Drudge, other sites flooded with malicious ads

Criminals flooded several online ad networks with malicious advertisements over the weekend, causing popular Web sites such as the Drudge Report, Horoscope.com and Lyrics.com to inadvertently attack their readers, a security company said Wednesday. The attack comes just a week after the New York Times Web site was tricked into displaying a deceptive 'scareware' advertisement for fake antivirus software from scammers pretending to be ad buyers with Vonage, an Internet telephony company. The trouble started on Saturday, when the criminals somehow placed the malicious ads on networks managed by Google's DoubleClick, as well as two others: YieldManager and ValueClick's Fastclick network, according to Mary Landesman, a senior security researcher with ScanSafe. Instead of trying to trick Web surfers into buying bogus software, these ads attacked.

Sometimes, the ads would also try to exploit a previously patched flaw in Microsoft's DirectShow software, Landesman said. "The user would have seen a very brief opening of a blank pdf window and it would be at the bottom portion of their screen," she said. They would pop up a nearly invisible window in the victim's browser that contained a maliciously encoded pdf document, which included attack code that placed a variant of the Win32/Alureon Trojan horse program on the victim's computer. The Alureon Trojan is known to download additional malware and often hijack victims' search results, she said. Between Saturday and Monday, the ads accounted for 11 percent of all Web pages blocked by ScanSafe's Web filtering software, a sign that many people were being presented with the malicious ads. The pdf attacks apparently only affected victims with out-of-date versions of Adobe's Reader or Acrobat software, she added. And because the pdf pages were modified slightly every time they were displayed, most antivirus products didn't detect them.

Earlier this year criminals placed similar ads on the home page of technology trade magazine eWeek, whose ads were managed by DoubleClick. In tests, ScanSafe found that only 3 out of 41 antivirus vendors detected the malware. "To be honest, they were pretty clever in the way they carried this out," Landesman said. "They managed to infiltrate sites that enjoy very good traffic and they were able to use a mechanism for creating this pdf that caused it to be nearly completely undetected." This is not the first time Google's DoubleClick has been associated with this type of malicious advertising.

New York Times tricked into serving scareware ad

Scammers tricked the New York Times' Digital Advertising department into placing a malicious ad for fake antivirus software on the NYTimes.com Web site over the weekend, the company confirmed Monday. According to the Times, the scammers initially claimed to be Internet phone provider Vonage, and had placed what appeared to be legitimate Vonage ads on the Web site. The newspaper had warned of the scam advertisement Sunday, after receiving about 100 e-mails from concerned readers.

However, sometime over the weekend, they switched these ads for aggressive pop-up advertisements that tried to trick victims into thinking that their computers were infected. When the complaints started pouring in, the Times first suspected that the ad had been unauthorized, and pulled third-party advertisements from the site. The point of the scam was to sell worried computer users a product called Personal Antivirus, a fake "scareware" product that bombards victims with popup ads until they either hand over their credit card information or somehow manage to remove the program. But on Monday spokeswoman Diane McNulty confirmed that the ad had been submitted directly to the company's online ad department. "The culprit masqueraded as a national advertiser and provided seemingly legitimate product advertising for a week," she said via email. "Over the weekend, the ad being served up was switched so that an intrusive message, claiming to be a virus warning from the reader's computer, appeared. " Technology executive Troy Davis was hit with the ad after he clicked on a Times story about Dubai on Saturday night. This gave the criminals a way to include embedded Web pages in their copy that could be hosted on a completely different server, outside of the control of the Times. After his antivirus software warned him not to visit the article, he performed an analysis of the site and discovered that the Times was allowing advertisers to embed an HTML element known as an iframe into their advertisements.

Apparently the scammers waited until the weekend, when it would be hardest for IT staff to respond, before switching the ad by inserting new JavaScript code into that iframe. It was, of course, all just a fake. That code redirected Davis's browser to the Web site that served a pop-up ad designed to look like a Windows system scan that had found security problems on his system.

It's hard to find anyone who likes audio conferences. Or play Facebook Scrabble and check e-mail until it's their turn to talk. Sure, worker bees can put themselves on mute to chat with fellow cube dwellers. Yes, for true lows in productivity, the fuzzy, disembodied, dial-in audio conference is hard to beat.

