Business Tech

Read all 'management' posts in Business Tech
December 17, 2009 10:52 AM PST

Ubuntu Linux founder stepping down as CEO

by Stephen Shankland

Ubuntu Linux backer Canonical is changing top management in an effort to become more operationally disciplined, with founder Mark Shuttleworth passing the chief executive job to Chief Operations Officer Jane Silber by March 1.

Shuttleworth will continue working at the company, focusing on the company's desktop Linux product, its cloud-computing efforts, and meetings with partners central to the company's business. Silber, who has worked for the company for almost all its five-year history, will spend more of her time on Canonical's enterprise products for business customers.

Canonical CEO Mark Shuttleworth speaking at the Intel Developer Forum

Canonical CEO Mark Shuttleworth speaking at the Intel Developer Forum

(Credit: Stephen Shankland/CNET)

"Within the company I can say very strongly everyone's expectations will be that Jane will bring a focus on financial performance as much as operational performance. It's something I want for the company," Shuttleworth said in a conference call with reporters Thursday.

Shuttleworth founded Ubuntu and Canonical in part as a reaction to Red Hat and Novell's Suse Linux, both of which are available as a free version that differs from the commercially supported product. With Ubuntu, the two versions are the same, meaning that those who want the better-tested and certified product need not necessarily pay for it. Canonical does offer support subscriptions and is working on gradually proving its server operating system's mettle beyond just test and development situations.

Canonical today has two other main lines of business besides its Linux server support: partnerships to help with operating-system technology for Netbook companies, including most recently Google for its Chrome OS; and selling support for Ubuntu's newer cloud-computing technology developed in partnership with Eucalyptus Systems. The Eucalyptus technology is compatible with Amazon Web Services options including the Elastic Compute Cloud (EC2) and Simple Storage Service (S3), but lets customers use the technology in their own data centers or in combination with Amazon.

Shuttleworth, who funds Canonical with wealth stemming from selling his Thawte Internet consulting business to Verisign in 1999, takes a long-term view of the company's finances.

"We are not profitable. But we continue to believe we're on the right trajectory," Shuttleworth said.

"Five years is a long time," he said, but Canonical wants to be a platform company on which others house or build their own technology. "Those take a substantial amount of time to get a foothold. We continue to invest in areas that make us a complete platform rather than focusing on the things that could achieve profitability fastest."

The company presently has more than 300 employees, he said.

Canonical releases new versions of Ubuntu every six months, the most recent being 9.10, called "Karmic Koala." Version 10.4, or "Lucid Lynx," is due in April. It will be one of the LTS versions that comes with long-term support for customers who don't enjoy upgrading their operating systems frequently. Canonical releases LTS versions every two years.

Originally posted at Deep Tech
December 16, 2009 9:05 AM PST

IBM to buy enterprise software maker Lombardi

by Lance Whitney
  • Post a comment

IBM is making yet another acquisition, this one a leading provider of business process management software.

Big Blue announced on Wednesday its intention to purchase Lombardi, a privately-held firm that sells business process management (BPM) software and services. BPM is designed to help companies cut costs and improve efficiency by automating and integrating key business processes. This encompasses such areas as product planning, supply chain, product procurement, human resources, and IT services.

Market research firm IDC forecasts that the market for BPM software will reach $3 billion by 2013, up from $1.7 billion this year--a compounded annual growth rate of almost 15 percent.

"Any discussion on business improvement inevitably leads to improving the processes that are at the heart of every company," said Craig Hayman, general manager for IBM Application and Integration Middleware, in a statement. "Recognizing this, IBM has strengthened its presence and investments in business process and integration software to meet these growing client demands. Lombardi fills out our company's portfolio in this key area."

Based in Austin, Texas, with offices in Europe, Lombardi has enjoyed record sales over the past few years. For fiscal 2008, the company's revenues almost doubled, rising 47 percent over those in 2007. Lombardi's customers run the gamut to include financial services, government, health care, insurance, manufacturing, and telecommunications.

