Adobe launches Flash-to-HTML5 conversion tool

Wallaby is most significant for iPad and iPhone users because it would make more Flash content available to the iOS devices
For most people, Wallaby conjures up images of a kangaroo-like creature. In the halls of Adobe, though, it has taken on a more technical identity.

Wallaby is the code name for an experimental Flash-to-HTML 5 converter that Adobe has just released to the development community via Adobe Labs, the site featuring Adobe's beta technology.

A cross-platform Adobe AIR application, the tool allows users to instantly convert Flash output (FLA files) to HTML5 via a simple drag and drop. It is available free for download.

Wallaby, which was first previewed last fall at Adobe's Max 2010 developer conference, is featured at FITC, a Flash show in Amsterdam.

"We are making this available free on Adobe Labs as experimental technology; it's something we hope to continue to iterate and get feedback on from customers," said Tom Barclay, senior product manager for Flash Professional.

"I'm interested in how useful this output is, what people intend to use it for, and whether this is something we should be supporting longer term in Flash Professional as another output option or publish setting," he said.

The release is especially significant for the Mac community because this technology would make some content previously unavailable on the iOS platform viewable on the iPad and iPhone.

Apple does not support Flash on its iOS devices, arguing that Adobe's multimedia technology is vulnerable to exploits, consumes too much battery life, and crashes too often. Adobe has fired back that Apple's Flash ban is an overly restrictive policy that hurts users and software makers.

Not all elements from the Flash files will translate into HTML5, Barclay said. Users get the benefit of the overall design and motion graphic animations. But blend modes and filters -- as well as audio, video, and ActionScript -- are discarded in the translation.

The output from Wallaby is essentially a combination of HTML, SVG (Scalable Vector Graphics), and CSS and is intended as a starting point. Vector graphics are converted to SVG; bitmaps are converted to image elements and JPEG files; and text is converted to paragraph elements or SVG text. The Flash timeline is converted to a group of CSS animations. Scripting allows for batch processing of multiple FLA files.

Supported Flash Professional features include: vector art and images; classic text; keyframes; MovieClips and graphics; classic, motion, and shape tweens; rollover buttons; and instance names.

Unsupported Flash Professional features include: filters (except simple alpha); blend modes; dynamic masks; some TLF (Text Layout Framework) text; 3D transforms and 3D tween; audio and video; and ActionScript.

Adobe envisions developers using Wallaby primarily for building simple banner ads and other types of animation. For anything more sophisticated, Barclay says developers would bring the content into Dreamweaver and add interactivity using JavaScript and JQuery.

Wallaby has been tested specifically in WebKit-based browsers such as the latest versions of Safari and Chrome. Adobe has also done some preliminary testing of the converter in Firefox, Android, and Opera browsers, but those versions are not yet available.

Barclay emphasized that the Wallaby release is designed to make the technology widely available and to determine the level of interest. Right now, Adobe is seeking comment from the Flash community on how best to deploy Wallaby -- from suggesting applications for the technology to feedback on the code and other issues.

Will it eventually be added to some future version of Flash Professional? Adobe isn't making any promises, but neither is it ruling out the possibility.

iPhone, BlackBerry tumble to Pwn2Own hackers

Charlie Miller, a staple at the hacking contest, becomes 'Mr. Four-peat'
Apple's iPhone 4 and RIM's BlackBerry Torch 9800 both succumbed to hackers today at Pwn2Own, but two other smartphones running Android and Windows Phone 7 were unchallenged, the contest's sponsor said.

Charlie Miller became the first "four-peat" at Pwn2Own when he teamed with Dion Blazakis to take down the iPhone. Both Miller and Blazakis work for the Baltimore-based consulting firm Independent Security Evaluators (ISE).

Miller has walked off with winnings from Pwn2Own four years running -- 2008 through 2011 -- twice as many times as anyone else.

