Google boosts Web bug bounties to $20,000

Increases payments for bugs in core sites, services and Web apps

Computerworld - Google today dramatically raised the bounties it pays independent researchers for reporting bugs in its core websites, services and online applications.

The search giant boosted the maximum reward from $3,133 to $20,000, and added a $10,000 payment to the program.

The Vulnerability Reward Program (VRP) will now pay $20,000 for vulnerabilities that allow remote code execution against google.com, youtube.com and other core domains, as well as what the company called "highly sensitive services" such as its search site, Google Wallet, Gmail and Google Play.

Remote code flaws found in Google's Web apps will also be rewarded $20,000.

The term "remote code execution" refers to the most serious category of vulnerabilities, those which when exploited allow an attacker to hijack a system and/or plant malware on a machine.

Best Microsoft MCTS Certification, Microsoft MCITP Training
at certkingdom.com

A $10,000 bounty will be paid for SQL injection bugs or "significant" authentication bypass or data leak vulnerabilities, Google said in the revised rules for the program.

Other bugs, including cross-site scripting (XSS) and cross-site request forgery (XSRF) flaws, will be compensated with payments between $100 and $3,133, with the amount dependent on the severity of the bug and where the vulnerability resides.

Google explained the higher bounties as ways "to celebrate the success of this [program] and to underscore our commitment to security."

The website and web app reward program debuted in November 2010, and followed Google's January 2010 launch of a bug bounty program for its Chrome browser. Google paid out about $180,000 in Chrome bounties last year.

The maximum award for reported Chrome vulnerabilities remains at $3,133, Google confirmed today.

Since VRP's introduction, Google today said it has received more than 780 eligible bug reports, and in just over a year, paid out around $460,000 to approximately 200 researchers.

"We're confident beyond any doubt the program has made Google users safer," said Adam Mein, a Google security program manager, and Michal Zalewski, a engineer on the Google security team, in a Monday post to a company blog.

Google has shown that upping bounty payments will shake loose vulnerabilities it wasn't aware existed.

Last month, the company wrote $60,000 checks to two researchers at Pwnium, the Chrome hacking contest it ran at the CanSecWest security conference in Vancouver, British Columbia.

Both researchers revealed bugs and associated attack code that demonstrated how hackers could escape the browser's isolating, anti-exploit "sandbox, to hijack the browser and plant malware on a machine.

Export data from MySQL to SQL Server

Problem
Many people want to create a customized migration process using SQL Server Integration Services (SSIS), but it is hard to start working with heterogeneous databases like MySQL, Postgres, DB2, etc. Check out this tip to learn about how to import data from heterogeneous databases like MySQL to SQL Server.

Solution
In this example, the database used to import data from is the Test Database in MySQL which is installed by default. We will import data from MySQL to SQL Server using SQL Server Integration Services.

Best Microsoft MCTS Certification, Microsoft MCITP Training
at certkingdom.com

MySQL Prerequisites

To follow the steps in this tip it is necessary to have the following software installed:

The MySQL database
The MySQL Connector Installed, this will install a MySQL ODBC driver

Let's create a table in MySQL called myTable with a column called myColumn then insert some data in the table:

use MySQL;
create table myTable(myColumn varchar(20));
insert into myTable(myColumn) values("John");
insert into myTable(myColumn) values("Jane");
insert into myTable(myColumn) values("Arnold");
insert into myTable(myColumn) values("Jessica");

Using SQL Server Integration Services to import data from MySQL to SQL Server

Here are the steps to create the SSIS project:

Start SQL Server Business Intelligence Development Studio and start an Integration Service Project.

Create a new project and select Integration Services Project.

In the toolbox drag and drop the Data flow task onto the design surface of the Control Flow tab.

Double click in the Data Flow task in the Design pane.

In the Data Flow tab, drag and drop the ADO.NET Source and ADO.NET Destination to the design pane, join both tasks with the green arrow.

Go to Windows start menu | Administrative tools | Data Sources (ODBC) and click the Add button.

Select the MySQL ODBC driver and press Finish. Please note this driver is installed with the connector specified in the prerequisites section above.

Specify the Data Source Name. e.g. "MySQL conn".

Specify the TCP/IP Server. It can be the IP or the localhost if the machine used is the local machine.

Specify the user, in this case root and the password. Ask to the MySQL administrator if you do not know the user database password).

Select the MySQL database.

Congratulations! You have a ODBC connection. Now let's use it in SSIS and return to the SSIS project.

Double click in the ADO Net Source and press the new button.

Press the new button again to add a connection.

This is important, in the provider, select the .NET Providers\ODBC Data Provider. The ODBC connection will be displayed. Select the connection created in step 8 and press OK.

In the ADO.NET source editor, in Data access mode, select SQL Command.

In the SQL command test, write "select * from myTable" and press OK. In this step you are writing the query to access to MySQL table created at the beginning.

Double click in the ADO.NET Destination task and in the Connection manager press New.

In the Configure ADO.NET Connection Manager press new again.

In the connection manager specify the SQL Server instance name (in this example the localhost is a dot) and select a Database where you want to import the MySQL Database and press OK. In this example the Adventureworks database is used, but any database can be used instead.