Office voice mail, cell phone voice mail, office e-mail, personal e-mail, texting, instant messaging, social media communiques. And what about all those mail and messaging systems anyway? Make it stop, you cry! At its most basic, UC makes real-time communication systems, such as instant messaging, share information with non-real-time systems, such as e-mail or voice mail, and runs them over the same network. Unified communications won't do that, but depending on which communications and messaging systems you integrate, UC could make it better. Ideally, there is one simple interface or dashboard for users to access these systems.

Using voice over IP to cut the traditional phone bill (the foundation for UC) doesn't hurt, nor does reducing travel costs as employees meet in video or audio chats rather than fly to faraway hotel conference rooms. With UC, CIOs aim to speed up communication and collaboration internally and perhaps raise customer satisfaction externally. About 31 percent of 466 organizations surveyed recently by Forrester have deployed some form of unified communications. In Forrester's survey, 42 percent of respondents who said they weren't investing in UC cited lack of money or the absence of clear business value to justify the investment. Half of those who haven't say they are investigating or piloting UC, up from 30 percent in 2007. Yet UC isn't on fire this year, as the recession continues to batter IT spending. To read more on this topic, see: How to Get the Most From Unified Communications and Video Conference Software Now Works with Other Apps. "Certainly it does make sense to connect voice mail, e-mail and mobile systems," says Jerry Hodge, senior director of information services at appliance distributor Hamilton Beach. "Unfortunately, the current economic situation has limited my aggressiveness in moving forward." The same is true at movie-rental chain Blockbuster and food and beverage maker Shaklee, their CIOs say.

The Original Social Networking UC has evolved from a back-room effort to simplify networking by, for example, running data and voice traffic on the same infrastructure, to applications that let employees share information no matter the device in front of them. Still, if you have money and want to move forward with UC, early adopters have advice about planning projects and measuring returns. Well, almost. But it's coming, predicts Steven John, CIO of manufacturing company H.B. Fuller. We're not quite at the point yet where a BlackBerry, say, can get you into any corporate system and connect you to any colleague.

The rise of consumer social networking platforms such as Facebook, Flikr and Twitter reinforce daily the desire among corporate employees to strip the friction from communicating at work, too, John says. Presence, meanwhile, is moving from a cool, gadgety technology to real corporate tool. He says he feels that heat and is studying potential UC systems, but he hasn't yet decided on any. That's when computer devices detect each other and indicate the fastest or preferred way to reach the person on the other end. One simpler UC move is to integrate voice mail and e-mail so that users can listen to e-mail or read voice mail.

It's like instant messaging for every kind of connection you might make to your corporate network or, if configured for it, the public Internet. Another is to allow instant messaging or document sharing during video conferences. Autodesk went whole hog into Cisco's TelePresence system, which involves super high-quality video conferencing that can connect up to 48 locations at once, along with on-screen, interactive data sharing. According to Autodesk VP of Strategic Initiatives Billy Hinners, the ultimate in video istelepresence technology. Cisco calls it an "immersive" experience-think Star Trek's Holodeck. Autodesk spent $350,000 to outfit its first six-person TelePresence room.

Of course, the price for such a system is steep. It runs 15 rooms now, ranging from two-person to 12-person sites, and spends about $10,000 per month on networking costs. "Cost savings was not a big driver for us," Hinners says. Subsequent installations have also been aimed at improving sales communications and efficiency as well as reducing travel and carbon emissions. Rather, the company initially wanted better collaboration between software designers and engineers in the United States and its 1,000-plus software engineers in Shanghai to pump out products faster at an improved quality. Employees embraced the technology right away, he says.

UC projects are some of the most technical ones that CIOs have to contend with today, integrating data and voice in ways that some IT groups have never done before. Time booked in the TelePresence rooms for regular video conferencing has become "a precious commodity." In fact, if there is any project for which success depends on users rather than IT guiding the planning and rollout, it's unified communications. But communicating is, by nature, a personal act. What you really want are users who push for a UC project, says Michael McTigue, CIO of Saint Barnabas Medical Center. Foisting upon people unwanted changes to how they talk and type to each other makes people uncomfortable, says Don Lewis, president of consultancy Strategic Intersect. "You think all you're doing is taking away someone's phone and giving them another one but you're not," says Lewis. "Changing the button they push to forward a call to someone is hugely disruptive." Is There a Doctor on the Device? The hospital group-which provides cardiac services, burn treatment and organ transplant among its offerings-wanted to speed up the time for doctors, nurses and technicians to reach each other.

