E-Cigarettes May Match The Patch In Helping Smokers Quit

iStockphoto.com

Electronic cigarettes are sparking lots of skepticism from public health types worried they may be a gateway to regular smoking.

But the cigarettes, which use water vapor to deliver nicotine into the lungs, may be as good as the patch when it comes to stop-smoking aids, a study finds.

Smokers who used e-cigarettes in an attempt to quit the old-fashioned kind of cigarettes did about as well at stopping smoking as the people who tried the patch.

After six months, 7.3 percent of e-smokers had dropped cigarettes, compared to 5.8 percent of people wearing the patch.

Either way, quitting is hard. The number of people who quit was low overall — just 38 of the 584 smokers given the e-cig or the patch. That wasn't enough people to say for sure that one approach was better than the other.

"What we couldn't show is that [e-cigarettes are] definitely superior to nicotine patches," says Christopher Bullen, an associate professor at the University of Auckland who led the research. He and his colleagues figured that the e-cigarettes would be much more successful, based on consumer surveys showing that people were less than pleased with the patch.

Still, Bullen says, the low quit rates are what you might expect when people are trying to quit without much counseling or support. That and the batteries kept failing in the early model e-cigarettes. "We had to keep sending out batteries," Bullen told Shots.

All that said, some e-cigarette users were able to reduce the number of cigarettes they smoked, even if they didn't quit.

The results were presented at the European Respiratory Society meeting in Barcelona and published in The Lancet.

The researchers recruited 584 smokers in Auckland, New Zealand, who wanted to stop smoking. Half were given e-cigarettes and the other half got coupons for nicotine patches, which are typically prescribed as a stop-smoking aid. Another 73 smokers were given e-cigs without nicotine, as a control.

Those people also made progress in quitting smoking, with 4 percent off tobacco after six months. "I think that speaks to the behavioral replacement," Bullen says. "They're oral. They're tactile. There's a ritualistic thing where you prepare the product and put it in your mouth and draw on it."

The number of children and teenagers using e-cigarettes more than doubled in a year, the Centers for Disease Control and Prevention reported this week. Numbers like that have public health officials in the United States worried that e-cigarettes will serve as a gateway to smoking cigarettes, which are much more toxic than e-cigarettes.

There's not yet evidence that that's happening, Bullen says. "I don't think that's an inevitable pathway." Efforts to regulate e-cigarettes could harm current smokers, he says. "For some people I think e-cigarettes will be part of the solution. But they're not going to be a magic bullet."

View the original article here

Hackers exploit critical IE bug; Microsoft promises patch

Microsoft today said that hackers are exploiting a critical, but unpatched, vulnerability in Internet Explorer 8 (IE8) and Internet Explorer 9 (IE9), and that its engineers are working on an update to plug the hole.

As it often does, the company downplayed the threat.

[ Windows 8 left you blue? Then check out Windows Red, InfoWorld's plan to fix Microsoft's contested OS. | Microsoft's new direction, the touch interface for tablet and desktop apps, the transition from Windows 7 -- InfoWorld covers all this and more in the Windows 8 Deep Dive PDF special report. | Stay atop key Microsoft technologies in our Technology: Microsoft newsletter. ]

"There are only reports of a limited number of targeted attacks specifically directed at Internet Explorer 8 and 9, although the issue could potentially affect all supported versions," Dustin Childs, a manager in the Trustworthy Computing group and its usual spokesman, said in a blog post Tuesday morning.

"We are actively working to develop a security update to address this issue," Childs added.

According to Childs and the security advisory Microsoft also published today, the vulnerability affects all supported versions of IE, from the 12-year-old IE6 to the not-yet-officially-released IE11, the browser that will accompany Windows 8.1 when it ships Oct. 18.

"There is no escaping this one," said Andrew Storms, director of DevOps at cloud security vendor CloudPassage, referring to the bug affecting all versions of Microsoft's browser. "IE zero-days are never a good thing, especially when they affect every version," Storms added.

Although Microsoft's advisory did not put it in these terms, the vulnerability can be exploited using classic "drive-by" attack tactics. That means hackers need only lure victims running IE to malicious sites -- or legitimate websites that have previously been compromised and loaded with attack code -- to hijack their browser and plant malware on their Windows PCs.

Until Microsoft produces a patch, the company offered customers several options to protect themselves, including advice on configuring EMET 4.0 and running one of its "Fixit" automated tools to "shim" the DLL that contains the IE rendering engine.

EMET (Enhanced Mitigation Experience Toolkit) is a tool designed for advanced users, primarily enterprise IT professionals, that manually enables anti-exploit technologies such as ASLR (address space layout randomization) and DEP (data execution prevention) for specific applications.

But the Fixit route will be easiest for individual users: Microsoft's posted a link to the Fixit tool on its support site, and customers need only click the icon marked "Enable." Microsoft has used the shim approach before when faced with unexpected attacks against IE.

View the original article here

Microsoft will still patch Windows XP for a select group

Just because Microsoft doesn't plan on giving Windows XP patches to the public after April 8, 2014, doesn't mean it's going to stop making those patches.

In fact, Microsoft will be creating security updates for Windows XP for months—years, even—after it halts their delivery to the general public.

Those patches will come from a program called "Custom Support," an after-retirement contract designed for very large customers who have not, for whatever reason, moved on from an older OS.

