Security Bullet In

A security researcher has said there is a zero-day vulnerability affecting Windows 7 and Vista.

The flaw in Windows 7 could allow an attack which would cause a critical system error, or "Blue Screen of Death", according to researcher Laurent Gaffie.

Gaffie wrote in his blog that the flaw lies in a Server Message Block 2 (SMB2) driver.

"SRV2.SYS fails to handle malformed SMB headers for the NEGOTIATE PROTOCOL REQUEST functionality," wrote Gaffie in a blog post on Monday.

Gaffie said he had contacted Microsoft. Comments on his blog by other users said that the flaw could lead not only to denial of service, but could also lead to remote code execution.

Computer security publication 'The H' wrote on Tuesday that its German sister publication had tested the proof-of-concept code, and that while the exploit had caused a reboot on Vista, the exploit had not worked on Windows 7.

Metasploit creator HD Moore said in a tweet on Tuesday that an SMB bug appeared to have been introduced into Vista SP1. Coder Josh Goebel said in a blog post that he had added the exploit code to Metasploit.

Microsoft had not responded to a request for comment at the time of writing.

Gary McKinnon, the man accused by US prosecutors of "the biggest military hack of all time", has suffered a severe deterioration in his mental health, according to his mother.

McKinnon, who has been diagnosed with Asperger's syndrome, was not faring well following a serious setback in court in July.

"He had a breakdown after the last court case," Sharp told ZDNet UK at a protest outside the US embassy on Thursday. "He can't look himself in the eye in the mirror."

Wilson Sharp, McKinnon's stepfather, said that the decision by two high court judges had deeply affected the self-confessed hacker.

"[Gary] took it really badly," said Wilson Sharp. "He switched off his phones and the TV, wouldn't speak to anyone, and was shouting at people. Most uncharacteristic. We were worried in case he did something stupid."

Sharp said that the family had contacted autism expert professor Simon Baron Cohen, who had agreed to meet McKinnon, along with Jeremy Turk, an expert in autism and depression. The three met at McKinnon's barristers' chambers, where Turk had said that McKinnon was in the process of "detaching from himself", according to Sharp.

The protest outside the US embassy on Thursday, which was organised by civil liberties group Liberty, was designed to draw attention to the extradition treaty the UK has with the US. The American Civil Liberties Union also sent a letter to foreign secretary David Miliband requesting that extradition arrangements be scrutinised.

Shami Chakrabarti, director of Liberty said:

"The intervention of Liberty's sister, the American Civil Liberties Union, proves that Britain's Extradition Act is an international embarrassment. Vulnerable people like Gary McKinnon can be bundled off to other countries when they ought to be dealt with at home. Janis Sharp's campaign for fairness for her son Gary has touched the hearts of parents everywhere. If Parliament doesn't amend Britain's rotten Extradition Act to put discretion and common sense back into the system, other vulnerable sons and daughters are bound to suffer."



Chakrabarti and Sharp outside the US Embassy on Thursday

Technology company Fujitsu is to make up to 1,200 UK employees redundant by the end of the year.

The firm said in a statement on Wednesday that it was making the UK job cuts due to "lower than anticipated revenues".

"Fujitsu has proposed this measure reluctantly," said the statement. "However, action is necessary to ensure that the company remains competitive in the current difficult global economic climate."

A spokesperson for the company told ZDNet UK on Wednesday that Fujitsu had not yet decided which of its workforce would be made redundant, and that the cuts would be made following a consultation process involving employee union representatives.

The job cuts are not linked to the company's decision to close its final salary pension scheme, said the spokesperson. Unite, the UK's largest union, said at the beginning of the month that Fujitsu planned to dismiss employees on the scheme, and re-employ them on a different pension plan.

The firm is still in the running for a UK government ID card contract, the spokesperson added.

Fujitsu has an annual revenue in the UK of £2bn, and currently employs approximately 12,500 people. More detailed UK revenue figures were not available at the time of writing. However, Fujitsu's Q1 financial results, published in July, reported a consolidated net loss of 29.1bn yen (£186m) for the corporation.

The next version of Apple's OS X, which is due out on Friday, may bundle antivirus capabilities.

Mac security firm Intego said that the latest version of Snow Leopard would have an antimalware feature, according to reports, in a blog post on Wednesday.

The company published a screenshot which it said was of the security feature detecting a Trojan in a download, made via Apple's Safari web browser.

Intego pointed out that the most recent Mac adverts compare Mac security favourably to PCs. However, security experts have historically been divided over the relative security of Microsoft and Apple code, while some point out that any comparison is further complicated by the differing market penetration of Macs and PCs.

The Identity and Passport Service has said that getting rid of ID cards won't save the taxpayer £3bn over 10 years — as the costs are to be met by people who apply for passports and ID cards.

A detailed study published on Thursday said that the government would save £3.1bn by scrapping the scheme. However, the Identity and Passport Service (IPS) said on Friday that the government wouldn't be paying for the cards, and that it was people that want a passport who would meet the costs.

"The claim that ditching ID cards would save £3bn is wrong," said the IPS in a statement. "During the next ten years, the operational costs of the National Identity Service will be funded by income from IPS services and products. If ID cards are cancelled, there will be no fees to be earned and so there will not be a pot of money available to be saved or spent elsewhere. We have always been very open about ID card costs and we will be publishing the latest National Identity Service cost report in the autumn."

The statement did not address the "pot of money" that could be saved by passport applicants should the government ID card scheme be scrapped.