Indeed, the archaic process of dialing a beeper, hoping the page goes through, waiting for the recipient to get it and call back slowed communications, and therefore reaction time during critical situations, McTigue says. The time-honored pager method was no longer good enough. Fifteen minutes might pass before a physician could reach someone in the telemetry group to order machines to monitor a given patient's heart rate, blood pressure and breathing. "Everyone was looking for a communications vehicle that would give better turnaround time," he says. In March 2007, Saint Barnabas launched a pilot of Vocera Communication's badge devices. Walkie-talkies, while quick, didn't pan out because the crackly speakers made the hallways noisier and they ran through a lot of batteries.

The 2-ounce rectangles are worn on a lanyard around the neck or clipped to a collar or pocket. A nurse might press the activation button and speak into it the name of a physician who is needed to check a medication order. They allow hands-free voice communication. Via a wireless network, the device pings a database to look up the doctor's name and relay the call. Saint Barnabas spent $500,000 for devices and software for 450 concurrent users, starting with the telemetry group. The doctor taps his button and speaks to respond.

That 15-minute wait time plunged-responses now take nine to 15 seconds, McTigue says. Within nine months, the hospital spent $250,000 to add another 300 concurrent users, giving 2,700 employees access to the system. Such dramatic results convinced the hospital to get as many of its 3,000 employees on the system as quickly as possible. IBM managed the initial training, helping new users enunciate and speak directly into the Vocera device. The training helped get Saint Barnabas to a high rate of calls recognized and completed on the first try: 83 percent.

In the emergency room, where there's more noise than in other parts of a hospital, the staff uses headsets rather than dangling the device at chest level. Seventy percent is more typical, McTigue says proudly. They had to fiddle with wireless access point configurations to get all areas hot. "If you don't have tight infrastructure, the application will get a bad name," he warns. Along the way, the hospital worked with IBM, Cisco and Vocera to identify and fix wireless dead spots in stairwells, elevators and the lead-walled radiology area. The system works only on campus but the hospital is testing a Vocera smart phone with the same capabilities for off-campus use. The hospital expects to connect 1.5 million to 2 million calls through the system, eliminating the need for one full-time switchboard operator, according to McTigue.

Yearly operating costs are $75,000 to $85,000, mainly for Vocera software maintenance, he says. The hospital has saved another $70,000 by getting rid of its backup phone system used during power outages. Payback from UC projects doesn't typically come from savings on networking equipment because those prices are low already, says Lewis of Strategic Intersect. The wireless Vocera system replaces a traditional dedicated circuit for that old emergency system. But hard returns can be calculated: Obviously, meeting virtually can cut travel costs. Softer results, Lewis says, can also be important: By merging voice mail, e-mail and BlackBerry messages, your sales organization may save 30 minutes every day.

Setting up call center staff to work from home, but access integrated voice, e-mail and document capabilities frees up physical room at the company for other uses. How valuable is that in productivity and morale? The more people on the system, the faster and more frictionless their communication. Try It, They'll Like It As the experience at Saint Barnabas shows, unifying the communications for lots of people at a company can be more beneficial than unifying communications for only some people. In a hospital, that can save lives. Woods Bagot, an architectural design firm with offices in Dubai, Hong Kong and London, among other cities, has built elaborate buildings worldwide.

At a corporation, that can make money. Recent projects include the oval dish-shaped campus of the United Arab Emirates University, a mixed residential and commercial district in Shenzhen, China, and the Cesaria beach resort in the Cape Verde islands. Exchanging drawings is key for an architecture firm, of course. In 2007, the board at Woods Bagot decided that it wanted the company to operate like one big studio no matter where its clients, engineers and architects lived. But the people who work at Woods Bagot are visual thinkers, so any new communications tools would have to let them see each other, not just share data and documents, says CIO Nectarios Lazaris. "Being a design firm, we don't sit in a boardroom and look at Excel spreadsheets," he says. "We walk around and interact with people." Not to mention swap 3-D visualization files that are a couple of gigabytes unto themselves.

Same with Polycom's Web conferencing product, he says. He tried at least five products, including Microsoft Live Meeting, whose video quality users found poor. Lazaris chose Microsoft Office Communicatorfor desktop video conferencing and collaboration, products from Tandberg for boardroom video conferencing and Blue Coat's software for secure Web connections. The first test came when a week after the video system went live, the Woods Bagot board opted to try the new toy instead of meeting in person. "It was a nervous time for us," he says, noting that Blue Coat had people on-site to troubleshoot should something go wrong during the pivotal meeting. He was impressed that Blue Coat sent engineers-not salespeople-to Woods Bagot during the decision phase and let them stay as long as needed during and after launch.