As part of Custom Support—which according to analysts, costs about $200 per PC for the first year and more each succeeding year—participants receive patches for vulnerabilities rated "critical" by Microsoft. Bugs ranked as "important," the next step down in Microsoft's four-level threat scoring system, are not automatically patched. Instead, Custom Support contract holders must pay extra for those. Flaws pegged as "moderate" or "low" are not patched at all.

"Legacy products or out-of-support service packs covered under Custom Support will continue to receive security hotfixes for vulnerabilities labeled as 'Critical' by the MSRC [Microsoft Security Response Center]," Microsoft said in a Custom Support data sheet. "Customers with Custom Support that need security patches defined as 'Important' by MSRC can purchase these for an additional fee.

"These security hotfixes will be issued through a secure process that makes the information available only to customers with Custom Support," the data sheet promised.

Because Microsoft sells Custom Support agreements, it's obligated to come up with patches for critical and important vulnerabilities. And it may be required to do so for years: The company sells Custom Support for up to three years after it retires an operating system.

Custom Support and the XP security updates that result have been one reason why some experts have held out hope that Microsoft will backtrack from retiring XP next April. Their reasoning is straightforward: Microsoft will have patches available—its engineers won't have to do any more work than they already committed to doing—so handing them out to all would be a simple matter.

Or not. Most experts have said that the chance Microsoft will prolong Windows XP's life run between slim and none. And giving away patches to everyone risks a revolt by those big customers who have paid millions for Custom Support.

But Microsoft does have options. Here are our suggestions:

If Windows XP remains a major presence, as it appears likely, with projections as high as 33.5 percent of all personal computers at the end of April 2014, Microsoft could decide to continue patching the aged OS with free fixes for critical vulnerabilities, maybe even those rated important.

Such a move would be unpalatable to Custom Support customers, but Microsoft could renegotiate the fees—unlikely—or remind those companies of the program's other benefits, which include access to support representatives, as well as to prior patches and hotfixes.

Microsoft could selectively patch only the critical bugs that are being exploited by hackers. Presumably, that would be a subset of the complete XP patch collection assembled each month.

Some analysts have picked this option as a possibility. Last December, Michael Cherry of Directions on Microsoft posed just such a situation.

"Suppose ... a security problem with XP suddenly causes massive problems on the Internet, such as a massive [denial-of-service] problem?" asked Cherry at the time. "It is not just harming Windows XP users, it is bringing the entire Internet to its knees. At this time there are still significant numbers of Windows XP in use, and the problem is definitely due to a problem in Windows XP. In this scenario, I believe Microsoft would have to do the right thing and issue a fix ... without regard to where it is in the support lifecycle."

Although Microsoft would much rather book revenue from the sale of a newer OS, it may realize that some will refuse to upgrade, and try to make money rather than give away fixes.

It's unlikely that Microsoft would be able to charge $200 annually for post-retirement patches, as it does with Custom Support customers, but it may be able to get away with $50 a year for individuals and small businesses, perhaps with a maximum machine cap at, say, five PCs per customer.

Traditionally, Microsoft's not charged for support, but it could cast this as a special situation caused by the longevity of XP, which was due to the delay of Vista and secondarily, that OS's subsequent flop. In late 2007, when Microsoft extended XP availability to OEMs by several months, it cited Vista's delayed launch for the unusual move. (It added another extension in 2008 that kept XP alive on new "netbook" PCs, the then-popular class of cheap laptops, until mid-2010.)

And Microsoft has talked up a transformation to a "devices-and-services" company; a pay-for-support plan would mesh nicely with the latter half of that strategy.

For several months late last year and through January 2013, Microsoft sold Windows 8 Pro upgrades for $40: It has not revived the cheaper prices since.

Microsoft might try another discount to nudge XP users off the creaky OS, pitching them either Windows 8.1, the update slated for a mid-October debut, or less likely, the option of moving from XP to Windows 7.

The latter would violate Microsoft's standing policy of shutting down retail sales of the preceding edition a year after the launch of a successor, but it might be worthwhile to backpedal to squeeze some money out of the XP situation without facing the backlash when customers complain that they're being pushed to adopt the radically-changed Windows 8.1.

Some revenue, in other words, would be better than no revenue, even if Microsoft had to eat crow and offer Windows 7 as an option.

Microsoft could get creative and blend one or more promotions. A combination of a pay-for-patches program with a discounted upgrade would, for instance, let Microsoft charge more, say $100, and effective "hide" a higher price for the patches in the total. A blended deal like that could also come with a definitive end to patching, even for a price, with Microsoft pledging to provide security updates for only one year, at which time the user would be expected to apply the Windows 7 or Windows 8 upgrade.

Microsoft may believe that none of the above are called for. One possible rationale for that thought: It's unlikely that any would have a significant impact in China, where an estimated 72 percent of all personal computers run Windows XP, or other emerging markets where cash is tight.

The standard thinking is that the bulk of those Chinese PCs are running a pirated copy of XP, and because of that, as well as lower consumer incomes there and in similar markets, any program that comes with extra fees would be dismissed out of hand.

Giving away patches for a longer period might help stifle exploits of XP PCs in China, for example—and thus indirectly protect the global Windows ecosystem—but even then, Microsoft may see no point in being generous. Most security experts believe few Chinese PC owners download and install patches, even though they can, because of their heavy reliance on pirated operating systems and an accompanying distrust of updates that they assume will sniff out the counterfeit and render it useless.

Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news.
More by Gregg Keizer, Computerworld

View the original article here