commonIT blog

Yes, Microsoft publishes yet another security alert for Internet Explorer. It allows an attacher access to any file on the system, and all versions of Internet Explorer are vulnerable — though the default configuration in the most recent versions of Windows (Vista, Server 2008, or 7) will block attempts to exploit the vulnerability. This leaves Windows XP deployments at risk; that’s 66% of the market according to NetMarketshare.

Bernard Ourghanlian, Director of Security at Microsoft France, has an interesting (for us) take on the issue. Interviewed by journalists for French web media Clubic, he says “We would love to put Internet Explorer 6.0 behind us, but we simply can’t. For an enterprise, deploying a new navigator is a huge job. As long as Microsoft offers support for Windows XP (up to 2014), Internet Explorer 6.0 will also be supported.”

Putting to one side (for the moment) the fact that this new vulnerability is one more proof point for the session isolation we’ve developped with Virtual Browser, Ourghanlian’s words highlight a further problem with the management of desktop navigators as part of the enterprise infrastructure: deployment, updates, patching… all these tasks represent significant management and support overheads for the enterprise. The centralized architecture of Virtual Browser makes updates, whether to the browser or its plugins, trivial, and means that every user sees the updated browser, instantly.

There’s nothing new under the sun, they say; they could have been talking about browser security issues. There’s clearly a need for a revolution in the browser architecture — run-time environment, deployment, and support tools. That’s what we’re working on and where we’re going with Virtual Browser.

On January 15th the German federal information security agency BSI and the French equivalent CERTA both issued bulletins recommending the use of products other than Microsoft Internet Explorer, following a security alert from Microsoft the previous day.

According to French agency CERTA the vulnerability in IE would allow an attacker to remotely execute code on the user’s PC, to steal data or compromise the system. Some of the world’s largest corporations, including Google, appear to have been victims of attacks.

This is the first time that official national IT security agencies have explicitly warned against the use of a specific product due to vulnerabilities. In this case, though, the vulnerabilities are present in every release of the product back to version 6.0. Some two-thirds of internet users browse with IE, meaning the potential for damage is huge. Many enterprises and government agencies deliver IE 6.0 or 7.0 as part of the standard end-user desktop environment; the risk of a crippling attack on industry and/or government networks called for action.

This time Internet Explorer has been identified as vulnerable. But the reality is that it’s the underlying architecture of industry-standard web browsers that’s at fault. That’s why we’ve taken an entirely new approach with Virtual Browser. The only truly effective way to protect sensitive corporate or government networks is to isolate the browser using virtual machines in a secure, centralized hosting environment. With the session isolation feature of Virtual Browser any attack is contained within the session; should the session be compromised, it’s just a virtual machine and the attack is eliminated when the virtual machine is shut down at the end of the session. Whether it’s Internet Explorer or on of the alternatives running in the Virtual Browser session, users can continue to browse safe in the knowledge that their data – and their employer’s – is fully protected against the exploitation of any browser vulnerability.

The new year starts with two media appearances for commonIT. The January 7th edition of 01Informatique, France’s leading weekly for IT professionals, dedicates (almost) a full page to commonIT — the founders, the first steps, the technology — by journalist Stéphane Bellec. Should you get your hands on a copy, commonIT is on page 20. Hard on the heels of the 01Informatique article I was interviewed for the 01Business show on French radio station BFM (Business FM) — 3 questions, 3 minutes. You can listen to the interview as a podcast here — skip to 42″40 (unless you’re also interested in the French market for e-learning solutions, the focus of the broadcast).

Malware researchers at McAfee Labs, the research division of McAfee, have just published their annual report “2010 Threat Predictions”. The browser, unsurprisingly, continues to be the principal vector for attacks, according to the report; the news is that social networking sites are fast becoming the main source of threats. One simple example: the popularity of URI shorthands (bit.ly, tinurl.com) to save characters in Twitter makes it easy to get even the most aware user to click on a “poisoned” link which may download malware or launch a cross-site attack.

The McAfee report also discusses the recent growth in exploits taking advantage of vulnerabilities in helper applications and browser plug-ins such as Adobe Acrobat and Flash. And they highlight the risk of HTML 5.0 “blurring and removing the lines between a web application and a desktop application”. The need for the enterprise to isolate different web usages based on security policies will become increasingly urgent in 2010.

The latest release of Virtual Browser introduces several new features (like every new release — with thanks to Mathieu’s team!). One of these new features in particular adds a whole new dimension to the Virtual Browser solution. Virtual Browser now supports delivery of ICA and RDP remote desktop clients, alongside our already familiar browser support (IE, Firefox, Java, Flash, etc). With this release the end-user now has access not just to web-based applications but to any application which can be virtualised, as well as full-featured virtual desktops.

It’s worth taking a few minutes to understand where we’re going with this. Release 1.3 offers a single, secure, platform-independent client delivering installation-free end-user access to any web-based or virtualised application without the need to worry about (i) the configuration of the end-point device; (ii) the compatibility of end-point browser configuration and the target application/server; or (iii) the appropriate network configuration (VPN, etc) to access the remote application. The objective is to position the Virtual Browser solution as the universal client for access to cloud-based services.