Both companies see the acquisition as a nice fit since Lombardi's Teamworks development and Blueprint documentation products already work under IBM's WebSphere environment. The two also enjoy many of the same customers and partners, which should pave the way for a smooth transition. IBM also noted that its existing technologies and those of Lombardi won't be changed, so customers can continue to use their current systems.

"Lombardi's had a long-standing technical partnership with IBM--we were one of the first vendors in the BPM space to deliver a product running on WebSphere," wrote Lombari CEO Rod Favaron in his blog on Wednesday. "We understand IBM's strengths and we know how they complement ours as well. We also know that there is a great fit for both Teamworks and Blueprint into the overall IBM BPM portfolio."

IBM has been on an acquisition streak this past year, trying to beef up its offerings to business customers. The company has so far gobbled up data discovery software firm Exeros, database security firm Guardium, security provider Ounce Labs, and analytics provider SPSS.

Following the usual regulatory approvals, Lombardi will be integrated into IBM. No specific closing date or financial terms were disclosed.

advertisement
 
Lotus knows there's more to work than just email.
Connect with people. Get live feeds. Create widgets. Work securely online or off. Try IBM Lotus Notes.
December 8, 2009 6:55 AM PST

Novell's quarter crumbles, but a new market beckons

by Matt Asay
  • 9 comments

The next time you feel tempted to laud the power of the open-source business model, take a look at Novell.

Novell has been struggling for over 10 years, yet it still manages to crank out nearly $1 billion in sales each year, most of which derives from the licensing of proprietary software.

Novell reported its fourth-quarter earnings on Thursday, along with results from its full fiscal year. They're not pretty, but they do suggest a path forward for the erstwhile software leader.

Novell saw its sales slump over 12 percent from its year-ago quarter to $216 million. For the full fiscal year, Novell stumbled to a $257 million net loss, versus a $5 million profit in 2008, on net revenue of $862 million and a net loss from operations of $206 million.

Perhaps not for long.

Much of that annual deficit came in the fourth quarter, which included a $279 million noncash impairment charge that sent Novell's quarter into the red by $259 million.

Not pretty.

Unless you look at Novell's Linux numbers. Linux remains Novell's most appealing business and was up 21 percent year over year to $149 million--and up 14 percent at $39 in in its fourth quarter over the year-ago period. While a far cry from Red Hat's booming Linux business, Novell's results suggest that there's life in its Linux business yet.

Life that Microsoft continues to seem content to grant.

Make no mistake, without Microsoft, Novell's Linux business would struggle, at least in the short term. Microsoft, after all, has been funding Novell's Linux business since 2006, when the two companies entered into an interoperability and Suse Linux subsidy pact.

And without its Linux business, all of the rest of Novell's business would be in jeopardy, as Suse Linux makes Novell's other products a palatable choice. Even so Novell's Identity and Security Management, Systems and Resource Management, and Workgroup businesses all dropped significantly (down 10 percent, 6 percent, and 13 percent, respectively).

Novell's needs
Clearly, Novell needs Linux. Equally clearly, it needs Microsoft to grow that Linux business. Microsoft has already plowed $247.5 million into Suse Linux Enterprise Server (SLES) subscription coupons, and Novell CEO Ron Hovsepian has indicated he's now dipping into the additional $100 million in coupons the companies negotiated.

But how can Novell accelerate its Linux business at a pace that will be comfortable for Microsoft, which has made no secret of its animus to Linux and desire to quash it? Microsoft partners with Novell to show a good interoperability face to its customers who use Linux and to prop up the No. 2 vendor against Red Hat, the dominant Linux vendor.

The day that Novell's Suse Linux business threatens Microsoft, and not merely undermines Red Hat, is the day Microsoft will pull its extensive financial support from Novell's Linux business. That same day Novell's Linux business will crumble, perhaps irreparably.

Unless.

Unless Novell can deliver a coherent strategy centered on Linux rather than merely friendly to Linux. For years Novell has packaged and repackaged a set of mostly stale offerings (e.g., Workgroup), pretending that they were part of a coherent strategy.

They weren't. The company was simply milking maintenance revenues as it sought to find a way forward. (I was in those meetings back in 2002 when the company discussed how to stanch the bleeding from maintenance declines. Those same conversations continue today, I'm sure.)