In the ADO.NET Destination Editor, click new in the Use a table or view option.

In the Create Table box, use this code:

CREATE TABLE "myTable" (
"myColumn" nvarchar(20)
)

In the ADO.NET Destination Editor, click the Mapping page and press OK.

We are ready. Press the Start Debugging icon as shown below.

You will see the tasks in green which means the tasks were completed successfully with the associated row count.

Last, but not least, open the Microsoft SQL Server Management Studio and verify in the instance and database used that the new table myTable was created and also that it contains the data specified.

Next Steps
SSIS enables you import and export data from multiple sources. With the providers help, it is possible to interact not only with MySQL, but with just about any data source.
Review the following tips and other resources: ."

Best Microsoft MCTS Certification, Microsoft MCITP Training
at certkingdom.com

Microsoft remains mum on Windows 8 upgrades from Vista, XP

Limits upgrade path confirmation to 2009's Windows 7

Computerworld - Microsoft today declined to confirm whether users of Windows XP and Vista will be able to upgrade their PCs to Windows 8 when the latter launches later this year.

On Monday, Microsoft spelled out the editions it would offer customers working with 32- and 64-bit Intel and AMD processor-powered PCs and tablets.

In that blog post, the company also noted the upgrade paths to Windows 8 for existing machines, saying that people now running Windows 7 Starter, Home Basic or Home Premium could upgrade to the consumer-oriented Windows 8. Systems running Windows 7 Professional or Ultimate will be upgradable to Windows 8 Pro.

Best Microsoft MCTS Certification, Microsoft MCITP Training
at certkingdom.com

Although Microsoft did not specify the upgrade path for customers currently running Windows 7 Enterprise, the assumption is that they will be able to upgrade to Windows 8 Enterprise, which, like its predecessor, will be distributed only to companies with Software Assurance upgrade agreements.

The omission of the problem-plagued Vista and the nearly 11-year-old XP from Microsoft's explicit upgrade path seemed odd: In February, the company used an FAQ to plainly state that users of those OSes could upgrade to Windows 8's beta, tagged "Consumer Preview."

"You can upgrade to Windows 8 Consumer Preview from Windows Developer Preview, Windows 7, Windows Vista, or Windows XP," the FAQ stated, "but you might not be able to keep all of your files, programs and settings."

Developer Preview was Microsoft's name for the first public sneak peak at Windows 8 as a work-in-progress, and was issued last September.

In the FAQ, Microsoft said that Vista users who upgraded would retain user accounts and files, as well as Windows settings. XP-to-Windows 8 upgrades would only preserve user accounts and files. Windows 7-to-Windows 8 upgrades, meanwhile, conserved not only user accounts, data files and Windows settings, but also already-installed applications in the move.

Ironically, migrating from Windows 7 is more thorough than from Windows 8's own Developer Preview, which will retain only as much information as an XP-to-Windows 8 transfer.

When asked today whether Vista and XP users would be able to upgrade to Windows 8 RTM, or "release to manufacturing" -- the label used to designate the final code -- as they were allowed in the Consumer Preview, a Microsoft spokeswoman declined to comment. "[We have] no information to share outside of what's in the blog," she said in an email.

It's possible Microsoft was using a narrow definition of "upgrade" in the Monday blog that confirmed only Windows 7-to-Windows 8 paths, one that included application migration as well as that for files and settings.

Previously, that kind of upgrade has been called "in-place," or one that leaves everything undisturbed as it swaps out the old OS for the new.

If Vista and XP get the cold shoulder, it wouldn't be the first time.

Three years ago, Microsoft offered an in-place upgrade to Windows 7 to users running Vista, but gave XP customers only the option of what it called a "custom" install -- others pegged it as a "clean" install -- that deleted all data on the hard drive before installing the then-new operating system.

It may seem foolish to exclude XP users from a possible Windows 8 upgrade since that 2001 edition powered 51% of all Windows PCs that went online last month, according to metrics company Net Applications. Vista accounted for another 8% of all Windows editions.

But the aged hardware running XP may be the hurdle Windows 8 can't jump: Microsoft has repeatedly said that PCs able to run Windows 7 will be able to run the new OS, but the system requirements it outlined for the Consumer Preview -- a 1GHz processor, 1GB of memory and a graphics card able to handle DirectX 9 or later -- may preclude many older machines.

Microsoft has not yet revealed the pricing for Windows 8's upgrades, or described how they will be distributed.

While Windows 7's upgrade in 2009 was handled much the same as always, Microsoft debuted a new strategy with Office 2010 when it dropped upgrade pricing -- a move that effectively raised costs for users of earlier editions of the suite -- and launched single-license "key cards" that carried only an activation code.

According to one analyst, Microsoft is unlikely to follow Apple's lead and offer Windows 8 upgrades only through its online channels, which could include Windows Store, the software market designed for Windows 8. Microsoft has not said whether Windows 7 users will be able to access that e-store.

Best Microsoft MCTS Certification, Microsoft MCITP Training
at certkingdom.com