices which are not specifically listed above will need to wait until the next release of AnyConnect in the Android market place. Further information is available at the Cisco website


View the original article here

Apple pushes out critical Java security update for OS X users

In an effort to resolve at least two remotely exploitable vulnerabilities that can be taken advantage of whilst a user is browsing the Internet, Apple has released an update to Java SE 6 which appears as 'Java for Mac OS X Update 5 Version 1.0' within the Software Update tab.

All OS X users are strongly encouraged to update, as this update resolves a number of published security issues.

According to Oracle, Java Platform Standard Edition (Java SE) is "designed to enable you to develop secure, portable, high-performance applications for the widest range of computing platforms possible."

"Java SE lets you develop and deploy Java applications on desktops and servers, as well as today's demanding embedded and real-time environments."

With a significant global footprint it's no wonder Oracle need to keep on top of the latest vulnerabilities. The latest update to the Java 6 Platform (6 1.6.0_26) was released in the second week of June 2011, and was available immediately to Linux, Windows, and Solaris platforms. Android users are encouraged to update their host and development operating systems where relevant. iOS 4.3 does not support Java.

Paul Ducklin from Sophos points out that Java updates for Mac OS X aren't listed on the Oracle download website. "You can download the latest updates for Linux, Solaris and Windows - and even for the esoteric Itanic processor - but there's no offering for OS X users of any stripe."

Mac users are left to wait for Apple to approve the updates and distribute them, a wait which could be days or even weeks while the Java environment remains unpatched. As recently as May 2011 McAfee reported in a blog post that a new cross-platform malware threat had been seen 'in the wild' - one that can execute on Windows and Mac operating systems with older versions of Java.

"IncognitoRAT is one example of a Java-based Trojan discovered in the wild that is being downloaded and installed by another component. This malware behaves like other Windows botnets but uses source code and libraries that can operate on other platforms" McAfee blog author Carlos Castillo wrote.

IncognitoRAT performs a number of activities, including

Java Remote Control: To view and take remote control (keyboard and mouse) of an infected machineJLayer – MP3 Library: To remotely play an MP3 file on the infected machineRNP-VideoPlayer: To play videos remotelyJavaMail: Optional Java package to send stolen information to an email accountFreedom for Media Java: Open-source alternative to the official Java Media Framework; used by the malware to watch and record images from a remote webcam

One of the most worrying issues fixed by the latest Java release is the ability for a Java applet to escape from Java's much-vaunted protective sandbox.

"Escape from the sandbox means that remotely-served, untrusted applets can trick the system into letting them behave like locally-installed, trusted applications. That's never supposed to happen, and it's always bad." Ducklin explains.

To update, just invoke the Software Update... option under the Apple menu and apply the outstanding Java update.

For corporate networks with large numbers of Mac users this could be a bandwidth intensive task.

There are some solutions available including software which can manage OS X end points centrally. Apple also provides the Software Update Enabler (free from Apple downloads) which points Mac clients later than OS X 10.4 to a local server for system updates.

The Mac OS X Update 5 Version 1.0 update is approximately 80Mb.

View the original article here