Then, as now, Novell's various product lines, and particularly Workgroup, offered little synergy, either in sales or engineering (i.e., the buyer of GroupWise is not the same as the buyer of Suse is generally not the same as the buyer of Identity Management).

Ongoing makeover
Novell is now entering a new phase of its repackaging makeover, but this one actually makes some sense. The company is calling it Intelligent Workload Management, arguing that a "new market [exists] for solutions that address the risks and challenges for computing securely across multiple environments."

Not surprisingly, Hovsepian argues that such an Intelligent Workload Management market "plays to the strengths of Novell--identity and security, systems and resource management, and our new Suse Appliance program."

Surprisingly, he may be right.

First of all, its wonderful to see Workgroup dropped from the discussion. Yes, it's Novell's biggest product by revenue, but no, it has almost no relevance for the rest of its business. Sell it off. Move on. The company has already offloaded much of its Workgroup development to India, anyway.

Second, Novell really does have a great deal of expertise in this area, with some assets that could go a long way toward helping it compete with the vendors that compete aggressively in the market: VMware, Microsoft, and increasingly Red Hat.

The key will be for Novell to really put Linux at the heart of its story, rather than simply using it as a conversation starter and loss-leader.

And yet, more is needed. Novell has the burden of a stale brand that it must shed. A few select acquisitions could help it to establish technology and brand leadership in the market. Companies like Reductive Labs (Puppet project for data center infrastructure management), VMOps or Eucalyptus (for building and managing private clouds), and/or Cloudera (for designing and analyzing large-scale data assets) could put Novell in the driver's seat on this market.

For the first time in years, the market seems to have moved in a direction that corresponds with Novell's rich technology assets. If Novell can make Linux the centerpiece of this campaign, bolstered by relevant, innovative technology, it will finally get its Linux business out of Microsoft's shadow and its overall business back on track.

The technology pieces are in place. It's now a question of brand and execution.

Originally posted at The Open Road
Matt Asay brings a decade of in-the-trenches open-source business and legal experience to The Open Road, with an emphasis on emerging open-source business strategies and opportunities. Matt is vice president of business development at Alfresco, a company that develops open-source software for content management. He is a member of the CNET Blog Network and is not an employee of CNET. Disclosure. You can follow Matt on Twitter @mjasay.
September 1, 2009 9:49 AM PDT

Xen.org to build open-standards cloud platform

by David Meyer
  • Post a comment

The Xen.org community has announced plans to build a new cloud platform for service providers, as the basis of an initiative designed to help private and public cloud services cooperate using open standards.

The planned Xen Cloud Platform (XCP), announced on Monday, will combine enhanced security, storage, and network virtualization capabilities with the Xen hypervisor--a piece of open-source software used for running virtualized operating systems on server hardware.

However, a key goal of the wider XCP initiative is to use open standards from the Distributed Management Task Force (DMTF) to package virtual appliances in a hypervisor-independent format that can be transported between private and public clouds without vendor lock-in.

"Today Xen is already the most widely used hypervisor in the service provider market and the community will be able to build on this momentum to develop a complete, open source, cloud-optimized Xen virtual infrastructure platform," Xen creator Ian Pratt said in a statement. "Our goal is to (let providers) offer a rich set of services that will catalyze cloud adoption by the enterprise in a way that's open, accessible, and non-proprietary."

According to Xen.org, the XCP initiative will not try to develop new virtualization management tools for the bridging of public and private clouds, as this area is already well-served by commercial products and open-source initiatives such as the Eucalyptus project and OpenNebula.org.

Instead, the new initiative will build on storage, security, and network virtualization technologies that are "already under development as part of Xen.org," the community said. It added: "As a result, the new platform will not only address cloud provider requirements around security and isolation, but will also meet next-generation user requirements for security, availability, performance, isolation, and manage between on-premise and off-premise infrastructures."

Xen.org advisory board members including Citrix, HP, Intel, Novell, and Oracle are backing the XCP initiative, as are a host of other companies such as NetApp, AMD, Dell, Fujitsu, Juniper Networks, and GoGrid.

