Hands-on: Chrome 10 pushes the browser speed barrier
The new version of Google's Chrome browser adds speed, password syncing and a new Options tab.
As Web sites become increasingly complex, streaming media becomes more common, and applications migrate from PC-client-based to Web-based, it becomes increasingly important for browsers to be as fast and responsive as possible. In fact, if you spend most of your life in Web-based apps, a speedy browser has gone from being a nice-to-have to a must-have.
The just-released Chrome 10 comes with speed improvements that make Web sites load faster and Web-based apps run more quickly. It also offers a revamped Options interface, such as improved security and better syncing. Put them all together and you have a winning upgrade.
A need for speed
Chrome has always been speedy, and with this release it gets even faster. Version 10 incorporates Google's new Crankshaft JavaScript engine, which the company first showed off in December. In its Chromium blog, Google claims that Crankshaft offers a 66% improvement in JavaScript performance as measured by the V8 benchmark suite.
In order to see how Chrome 10 compares to its rivals, I ran the SunSpider JavaScript benchmark using a Dell Dimension 9200 with a 2.40GHz Intel Core 2 Quad processor and 2GB RAM running Windows Vista. I ran three sets of tests on each browser and averaged the results.
Results showed that Chrome has caught up to the long-time speed champion, Opera. Chrome 10 averaged 312.23 milliseconds (ms) to complete the tests, while Opera 11.01 averaged 309.97ms -- a virtual dead heat. Safari 5.0.3 came in at 406.933ms, with Firefox 3.6.15 well behind at an average 978.37ms and Internet Explorer 8 lagging at 5,035.07ms.
Keep in mind, however, that Internet Explorer 9 could take the lead once it becomes an official release on March 14. My tests showed Internet Explorer 9 Release Candidate proved to be fastest of all the browsers with a 274.6ms average time. In addition, Firefox 4 Beta 12 took 321.3ms to complete the tests, essentially a dead heat with Chrome and Opera.

Chrome 10 and Opera 11.01 are in a virtual dead heat in the author's SunSpider JavaScript benchmark tests. IE8 brings up the rear, but the IE9 RC leads the pack. (Smaller numbers are better.)
Feeds and speeds are one thing, but personal experience is another. I can vouch that virtually every Web site I visited was exceptionally fast and responsive, whether it was a simple, straightforward page, one that featured plenty of graphics or a Web-based app.
The upshot: If you want fast browsing and responsive Web-based apps, you want this version of Chrome.
Happy news for tweakers
The most noticeable change in Chrome 10 is the Options settings, and they'll be welcomed by tweakers and anyone who ever changes Chrome options. When you click the gear icon in the upper-right corner and select Options (Preferences on a Mac), the menu now opens in its own tab rather than in a relatively small window, as with previous releases, making it easier to find the options you want to change. (Story continues on next page.)

In Chrome 10, Options now opens in its own tab.

More important is that you can now search through Options, so you don't have to hunt around for the feature you want to change. For example, if you want to make changes to any settings related to downloads or passwords, type in one of those terms, and you'll be sent directly to those settings.
As you use Options, the Omnibox (Google's name for the address bar) displays a local URL for your location -- for example, chrome://settings/advanced for advanced settings and chrome://settings/browser for basic settings. In some instances, an individual Option feature or setting will have its own URL, such as chrome://settings/passwordManager for the Password Manager. You can add this to your bookmarks if it's a feature you frequently use, which I found very convenient.
What else is new
Syncing among multiple computers and devices has been improved as well. Chrome 9 already synced bookmarks among versions of Chrome running on Windows PCs, Macs, Linux systems and Android Honeycomb devices such as the Motorola Xoom. (The Honeycomb browser looks and works like Chrome but is actually based on different code, although it syncs with Chrome.) With Chrome 10, passwords now sync as well.
I've found that to be a big bonus, because I use Chrome as my primary browser on my PC, Mac and Xoom. So now when I need to log into my Computerworld blog or my online library account from any of my devices, I no longer need to remember passwords.
Also added is increased security for synced data -- your passwords are encrypted so that they can't be snooped on.
It did take some time for me to figure out how to get the syncing feature to work. Finally, I was able to get it to sync by going to the Personal Stuff options page (chrome://settings/personal), clicking Customize and then clicking OK on the Encryption tab. After that, it took about 45 minutes for all the passwords to sync.
Chrome's already solid security has also been improved. Earlier versions of Chrome already used a virtual sandbox, in which programs were isolated from the rest of your computer, so that they couldn't break out of the browser and infect your PC. In Chrome 10, the browser's integrated Flash player is now sandboxed as well for PCs running Windows Vista or Windows 7.
The bottom line
Chrome may have only 10.9% of the browser market by the latest figures, but this version may help change that. If you don't yet use Chrome, you may want to try it out for the speed improvement alone. The new Options tab and the ability to sync passwords are the icing on the cake.

