Xmarks bookmark sync passwords safe, says LastPass

LastPass said Thursday that hackers did not obtain passwords linked to Xmarks, the browser synchronization service the company acquired last December.

Earlier in the day, LastPass forced customers to reset their master passwords after detecting a "traffic anomaly" that may have been a hacker intrusion.

But Xmarks passwords were not affected, and users of the browser plug-in -- available for Internet Explorer, Firefox, Chrome and Safari -- were not required to come up with a new password.

"Xmarks users are not impacted that we can see," said LastPass CEO Joe Siegrist in an email reply to questions Thursday. "Different machines, networks, databases."

LastPass, an online password management company that bills its free and for-pay service as "The Last Password You'll Have to Remember," acquired Xmarks late last year.

Before selling to LastPass for an undisclosed sum, Xmarks, which synchronizes browser bookmarks across multiple computers, browsers and operating systems, was ready to pull the plug on its service. In September 2010, Xmarks said it could no longer compete with the sync services built into Chrome and Firefox.

Later, Xmarks ran a pledge drive that asked users to promise to pay $10 annually for the service.

After buying Xmarks, LastPass retained the free service but also added a $12 per year premium service that offered bookmark synchronization toiPhone,ipad,Android and BlackBerry users.

In an interview late Thursday with PCworld -- like Computerworld, an IDG publication -- Siegrist said that at the worst, the danger to LastPass users was "a one in a million kind of a risk."

Brocade gives a reality check on IPv6

"IPv4 diehards" and "IPv6 purists" are both wrong: The transition will be long and hard, Brocade said

The looming depletion of Internet addresses has split the networking world into "IPv4 diehards" and "IPv6 purists," but the real needs of businesses lie somewhere in between the views of these extremists, a Brocade Communications Systems executive said this week.

Speaking on Tuesday to the Brocade Technology Day Summit on the company's campus in San Jose, California, Director of Product Management Keith Stewart said many Brocade customers are grappling with the issue of IP (Internet Protocol) address migration.

"As organizations embarked upon that journey, we found many felt that there was a lack of a pragmatic point of view on how to manage that transition. The market was dominated by conversations at opposite ends of the spectrum," Stewart said.

IPv4, the addressing scheme used in most of the Internet today, is limited to about 4.3 billion unique Internet addresses, and most of those have already been assigned. PCs, servers, phones and other devices that use the Internet need an IP address to communicate, and soon they may only be able to get addresses from the next-generation protocol, IPv6. The announcement in February that the global Internet Assigned Numbers Authority (IANA) had assigned its last large block of IPv4addresses to regional registries placed this fact in sharp relief. However, reaction to the trend has come down on two extremes, according to Stewart.

The "IPv4 diehards" think that the current addressing scheme can be extended forever through NAT (network address translation) and there is no economic incentive to move to IPv6, he said. The "IPv6 purists" believe all organizations should move to the new protocol in the next 18 months. "That's simply not economically viable," Stewart said. It's also not realistic to think NAT will take care of all the IPv6-only client devices that enterprises will want to reach in the coming years, he said.

"We believe that exhaustion is real, but that most organizations have time to plan and execute their strategies," Stewart said. And administrators should get ready for a long transition, broken into several stages. "A two-protocol world is the world in which we will live for the next decade," Stewart said.

Stewart summed up the debate well, according to analyst Michael Howard of Infonetics Research, who saw the presentation. Moving to IPv6 while remaining visible to IPv4 users involves a lot of unanswered questions and unknown costs, Howard said. While some enterprises and service providers are already taking the plunge, most are scared of what the move will entail, he said.

Not surprisingly, Brocade said it has some tools to help customers navigate the transition. For example, the Brocade ServerIron ADX Series, which it calls an "application delivery switch," can be used to present an organization's existing sites and services to IPv6 users. Brocade also has a NAT gateway for translating IPv4 to IPv6 addresses, which it developed for a cable operator that needs to deliver IPv6-based video-on-demand products over existing set-top boxes that can only use IPv4. These products are available now, Stewart said.

Brocade claims it is the first and only major technology vendor to make its Web presence, mail presence and DNS (domain name system) presence on the Internet available via both IPv4 and IPv6. Economics helped drive the company to this point, Stewart said. The U.S. government, a big Brocade customer, is starting to give preference to IT vendors that have proved their IPv6 capability by implementing the new protocol themselves, he said.

Anonymous not off the hook for the Sony PlayStation Network attack

The worldwide hacker group Anonymous may have played a role - even unwittingly - in the theft of personal data from 77 million Sony PlayStation Network customers, according to a letter from Sony's chairman to a Congressional committee.

Forensics teams have tracked the attack that netted the information to a file named "Anonymous" on an internal Sony server including the words "We are Legion", which is part of the hacker group's motto.

"Just weeks before, several Sony companies had been the target of a large-scale, coordinated denial of service attack by the group called Anonymous," says Kazuo Hirai, Sony's chairman, in the letter.

PAST DDOS DEBACLES: DDos Hall of Shame

That attack and the threat of more had Sony network security staff focused on DDoS defense, which might have distracted them from discovering the breach earlier, the letter says, "perhaps by design."