"Novell is committed to an open-source model that thrives on the support and contributions of a strong community," Carlos Montero-Luque, Novell's open platforms chief, said in the statement. "Creating a stable, well-defined public API for Xen will help drive its rapid adoption inside the enterprise and in clouds."

Oracle's head of Linux engineering, Win Coekaerts, added that "aligning the community around a single compatible code base will maximize the benefits of open-source virtual infrastructure for customers, and simplify the federation of private and public clouds."

The Xen.org statement said it wanted to bridge internal enterprise clouds with "external cloud platforms like Amazon EC2, Rackspace Cloud Server, and GoGrid." While Rackspace and GoGrid are both quoted as supporters of the XCP initiative, Amazon is not involved in the project.

Last week, Amazon launched a separate service, Virtual Private Cloud (VPC), for bridging private and public clouds. VPC is designed to let companies extend their security services, firewalls, and intrusion-detection systems to the cloud, and Amazon has indicated it will roll out the service--currently in beta--to all of the Amazon Web Services.

David Meyer of ZDNet UK reported from London.

Correction, Sept. 2, 4:53 a.m. PDT: This story initially miscast some background information on the DMTF.

August 19, 2009 3:15 PM PDT

Smartphones moving to fancier flash drives

by Brooke Crothers
  • 6 comments

Memory chip makers will offer more sophisticated flash drives for smartphones--technology that will be comparable to the solid-state drives found in laptops today.

The Palm Pre comes with an 8GB flash memory drive: flash drive makers like Micron Technology will market more sophisticated flash drives for future phones.

The Palm Pre comes with an 8GB flash memory drive: flash drive makers like Micron Technology will market more sophisticated flash drives for future phones.

(Credit: Palm)

Today's flash drives, which typically range up to 32GB in capacity in products like Apple's iPhone, often use relatively unsophisticated techniques for reading and writing data. In general, the technology is not very different from that used in basic cell phones or digital cameras, according to Brian Shirley, vice president of Micron's memory group.

But as smartphones--and possible future tablet devices--become more like personal computing devices and less like basic MP3 players, memory chip makers will begin offering more sophisticated flash memory, said Shirley, in a phone interview.

"In nearly all MP3 players today it's almost exclusively 'raw' NAND. And at some point we anticipate moving more to a managed NAND," Shirley said. NAND is the type of flash memory chip used in all flash cards and solid-state drives.

Managed NAND falls somewhere between very basic flash drives--such as Secure Digital, or SD, cards--and pricey solid-state drives (SSDs) used in laptops and servers. "It's something in between the raw NAND that we've been talking about for cell phones and MP3 players and the full-blown SSD space," Shirley said.

"We believe this will be fairly busy (market) space in 2010," he added.

Solid-state drives used in laptops like the Apple MacBook Air and Dell Adamo get their performance from highly-developed, sophisticated controller chips and firmware, which manage how the data is read and recorded. Though managed NAND wouldn't necessarily reach this level of sophistication, it would begin to approach it.

The iPhone uses raw NAND with a separate controller, according to Gregory Wong, founder and principal analyst at Forward Insights, which does research on flash memory technology.

"They like to have control over the flash and the controller so they can boost performance," he said. "They're very cognizant of differentiating their products. The user experience is what is important to them. Whether it means you can download your music or video very quickly, whether it means you can find the data very quickly--that ties in to how they manage the NAND," he said.

But even Apple is looking for better performance as it looks to continue its very successful strategy of making its products different, according to Wong.

And future Netbooks may also use this kind of flash memory. Netbooks today using Intel Atom processors and the Windows operating system use, almost exclusively, hard disk drives. But a new category of Netbooks dubbed smartbooks--devices that are always on, always connected, and boast all-day battery life--are expected to come to market in 2010 packing flash drives. These small laptops may be candidates for managed NAND.