Adobe launches Flash-to-HTML5 conversion tool

Wallaby is most significant for iPad and iPhone users because it would make more Flash content available to the iOS devices
For most people, Wallaby conjures up images of a kangaroo-like creature. In the halls of Adobe, though, it has taken on a more technical identity.

Wallaby is the code name for an experimental Flash-to-HTML 5 converter that Adobe has just released to the development community via Adobe Labs, the site featuring Adobe's beta technology.

A cross-platform Adobe AIR application, the tool allows users to instantly convert Flash output (FLA files) to HTML5 via a simple drag and drop. It is available free for download.

Wallaby, which was first previewed last fall at Adobe's Max 2010 developer conference, is featured at FITC, a Flash show in Amsterdam.

"We are making this available free on Adobe Labs as experimental technology; it's something we hope to continue to iterate and get feedback on from customers," said Tom Barclay, senior product manager for Flash Professional.

"I'm interested in how useful this output is, what people intend to use it for, and whether this is something we should be supporting longer term in Flash Professional as another output option or publish setting," he said.

The release is especially significant for the Mac community because this technology would make some content previously unavailable on the iOS platform viewable on the iPad and iPhone.

Apple does not support Flash on its iOS devices, arguing that Adobe's multimedia technology is vulnerable to exploits, consumes too much battery life, and crashes too often. Adobe has fired back that Apple's Flash ban is an overly restrictive policy that hurts users and software makers.

Not all elements from the Flash files will translate into HTML5, Barclay said. Users get the benefit of the overall design and motion graphic animations. But blend modes and filters -- as well as audio, video, and ActionScript -- are discarded in the translation.

The output from Wallaby is essentially a combination of HTML, SVG (Scalable Vector Graphics), and CSS and is intended as a starting point. Vector graphics are converted to SVG; bitmaps are converted to image elements and JPEG files; and text is converted to paragraph elements or SVG text. The Flash timeline is converted to a group of CSS animations. Scripting allows for batch processing of multiple FLA files.

Supported Flash Professional features include: vector art and images; classic text; keyframes; MovieClips and graphics; classic, motion, and shape tweens; rollover buttons; and instance names.

Unsupported Flash Professional features include: filters (except simple alpha); blend modes; dynamic masks; some TLF (Text Layout Framework) text; 3D transforms and 3D tween; audio and video; and ActionScript.

Adobe envisions developers using Wallaby primarily for building simple banner ads and other types of animation. For anything more sophisticated, Barclay says developers would bring the content into Dreamweaver and add interactivity using JavaScript and JQuery.

Wallaby has been tested specifically in WebKit-based browsers such as the latest versions of Safari and Chrome. Adobe has also done some preliminary testing of the converter in Firefox, Android, and Opera browsers, but those versions are not yet available.

Barclay emphasized that the Wallaby release is designed to make the technology widely available and to determine the level of interest. Right now, Adobe is seeking comment from the Flash community on how best to deploy Wallaby -- from suggesting applications for the technology to feedback on the code and other issues.