The “Cloud” and “Cloud Computing” are still relatively new terms and there are varying definitions of what they comprise. For us, they cover the full set of web-enabled or virtualised applications, hosted in the enterprise (the private cloud) or by third-party service providers (SaaS). What we’re seeing today is enterprises migrating step-by-step to cloud computing models, with the infrastructure becoming decentralised — some of it moving to virtual environments (Citrix and others), some of it onto the Intranet, and some moving to the Internet, taking advantage of Cloud offerings vendors like Google, Salesforce.com and other SaaS providers.

In positioning Virtual Browser as the universal client for cloud access, we’re facilitating enterprise migration to cloud computing by resolving three key management issues:

1. Security: encrypted traffic between the VB client and server, strong authentication, and support for multiple isolated user environments: Internet, Enterprise (internal) applications, on-line (cloud, SaaS) services, on both enterprise (managed) end-points and non-managed end-point devices.
2. Single point of management and maintenance — configuration, updates, patching — of the client environment, on a centralised server environment, clustered for redundancy and scalability.
3. Platform independence and compatibility: No matter what type of device the end-user is using or where they connect from, the application sees the same browser, eliminating compatibility issues and facilitating application development and support.

Navixia, a leading information security integrator in the French-speaking regions of Switzerland, is now a commonIT Gold partner — the first channel partner for the Virtual Browser solution outside France. Claude Krahenbuhl, Managing Director of Navixia, sees clear benefits for Navixia customers in the innovative Virtual Browser solution. And Navixia’s customers have responded enthusiastically.

Navixia offers a flexible, customer-centred approach to information security, enabled by the high level of technical skills and experience of the Swiss company’s founders and employees. For commonIT, we see this as validation that our technology and our business model can reach beyond the purely domestic market, and it marks a first concrete step in fulfilling our international ambitions.

Hot on the heels of Virtual Browser version 1.2, version 1.3 is now ready for release. Why are we introducing two versions at so close together? Well, it’s part of an ambitious product roadmap which leads up to a full rollover to version 2.0 during Q1 2010. Regular intermediate releases help keep us focused, while fulfilling customer and partner expectations in terms of fast time-to-market for new features and functionality.

Virtual Browser release 1.3 delivers support for transparent authentication modes so that, for example, user authentication for Virtual Browser sessions can be based on Windows logon credentials. On the server side, Virtual Browser can now integrate ICA and RDP clients, opening up a whole new range of possibilities for enterprise deployments.

Looking ahead, the objective is to position Virtual Browser as the universal client for the Cloud Computing era. For the enterprise moving to Cloud-based solutions, Virtual Browser offers a single, centralized point of control for multi-platform access to any web-enabled or virtualized application, wherever it’s hosted. By integrating support for ICA and RDP clients on the Virtual Browser server, end users can access web applications and Citrix or TSE applications through a single, secure, multiplatform browser interface.

CommonIT is growing fast. Less than a year after we opened for business, we’ve outgrown our original offices and so from today we’ve moved half a mile across Lyon to more spacious accommodation. Our new offices, at 22 Rue Constantine in Lyon’s 1st arondissement, are next door to the Museum of Fine Arts and a short walk across the Place des Terreaux from City Hall.

We’ll have space for our expanding team (currently 10 people), and the new offices also offer better facilities for meetings with customers and partners — and for our training sessions, the next of which takes place on December 17th (at the new address).

Visit the web site for full contact details.

Details of a new vulnerability in IE6 and IE7 were published on the internet at the beginning of last week, before Microsoft was aware of the problem. Microsoft has issued a security advisory but has yet to announce an update to correct the problem. Like previous vulnerabilities (see here and here), recommended workarounds and protection measures place heavy (unrealistic?) demands on users, and the risks remain high — an attacker can inherit the user’s access rights on the attacked machine. IE6 and IE7 are still the most widely used browsers on enterprise networks.

It’s worth remembering that even the most well-informed users can fall victim to a web-based attack. It happened to well-known security expert Gadri Evron, who unwittingly helped propagate a worm on Facebook. While Facebook reacted quickly to the attack, it’s interesting to note the propagation method was based on clickjacking rather than on XSRF as some early blog posts said.

Just a month after the release of version 1.1, version 1.2 of the Virtual Browser server component is ready for deployment.

The latest release offers improved performance, but more importantly for enterprise deployments multi-server support means that high availability and load balancing features are now available. It’s also possible to configure individual web sessions so that they are isolated on separate physical servers, optimizing network topologies and performance and further reinforcing application security.

Eagerly awaited by our most demanding users, these new features guarantee continuity of service for Virtual Browser end-users independently of the failsafe mechanisms offered by the underlying platform (the Virtual Browser server is designed for installation in VMware environment), while also improving scalability, optimizing performance when very large numbers of sessions are open simultaneously.