Originally posted at Nanotech - The Circuits Blog
Brooke Crothers has served as an editor at large at CNET News, an editor at Dow Jones' Asian Wall Street Journal Weekly, and a senior editor at InfoWorld. His CNET blog covers chip technology and computer systems, and how they define the computing experience. He also contributes to The New York Times' Bits and Technology sections. He is a member of the CNET Blog Network and is not an employee of CNET. Disclosure. Follow Brooke on Twitter @mbrookec.
advertisement
 
Lotus knows there's more to work than just email.
Connect with people. Get live feeds. Create widgets. Work securely online or off. Try IBM Lotus Notes.
April 15, 2009 9:57 AM PDT

Algorithms everywhere: Can IBM automate decisions?

by Larry Dignan
  • 2 comments

This was originally posted at ZDNet's Between the Lines.

IBM is outlining a vision--and of course a new services unit to go with it--that takes a little time to grok.

Big Blue speaks about the "information journey," about fact-based enterprises, and about nudging out gut calls in everyday management for decisions based on hard, cold facts. When you boil it all down, Big Blue is talking about providing a bag of algorithms that will automate many of your business decisions.

Sitting through IBM's series of presentations on Tuesday about how we'll all work for fact-based enterprises in the future left me with a few nagging questions (with a dearth of concrete answers): What's the role of intuition and gut calls in management? Are we all becoming quant black boxes of management? Can we see around corners for real? What's the prototype of a fact-based enterprise? How long will this journey take and what does the end state look like?

The answers after a few rounds with IBM execs: intuition will still matter, but for the bigger decisions. Some decisions will be automated (think a call center manager who will look for a simple yes/no answer when deciding on whether to extend a warranty). Predictive modeling will be everything. The journey will take awhile and the blueprint will be industry specific. (Rest assured, IBM will consult with you every step of the way).

"We're developing a bag of algorithms to be plugged together," said William Pulleyblank, chief of IBM's center for business optimization. Pulleyblank should know: he led the Blue Gene supercomputing effort. Remember Blue Gene? It might be your boss someday (only half kidding).

There's little question that IBM could hit a sweet spot for its consulting business. Simply put, risk management is on every manager's mind. Anecdotally, execs talk about risk management more. And I've seen it up close. ZDNet's risk management report about Goldman Sachs had a lot of interest, but it wasn't just the financial wonks on board--it was IT folks. Turns out everyone wants to see around the corner for the latest bogeyman. Risk management and mitigation were something that used to be tucked away in the corner. Today they're everyone's business.

In some respects, IBM's big pitch boils down to better data analytics. How can you take all that stuff you've been collecting and find some real intelligence? How can you account for systematic problems? Real-time reaction to customer needs? Altering pricing on the fly?

It would be easy to dismiss IBM's effort as another wrapper to sell software, hardware, and services, but the vision is big and makes a lot of sense. However, I couldn't help but feel a little uneasy. Algorithms are partly responsible for this financial mess. Sometimes the black box fails miserably. And sometimes a little human intervention is needed. And the biggest worry: if managers wind up just looking to a screen to make a call--yes or no--doesn't that make us a business equivalent of a GPS slave where no one will be able to read a map in a decade. Thankfully, IBM's vision doesn't include an artificial intelligence theme. (Maybe next decade.)

Meanwhile, IBM's Fred Balboni, head of the business analytics and optimizations services unit, says Big Blue will go easy on pitching the "intergalactic projects" that may spook clients. The game plan is to serve up valid business cases for being more analytic and deliver returns within a year. Over time, companies can become the so-called fact-based business.

Here's the big picture:

(Credit: IBM)

But are "applied semantics" better than "human insight?"

In Corporate America you can easily (predictively) model some cultural issues. CEOs will love this "fact-based" management, but the front line folks can resist. IBM notes the hurdles, but expects rapid adoption--at least something faster than the ERP revolution of the 1990s. Why? Younger folks already look at their PCs--and Google--as an answer machine, said Brenda Dietrich, vice president of business analytics and mathematical sciences at IBM Research.

This blur of data, computation, and decision-making looks great on paper. The reality is that data architecture is messy already and could use the clean up. Ask the Bill Eimicke, deputy commissioner of New York City's fire department. Eimicke got on this fact-based enterprise bandwagon in 2007 following the deaths of two firefighters as the Deutsche Bank building was being dismantled. (It was heavily damaged on Sept. 11, 2001.).