The company saved $450,000 by not flying the 12 board members to Sydney or providing their accommodations for that meeting as well as the remaining ones planned that year, Lazaris says. The technology lets Woods Bagot work with cream-of-the-crop designers and architects residing anywhere in the world, according to Lazaris, which is a point the firm makes in presentations to potential clients. But it was the experience that sold the board. "When they see their investment in play, that's a bigger win than trying to show them a PowerPoint that says, 'I saved you $450,000,'" he says. He says it's gotten the firm work it might not otherwise have won. "This is not follow-the-sun like in outsourcing. Volvo Group wanted a better way to work across time zones with colleagues who don't necessarily respond to e-mail-however red-hot urgent it's marked, says Magnus Holmqvist, director for the IT innovation center at the company. We're not handing over projects but collaborating in a live environment," he says. "It's comforting to them." How UC Helps IT The mere thought of coordinating a global supply chain project will send many IT managers quivering under their project management software and spreadsheets.

Volvo Group makes Mac trucks and Volvo busses and construction equipment; Ford now makes the famously rectangular cars. Previously, various team members would meet every 12 weeks to test versions of the new SAP and Red Prairie applications they are building. An IT team of 70 people around the world are working on a project to streamline Volvo's spare-parts supply chain, which reaches 60,000 mechanics in 180 countries. Early this spring, Volvo started virtual test rooms online, using Microsoft Office Communicator and Hewlett-Packard's TestDirector quality-check tool running over VoIP. So far, half of the in-person meetings have been eliminated, but plane trips have been reduced by more than half because the technology is so good, Holmqvist says. He declines to say how much money Volvo has saved in travel costs but says the system has cut carbon dioxide emissions by 630 tons-about the equivalent of taking 250 cars off the road for a year.

Even people in the same city sometimes opt to attend meetings virtually rather than trek across town. Don't underestimate the mileage, so to speak, that you may get from promoting the green ROIof cutting travel, Homqvist says. "People don't feel too good about flying across the Atlantic when we know we have climate change going on. Linking that idea to cost-cutting has helped IT get the new technology more eagerly accepted across the company, he adds. "That is real." Homqvist predicts work quality and productivity will rise because employees will spend less time planning meeting logistics and traveling. "Our perception is that we're already earlier on these test-suite sessions. But people feel much better about eliminating those kinds of meetings," he says. Instead of a 12-week cycle, we may reduce the cycle." Defining the ROI Some organizations, however, aren't seeing the returns they expected on UC projects.

The softer benefits of smoother collaboration are hard to quantify and therefore, Dewing says, hard to justify. Or rather, they don't know how to tie a dollar figure to them, says Henry Dewing, a principal analyst at Forrester Research. Especially now. It's hard to pin down the dollars generated or saved by faster project completion or product launches, Dewing says. Twenty-four percent of the telecommunications and networking managers surveyed by Forrester say they aren't getting all the benefits they expected from UC. Another 11 percent said they didn't know whether they were or not.

John, the H.B. Fuller CIO, isn't sure yet what mix of tools will produce the best return. The adhesives company does business in 100 countries, with offices in 36. The pressure is on John to find technological ways to overcome such geographic diversity, he says. As a $1.5 billion company, Fuller's revenues aren't huge but its global footprint is. But he doesn't want to jump too quickly. But standardizing hardware is something Fuller has only recently started to do.

For example, it's easier to unify communications when PCs and laptops are standardized, in part because tweaking the configurations takes less time. He doesn't want to buy more products than he needs. How about accessing your computer calendar by voice, over the phone? Say a Fuller engineer in China views a document created by a U.S. counterpart and can hover over his colleague's name with his mouse to automatically dial that person for a PC-based call. That's the kind of razzle dazzle UC application vendors pitch that isn't available in, say, SharePoint, Microsoft's document sharing and collaboration system. "It's fun, fancy, very sexy but is it needed? One part of the calculation, he says, will be trying to predict how much bandwidth different combinations of UC technologies would eat and whether the network costs will be worth the UC benefits.

Would that be a competitive advantage?" John wonders. He hasn't reached any conclusions yet, but a product like SharePoint might provide enough collaboration for Fuller employees so that a big UC investment isn't necessary. "That's what we're debating." Loomis, the armored car company, has been installing UC components for two years, expecting to cut telecommunications costs and make some business processes more efficient. Wayne Sadin, Loomis' CIO, began contemplating UC a few years ago, when the company was outgrowing its existing phone systems. But first, the company had to lay some infrastructure. Loomis had acquired several smaller armored car companies along with their mix of different PBXes.