"Whether those who participated in the denial of service attacks were conspirators or whether they were simply duped in to providing cover for a very clever thief, we may never know. In any case, those who participated in the denial of service attacks should understand that - whether they knew it or not - they were aiding in a well planned, well executed, large scale theft that left not only Sony a victim, but also Sony's many customers around the world."

Anonymous earlier issued a statement that it wasn't responsible, but acknowledged that individual members might have acted independently to break in and steal the data.

The letter to Congress was prompted by a set of questions sent from a Congressional committee to Sony seeking information about the breach, how it happened and what Sony was doing about it.

The letter says that the attackers exploited a software vulnerability in one of the applications in the network that supports PlayStation Network, the online gaming site for Sony PlayStation customers.

The network consists of 130 servers, 50 software programs and 77 million registered accounts, the letter says. In all, Sony came to believe 10 of those servers had been compromised.

The letter says Sony knows the personal data was compromised because it found records of queries being made for it and large data transfers being made out in response. There were no logs of request for credit card information or corresponding outbound transfers, which is why Sony says credit card information might have been compromised but it just doesn't know.

"Among other things, the intruders deleted log files in order to hide the extent of their work and activity within the network," the letter says, which led Sony to conclude that "very sophisticated and aggressive techniques to obtain unauthorized access, hide their presence from system administrators, and escalate privileges inside the servers" had been used.

"At the same time that the experienced attackers were carrying out their attack, they also attempted to destroy the evidence that would reveal their steps."

The worst moments in network security history

The company says it has taken six steps to prevent future breaches:

* Added automated software monitoring and configuration management to help defend against new attacks;

* Enhanced levels of data protection and encryption;

* Enhanced ability to detect software intrusions within the network, unauthorized access and unusual activity patterns;

* Implementation of additional firewalls;

* Expediting a planned mover of the system to a new data center in a different location with enhanced security;

* Naming of new chief information security officer directly reporting to the chief information officer of Sony Corp.

To make up to its customers, Sony plans to offer U.S. members complementary identity theft protection services.

It is creating a Welcome Back program including selected PlayStation entertainment content for free. All consumers returning to PSN will get 30 days free membership in PlayStation Plus premium subscription service. Current PlayStation Plus customers will have subscriptions extended for the number of days PSN and Qriocity services were unavailable and get an additional 30 days of free service, Sony says.

EMC's Iomega launches NAS storage line for smaller businesses

The disk storage arrays support both file and block level data transfers 

EMC subsidiary Iomega today unveiled a new series of simple disk storage arrays aimed at small-to-medium sized businesses and remote offices.

Known for its small office and home office products, Iomega is trying to sell upstream with its new StorCenter PX Series of network storage products. The company said the new arrays are its most advanced series of desktop and rackmount NAS devices.

The Iomega StorCenter PX desktop NAS box

The StorCenter PX Series features four-bay and six-bay desktop models and a four-bay rackmount model, each available in scalable configurations. Prices for the NAS range from $799 for a diskless, four-bay StorCenter desktop version to $3,999.99 for a six-bay, 18TB StorCenter px6-300d model.

The NAS arrays are optimized for 3.5-in., 7,200rpm, serial ATA (SATA) hard disk drives, but they can also use 2.5-in drives. The devices are also the first for Iomega that can use solid-state drives (SSDs).

Another first for Iomega: the StorCenter PX series arrays can replicate data between each other for business continuity and disaster recovery purposes, according to Marc Tanguay, Iomega's general manager of network storage products.

Tanguay said Iomega plans to demonstrate streaming multiple virtual desktop image files from SSDs in a StorCenter PX box next week at EMC World. "Virtualization is a real target application for these products," he said. "They have great performance for things like call centers with boot storms in the morning and for streaming video."

A StorCenter PX series NAS box with a drive removed

The StorCenter PX series features hot-swappable drives and several levels of RAID disk protection. Iomega also included an iSCSI port for block-level data transfers.

he arrays are certified for VMware vSphere 4.0, Citrix XenServer, and Windows Server 2003/2008/2008 R2 HyperV environments.

"With new software features, we think this will help us expand into the remote office of larger enterprise customers," Tanguay said. For example, the NAS boxes offer Microsoft Active Directory Domain Services for distributed networks, allowing the boxes to replicate back and forth to a main corporate data center.

Brocade developing 32-Gigabit Fibre Channel

The company is also planning a massive data-center chassis switch for next year

Brocade Technologies, which announced 16G bps (bit-per-second) Fibre Channel products on Monday, is already working on a 32G bps version and expects to have it on the market within three years.

Other vendors are moving toward Ethernet as a common storage and LAN interconnect, with 40G bps and 100G bps generations recently standardized. But while Brocade offers a growing range of Ethernet products, it also plans to continue developing Fibre Channel, a specialized protocol for storage in which the company has a dominant market position.

Brocade's customers like and trust Fibre Channel, CTO Dave Stevens said at a press and analyst event on the Brocade campus on Tuesday, after he was asked why his company is pushing ahead with faster iterations.