Will it eventually be added to some future version of Flash Professional? Adobe isn't making any promises, but neither is it ruling out the possibility.

iPhone, BlackBerry tumble to Pwn2Own hackers

Charlie Miller, a staple at the hacking contest, becomes 'Mr. Four-peat'
Apple's iPhone 4 and RIM's BlackBerry Torch 9800 both succumbed to hackers today at Pwn2Own, but two other smartphones running Android and Windows Phone 7 were unchallenged, the contest's sponsor said.

Charlie Miller became the first "four-peat" at Pwn2Own when he teamed with Dion Blazakis to take down the iPhone. Both Miller and Blazakis work for the Baltimore-based consulting firm Independent Security Evaluators (ISE).

Miller has walked off with winnings from Pwn2Own four years running -- 2008 through 2011 -- twice as many times as anyone else.

"Every other year I've had an exploit ready to go for months," said Miller in an interview after the win. "But this was a different experience, working under the time pressure because we were working on [the iPhone] exploit the night before."

Miller credited his partner for much of the work. "Dion's a really good researcher in his own right," said Miller.

Miller and Blazakis worked on their iPhone exploit for months, Miller said. "This one was pretty hard. Different bugs take different exploits, and this one was hard to exploit."

Pwn2Own winners are forbidden from discussing technical details of the vulnerabilities they exploit, or to release the attack code they've used. Instead, they turn over their findings and code to HP TippingPoint, the contest sponsor. TippingPoint in turn reports the vulnerabilities to vendors, who have six months to patch the bugs before TippingPoint publicly releases any information.

On the BlackBerry, a multi-national team composed of Vincenzo Iozzo, Ralf-Philipp Weinmann and a third researcher from the Netherlands, matched Miller and Blazakis by hacking the Torch. Iozzo and Weinmann were old hands at Pwn2Own, having partnered in 2010 to successfully break into an iPhone 3GS at that year's contest.

Iozzo is an engineer at Zynamics GmbH, the German reverse engineering tool maker headed by noted researcher Thomas Dullien, better known as Halvar Flake. Zynamics was acquired by Google earlier this month for an undisclosed sum.

Weinmann, meanwhile, is a post-doctoral researcher at the Laboratory of Algorithms, Cryptology and Security at the University of Luxembourg.

Both teams were busy tweaking their exploits before today's round, said Peter Vreugdenhil, a former Pwn2Own winner who now works for TippingPoint, and served as a contest judge this year.

"Both were actually tweaking their exploits at the [CanSecWest] conference," said Vreugdenhil, referring to the Vancouver, British Columbia security conference where Pwn2Own takes place.

The iPhone and BlackBerry Torch hacks, however, were over in seconds. "They hooked up their computers to the phones, and that was it," said Vreugdenhil.

The teams each will receive a check for $15,000 from TippingPoint, as well as the smartphones they exploited, in a ceremony Friday at CanSecWest.

Google's Chrome untouched at Pwn2Own hack match

Scheduled attackers don't show, or pass on exploiting sandboxed browser
Google's $20,000 was as safe at Pwn2Own Wednesday as if it had been in the bank.

The search giant had promised to pay $20,000 to the first researcher who broke into Chrome on the hacking contest's opening day.

But no one took up Google's offer.

"The first contestant was a no-show," said Aaron Portnoy, manager of HP TippingPoint's security research team, and Pwn2Own's organizer. "And the other team wanted to work on their BlackBerry vulnerability. So it doesn't look like anyone will try Chrome."

Only two entries had pre-registered for Chrome: Moatz Khader and one or more researchers going as "Team Anon." (Researchers may remain anonymous if they wish.) Based on a random drawing several weeks ago, Khader was to get first shot, with Team Anon second.

Team Anon is also slated to tackle RIM's BlackBerry OS on Thursday.

Late Wednesday, TippingPoint provided a tentative schedule for today's Pwn2Own; that schedule doesn't show any planned Chrome exploit.

Even if someone unexpectedly stepped up to take a crack at Chrome and exploited the browser, Google would be on the hook for just $10,000. As part of the deal it struck with TippingPoint, the two will split the $20,000 payment for a successful hack on the second or third days of the contest.