"Every other year I've had an exploit ready to go for months," said Miller in an interview after the win. "But this was a different experience, working under the time pressure because we were working on [the iPhone] exploit the night before."

Miller credited his partner for much of the work. "Dion's a really good researcher in his own right," said Miller.

Miller and Blazakis worked on their iPhone exploit for months, Miller said. "This one was pretty hard. Different bugs take different exploits, and this one was hard to exploit."

Pwn2Own winners are forbidden from discussing technical details of the vulnerabilities they exploit, or to release the attack code they've used. Instead, they turn over their findings and code to HP TippingPoint, the contest sponsor. TippingPoint in turn reports the vulnerabilities to vendors, who have six months to patch the bugs before TippingPoint publicly releases any information.

On the BlackBerry, a multi-national team composed of Vincenzo Iozzo, Ralf-Philipp Weinmann and a third researcher from the Netherlands, matched Miller and Blazakis by hacking the Torch. Iozzo and Weinmann were old hands at Pwn2Own, having partnered in 2010 to successfully break into an iPhone 3GS at that year's contest.

Iozzo is an engineer at Zynamics GmbH, the German reverse engineering tool maker headed by noted researcher Thomas Dullien, better known as Halvar Flake. Zynamics was acquired by Google earlier this month for an undisclosed sum.

Weinmann, meanwhile, is a post-doctoral researcher at the Laboratory of Algorithms, Cryptology and Security at the University of Luxembourg.

Both teams were busy tweaking their exploits before today's round, said Peter Vreugdenhil, a former Pwn2Own winner who now works for TippingPoint, and served as a contest judge this year.

"Both were actually tweaking their exploits at the [CanSecWest] conference," said Vreugdenhil, referring to the Vancouver, British Columbia security conference where Pwn2Own takes place.

The iPhone and BlackBerry Torch hacks, however, were over in seconds. "They hooked up their computers to the phones, and that was it," said Vreugdenhil.

The teams each will receive a check for $15,000 from TippingPoint, as well as the smartphones they exploited, in a ceremony Friday at CanSecWest.

Google's Chrome untouched at Pwn2Own hack match

Scheduled attackers don't show, or pass on exploiting sandboxed browser
Google's $20,000 was as safe at Pwn2Own Wednesday as if it had been in the bank.

The search giant had promised to pay $20,000 to the first researcher who broke into Chrome on the hacking contest's opening day.

But no one took up Google's offer.

"The first contestant was a no-show," said Aaron Portnoy, manager of HP TippingPoint's security research team, and Pwn2Own's organizer. "And the other team wanted to work on their BlackBerry vulnerability. So it doesn't look like anyone will try Chrome."

Only two entries had pre-registered for Chrome: Moatz Khader and one or more researchers going as "Team Anon." (Researchers may remain anonymous if they wish.) Based on a random drawing several weeks ago, Khader was to get first shot, with Team Anon second.

Team Anon is also slated to tackle RIM's BlackBerry OS on Thursday.

Late Wednesday, TippingPoint provided a tentative schedule for today's Pwn2Own; that schedule doesn't show any planned Chrome exploit.

Even if someone unexpectedly stepped up to take a crack at Chrome and exploited the browser, Google would be on the hook for just $10,000. As part of the deal it struck with TippingPoint, the two will split the $20,000 payment for a successful hack on the second or third days of the contest.

If Chrome comes out unscathed, as it now appears it will, the browser will have survived three consecutive Pwn2Owns, a record.

On Wednesday, researchers successfully exploited Safari and Internet Explorer. A team from French security company Vupen took down Safari 5 running on a MacBook Air notebook in five seconds, and independent researcher Stephen Fewer used a trio of vulnerabilities to hack IE8 on Windows 7.

Portnoy was impressed with Fewer's work. "The most impressive so far," said Portnoy. "He used three vulnerabilities to [not only] bypass ASLR and DEP, but also escape Protected Mode. That's something we've not seen at Pwn2Own before."