There were "flammable things" amid the demolition work. The problem: the FDNY didn't know there were flammables because it didn't have access to the data from the plethora of city agencies that inspect buildings.

Eimicke, a Columbia University academic on loan to the fire department, said that the data was there, but not in a form that was usable. His project: aggregate all of the data on buildings in New York so it can prioritize inspections. Maybe a few extra facts will save another Deutsche Bank building from happening. "That crisis triggered our project," Eimicke said.

Indeed, firefighting is an obvious fact-based business. Financial services, health care, and retail are other obvious verticals ripe for some algorithm love. Financial services firms are the farthest along on this algorithm utopia.

What can go wrong?

There are multiple industries that could benefit from a little fact-based decision making, but there are landmines ahead. When I asked Pulleyblank, he rattled off a few items. Given more time, a top 10 list would have emerged.

Here are Pulleyblank's landmines ahead:

• Data quality. Any automated process is only as good as the data being used. If the data has errors in it IBM's algorithms won't work as well. The solution will be better filtering to diminish "noisy data," says Pulleyblank. It's not like a company is going to go back and clean 30 years of data.

• Risk management techniques. This entire concept of managing systemic risk--and determining everything that could go wrong--is young.

• The need for real-time reactions: Are companies ready to respond and make decisions in real-time?

• An unexpected shift in the world. Pulleyblank acknowledges that predictive modeling only goes so far. What are the Black Swans ahead?

• A spectacular failure. "We can't afford a spectacular failure," said Pulleyblank. What would be a spectacular failure? Try a major Northeast blackout where the algorithms in the smart grid are at fault.

It's a bit early for those concerns, but it is something to think about. If IBM's vision plays out, algorithm management will be a key component of businesses everywhere.

March 24, 2009 12:51 PM PDT

VMware: Manage your data center by phone

by Colin Barker
  • 5 comments

VMware has come up with a tool that lets users access the virtualized machines in their data center from a mobile phone.

According to VMware, the VCenter Mobile Access tool will also allow system managers to migrate virtual machines from one virtual host to another, using their phones.

The software was introduced on Friday on VMware's VMTN blog by Srinivas Krishnamurti, the director of product management for the company. In addition to its search-and-migration capabilities, VCMA could also be used to remotely execute recovery plans, access scheduled tasks, and respond to alarms and events, Krishnamurti said in the blog.

The VCenter software is an infrastructure management product that is intended to help with IT administration of tasks such as provisioning virtual machines, checking for the availability of the machines, and monitoring to ensure that systems stay within compliance rules.

VMware has expanded the range of software products VCenter can manage. In February, the company said VCenter can now work with Linux as well as Microsoft software.

To access VCMA, managers need to "deploy a virtual appliance and call it the VCMA server," Krishnamurti wrote in the blog. "The VCMA server must be connected to VMware VCenter or any of the ESX servers that you want to manage, (and) once the server component is set up, you can manage your data center from the convenience of your mobile phone."

According to Krishnamurti, VMware will be releasing VCMA as a "product preview," which means that it can be tried and tested prior to its full release, scheduled for April. The company has not yet released any details of VCMA's pricing.

Colin Barker of ZDNet UK reported from London.

March 23, 2009 2:03 PM PDT

Intel open-source expert heads to start-up

by Stephen Shankland
  • 2 comments

Danese Cooper

Danese Cooper

Danese Cooper, who spent more than three years as senior director of Intel's open-source strategies, has taken a similar job at Revolution Computing, a start-up that's commercializing the open-source R programming technology for data analysis.

Cooper, who took on the title of open-source diva at Sun Microsystems before her stint at Intel, plans to help Revolution expand its current community of developers and users to a broader group, she said in an interview. For example, she'll work on better user groups and new assets to help the community.

Intel, an investor in Revolution, "wanted me to go help them nail their community strategy," she said. But Cooper ended up with a job at the company, not just an outside advisory role, she said.