If Chrome comes out unscathed, as it now appears it will, the browser will have survived three consecutive Pwn2Owns, a record.

On Wednesday, researchers successfully exploited Safari and Internet Explorer. A team from French security company Vupen took down Safari 5 running on a MacBook Air notebook in five seconds, and independent researcher Stephen Fewer used a trio of vulnerabilities to hack IE8 on Windows 7.

Portnoy was impressed with Fewer's work. "The most impressive so far," said Portnoy. "He used three vulnerabilities to [not only] bypass ASLR and DEP, but also escape Protected Mode. That's something we've not seen at Pwn2Own before."

ASLR, for address space layout randomization, and DEP, or data execution prevention, are a pair of technologies baked into Windows that are designed to make it more difficult for exploits to reliably execute. Protected Mode is IE's "sandbox," which isolates the browser -- and thus any attack code that manages to infiltrate it -- from escaping to do damage on the system as a whole.

Pwn2Own continues today and Friday, when Mozilla's Firefox and four smartphones running Apple's iOS, Google's Android, Microsoft's Windows 7 Phone and RIM's BlackBerry OS will be in researchers' crosshairs.

Apple's iOS 4.3 a welcome update for iPad, iPhone

A faster Safari, enhanced AirPlay, and security fixes make it a must-have

Apple's update for iOS 4, released Wednesday (two days earlier than expected ), offers a number of changes and new features for iPhone, iPad and iPod Touch owners, plus 59 security patches for the mobile version of Safari.

For that last reason alone, you should install iOS 4.3. But there's more than just improved security in the latest upgrade: As expected AirPlay compatibility has been extended to additional apps, Safari now runs faster, iTunes Home Sharing is better integrated and personal hot spot support for the AT&T version of the iPhone has finally been rolled out.

Apple's iOS 4.3 is compatible with the iPhone 4 (the GSM model only), the iPhone 3GS, the third and fourth generations of the iPod Touch, and both the original iPad and the iPad 2 that's due on Friday. There's also a related AppleTV update for those who have the latest AppleTV, which was released last September. Not getting this update are the first- and second-generation iPhones, released in 2007 and 2008, and earlier versions of the iPod Touch.

In addition to the big changes offered in iOS 4.3, Apple tucked away several minor tweaks: the Camera app has a new shutter sound; the Notes app gets a few additional fonts; the Location Services setting is now prominently displayed under Settings; and Ping notifications are available.

Safari and AirPlay

For most users, the changes to Safari will be most obvious. Safari is now speedier, with Javascript performance twice as fast as before, according to Apple. In fact, that claim may be understated; Insanely Great Mac and others who have tested the new Safari found its Nitro Engine Javascript to be noticeably faster than Apple claimed.

Safari can also now stream specific H.264 videos to an AppleTV using AirPlay. But in an apparent effort to appease content creators, Web videos must be specifically tagged to allow the streaming: If Safari detects content that is not authorized, the video plays locally on the iPad/iPhone/iPod Touch while the audio alone is transmitted via AirPlay. I'm not sure how many sites will allow this streaming to happen, but the feature works really well; it's nice to be able to beam content right to the TV without everyone crowding around my iPhone or iPad. Aintitcool.com, for instance, has a preview of the movie Thor that you can surf to on your phone and then stream to Apple TV. You can do the same thing with the Apple-supplied video of the iPad 2 unveiling that took place March 2.

The changes to AirPlay mean you can finally stream photos, slide shows and movies stored in the Photos app wirelessly to Apple TV. Better yet, AirPlay capabilities are now available to third-party developers, meaning non-Apple apps like Pandora or Vevo could add this feature to their own apps. The implementation is much better than before, when only iPod and YouTube content could be streamed, but it still needs some work. I'll get to that in a moment.
Home sharing
To enable Home Sharing, you have to plug in your Apple ID and password on your iOS device.
Home Sharing and Apple TV

Users of iTunes with Home Sharing turned on can now access all of their content on their iOS devices. That's important because as digital media collections grow, the limited storage of the iPhone or iPad can become a hindrance. It's easy to set up: Just enter your iTunes Home Share username and password under Settings / iPod, tap the More icon in the iPod app itself, and tap Shared. From there, pick the iTunes library you wish to access (iTunes must be running on the host computer), and just like that, media from the cloud, your cloud, is available on your iOS device.