ASLR, for address space layout randomization, and DEP, or data execution prevention, are a pair of technologies baked into Windows that are designed to make it more difficult for exploits to reliably execute. Protected Mode is IE's "sandbox," which isolates the browser -- and thus any attack code that manages to infiltrate it -- from escaping to do damage on the system as a whole.

Pwn2Own continues today and Friday, when Mozilla's Firefox and four smartphones running Apple's iOS, Google's Android, Microsoft's Windows 7 Phone and RIM's BlackBerry OS will be in researchers' crosshairs.

Apple's iOS 4.3 a welcome update for iPad, iPhone

A faster Safari, enhanced AirPlay, and security fixes make it a must-have

Apple's update for iOS 4, released Wednesday (two days earlier than expected ), offers a number of changes and new features for iPhone, iPad and iPod Touch owners, plus 59 security patches for the mobile version of Safari.

For that last reason alone, you should install iOS 4.3. But there's more than just improved security in the latest upgrade: As expected AirPlay compatibility has been extended to additional apps, Safari now runs faster, iTunes Home Sharing is better integrated and personal hot spot support for the AT&T version of the iPhone has finally been rolled out.

Apple's iOS 4.3 is compatible with the iPhone 4 (the GSM model only), the iPhone 3GS, the third and fourth generations of the iPod Touch, and both the original iPad and the iPad 2 that's due on Friday. There's also a related AppleTV update for those who have the latest AppleTV, which was released last September. Not getting this update are the first- and second-generation iPhones, released in 2007 and 2008, and earlier versions of the iPod Touch.

In addition to the big changes offered in iOS 4.3, Apple tucked away several minor tweaks: the Camera app has a new shutter sound; the Notes app gets a few additional fonts; the Location Services setting is now prominently displayed under Settings; and Ping notifications are available.

Safari and AirPlay

For most users, the changes to Safari will be most obvious. Safari is now speedier, with Javascript performance twice as fast as before, according to Apple. In fact, that claim may be understated; Insanely Great Mac and others who have tested the new Safari found its Nitro Engine Javascript to be noticeably faster than Apple claimed.

Safari can also now stream specific H.264 videos to an AppleTV using AirPlay. But in an apparent effort to appease content creators, Web videos must be specifically tagged to allow the streaming: If Safari detects content that is not authorized, the video plays locally on the iPad/iPhone/iPod Touch while the audio alone is transmitted via AirPlay. I'm not sure how many sites will allow this streaming to happen, but the feature works really well; it's nice to be able to beam content right to the TV without everyone crowding around my iPhone or iPad. Aintitcool.com, for instance, has a preview of the movie Thor that you can surf to on your phone and then stream to Apple TV. You can do the same thing with the Apple-supplied video of the iPad 2 unveiling that took place March 2.

The changes to AirPlay mean you can finally stream photos, slide shows and movies stored in the Photos app wirelessly to Apple TV. Better yet, AirPlay capabilities are now available to third-party developers, meaning non-Apple apps like Pandora or Vevo could add this feature to their own apps. The implementation is much better than before, when only iPod and YouTube content could be streamed, but it still needs some work. I'll get to that in a moment.
Home sharing
To enable Home Sharing, you have to plug in your Apple ID and password on your iOS device.
Home Sharing and Apple TV

Users of iTunes with Home Sharing turned on can now access all of their content on their iOS devices. That's important because as digital media collections grow, the limited storage of the iPhone or iPad can become a hindrance. It's easy to set up: Just enter your iTunes Home Share username and password under Settings / iPod, tap the More icon in the iPod app itself, and tap Shared. From there, pick the iTunes library you wish to access (iTunes must be running on the host computer), and just like that, media from the cloud, your cloud, is available on your iOS device.

Reminder: You have to be on the same WI-Fi network as the Home Share to get access to your digital libraries.