Cooper drew a parallel between the position of Revolution and Sun. Sun's Java programming language was popular among expert programmers, but Sun eventually came around to the idea of trying to promote it among the larger number of more ordinary programmers.

The company works on the R programming language and associated technology designed for statistical and analytical computing, trying to help move it from an academic tool to a commercial application. Revolution offers proprietary extensions for the open-source tools, one of the hybrid business models open-source businesses employ. Customers include Pfizer, Novartis, Bank of America, and the Yale Cancer Center.

Revolution focuses in particular on the ability to run software that takes advantage of multicore processors. With traditional software development, it's difficult to break programming up into tasks that run in parallel across independent processors or processor cores.

In other open-source involvement, Cooper is a member of the Apache Software Foundation and is on a Mozilla.org advisory board.

March 23, 2009 4:00 AM PDT

Intel chip flaw--but what of it?

by Brooke Crothers
  • 13 comments

Some researchers claim that Intel has a serious chip bug on its hands. But that all depends.

Security experts who are into the arcana of chip security may find "CPU cache poisoning" riveting and serious stuff. Others, however, may simply scratch their heads and move on.

But let's not move on too quickly. First, a quote from an abstract of the paper (PDF) that has some of the chip world abuzz. "In this paper we have described practical exploitation of the CPU cache poisoning...This is the third attack on SMM (system management mode) memory our team has found within the last 10 months, affecting Intel-based systems. It seems that the current state of firmware security, even in case of such reputable vendors as Intel, is quite unsatisfying."

Joanna Rutkowska, who exposed the potential of the so-called Blue Pill flaw in August 2006 and who founded Invisible Things Lab, wrote that excerpt (along with colleague Rafal Wojtczuk) and obviously takes this very seriously.

As do others. Not worried yet? "This is the scariest, stealthiest, and most dangerous exploit I've seen come around since the legendary Blue Pill!," writes Jamey Heary in a Network World blog. He is a consulting systems engineer for Cisco Systems.

So now that we know it's scary, what could happen in a worst-case scenario? Suffice to say that gaining access to "privileged" SMM memory would essentially allow hackers to do anything to the target PC that they want. The question is, would they actually take advantage of this particular opening?

"If a hacker can use this new exploit to embed a SMM rootkit (malware) they would have ultimate control over the box (computer). Additionally, it would be virtually undetectable," Heary wrote in response to an e-mail query. But he also added: "In a nutshell. This exploit is very serious and needs to fixed. But...I don't see a mass virus or worm using this. The attacks will be targeted. A rootkit must be perfectly matched to the hardware. This makes mass infection more difficult."

Rutkowska and Wojtczuk, in the abstract, say that the paper discusses "how to practically exploit this problem, showing working proof of concept codes that allow for arbitrary SMM code execution. This allows for various kind of abuses of the super-privileged SMM mode, e.g. via SMM rootkits."

Who can do this? "We assume that the attacker has (what is in practice)...equivalent to administrator privileges on the target system, and on some systems, e.g. Windows, also the ability to load and execute arbitrary kernel code," write Rutkowska and Wojtczuk.

And what systems are potentially vulnerable? Though both Intel and Rutkowska say the "attack" presented in the paper has been fixed on some systems, Rutkowska goes on to say: "We have however found out that even the relatively new boards, e.g. Intel DQ35 are still vulnerable (the very recent Intel DQ45 doesn't seem to be vulnerable though). The exploit attached is for DQ35 board--the offsets would have to be changed to work on other boards (please do not ask how to do this)." (Here is a list of Intel motherboards she refers to.)

These motherboards are used with Core 2 Quad, Core 2 Duo, Pentium, and Celeron processors, according to Intel's Web site.

Intel has addressed the matter this way: "We are working with these researchers. We take this research and all reports seriously. Currently as far as we know, there are no known exploits in the wild," Intel spokesman George Alfs said in a written statement.

One point worth noting is that this is not an Intel errata per se, which Intel typically details in processor specification updates. This is a theoretical attack from a malicious hacker. Nevertheless, users can minimize the risk by keeping up-to-date on patches and on operating system and security suite updates. Particularly important are BIOS (basic input/output system) and firmware updates for the processors and motherboards referenced above.