Reminder: You have to be on the same WI-Fi network as the Home Share to get access to your digital libraries.

Researcher chains three exploits to take down IE8 at Pwn2Own

Marks the first ever Pwn2Own escape from a browser sandbox
An Irish security researcher today said it took him six weeks to craft a three-exploit package that brought Microsoft's Internet Explorer 8 (IE8) to its knees at Pwn2Own Wednesday.

Independent researcher Stephen Fewer walked off with $15,000 and a Sony notebook yesterday after hacking IE8 on Windows 7 by exploiting three unpatched vulnerabilities in the operating system and browser.

"It was a challenge, especially engineering the exploit that escaped Protected Mode," said Fewer today, referring to the "sandbox" that isolates IE8 from the rest of the computer.

The sandbox, like the one baked into Google's Chrome, is designed to hold malicious code within the browser so that it can't leak into the operating system or system as a whole.

"I spent about six weeks finding the vulnerabilities and engineering the exploits," Fewer said. "Then I decided to give [Pwn2Own] a go, and bought a plane ticket."

Fewer is a first-time Pwn2Own contestant and winner. He has a one-man consulting firm called Harmony Security, and is a long-time contributor to both the Metasploit open-source penetration testing toolkit project, and to HP TippingPoint's Zero Day Initiative (ZDI) bug bounty program, which pays researchers for finding and reporting vulnerabilities. TippingPoint is the sponsor of Pwn2Own.

Fewer chained three exploits together to bring down IE8, a feat that Aaron Portnoy, manager of TippingPoint's security research team and Pwn2Own's organizer, called "impressive" yesterday.

Two of the three were necessary to craft a reliable attack that sidestepped ASLR, for "address space layout randomization," and DEP, or "data execution prevention," on Windows 7. ASLR and DEP are technologies baked into Microsoft's operating system designed to make it more difficult for exploits to reliably execute.

The third exploit leveraged yet another bug to jump out of the Protected Mode sandbox.

"That was pretty difficult," said Fewer, talking about the sandbox-escape exploit. "It took quite a while to engineer that, and then there was the time pressure of the contest."

By escaping Protected Mode, Fewer was able to gain complete control over the Sony laptop running Windows 7, a point he proved by adding a file to the machine, mimicking a cybercriminal's insertion of additional malware.

Fewer's hack of IE was the first ever at Pwn2Own to bust out of a browser sandbox. Although Chrome also boasts an anti-exploit sandbox, that browser has never been breached at Pwn2Own.

Yesterday, one expected Chrome contestant was a no-show, while a team slated to go second decided to focus instead on an attack against RIM's BlackBerry OS later today.

Although Fewer acknowledged he hasn't poked around Chrome, he didn't seem surprised that no one took on Google's browser yesterday. "Chrome's sandbox is fundamentally quite solid," he said.

Fewer made use of the work by Peter Vreugdenhil, last year's IE Pwn2Own winner, to build his multi-part package. "Peter's work was great, and I applied a few of his techniques," said Fewer.

Vreugdenhil, who now works for TippingPoint, chained two exploits last year to bypass Windows 7's ASLR and DEP.

The only other browser to fall Wednesday was Apple's Safari 5, which dropped to a team from French security company Vupen minutes before Fewer took his shot at IE8.

Not surprisingly, Fewer felt great about winning the $15,000. "I feel fantastic," he said today. "Everything here went very smoothly."

He plans to spend the cash prize to pay for his trip from the U.K. and on some home improvements.

Today's Pwn2Own schedule will pit researchers against Mozilla's Firefox -- that browser's turn was postponed to today after Wednesday's round started late -- and four smartphones running Apple's iOS, Google's Android, Microsoft's Windows Phone 7 and RIM's BlackBerry OS.