Customers tell Brocade that Fibre Channel is tested, cost-efficient and resilient, Stevens said. Earlier in the day, Brocade executives had said that demand for FCOE (Fibre Channel Over Ethernet), which is designed for unified networks across storage and computing, is still very thin. Brocade also offers FCOE. Executives said Brocade believes it is important to give customers choices.

In addition to 16G bps Fibre Channel products, which will be backward compatible to the earlier 8G bps, 4G bps and 2G bps versions of the technology, Brocade announced a variety of products for enterprise and service-provider networks on Tuesday. The company is focused on extending the predictable and solid characteristics of data center networks across entire networks, all the way out to client devices and remote locations.

Brocade also unveiled an architecture called CloudPlex, which will guide the company in developing infrastructure for private, public and hybrid clouds. Ultimately, this architecture will provide a way for enterprises to easily and quickly shift virtual machines between public and private clouds over long distances, Stevens said. The architecture for doing this, called Starlifter, will hit the market in 2012, CEO Mike Klayko said in an interview after the event.

Also on Tuesday, Stevens gave a few details about a large, chassis-based version of the company's VDX 10G bps switch. The current VDX models are designed for the tops of server racks. The chassis-based model will be able to accommodate more than 750 ports of 10-Gigabit Ethernet and more than 100 ports of 100-Gigabit Ethernet, he said. It will also support 40-Gigabit Ethernet. The switch will be based on the same software stack and Brocade ASICs (application-specific integrated circuits) as the current VDX line.

As a networking specialist competing against companies such as Cisco Systems and Hewlett-Packard that are building product lines spanning the data center, Brocade emphasized its interoperability with other vendors' products.

"The problem with the virtual enterprise is that it's too big a problem for any one company to solve," Stevens said.

The company is developing what it calls "virtual compute blocks" that will combine Dell servers and storage with Brocade network adapters and VDX switches, with the VMware hypervisor for virtualization. The blocks will carry Brocade's brand, but customers will be able to order them from Dell beginning later this year.

Business, IT collaboration drives new BI system at Toyota

System provides common view of six years of data 

LOS ANGELES -- A recently implemented business intelligence project at Toyota Motors challenges a growing perception that IT organizations are no longer able to keep up with the BI demands of their business units.

The new Product Quality Analytics system is being used by Toyota's Technical Information & Diagnostics Group and was built largely in response to the crisis stemming from a massive product recall last year.

The system provides a common view of six years' worth of product and quality data from multiple internal systems across the company.

It allows Toyota's quality engineers to search through, drill down, mash up and analyze data from sources as disparate as its vehicle configuration system, customer call centers, warranty claims system, customer mediation group and service centers.

The system supports both structured and unstructured data, a search-engine like interface and filters that allow users to view product quality data in a manner that was not previously possible, said Tom Trisdale, manager of Toyota's Technical Information & Diagnostics Group. The group is part of Toyota's product quality and support organization.

"The great thing is, everything is available from one source," said Trisdale during a session detailing the project at the Gartner Business Intelligence conference held here this week.

"We can have results very quickly," ensuring significant productivity gains, he said. Importantly, the system allows its quality engineers to filter, visualize and explore multiple years' worth of quality data for patterns that they wouldn't even have known to look for previously.

The system was developed in partnership with Toyota's IT organization at a time when business groups in many companies are increasingly taking the lead on such efforts.

For instance, in a recent survey of 575 BI professionals by software vendor LogiXML, more than half said they were dissatisfied with IT's ability to deliver business intelligence functionality. More than one in four respondents said their organizations did not have the IT staff needed to deliver BI functionality.

In Toyota's case, a couple of factors contributed to the successful partnership, said Mike Burkes, manager of the auto maker's information management group. One was technology.

Toyota's IT group was able to deliver the BI system much faster than it would have been able to normally by taking advantage of technology from Endeca, Burkes said.

Endeca's software allows users to quickly and easily search for, view and analyze data from multiple enterprise data repositories. It allows users to design reports and dashboards in minutes using both structured and unstructured data from numerous sources.

The software can be implemented in a fraction of the time it would take to develop a BI system with similar capabilities -- a factor that has led to the explosive growth of companies such as Endeca and rivals such as QlikView.

In several cases, the ones deploying BI systems based on such technologies are the business units. Contrary to perception, IT is involved in a vast majority of such efforts, said Donald Farmer, former Microsoft BI guru and an advocate at QlikView.

However, in a growing number of cases, its role is more about providing and governing the data that feed BI systems, rather than building out the BI system, he said. "They have become the providers of information," rather than developers of BI systems, in a growing number of instances, he said.

In Toyota's case, the IT group was able to play a more direct role. Endeca's Latitude software allowed Toyota's IT department to deliver the BI capability that its quality group was looking for much more quickly than it would have been able to otherwise, Burkes said. "We have never delivered anything in less than 12 months," he said.

Another factor that contributed to the success of the project was the effort that both sides put into explaining and understanding business requirements, managing expectations and establishing trust, Burkes said.

Almost 45% of the time and budget on the project was also spent on improving data quality to ensure that the data being used by the BI system was as useful and consistent as possible.

"We were able to do this because we had both business and IT saying we want this," Burkes said.