Loomis replaced those PBX systems at headquarters and, so far, a little more than 10 percent of its 200 branches with Cisco VoIP. Now those tasks can be done by Loomis' own IT staff, centrally. "You just call the help desk. If a branch's voice mail needed reprogramming, they had to call local providers who would drive over to do the work for $100 to $200 an hour, Sadin recalls. It's 10 minutes of work or even one minute of work," he says. In 2007, Loomis finished putting its Microsoft Exchange e-mail system on VoIP. Meanwhile, Microsoft Office Communicator supplies video conferencing, instant messaging and presence, including a BlackBerry IM client. Not paying PBX vendors for move, add or change orders is a big part of Loomis' ROI, he adds.

Employees can forward voice mails as if they were e-mail and they don't have to log in to separate voice mail, e-mail and BlackBerry messaging systems, Sadin says. When Pacific Medical Centers put in VoIP to let data and voice traffic run unified on its network, it had to rearrange some job responsibilities, says consultant Lewis, who was the hospital's CIO at the time. A Unified Mind-Set Melding all of these capabilities takes some forethought and, perhaps, changes to how the IT group works together and with outside vendors. Network administrators, for example, had to learn to plan for spikes in traffic during peak application usage times as well as for telecommunications. But as UC takes root, CIOs and IT staff must make sure those different vendors coordinate their work, he says.

For many companies, separate vendors supply networking gear, servers and software. For example, Loomis planned to upgrade Cisco's Call Manager administrative suite last spring, in part to more fully integrate Cisco phone handsets with Microsoft's Office Communications Server. But the morning of the scheduled upgrade, the teams discovered that the need for a schema change to Microsoft's Active Directory got overlooked. Loomis' network and server teams planned and tested the upgrade with a local VoIP consultant for two to three months. The upgrade was aborted.

Do you Tweet. Loomis tried again in late August, after the Active Directory tweak was tested and rolled out. "I guess the phone-oriented vendor didn't realize how carefully our server team guards Active Directory from untested changes," he says. "The hardest thing about integrating communications is integrating people's mind-sets." Senior Editor Kim S. Nash can be reached at knash@cio.com. Follow me on Twitter @knash99. Follow everything from CIO Magazine @CIOMagazine.

Report: eBay to sell Skype to group of private investors

EBay plans to announce a deal to sell its Skype voice-over-IP service to a group of private investors, The New York Times reported on its Web site, citing people briefed on the company's plans.

The deal could be announced as early as Tuesday, the report said.

Several investment groups are likely involved in the purchase, including Andreessen Horowitz, Index Ventures and Silver Lake Partners, the report said. Andreessen Horowitz is run by partners Marc Andreessen, co-founder of Netscape, and Ben Horowitz. Andreessen is also a member of eBay's board of directors.

Ebay has reportedly been seeking around US$2 billion for Skype. The company paid $2.6 billion for Skype in October 2005, saying it would enhance communication between merchants and buyers on eBay, but that never panned out. Two years after the acquisition, eBay wrote down Skype's value by $1.4 billion.

Still, Skype continues to be the most popular VoIP service in the world. Its revenue grew 25 percent year-on-year to $170 million in the second quarter, according to eBay, and it added 37.3 million new registered users at the same time, ending June with over 480.5 million registered users.

Ebay has said it planned to sell Skype in an initial public stock offering. Several groups have reportedly been in talks with the company for the communications company, including Skype's founders, Janus Friis and Niklas Zennstrom.

One question that looms over any sale of Skype is access to the peer-to-peer technology that underpins the service. In July, eBay said it was developing an alternative to the technology currently used by Skype because licensing talks with the owner of the technology had broken down.

When eBay bought Skype, the deal didn't include the technology used to run the VoIP service. That technology is owned by a company called Joltid, which licenses the technology to Skype.

Skype brought Joltid to a U.K. court earlier this year in a bid to resolve the licensing dispute, which led Joltid to terminate the licensing agreement.

"Joltid has alleged that Skype should not possess, use or modify certain software source code and that, by doing so, and by disclosing such code in certain U.S. patent cases pursuant to orders from U.S. courts, Skype has breached the license agreement," Ebay said in a U.S. Securities and Exchange Commission filing in July.

Skype responded to Joltid's move to terminate the license by asking the court to declare the termination was invalid. The court case is due to be heard in June 2010.