So, what is the average user to make of all of this? Security attacks and security vulnerabilities have been around since (computer) time immemorial (in the relatively brief history of mass-market computing). A report from U.K.-based technology Web site The Register in 2006, for example, suggested that people should not purchase Core 2 Duo systems--now widespread worldwide--because of security vulnerabilities and cited an open-source expert, who prophesied doom and gloom for the Core 2 Duo architecture.

Then there's the whopper of them all--and a flaw very different in nature from the SMM vulnerability discussed above--the show-stopping 1994 Intel FDIV bug, discovered by Professor Thomas Nicely, then at Lynchburg College in Virginia. Also referred to as the floating-point bug, it wasn't a flaw exploitable by malicious hackers; rather, it was a bug in Intel's original Pentium floating-point unit. Certain arcane floating-point division operations done on these processors would generate incorrect results.

This bug, covered prominently by The New York Times and CNN at the time, actually had virtually no affect on users, except causing them to panic and, as a consequence, some insisted that Intel provide them with new processors. The recall cost Intel close to a half-billion dollars.

Originally posted at Nanotech - The Circuits Blog
Brooke Crothers is a former editor at large at CNET News.com, and has been an editor for the Asian weekly version of the Wall Street Journal. He writes for the CNET Blog Network, and is not a current employee of CNET. Contact him at mbcrothers@gmail.com. Disclosure.
March 18, 2009 6:13 AM PDT

Sun activist shareholder to get payday?

by Dawn Kawamoto
  • 3 comments

CNET News Poll

Should IBM buy Sun?
Big Blue reportedly is in talks to buy Sun Microsystems for $6.4 billion. Should it?

Yes. Sun's products complement IBM's.
Yes. Keep a few assets, and sell the rest as scraps.
No. There are too many product overlaps.
No. Sun brings too many problems.



View results

Update at 9:13 a.m. PDT, with IBM comment and Sun's stock price.

With Sun Microsystems reportedly in merger talks with IBM and its stock soaring as high as 83.7 percent in morning trading, Sun's largest shareholder may find its activist role is paying off.

Southeastern Asset Management, which holds a 22 percent stake, announced in October that it was seeking an active role in the company and would engage in talks with not only Sun's management but also third parties, in an effort to maximize shareholder value.

That was followed in December with an announcement that Southeastern would gain two seats on Sun's board of directors.

In landing two board seats, Southeastern's vice president and principal, Jason Dunn, noted:

Southeastern adding two directors to (Sun's) board further strengthens our conviction that Sun will take maximum advantage of all its opportunities for customers and for shareholders.

Shares of Sun jumped as high as $9.13 per share in morning trading, valuing the company in excess of $6.7 billion. But based on Tuesday's close, before news of reported merger talks surfaced, Sun closed at $4.97 a share with a market cap of $3.7 billion.

IBM is reportedly considering a cash deal of at least $6.5 billion, according to a report Wednesday in the The Wall Street Journal, which first reported the merger talks.

Sun's stock--the blue line here--slumped through 2007 and 2008, and through that time has been underperforming the broader markets.

Since October 2007, Sun's stock has headed southward and underperformed the broader markets. And in the fall, it dipped below $5 a share, further compounding its problems in attracting institutional investors.

For Southeastern, which has a reputation of wearing a velvet glove with the companies in its portfolio, the decision to take an activist role in Sun may ultimately pay off should the deal with IBM go through.

Southeastern and Sun were not immediately available for comment. IBM declined comment.

advertisement

15 sites that went kaput in 2009

Web sites launch all the time, but they also shut their doors. We highlight 15 that bit the dust this year.

Top 10 news stories of the decade

Let the debate begin: Was the iPhone more important than iTunes? Was anything bigger than Google finding a great business model? CNET offers its list of the 10 most important stories of the '00s.

About Business Tech

Your destination for the latest news on enterprise-level information technology, from chip research and server design to software issues including programming, open source and patents.

Add this feed to your online news reader

Business Tech topics

Most Discussed



advertisement

Inside CNET News

Scroll Left Scroll Right